Remove asteval from graalos demo story, it's confusing

Author: timfel

graalpython/com.oracle.graal.python.test/src/tests/graalos/GRAALOS_DEMO.md

@@ -1,38 +1,24 @@
 # GraalOS Standalone Sandbox Demo
 
-This demo shows a small chat-style expression evaluator running inside the
+This demo shows a small chat-style Python evaluator running inside the
 GraalPy GraalOS standalone.
 
 The story:
 
 1. `rich` renders a friendly terminal UI.
-2. `asteval` evaluates normal user expressions with an application-level
-   restricted evaluator. This demo also removes `open` from that evaluator.
-3. `/unsafe ...` expressions deliberately bypass `asteval` and use Python
-   `eval` directly.
-4. The process is still inside the GraalOS sandbox, so file, subprocess,
+2. The demo treats each entered expression as untrusted Python code, such as
+   code produced by an LLM agent or pasted by a human operator.
+3. The process is inside the GraalOS sandbox, so file, subprocess,
    network, and native library attempts remain contained.
 
 ## Setup
 
-From the standalone directory, install `pip` inside the sandbox, then
-install the demo wheels from a host-downloaded wheel cache:
-
-```bash
-./bin/graalpy -Im ensurepip
-python3 -m pip download --only-binary=:all: --dest demo-wheels rich asteval
-./bin/graalpy -Im pip install --no-index --find-links /demo-wheels rich asteval
-```
-
-The online download is intentionally done outside the sandbox. The sandboxed
-standalone has no outbound network mapping by default, which is one of the
-things the demo can show.
-
-### GRAALOS-8260 workaround
-
-There is currently a bug in GraalOS that prevents the above ensurepip command
-from working. Until it is fixed, we can install the pure-Python wheels from the
-host directly into the standalone's `site-packages`:
+We can install the `rich` wheel directly into the standalone's `site-packages`
+using any standard Python. While we could run `ensurepip` and `pip` inside the
+sandbox by configuring the appropriate network access, we do this here
+intentionally done outside the sandbox. The sandboxed standalone has no
+outbound network mapping by default, which is one of the things the demo can
+show.
 
 ```bash
 python3 -m pip install \
@@ -43,12 +29,9 @@ python3 -m pip install \
   --abi none --abi graalpy250_312_native \
   --platform any --platform graalos_x86_64 \
   --no-compile \
-  rich asteval
+  rich
 ```
 
-Use this workaround only for pure-Python wheels such as `py3-none-any`; native
-wheels need GraalOS/GraalPy-specific handling.
-
 There should be a file `test_graalos_sandbox_chat.py` in this directory. If
 not, find it in and copy it from the GraalPy source repository. From inside the
 sandbox that file is available as `/test_graalos_sandbox_chat.py`, so run:
@@ -71,21 +54,15 @@ Start with a normal expression:
 sum([i*i for i in range(1000)])
 ```
 
-Then show that the app-level evaluator blocks direct file access:
+Then move on to untrusted code that tries to access host resources:
 
 ```python
 open('/etc/passwd').read()
-```
-
-Switch to `/unsafe` mode to bypass the app-level evaluator while keeping the
-outer GraalOS sandbox:
-
-```python
-/unsafe open('/etc/passwd').read().splitlines()[:3]
-/unsafe open('/etc/shadow').read()
-/unsafe __import__('subprocess').run(['/bin/sh', '-c', 'id'], capture_output=True, text=True)
-/unsafe __import__('socket').create_connection(('example.com', 80), timeout=2)
-/unsafe __import__('ctypes').CDLL('libc.so').system(b'cat /etc/shadow')
+open('/etc/passwd').read().splitlines()[:3]
+open('/etc/shadow').read()
+__import__('subprocess').run(['/bin/sh', '-c', 'id'], capture_output=True, text=True)
+__import__('socket').create_connection(('example.com', 80), timeout=2)
+__import__('ctypes').CDLL('libc.so').system(b'cat /etc/shadow')
 ```
 
 Expected result: harmless operations work or fail normally; sensitive host
@@ -95,7 +72,7 @@ filesystem, process namespace, and configured network policy. The native
 
 ## Why This Is Useful
 
-`asteval` is an application-level guardrail. It reduces accidental exposure but
-it is not a complete containment boundary. GraalOS is the outer boundary: even
-if application logic accidentally evaluates dangerous code in `/unsafe` mode,
-the runtime still mediates filesystem, subprocess, native, and network behavior.
+This is a deliberately unsafe application pattern: it evaluates untrusted Python
+code directly. That is useful for demonstrating the actual containment boundary.
+GraalOS is that boundary, and it mediates filesystem, subprocess, native, and
+network behavior even when the application itself offers no extra guardrails.

graalpython/com.oracle.graal.python.test/src/tests/graalos/test_graalos_sandbox_chat.py

@@ -37,7 +37,7 @@
 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
-"""Small Rich + asteval demo for the GraalOS standalone sandbox."""
+"""Small Rich demo for the GraalOS standalone sandbox."""
 
 from __future__ import annotations
 
@@ -59,39 +59,12 @@ class EvalResult:
     ok: bool
     output: str
     elapsed_ms: float
-
-
-def make_interpreter():
-    from asteval import Interpreter
-    aeval = Interpreter()
-    # Keep the demo's "safe" lane expression-oriented. GraalOS is the real
-    # containment boundary; this prevents the app-level evaluator from opening files.
-    aeval.symtable.pop("open", None)
-    return aeval
-
-
 def render_message(role: str, body: str, style: str) -> None:
     from rich.panel import Panel
     from rich.text import Text
     console.print(Panel(Text(body), title=role, title_align="left", border_style=style))
 
 
-def safe_eval(aeval, expr: str):
-    start = time.perf_counter()
-    aeval.error = []
-    try:
-        value = aeval(expr)
-    except Exception as exc:  # asteval normally records errors instead of raising
-        elapsed = (time.perf_counter() - start) * 1000
-        return EvalResult("asteval", False, f"{type(exc).__name__}: {exc}", elapsed)
-
-    elapsed = (time.perf_counter() - start) * 1000
-    if aeval.error:
-        errors = "\n".join(str(err.get_error()) for err in aeval.error)
-        return EvalResult("asteval", False, errors, elapsed)
-    return EvalResult("asteval", True, repr(value), elapsed)
-
-
 def unsafe_eval(expr: str):
     start = time.perf_counter()
     try:
@@ -117,27 +90,23 @@ def render_result(result) -> None:
     render_message("sandbox", result.output, "green" if result.ok else "red")
 
 
-def evaluate(aeval, line: str) -> None:
+def evaluate(line: str) -> None:
     line = line.strip()
     if not line:
         return
-    if line.startswith("/unsafe "):
-        expr = line[len("/unsafe ") :].strip()
-        render_result(unsafe_eval(expr))
-    else:
-        render_result(safe_eval(aeval, line))
+    render_result(unsafe_eval(line))
 
 
 def demo_script() -> list[str]:
     return [
         "sum([i*i for i in range(1000)])",
         "sin(pi / 4) ** 2 + cos(pi / 4) ** 2",
         "open('/etc/passwd').read()",
-        "/unsafe open('/etc/passwd').read().splitlines()[:3]",
-        "/unsafe open('/etc/shadow').read()",
-        "/unsafe __import__('subprocess').run(['/bin/sh', '-c', 'id'], capture_output=True, text=True)",
-        "/unsafe __import__('socket').create_connection(('example.com', 80), timeout=2)",
-        "/unsafe __import__('ctypes').CDLL('libc.so').system(b'cat /etc/shadow')",
+        "open('/etc/passwd').read().splitlines()[:3]",
+        "open('/etc/shadow').read()",
+        "__import__('subprocess').run(['/bin/sh', '-c', 'id'], capture_output=True, text=True)",
+        "__import__('socket').create_connection(('example.com', 80), timeout=2)",
+        "__import__('ctypes').CDLL('libc.so').system(b'cat /etc/shadow')",
     ]
 
 
@@ -146,10 +115,10 @@ def print_intro() -> None:
         """
         Type Python expressions and get chat-style results.
 
-        Normal input uses asteval, a restricted expression evaluator.
-        Prefix with /unsafe to bypass asteval and use Python eval directly.
-        The process is still inside the GraalOS sandbox, so filesystem,
-        subprocess, native library, and network attempts remain contained.
+        This demo treats each expression as untrusted Python code, such as
+        code proposed by an LLM agent or pasted by a human operator.
+        GraalOS sandboxes that code, so filesystem, subprocess, native
+        library, and network attempts remain contained.
 
         Commands: /demo, /help, /quit
         """
@@ -164,7 +133,6 @@ def print_help() -> None:
 
 
 def interactive() -> int:
-    aeval = make_interpreter()
     print_intro()
     while True:
         try:
@@ -179,22 +147,20 @@ def interactive() -> int:
             print_help()
             continue
         if command == "/demo":
-            run_demo(aeval)
+            run_demo()
             continue
-        evaluate(aeval, line)
+        evaluate(line)
 
 
-def run_demo(aeval=None) -> None:
-    if aeval is None:
-        aeval = make_interpreter()
+def run_demo() -> None:
     for line in demo_script():
         render_message("you", line, "blue")
-        evaluate(aeval, line)
+        evaluate(line)
 
 
 def main(argv: list[str] | None = None) -> int:
-    global console, Console
     from rich.console import Console
+    global console
     console = Console()
     parser = argparse.ArgumentParser()
     parser.add_argument("--demo", action="store_true", help="run the prepared demo script and exit")
@@ -219,13 +185,12 @@ def setUp(self):
         skip_unless_graalos()
 
     def test_demo_packages(self):
-        import asteval
         import rich
 
-        self.assertTrue(asteval.__version__)
         self.assertTrue(rich.get_console())
 
     def test_sandbox_chat_demo(self):
+        from rich.console import Console
         global console
         output = io.StringIO()
         console = Console(file=output, force_terminal=False, color_system=None, width=120)

mx.graalpython/mx_graalpython_graalos.py

@@ -207,7 +207,6 @@ def _prepare_graalos_demo(standalone_home: Path, env):
         "--platform", "any",
         "--dest", str(demo_wheels),
         "rich",
-        "asteval",
     ], env=env)
     # Work around GRAALOS-8260 by installing pure-Python demo wheels from the
     # host. Remove this once in-sandbox ensurepip/pip subprocesses work there.
@@ -220,7 +219,6 @@ def _prepare_graalos_demo(standalone_home: Path, env):
         "--no-compile",
         "--upgrade",
         "rich",
-        "asteval",
     ], env=env)
 
     from mx_graalpython import _python_unittest_root