Modularize telemetry.py into a package with focused sub-modules

- Split telemetry.py into teaagent/telemetry/ package: _availability
  (HAS_OTEL flag), _config (TelemetryConfig, TelemetryNotAvailable),
  _audit (OTelAuditSink, configure_telemetry), _metrics
  (InMemoryMetricsSink, OTelMetricsSink, configure_metrics),
  _transport (TracingHTTPTransport)

Author: johnteee

CHANGELOG.md

@@ -6,7 +6,8 @@ All notable changes to TeaAgent are tracked here.
 
 - Split `teaagent/tui.py` (517 → ~290 lines) by extracting `handle_command` logic to `_commands.py`.
 - Split `teaagent/mcp_http.py` (575 → ~400 lines) by extracting OAuth endpoint handlers to `_oauth.py`.
-- Split `teaagent/telemetry.py` into a `teaagent/telemetry/` package with focused modules: `_deps.py`, `_config.py`, `_audit.py`, `_metrics.py`, and `_transport.py`.
+- Split `teaagent/telemetry.py` into a `teaagent/telemetry/` package with focused modules: `_availability.py`, `_config.py`, `_audit.py`, `_metrics.py`, and `_transport.py`.
+- Split `teaagent/code_mode.py` into a `teaagent/code_mode/` package with focused modules: `_types.py`, `_validation.py`, `_child_process.py`, and `_container.py`.
 - Made `teaagent.cli.main()` accept injectable `_adapter_factory`, `_serve_mcp_http`, `_check_graphqlite`, `_check_llm`, and `_run_model_conformance` keyword arguments, enabling handler extraction without breaking existing tests.
 - Split `teaagent/workspace_tools.py` into a `teaagent/workspace_tools/` package with four focused modules: `_config.py`, `_helpers.py`, `_shell.py`, `_files.py`. Backward-compatible public imports preserved via `__init__.py` re-exports.
 - Expanded audit string redaction with patterns for JWT tokens, AWS access keys (`AKIA...`), and GitHub personal access tokens (`ghp_...`, `github_pat_...`).

teaagent/code_mode/__init__.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+import ast
+from typing import Any
+
+from ._child_process import ChildProcessCodeModeBackend
+from ._container import CONTAINER_CODE_MODE_SCRIPT, ContainerCodeModeBackend
+from ._types import CodeModeBackend, CodeModeResult, CodeModeSandbox
+from ._validation import (
+    ALLOWED_NODES,
+    SAFE_BUILTINS,
+    UnsafeCodeError,
+    validate_plain_data,
+    validate_tree,
+)
+
+
+def execute_code_mode(
+    code: str,
+    *,
+    inputs: dict[str, Any] | None = None,
+    sandbox: CodeModeSandbox | None = None,
+    backend: CodeModeBackend | None = None,
+) -> CodeModeResult:
+    tree = ast.parse(code, mode='exec')
+    validate_tree(tree)
+    safe_inputs = dict(inputs or {})
+    validate_plain_data(safe_inputs, 'inputs')
+
+    active_sandbox = sandbox or CodeModeSandbox()
+    if active_sandbox.timeout_seconds <= 0:
+        raise UnsafeCodeError('Code Mode timeout must be positive')
+    if active_sandbox.cpu_seconds <= 0:
+        raise UnsafeCodeError('Code Mode CPU limit must be positive')
+    if active_sandbox.memory_bytes <= 0:
+        raise UnsafeCodeError('Code Mode memory limit must be positive')
+
+    return (backend or ChildProcessCodeModeBackend()).execute(
+        code, safe_inputs, active_sandbox
+    )
+
+
+__all__ = [
+    'ALLOWED_NODES',
+    'CONTAINER_CODE_MODE_SCRIPT',
+    'SAFE_BUILTINS',
+    'ChildProcessCodeModeBackend',
+    'CodeModeBackend',
+    'CodeModeResult',
+    'CodeModeSandbox',
+    'ContainerCodeModeBackend',
+    'UnsafeCodeError',
+    'execute_code_mode',
+]

teaagent/code_mode/_child_process.py

@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+import multiprocessing
+import traceback
+from contextlib import suppress
+from dataclasses import dataclass
+from typing import Any
+
+from ._types import CodeModeResult, CodeModeSandbox
+from ._validation import SAFE_BUILTINS, UnsafeCodeError, validate_plain_data
+
+try:
+    import resource
+except ImportError:  # pragma: no cover - resource is Unix-only.
+    resource = None  # type: ignore[assignment]
+
+
+@dataclass(frozen=True)
+class ChildProcessCodeModeBackend:
+    def execute(
+        self,
+        code: str,
+        inputs: dict[str, Any],
+        sandbox: CodeModeSandbox,
+    ) -> CodeModeResult:
+        parent_conn, child_conn = multiprocessing.Pipe(duplex=False)
+        process = multiprocessing.Process(
+            target=_execute_code_mode_child,
+            args=(code, inputs, sandbox, child_conn),
+        )
+        process.start()
+        process.join(sandbox.timeout_seconds)
+        if process.is_alive():
+            process.terminate()
+            process.join()
+            raise UnsafeCodeError('Code Mode timed out')
+
+        if parent_conn.poll():
+            message = parent_conn.recv()
+        else:
+            raise UnsafeCodeError('Code Mode sandbox exited without a result')
+
+        if message['status'] == 'error':
+            raise UnsafeCodeError(message['error'])
+        variables = message['variables']
+        validate_plain_data(variables, 'variables')
+        return CodeModeResult(variables=variables)
+
+
+def _execute_code_mode_child(
+    code: str,
+    inputs: dict[str, Any],
+    sandbox: CodeModeSandbox,
+    result_pipe: multiprocessing.connection.Connection,
+) -> None:
+    try:
+        _apply_resource_limits(sandbox)
+        namespace: dict[str, Any] = {'__builtins__': SAFE_BUILTINS}
+        namespace.update(inputs)
+        exec(compile(code, '<teaagent-code-mode>', 'exec'), namespace, namespace)
+        variables = {
+            key: value
+            for key, value in namespace.items()
+            if key != '__builtins__' and not key.startswith('_')
+        }
+        validate_plain_data(variables, 'variables')
+    except Exception as exc:  # pragma: no cover - exercised through parent process.
+        result_pipe.send(
+            {
+                'status': 'error',
+                'error': f'{type(exc).__name__}: {exc}',
+                'traceback': traceback.format_exc(),
+            }
+        )
+    else:
+        result_pipe.send({'status': 'ok', 'variables': variables})
+
+
+def _apply_resource_limits(sandbox: CodeModeSandbox) -> None:
+    if resource is None:
+        return
+    _, cpu_hard = resource.getrlimit(resource.RLIMIT_CPU)
+    resource.setrlimit(resource.RLIMIT_CPU, (sandbox.cpu_seconds, cpu_hard))
+    if hasattr(resource, 'RLIMIT_AS'):
+        _, hard = resource.getrlimit(resource.RLIMIT_AS)
+        soft = sandbox.memory_bytes
+        if hard != resource.RLIM_INFINITY:
+            soft = min(soft, hard)
+        with suppress(ValueError):
+            resource.setrlimit(resource.RLIMIT_AS, (soft, hard))