agentenv-framework 0.9.1302__tar.gz → 0.9.1303__tar.gz

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentenv-framework
-Version: 0.9.1302
+Version: 0.9.1303
 Summary: SDK and CLI for building, deploying and running agent environments and the tasks that grade agents in them.
 Project-URL: Homepage, https://www.agentenvframework.com
 Project-URL: Documentation, https://www.agentenvframework.com/docs
@@ -29,7 +29,7 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: a2a-sdk==0.3.26
-Requires-Dist: agentenv-framework-protocol==0.1.317
+Requires-Dist: agentenv-framework-protocol==0.1.318
 Requires-Dist: certifi>=2024.2.2
 Requires-Dist: click>=8.0.0
 Requires-Dist: cryptography>=42

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/packages/agentenv-protocol/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentenv-framework-protocol"
-version = "0.1.317"
+version = "0.1.318"
 description = "Open data-plane protocol and server SDK for agent environments."
 readme = "README.md"
 license = "Apache-2.0"

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentenv-framework"
-version = "0.9.1302"
+version = "0.9.1303"
 description = "SDK and CLI for building, deploying and running agent environments and the tasks that grade agents in them."
 readme = "README.md"
 license = "Apache-2.0"
@@ -29,7 +29,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "agentenv-framework-protocol==0.1.317",
+    "agentenv-framework-protocol==0.1.318",
     "certifi>=2024.2.2",  # the public roots the local transfer CA's trust bundle carries
     "click>=8.0.0",
     "cryptography>=42",  # the local transfer CA

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/src/agent_env/a2a_agent/a2a_agent.py

@@ -33,6 +33,8 @@ from agent_env.providers.sandbox_providers.local_sandbox import (
     local_grant_trust,
     start_trusting,
 )
+from agent_env.providers.sandbox_providers.chained_sandbox_provider import ChainedSandboxProvider
+from agent_env.providers.sandbox_providers.modal_sandbox import ModalSandboxProvider
 from agent_env.providers.sandbox_providers.sandbox_provider import all_sandbox_container_env, all_sandbox_url_rewrites
 from agent_env.attribution import Attribution
 
@@ -431,6 +433,14 @@ class A2AAgent:
 
         merged_env = await asyncio.to_thread(self._build_merged_env, resolved_env, a2a_port)
         image_name = self.docker_image_artifact.image_name
+        if problem := self.docker_image_artifact.by_name_problem():
+            if provider is None and sandbox.mode != SANDBOX_MODE_VM:
+                raise ValueError(f"Can't deploy agent {self.id!r} on the container sandbox {sandbox.sandbox_id!r}, which "
+                                 f"runs its own image, never the agent's: {problem}")
+            links = provider.providers if isinstance(provider, ChainedSandboxProvider) else [provider] if provider else []
+            if by_name := [link for link in links if isinstance(link, (LocalSandboxProvider, ModalSandboxProvider))]:
+                raise ValueError(f"Can't deploy agent {self.id!r} with {type(by_name[0]).__name__}, which runs an "
+                                 f"agent's image by name: {problem}")
 
         try:
             if provider is not None:

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/src/agent_env/artifact/artifacts/docker_image.py

@@ -264,20 +264,31 @@ class DockerImageArtifact(Artifact):
     def load(self) -> bytes:
         from agent_env.artifact.store import get_artifact_store
         if not self.tar_gz_object_url:
-            raise ValueError(self.load_problem() or f"{self.id!r} v{self.version} has no tar.gz; its image is pulled "
-                             f"from {self.image_name}")
+            how = "built from its build context" if self.context_only else f"pulled from {self.image_name}"
+            raise ValueError(f"{self.id!r} v{self.version} has no tar.gz; its image is {how}")
         return get_artifact_store().get_object(self.tar_gz_object_url)
 
+    @property
+    def context_only(self) -> bool:
+        """Whether only the image's build context is stored: no tar.gz, and an image name that names no registry, the
+        tag a VM sandbox gives the image when it builds it."""
+        return bool(self.build_context_object_url) and not self.tar_gz_object_url and not names_registry(self.image_name)
+
     def load_problem(self) -> str | None:
-        """Why no sandbox can get this image, or None when one can: a tar.gz is loaded, and with none, ``image_name``
-        is pulled, so it must name its registry. One registered by its build context alone isn't built yet."""
-        if self.tar_gz_object_url or names_registry(self.image_name):
+        """Why no VM sandbox can get this image, or None when one can: a tar.gz is loaded, an image with none is pulled
+        when its name names a registry, and built from its build context when it has only that."""
+        if self.tar_gz_object_url or names_registry(self.image_name) or self.context_only:
             return None
-        if self.build_context_object_url:
-            return f"{self.id!r} v{self.version} is only a build context, and sandboxes don't build images from one yet"
         return (f"{self.id!r} v{self.version} has no tar.gz, and its image name {self.image_name!r} doesn't name a "
                 "registry to pull it from")
 
+    def by_name_problem(self) -> str | None:
+        """Why a sandbox that runs an image by pulling its name can't run this one, or None when it can: a context-only
+        image's name is a tag only a VM sandbox's build gives it, and pulled, it would be looked up on Docker Hub."""
+        if self.context_only:
+            return f"{self.id!r} v{self.version} is only a build context, which only a VM sandbox builds"
+        return None
+
     @classmethod
     async def put_from_github(
         cls,

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/src/agent_env/bundle/preflight.py

@@ -96,6 +96,7 @@ class _Image:
     what: str
     local_only: str | None  # why only this machine has it, or None
     unloadable: str | None = None  # why no sandbox can get it, or None
+    by_name: str | None = None  # why a sandbox that runs it by pulling its name can't, or None
 
 
 @dataclass(frozen=True)
@@ -183,6 +184,10 @@ class _Walk:
         if GATEWAY in kinds and (loaders := [link for link in _links(provider)
                                              if not isinstance(link, ModalSandboxProvider)]):
             self._loadable(where, loaders, images)  # a gateway VM loads its images; Modal's runs each by name
+        # A lone server runs in a container from its image's name on any provider; a gateway does on Modal.
+        by_name = ([link for link in _links(provider) if isinstance(link, ModalSandboxProvider)] if GATEWAY in kinds
+                   else _links(provider))
+        self._by_name(where, by_name, images)
         if _local_link(provider):
             self.infra |= kinds
             self.docker_users.append(where)
@@ -291,12 +296,14 @@ class _Walk:
         if agent_id is None:
             self.default_agent_users.append((where, unnamed))
             agent_id = get_config().get_default_a2a_agent_id()
-        loaders = [link for link in _links(provider) if not isinstance(link, (LocalSandboxProvider, ModalSandboxProvider))]
+        by_name = [link for link in _links(provider) if isinstance(link, (LocalSandboxProvider, ModalSandboxProvider))]
+        loaders = [link for link in _links(provider) if link not in by_name]  # by_name run an agent in a container
         remote = _remote_links(provider)
-        if not (loaders or remote) or (image := self._agent_image(agent_id, version)) is None:
+        if (image := self._agent_image(agent_id, version)) is None:
             return
         if loaders:
-            self._loadable(where, loaders, [image])  # those two run an agent in a container, by image name
+            self._loadable(where, loaders, [image])
+        self._by_name(where, by_name, [image])
         if remote:
             self._reachable(where, remote, [image])
 
@@ -340,6 +347,15 @@ class _Walk:
                 self._problem(where, f"deploys {image.what} on the {_shown(loaders[0])} sandbox provider, which can't "
                                      f"load it: {image.unloadable}")
 
+    def _by_name(self, where: str, links: list[SandboxProvider], images: list[_Image]) -> None:
+        """Refuse each of ``images`` a sandbox on ``links`` can't run: it pulls an image by its name, and a context-only
+        image's name is a tag only a VM sandbox's build gives it."""
+        for image in images:
+            if links and image.by_name:
+                self._problem(where, f"deploys {image.what} on the {_shown(links[0])} sandbox provider, which runs it "
+                                     f"by name: {image.by_name}; run it on a provider whose VMs build it, such as "
+                                     "--sandbox modal_vm")
+
     def _reachable(self, where: str, remote: list[SandboxProvider], images: list[_Image]) -> None:
         for image in images:
             if image.local_only:
@@ -361,6 +377,8 @@ class _Walk:
             images = [_image(f"the {kind} env {env_id!r}'s image {image.id!r}", image) for image in artifacts]
             if not isinstance(provider, ModalSandboxProvider):  # whose containers run by name, or are swapped out
                 self._loadable(where, [provider], images)
+            else:
+                self._by_name(where, [provider], images)
             self._reachable(where, [provider], images)
 
     def _default_agent(self) -> None:
@@ -439,7 +457,7 @@ def _name(provider: SandboxProvider) -> str:
 
 
 def _image(what: str, image: DockerImageArtifact) -> _Image:
-    return _Image(what, _local_only(image), image.load_problem())
+    return _Image(what, _local_only(image), image.load_problem(), image.by_name_problem())
 
 
 def _local_only(image: DockerImageArtifact | str) -> str | None:

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/src/agent_env/providers/env_providers/env_gateway_provider.py

@@ -836,6 +836,9 @@ COMPOSE_EOF'''
 
         config = get_config()
         gateway_env = Env.get(config.default_gateway_env_id)
+        if problems := [problem for image in [gateway_env.docker_image_artifact, *mcp_server_images]
+                        if (problem := image.by_name_problem())]:
+            raise ValueError(f"Can't deploy on Modal, whose gateway runs each image by name: {'; '.join(problems)}")
 
         i6pn_kwargs = {"i6pn": True, "region": config.modal_default_region} if isinstance(sandbox_provider, ModalSandboxProvider) else {}
         deploy = _ContainerDeploy(

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/src/agent_env/providers/env_providers/env_server_provider.py

@@ -67,6 +67,8 @@ class EnvironmentServerProvider(_SandboxEnvironmentProvider):
         from agent_env.env.envs.mcp_server import MCPServerEnv
 
         name = env.environment_name
+        if problem := env.docker_image_artifact.by_name_problem():
+            raise ValueError(f"Can't deploy {name!r} as a server, which runs its image by name: {problem}")
         server = await sandbox_provider.create_container(
             image_name=env.docker_image_artifact.image_name,
             port=AGENT_ENV_GATEWAY_MCP_PORT,

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/src/agent_env/providers/sandbox_providers/e2b/sandbox.py

@@ -13,10 +13,12 @@ import asyncio
 import logging
 import shlex
 import time
+import weakref
 from collections.abc import Iterable
 from typing import TYPE_CHECKING, Any
 from urllib.parse import urlparse
 
+from agent_env.config import get_config
 from agent_env.providers.sandbox_providers.sandbox import NetworkMode, NetworkPolicy, VmSandbox
 from agent_env.providers.sandbox_providers.sandbox_provider import SANDBOX_MODE_VM
 
@@ -28,6 +30,13 @@ logger = logging.getLogger(__name__)
 E2B_ALL_TRAFFIC = "0.0.0.0/0"
 
 
+# One lock per E2B sandbox in each event loop, held to widen its egress policy, so concurrent downloads don't each widen
+# a stale copy and drop the other's host.
+_policy_locks: weakref.WeakValueDictionary[tuple[asyncio.AbstractEventLoop, str], asyncio.Lock] = (
+    weakref.WeakValueDictionary()
+)
+
+
 class _BytesReader:
     """The small ``StreamReader`` subset consumed by ``Sandbox.exec_with_output``."""
 
@@ -312,15 +321,30 @@ class E2BSandbox(VmSandbox):
             return
 
         signed_urls = await self._signed_image_urls(artifacts)
-        signed_hosts = {
-            parsed.hostname
-            for signed_url in signed_urls
-            if signed_url and (parsed := urlparse(signed_url)).hostname
-        }
-        if signed_hosts:
-            await self.apply_network_policy(policy.with_hosts(sorted(signed_hosts)))
+        await self._allow_download_hosts(signed_urls)
         await self._load_docker_images(artifacts, signed_urls)
 
+    async def _download_object_to_vm(self, object_url: str, vm_path: str) -> None:
+        """Download an object after adding its signed-download host to a restrictive policy, as image tarballs are: a
+        build context is fetched this way before a build in the VM. A reconnected sandbox, whose policy is unknown,
+        downloads as before."""
+        policy = self.network_policy
+        if policy is not None and policy.restricts_egress:
+            signed = await asyncio.to_thread(get_config().get_object_store_at(object_url).signed_get_url, object_url)
+            await self._allow_download_hosts([signed])
+        await super()._download_object_to_vm(object_url, vm_path)
+
+    async def _allow_download_hosts(self, signed_urls: list[str | None]) -> None:
+        """Add the hosts of ``signed_urls`` to a restrictive applied policy, reading the policy under the sandbox's
+        lock, so a concurrent download's host isn't dropped."""
+        hosts = {parsed.hostname for url in signed_urls if url and (parsed := urlparse(url)).hostname}
+        if not hosts:
+            return
+        async with _policy_locks.setdefault((asyncio.get_running_loop(), self.sandbox_id), asyncio.Lock()):
+            policy = self.network_policy
+            if policy is not None and policy.restricts_egress and not hosts <= set(policy.allow_hosts):
+                await self.apply_network_policy(policy.with_hosts(sorted(hosts)))
+
     @classmethod
     async def reconnect(
         cls,

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/src/agent_env/providers/sandbox_providers/sandbox.py

@@ -23,6 +23,7 @@ from typing import IO, TYPE_CHECKING, Any, AsyncIterator, Callable, Iterable, Op
 
 from agent_env.config import get_config
 from agent_env.store.image_store.oci_registry_credentials import registry_host_from_ref
+from agent_env.utils.docker_build import DEFAULT_BUILD_PLATFORM
 from agent_env.utils.paths import validate_relative_filename
 
 if TYPE_CHECKING:
@@ -279,16 +280,54 @@ class VmSandbox(Sandbox):
         )
 
     async def load_docker_images(self, artifacts: list) -> None:
-        """Put each DockerImageArtifact's image on the VM: those with a tar.gz are loaded from it, in parallel, and the
-        rest are pulled by image name. An image no sandbox can get is refused before anything is loaded."""
+        """Put each DockerImageArtifact's image on the VM: those with a tar.gz are loaded from it, in parallel, those
+        with only a build context are built from it, and the rest are pulled by image name. An image no sandbox can get
+        is refused before anything is loaded."""
         if not artifacts:
             return
         if problems := [problem for artifact in artifacts if (problem := artifact.load_problem())]:
             raise RuntimeError(f"Can't load images: {'; '.join(problems)}")
         if tarballs := [artifact for artifact in artifacts if artifact.tar_gz_object_url]:
             await self._load_tarballs(tarballs)
-        if pulled := [artifact.image_name for artifact in artifacts if not artifact.tar_gz_object_url]:
+        if pulled := [artifact.image_name for artifact in artifacts
+                      if not artifact.tar_gz_object_url and not artifact.context_only]:
             await self.pull_images(pulled)
+        if built := [artifact for artifact in artifacts if artifact.context_only]:
+            await self.build_images(built)
+
+    async def build_images(self, artifacts: list) -> None:
+        """Build each context-only image from its build context, one build at a time, so heavy builds don't contend
+        for one VM; images with the same ``source_digest`` share a build. The build pulls its base images and packages
+        itself, so a network policy restricting egress must allow them; only the context's download is let through."""
+        builds: dict[str, list] = {}
+        for artifact in artifacts:
+            builds.setdefault(artifact.source_digest or artifact.build_context_object_url, []).append(artifact)
+        for source, images in builds.items():
+            await self._build_image(source, images)
+
+    async def _build_image(self, source: str, images: list) -> None:
+        """Download the context ``images`` share, extract it, and ``docker build`` it, tagged with each image's name."""
+        first = images[0]
+        names = list(dict.fromkeys(image.image_name for image in images))
+        work = f"/tmp/agent-env-build-{hashlib.sha256(source.encode()).hexdigest()[:16]}"
+        platform = first.platform or DEFAULT_BUILD_PLATFORM
+        tags = " ".join(f"-t {shlex.quote(name)}" for name in names)
+        logger.info(f"Building {', '.join(names)} from its build context, for {platform}...")
+        await self.exec_script(f"rm -rf {work} && mkdir -p {work}/context")
+        try:
+            await self.load_object_file(first.build_context_object_url, f"{work}/context.tar.gz")
+            await self.exec_script(
+                f"tar -xzf {work}/context.tar.gz -C {work}/context && cd {work}/context && "
+                f"docker build --platform {shlex.quote(platform)} -f {shlex.quote(first.dockerfile_path or 'Dockerfile')} "
+                f"{tags} ."
+            )
+        except RuntimeError as e:
+            raise RuntimeError(f"Building {', '.join(names)} from its build context failed: {e}") from e
+        finally:
+            try:
+                await self.exec_script(f"rm -rf {work}")
+            except Exception as e:  # the VM may be gone; the folder goes with it
+                logger.warning(f"Could not remove {work} on {self.sandbox_id}: {e}")
 
     async def _load_tarballs(self, artifacts: list) -> None:
         """Load the images of ``artifacts``, each with a tar.gz, in parallel."""

agentenv_framework-0.9.1303/tst/unit/a2a_agent/context_only_deploy_test.py

@@ -0,0 +1,67 @@
+"""An agent whose image is only a build context deploys only where a VM builds it: a provider that runs an agent in a
+container by its image's name refuses it before creating anything."""
+
+import pytest
+
+from agent_env.a2a_agent.a2a_agent import A2AAgent
+from agent_env.artifact.artifacts.docker_image import DockerImageArtifact
+from agent_env.providers.sandbox_providers import sandbox_provider
+from agent_env.providers.sandbox_providers.chained_sandbox_provider import ChainedSandboxProvider
+from agent_env.providers.sandbox_providers.local_sandbox import LocalSandboxProvider
+from agent_env.providers.sandbox_providers.sandbox_provider import SandboxProvider
+
+
+class _Created(Exception):
+    """Raised by a fake provider once asked for a sandbox, which is as far as a test needs to go."""
+
+
+class _LocalProvider(LocalSandboxProvider):
+    async def create_sandbox(self, **_):
+        raise AssertionError("an image that is only a build context was run by name")
+
+
+class _VmProvider(SandboxProvider):
+    async def create_sandbox(self, **_):
+        raise _Created
+
+
+IMAGE = DockerImageArtifact(id="solver-image", version=2, description="d", image_name="local/solver-0123456789ab:v2",
+                            build_context_object_url="s3://bucket/ctx.tar.gz")
+
+
+@pytest.fixture
+def litellm(monkeypatch):
+    monkeypatch.setenv("LITELLM_API_KEY", "k")
+    monkeypatch.setenv("LITELLM_BASE_URL", "http://litellm.example/v1")
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("provider", [_LocalProvider(), ChainedSandboxProvider([_VmProvider(), _LocalProvider()])],
+                         ids=["local", "chain-with-local"])
+async def test_a_provider_that_runs_the_agent_by_name_refuses_it(monkeypatch, local_stores, litellm, provider):
+    monkeypatch.setattr(sandbox_provider, "build_sandbox_provider", lambda name: provider)
+
+    with pytest.raises(ValueError, match="Can't deploy agent 'solver' with _LocalProvider, which runs an agent's image by "
+                                         "name: 'solver-image' v2 is only a build context, which only a VM sandbox builds"):
+        await A2AAgent(id="solver", version=1, docker_image_artifact=IMAGE).deploy(sandbox_type="any")
+
+
+@pytest.mark.asyncio
+async def test_a_vm_provider_is_asked_for_a_sandbox(monkeypatch, local_stores, litellm):
+    monkeypatch.setattr(sandbox_provider, "build_sandbox_provider", lambda name: _VmProvider())
+
+    with pytest.raises(_Created):
+        await A2AAgent(id="solver", version=1, docker_image_artifact=IMAGE).deploy(sandbox_type="any")
+
+
+class _ContainerSandbox:
+    sandbox_id = "sb-container"
+    mode = "container"
+    tunnel_urls = {}
+
+
+@pytest.mark.asyncio
+async def test_an_existing_container_sandbox_refuses_it_since_it_never_runs_the_agents_image(local_stores, litellm):
+    with pytest.raises(ValueError, match="Can't deploy agent 'solver' on the container sandbox 'sb-container', which runs its "
+                                         "own image, never the agent's: 'solver-image' v2 is only a build context"):
+        await A2AAgent(id="solver", version=1, docker_image_artifact=IMAGE).deploy(sandbox=_ContainerSandbox())

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/tst/unit/a2a_agent/deploy_cleanup_test.py

@@ -7,6 +7,7 @@ import types
 import pytest
 
 from agent_env.a2a_agent.a2a_agent import DEFAULT_A2A_PORT, A2AAgent
+from agent_env.artifact.artifacts.docker_image import DockerImageArtifact
 from agent_env.providers.sandbox_providers import sandbox_provider
 from agent_env.providers.sandbox_providers.sandbox_provider import SANDBOX_MODE_CONTAINER
 
@@ -37,7 +38,7 @@ async def test_a_deploy_that_stops_waiting_for_its_card_closes_its_sandbox(monke
 
     monkeypatch.setattr(sandbox_provider, "build_sandbox_provider", lambda name: _Provider())
     monkeypatch.setattr(A2AAgent, "_wait_for_agent_card", wait_for_card)
-    agent = A2AAgent(id="solver", version=1, docker_image_artifact=types.SimpleNamespace(image_name="img"))
+    agent = A2AAgent(id="solver", version=1, docker_image_artifact=DockerImageArtifact(id="img", description="d", image_name="img"))
     deploying = asyncio.ensure_future(agent.deploy(
         sandbox_type="fake", env_vars={"LITELLM_API_KEY": "k", "LITELLM_BASE_URL": "http://llm"}))
     await waiting.wait()

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/tst/unit/artifact/test_docker_image_build_context.py

@@ -66,11 +66,12 @@ def test_equal_sources_give_equal_digests_and_bytes(local_stores, context):
     assert three.version == 2
 
 
-def test_a_context_only_image_says_why_no_sandbox_can_get_it_yet(local_stores, context):
+def test_a_context_only_image_is_built_by_a_vm_and_refused_where_run_by_name(local_stores, context):
     image = DockerImageArtifact.put_context("a", description="d", context_path=str(context), dockerfile_path="Dockerfile")
 
-    assert image.load_problem() == "'a' v1 is only a build context, and sandboxes don't build images from one yet"
-    with pytest.raises(ValueError, match="is only a build context"):
+    assert image.context_only and image.load_problem() is None
+    assert image.by_name_problem() == "'a' v1 is only a build context, which only a VM sandbox builds"
+    with pytest.raises(ValueError, match="has no tar.gz; its image is built from its build context"):
         image.load()
 
 

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1303}/tst/unit/bundle/preflight_test.py

@@ -197,6 +197,57 @@ def test_an_env_image_with_no_tarball_and_no_registry_is_refused_where_a_gateway
     assert [entry.name for entry in dry_run_bundle(bundle_dir, sandbox="modal").runs] == ["t"]
 
 
+# Images with only a build context, which a VM sandbox builds and nothing else can run
+
+
+def _context_image(id):
+    with namespace_routing():
+        return get_artifact_store().put_document(DockerImageArtifact(
+            id=id, description=id, image_name=f"local/{id}-0123456789ab:v1", build_context_object_url="s3://bucket/ctx.tar.gz",
+            dockerfile_path="Dockerfile", platform="linux/amd64", source_digest="sha256:" + "1" * 64))
+
+
+BY_NAME = ("on the {sandbox!r} sandbox provider, which runs it by name: '{id}' v1 is only a build context, which only a "
+           "VM sandbox builds; run it on a provider whose VMs build it, such as --sandbox modal_vm")
+
+
+@pytest.mark.parametrize("sandbox, refused", [("modal_vm", False), ("local", True), ("modal", True), ("modal_vm,local", True)])
+def test_an_agent_image_that_is_only_a_build_context_runs_where_a_vm_builds_it(bundle_dir, sandbox, refused):
+    with namespace_routing():
+        A2AAgent.put(id="solver", docker_image_artifact=_context_image("solver-image"))
+    _task(bundle_dir, [AGENT])
+
+    if refused:
+        link = "local" if "local" in sandbox else sandbox
+        assert _problems(lambda: dry_run_bundle(bundle_dir, sandbox=sandbox)) == [
+            "tasks/t.json: step 'agent': deploys agent 'solver''s image "
+            + BY_NAME.format(sandbox=sandbox if link == sandbox else link, id="solver-image")]
+    else:
+        assert [entry.name for entry in dry_run_bundle(bundle_dir, sandbox=sandbox).runs] == ["t"]
+
+
+def test_an_env_image_that_is_only_a_build_context_runs_on_a_gateway_vm_and_not_on_modals_containers(bundle_dir):
+    with namespace_routing():
+        MCPServerEnv.put(id="crm", docker_image_artifact=_context_image("crm-image"), environment_name="crm")
+    _task(bundle_dir, [{"id": "env", "type": "deploy_env", "env_id": "crm"}])
+
+    assert [entry.name for entry in dry_run_bundle(bundle_dir, sandbox="local").runs] == ["t"]
+    _infra(REMOTE)
+    assert _problems(lambda: dry_run_bundle(bundle_dir, sandbox="modal")) == [
+        "tasks/t.json: step 'env': deploys env 'crm''s image 'crm-image' " + BY_NAME.format(sandbox="modal", id="crm-image")]
+
+
+@pytest.mark.parametrize("sandbox", ["local", "modal_vm"])
+def test_a_lone_server_whose_image_is_only_a_build_context_is_refused_on_any_provider(bundle_dir, sandbox):
+    with namespace_routing():
+        MCPServerEnv.put(id="crm", docker_image_artifact=_context_image("crm-image"), environment_name="crm",
+                         env_provider_type="server")
+    _task(bundle_dir, [{"id": "env", "type": "deploy_env", "env_id": "crm"}])
+
+    assert _problems(lambda: dry_run_bundle(bundle_dir, sandbox=sandbox)) == [
+        "tasks/t.json: step 'env': deploys env 'crm''s image 'crm-image' " + BY_NAME.format(sandbox=sandbox, id="crm-image")]
+
+
 # What a provider can create