Previously __import__ was a plain closure whose __globals__ contained
this module's real __builtins__, so sandboxed code could escape via
__import__.__globals__['__builtins__']['__import__']('os').
Wrap _safe_import in _SafeBuiltin (same hardening as other builtins) so
its __globals__ attribute is not reachable from user code. Also resolve
_real_import at wrap-time rather than closing over __builtins__ to keep
the closure minimal.
Replace closure wrapper with a callable class (_SafeBuiltin) built in an
isolated exec namespace. Closures leak this module's globals via
wrapper.__globals__ (print.__globals__['io'], print.__globals__['Path']).
The callable class has no __globals__ attribute at instance level, and
the class methods' __globals__ is the isolated namespace instead of this
module.
Also block pathlib and asyncio imports — both modules import os directly,
so Path.cwd.__globals__['os'] and asyncio.subprocess were escape routes.
Remove os from the default namespace and restrict __builtins__ to a
curated safe set (no open/exec/eval/compile). Add an import guard that
blocks os, subprocess, shutil, sys, builtins, and other system-access
modules. Preserve __build_class__ so class definitions still work.
Wrap builtin functions to prevent __self__ leaking the builtins module.
Remove Path and asyncio from pre-loaded namespace to close
Path.cwd.__globals__ and asyncio.sys.modules escape routes.
Saurav Panda