py-sandbox=true
os-sandbox=${OS_SANDBOX:-subprocess}

net=ALLOW|TCP|www.google.com|443|OUT

# Add rules (2026/09/10 at 07:22)
env=CONDA_HOME=${CONDA_HOME}
env=HOME=${HOME}
env=PWD=${PWD}
env=PYDANTIC_DISABLE_PLUGINS=${PYDANTIC_DISABLE_PLUGINS}
env=PYENV_ROOT=${PYENV_ROOT}
env=PYTHONUSERBASE=${PYTHONUSERBASE}
env=TEMP=${TEMP}
env=TMP=${TMP}
env=TMPDIR=${TMPDIR}

# ⚠ Dangerous!
python-import=atexit, importlib, inspect, subprocess

# Standard Python
python-import=__future__, _decimal, _hashlib, _markupbase, _multibytecodec, _queue
python-import=_socket, _sysconfigdata__linux_x86_64-linux-gnu, _zoneinfo, abc, array
python-import=ast, asyncio, base64, binascii, calendar, codecs, collections
python-import=colorsys, concurrent, contextlib, contextvars, copy, copyreg
python-import=dataclasses, datetime, decimal, email, encodings, enum, errno, fnmatch
python-import=fractions, functools, gettext, hashlib, heapq, hmac, html, http, io
python-import=ipaddress, itertools, json, keyword, logging, math, mimetypes
python-import=multiprocessing, numbers, operator, os, pathlib, pickle, platform
python-import=pprint, queue, random, re, reprlib, select, signal, socket, ssl, stat
python-import=stringprep, struct, sysconfig, tempfile, textwrap, threading, time
python-import=traceback, types, typing, unicodedata, urllib, uuid, weakref, zipfile
python-import=zlib, zoneinfo

# External modules (Are you sure about the origin?)
python-import=annotated_types
python-import=anyio
python-import=bs4
python-import=certifi
python-import=charset_normalizer
python-import=click
python-import=h11
python-import=httpcore
python-import=httpx
python-import=idna
python-import=jsonpatch
python-import=jsonpointer
python-import=langchain_core
python-import=langgraph_simple_chatbot
python-import=langsmith
python-import=markdownify
python-import=orjson
python-import=packaging
python-import=pydantic
python-import=pydantic_core
python-import=pygments
python-import=requests
python-import=requests_toolbelt
python-import=six
python-import=sniffio
python-import=soupsieve
python-import=tenacity
python-import=typing_extensions
python-import=typing_inspection
python-import=urllib3
python-import=zstandard

# The repository root, which uv installs as an editable dependency (see
# `[tool.uv.sources]`), so the sandbox must be able to read it. Relative to the
# working directory, which is this sample's own directory: an absolute `~/...`
# form only resolves on a machine that checked the repository out there, and
# fails on any CI runner. Learning mode cannot emit this form -- it never walks
# above PWD -- so `make learn` puts the absolute path back.
expose-ro=../..

net=ALLOW|TCP|ip6-localhost|0|IN
net=ALLOW|TCP|ip6-loopback|0|IN

# threads: concurrency primitives
python-api=ALLOW:threading.Thread.start
python-api=ALLOW:threading._start_joinable_thread

# Add rules (2026/09/10 at 10:01)
env=PSUTIL_DEBUG=${PSUTIL_DEBUG}
env=VIRTUAL_ENV=${VIRTUAL_ENV}

# Standard Python
python-import=_codecs_cn, _codecs_hk, _codecs_iso2022, _codecs_jp, _codecs_kr
python-import=_codecs_tw, argparse, bisect, fcntl, glob, pwd, resource, secrets
python-import=shlex, shutil, xml

# External modules (Are you sure about the origin?)
python-import=distro
python-import=httpx2
python-import=opentelemetry
python-import=psutil
python-import=uuid_utils
python-import=xxhash


# The calculator tool evaluates a string the model produced. `closed` rather
# than the adaptive default: the caller already passes {"__builtins__": {}},
# so the resulting namespace is identical, and a profile handling model output
# should declare its surface here rather than at the call site.
eval-namespace=closed
eval-syntax=arith, compare
eval-max-iterations=100_000
eval-timeout=2s

# Add rules (2026/09/21 at 08:57)
env=SSL_CERT_FILE=${SSL_CERT_FILE}

expose-ro=/proc


# Add rules (2026/09/21 at 08:57)
# Standard Python
python-import=_hmac

# External modules (Are you sure about the origin?)
python-import=annotationlib
python-import=compression

