miniswen 1.3.5 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb0210425289d60629f23be4579598a50bd5e901da6ba2c8198ba3d9cb5760a0
-  data.tar.gz: e9377f196e3342d3cc3b67cd1ff5be7af22937be9a49647872a90a9a5ff888d1
+  metadata.gz: 49e7b2a4a062867c6b85476f94ebda50ce7d356add5500d40b2c5c513155f7ca
+  data.tar.gz: 4b5dfc61e161b9e2776b2547e8a10862e785fedcbd5fff1a1621054657ed21fb
 SHA512:
-  metadata.gz: 8fbdd1b68f84eab112e32de6a8eed4d85872424cae07ae3166aa334bb924e2c00b73654d59386b22e58b4ad4125fb0405dbff3b82484495c9927e650173f1af4
-  data.tar.gz: 5f6e01261b89cc6fc048f3ea960a89eef3ce5e43b9d2d16e2758b2c8899731e3eb849a1b7bd996224b30f21c216ad7abf1baf540b3ae9036c6278531669a1d6b
+  metadata.gz: b6e67519d94b5e32469173068f8121f8682dd5f16398c38c118f4516931d9e8b2e068e89f612bdc3d543df0a10cc9d8279bc425de404b1e63774085f77f8fab1
+  data.tar.gz: addc1fbee5c18257a2e0f115316a33a4f0f5e9233bb6a7f47ed43d244f1e49ec0a4fd912519e9442edb149a01c25d21cebe3f84cf8d4d6142d170bc30266c80b

data/lib/miniswen/agent.rb

@@ -294,6 +294,8 @@ module Miniswen
         end
 
         actions.each do |action|
+          return finish(:time_limit) if out_of_time?
+
           reporter&.on_tool_call(action)
           result = execute(action.fetch(:arguments).fetch("command"))
           # The submit command's output is observed too, so the final tool
@@ -334,12 +336,14 @@ module Miniswen
     # Checked before the model is asked, so the tripping step is never paid for.
     def limit_reached
       return :step_limit if max_steps.positive? && @steps >= max_steps
-      return :time_limit if max_time.positive? && (@clock.call - @started_at) >= max_time
+      return :time_limit if out_of_time?
       return :cost_limit if max_cost && @cost_known && @cost >= max_cost
 
       nil
     end
 
+    def out_of_time? = max_time.positive? && (@clock.call - @started_at) >= max_time
+
     # One model turn. Returns the actions to run, or nil after appending a
     # format-error message the model gets to react to on its next turn.
     def next_actions
@@ -568,6 +572,11 @@ module Miniswen
                               registry: nil)
       end
       return nil unless info
+      if free?
+        return CostSource.new(name: :free_model, model: @model,
+                              priced_as: "#{info.provider}/#{info.id} ($0.00, free)",
+                              registry: Miniswen.registry_revision)
+      end
 
       CostSource.new(name: :model_registry, model: @model,
                      priced_as: "#{info.provider}/#{info.id}",
@@ -668,6 +677,8 @@ module Miniswen
 
     def local? = LOCAL_PROVIDERS.include?((@provider || info&.provider)&.to_sym)
 
+    def free? = info&.provider == "openrouter" && info.input_price_per_million.nil? && info.output_price_per_million.nil?
+
     def info
       return @info if defined?(@info)
 
@@ -681,7 +692,7 @@ module Miniswen
     end
 
     def price(response)
-      return 0.0 if local?
+      return 0.0 if local? || free?
 
       input = info&.input_price_per_million
       output = info&.output_price_per_million

data/lib/miniswen/cli.rb

@@ -23,10 +23,13 @@ module Miniswen
       @refresh_registry = false
       @skip_registry_refresh = false
       @jail = false
+      @allowed_hosts = nil
+      @workdir = nil
     end
 
     def run
       parse_args!
+      Dir.chdir(@workdir) if @workdir
 
       # Require the core library after parsing options,
       # so env flags kick in
@@ -45,7 +48,7 @@ module Miniswen
           Environment::Docker.new(@docker_id)
         elsif @jail
           require "miniswen/jail"
-          Jail.new.start
+          Jail.new(allowed_hosts: @allowed_hosts).start
         else
           Local.new
         end
@@ -161,6 +164,14 @@ module Miniswen
           @jail = true
         end
 
+        opts.on("--allow-hosts=HOSTS", String, "Let jailed commands reach these hosts through a proxy (comma-separated)") do |v|
+          @allowed_hosts = v.split(",").map(&:strip).reject(&:empty?)
+        end
+
+        opts.on("--workdir=DIR", String, "Run commands in DIR instead of the current directory") do |v|
+          @workdir = v
+        end
+
         opts.on("--refresh-registry", "Refresh the model registry, persist it, and exit") do
           @refresh_registry = true
         end

data/lib/miniswen/jail/proxy.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "socket"
+
+module Miniswen
+  class Jail < Local
+    # An HTTP CONNECT proxy that lets jailed commands reach the allowed hosts only.
+    class Proxy
+      def self.forward(port, socket)
+        server = TCPServer.new("127.0.0.1", port)
+        exit!(0) if fork
+        serve(server) { pump(it, UNIXSocket.new(socket)) }
+      end
+
+      def self.serve(server)
+        Thread.report_on_exception = false
+        loop { Thread.new(server.accept) { yield it } }
+      end
+
+      def self.pump(client, upstream)
+        Thread.new do
+          IO.copy_stream(client, upstream)
+          upstream.close_write
+        end
+        IO.copy_stream(upstream, client)
+      ensure
+        client.close
+        upstream.close
+      end
+
+      def initialize(hosts:, socket:)
+        @hosts = hosts
+        @socket = socket
+      end
+
+      def start
+        FileUtils.rm_f(@socket)
+        server = UNIXServer.new(@socket)
+        @pid = fork { self.class.serve(server) { handle(it) } }
+        self
+      end
+
+      def stop
+        Process.kill(:KILL, @pid)
+        Process.wait(@pid)
+      end
+
+      def handle(client)
+        _, target = client.gets("\r\n\r\n").split(" ", 3)
+        host, port = target.split(":", 2)
+        return client.write("HTTP/1.1 403 Forbidden\r\n\r\n") unless @hosts.include?(host)
+
+        upstream = Socket.tcp(host, port.to_i, connect_timeout: 10)
+        client.write("HTTP/1.1 200 Connection Established\r\n\r\n")
+        self.class.pump(client, upstream)
+      ensure
+        client.close
+      end
+    end
+  end
+end

data/lib/miniswen/jail.rb

@@ -1,30 +1,39 @@
 # frozen_string_literal: true
 
+require "open3"
 require "shellwords"
 
 require "miniswen/local"
+require "miniswen/jail/proxy"
 
 module Miniswen
   # Runs every command in its own namespaces: none of the harness's environment,
-  # no network, read-only system, none of its files.
+  # no network, read-only system, none of its files. A task that may reach some
+  # hosts gets an HTTP proxy on loopback that allows only those.
   class Jail < Local
-    def initialize(workdir: Dir.pwd)
+    PROXY_PORT = 3128
+    PROXY_SOCKET = "/var/lib/miniswen/run/miniswen-proxy.sock"
+
+    def initialize(workdir: Dir.pwd, allowed_hosts: nil)
       @workdir = workdir
+      @allowed_hosts = allowed_hosts
     end
 
     def start
       _, @stdout, @stderr, @holder = Open3.popen3(
-        ENV.to_h.slice(*container_variables),
+        container_env,
         "unshare", "--net", "--mount", "--pid", "--fork", "--kill-child", "--mount-proc", "sh", "-c", setup,
         pgroup: true, unsetenv_others: true
       )
-      return self if @stdout.gets == "ready\n"
+      raise InfrastructureError, "jail did not start: #{@stderr.read}" unless @stdout.gets == "ready\n"
 
-      raise InfrastructureError, "jail did not start: #{@stderr.read}"
+      @proxy = Proxy.new(hosts: @allowed_hosts, socket: PROXY_SOCKET).start if @allowed_hosts
+      self
     end
 
     def stop
-      Process.kill(:KILL, -@holder.pid) if @holder.alive?
+      Process.kill(:KILL, -@holder.pid) if @holder&.alive?
+      @proxy&.stop
     end
 
     private
@@ -37,22 +46,40 @@ module Miniswen
       mount --bind #{Shellwords.escape(@workdir)} #{Shellwords.escape(@workdir)}
       # Make private temp dirs their own mounts
       for dir in /tmp /run /root; do mkdir -p "/var/lib/miniswen$dir" && mount --bind "/var/lib/miniswen$dir" "$dir"; done
+      #{forwarder_command if @allowed_hosts}
       # Make everything without its own mount read-only
       mount -o remount,bind,ro /
       echo ready
       exec sleep infinity
     SH
 
+    def forwarder_command
+      forward = "Miniswen::Jail::Proxy.forward(#{PROXY_PORT}, #{"/run/#{File.basename(PROXY_SOCKET)}".inspect})"
+      [ RbConfig.ruby, "-I", File.expand_path("..", __dir__), "-rminiswen/jail", "-e", forward ].map { Shellwords.escape(it) }.join(" ")
+    end
+
     def spawn_arguments(command, env)
-      [ ENV.to_h.merge(env.to_h).slice(*container_variables),
+      [ command_env(env),
         "nsenter", "--target", @holder.pid.to_s, "--net", "--mount", "--pid=/proc/#{@holder.pid}/ns/pid_for_children", "--wd=#{@workdir}",
         "--", "setpriv", "--bounding-set=-all", "--inh-caps=-all", "--no-new-privs", "--", "sh", "-c", command ]
     end
 
     def spawn_options = super.merge(unsetenv_others: true)
 
+    def command_env(env)
+      variables = container_env.merge(env.to_h).slice(*container_variables)
+      return variables unless @allowed_hosts
+
+      proxy = "http://127.0.0.1:#{PROXY_PORT}"
+      variables.merge("http_proxy" => proxy, "https_proxy" => proxy, "no_proxy" => "localhost,127.0.0.1")
+    end
+
+    def container_env
+      @container_env ||= File.read("/proc/1/environ").split("\0").to_h { it.split("=", 2) }
+    end
+
     def container_variables
-      @container_variables ||= File.read("/proc/1/environ").split("\0").map { it.split("=").first } | Agent::EXEC_ENV.keys
+      @container_variables ||= container_env.keys | Agent::EXEC_ENV.keys
     end
   end
 end

data/lib/miniswen/local.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "open3"
+require "tempfile"
 
 require "miniswen/environment"
 
@@ -12,18 +12,17 @@ module Miniswen
     # Always through a shell: Ruby execs a metacharacter-free string directly,
     # and a missing binary would then raise ENOENT here instead of exiting 127.
     def exec(command, timeout: nil, env: nil)
-      Open3.popen2e(*spawn_arguments(command, env), **spawn_options) do |stdin, io, wait_thr|
-        stdin.close
-        reader = Thread.new { io.read }
+      Tempfile.create("miniswen") do |log|
+        wait_thr = Process.detach(Process.spawn(*spawn_arguments(command, env), in: File::NULL, %i[out err] => log, **spawn_options))
 
         if timeout&.positive? && wait_thr.join(timeout).nil?
           kill_group(wait_thr.pid)
           wait_thr.join
-          output = "#{scrub(reader.value)}\n<command timed out after #{timeout} seconds>"
+          output = "#{scrub(File.read(log))}\n<command timed out after #{timeout} seconds>"
           return ExecResult.new(exit_code: TIMEOUT_EXIT_CODE, output:)
         end
 
-        ExecResult.new(exit_code: exit_code(wait_thr.value), output: scrub(reader.value))
+        ExecResult.new(exit_code: exit_code(wait_thr.value), output: scrub(File.read(log)))
       end
     end
 

data/lib/miniswen/testing.rb

@@ -36,7 +36,13 @@ module Miniswen
       modalities: { input: %w[text], output: %w[text] }
     )
 
-    MODELS = { PRICED_MODEL.id => PRICED_MODEL, UNPRICED_MODEL.id => UNPRICED_MODEL }.freeze
+    FREE_MODEL = RubyLLM::Model::Info.new(
+      id: "test-free", name: "Test free", provider: "openrouter",
+      capabilities: %w[function_calling],
+      modalities: { input: %w[text], output: %w[text] }
+    )
+
+    MODELS = { PRICED_MODEL.id => PRICED_MODEL, UNPRICED_MODEL.id => UNPRICED_MODEL, FREE_MODEL.id => FREE_MODEL }.freeze
 
     # Serves the test models from ruby_llm's registry lookups.
     module FindTestModels

data/lib/miniswen/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Miniswen
-  VERSION = "1.3.5"
+  VERSION = "1.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: miniswen
 version: !ruby/object:Gem::Version
-  version: 1.3.5
+  version: 1.4.0
 platform: ruby
 authors:
 - Svyatoslav Kryukov
@@ -59,6 +59,7 @@ files:
 - lib/miniswen/environment.rb
 - lib/miniswen/environment/docker.rb
 - lib/miniswen/jail.rb
+- lib/miniswen/jail/proxy.rb
 - lib/miniswen/local.rb
 - lib/miniswen/ruby_llm.rb
 - lib/miniswen/testing.rb