[herber]

Note

Medium Risk
New networked execution and filesystem paths with token handling and automatic retries; mistakes could affect remote machine state or leak credentials in headers, though scope is isolated to the new sandbox module and Magnetar machine helpers.

Overview
Adds a new metorial.sandbox client for live access to sandbox machines: files (list/read/write/move/delete over a multiplexed WebSocket), shell (spawn processes, stream stdout/stderr, run one-shot commands), and port (HTTP to an exposed machine port with token refresh on 401).

MagnetarSandboxMachinesGroup now exposes files(), shell(), and connect(port), which mint short-lived access grants via existing access.files / access.shell / access.ports APIs and wire them through SandboxAccessCache. Shared MuxSocket handles token auth, reconnect, and connection notices; file ops add chunked uploads, retries, and selective resend rules.

Public SDK surface re-exports sandbox types from metorial. tests/test_sandbox.py exercises the stack against a fake aiohttp server.

^{Reviewed by Cursor Bugbot for commit 5c35775. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5c35775. Configure here.}

[cursor]

Failed connect leaks HTTP clients

High Severity

SandboxFiles.connect and SandboxShell.connect do not close the mux socket when ensure_open fails or is cancelled, so the aiohttp.ClientSession created in _connect (and a live websocket if connect finishes after cancel) is abandoned. SandboxPort.connect has the same gap for its owned httpx.AsyncClient when access.get raises.

Additional Locations (2)

• src/metorial/sandbox/shell.py#L147-L154
• src/metorial/sandbox/port.py#L29-L40

 

^{Reviewed by Cursor Bugbot for commit 5c35775. Configure here.}

[cursor]

Command output handlers miss early data

Medium Severity

command registers the caller’s on_stdout and on_stderr only after await spawn(...). Because spawn already yielded on send, the reader can deliver output (or even exit) before those handlers are attached, so streaming callbacks silently miss data even though result.stdout / result.stderr stay complete.

 

^{Reviewed by Cursor Bugbot for commit 5c35775. Configure here.}