Skip to main content

PyBonsai

PyBonsai is a restricted subset of Python 3.12 for writing configuration that must give the same result on every machine. It is the configuration language of PyrixOS and is defined in section 7 of RFC 0001, but the package has no knowledge of packages or builds and can be embedded in any Python program.

A PyBonsai file is ordinary Python syntax. It is never run by CPython. PyBonsai parses it into a syntax tree, rejects every construct outside an allow list, and then interprets the tree itself. A file therefore cannot:

  • read or write files, open network connections, or read the clock or environment variables;
  • change a value after creating it, since lists, dicts and sets become immutable tuples, mappings and frozensets;
  • loop without a bound, since while and recursion are rejected and every for runs over a finite collection.

The same file with the same inputs always produces the same values, and evaluation always finishes within fixed limits.

Status

Implemented. The parser, checker and evaluator follow RFC 0001 section 7, and the tests encode its rules. The coverage floor is 80%.

Install

The distribution is named pybonsai-lang, because the name pybonsai on PyPI belongs to an unrelated project. The import name is pybonsai. To use it in another project:

pip install pybonsai-lang

or add pybonsai-lang>=1.0,<2 to the project's dependencies. Version 1 keeps the language and the names in pybonsai.__all__ stable: a file that evaluates under 1.0 gives the same values under every 1.x release.

To work on PyBonsai itself:

python -m pip install --upgrade "pip>=25.1"
pip install --group dev
pip install --config-settings editable_mode=strict -e .
pybootstrap check

Python 3.12 or later is required. There are no runtime dependencies. The dev dependency group installs pybootstrap and the tools its gates drive: ruff for formatting and lint, pyright for type checking, pytest with coverage (at least 80%), and hypothesis for property tests. Each tool also works on its own, for example pytest or ruff check src tests.

The repository's src directory is the package itself, mapped to its import name in pyproject.toml. Strict editable mode gives that mapping a real pybonsai/ directory under build/, which pyright needs to find the package. Tests import the installed package, so install before running them.

Releases are made by pushing a tag vX.Y.Z that matches __version__ and has a section in CHANGELOG.md. The release workflow runs the gates, builds the package, publishes it to PyPI through trusted publishing with attestations, and creates the GitHub release.

Use

from pybonsai import evaluate_source

names = evaluate_source("xs = [i * i for i in range(4)]")
assert names["xs"] == (0, 1, 4, 9)

A program adds its own functions and value types through a Host:

from pybonsai import Builtin, evaluate_source, make_host

host = make_host(
    names={"double": Builtin("double", lambda x: 2 * x)},
    types={},
)
evaluate_source("y = double(21)", host=host)

A host can also give a file constants, such as a mapping of options, which the file reads like any other name. A dict or list given here reaches the file as a read-only mapping or tuple:

host = make_host(names={"config": {"DEBUG": True}})
evaluate_source("debug = config.get('DEBUG', False)", host=host)

Host types must be immutable and hashable, and each one lists the attributes a file may read. Without a host, a file sees only the prelude: len, range, sorted, min, max, sum, any, all, abs, str, int, bool, enumerate, zip and reversed.

Layout

Module Role
parser.py Parse source with the Python 3.12 grammar
checker.py Reject constructs outside the allow list before evaluation
allowlist.py Permitted syntax nodes, operators and attributes
evaluator.py Interpret the checked syntax tree
values.py Immutable value types, freezing and attribute access
scope.py Name lookup for module and function scopes
limits.py Size, depth and step limits
prelude.py The pure built-in functions
host.py The interface for embedding programs
errors.py Error types with file and line positions

License

GPL-2.0-only. See LICENSE.

Metadata

Release files for pybonsai-lang 1.1.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for pybonsai-lang 1.1.0
File Size Uploaded Provenance Actions
pybonsai_lang-1.1.0.tar.gz 42.4 kB With provenance Details for pybonsai_lang-1.1.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for pybonsai-lang 1.1.0
File Interpreter ABI Platform Actions
pybonsai_lang-1.1.0-py3-none-any.whl Python 3 none any Details for pybonsai_lang-1.1.0-py3-none-any.whl

Total release size: 82.3 kB

Release files / pybonsai_lang-1.1.0.tar.gz

Download URL pybonsai_lang-1.1.0.tar.gz
Size 42.4 kB
Tags Source
SHA-256 checksum
How to use checksums
35a360bfc5b9b096a798e06f468d33eeb7f0ae2e41108a8389b6764e8d15d71a
BLAKE2b-256 checksum
How to use checksums
598011d46191d3d52f386fddbd072cd56e5dec4aba83eb370cbfd5eaa3fadf96
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.

Transparency log

Release files / pybonsai_lang-1.1.0-py3-none-any.whl

Download URL pybonsai_lang-1.1.0-py3-none-any.whl
Size 39.9 kB
Tags Python 3
SHA-256 checksum
How to use checksums
7c6efe385aa70abf2f10944adea658fba57dc53380d3a1b013d0763dfdae01df
BLAKE2b-256 checksum
How to use checksums
25f8c8d8df02f73f5fa9e747b9de103b8223b6a021af4d59f441f0c1cc3aea2b
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.

Transparency log

Security for pybonsai-lang 1.1.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for pybonsai_lang-1.1.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 30, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page