feat: add process isolation for tool execution

[qinxuye]

Summary

• Add a process execution service backed by xoscar actor pools for process-isolated execution
• Wire process isolation into the production web lifecycle; it is enabled by default and can be disabled with XAGENT_PROCESS_ISOLATION_ENABLED=false
• Wrap only tools that explicitly declare supports_process_isolation, with sandbox execution taking priority
• Expose process service monitoring at /api/process-service/status and /api/process-service/health
• Preserve existing command executor shell semantics by reusing CommandExecutorCore

Rebase notes

• Rebased the original feat/process-isolation work onto current main
• Resolved the pyproject.toml conflict by keeping both exa-py from main and xoscar from this feature

Review fixes

• Avoid asyncio.run() inside async actor execution
• Clean up actors and sub-pools from a shared finally path, including timeout paths
• Limit concurrent sub-pool creation with n_workers and expose service resource info
• Use xoscar serialization directly for tool execution instead of manual cloudpickle
• Keep child pool startup payload small by passing only required PYTHONPATH
• Bound sub-pool startup and actor creation with timeout handling so process isolation cannot hang before actor execution starts; timeout errors identify the stalled stage
• Delegate wrapper lifecycle/state/formatting methods to the wrapped tool
• Add explicit process-isolation opt-in and ToolFactory coverage for supported and unsupported tools
• Wire service startup/shutdown, global registration, and API routing through config
• Keep auto-migration startup tests focused by explicitly disabling process isolation in those tests
• Add a ToolFactory integration test that creates execute_python_code, verifies it is process-isolated, executes Python through it, and checks the child PID differs from the parent PID
• Add startup-timeout coverage for stalled xoscar sub-pool creation

Verification

• ruff check src/xagent/core/execution/service/process.py tests/core/execution/test_process_service.py
• ruff format --check src/xagent/core/execution/service/process.py tests/core/execution/test_process_service.py
• ruff check src/xagent/core/execution/service/process.py src/xagent/core/execution/actors/command_executor_actor.py src/xagent/core/tools/adapters/vibe/process_isolated src/xagent/core/tools/adapters/vibe/factory.py src/xagent/core/tools/adapters/vibe/python_executor.py src/xagent/core/tools/adapters/vibe/output_filter_wrapper.py src/xagent/config.py src/xagent/web/app.py src/xagent/web/api/services.py tests/core/tools/test_process_isolated_wrapper.py tests/core/execution/test_process_service.py tests/core/test_config.py tests/web/api/test_process_service_api.py
• PYTHONPATH=src pytest tests/core/test_config.py tests/web/api/test_process_service_api.py tests/core/tools/test_process_isolated_wrapper.py -q
• PYTHONPATH=src pytest tests/core/execution/test_process_service.py tests/core/execution/test_integration.py tests/core/tools/test_python_executor_process_isolation.py -q
• PYTHONPATH=src pytest tests/core/execution/test_process_service.py::test_python_execution_timeout tests/core/execution/test_process_service.py::test_command_execution_preserves_shell_semantics tests/core/tools/test_python_executor_process_isolation.py::test_python_executor_concurrent_executions -q
• PYTHONPATH=src pytest tests/core/test_config.py::TestProcessIsolationConfig -q
• PYTHONPATH=src pytest tests/integration/test_auto_migration_startup.py::test_startup_event_skips_when_auto_migrate_disabled tests/integration/test_auto_migration_startup.py::test_startup_event_triggers_background_auto_migration tests/integration/test_auto_migration_startup.py::test_startup_event_no_task_when_no_table_needs_migration -q
• PYTHONPATH=src pytest tests/core/execution/test_integration.py::test_tool_factory_process_isolated_python_executor_runs -q
• PYTHONPATH=src pytest tests/core/execution/test_integration.py tests/core/tools/test_process_isolated_wrapper.py tests/core/tools/test_python_executor_process_isolation.py -q

Note: I did not run sandbox tool tests locally per the sandbox constraint; CI will cover the standard suite.

[gemini-code-assist]

Code Review

This pull request introduces a process-level isolation framework for tool execution using the xoscar library, including new executor actors, a managed ProcessService, and integration wrappers for existing tools. Feedback highlights several critical issues: a potential RuntimeError caused by improper use of asyncio.run() in an async context, resource leaks in sub-pool cleanup logic, and multiple API mismatches between the implementation and the test suite, such as missing methods and incorrect constructor signatures. Additionally, a duplicate return statement was identified in the tool executor actor.

[qinxuye]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces process-level isolation for tool execution using the xoscar framework. It adds a new execution service module, specialized actors for Python, JavaScript, and shell commands, and a wrapper to isolate existing tools. Key feedback includes critical security concerns regarding potential shell injection and permissive Python execution globals. Additionally, the reviewer highlighted a lack of concurrency limits in process management that could lead to resource exhaustion, potential runtime errors when calling asynchronous code from synchronous wrappers, and logic duplication in the base executor classes.

[qinxuye]

/gemini review

[gemini-code-assist]

Code Review

This pull request implements a process-level isolation framework for tool execution using the xoscar actor library. It introduces a new execution module featuring specialized actors for Python, JavaScript, shell commands, and generic tools, alongside a ProcessService for managing dynamic sub-pools. Integration utilities are also provided to wrap existing tools for isolated execution. Feedback focuses on adhering to PEP 8 by moving local imports to the top level and ensuring that process termination is handled robustly when execution timeouts occur.

[rogercloud]

I found several integration and contract issues in the process-isolation implementation. Inline comments below.

[rogercloud]

Approved. I re-checked the latest head and the previously raised concerns have been addressed: process isolation is now wired into the production lifecycle, the wrapper preserves the tool contract, timeout cleanup no longer leaves stale actor references, command execution preserves existing shell semantics, and process isolation is gated behind explicit tool opt-in.