v0.19.0

Streaming file I/O with IO[bytes] buffers

write_file() and read_file() now accept IO[bytes] in addition to bytes and Path. Stream directly from/to BytesIO, SpooledTemporaryFile, pipes, or any binary stream — no temp files, no extra copies.

import io

async with await scheduler.session(language=Language.PYTHON) as session:
    # Write from an in-memory buffer
    await session.write_file("input.bin", io.BytesIO(my_data))

    # Read into an in-memory buffer
    result = io.BytesIO()
    await session.read_file("output.bin", destination=result)
    data = result.getvalue()

Caller-provided streams are never closed by the session — you retain full ownership. Seekable streams are validated against the file size limit before transfer; non-seekable streams rely on guest-side enforcement.

Fail-fast on unsupported platforms

Importing exec_sandbox on Windows now raises PermanentError immediately instead of failing cryptically at runtime. Orchestrators can catch this and fall back gracefully:

try:
    from exec_sandbox import Scheduler
except PermanentError:
    pass  # use another execution backend

Bug fixes

• Hardened JS/Bun TLS tests against intermittent BoringSSL certificate flakes
• Aligned admission tests with CPU_OVERCOMMIT_RATIO=2x default

Internal

• Documented TLS trust chain for all three REPL runtimes (Python/OpenSSL, Bun/BoringSSL, shell/curl) in spawn.rs
• Replaced 4 constant-dependent effective_max_vms tests with 1 behavioral test
• Standardized scripts on uv run --script with PEP 723 inline metadata
• README restructured for progressive depth

Full changelog: v0.18.1...v0.19.0