The `except*` improvements are underrated. Been using ExceptionGroup in a CLI tool that wraps Semgrep — catching multiple subprocess errors cleanly in one block made the retry logic much simpler.
Interesting approach to sandboxing. One thing I've been thinking about in this space: even with sandboxed execution, the generated code still needs to pass security policy checks before it merges.
Static analysis catches a different class of issues than runtime sandboxing — they seem complementary rather than competing.