diff --git a/Cargo.lock b/Cargo.lock index ac425a2..132fc99 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1675,7 +1675,7 @@ dependencies = [ [[package]] name = "sandbox-server" -version = "0.2.0" +version = "0.2.1" dependencies = [ "anyhow", "axum", @@ -1700,7 +1700,7 @@ dependencies = [ [[package]] name = "sandd" -version = "0.2.0" +version = "0.2.1" dependencies = [ "anyhow", "base64", @@ -1729,7 +1729,7 @@ dependencies = [ [[package]] name = "sandd-protocol" -version = "0.2.0" +version = "0.2.1" dependencies = [ "base64", "serde", diff --git a/Makefile b/Makefile index 4bdd216..63510eb 100644 --- a/Makefile +++ b/Makefile @@ -210,12 +210,18 @@ build-wheels-linux: @echo "Building for Linux aarch64..." docker run --rm --platform linux/arm64 -v $$(pwd):/io ghcr.io/pyo3/maturin build --release -m /io/server/Cargo.toml -# Build all wheels (local + Linux if Docker available) -build-wheels: build-wheels-local build-wheels-linux - -# Upload wheels to PyPI +# Build all wheels (local + Linux). Starts from an empty target/wheels so only this +# version is uploaded: publish-pypi uploads everything in it, and a leftover wheel +# from an earlier version bump once got published by accident. +build-wheels: + rm -rf target/wheels + $(MAKE) build-wheels-local build-wheels-linux + +# Upload wheels to PyPI. Exported so `make publish-pypi INFTYAI_PYPI_TOKEN=...` also +# reaches the recipe through the environment. +export INFTYAI_PYPI_TOKEN publish-pypi: $(MATURIN) build-wheels - @if [ -z "$(INFTYAI_PYPI_TOKEN)" ]; then \ + @if [ -z "$$INFTYAI_PYPI_TOKEN" ]; then \ echo "Error: INFTYAI_PYPI_TOKEN environment variable not set"; \ exit 1; \ fi @@ -225,7 +231,9 @@ publish-pypi: $(MATURIN) build-wheels fi @echo "Uploading wheels to PyPI..." @ls target/wheels/*.whl - $(MATURIN) upload target/wheels/*.whl --skip-existing --username __token__ --password $(INFTYAI_PYPI_TOKEN) + @# The token goes in via the environment, never argv: a make-echoed or `ps`-visible + @# command line would expose it. + @MATURIN_PYPI_TOKEN="$$INFTYAI_PYPI_TOKEN" $(MATURIN) upload --skip-existing target/wheels/*.whl # Publish one crate unless that exact version is already on crates.io. cargo has # no --skip-existing, and crates.io is append-only, so reruns of a partially diff --git a/README.md b/README.md index 1eaa2f9..f6bac02 100644 --- a/README.md +++ b/README.md @@ -130,7 +130,7 @@ curl -fsSL https://raw.githubusercontent.com/InftyAI/SandD/main/hack/scripts/ins This installs the latest release to `/usr/local/bin/sandd`. To pin a specific version: ```bash -curl -fsSL https://raw.githubusercontent.com/InftyAI/SandD/main/hack/scripts/install.sh | sudo bash -s -- --version v0.2.0 +curl -fsSL https://raw.githubusercontent.com/InftyAI/SandD/main/hack/scripts/install.sh | sudo bash -s -- --version v0.2.1 ``` #### Alternative Methods diff --git a/hack/docker/Dockerfile.daemon-tunnel-release b/hack/docker/Dockerfile.daemon-tunnel-release index 5e990a6..cbc58ff 100644 --- a/hack/docker/Dockerfile.daemon-tunnel-release +++ b/hack/docker/Dockerfile.daemon-tunnel-release @@ -2,9 +2,9 @@ # Downloads pre-built binary from GitHub releases # # Build: docker build -f hack/docker/Dockerfile.daemon-tunnel-release \ -# --build-arg SANDD_VERSION=v0.2.0 \ -# -t inftyai/sandd-tunnel:v0.2.0 . -# Run: docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-tunnel:v0.2.0 +# --build-arg SANDD_VERSION=v0.2.1 \ +# -t inftyai/sandd-tunnel:v0.2.1 . +# Run: docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-tunnel:v0.2.1 FROM debian:bookworm-slim @@ -23,7 +23,7 @@ RUN apt-get update && apt-get install -y \ RUN curl -fsSL https://tailscale.com/install.sh | sh # Download pre-built daemon binary from GitHub releases -ARG SANDD_VERSION=v0.2.0 +ARG SANDD_VERSION=v0.2.1 ARG TARGETOS=linux ARG TARGETARCH=amd64 diff --git a/hack/docker/Dockerfile.server-tunnel-release b/hack/docker/Dockerfile.server-tunnel-release index 1c8a9f7..e5cff1e 100644 --- a/hack/docker/Dockerfile.server-tunnel-release +++ b/hack/docker/Dockerfile.server-tunnel-release @@ -2,9 +2,9 @@ # Uses published PyPI package instead of building from source # # Build: docker build -f hack/docker/Dockerfile.server-tunnel-release \ -# --build-arg SANDD_VERSION=0.2.0 \ -# -t inftyai/sandd-server-tunnel:v0.2.0 . -# Run: docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-server-tunnel:v0.2.0 +# --build-arg SANDD_VERSION=0.2.1 \ +# -t inftyai/sandd-server-tunnel:v0.2.1 . +# Run: docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-server-tunnel:v0.2.1 FROM python:3.11-slim-bookworm @@ -23,7 +23,7 @@ RUN apt-get update && apt-get install -y \ RUN curl -fsSL https://tailscale.com/install.sh | sh # Install SandD from PyPI (specify version or use latest) -ARG SANDD_VERSION=0.2.0 +ARG SANDD_VERSION=0.2.1 RUN pip install --no-cache-dir sandd==${SANDD_VERSION} # Create directory for Tailscale state diff --git a/hack/docker/README.md b/hack/docker/README.md index 9d93d71..e149c3f 100644 --- a/hack/docker/README.md +++ b/hack/docker/README.md @@ -15,7 +15,7 @@ This directory contains Docker-related files for building and testing SandD. - **`Dockerfile.server-tunnel-release`** - Server with Tailscale (uses PyPI release) - Use: Production deployments - - Build: `docker build -f hack/docker/Dockerfile.server-tunnel-release --build-arg SANDD_VERSION=0.2.0 -t inftyai/sandd-server-tunnel:v0.2.0 .` + - Build: `docker build -f hack/docker/Dockerfile.server-tunnel-release --build-arg SANDD_VERSION=0.2.1 -t inftyai/sandd-server-tunnel:v0.2.1 .` #### Daemon (Worker) Images @@ -25,7 +25,7 @@ This directory contains Docker-related files for building and testing SandD. - **`Dockerfile.daemon-tunnel-release`** - Daemon with Tailscale (uses GitHub release) - Use: Production deployments - - Build: `docker build -f hack/docker/Dockerfile.daemon-tunnel-release --build-arg SANDD_VERSION=v0.2.0 -t inftyai/sandd-tunnel:v0.2.0 .` + - Build: `docker build -f hack/docker/Dockerfile.daemon-tunnel-release --build-arg SANDD_VERSION=v0.2.1 -t inftyai/sandd-tunnel:v0.2.1 .` #### Test Images (Direct Mode) @@ -68,7 +68,7 @@ Overridable variables: `SERVER_TUNNEL_IMG`, `SERVER_TUNNEL_TAG`, `PLATFORMS`, ```bash make docker-push-server-tunnel \ - SERVER_TUNNEL_IMG=myrepo/sandd-server-tunnel SERVER_TUNNEL_TAG=v0.2.0 + SERVER_TUNNEL_IMG=myrepo/sandd-server-tunnel SERVER_TUNNEL_TAG=v0.2.1 ``` To iterate locally you need a **runnable** image, which a multi-platform build cannot diff --git a/protocol/Cargo.toml b/protocol/Cargo.toml index 5d3f239..e139113 100644 --- a/protocol/Cargo.toml +++ b/protocol/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "sandd-protocol" -version = "0.2.0" +version = "0.2.1" edition = "2021" license = "Apache-2.0" description = "Shared wire protocol types for the SandD sandbox daemon and controller." diff --git a/pyproject.toml b/pyproject.toml index 63947ad..818e93d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "maturin" [project] name = "sandd" -version = "0.2.0" +version = "0.2.1" description = "A lightweight sandbox daemon for secure agent execution in isolated environments." readme = {file = "README.md", content-type = "text/markdown"} requires-python = ">=3.8" diff --git a/sandd/Cargo.toml b/sandd/Cargo.toml index a429811..01cb982 100644 --- a/sandd/Cargo.toml +++ b/sandd/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "sandd" -version = "0.2.0" +version = "0.2.1" edition = "2021" license = "Apache-2.0" description = "A lightweight sandbox daemon for secure agent execution in isolated environments." @@ -30,7 +30,7 @@ path = "../examples/snapshot_real_project.rs" [dependencies] # `version` is required to publish: cargo strips `path` and resolves the # dependency from crates.io, so sandd-protocol must be published first. -sandd-protocol = { path = "../protocol", version = "0.2.0" } +sandd-protocol = { path = "../protocol", version = "0.2.1" } tokio = { workspace = true } serde = { workspace = true } serde_json = { workspace = true } diff --git a/server/Cargo.toml b/server/Cargo.toml index c8d1960..bafce7c 100644 --- a/server/Cargo.toml +++ b/server/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "sandbox-server" -version = "0.2.0" +version = "0.2.1" edition = "2021" license = "Apache-2.0" description = "A lightweight sandbox daemon for secure agent execution in isolated environments." @@ -39,7 +39,7 @@ parking_lot = "0.12" # [features] below). With extension-module set, pyo3 deliberately leaves the CPython # symbols undefined for an interpreter to supply at dlopen time, so a plain `cargo # test` linking it would fail (loudly on macOS, subtly elsewhere). -pyo3 = { version = "0.20", features = ["extension-module", "anyhow"], optional = true } +pyo3 = { version = "0.20", features = ["extension-module", "anyhow", "abi3-py38"], optional = true } pythonize = { version = "0.20", optional = true } # Base64 for protocol