Built-in sandbox SHIM: a requests-compatible module for the model's Python
sandbox, backed PURELY by the stdlib urllib.request — NO host/JVM bridge,
NOT a line of Clojure or babashka. requests is a third-party wheel that does
not ship in GraalPy, so agents that reach for import requests out of habit
would otherwise hit ModuleNotFoundError; this extension contributes a
:ext/sandbox-shims entry that env-python/build-agent-context installs into
every sandbox Context (main + every sub_loop fork).
Because every call travels through the sandbox's OWN socket (urllib ->
http.client -> socket), it automatically honours the network toggle
(allowHostSocketAccess) AND the allow/deny + anti-SSRF network-guard-python
— a JVM babashka.http-client bridge would open an egress path OUTSIDE the
sandbox and disarm all of that, which is exactly why this stays 100% Python.
Unlike shim-yaml/shim-matplotlib there are NO :shim/bindings: the shim is
a self-contained Python preamble with zero host callables. It publishes a
requests module into sys.modules (so import requests works) and staples
it onto builtins (so requests.get(...) works with NO import, like json/os).
Built-in sandbox SHIM: a `requests`-compatible module for the model's Python sandbox, backed PURELY by the stdlib `urllib.request` — NO host/JVM bridge, NOT a line of Clojure or babashka. `requests` is a third-party wheel that does not ship in GraalPy, so agents that reach for `import requests` out of habit would otherwise hit ModuleNotFoundError; this extension contributes a `:ext/sandbox-shims` entry that `env-python/build-agent-context` installs into every sandbox Context (main + every `sub_loop` fork). Because every call travels through the sandbox's OWN socket (urllib -> http.client -> socket), it automatically honours the network toggle (`allowHostSocketAccess`) AND the allow/deny + anti-SSRF `network-guard-python` — a JVM `babashka.http-client` bridge would open an egress path OUTSIDE the sandbox and disarm all of that, which is exactly why this stays 100% Python. Unlike `shim-yaml`/`shim-matplotlib` there are NO `:shim/bindings`: the shim is a self-contained Python preamble with zero host callables. It publishes a `requests` module into `sys.modules` (so `import requests` works) and staples it onto builtins (so `requests.get(...)` works with NO import, like json/os).
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |