Repository navigation
feat(extensions): Python code tools, run in a process of their own (admins only) - #103
Merged
Merged
Conversation
…dmins only) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JroZmoXJUKvyfkvDYvmbka
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before: an assistant tool's body could be a prompt, a web request or a canvas graph, but not code.
After: admins can write a tool in Python. Its
runis{type: python, code, seconds, network}, andcodedefinesrun(**args). The assistant calls it like any other tool, and "Try it" on the extension page runs it. The new-extension editor has a "Python tool" starter.How:
app/domain/code_tools.pyruns the code in its own Python process with these limits:-I -S -B), so standard library only, started in an empty temp folderseconds, max 60), memory, file size and open files, plus a wall-clock killnetwork: trueunshare -rnfor a private network namespace where the machine allows itWho can use it:
Audit hooks raise the bar but are not a wall, which is why this is admins only. A container or gVisor sandbox would let non-admins write code tools; that is noted as "refine later" in DEVLOG.
Tests: the full local suite passes (backend 480 passed; the known LibreOffice conversion test fails in this environment; frontend jest 628 passed, plus tsc and lint).
🤖 Generated with Claude Code
https://claude.ai/code/session_01JroZmoXJUKvyfkvDYvmbka
Generated by Claude Code