$npx -y skills add jsturtevant/copilot-codeact-plugin --skill hyperlight-codeactCodeAct via Hyperlight. Use when looping over many files (8+), cross-referencing results from multiple sources, aggregating data across directories, or chaining 5+ dependent tool calls. Collapses N round-trips into one sandboxed Python run via scripts/codeact.py. NOT beneficial f
| 1 | # Hyperlight CodeAct |
| 2 | |
| 3 | Collapse multi-step tool chains into a single sandboxed Python execution |
| 4 | inside an isolated Hyperlight micro-VM (WebAssembly). |
| 5 | |
| 6 | ## Syntax |
| 7 | |
| 8 | Use `call_tool(name, **kwargs)` — built-in global, no import needed: |
| 9 | |
| 10 | ```python |
| 11 | content = call_tool('view', path='src/main.py') |
| 12 | files = call_tool('glob', pattern='**/*.py') |
| 13 | hits = call_tool('grep', pattern='TODO', paths='src') |
| 14 | result = call_tool('bash', command='git log --oneline -5') |
| 15 | call_tool('edit', path='config.json', old_str='"debug": false', new_str='"debug": true') |
| 16 | ``` |
| 17 | |
| 18 | ## Return types (critical — wrong assumptions cause retries) |
| 19 | |
| 20 | - `call_tool('glob', ...)` → **list of strings** like `["src/app.py", ...]` |
| 21 | - `call_tool('view', ...)` → **string** (file content) |
| 22 | - `call_tool('bash', ...)` → **dict** with `stdout`, `stderr`, `returncode` |
| 23 | - `call_tool('mcp_call', ...)` → **string** |
| 24 | |
| 25 | ## Pattern |
| 26 | |
| 27 | ```python |
| 28 | for f in call_tool('glob', pattern='src/**/*.py'): |
| 29 | try: |
| 30 | content = call_tool('view', path=f) |
| 31 | except Exception: |
| 32 | continue |
| 33 | # analyze content... |
| 34 | print(f"{f}: {result}") |
| 35 | ``` |
| 36 | |
| 37 | ## Rules |
| 38 | |
| 39 | - **One bash call, one program.** Do not scout with separate tool calls first. |
| 40 | - **Wrap file reads in try/except.** |
| 41 | - `glob()` returns workspace-relative paths — pass directly to `view()`. |
| 42 | - Brace expansion works: `call_tool('glob', pattern='src/{db,services}/**/*.py')` |
| 43 | |
| 44 | ## Discover tools |
| 45 | |
| 46 | ```bash |
| 47 | python3 scripts/codeact.py --discover # JSON manifest |
| 48 | python3 scripts/codeact.py --instructions # LLM-ready reference |
| 49 | ``` |
| 50 | |
| 51 | Tools are auto-detected based on what's installed on the host. |
| 52 | |
| 53 | ## Execute |
| 54 | |
| 55 | ```bash |
| 56 | uv run --python 3.13 --with 'hyperlight-sandbox[wasm,python_guest]>=0.3.0' \ |
| 57 | python3 scripts/codeact.py --auto --workspace . --code '...' |
| 58 | ``` |
| 59 | |
| 60 | Output: `{"stdout": "...", "stderr": "...", "exit_code": 0, "success": true}` |
| 61 | |
| 62 | ## Trust model |
| 63 | |
| 64 | Sandboxed code can only reach the outside world through `call_tool()` bridges. |
| 65 | Tools run on the host with full process access. Use `--workspace` to restrict |
| 66 | file tools to a directory tree. |
| 67 | |
| 68 | ## Prerequisites |
| 69 | |
| 70 | - Python 3.10–3.13 (Wasm backend has no wheels for 3.14+) |
| 71 | - `uv` (recommended) or `pip install 'hyperlight-sandbox[wasm,python_guest]>=0.3.0'` |
| 72 | |
| 73 | ## References |
| 74 | |
| 75 | - [references/tool-patterns.md](references/tool-patterns.md) |