agent-hitch 0.2.15 → 0.2.17

package/integrations/harbor/hitch_shared_runtime.py

@@ -0,0 +1,123 @@
+"""Read-only, evaluation-local installation snapshots for Harbor main services.
+
+This changes transport, not content authentication. The bridge and in-container
+Hitch keep their existing pinned manifest and payload checks.
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+import posixpath
+import re
+from pathlib import Path
+from typing import Any
+
+CONTROLLER_TARGET = "/opt/hitch"
+ARTIFACT_TARGET = "/opt/hitch-harness-artifact"
+TARGETS = (CONTROLLER_TARGET, ARTIFACT_TARGET)
+
+
+def configure(raw: Any, candidate: bool) -> dict[str, str] | None:
+    if raw is None:
+        return None
+    if not isinstance(raw, dict) or set(raw) != {"runtime_directory", "artifact_directory"}:
+        raise ValueError("shared runtime transport metadata is invalid")
+    for value in raw.values():
+        if not isinstance(value, str) or not Path(value).is_absolute() or any(ord(c) < 32 for c in value):
+            raise ValueError("shared runtime transport requires absolute host paths")
+    # Harbor also forwards environment kwargs to separate verifier containers.
+    # Only the candidate session receives harness code.
+    if not candidate:
+        return None
+    result = {
+        CONTROLLER_TARGET: str(Path(raw["runtime_directory"]) / "payload"),
+        ARTIFACT_TARGET: raw["artifact_directory"],
+    }
+    for source in result.values():
+        if not Path(source).is_dir() or Path(source).is_symlink():
+            raise ValueError("shared runtime snapshot must be an existing regular directory")
+    return result
+
+
+def reject_conflicts(services: dict[str, Any]) -> None:
+    """Validate resolved services before exposing any shared installation."""
+    # Volume inheritance can copy main's mounts into sidecars transitively,
+    # or import unknown external mounts into main. A read-only declaration
+    # cannot protect a mount inherited by a privileged consumer. Require
+    # explicit mounts throughout this composition instead of guessing which
+    # container aliases or inheritance chains remain isolated.
+    if any(service.get("volumes_from") for service in services.values()):
+        raise ValueError("shared runtime does not support Compose volume inheritance")
+    # A sidecar can also join main's PID namespace and enter its mount
+    # namespace. Apply the privilege boundary to the entire composition.
+    for service in services.values():
+        if service.get("privileged") or any(str(cap).upper().removeprefix("CAP_") in {"ALL", "SYS_ADMIN"} for cap in (service.get("cap_add") or [])):
+            raise ValueError("shared runtime requires unprivileged services without CAP_SYS_ADMIN")
+    config = services["main"]
+    for mount in config.get("volumes") or []:
+        if isinstance(mount, dict):
+            target = mount.get("target")
+        elif isinstance(mount, str):
+            parts = mount.split(":")
+            target = parts[1] if len(parts) > 1 else parts[0]
+        else:
+            raise ValueError("shared runtime cannot validate candidate mounts")
+        if not isinstance(target, str):
+            raise ValueError("shared runtime cannot validate candidate mount target")
+        target = posixpath.normpath(target)
+        if any(target == reserved or target.startswith(reserved + "/") for reserved in TARGETS):
+            raise ValueError("task mount conflicts with a shared runtime installation")
+
+
+def compose_mounts(sources: dict[str, str]) -> list[dict[str, Any]]:
+    return [{"type": "bind", "source": source.replace("$", "$$"), "target": target,
+             "read_only": True, "bind": {"create_host_path": False}}
+            for target, source in sources.items()]
+
+
+def validate_mounts(inspected: Any, expected: dict[str, str]) -> None:
+    if not isinstance(inspected, dict) or not isinstance(inspected.get("mounts"), list):
+        raise RuntimeError("shared runtime Docker mount inspection is invalid")
+    if inspected.get("privileged") or any(str(c).upper().removeprefix("CAP_") in {"ALL", "SYS_ADMIN"} for c in (inspected.get("cap_add") or [])):
+        raise RuntimeError("shared runtime requires an unprivileged candidate without CAP_SYS_ADMIN")
+    found = {}
+    for mount in inspected["mounts"]:
+        target = mount.get("Destination", "")
+        if any(target.startswith(reserved + "/") for reserved in TARGETS):
+            raise RuntimeError("nested mount shadows a shared runtime installation")
+        if target in expected:
+            if target in found or mount.get("Type") != "bind" or mount.get("RW") is not False:
+                raise RuntimeError("shared runtime installation is not a unique read-only bind mount")
+            if mount.get("Source") != expected[target]:
+                raise RuntimeError("shared runtime bind source does not match its job")
+            found[target] = mount
+    if set(found) != set(expected):
+        raise RuntimeError("shared runtime installation mount is missing")
+
+
+async def verify_environment(environment: Any, controller_payload: Path, artifact_directory: Path) -> bool:
+    expected = environment._hitch_shared_runtime
+    if expected is None:
+        return False
+    if expected != {CONTROLLER_TARGET: str(controller_payload), ARTIFACT_TARGET: str(artifact_directory)}:
+        raise RuntimeError("shared runtime environment and agent handoff disagree")
+    result = await environment._run_docker_compose_command(["ps", "--all", "--quiet", "main"])
+    identity = result.stdout.strip()
+    if not re.fullmatch(r"[a-f0-9]{64}", identity):
+        raise RuntimeError("shared runtime requires exactly one candidate container")
+    template = '{"mounts":{{json .Mounts}},"privileged":{{json .HostConfig.Privileged}},"cap_add":{{json .HostConfig.CapAdd}}}'
+    process = await asyncio.create_subprocess_exec(
+        "docker", "inspect", "--format", template, identity,
+        env=environment._compose_env_vars(),
+        stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.DEVNULL,
+    )
+    try:
+        stdout, _ = await asyncio.wait_for(process.communicate(), 30)
+    finally:
+        if process.returncode is None:
+            process.kill()
+            await process.wait()
+    if process.returncode != 0 or len(stdout) > 1024 * 1024:
+        raise RuntimeError("shared runtime Docker mount inspection failed")
+    validate_mounts(json.loads(stdout), expected)
+    return True

package/integrations/model-call/cli.js

@@ -14,9 +14,9 @@ const key = process.env.HITCH_LOCAL_MODEL_TOKEN || process.env.OPENAI_API_KEY;
 if (!key) throw new Error('a model API credential is required for the model-call harness');
 const base = new URL(process.env.HITCH_LOCAL_MODEL_BASE_URL || process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1/');
 const loopback = base.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(base.hostname);
-const managedRunId = process.env.HITCH_MANAGED_RUN_ID || '';
-const managed = process.env.HITCH_MANAGED_LOCAL_INFERENCE === '1'
-  && key === 'hitch-managed-local'
+const managedRunId = process.env.HITCH_EXTERNAL_RUN_ID || '';
+const managed = process.env.HITCH_EXTERNAL_ENDPOINT_BINDING
+  && key === 'hitch-external-endpoint'
   && /^run_[a-f0-9]{32}$/.test(managedRunId)
   && base.protocol === 'http:'
   && new RegExp(`^/[a-f0-9]{48}/${managedRunId}/openai/?$`).test(base.pathname);
@@ -27,7 +27,8 @@ for await (const chunk of process.stdin) {
   raw += chunk;
   if (Buffer.byteLength(raw) > 30 * 1024 * 1024) throw new Error('model input exceeds 30 MB');
 }
-const input = JSON.parse(raw);
+let input;
+try { input = JSON.parse(raw); } catch { input = { schema_version: '1', messages: [{ role: 'user', content: [{ type: 'input_text', text: raw }] }] }; }
 const allowed = new Set(['schema_version', 'messages', 'max_output_tokens', 'reasoning_effort']);
 if (input.schema_version !== '1' || Object.keys(input).some(k => !allowed.has(k)) || !Array.isArray(input.messages) || !input.messages.length) throw new Error('invalid model input');
 for (const message of input.messages) {
@@ -46,18 +47,18 @@ if (!Number.isSafeInteger(maxTokens) || maxTokens < 1 || maxTokens > 131072) thr
 if (input.reasoning_effort !== undefined && !['none', 'minimal', 'low', 'medium', 'high', 'xhigh'].includes(input.reasoning_effort)) throw new Error('invalid reasoning effort');
 const emit = event => console.log(JSON.stringify(event));
 emit({ type: 'session.created', session_id: randomUUID() });
-const response = await fetch(new URL('responses', base), {
+const responses = process.env.HITCH_MODEL_API !== 'chat-completions';
+const response = await fetch(new URL(responses ? 'responses' : 'chat/completions', base), {
   redirect: 'error',
   method: 'POST', headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
-  body: JSON.stringify({ model, input: input.messages, tools: [], tool_choice: 'none', store: false,
-    max_output_tokens: maxTokens, ...(input.reasoning_effort ? { reasoning: { effort: input.reasoning_effort } } : {}) }),
+  body: JSON.stringify(responses ? { model, input: input.messages, tools: [], tool_choice: 'none', store: false, max_output_tokens: maxTokens, ...(input.reasoning_effort ? { reasoning: { effort: input.reasoning_effort } } : {}) } : { model, messages: input.messages.map(m => ({ role: m.role, content: m.content.map(p => p.text || '').join('\n') })), max_tokens: maxTokens }),
   signal: AbortSignal.timeout(3600000),
 });
 if (!response.ok) throw new Error(`model API returned HTTP ${response.status}`);
 const body = await response.json();
-if (!['completed', 'incomplete'].includes(body.status) || !Array.isArray(body.output)) throw new Error('invalid model completion');
-if (body.output.some(item => !['message', 'reasoning'].includes(item.type))) throw new Error('model returned a prohibited tool/action item');
-const output = body.output.filter(item => item.type === 'message').flatMap(item => item.content || []).map(part => part.type === 'output_text' ? part.text : part.type === 'refusal' ? part.refusal : '').join('\n');
+if (responses && (!['completed', 'incomplete'].includes(body.status) || !Array.isArray(body.output)) || !responses && !Array.isArray(body.choices)) throw new Error('invalid model completion');
+if (responses && body.output.some(item => !['message', 'reasoning'].includes(item.type))) throw new Error('model returned a prohibited tool/action item');
+const output = !responses ? body.choices.map(c => c.message?.content || '').join('\n') : body.output.filter(item => item.type === 'message').flatMap(item => item.content || []).map(part => part.type === 'output_text' ? part.text : part.type === 'refusal' ? part.refusal : '').join('\n');
 // An empty answer (including token exhaustion) remains a gradable model
 // outcome. Provider/transport failures above remain infrastructure errors.
 emit({ type: 'provider.response', response: body });

package/integrations/training-tool/cli.js

@@ -9,11 +9,13 @@ if (args.length !== 2 || args[0] !== '--model' || !args[1]) throw new Error('Usa
 if (process.env.HITCH_HARBOR_INTERNAL !== '1') throw new Error('training-tool requires a Harbor task container');
 const binding = JSON.parse(process.env.HITCH_TRAINING_BINDING || 'null');
 const training = process.env.HITCH_TRAINING_EXTERNAL === '1';
-if (!training && process.env.HITCH_MANAGED_LOCAL_INFERENCE !== '1') throw new Error('explicit Hitch model binding required');
-const runId = training ? process.env.HITCH_TRAINING_RUN_ID : process.env.HITCH_MANAGED_RUN_ID;
+const external = JSON.parse(process.env.HITCH_EXTERNAL_ENDPOINT_BINDING || 'null');
+if (!training && !external) throw new Error('explicit Hitch model binding required');
+const runId = training ? process.env.HITCH_TRAINING_RUN_ID : process.env.HITCH_EXTERNAL_RUN_ID;
 const base = new URL(process.env.OPENAI_BASE_URL || '');
 if (!/^run_[a-f0-9]{32}$/.test(runId || '') || base.protocol !== 'http:' || base.username || base.password || base.search || base.hash
   || !new RegExp(`^/[a-f0-9]{48}/${runId}/openai/?$`).test(base.pathname)) throw new Error('invalid run-scoped endpoint');
+if (!training && (external.api !== 'chat-completions' || args[1] !== external.endpoint_ref)) throw new Error('wrong ordinary endpoint binding');
 if (training && args[1] !== `training/${binding?.binding_id}`) throw new Error('wrong training binding');
 if (!base.pathname.endsWith('/')) base.pathname += '/';
 const maxTokens = training ? binding.max_output_tokens : Number(process.env.HITCH_LOCAL_MAX_OUTPUT_TOKENS || 2048);
@@ -21,8 +23,11 @@ const maxSteps = training ? binding.max_episode_steps : Number(process.env.HITCH
 if (![maxTokens, maxSteps].every(n => Number.isSafeInteger(n) && n > 0)) throw new Error('invalid harness budget');
 let prompt = '';
 for await (const chunk of process.stdin) { prompt += chunk; if (Buffer.byteLength(prompt) > 8 * 1024 * 1024) throw new Error('prompt exceeds 8 MiB'); }
-const messages = [{ role: 'user', content: prompt }];
-const tools = [{ type: 'function', function: { name: 'bash', description: 'Run a command in the task container.', parameters: { type: 'object', properties: { command: { type: 'string' } }, required: ['command'], additionalProperties: false } } }];
+const messages = [
+  { role: 'system', content: `You are operating a live terminal in the task container. The current working directory is ${process.cwd()}. Use the bash tool to complete the user's task autonomously. Inspect the actual files and command output before choosing paths or actions. Keep commands and scripts short and focused. Run the commands needed to make the requested changes, check their results, and correct errors. Do not substitute instructions or placeholder commands for performing the work. Give your final response only after checking that the requested result exists.` },
+  { role: 'user', content: prompt },
+];
+const tools = [{ type: 'function', function: { name: 'bash', description: 'Run a command in the task container, with a 120-second timeout and up to 4096 characters of output.', parameters: { type: 'object', properties: { command: { type: 'string' } }, required: ['command'], additionalProperties: false } } }];
 const emit = event => console.log(JSON.stringify(event));
 let child;
 const abort = new AbortController();
@@ -36,7 +41,7 @@ for (let step = 0; step < maxSteps; step++) {
     method: 'POST', redirect: 'error', headers: { Authorization: `Bearer ${process.env.OPENAI_API_KEY}`, 'Content-Type': 'application/json', 'Idempotency-Key': `${runId}-${step}` },
     body: JSON.stringify({ model: args[1], messages, tools, stream: false, max_tokens: maxTokens }), signal: abort.signal,
   });
-  if (!response.ok) throw new Error(`training gateway returned HTTP ${response.status}`);
+  if (!response.ok) throw new Error(`model endpoint returned HTTP ${response.status}`);
   const body = await response.json(); abort.signal.throwIfAborted(); const choice = body.choices?.[0];
   if (!choice?.message || body.choices.length !== 1) throw new Error('invalid completion');
   emit({ type: 'provider.response', response: body, receipt_id: response.headers.get('x-gear-receipt-id') });
@@ -51,18 +56,54 @@ for (let step = 0; step < maxSteps; step++) {
   if (choice.finish_reason !== 'tool_calls') throw new Error('missing tool terminal state');
   for (const call of calls) {
     abort.signal.throwIfAborted();
-    if (call.function?.name !== 'bash' || typeof call.id !== 'string') throw new Error('unsupported tool');
-    const input = JSON.parse(call.function.arguments);
-    if (typeof input.command !== 'string' || Object.keys(input).join(',') !== 'command') throw new Error('invalid bash arguments');
+    if (typeof call.id !== 'string') throw new Error('missing tool call identity');
+    let input; let toolError;
+    if (call.function?.name !== 'bash') toolError = 'Unknown tool. The available tool is bash, with arguments {"command":"shell command"}.';
+    else {
+      try { input = JSON.parse(call.function.arguments); }
+      catch { toolError = 'Invalid JSON arguments. bash expects {"command":"shell command"}.'; }
+      if (!toolError && (!input || typeof input !== 'object' || Array.isArray(input)
+        || typeof input.command !== 'string' || Object.keys(input).join(',') !== 'command'))
+        toolError = 'Invalid arguments. bash expects only a string command field.';
+    }
+    if (toolError) {
+      const result = `Tool error: ${toolError} No command was executed.`;
+      messages.push({ role: 'tool', tool_call_id: call.id, content: result });
+      emit({ type: 'tool.rejected', call_id: call.id, name: call.function?.name ?? null, error: toolError });
+      continue;
+    }
     emit({ type: 'tool.started', call_id: call.id, name: 'bash', arguments: input });
     const result = await new Promise((resolve, reject) => {
-      let output = ''; let truncated = false;
-      child = spawn('/bin/bash', ['-lc', input.command], { detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
-      const append = data => { const remaining = 32768 - output.length; if (remaining > 0) output += data.toString().slice(0, remaining); if (data.length > remaining) truncated = true; };
-      child.stdout.on('data', append); child.stderr.on('data', append);
-      const timer = setTimeout(killTool, 30000);
-      child.once('error', error => { clearTimeout(timer); reject(error); });
-      child.once('close', code => { clearTimeout(timer); child = undefined; resolve(`exit=${code}\n${output}${truncated ? '\n[tool output truncated]' : ''}`); });
+      let output = ''; let truncated = false; let timedOut = false;
+      const tool = spawn('/bin/bash', ['-lc', input.command], { detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+      child = tool;
+      let settled = false; let postExitTimer;
+      const append = data => { if (settled) return; const remaining = 4096 - output.length; if (remaining > 0) output += data.toString().slice(0, remaining); if (data.length > remaining) truncated = true; };
+      tool.stdout.on('data', append); tool.stderr.on('data', append);
+      const timer = setTimeout(() => { timedOut = true; killTool(); }, 120000);
+      const finish = (code, background = false) => {
+        if (settled) return;
+        settled = true; clearTimeout(timer); clearTimeout(postExitTimer);
+        if (child === tool) child = undefined;
+        resolve(`exit=${code}\n${output}${truncated ? '\n[tool output truncated]' : ''}${timedOut ? '\n[command timed out after 120 seconds]' : ''}${background ? '\n[command exited; background process kept output streams open]' : ''}`);
+      };
+      tool.once('error', error => {
+        if (settled) return;
+        settled = true; clearTimeout(timer); clearTimeout(postExitTimer);
+        if (child === tool) child = undefined;
+        reject(error);
+      });
+      tool.once('exit', code => {
+        clearTimeout(timer);
+        // Let ordinary output drain; daemons must not hold the command open.
+        postExitTimer = setTimeout(() => {
+          finish(code, true);
+          // Keep draining and discard later logs while the harness is alive.
+          // Unref lets it exit; Harbor owns cleanup of the task's processes.
+          tool.stdout.unref(); tool.stderr.unref(); tool.unref();
+        }, 1000);
+      });
+      tool.once('close', code => finish(code));
     });
     messages.push({ role: 'tool', tool_call_id: call.id, content: result });
     emit({ type: 'tool.completed', call_id: call.id, output: result });

package/node_modules/smol-toml/LICENSE

@@ -0,0 +1,24 @@
+Copyright (c) Squirrel Chat et al., All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.