Fix code execution on the local sandbox backend (#720)

* Fix code execution on the local sandbox backend

Since #716, CodeExecutor with the default "local" backend always failed:
the command `cd /workspace && ...` escapes the sandbox path rebasing.
Host-style sandbox backends (local, ray) map absolute paths under a temp
$SANDBOX_ROOT via a shell prelude that wraps common file utilities, but
`cd` is not among them, so the shell tried to enter the host's
nonexistent /workspace and every execution returned an error output.
This is also why tests/code_executor/test_code_execution.py::
test_simple_code_execution_local has been failing CI on main.

Rebase the workspace path explicitly with "${SANDBOX_ROOT:-}/workspace":
host-style backends expand their sandbox root, while container backends
(docker, e2b, ...) leave SANDBOX_ROOT unset and keep using the real
/workspace.

Also invoke `python3` instead of `python`: stock macOS hosts have no
bare `python` binary, so the local backend failed on Macs even with the
cd fix; python3 is present on CI runners and in python docker images.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Scope CI coverage to bespokelabs.curator

Since #716, bespokelabs-sandbox (a required dependency) installs into the
same bespokelabs.* namespace package that CI measures with
--cov=bespokelabs, so ~1,100 statements of third-party sandbox code
(docker/e2b/modal/ray/... backends, mostly unexercised here) entered the
coverage denominator and dropped the total from 79.5% to ~72%, tripping
the 80% gate. Measure only curator's own package instead.

Author: mahesh-bespoke

.github/workflows/lint-and-test.yaml

@@ -52,4 +52,6 @@ jobs:
 
       - name: Run tests with coverage
         run: |
-          poetry run pytest --cov='bespokelabs' --cov-report=html --cov-fail-under=80  tests/
+          # Scope coverage to curator itself: bespokelabs-sandbox installs into the
+          # same bespokelabs.* namespace and would otherwise be measured too.
+          poetry run pytest --cov='bespokelabs.curator' --cov-report=html --cov-fail-under=80  tests/

src/bespokelabs/curator/code_executor/code_execution_backend/sandbox_backend.py

@@ -91,7 +91,16 @@ def _execute_in_sandbox(
             sb.write_file(f"{WORKSPACE_DIR}/program.py", code)
             sb.write_file(f"{WORKSPACE_DIR}/input.txt", code_input)
 
-            result = sb.execute_command("bash", args=["-c", f"cd {WORKSPACE_DIR} && timeout {timeout} python program.py < input.txt"])
+            # Host-style backends (local, ray) rebase absolute paths under
+            # $SANDBOX_ROOT, but their shell prelude does not wrap `cd`, so the
+            # workspace path must be rebased explicitly. Container backends
+            # (docker, e2b, ...) leave SANDBOX_ROOT unset and have a real
+            # /workspace. `python3` rather than `python`: stock macOS hosts
+            # (local backend) have no bare `python` binary.
+            result = sb.execute_command(
+                "bash",
+                args=["-c", f'cd "${{SANDBOX_ROOT:-}}{WORKSPACE_DIR}" && timeout {timeout} python3 program.py < input.txt'],
+            )
             files = _collect_sandbox_files(sb)
             stdout = result.stdout
             stderr = result.stderr