Code Metrics¶
Generated: 2026-06-05 15:45 UTC
Lines of Code¶
| Files | Code | Comment | Blank | Total | |
|---|---|---|---|---|---|
| Source | 73 | 15 449 | 3 867 | 1 140 | 20 456 |
| Tests | 84 | 22 471 | 2 213 | 1 909 | 26 593 |
| Combined | 157 | 37 920 | 6 080 | 3 049 | 47 049 |
- Comment/code ratio: 25%
- Test/source ratio: 145.5%
Source by module (click to expand)
| Module | Files | Code | Comment | Blank |
|---|---|---|---|---|
terok_sandbox/ |
73 | 15 449 | 3 867 | 1 140 |
terok_sandbox/_util/ |
11 | 638 | 253 | 94 |
terok_sandbox/_util/__init__.py |
— | 26 | 3 | 4 |
terok_sandbox/_util/_apparmor.py |
— | 97 | 18 | 5 |
terok_sandbox/_util/_fs.py |
— | 23 | 13 | 2 |
terok_sandbox/_util/_logging.py |
— | 29 | 12 | 2 |
terok_sandbox/_util/_naming.py |
— | 7 | 9 | 3 |
terok_sandbox/_util/_net.py |
— | 25 | 10 | 9 |
terok_sandbox/_util/_pidfile.py |
— | 50 | 32 | 8 |
terok_sandbox/_util/_selinux.py |
— | 238 | 88 | 46 |
terok_sandbox/_util/_subprocess_env.py |
— | 15 | 15 | 2 |
terok_sandbox/_util/_systemctl.py |
— | 104 | 39 | 8 |
terok_sandbox/_util/_templates.py |
— | 24 | 14 | 5 |
terok_sandbox/commands/ |
11 | 2 490 | 480 | 121 |
terok_sandbox/commands/__init__.py |
— | 67 | 92 | 3 |
terok_sandbox/commands/_types.py |
— | 12 | 8 | 1 |
terok_sandbox/commands/credentials.py |
— | 523 | 67 | 35 |
terok_sandbox/commands/doctor.py |
— | 58 | 17 | 12 |
terok_sandbox/commands/gate.py |
— | 48 | 9 | 6 |
terok_sandbox/commands/launch.py |
— | 221 | 14 | 3 |
terok_sandbox/commands/sandbox.py |
— | 186 | 76 | 19 |
terok_sandbox/commands/shield.py |
— | 108 | 55 | 5 |
terok_sandbox/commands/ssh.py |
— | 679 | 17 | 22 |
terok_sandbox/commands/supervisor.py |
— | 37 | 18 | 2 |
terok_sandbox/commands/vault.py |
— | 551 | 107 | 13 |
terok_sandbox/gate/ |
4 | 1 154 | 218 | 36 |
terok_sandbox/gate/mirror.py |
— | 700 | 137 | 22 |
terok_sandbox/gate/server.py |
— | 445 | 51 | 10 |
terok_sandbox/gate/tokens.py |
— | 9 | 15 | 3 |
terok_sandbox/integrations/ |
3 | 193 | 182 | 24 |
terok_sandbox/integrations/clearance.py |
— | 13 | 27 | 2 |
terok_sandbox/integrations/shield.py |
— | 180 | 145 | 21 |
terok_sandbox/resources/ |
7 | 559 | 288 | 82 |
terok_sandbox/resources/apparmor/ |
1 | 60 | 28 | 9 |
terok_sandbox/resources/bridges/ |
2 | 83 | 96 | 17 |
terok_sandbox/resources/hooks/ |
2 | 296 | 111 | 40 |
terok_sandbox/resources/hooks/_supervisor_state.py |
— | 58 | 47 | 8 |
terok_sandbox/resources/hooks/supervisor_hook.py |
— | 238 | 64 | 32 |
terok_sandbox/resources/selinux/ |
1 | 66 | 33 | 13 |
terok_sandbox/resources/supervisor_wrapper.py |
— | 54 | 20 | 3 |
terok_sandbox/runtime/ |
6 | 2 249 | 481 | 134 |
terok_sandbox/runtime/__init__.py |
— | 44 | 13 | 4 |
terok_sandbox/runtime/krun.py |
— | 252 | 66 | 7 |
terok_sandbox/runtime/krun_transport.py |
— | 353 | 77 | 23 |
terok_sandbox/runtime/null.py |
— | 335 | 62 | 23 |
terok_sandbox/runtime/podman.py |
— | 1 073 | 158 | 46 |
terok_sandbox/runtime/protocol.py |
— | 192 | 105 | 31 |
terok_sandbox/supervisor/ |
3 | 702 | 170 | 44 |
terok_sandbox/supervisor/__init__.py |
— | 12 | 16 | 3 |
terok_sandbox/supervisor/install.py |
— | 242 | 26 | 10 |
terok_sandbox/supervisor/main.py |
— | 448 | 128 | 31 |
terok_sandbox/vault/ |
14 | 3 543 | 910 | 317 |
terok_sandbox/vault/daemon/ |
3 | 878 | 278 | 108 |
terok_sandbox/vault/daemon/__init__.py |
— | 5 | 43 | 3 |
terok_sandbox/vault/daemon/audit.py |
— | 120 | 5 | 4 |
terok_sandbox/vault/daemon/token_broker.py |
— | 753 | 230 | 101 |
terok_sandbox/vault/ssh/ |
4 | 991 | 210 | 94 |
terok_sandbox/vault/ssh/__init__.py |
— | 2 | 21 | 1 |
terok_sandbox/vault/ssh/keypair.py |
— | 457 | 92 | 32 |
terok_sandbox/vault/ssh/manager.py |
— | 163 | 27 | 16 |
terok_sandbox/vault/ssh/signer.py |
— | 369 | 70 | 45 |
terok_sandbox/vault/store/ |
6 | 1 674 | 403 | 114 |
terok_sandbox/vault/store/db.py |
— | 660 | 85 | 22 |
terok_sandbox/vault/store/encryption.py |
— | 462 | 97 | 24 |
terok_sandbox/vault/store/migrations.py |
— | 103 | 46 | 12 |
terok_sandbox/vault/store/recovery.py |
— | 94 | 49 | 22 |
terok_sandbox/vault/store/systemd_creds.py |
— | 355 | 105 | 33 |
terok_sandbox/__init__.py |
— | 161 | 41 | 10 |
terok_sandbox/_exit_codes.py |
— | 3 | 17 | 5 |
terok_sandbox/_setup.py |
— | 453 | 76 | 17 |
terok_sandbox/_stage.py |
— | 237 | 40 | 16 |
terok_sandbox/_yaml.py |
— | 57 | 19 | 3 |
terok_sandbox/cli.py |
— | 39 | 17 | 15 |
terok_sandbox/config.py |
— | 524 | 61 | 22 |
terok_sandbox/config_schema.py |
— | 441 | 26 | 22 |
terok_sandbox/doctor.py |
— | 270 | 57 | 24 |
terok_sandbox/launch.py |
— | 473 | 226 | 55 |
terok_sandbox/paths.py |
— | 126 | 38 | 11 |
terok_sandbox/port_registry.py |
— | 450 | 63 | 9 |
terok_sandbox/sandbox.py |
— | 506 | 158 | 63 |
terok_sandbox/setup_stamp.py |
— | 181 | 46 | 16 |
Architecture¶
Module Dependency Graph¶
graph TD
terok_sandbox.port_registry --> terok_sandbox.paths
terok_sandbox.setup_stamp --> terok_sandbox.paths
terok_sandbox.config_schema --> terok_sandbox.paths
terok_sandbox.config --> terok_sandbox.paths
terok_sandbox.config --> terok_sandbox.port_registry
terok_sandbox.config --> terok_sandbox.vault.store.db
terok_sandbox.config --> terok_sandbox.vault.store.encryption
terok_sandbox.config --> terok_sandbox.config_schema
terok_sandbox.doctor --> terok_sandbox._stage
terok_sandbox.doctor --> terok_sandbox.config
terok_sandbox.doctor --> terok_sandbox.paths
terok_sandbox.doctor --> terok_sandbox.vault.daemon
terok_sandbox.doctor --> terok_sandbox.vault.store.encryption
terok_sandbox.doctor --> terok_sandbox.vault.store.recovery
terok_sandbox.vault --> terok_sandbox.vault.daemon.token_broker
terok_sandbox.vault.store.db --> terok_sandbox.vault.store.migrations
terok_sandbox.vault.store.db --> terok_sandbox.vault.store.encryption
terok_sandbox.vault.store.encryption --> terok_sandbox.vault.store.systemd_creds
terok_sandbox.vault.store.recovery --> terok_sandbox._yaml
terok_sandbox.vault.store.recovery --> terok_sandbox.config
terok_sandbox.vault.store.recovery --> terok_sandbox.vault.store.encryption
terok_sandbox.vault.ssh.signer --> terok_sandbox.vault.store.db
terok_sandbox.vault.ssh.signer --> terok_sandbox.vault.daemon.token_broker
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.vault.daemon
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.vault.daemon.audit
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.vault.store.db
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.vault.store.encryption
terok_sandbox.vault.daemon.token_broker --> terok_sandbox.config
terok_sandbox.gate --> terok_sandbox.gate.server
terok_sandbox.vault.ssh.manager --> terok_sandbox.vault.ssh.keypair
terok_sandbox.sandbox --> terok_sandbox.integrations.shield
terok_sandbox.commands --> terok_sandbox.commands.credentials
terok_sandbox.commands --> terok_sandbox.commands.doctor
terok_sandbox.commands --> terok_sandbox.commands.gate
terok_sandbox.commands --> terok_sandbox.commands.launch
terok_sandbox.commands --> terok_sandbox.commands.sandbox
terok_sandbox.commands --> terok_sandbox.commands.shield
terok_sandbox.commands --> terok_sandbox.commands.ssh
terok_sandbox.commands --> terok_sandbox.commands.supervisor
terok_sandbox.commands --> terok_sandbox.commands.vault
terok_sandbox.commands.sandbox --> terok_sandbox._setup
terok_sandbox.commands.sandbox --> terok_sandbox.commands.credentials
terok_sandbox.commands.launch --> terok_sandbox.launch
terok_sandbox.commands.supervisor --> terok_sandbox.supervisor
terok_sandbox.supervisor --> terok_sandbox.supervisor.main
terok_sandbox.supervisor --> terok_sandbox.integrations.shield
terok_sandbox.supervisor --> terok_sandbox.paths
terok_sandbox.supervisor.main --> terok_sandbox.integrations.clearance
terok_sandbox.supervisor.main --> terok_sandbox.vault.daemon.token_broker
terok_sandbox.supervisor.main --> terok_sandbox.vault.ssh.signer
terok_sandbox.supervisor.main --> terok_sandbox._util._selinux
terok_sandbox.launch --> terok_sandbox.sandbox
terok_sandbox.launch --> terok_sandbox.integrations.shield
terok_sandbox._setup --> terok_sandbox.integrations.shield
terok_sandbox._setup --> terok_sandbox.integrations.clearance
terok_sandbox.cli --> terok_sandbox.commands
terok_sandbox --> terok_sandbox.commands
terok_sandbox --> terok_sandbox.launch
terok_sandbox --> terok_sandbox.sandbox
terok_sandbox._util
terok_sandbox.paths
terok_sandbox._stage
terok_sandbox.vault.store
terok_sandbox.vault.store.migrations
terok_sandbox.vault.store.systemd_creds
terok_sandbox.vault.ssh
terok_sandbox.vault.daemon
terok_sandbox.vault.daemon.audit
terok_sandbox.gate.server
terok_sandbox.runtime
terok_sandbox.integrations.shield
terok_sandbox.integrations.clearance
terok_sandbox.gate.tokens
terok_sandbox.vault.ssh.keypair
terok_sandbox.gate.mirror
terok_sandbox.commands._types
terok_sandbox.commands.gate
terok_sandbox.commands.shield
terok_sandbox.commands.vault
terok_sandbox.commands.ssh
terok_sandbox.commands.doctor
terok_sandbox.commands.credentials
terok_sandbox._yaml
terok_sandbox._exit_codesModule Boundaries¶
49 modules, 59 dependency edges — all boundaries validated.
Module Summary¶
49 modules (click to expand)
| Module | Deps | Description |
|---|---|---|
terok_sandbox._util |
0 | Shared repo-local helpers (fs, logging, templates, naming conventions) |
terok_sandbox.paths |
0 | binders (vault_root, runtime_root, …). |
terok_sandbox.port_registry |
1 | Shared port registry — depends on paths for configurable registry dir |
terok_sandbox.setup_stamp |
1 | package versions via importlib.metadata, writes under namespace_state_dir. |
terok_sandbox._stage |
0 | re-export. |
terok_sandbox.config_schema |
1 | validation, composed by terok-executor and terok into the global config. |
terok_sandbox.config |
5 | standalone sandbox and embedded (terok) paths share one validator. |
terok_sandbox.doctor |
6 | Health check protocol + sandbox-level diagnostics |
terok_sandbox.vault |
1 | |
terok_sandbox.vault.store |
0 | Vault.store — at-rest data layer. |
terok_sandbox.vault.store.db |
2 | |
terok_sandbox.vault.store.migrations |
0 | |
terok_sandbox.vault.store.encryption |
1 | |
terok_sandbox.vault.store.recovery |
3 | WrongPassphraseError while walking the resolver chain. |
terok_sandbox.vault.store.systemd_creds |
0 | |
terok_sandbox.vault.ssh |
0 | Vault.ssh — keypair I/O + scope manager + agent protocol + sockets. |
terok_sandbox.vault.ssh.signer |
2 | |
terok_sandbox.vault.daemon |
0 | Vault.daemon — the long-running process: lifecycle, broker, audit. |
terok_sandbox.vault.daemon.token_broker |
5 | |
terok_sandbox.vault.daemon.audit |
0 | |
terok_sandbox.gate.server |
0 | only internal import is the SELinux socket-labelling helper (foundation). |
terok_sandbox.gate |
1 | Gate package root |
terok_sandbox.runtime |
0 | Container runtime |
terok_sandbox.integrations.shield |
0 | Shield adapter (cross-package — terok_shield boundary) |
terok_sandbox.integrations.clearance |
0 | Clearance adapter (cross-package — terok_clearance boundary) |
terok_sandbox.gate.tokens |
0 | Gate token minter — no internal imports |
terok_sandbox.vault.ssh.manager |
1 | and the keypair primitives. |
terok_sandbox.vault.ssh.keypair |
0 | |
terok_sandbox.gate.mirror |
0 | Git gate mirror management |
terok_sandbox.sandbox |
1 | Sandbox facade |
terok_sandbox.commands |
9 | tuple; the package __init__ assembles COMMANDS from them. |
terok_sandbox.commands._types |
0 | subsystem modules in the surface layer can all import from it. |
terok_sandbox.commands.sandbox |
2 | |
terok_sandbox.commands.gate |
0 | |
terok_sandbox.commands.shield |
0 | |
terok_sandbox.commands.vault |
0 | |
terok_sandbox.commands.ssh |
0 | |
terok_sandbox.commands.doctor |
0 | |
terok_sandbox.commands.credentials |
0 | |
terok_sandbox.commands.launch |
1 | |
terok_sandbox.commands.supervisor |
1 | |
terok_sandbox.supervisor |
3 | the cross-package import surface contained. |
terok_sandbox.supervisor.main |
4 | |
terok_sandbox._yaml |
0 | Round-trip YAML writer for setup-time config.yml edits. |
terok_sandbox.launch |
2 | and shield rules in one place. |
terok_sandbox._setup |
2 | gate / clearance. |
terok_sandbox._exit_codes |
0 | API). Zero internal imports. |
terok_sandbox.cli |
1 | CLI entry point — same-layer dep on commands |
terok_sandbox |
3 | Package root — same-layer deps on surface peers |
Test Coverage¶
Overall line coverage: 97.3% (6325/6499 statements).
Each rectangle is a source file. Area is proportional to the number of statements; colour encodes the coverage percentage (green = fully covered, red = uncovered). Files are grouped by the first 3 directory levels.
Cognitive Complexity¶
Threshold: 15 (functions above this are listed below)
Warning
complexipy cache not found — skipping complexity report.
Dead Code Analysis¶
No dead code found at 80% confidence threshold.
Docstring Coverage¶
- Needed: 22; Found: 19; Missing: 3; Coverage: 86.4%
- Needed: 7; Found: 6; Missing: 1; Coverage: 85.7%
- Needed: 14; Found: 13; Missing: 1; Coverage: 92.9%
- Needed: 16; Found: 15; Missing: 1; Coverage: 93.8%
- Needed: 32; Found: 30; Missing: 2; Coverage: 93.8%
- Needed: 22; Found: 21; Missing: 1; Coverage: 95.5%
- Needed: 25; Found: 22; Missing: 3; Coverage: 88.0%
- Needed: 13; Found: 11; Missing: 2; Coverage: 84.6%
- Needed: 60; Found: 56; Missing: 4; Coverage: 93.3%
- Needed: 74; Found: 67; Missing: 7; Coverage: 90.5%
- Needed: 44; Found: 38; Missing: 6; Coverage: 86.4%
- Needed: 30; Found: 28; Missing: 2; Coverage: 93.3%
- Needed: 13; Found: 12; Missing: 1; Coverage: 92.3%
- Needed: 46; Found: 43; Missing: 3; Coverage: 93.5%
- Needed: 21; Found: 20; Missing: 1; Coverage: 95.2%
- Needed: 39; Found: 37; Missing: 2; Coverage: 94.9%
- Needed: 890 - Found: 850 - Missing: 40
- Total coverage: 95.5% - Grade: Excellent
Generated by scc, complexipy, vulture, tach, and docstr-coverage.