"""
Sandbox execution subsystem (ADR-0007 Phase 1).

Two halves that speak a small JSON-over-HTTP protocol:

- `kernel.py`   — the exec-kernel HTTP server that RUNS inside the sandbox
                  (container in prod; a localhost subprocess in dev/test). Holds
                  the persistent per-session namespace and `exec`s untrusted code.
- `executor.py` — the `SandboxedExecutor` CLIENT that runs in the agent process,
                  starts/tears-down one kernel per session (pluggable launcher),
                  and proxies `Executor`-protocol calls over HTTP.

`mcp_bridge.py` builds the in-kernel MCP tool stubs so injected tool NAMES resolve
to callables that dispatch to the vetted MCP HTTP server (tools stay outside the
sandbox — only the untrusted free-form code is confined).
"""

__all__ = ["SandboxedExecutor", "get_sandboxed_executor"]


def __getattr__(name):  # lazy re-export so importing the package is dep-light
    if name in ("SandboxedExecutor", "get_sandboxed_executor"):
        from .executor import SandboxedExecutor, get_sandboxed_executor

        return {
            "SandboxedExecutor": SandboxedExecutor,
            "get_sandboxed_executor": get_sandboxed_executor,
        }[name]
    raise AttributeError(name)