Secure filesystem primitives using dir_fd-relative operations with O_NOFOLLOW, O_NONBLOCK, FIFO/device rejection, O_EXCL write-new semantics, and inode-preserving writes. Demonstrates defense-in-depth for sandbox file access.

Trusted host worker that enters container namespaces via setns/chroot, binds paths with O_PATH fds, and removes files as arbitrary users via fork/setuid with CPU limits. A non-obvious pattern for safe cross-namespace file deletion.

Dependency injection container with value/factory bindings, caching, ownership tracking, and async lifecycle management. Clean abstraction for wiring sandbox session dependencies.

Span implementation with contextvars-based current-span scoping, generator-exit tolerance, and NoOpSpan fallback. Demonstrates robust async tracing that survives cancellation and generator finalization.

ToolContext extends RunContextWrapper with tool identity fields and routes approvals/rejections to nested agent-tool contexts via invocation identity matching. A well-designed context propagation pattern.

Prefix-based model routing (openai/, litellm/, any-llm/, custom map) with alias vs model_id prefix modes and unknown-prefix fallback. Enables transparent multi-provider model selection.

Core sandbox implementation with snapshot lifecycle, capability validation, and mount strategy coordination. Central to the sandbox abstraction.

Error handling and final output formatting with redaction support. Ensures sensitive data is stripped from errors and traces.