[anycodes]

Description

The production serve --commands FILE loader crashed before HTTP startup for valid postponed-annotation dataclasses. The canonical file module is now registered before execution, cached on success, separated from same-basename files, and removed with the original search path restored after failure. Module-name imports remain supported.

Fixes #30. The dependency #29 has merged; this PR now targets main.

Type of Change

• Bug fix
• Tests and bilingual documentation

Validation

• Exact original loader source e2cb27e, built server 0.3.0 wheel: real Express base sandbox installation, production python3 -m agent_sandbox.server serve --commands, postponed dataclass/ClassVar load, HTTP catalog 200 and exact command result all PASS. The source wheel SHA256 and failed preliminary attempt are recorded in the new delivery evidence.
• Focused exact-source CLI tests: 13 passed, including healthcheck. A mistaken initial import of the unfixed workspace installation caused five regressions to fail; the explicit source-path run passes and confirms those tests catch the defect.
• Both owned source-wheel cloud sandboxes destroyed; final janitor dry run zero candidates out of zero listed, exit zero.
• Repository health: 106 PASS, one optional release-guide warning, zero FAIL. Hygiene and scoped configured-secret scan PASS.
• Fresh dependency installation: original uv workspace command, both editable packages, 87 packages. Local lint/format/mypy PASS; local server suite 853 PASS/7 FAIL (six restricted-host raw HTTP checks, one uv environment without pip); stopped before client/build and was not retried through alternate network paths. Exact synchronized head 126e445 passed the complete nine-job normal GitHub matrix, including the same full server suite on Python 3.10/3.11/3.12. Evidence-only follow-up 01f79ef75f89bc20441fff3a784150c024b09e3f preserves both local failures and remote successes and reruns its full matrix before merge.
• Parent reviewer independently reviews the delivery diff. Historical partial/failed evidence is preserved; the archive mismatch was fixed in merged docs: translate the OpenSandbox research archive into Chinese #40, and the previously polluted optional-dependency mypy environment is replaced by an isolated development environment.

Records and limits

New evidence: .agents/evidence/verify/2026-10-16-server-loader-cloud-delivery.md; canonical seven-section note: .agents/notes/proposed/feature/2026-10-16-server-command-loader.md. English/Chinese server guides and CHANGELOG are included.

The successor #33 separately records the corrected complete cloud harness run: 113 passed, four unavailable native-provider skips, two slow deselections, one documented KI-009 expected failure. It is not presented as a direct run of this branch. New Docker image deployment, native provider credentials and public package publication are not established by this loader fix.

Definition of Done

• Regression tests and direct real-component source-wheel scenario pass
• Evidence, note, English/Chinese docs and changelog included
• Health and hygiene pass
• Final exact head 01f79ef passed all nine checks; root independent review passed before normal merge

Actual remote state: MERGED at 2026-10-16 04:38:26 UTC, merge commit 8d22eae; Issue 30 closed.