Skip to content

fix(sandbox): pass NetworkSpec to boxlite 0.9.5 BoxOptions (#797) - #813

Merged
0xKT merged 2 commits into
EverMind-AI:mainfrom
truecallerabreham:fix/797-boxlite-network-spec
Oct 3, 2026
Merged

0xKT merged 2 commits into
EverMind-AI:mainfrom
truecallerabreham:fix/797-boxlite-network-spec

Conversation

@truecallerabreham

Copy link
Copy Markdown
Contributor

Fixes #797

Problem

pyproject.toml pins boxlite==0.9.5, where boxlite.BoxOptions replaced the separate string network and list allow_net keyword arguments with network: Optional[boxlite.NetworkSpec]:

  • Passing allow_net=False in BoxliteExecutor._ensure_box still sets extra_kwargs["network"] = "none", raising TypeError: argument 'network': 'str' object cannot be cast as 'NetworkSpec' on sandbox start.
  • Passing a domain allowlist (allow_net=["pypi.org", ...]) still sets extra_kwargs["allow_net"] = self._allow_net, raising TypeError: BoxOptions.__new__() got an unexpected keyword argument 'allow_net'.

Solution

  • Pass extra_kwargs["network"] = boxlite.NetworkSpec(mode="disabled") when self._allow_net is False.
  • Pass extra_kwargs["network"] = boxlite.NetworkSpec(mode="enabled", allow_net=self._allow_net) when isinstance(self._allow_net, list).
  • Leave network unset when self._allow_net is True.

Testing

  • Added TestBoxliteEnsureBoxNetworkSpec in tests/test_sandbox_unit.py covering allow_net=False, allow_net=[...], and allow_net=True.
  • pytest tests/test_sandbox_unit.py -k "TestBoxliteEnsureBoxNetworkSpec or TestBoxliteStartFailureCleanup" (6 passed).
  • ruff check and ruff format --check pass.

…AI#797)

boxlite 0.9.5 replaced the string `network` and list `allow_net` fields on
`BoxOptions` with `network: Optional[boxlite.NetworkSpec]`. Update
`BoxliteExecutor._ensure_box` to pass `boxlite.NetworkSpec(mode="disabled")`
when `allow_net=False` and `boxlite.NetworkSpec(mode="enabled", allow_net=...)`
when `allow_net` is a domain allowlist.

Fixes EverMind-AI#797
@0xKT
0xKT merged commit c18bba5 into EverMind-AI:main Oct 3, 2026
21 checks passed
@0xKT

0xKT commented Oct 3, 2026

Copy link
Copy Markdown
Member

Merged, thanks @truecallerabreham! Since the boxlite 0.9.5 bump, allow_net: false and domain allowlists crashed the sandbox at startup, so this brings network isolation back. The tests that check NetworkSpec in each mode are a good addition too. Thanks for the fix, and we'd be glad to see more contributions.

LivXue pushed a commit that referenced this pull request Oct 12, 2026
Fixes #797

### Problem
`pyproject.toml` pins `boxlite==0.9.5`, where `boxlite.BoxOptions`
replaced the separate string `network` and list `allow_net` keyword
arguments with `network: Optional[boxlite.NetworkSpec]`:
- Passing `allow_net=False` in `BoxliteExecutor._ensure_box` still sets
`extra_kwargs["network"] = "none"`, raising `TypeError: argument
'network': 'str' object cannot be cast as 'NetworkSpec'` on sandbox
start.
- Passing a domain allowlist (`allow_net=["pypi.org", ...]`) still sets
`extra_kwargs["allow_net"] = self._allow_net`, raising `TypeError:
BoxOptions.__new__() got an unexpected keyword argument 'allow_net'`.

### Solution
- Pass `extra_kwargs["network"] = boxlite.NetworkSpec(mode="disabled")`
when `self._allow_net is False`.
- Pass `extra_kwargs["network"] = boxlite.NetworkSpec(mode="enabled",
allow_net=self._allow_net)` when `isinstance(self._allow_net, list)`.
- Leave `network` unset when `self._allow_net is True`.

### Testing
- Added `TestBoxliteEnsureBoxNetworkSpec` in
`tests/test_sandbox_unit.py` covering `allow_net=False`,
`allow_net=[...]`, and `allow_net=True`.
- `pytest tests/test_sandbox_unit.py -k "TestBoxliteEnsureBoxNetworkSpec
or TestBoxliteStartFailureCleanup"` (`6 passed`).
- `ruff check` and `ruff format --check` pass.

Co-authored-by: Abreham Melese <xvimelese@gmail.com>
Co-authored-by: KT <74288668+0xKT@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

boxlite 0.9.5: allow_net=false crashes sandbox start (network is now a NetworkSpec)

3 participants