Code Metrics¶
Generated: 2026-07-11 17:06 UTC
Lines of Code¶
| Files | Code | Comment | Blank | Total | |
|---|---|---|---|---|---|
| Source | 75 | 16 750 | 4 165 | 1 242 | 22 157 |
| Tests | 88 | 24 230 | 2 364 | 1 985 | 28 579 |
| Combined | 163 | 40 980 | 6 529 | 3 227 | 50 736 |
- Comment/code ratio: 25%
- Test/source ratio: 144.7%
Source by module (click to expand)
| Module | Files | Code | Comment | Blank |
|---|---|---|---|---|
terok_sandbox/ |
75 | 16 750 | 4 165 | 1 242 |
terok_sandbox/_util/ |
11 | 638 | 253 | 94 |
terok_sandbox/_util/__init__.py |
— | 26 | 3 | 4 |
terok_sandbox/_util/_apparmor.py |
— | 97 | 18 | 5 |
terok_sandbox/_util/_fs.py |
— | 23 | 13 | 2 |
terok_sandbox/_util/_logging.py |
— | 29 | 12 | 2 |
terok_sandbox/_util/_naming.py |
— | 7 | 9 | 3 |
terok_sandbox/_util/_net.py |
— | 25 | 10 | 9 |
terok_sandbox/_util/_pidfile.py |
— | 50 | 32 | 8 |
terok_sandbox/_util/_selinux.py |
— | 238 | 88 | 46 |
terok_sandbox/_util/_subprocess_env.py |
— | 15 | 15 | 2 |
terok_sandbox/_util/_systemctl.py |
— | 104 | 39 | 8 |
terok_sandbox/_util/_templates.py |
— | 24 | 14 | 5 |
terok_sandbox/commands/ |
11 | 2 879 | 580 | 152 |
terok_sandbox/commands/__init__.py |
— | 72 | 97 | 3 |
terok_sandbox/commands/_types.py |
— | 12 | 8 | 1 |
terok_sandbox/commands/credentials.py |
— | 524 | 67 | 35 |
terok_sandbox/commands/doctor.py |
— | 60 | 17 | 12 |
terok_sandbox/commands/gate.py |
— | 48 | 9 | 6 |
terok_sandbox/commands/launch.py |
— | 221 | 14 | 3 |
terok_sandbox/commands/sandbox.py |
— | 186 | 76 | 19 |
terok_sandbox/commands/shield.py |
— | 108 | 55 | 5 |
terok_sandbox/commands/ssh.py |
— | 679 | 17 | 22 |
terok_sandbox/commands/supervisor.py |
— | 37 | 18 | 2 |
terok_sandbox/commands/vault.py |
— | 932 | 202 | 44 |
terok_sandbox/gate/ |
4 | 1 140 | 249 | 59 |
terok_sandbox/gate/mirror.py |
— | 686 | 168 | 45 |
terok_sandbox/gate/server.py |
— | 445 | 51 | 10 |
terok_sandbox/gate/tokens.py |
— | 9 | 15 | 3 |
terok_sandbox/integrations/ |
3 | 193 | 182 | 24 |
terok_sandbox/integrations/clearance.py |
— | 13 | 27 | 2 |
terok_sandbox/integrations/shield.py |
— | 180 | 145 | 21 |
terok_sandbox/resources/ |
7 | 600 | 290 | 83 |
terok_sandbox/resources/apparmor/ |
1 | 60 | 28 | 9 |
terok_sandbox/resources/bridges/ |
2 | 83 | 101 | 17 |
terok_sandbox/resources/hooks/ |
2 | 318 | 99 | 40 |
terok_sandbox/resources/hooks/_supervisor_state.py |
— | 58 | 47 | 8 |
terok_sandbox/resources/hooks/supervisor_hook.py |
— | 260 | 52 | 32 |
terok_sandbox/resources/selinux/ |
1 | 66 | 33 | 13 |
terok_sandbox/resources/supervisor_wrapper.py |
— | 73 | 29 | 4 |
terok_sandbox/runtime/ |
6 | 2 493 | 462 | 129 |
terok_sandbox/runtime/__init__.py |
— | 52 | 14 | 4 |
terok_sandbox/runtime/krun.py |
— | 252 | 66 | 7 |
terok_sandbox/runtime/krun_transport.py |
— | 353 | 77 | 23 |
terok_sandbox/runtime/null.py |
— | 355 | 64 | 23 |
terok_sandbox/runtime/podman.py |
— | 1 281 | 132 | 40 |
terok_sandbox/runtime/protocol.py |
— | 200 | 109 | 32 |
terok_sandbox/supervisor/ |
3 | 762 | 177 | 46 |
terok_sandbox/supervisor/__init__.py |
— | 12 | 16 | 3 |
terok_sandbox/supervisor/install.py |
— | 242 | 26 | 10 |
terok_sandbox/supervisor/main.py |
— | 508 | 135 | 33 |
terok_sandbox/vault/ |
14 | 3 779 | 1 016 | 349 |
terok_sandbox/vault/daemon/ |
3 | 940 | 321 | 115 |
terok_sandbox/vault/daemon/__init__.py |
— | 5 | 43 | 3 |
terok_sandbox/vault/daemon/audit.py |
— | 120 | 5 | 4 |
terok_sandbox/vault/daemon/token_broker.py |
— | 815 | 273 | 108 |
terok_sandbox/vault/ssh/ |
4 | 991 | 210 | 94 |
terok_sandbox/vault/ssh/__init__.py |
— | 2 | 21 | 1 |
terok_sandbox/vault/ssh/keypair.py |
— | 457 | 92 | 32 |
terok_sandbox/vault/ssh/manager.py |
— | 163 | 27 | 16 |
terok_sandbox/vault/ssh/signer.py |
— | 369 | 70 | 45 |
terok_sandbox/vault/store/ |
6 | 1 848 | 466 | 139 |
terok_sandbox/vault/store/db.py |
— | 706 | 100 | 23 |
terok_sandbox/vault/store/encryption.py |
— | 520 | 132 | 48 |
terok_sandbox/vault/store/migrations.py |
— | 129 | 59 | 15 |
terok_sandbox/vault/store/recovery.py |
— | 98 | 65 | 20 |
terok_sandbox/vault/store/systemd_creds.py |
— | 395 | 89 | 32 |
terok_sandbox/__init__.py |
— | 190 | 42 | 10 |
terok_sandbox/_exit_codes.py |
— | 3 | 17 | 5 |
terok_sandbox/_setup.py |
— | 453 | 76 | 17 |
terok_sandbox/_stage.py |
— | 237 | 40 | 16 |
terok_sandbox/_yaml.py |
— | 57 | 19 | 3 |
terok_sandbox/cli.py |
— | 39 | 17 | 15 |
terok_sandbox/config.py |
— | 548 | 84 | 28 |
terok_sandbox/config_schema.py |
— | 441 | 26 | 22 |
terok_sandbox/diagnostics.py |
— | 37 | 37 | 10 |
terok_sandbox/doctor.py |
— | 270 | 57 | 24 |
terok_sandbox/launch.py |
— | 645 | 227 | 59 |
terok_sandbox/operator_cli.py |
— | 30 | 4 | 1 |
terok_sandbox/paths.py |
— | 126 | 38 | 11 |
terok_sandbox/port_registry.py |
— | 450 | 63 | 9 |
terok_sandbox/sandbox.py |
— | 559 | 163 | 60 |
terok_sandbox/setup_stamp.py |
— | 181 | 46 | 16 |
Architecture¶
Module Dependency Graph¶
graph TD
terok_sandbox.port_registry --> terok_sandbox.paths
terok_sandbox.setup_stamp --> terok_sandbox.paths
terok_sandbox.config_schema --> terok_sandbox.paths
terok_sandbox.config --> terok_sandbox.paths
terok_sandbox.config --> terok_sandbox.port_registry
terok_sandbox.config --> terok_sandbox.vault.store.db
terok_sandbox.config --> terok_sandbox.vault.store.encryption
terok_sandbox.config --> terok_sandbox.config_schema
terok_sandbox.doctor --> terok_sandbox._stage
terok_sandbox.doctor --> terok_sandbox.config
terok_sandbox.doctor --> terok_sandbox.paths
terok_sandbox.doctor --> terok_sandbox.vault.daemon
terok_sandbox.doctor --> terok_sandbox.vault.store.encryption
terok_sandbox.doctor --> terok_sandbox.vault.store.recovery
terok_sandbox.vault --> terok_sandbox.vault.daemon.token_broker
terok_sandbox.vault.store.db --> terok_sandbox.vault.store.migrations
terok_sandbox.vault.store.db --> terok_sandbox.vault.store.encryption
terok_sandbox.vault.store.encryption --> terok_sandbox.vault.store.systemd_creds
terok_sandbox.vault.store.recovery --> terok_sandbox._yaml
terok_sandbox.vault.store.recovery --> terok_sandbox.config
terok_sandbox.vault.store.recovery --> terok_sandbox.vault.store.encryption
terok_sandbox.vault.ssh.signer --> terok_sandbox.vault.store.db
terok_sandbox.vault.ssh.signer --> terok_sandbox.vault.daemon.token_broker
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.vault.daemon
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.vault.daemon.audit
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.vault.store.db
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.vault.store.encryption
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.config
terok_sandbox.gate --> terok_sandbox.gate.server
terok_sandbox.vault.ssh.manager --> terok_sandbox.vault.ssh.keypair
terok_sandbox.sandbox --> terok_sandbox.integrations.shield
terok_sandbox.commands --> terok_sandbox.commands.credentials
terok_sandbox.commands --> terok_sandbox.commands.doctor
terok_sandbox.commands --> terok_sandbox.commands.gate
terok_sandbox.commands --> terok_sandbox.commands.launch
terok_sandbox.commands --> terok_sandbox.commands.sandbox
terok_sandbox.commands --> terok_sandbox.commands.shield
terok_sandbox.commands --> terok_sandbox.commands.ssh
terok_sandbox.commands --> terok_sandbox.commands.supervisor
terok_sandbox.commands --> terok_sandbox.commands.vault
terok_sandbox.commands.sandbox --> terok_sandbox._setup
terok_sandbox.commands.sandbox --> terok_sandbox.commands.credentials
terok_sandbox.commands.doctor --> terok_sandbox.launch
terok_sandbox.commands.launch --> terok_sandbox.launch
terok_sandbox.commands.supervisor --> terok_sandbox.supervisor
terok_sandbox.supervisor --> terok_sandbox.supervisor.main
terok_sandbox.supervisor --> terok_sandbox.integrations.shield
terok_sandbox.supervisor --> terok_sandbox.paths
terok_sandbox.supervisor.main --> terok_sandbox.integrations.clearance
terok_sandbox.supervisor.main --> terok_sandbox.vault.daemon.token_broker
terok_sandbox.supervisor.main --> terok_sandbox.vault.ssh.signer
terok_sandbox.supervisor.main --> terok_sandbox._util._selinux
terok_sandbox.launch --> terok_sandbox.sandbox
terok_sandbox.launch --> terok_sandbox.integrations.shield
terok_sandbox._setup --> terok_sandbox.integrations.shield
terok_sandbox._setup --> terok_sandbox.integrations.clearance
terok_sandbox.cli --> terok_sandbox.commands
terok_sandbox --> terok_sandbox.commands
terok_sandbox --> terok_sandbox.launch
terok_sandbox --> terok_sandbox.sandbox
terok_sandbox._util
terok_sandbox.paths
terok_sandbox._stage
terok_sandbox.vault.store
terok_sandbox.vault.store.migrations
terok_sandbox.vault.store.systemd_creds
terok_sandbox.vault.ssh
terok_sandbox.vault.daemon
terok_sandbox.vault.daemon.audit
terok_sandbox.gate.server
terok_sandbox.runtime
terok_sandbox.integrations.shield
terok_sandbox.integrations.clearance
terok_sandbox.gate.tokens
terok_sandbox.vault.ssh.keypair
terok_sandbox.gate.mirror
terok_sandbox.commands._types
terok_sandbox.operator_cli
terok_sandbox.commands.gate
terok_sandbox.commands.shield
terok_sandbox.commands.vault
terok_sandbox.commands.ssh
terok_sandbox.commands.credentials
terok_sandbox._yaml
terok_sandbox._exit_codesModule Boundaries¶
50 modules, 60 dependency edges — all boundaries validated.
Module Summary¶
50 modules (click to expand)
| Module | Deps | Description |
|---|---|---|
terok_sandbox._util |
0 | Shared repo-local helpers (fs, logging, templates, naming conventions) |
terok_sandbox.paths |
0 | binders (vault_root, runtime_root, …). |
terok_sandbox.port_registry |
1 | Shared port registry — depends on paths for configurable registry dir |
terok_sandbox.setup_stamp |
1 | package versions via importlib.metadata, writes under namespace_state_dir. |
terok_sandbox._stage |
0 | re-export. |
terok_sandbox.config_schema |
1 | validation, composed by terok-executor and terok into the global config. |
terok_sandbox.config |
5 | standalone sandbox and embedded (terok) paths share one validator. |
terok_sandbox.doctor |
6 | Health check protocol + sandbox-level diagnostics |
terok_sandbox.vault |
1 | |
terok_sandbox.vault.store |
0 | Vault.store — at-rest data layer. |
terok_sandbox.vault.store.db |
2 | |
terok_sandbox.vault.store.migrations |
0 | |
terok_sandbox.vault.store.encryption |
1 | |
terok_sandbox.vault.store.recovery |
3 | WrongPassphraseError while walking the resolver chain. |
terok_sandbox.vault.store.systemd_creds |
0 | |
terok_sandbox.vault.ssh |
0 | Vault.ssh — keypair I/O + scope manager + agent protocol + sockets. |
terok_sandbox.vault.ssh.signer |
2 | |
terok_sandbox.vault.daemon |
0 | Vault.daemon — the long-running process: lifecycle, broker, audit. |
terok_sandbox.vault.daemon.token_broker |
5 | |
terok_sandbox.vault.daemon.audit |
0 | |
terok_sandbox.gate.server |
0 | only internal import is the SELinux socket-labelling helper (foundation). |
terok_sandbox.gate |
1 | Gate package root |
terok_sandbox.runtime |
0 | Container runtime |
terok_sandbox.integrations.shield |
0 | Shield adapter (cross-package — terok_shield boundary) |
terok_sandbox.integrations.clearance |
0 | Clearance adapter (cross-package — terok_clearance boundary) |
terok_sandbox.gate.tokens |
0 | Gate token minter — no internal imports |
terok_sandbox.vault.ssh.manager |
1 | and the keypair primitives. |
terok_sandbox.vault.ssh.keypair |
0 | |
terok_sandbox.gate.mirror |
0 | Git gate mirror management |
terok_sandbox.sandbox |
1 | Sandbox facade |
terok_sandbox.commands |
9 | tuple; the package __init__ assembles COMMANDS from them. |
terok_sandbox.commands._types |
0 | subsystem modules in the surface layer can all import from it. |
terok_sandbox.operator_cli |
0 | so any layer composing operator hints can import it. |
terok_sandbox.commands.sandbox |
2 | |
terok_sandbox.commands.gate |
0 | |
terok_sandbox.commands.shield |
0 | |
terok_sandbox.commands.vault |
0 | |
terok_sandbox.commands.ssh |
0 | |
terok_sandbox.commands.doctor |
1 | |
terok_sandbox.commands.credentials |
0 | |
terok_sandbox.commands.launch |
1 | |
terok_sandbox.commands.supervisor |
1 | |
terok_sandbox.supervisor |
3 | the cross-package import surface contained. |
terok_sandbox.supervisor.main |
4 | |
terok_sandbox._yaml |
0 | Round-trip YAML writer for setup-time config.yml edits. |
terok_sandbox.launch |
2 | and shield rules in one place. |
terok_sandbox._setup |
2 | gate / clearance. |
terok_sandbox._exit_codes |
0 | API). Zero internal imports. |
terok_sandbox.cli |
1 | CLI entry point — same-layer dep on commands |
terok_sandbox |
3 | Package root — same-layer deps on surface peers |
Test Coverage¶
Overall line coverage: 97.4% (6754/6935 statements).
Each rectangle is a source file. Area is proportional to the number of statements; colour encodes the coverage percentage (green = fully covered, red = uncovered). Files are grouped by the first 3 directory levels.
Cognitive Complexity¶
Threshold: 15 (functions above this are listed below)
- Functions analyzed: 750
- Median complexity: 1.0 · Average: 2.7 · Max: 51
- Within threshold (15): 97% (729/750)
0– 3 │ ██████████████████████████████ 578 (77.1%)
4– 6 │ █████ 91 (12.1%)
7– 9 │ █ 28 ( 3.7%)
10– 12 │ █ 24 ( 3.2%)
13– 15 │ 8 ( 1.1%) ◄ threshold
16– 18 │ 5 ( 0.7%)
19– 21 │ 6 ( 0.8%)
22– 25 │ 4 ( 0.5%)
26+ │ 6 ( 0.8%)
21 functions exceeding threshold:
| Complexity | Function | File |
|---|---|---|
| 51 | _stream_initial_logs |
src/terok_sandbox/runtime/podman.py |
| 47 | _handle_request |
src/terok_sandbox/vault/daemon/token_broker.py |
| 44 | _handle_ssh_remove |
src/terok_sandbox/commands/ssh.py |
| 27 | compose |
src/terok_sandbox/launch.py |
| 27 | PortRegistry::_claim_locked |
src/terok_sandbox/port_registry.py |
| 26 | _RouteTable::__init__ |
src/terok_sandbox/vault/daemon/token_broker.py |
| 25 | _proxy_websocket |
src/terok_sandbox/vault/daemon/token_broker.py |
| 23 | _print_vault_status |
src/terok_sandbox/commands/vault.py |
| 22 | PortRegistry::_resolve_service_ports_locked |
src/terok_sandbox/port_registry.py |
| 22 | _serve_agent_session |
src/terok_sandbox/vault/ssh/signer.py |
| 21 | make_stray_sidecar_check |
src/terok_sandbox/launch.py |
| 21 | Sandbox::run |
src/terok_sandbox/sandbox.py |
| 19 | _handle_vault_list |
src/terok_sandbox/commands/vault.py |
| 19 | purge_passphrase_tiers |
src/terok_sandbox/commands/vault.py |
| 19 | _make_handler_class |
src/terok_sandbox/gate/server.py |
| 19 | Sandbox::_build_cmd |
src/terok_sandbox/sandbox.py |
| 18 | PortRegistry::_read_other_claims |
src/terok_sandbox/port_registry.py |
| 17 | load_sidecar |
src/terok_sandbox/supervisor/main.py |
| 16 | _handle_doctor |
src/terok_sandbox/commands/doctor.py |
| 16 | _handle_vault_status |
src/terok_sandbox/commands/vault.py |
| 16 | resolve_passphrase_with_source |
src/terok_sandbox/vault/store/encryption.py |
Dead Code Analysis¶
No dead code found at 80% confidence threshold.
Docstring Coverage¶
- Needed: 22; Found: 19; Missing: 3; Coverage: 86.4%
- Needed: 7; Found: 6; Missing: 1; Coverage: 85.7%
- Needed: 25; Found: 24; Missing: 1; Coverage: 96.0%
- Needed: 16; Found: 15; Missing: 1; Coverage: 93.8%
- Needed: 33; Found: 31; Missing: 2; Coverage: 93.9%
- Needed: 29; Found: 28; Missing: 1; Coverage: 96.6%
- Needed: 22; Found: 21; Missing: 1; Coverage: 95.5%
- Needed: 25; Found: 22; Missing: 3; Coverage: 88.0%
- Needed: 13; Found: 11; Missing: 2; Coverage: 84.6%
- Needed: 64; Found: 60; Missing: 4; Coverage: 93.8%
- Needed: 87; Found: 79; Missing: 8; Coverage: 90.8%
- Needed: 46; Found: 40; Missing: 6; Coverage: 87.0%
- Needed: 31; Found: 29; Missing: 2; Coverage: 93.5%
- Needed: 19; Found: 18; Missing: 1; Coverage: 94.7%
- Needed: 49; Found: 46; Missing: 3; Coverage: 93.9%
- Needed: 21; Found: 20; Missing: 1; Coverage: 95.2%
- Needed: 42; Found: 40; Missing: 2; Coverage: 95.2%
- Needed: 950 - Found: 908 - Missing: 42
- Total coverage: 95.6% - Grade: Excellent
Generated by scc, complexipy, vulture, tach, and docstr-coverage.