Route sandbox package changes through the script environment - #10696
Open
manzt wants to merge 1 commit into
Open
Route sandbox package changes through the script environment#10696manzt wants to merge 1 commit into
manzt wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
All contributors have signed the CLA ✍️ ✅ |
manzt
changed the title
manzt
force-pushed
the
sandbox-packages
branch
from
August 28, 2026 22:28
7ff0e9a to
a10835c
Compare
manzt
force-pushed
the
sandbox-packages
branch
from
August 28, 2026 22:38
a10835c to
3429bc7
Compare
Installing a package into a sandboxed notebook runs `uv pip install` against the environment and then edits the script metadata as a separate step. The install ignores the metadata's index configuration and sources (#6042), the two steps can disagree, and the server infers "sandboxed" from the metadata-management flag, which also covers configured venvs. These changes put uv's package manager in script mode when the notebook's dependencies live in a script environment. Installs and uninstalls edit the manifest and synchronize the environment, so uv owns constraint selection and resolves with the metadata's full semantics. uv's output streams to the frontend line by line, and a resolution failure streams the solver's message instead of pointing at the terminal. ```py pm = create_package_manager("uv", script_path=notebook_path) await pm.install("polars", version=None, log_callback=on_line) ``` `MARIMO_SANDBOX_MODE` carries the sandbox identity explicitly: the single-file launcher and multi-file kernels set it, configured venvs do not, and the server keys script mode on the kernel's synchronized environment rather than on metadata management. Cell-registration namespace updates keep their metadata-only path; explicit installs no longer write the metadata twice. Closes #6042
manzt
force-pushed
the
sandbox-packages
branch
from
August 28, 2026 22:56
3429bc7 to
86b14ad
Compare
manzt
marked this pull request as ready for review
August 29, 2026 18:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Installing a package into a sandboxed notebook runs
uv pip installagainst the environment and edits the script metadata as a separate step. The install ignores the metadata's index configuration and sources (#6042), and the two steps can disagree.This PR makes a package change edit the manifest and synchronize the environment, so uv owns constraint selection and resolves with the metadata's full semantics. uv's output streams to the frontend, and a resolution failure streams the solver's message instead of pointing at the terminal.
Reconciling the complete manifest may also move shared transitive dependencies, matching what
uv add --scriptdoes by hand.Closes #6042