[vangheem]

Summary

Preserves backward compatibility for existing agents/restricted deployments while retaining the scoped Code Mode hardening introduced by nuclia#119.

Architecture

• Keeps the bounded JSON protocol for remote sandbox and isolated-process execution.
• Retains the existing pickle-based IPC only for SandboxRunner.with_pool(), which is the legacy local execution path used by the restricted agent.
• Makes the new server concurrency, runtime, and memory ceilings opt-in so existing deployments do not acquire unconfigured behavior limits.
• Preserves the existing sandbox metrics endpoint defaults while keeping the new settings available to disable or restrict the listener.

Backward Compatibility

• Existing restricted-agent callbacks can continue passing picklable Python values such as bytes, sets, dataclasses, and domain objects through local process-pool execution.
• Existing sandbox deployments remain unrestricted unless SANDBOX_MAX_CONCURRENT_SESSIONS, SANDBOX_MAX_SESSION_RUNTIME_SECONDS, or SANDBOX_MAX_SESSION_MEMORY_BYTES is explicitly configured.
• Existing metrics scraping continues to work on 0.0.0.0:8091 by default. Deployments can opt into the hardened behavior with SANDBOX_METRICS_ENABLED=false or SANDBOX_METRICS_HOST=127.0.0.1.
• The tokenless Unix-socket behavior restored by Make codemode sandbox token optional nuclia/hyperforge#114 remains unchanged.
• Scoped Code Mode still supplies per-request runtime and memory limits and continues to use bounded JSON transport.

Validation

Adds a real ProcessPoolExecutor integration test that exercises a legacy bytes value across both sides of restricted-agent callback IPC, plus assertions protecting the compatibility defaults.

This PR is stacked on nuclia#119 and targets its source branch.