* feat(sandbox): add BoxLite micro-VM sandbox provider (scaffold)
Community SandboxProvider backed by BoxLite, a daemonless OCI-native micro-VM
runtime. execute_command is wired end to end through a private asyncio loop that
bridges BoxLite's async SDK to DeerFlow's sync Sandbox contract; the remaining
Sandbox methods are stubbed pending approach review. Opt-in via sandbox.use
(pip install boxlite); a packaged [boxlite] extra will follow. Existing
providers are unchanged.
Refs #3936, #3439, #3213
* feat(sandbox): implement full Sandbox contract for BoxLite backend
Rename the community BoxLite integration to read as a compute backend rather
than "a sandbox": module boxlite_sandbox -> boxlite, BoxliteSandboxProvider ->
BoxliteProvider, BoxliteSandbox -> BoxliteBox.
Implement the file surface DeerFlow's default tool path assumes -- read_file,
write_file, update_file, download_file, list_dir, glob, grep -- as shell
commands inside the box (cat/find/grep/chunked base64), reusing
deerflow.sandbox.search and busybox-portable flags. Removes the reachable
NotImplementedError regression once the provider is selected. download_file
keeps the /mnt/user-data prefix + traversal guards; the provider materialises
those virtual dirs on box start.
Refs #3936, #3940
* fix(sandbox): resolve CI + review findings on BoxLite backend
- provider: import DEFAULT_SKILLS_CONTAINER_PATH instead of the "/mnt/skills"
literal (backend-unit-tests guard), and drop the redundant env-var
re-resolution -- AppConfig.resolve_env_variables already resolves $VARS and
raises on missing.
- box: grep now passes the raw pattern to grep (-F/-E); it previously handed
the re.escape'd pattern to grep -F, so a literal search of e.g. foo.bar
looked for foo\.bar and never matched.
- box: execute_command now calls _validate_extra_env(env), matching the
Sandbox POSIX env-key contract that the local/e2b/aio sandboxes enforce.
- add tests/test_boxlite_provider.py (CI-safe, no BoxLite): actionable
ImportError on the lazy import, clean acquire-failure + shutdown, the
traversal / download-prefix guards, and env-key rejection.
Refs #3936, #3940
