Address .NET SDK review feedback

Author: simongdavies

.github/workflows/ci.yml

@@ -114,7 +114,7 @@ jobs:
           components: rustfmt, clippy
           rustflags: ""
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7  # v5.2.0
         with:
           dotnet-version: '8.0.x'
 

.github/workflows/publish.yml

@@ -128,7 +128,7 @@ jobs:
           cache-key: release
           rustflags: ""
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7  # v5.2.0
         with:
           dotnet-version: '8.0.x'
 

src/sdk/dotnet/core/Api/HyperlightSandbox.Api.csproj

@@ -25,6 +25,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <InternalsVisibleTo Include="HyperlightSandbox.Extensions.AI" />
     <InternalsVisibleTo Include="HyperlightSandbox.Tests" />
   </ItemGroup>
 

src/sdk/dotnet/core/Api/Sandbox.cs

@@ -523,9 +523,9 @@ public Task RestoreAsync(SandboxSnapshot snapshot, CancellationToken cancellatio
     /// Releases the sandbox and all associated native resources.
     /// </summary>
     /// <remarks>
-    /// After disposal, all pinned tool callback delegates are freed,
-    /// allowing the GC to collect them. The native sandbox handle is
-    /// also released.
+    /// The native sandbox handle is released before pinned tool callback
+    /// delegates are freed. This keeps callbacks valid for the full native
+    /// drop path if the backend ever invokes them during cleanup.
     /// </remarks>
     public void Dispose()
     {
@@ -538,28 +538,34 @@ public void Dispose()
 
             _disposed = true;
 
+            ReleaseNativeHandle();
             FreePinnedDelegates();
 
-            // Release the native sandbox handle.
-            if (!_handle.IsInvalid)
-            {
-                _handle.Dispose();
-            }
-
             GC.SuppressFinalize(this);
         } // lock
     }
 
     /// <summary>
-    /// Destructor — ensures pinned GCHandles are freed even if the user
-    /// forgets to call <see cref="Dispose"/>. The <see cref="SandboxSafeHandle"/>
-    /// has its own finalizer for the native handle.
+    /// Destructor — ensures the native handle is released before pinned
+    /// GCHandles are freed even if the user forgets to call <see cref="Dispose"/>.
     /// </summary>
     ~Sandbox()
     {
+        ReleaseNativeHandle();
         FreePinnedDelegates();
     }
 
+    /// <summary>
+    /// Releases the native sandbox handle. Safe to call multiple times.
+    /// </summary>
+    private void ReleaseNativeHandle()
+    {
+        if (!_handle.IsInvalid)
+        {
+            _handle.Dispose();
+        }
+    }
+
     /// <summary>
     /// Frees all pinned tool callback delegates.
     /// Safe to call multiple times (idempotent).

src/sdk/dotnet/core/Api/SandboxBuilder.cs

@@ -29,6 +29,11 @@ public sealed class SandboxBuilder
     private bool _tempOutput;
     private SandboxBackend _backend = SandboxBackend.Wasm;
 
+    /// <summary>
+    /// Gets the backend configured for sandboxes built by this builder.
+    /// </summary>
+    internal SandboxBackend Backend => _backend;
+
     /// <summary>
     /// Sets the backend to use. Default is <see cref="SandboxBackend.Wasm"/>.
     /// </summary>

src/sdk/dotnet/core/Extensions.AI/CodeExecutionTool.cs

@@ -37,7 +37,11 @@ namespace HyperlightSandbox.Extensions.AI;
 /// </remarks>
 public sealed class CodeExecutionTool : IDisposable
 {
+    private const string WasmInitializationCode = "None";
+    private const string JavaScriptInitializationCode = "void 0;";
+
     private readonly Api.Sandbox _sandbox;
+    private readonly string _initializationCode;
     private Api.SandboxSnapshot? _snapshot;
     private bool _initialized;
     private bool _disposed;
@@ -53,6 +57,7 @@ public sealed class CodeExecutionTool : IDisposable
     public CodeExecutionTool(Api.SandboxBuilder builder)
     {
         ArgumentNullException.ThrowIfNull(builder);
+        _initializationCode = InitializationCodeFor(builder.Backend);
         _sandbox = builder.Build();
     }
 
@@ -140,8 +145,7 @@ public Api.ExecutionResult Execute(string code)
             {
                 // Initialize the sandbox runtime with a no-op, then snapshot
                 // the CLEAN state before any user code pollutes it.
-                // Use empty string that's valid in both Python ("") and JS ("").
-                _sandbox.Run("None");
+                _sandbox.Run(_initializationCode);
                 _snapshot = _sandbox.Snapshot();
                 _initialized = true;
             }
@@ -222,4 +226,11 @@ public void Dispose()
         // Only free what WE own. The sandbox cleans up via its own finalizer.
         _snapshot?.Dispose();
     }
+
+    internal static string InitializationCodeFor(Api.SandboxBackend backend) => backend switch
+    {
+        Api.SandboxBackend.Wasm => WasmInitializationCode,
+        Api.SandboxBackend.JavaScript => JavaScriptInitializationCode,
+        _ => throw new ArgumentOutOfRangeException(nameof(backend), backend, "Unknown sandbox backend."),
+    };
 }

src/sdk/dotnet/core/Extensions.AI/HyperlightSandbox.Extensions.AI.csproj

@@ -28,4 +28,8 @@
     <PackageReference Include="Microsoft.Extensions.AI" Version="9.5.0" />
   </ItemGroup>
 
+  <ItemGroup>
+    <InternalsVisibleTo Include="HyperlightSandbox.Tests" />
+  </ItemGroup>
+
 </Project>

src/sdk/dotnet/core/PInvoke/SafeNativeMethods.cs

@@ -67,6 +67,7 @@ private static IntPtr DllImportResolver(
         string rid = OperatingSystem.IsWindows() ? "win-x64" : "linux-x64";
         string runtimePath = Path.Join(
             assemblyDirectory, "runtimes", rid, "native", platformLibraryName);
+        List<string> searchedPaths = [runtimePath];
 
         if (File.Exists(runtimePath))
         {
@@ -75,6 +76,7 @@ private static IntPtr DllImportResolver(
 
         // Check assembly directory directly (local development)
         string localPath = Path.Join(assemblyDirectory, platformLibraryName);
+        searchedPaths.Add(localPath);
         if (File.Exists(localPath))
         {
             return NativeLibrary.Load(localPath);
@@ -87,12 +89,14 @@ private static IntPtr DllImportResolver(
         while (dir != null)
         {
             string cargoTarget = Path.Join(dir, "target", "debug", platformLibraryName);
+            searchedPaths.Add(cargoTarget);
             if (File.Exists(cargoTarget))
             {
                 return NativeLibrary.Load(cargoTarget);
             }
 
             string cargoTargetRelease = Path.Join(dir, "target", "release", platformLibraryName);
+            searchedPaths.Add(cargoTargetRelease);
             if (File.Exists(cargoTargetRelease))
             {
                 return NativeLibrary.Load(cargoTargetRelease);
@@ -102,8 +106,9 @@ private static IntPtr DllImportResolver(
         }
 #endif
 
-        // Fallback to default resolution
-        return IntPtr.Zero;
+        throw new DllNotFoundException(
+            $"Unable to load native library '{libraryName}'. Searched paths: " +
+            string.Join(Path.PathSeparator, searchedPaths));
     }
 
     // -----------------------------------------------------------------------

src/sdk/dotnet/core/Tests/HyperlightSandbox.Tests/CodeExecutionToolTests.cs

@@ -25,6 +25,15 @@ public void Create_WithBuilder_Succeeds()
         Assert.NotNull(tool);
     }
 
+    [Fact]
+    public void Create_WithJavaScriptBackend_Succeeds()
+    {
+        using var tool = new CodeExecutionTool(
+            new SandboxBuilder().WithBackend(SandboxBackend.JavaScript));
+
+        Assert.NotNull(tool);
+    }
+
     [Fact]
     public void Create_NullBuilder_ThrowsArgumentNullException()
     {
@@ -51,6 +60,16 @@ public void Execute_AfterDispose_ThrowsObjectDisposedException()
             tool.Execute("print('hello')"));
     }
 
+    [Theory]
+    [InlineData(SandboxBackend.Wasm, "None")]
+    [InlineData(SandboxBackend.JavaScript, "void 0;")]
+    public void InitializationCodeFor_UsesBackendNoOp(
+        SandboxBackend backend,
+        string expectedCode)
+    {
+        Assert.Equal(expectedCode, CodeExecutionTool.InitializationCodeFor(backend));
+    }
+
     // -----------------------------------------------------------------------
     // Tool registration
     // -----------------------------------------------------------------------

src/sdk/dotnet/core/Tests/HyperlightSandbox.Tests/JavaScriptBackendTests.cs

@@ -49,9 +49,19 @@ public void WithBackend_Default_IsWasm()
     {
         // Default backend requires module path (Wasm)
         var builder = new SandboxBuilder();
+        Assert.Equal(SandboxBackend.Wasm, builder.Backend);
         Assert.Throws<InvalidOperationException>(() => builder.Build());
     }
 
+    [Fact]
+    public void WithBackend_UpdatesBackendProperty()
+    {
+        var builder = new SandboxBuilder()
+            .WithBackend(SandboxBackend.JavaScript);
+
+        Assert.Equal(SandboxBackend.JavaScript, builder.Backend);
+    }
+
     // -----------------------------------------------------------------------
     // Lifecycle
     // -----------------------------------------------------------------------