feat: improve Daytona sandbox tools#5740
Conversation
Signed-off-by: Mislav Ivanda <mislavivanda454@gmail.com>
* chore(deps): use 3-day exclude-newer window Aligns the root workspace with the per-package pyprojects, which already use `exclude-newer = "3 days"`. The fixed 2026-04-27 cutoff blocks legitimate dependency bumps (e.g. daytona ~=0.171 in #5740) without adding meaningful protection — the relative window still includes the security patches that motivated the original pin. * fix(deps): bump gitpython and python-multipart for new advisories - gitpython >=3.1.49 for GHSA-v87r-6q3f-2j67 (newline injection in config_writer().set_value() enables RCE via core.hooksPath). - python-multipart >=0.0.27 for GHSA-pp6c-gr5w-3c5g (DoS via unbounded multipart part headers). Both surfaced via pip-audit on this branch.
|
Hey, this conflicts with our otel packages |
Signed-off-by: Mislav Ivanda <mislavivanda454@gmail.com>
@greysonlalonde Confirmed, sorry for the breakage. The SDK bump was the cause: Daytona 0.141+ transitively pulls opentelemetry-instrumentation-aiohttp-client>=0.59b0 whose lowest version requires opentelemetry-api==1.38, conflicting with CrewAI's ~=1.34.0 pin. There's no version of the aiohttp-client transitive that's compatible with CrewAI's OTel range. I've reverted the pin to daytona~=0.140.0 and verified empirically that 0.140 already exposes every SDK method this PR uses ( |
Signed-off-by: Mislav Ivanda <mislavivanda454@gmail.com>
|
Sorry, didn't mean to close this |
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughDaytonaFileTool is extended with six new file operations (exists, move, find, search, chmod, replace) via expanded FileAction type and schema. Append is refactored for server-side execution. DaytonaBaseTool exposes active_sandbox_id property for cross-tool sandbox sharing. Documentation updated across all languages with new examples and extended parameter tables. ChangesDaytona File Tool Expansion
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
3 participants
Summary
This PR improves the existing Daytona sandbox tool integration in
crewai-tools. It bumps the SDK pin to a current version, expandsDaytonaFileToolwith 6 new file operations, fixes several bugs in the existing implementation and docs, and ensures the docs sidebar correctly lists Daytona alongside E2B.Motivation
daytona~=0.140.0is 31 minor versions behind current (0.171.x). The narrow~=constraint creates a resolver conflict for users who already have a recentdaytonainstalled alongsidecrewai-tools[daytona].DaytonaFileTool.appendwas O(N²) in network transfer — it downloaded the entire growing file, concatenated the new chunk in memory, and re-uploaded everything. The tool's own description tells agents to use chunked appends, so the bad path is reachable from the documented usage pattern. Appending 10 MB in 4 KB chunks transferred ~25 GB.docs/docs.json./workspace/...paths that aren't writable in default Daytona sandboxes (which run as userdaytonawith home at/home/daytona). The "multi-step persistent session" example also created two separate sandboxes and then tried to read a file across them — silently broken.DaytonaFileTooldidn't expose several SDK methods that are very useful for agents (move, content grep, filename glob, chmod, bulk find-and-replace, existence check).Changes
Code
daytona~=0.140.0→daytona~=0.171(PEP 440 form:>=0.171, <1.0; allows all 0.x updates, stops at 1.0)DaytonaFileTool._append— upload the chunk to a uniquely-named temp file once, do a server-sidecat <temp> >> <target>viaprocess.execwithshlex.quote-protected paths, thenrmthe temp. O(N²) → O(chunk_size) per call.active_sandbox_idproperty onDaytonaBaseToolto replace the documented use of the private_persistent_sandbox.idattribute. Returns the explicitly-attachedsandbox_id, the lazily-created persistent sandbox's id, orNonefor ephemeral mode.DaytonaFileTool:exists,move,find(recursive content grep),search(filename glob),chmod(mode/owner/group),replace(bulk find-and-replace across files)DaytonaFileToolSchemawith the required new fields (destination,pattern,replacement,paths,owner,group) plus per-action validation in the existingmodel_validator.DaytonaFileTool.descriptionso the LLM is aware of the new actions.Docs (
docs/{en,ko,pt-BR,ar}/tools/ai-ml/daytona.mdx+lib/crewai-tools/src/crewai_tools/tools/daytona_sandbox_tool/README.md)_persistent_sandbox.idreferences withactive_sandbox_ideverywhere (5 files)./workspace/...→workspace/...(23 occurrences × 4 locale files = 92 corrections). Daytona resolves relative paths under the sandbox user's home (/home/daytona/).persistent=Truetool gets its own); now usesactive_sandbox_idto share one sandbox correctly. Also swapped flakyhttpx.get(httpbin.org)for an offlinehttpx.__version__check so the example works regardless of sandbox egress policy.'artifacts': None→'artifacts': ExecutionArtifacts(...)).Sidebar registration (
docs/docs.json)v1.14.2is preserved as-is.Testing
Validated against a real Daytona sandbox (SDK 0.171.x). All 47 distinct validations PASS:
active_sandbox_id.; rm -rf /,$(whoami), backticks), unicode (emoji + CJK + accents), paths with spaces, paths with shell metacharacters, deeply nested paths, 64 KB single chunk, append after delete, return-contract correctness, zero temp-file leakage.chmodactually set0755;replaceactually rewrote both files).Static analysis:
ruff checkandruff format --checkpass on all touched Python files.docs.jsonvalidates as JSON;pyproject.tomlvalidates as TOML.Out of scope (separate PRs welcome)
daytona.mdxfiles (en/ko/pt-BR/ar) are byte-for-byte identical English copies — that's the upstream pattern from PR docs: add Daytona sandbox tools documentation #5643, where the original author created locale-specific files so per-language sidebar links work but deferred actual translation. Our edits keep them in sync as English placeholders. Real localization is a community translation effort.Notes for reviewers
shlex.quote()for path safety against shell metacharacters anduuid.uuid4()for temp file naming. The temp path lives in/tmp/on the sandbox's ephemeral filesystem (not the host); a# noqa: S108with security-context comment suppresses Ruff's flag.icon: boxin their docs frontmatter — visual collision in the sidebar, but kept as-is to keep this PR scoped.Related
Summary by CodeRabbit
Release Notes
New Features
DaytonaFileToolexpanded with additional file operations: move, find, search, chmod, replace, and existence checks.active_sandbox_idproperty enables seamless sandbox sharing across multiple tool instances.Documentation