agent-hitch 0.2.9 → 0.2.10

package/integrations/harbor/hitch_harbor_environment.py

@@ -31,6 +31,7 @@ _REQUIRED_LABELS = {
 _ALLOWED_LABELS = _REQUIRED_LABELS | {_LABEL_TASK}
 _COMPOSE_RESET_MARKER = "__HITCH_COMPOSE_RESET_NULL__"
 _GPU_OVERRIDE_PREFIX = "__HITCH_GPU_OVERRIDE_"
+_HOST_CREDENTIAL_HELPER_ENV = "HITCH_HOST_CREDENTIAL_HELPER_JSON"
 
 
 class HitchHarborDockerEnvironment(DockerEnvironment):
@@ -128,6 +129,25 @@ class HitchHarborDockerEnvironment(DockerEnvironment):
             return result.model_copy(update={"disable_internet": True, "dynamic_network_policy": False})
         return result
 
+    def _compose_env_vars(self, include_os_env=True):
+        result = super()._compose_env_vars(include_os_env=include_os_env)
+        # The host-only helper command is not a task Compose interpolation
+        # input. The agent reads it directly from its trusted host process.
+        result.pop(_HOST_CREDENTIAL_HELPER_ENV, None)
+        return result
+
+    async def hitch_exec_with_private_env(self, command, *, env, cwd=None, timeout_sec=None, user=None):
+        """Execute one Target without placing per-exec credential values in argv."""
+        from hitch_private_exec import exec_with_private_environment
+        return await exec_with_private_environment(
+            self,
+            command,
+            env=env,
+            cwd=cwd,
+            timeout_sec=timeout_sec,
+            user=user,
+        )
+
     async def _apply_network_policy(self, network_policy):
         if self._hitch_static_no_network:
             if network_policy != self.network_policy:
@@ -375,7 +395,8 @@ def _validate_labels(value: Mapping[str, str] | None) -> dict[str, str]:
     labels = dict(value)
     if (
         not re.fullmatch(r"[a-f0-9]{24}", labels.get(_LABEL_ROOT, ""))
-        or labels.get(_LABEL_PROVIDER) != "local-docker"
+        or not isinstance(labels.get(_LABEL_PROVIDER), str)
+        or not re.fullmatch(r"[a-z0-9][a-z0-9._-]{0,127}", labels[_LABEL_PROVIDER])
         or not re.fullmatch(r"eval_[a-f0-9]{32}", labels.get(_LABEL_EVAL, ""))
         or not re.fullmatch(r"work_[a-f0-9]{32}", labels.get(_LABEL_WORK, ""))
         or not re.fullmatch(r"lease_[a-f0-9]{32}", labels.get(_LABEL_LEASE, ""))

package/integrations/harbor/hitch_host_credentials.py

@@ -0,0 +1,354 @@
+"""Prepare short-lived credentials on the Harbor host at Target start."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import re
+import signal
+import subprocess
+import sys
+import time
+from typing import Any, NamedTuple
+
+HOST_CREDENTIAL_HELPER_ENV = "HITCH_HOST_CREDENTIAL_HELPER_JSON"
+HOST_CREDENTIAL_HELPER_CAPABILITY = "host-task-credential-helper-v1"
+HOST_CREDENTIAL_VALIDITY_MARGIN_MS = 5 * 60 * 1000
+
+_MAX_CONFIG_BYTES = 64 * 1024
+_MAX_OUTPUT_BYTES = 256 * 1024
+_MAX_ARGUMENTS = 32
+_MAX_ARGUMENT_LENGTH = 4_096
+_MAX_CREDENTIAL_BYTES = 256 * 1024
+_ENVIRONMENT_NAME = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
+_WINDOWS_JOB_LAUNCHER = "--hitch-host-credential-helper-job"
+_WINDOWS_JOB_HANDLE = None
+
+
+class _HelperOutputTooLarge(RuntimeError):
+    pass
+
+
+class HostCredentialHelperError(RuntimeError):
+    """A stable failure that never includes helper output or credential values."""
+
+    def __init__(self, code: str, message: str) -> None:
+        super().__init__(f"{code}: {message}")
+        self.code = code
+        self.message = message
+
+
+class HostCredentialHelperConfig(NamedTuple):
+    argv: tuple[str, ...]
+    credential_names: tuple[str, ...]
+    timeout_ms: int
+
+
+def load_host_credential_helper(available_names: list[str]) -> HostCredentialHelperConfig | None:
+    encoded = os.environ.get(HOST_CREDENTIAL_HELPER_ENV)
+    if encoded is None:
+        return None
+    try:
+        if not encoded or len(encoded.encode("utf-8")) > _MAX_CONFIG_BYTES:
+            raise ValueError
+        value = json.loads(encoded)
+        if not isinstance(value, dict) or set(value) != {"version", "argv", "credentialNames", "timeoutMs"}:
+            raise ValueError
+        if isinstance(value["version"], bool) or value["version"] != 1:
+            raise ValueError
+        argv = value["argv"]
+        if (
+            not isinstance(argv, list)
+            or not 1 <= len(argv) <= _MAX_ARGUMENTS
+            or any(not isinstance(item, str) or not item or len(item) > _MAX_ARGUMENT_LENGTH or re.search(r"[\0\r\n]", item) for item in argv)
+            or not os.path.isabs(argv[0])
+        ):
+            raise ValueError
+        names = value["credentialNames"]
+        if (
+            not isinstance(names, list)
+            or not names
+            or any(not isinstance(name, str) or _ENVIRONMENT_NAME.fullmatch(name) is None for name in names)
+            or len(set(names)) != len(names)
+            or any(name not in available_names for name in names)
+        ):
+            raise ValueError
+        timeout_ms = value["timeoutMs"]
+        if isinstance(timeout_ms, bool) or not isinstance(timeout_ms, int) or not 100 <= timeout_ms <= 60_000:
+            raise ValueError
+    except (KeyError, TypeError, ValueError, json.JSONDecodeError):
+        raise HostCredentialHelperError(
+            "host_credential_helper_config_invalid",
+            "host credential helper configuration is invalid",
+        ) from None
+    return HostCredentialHelperConfig(tuple(argv), tuple(sorted(names)), timeout_ms)
+
+
+async def prepare_host_credentials(
+    config: HostCredentialHelperConfig,
+    minimum_validity_ms: int,
+) -> dict[str, str]:
+    if (
+        isinstance(minimum_validity_ms, bool)
+        or not isinstance(minimum_validity_ms, int)
+        or not 1 <= minimum_validity_ms <= 9_007_199_254_740_991
+    ):
+        raise HostCredentialHelperError(
+            "host_credential_helper_request_invalid",
+            "host credential helper request is invalid",
+        )
+    request = json.dumps(
+        {
+            "version": 1,
+            "credentialNames": list(config.credential_names),
+            "minimumValidityMs": minimum_validity_ms,
+        },
+        separators=(",", ":"),
+        sort_keys=True,
+    ).encode("utf-8") + b"\n"
+
+    spawn_options: dict[str, Any]
+    argv: tuple[str, ...]
+    if os.name == "nt":
+        argv = (sys.executable, os.path.abspath(__file__), _WINDOWS_JOB_LAUNCHER, *config.argv)
+        spawn_options = {"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP}
+    else:
+        argv = config.argv
+        spawn_options = {"start_new_session": True}
+
+    try:
+        process = await asyncio.create_subprocess_exec(
+            *argv,
+            stdin=asyncio.subprocess.PIPE,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+            env=dict(os.environ),
+            **spawn_options,
+        )
+    except (OSError, ValueError):
+        raise HostCredentialHelperError(
+            "host_credential_helper_unavailable",
+            "host credential helper could not be started",
+        ) from None
+
+    try:
+        stdout, _stderr = await asyncio.wait_for(
+            _communicate_limited(process, request),
+            timeout=config.timeout_ms / 1000,
+        )
+    except asyncio.TimeoutError:
+        await _terminate_helper(process)
+        raise HostCredentialHelperError(
+            "host_credential_helper_timed_out",
+            "host credential helper exceeded its time limit",
+        ) from None
+    except _HelperOutputTooLarge:
+        await _terminate_helper(process)
+        raise invalid_response() from None
+    except asyncio.CancelledError:
+        await _terminate_helper(process)
+        raise
+
+    if process.returncode != 0:
+        raise HostCredentialHelperError(
+            "host_credential_helper_failed",
+            "host credential helper did not provide credentials",
+        )
+    try:
+        response: Any = json.loads(stdout.decode("utf-8"))
+        if (
+            not isinstance(response, dict)
+            or set(response) != {"version", "env", "expiresAtMs"}
+            or isinstance(response["version"], bool)
+            or response["version"] != 1
+        ):
+            raise ValueError
+        expires_at_ms = response["expiresAtMs"]
+        if isinstance(expires_at_ms, bool) or not isinstance(expires_at_ms, int):
+            raise ValueError
+        values = response["env"]
+        if not isinstance(values, dict) or set(values) != set(config.credential_names):
+            raise ValueError
+        if any(
+            not isinstance(name, str)
+            or not isinstance(value, str)
+            or not value
+            or "\0" in value
+            for name, value in values.items()
+        ):
+            raise ValueError
+        if sum(len(value.encode("utf-8")) for value in values.values()) > _MAX_CREDENTIAL_BYTES:
+            raise ValueError
+    except (TypeError, ValueError, UnicodeDecodeError, json.JSONDecodeError):
+        raise invalid_response() from None
+
+    if expires_at_ms <= int(time.time() * 1000) + minimum_validity_ms:
+        raise HostCredentialHelperError(
+            "host_credential_helper_insufficient_validity",
+            "host credential helper returned credentials with insufficient validity",
+        )
+    return dict(values)
+
+
+async def _communicate_limited(process, request: bytes) -> tuple[bytes, bytes]:
+    async def read(stream) -> bytes:
+        chunks: list[bytes] = []
+        total = 0
+        while True:
+            chunk = await stream.read(min(64 * 1024, _MAX_OUTPUT_BYTES + 1 - total))
+            if not chunk:
+                return b"".join(chunks)
+            chunks.append(chunk)
+            total += len(chunk)
+            if total > _MAX_OUTPUT_BYTES:
+                raise _HelperOutputTooLarge
+
+    stdout_task = asyncio.create_task(read(process.stdout))
+    stderr_task = asyncio.create_task(read(process.stderr))
+    wait_task = asyncio.create_task(process.wait())
+    try:
+        process.stdin.write(request)
+        try:
+            await process.stdin.drain()
+        except (BrokenPipeError, ConnectionResetError):
+            pass
+        process.stdin.close()
+        stdout, stderr, _return_code = await asyncio.gather(stdout_task, stderr_task, wait_task)
+        return stdout, stderr
+    finally:
+        for task in (stdout_task, stderr_task, wait_task):
+            if not task.done():
+                task.cancel()
+        await asyncio.gather(stdout_task, stderr_task, wait_task, return_exceptions=True)
+
+
+async def _terminate_helper(process) -> None:
+    """Kill a failed helper and drain both pipes without retaining their contents."""
+    if os.name == "nt":
+        # The launcher owns a kill-on-close Job, so killing it closes the only
+        # Job handle and terminates the helper tree even if its leader exited.
+        try:
+            process.kill()
+        except ProcessLookupError:
+            pass
+    else:
+        # The group may outlive its leader while a descendant keeps a pipe open.
+        try:
+            os.killpg(process.pid, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+
+    async def discard(stream) -> None:
+        while await stream.read(64 * 1024):
+            pass
+
+    cleanup = asyncio.gather(discard(process.stdout), discard(process.stderr), process.wait())
+    try:
+        await asyncio.wait_for(cleanup, timeout=5)
+    except asyncio.TimeoutError:
+        # Closing the subprocess transport is a last-resort, bounded cleanup.
+        # The helper is already SIGKILLed and never runs inside the Target.
+        transport = getattr(process, "_transport", None)
+        if transport is not None:
+            transport.close()
+
+
+def invalid_response() -> HostCredentialHelperError:
+    return HostCredentialHelperError(
+        "host_credential_helper_response_invalid",
+        "host credential helper returned an invalid response",
+    )
+
+
+def _run_windows_job_launcher(argv: list[str]) -> int:
+    """Run one helper in a Job that owns every non-breakaway descendant."""
+    if os.name != "nt" or not argv:
+        return 125
+    try:
+        _create_windows_kill_on_close_job()
+        return subprocess.call(argv)
+    except (OSError, ValueError):
+        return 125
+
+
+def _create_windows_kill_on_close_job() -> None:
+    # Importing ctypes only inside the Windows launcher keeps the Harbor runtime
+    # importable on every supported POSIX Python.
+    import ctypes
+    from ctypes import wintypes
+
+    class BasicLimitInformation(ctypes.Structure):
+        _fields_ = [
+            ("PerProcessUserTimeLimit", ctypes.c_longlong),
+            ("PerJobUserTimeLimit", ctypes.c_longlong),
+            ("LimitFlags", wintypes.DWORD),
+            ("MinimumWorkingSetSize", ctypes.c_size_t),
+            ("MaximumWorkingSetSize", ctypes.c_size_t),
+            ("ActiveProcessLimit", wintypes.DWORD),
+            ("Affinity", ctypes.c_size_t),
+            ("PriorityClass", wintypes.DWORD),
+            ("SchedulingClass", wintypes.DWORD),
+        ]
+
+    class IoCounters(ctypes.Structure):
+        _fields_ = [
+            ("ReadOperationCount", ctypes.c_ulonglong),
+            ("WriteOperationCount", ctypes.c_ulonglong),
+            ("OtherOperationCount", ctypes.c_ulonglong),
+            ("ReadTransferCount", ctypes.c_ulonglong),
+            ("WriteTransferCount", ctypes.c_ulonglong),
+            ("OtherTransferCount", ctypes.c_ulonglong),
+        ]
+
+    class ExtendedLimitInformation(ctypes.Structure):
+        _fields_ = [
+            ("BasicLimitInformation", BasicLimitInformation),
+            ("IoInfo", IoCounters),
+            ("ProcessMemoryLimit", ctypes.c_size_t),
+            ("JobMemoryLimit", ctypes.c_size_t),
+            ("PeakProcessMemoryUsed", ctypes.c_size_t),
+            ("PeakJobMemoryUsed", ctypes.c_size_t),
+        ]
+
+    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+    kernel32.CreateJobObjectW.argtypes = (ctypes.c_void_p, wintypes.LPCWSTR)
+    kernel32.CreateJobObjectW.restype = wintypes.HANDLE
+    kernel32.SetInformationJobObject.argtypes = (
+        wintypes.HANDLE,
+        ctypes.c_int,
+        ctypes.c_void_p,
+        wintypes.DWORD,
+    )
+    kernel32.SetInformationJobObject.restype = wintypes.BOOL
+    kernel32.GetCurrentProcess.argtypes = ()
+    kernel32.GetCurrentProcess.restype = wintypes.HANDLE
+    kernel32.AssignProcessToJobObject.argtypes = (wintypes.HANDLE, wintypes.HANDLE)
+    kernel32.AssignProcessToJobObject.restype = wintypes.BOOL
+    kernel32.CloseHandle.argtypes = (wintypes.HANDLE,)
+    kernel32.CloseHandle.restype = wintypes.BOOL
+
+    handle = kernel32.CreateJobObjectW(None, None)
+    if not handle:
+        raise ctypes.WinError(ctypes.get_last_error())
+    information = ExtendedLimitInformation()
+    information.BasicLimitInformation.LimitFlags = 0x00002000  # JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+    if not kernel32.SetInformationJobObject(handle, 9, ctypes.byref(information), ctypes.sizeof(information)):
+        error = ctypes.get_last_error()
+        kernel32.CloseHandle(handle)
+        raise ctypes.WinError(error)
+    if not kernel32.AssignProcessToJobObject(handle, kernel32.GetCurrentProcess()):
+        error = ctypes.get_last_error()
+        kernel32.CloseHandle(handle)
+        raise ctypes.WinError(error)
+
+    # Deliberately retain the sole non-inheritable Job handle until ExitProcess.
+    # Its automatic close then terminates any helper descendants still running.
+    global _WINDOWS_JOB_HANDLE
+    _WINDOWS_JOB_HANDLE = handle
+
+
+if __name__ == "__main__":
+    if len(sys.argv) >= 3 and sys.argv[1] == _WINDOWS_JOB_LAUNCHER:
+        raise SystemExit(_run_windows_job_launcher(sys.argv[2:]))
+    raise SystemExit(125)

package/integrations/harbor/hitch_private_exec.py

@@ -0,0 +1,150 @@
+"""Run one Docker Target with per-exec secrets absent from process argv."""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+import json
+import re
+from typing import Any
+
+from harbor.environments.base import ExecResult
+from harbor.environments.docker.docker import _sanitize_docker_compose_project_name
+
+_ENVIRONMENT_NAME = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
+
+
+async def exec_with_private_environment(
+    environment: Any,
+    command: str,
+    *,
+    env: dict[str, str],
+    cwd: str | None = None,
+    timeout_sec: int | None = None,
+    user: str | int | None = None,
+) -> ExecResult:
+    """Pass values through the compose client's environment and only names in argv."""
+    if (
+        not isinstance(env, dict)
+        or not env
+        or any(
+            not isinstance(name, str)
+            or _ENVIRONMENT_NAME.fullmatch(name) is None
+            or not isinstance(value, str)
+            or not value
+            or "\0" in value
+            for name, value in env.items()
+        )
+    ):
+        raise RuntimeError("private Target environment is invalid")
+
+    resolved_user = environment._resolve_user(user)
+    # Preserve Harbor's persistent and task-scoped agent environment, then let
+    # the fresh helper values replace the deliberately blank startup values.
+    target_environment = dict(environment._merge_env(None) or {})
+    target_environment.update(env)
+    exec_command = ["exec"]
+    effective_cwd = cwd or environment.task_env_config.workdir
+    if effective_cwd:
+        exec_command.extend(["-w", effective_cwd])
+    for name in sorted(target_environment):
+        # Docker Compose resolves a name without `=value` from its own process
+        # environment. The secret therefore never appears in host process argv.
+        exec_command.extend(["-e", name])
+    if resolved_user is not None:
+        exec_command.extend(["-u", str(resolved_user)])
+    exec_command.append("main")
+    exec_command.extend(environment._platform.exec_shell_args(command))
+
+    full_command = [
+        "docker",
+        "compose",
+        "--project-name",
+        _sanitize_docker_compose_project_name(environment.session_id),
+        "--project-directory",
+        str(environment.environment_dir.resolve().absolute()),
+    ]
+    for compose_path in environment._docker_compose_paths:
+        full_command.extend(["-f", str(compose_path.resolve().absolute())])
+    full_command.extend(exec_command)
+
+    host_environment = environment._compose_env_vars(include_os_env=True)
+    host_environment.update(target_environment)
+    process = await asyncio.create_subprocess_exec(
+        *full_command,
+        env=host_environment,
+        stdin=asyncio.subprocess.DEVNULL,
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.STDOUT,
+    )
+    try:
+        if timeout_sec is None:
+            stdout, stderr = await process.communicate()
+        else:
+            stdout, stderr = await asyncio.wait_for(process.communicate(), timeout=timeout_sec)
+    except asyncio.TimeoutError:
+        await _terminate_compose_client(process)
+        raise RuntimeError("private Target execution timed out") from None
+    except BaseException:
+        # Match Harbor 0.21's compose-exec cleanup. The surrounding trial still
+        # owns Target teardown; stopping this client alone is not treated as
+        # proof that the command or container has stopped.
+        await _terminate_compose_client(process)
+        raise
+    secrets = sorted(
+        {secret for name, value in env.items() for secret in _credential_secrets(name, value)},
+        key=len,
+        reverse=True,
+    )
+    stdout_text = _redact(stdout.decode(errors="replace") if stdout else None, secrets)
+    stderr_text = _redact(stderr.decode(errors="replace") if stderr else None, secrets)
+    return ExecResult(
+        stdout=stdout_text,
+        stderr=stderr_text,
+        return_code=process.returncode or 0,
+    )
+
+
+async def _terminate_compose_client(process) -> None:
+    if process.returncode is not None:
+        return
+    process.terminate()
+    try:
+        await asyncio.wait_for(process.wait(), timeout=5)
+    except asyncio.TimeoutError:
+        process.kill()
+        await process.wait()
+
+
+def _redact(value: str | None, secrets: list[str]) -> str | None:
+    if value is None:
+        return None
+    for secret in secrets:
+        value = value.replace(secret, "[REDACTED]")
+    return value
+
+
+def _credential_secrets(name: str, value: str) -> list[str]:
+    secrets = [value]
+    if not name.endswith("_B64") or len(value) > 512 * 1024:
+        return secrets
+    try:
+        decoded = base64.b64decode(value, validate=True)
+        if len(decoded) > 256 * 1024:
+            return secrets
+        parsed = json.loads(decoded.decode("utf-8"))
+    except (ValueError, UnicodeDecodeError, json.JSONDecodeError):
+        return secrets
+
+    def collect(entry):
+        if isinstance(entry, str) and len(entry) >= 16:
+            secrets.append(entry)
+        elif isinstance(entry, dict):
+            for nested in entry.values():
+                collect(nested)
+        elif isinstance(entry, list):
+            for nested in entry:
+                collect(nested)
+
+    collect(parsed)
+    return secrets

package/integrations/model-call/cli.js

@@ -10,10 +10,17 @@ if (process.argv.includes('--version')) {
 const args = process.argv.slice(2);
 if (args.length !== 2 || args[0] !== '--model' || !args[1]) throw new Error('Usage: model-call --model MODEL');
 const model = args[1];
-const key = process.env.OPENAI_API_KEY;
-if (!key) throw new Error('OPENAI_API_KEY is required for the model-call harness');
-const base = new URL(process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1/');
-if (base.username || base.password || base.search || base.hash || (base.protocol !== 'https:' && !(base.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(base.hostname)))) throw new Error('invalid model endpoint');
+const key = process.env.HITCH_LOCAL_MODEL_TOKEN || process.env.OPENAI_API_KEY;
+if (!key) throw new Error('a model API credential is required for the model-call harness');
+const base = new URL(process.env.HITCH_LOCAL_MODEL_BASE_URL || process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1/');
+const loopback = base.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(base.hostname);
+const managedRunId = process.env.HITCH_MANAGED_RUN_ID || '';
+const managed = process.env.HITCH_MANAGED_LOCAL_INFERENCE === '1'
+  && key === 'hitch-managed-local'
+  && /^run_[a-f0-9]{32}$/.test(managedRunId)
+  && base.protocol === 'http:'
+  && new RegExp(`^/[a-f0-9]{48}/${managedRunId}/openai/?$`).test(base.pathname);
+if (base.username || base.password || base.search || base.hash || (base.protocol !== 'https:' && !loopback && !managed)) throw new Error('invalid model endpoint');
 if (!base.pathname.endsWith('/')) base.pathname += '/';
 let raw = '';
 for await (const chunk of process.stdin) {
@@ -33,7 +40,8 @@ for (const message of input.messages) {
     } else throw new Error('unsupported input modality');
   }
 }
-const maxTokens = input.max_output_tokens ?? 8192;
+const localDefault = process.env.HITCH_LOCAL_MAX_OUTPUT_TOKENS === undefined ? 8192 : Number(process.env.HITCH_LOCAL_MAX_OUTPUT_TOKENS);
+const maxTokens = input.max_output_tokens ?? localDefault;
 if (!Number.isSafeInteger(maxTokens) || maxTokens < 1 || maxTokens > 131072) throw new Error('invalid max_output_tokens');
 if (input.reasoning_effort !== undefined && !['none', 'minimal', 'low', 'medium', 'high', 'xhigh'].includes(input.reasoning_effort)) throw new Error('invalid reasoning effort');
 const emit = event => console.log(JSON.stringify(event));

package/integrations/training-tool/cli.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// Fixed linear tool loop, restricted to a managed Harbor task container.
+import { randomUUID } from 'node:crypto';
+import { spawn } from 'node:child_process';
+
+if (process.argv.includes('--version')) { console.log('hitch-training-tool 1.0.0'); process.exit(0); }
+const args = process.argv.slice(2);
+if (args.length !== 2 || args[0] !== '--model' || !args[1]) throw new Error('Usage: training-tool --model MODEL');
+if (process.env.HITCH_HARBOR_INTERNAL !== '1') throw new Error('training-tool requires a Harbor task container');
+const binding = JSON.parse(process.env.HITCH_TRAINING_BINDING || 'null');
+const training = process.env.HITCH_TRAINING_EXTERNAL === '1';
+if (!training && process.env.HITCH_MANAGED_LOCAL_INFERENCE !== '1') throw new Error('explicit Hitch model binding required');
+const runId = training ? process.env.HITCH_TRAINING_RUN_ID : process.env.HITCH_MANAGED_RUN_ID;
+const base = new URL(process.env.OPENAI_BASE_URL || '');
+if (!/^run_[a-f0-9]{32}$/.test(runId || '') || base.protocol !== 'http:' || base.username || base.password || base.search || base.hash
+  || !new RegExp(`^/[a-f0-9]{48}/${runId}/openai/?$`).test(base.pathname)) throw new Error('invalid run-scoped endpoint');
+if (training && args[1] !== `training/${binding?.binding_id}`) throw new Error('wrong training binding');
+if (!base.pathname.endsWith('/')) base.pathname += '/';
+const maxTokens = training ? binding.max_output_tokens : Number(process.env.HITCH_LOCAL_MAX_OUTPUT_TOKENS || 2048);
+const maxSteps = training ? binding.max_episode_steps : Number(process.env.HITCH_TRAINING_EVAL_MAX_STEPS || 16);
+if (![maxTokens, maxSteps].every(n => Number.isSafeInteger(n) && n > 0)) throw new Error('invalid harness budget');
+let prompt = '';
+for await (const chunk of process.stdin) { prompt += chunk; if (Buffer.byteLength(prompt) > 8 * 1024 * 1024) throw new Error('prompt exceeds 8 MiB'); }
+const messages = [{ role: 'user', content: prompt }];
+const tools = [{ type: 'function', function: { name: 'bash', description: 'Run a command in the task container.', parameters: { type: 'object', properties: { command: { type: 'string' } }, required: ['command'], additionalProperties: false } } }];
+const emit = event => console.log(JSON.stringify(event));
+let child;
+const abort = new AbortController();
+const killTool = () => { if (child?.pid) { try { process.kill(-child.pid, 'SIGKILL'); } catch {} } };
+const cancel = () => { abort.abort(); killTool(); };
+process.once('SIGTERM', cancel); process.once('SIGINT', cancel);
+emit({ type: 'session.created', session_id: randomUUID(), policy_version: binding?.policy_version });
+for (let step = 0; step < maxSteps; step++) {
+  abort.signal.throwIfAborted();
+  const response = await fetch(new URL('chat/completions', base), {
+    method: 'POST', redirect: 'error', headers: { Authorization: `Bearer ${process.env.OPENAI_API_KEY}`, 'Content-Type': 'application/json', 'Idempotency-Key': `${runId}-${step}` },
+    body: JSON.stringify({ model: args[1], messages, tools, stream: false, max_tokens: maxTokens }), signal: abort.signal,
+  });
+  if (!response.ok) throw new Error(`training gateway returned HTTP ${response.status}`);
+  const body = await response.json(); abort.signal.throwIfAborted(); const choice = body.choices?.[0];
+  if (!choice?.message || body.choices.length !== 1) throw new Error('invalid completion');
+  emit({ type: 'provider.response', response: body, receipt_id: response.headers.get('x-gear-receipt-id') });
+  emit({ type: 'usage.updated', usage: body.usage || {} });
+  if (choice.finish_reason === 'length') { emit({ type: 'training.terminated', termination: 'truncated' }); process.exitCode = 8; break; }
+  const message = choice.message; messages.push(message);
+  const calls = message.tool_calls || [];
+  if (!calls.length) {
+    if (choice.finish_reason !== 'stop') throw new Error('missing terminal state');
+    emit({ type: 'message.completed', text: message.content || '' }); emit({ type: 'training.terminated', termination: 'terminated' }); break;
+  }
+  if (choice.finish_reason !== 'tool_calls') throw new Error('missing tool terminal state');
+  for (const call of calls) {
+    abort.signal.throwIfAborted();
+    if (call.function?.name !== 'bash' || typeof call.id !== 'string') throw new Error('unsupported tool');
+    const input = JSON.parse(call.function.arguments);
+    if (typeof input.command !== 'string' || Object.keys(input).join(',') !== 'command') throw new Error('invalid bash arguments');
+    emit({ type: 'tool.started', call_id: call.id, name: 'bash', arguments: input });
+    const result = await new Promise((resolve, reject) => {
+      let output = ''; let truncated = false;
+      child = spawn('/bin/bash', ['-lc', input.command], { detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+      const append = data => { const remaining = 32768 - output.length; if (remaining > 0) output += data.toString().slice(0, remaining); if (data.length > remaining) truncated = true; };
+      child.stdout.on('data', append); child.stderr.on('data', append);
+      const timer = setTimeout(killTool, 30000);
+      child.once('error', error => { clearTimeout(timer); reject(error); });
+      child.once('close', code => { clearTimeout(timer); child = undefined; resolve(`exit=${code}\n${output}${truncated ? '\n[tool output truncated]' : ''}`); });
+    });
+    messages.push({ role: 'tool', tool_call_id: call.id, content: result });
+    emit({ type: 'tool.completed', call_id: call.id, output: result });
+    abort.signal.throwIfAborted();
+  }
+  if (step === maxSteps - 1) { emit({ type: 'training.terminated', termination: 'truncated' }); process.exitCode = 8; }
+}