agentenv-framework 0.9.1302__tar.gz → 0.9.1304__tar.gz

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentenv-framework
-Version: 0.9.1302
+Version: 0.9.1304
 Summary: SDK and CLI for building, deploying and running agent environments and the tasks that grade agents in them.
 Project-URL: Homepage, https://www.agentenvframework.com
 Project-URL: Documentation, https://www.agentenvframework.com/docs
@@ -29,7 +29,7 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: a2a-sdk==0.3.26
-Requires-Dist: agentenv-framework-protocol==0.1.317
+Requires-Dist: agentenv-framework-protocol==0.1.319
 Requires-Dist: certifi>=2024.2.2
 Requires-Dist: click>=8.0.0
 Requires-Dist: cryptography>=42

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/packages/agentenv-protocol/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentenv-framework-protocol"
-version = "0.1.317"
+version = "0.1.319"
 description = "Open data-plane protocol and server SDK for agent environments."
 readme = "README.md"
 license = "Apache-2.0"

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentenv-framework"
-version = "0.9.1302"
+version = "0.9.1304"
 description = "SDK and CLI for building, deploying and running agent environments and the tasks that grade agents in them."
 readme = "README.md"
 license = "Apache-2.0"
@@ -29,7 +29,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "agentenv-framework-protocol==0.1.317",
+    "agentenv-framework-protocol==0.1.319",
     "certifi>=2024.2.2",  # the public roots the local transfer CA's trust bundle carries
     "click>=8.0.0",
     "cryptography>=42",  # the local transfer CA

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/src/agent_env/a2a_agent/a2a_agent.py

@@ -33,6 +33,8 @@ from agent_env.providers.sandbox_providers.local_sandbox import (
     local_grant_trust,
     start_trusting,
 )
+from agent_env.providers.sandbox_providers.chained_sandbox_provider import ChainedSandboxProvider
+from agent_env.providers.sandbox_providers.modal_sandbox import ModalSandboxProvider
 from agent_env.providers.sandbox_providers.sandbox_provider import all_sandbox_container_env, all_sandbox_url_rewrites
 from agent_env.attribution import Attribution
 
@@ -431,6 +433,14 @@ class A2AAgent:
 
         merged_env = await asyncio.to_thread(self._build_merged_env, resolved_env, a2a_port)
         image_name = self.docker_image_artifact.image_name
+        if problem := self.docker_image_artifact.by_name_problem():
+            if provider is None and sandbox.mode != SANDBOX_MODE_VM:
+                raise ValueError(f"Can't deploy agent {self.id!r} on the container sandbox {sandbox.sandbox_id!r}, which "
+                                 f"runs its own image, never the agent's: {problem}")
+            links = provider.providers if isinstance(provider, ChainedSandboxProvider) else [provider] if provider else []
+            if by_name := [link for link in links if isinstance(link, (LocalSandboxProvider, ModalSandboxProvider))]:
+                raise ValueError(f"Can't deploy agent {self.id!r} with {type(by_name[0]).__name__}, which runs an "
+                                 f"agent's image by name: {problem}")
 
         try:
             if provider is not None:

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/src/agent_env/artifact/artifacts/docker_image.py

@@ -264,20 +264,31 @@ class DockerImageArtifact(Artifact):
     def load(self) -> bytes:
         from agent_env.artifact.store import get_artifact_store
         if not self.tar_gz_object_url:
-            raise ValueError(self.load_problem() or f"{self.id!r} v{self.version} has no tar.gz; its image is pulled "
-                             f"from {self.image_name}")
+            how = "built from its build context" if self.context_only else f"pulled from {self.image_name}"
+            raise ValueError(f"{self.id!r} v{self.version} has no tar.gz; its image is {how}")
         return get_artifact_store().get_object(self.tar_gz_object_url)
 
+    @property
+    def context_only(self) -> bool:
+        """Whether only the image's build context is stored: no tar.gz, and an image name that names no registry, the
+        tag a VM sandbox gives the image when it builds it."""
+        return bool(self.build_context_object_url) and not self.tar_gz_object_url and not names_registry(self.image_name)
+
     def load_problem(self) -> str | None:
-        """Why no sandbox can get this image, or None when one can: a tar.gz is loaded, and with none, ``image_name``
-        is pulled, so it must name its registry. One registered by its build context alone isn't built yet."""
-        if self.tar_gz_object_url or names_registry(self.image_name):
+        """Why no VM sandbox can get this image, or None when one can: a tar.gz is loaded, an image with none is pulled
+        when its name names a registry, and built from its build context when it has only that."""
+        if self.tar_gz_object_url or names_registry(self.image_name) or self.context_only:
             return None
-        if self.build_context_object_url:
-            return f"{self.id!r} v{self.version} is only a build context, and sandboxes don't build images from one yet"
         return (f"{self.id!r} v{self.version} has no tar.gz, and its image name {self.image_name!r} doesn't name a "
                 "registry to pull it from")
 
+    def by_name_problem(self) -> str | None:
+        """Why a sandbox that runs an image by pulling its name can't run this one, or None when it can: a context-only
+        image's name is a tag only a VM sandbox's build gives it, and pulled, it would be looked up on Docker Hub."""
+        if self.context_only:
+            return f"{self.id!r} v{self.version} is only a build context, which only a VM sandbox builds"
+        return None
+
     @classmethod
     async def put_from_github(
         cls,

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/src/agent_env/bundle/preflight.py

@@ -96,6 +96,7 @@ class _Image:
     what: str
     local_only: str | None  # why only this machine has it, or None
     unloadable: str | None = None  # why no sandbox can get it, or None
+    by_name: str | None = None  # why a sandbox that runs it by pulling its name can't, or None
 
 
 @dataclass(frozen=True)
@@ -183,6 +184,10 @@ class _Walk:
         if GATEWAY in kinds and (loaders := [link for link in _links(provider)
                                              if not isinstance(link, ModalSandboxProvider)]):
             self._loadable(where, loaders, images)  # a gateway VM loads its images; Modal's runs each by name
+        # A lone server runs in a container from its image's name on any provider; a gateway does on Modal.
+        by_name = ([link for link in _links(provider) if isinstance(link, ModalSandboxProvider)] if GATEWAY in kinds
+                   else _links(provider))
+        self._by_name(where, by_name, images)
         if _local_link(provider):
             self.infra |= kinds
             self.docker_users.append(where)
@@ -291,12 +296,14 @@ class _Walk:
         if agent_id is None:
             self.default_agent_users.append((where, unnamed))
             agent_id = get_config().get_default_a2a_agent_id()
-        loaders = [link for link in _links(provider) if not isinstance(link, (LocalSandboxProvider, ModalSandboxProvider))]
+        by_name = [link for link in _links(provider) if isinstance(link, (LocalSandboxProvider, ModalSandboxProvider))]
+        loaders = [link for link in _links(provider) if link not in by_name]  # by_name run an agent in a container
         remote = _remote_links(provider)
-        if not (loaders or remote) or (image := self._agent_image(agent_id, version)) is None:
+        if (image := self._agent_image(agent_id, version)) is None:
             return
         if loaders:
-            self._loadable(where, loaders, [image])  # those two run an agent in a container, by image name
+            self._loadable(where, loaders, [image])
+        self._by_name(where, by_name, [image])
         if remote:
             self._reachable(where, remote, [image])
 
@@ -340,6 +347,15 @@ class _Walk:
                 self._problem(where, f"deploys {image.what} on the {_shown(loaders[0])} sandbox provider, which can't "
                                      f"load it: {image.unloadable}")
 
+    def _by_name(self, where: str, links: list[SandboxProvider], images: list[_Image]) -> None:
+        """Refuse each of ``images`` a sandbox on ``links`` can't run: it pulls an image by its name, and a context-only
+        image's name is a tag only a VM sandbox's build gives it."""
+        for image in images:
+            if links and image.by_name:
+                self._problem(where, f"deploys {image.what} on the {_shown(links[0])} sandbox provider, which runs it "
+                                     f"by name: {image.by_name}; run it on a provider whose VMs build it, such as "
+                                     "--sandbox modal_vm")
+
     def _reachable(self, where: str, remote: list[SandboxProvider], images: list[_Image]) -> None:
         for image in images:
             if image.local_only:
@@ -361,6 +377,8 @@ class _Walk:
             images = [_image(f"the {kind} env {env_id!r}'s image {image.id!r}", image) for image in artifacts]
             if not isinstance(provider, ModalSandboxProvider):  # whose containers run by name, or are swapped out
                 self._loadable(where, [provider], images)
+            else:
+                self._by_name(where, [provider], images)
             self._reachable(where, [provider], images)
 
     def _default_agent(self) -> None:
@@ -439,7 +457,7 @@ def _name(provider: SandboxProvider) -> str:
 
 
 def _image(what: str, image: DockerImageArtifact) -> _Image:
-    return _Image(what, _local_only(image), image.load_problem())
+    return _Image(what, _local_only(image), image.load_problem(), image.by_name_problem())
 
 
 def _local_only(image: DockerImageArtifact | str) -> str | None:

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/src/agent_env/providers/env_providers/env_gateway_provider.py

@@ -836,6 +836,9 @@ COMPOSE_EOF'''
 
         config = get_config()
         gateway_env = Env.get(config.default_gateway_env_id)
+        if problems := [problem for image in [gateway_env.docker_image_artifact, *mcp_server_images]
+                        if (problem := image.by_name_problem())]:
+            raise ValueError(f"Can't deploy on Modal, whose gateway runs each image by name: {'; '.join(problems)}")
 
         i6pn_kwargs = {"i6pn": True, "region": config.modal_default_region} if isinstance(sandbox_provider, ModalSandboxProvider) else {}
         deploy = _ContainerDeploy(

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/src/agent_env/providers/env_providers/env_server_provider.py

@@ -67,6 +67,8 @@ class EnvironmentServerProvider(_SandboxEnvironmentProvider):
         from agent_env.env.envs.mcp_server import MCPServerEnv
 
         name = env.environment_name
+        if problem := env.docker_image_artifact.by_name_problem():
+            raise ValueError(f"Can't deploy {name!r} as a server, which runs its image by name: {problem}")
         server = await sandbox_provider.create_container(
             image_name=env.docker_image_artifact.image_name,
             port=AGENT_ENV_GATEWAY_MCP_PORT,

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/src/agent_env/providers/sandbox_providers/e2b/sandbox.py

@@ -13,10 +13,12 @@ import asyncio
 import logging
 import shlex
 import time
+import weakref
 from collections.abc import Iterable
 from typing import TYPE_CHECKING, Any
 from urllib.parse import urlparse
 
+from agent_env.config import get_config
 from agent_env.providers.sandbox_providers.sandbox import NetworkMode, NetworkPolicy, VmSandbox
 from agent_env.providers.sandbox_providers.sandbox_provider import SANDBOX_MODE_VM
 
@@ -28,6 +30,13 @@ logger = logging.getLogger(__name__)
 E2B_ALL_TRAFFIC = "0.0.0.0/0"
 
 
+# One lock per E2B sandbox in each event loop, held to widen its egress policy, so concurrent downloads don't each widen
+# a stale copy and drop the other's host.
+_policy_locks: weakref.WeakValueDictionary[tuple[asyncio.AbstractEventLoop, str], asyncio.Lock] = (
+    weakref.WeakValueDictionary()
+)
+
+
 class _BytesReader:
     """The small ``StreamReader`` subset consumed by ``Sandbox.exec_with_output``."""
 
@@ -312,15 +321,30 @@ class E2BSandbox(VmSandbox):
             return
 
         signed_urls = await self._signed_image_urls(artifacts)
-        signed_hosts = {
-            parsed.hostname
-            for signed_url in signed_urls
-            if signed_url and (parsed := urlparse(signed_url)).hostname
-        }
-        if signed_hosts:
-            await self.apply_network_policy(policy.with_hosts(sorted(signed_hosts)))
+        await self._allow_download_hosts(signed_urls)
         await self._load_docker_images(artifacts, signed_urls)
 
+    async def _download_object_to_vm(self, object_url: str, vm_path: str) -> None:
+        """Download an object after adding its signed-download host to a restrictive policy, as image tarballs are: a
+        build context is fetched this way before a build in the VM. A reconnected sandbox, whose policy is unknown,
+        downloads as before."""
+        policy = self.network_policy
+        if policy is not None and policy.restricts_egress:
+            signed = await asyncio.to_thread(get_config().get_object_store_at(object_url).signed_get_url, object_url)
+            await self._allow_download_hosts([signed])
+        await super()._download_object_to_vm(object_url, vm_path)
+
+    async def _allow_download_hosts(self, signed_urls: list[str | None]) -> None:
+        """Add the hosts of ``signed_urls`` to a restrictive applied policy, reading the policy under the sandbox's
+        lock, so a concurrent download's host isn't dropped."""
+        hosts = {parsed.hostname for url in signed_urls if url and (parsed := urlparse(url)).hostname}
+        if not hosts:
+            return
+        async with _policy_locks.setdefault((asyncio.get_running_loop(), self.sandbox_id), asyncio.Lock()):
+            policy = self.network_policy
+            if policy is not None and policy.restricts_egress and not hosts <= set(policy.allow_hosts):
+                await self.apply_network_policy(policy.with_hosts(sorted(hosts)))
+
     @classmethod
     async def reconnect(
         cls,

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/src/agent_env/providers/sandbox_providers/local_sandbox.py

@@ -7,6 +7,7 @@ via subprocess instead of on a remote VM.
 from __future__ import annotations
 
 import asyncio
+import collections
 import contextlib
 import functools
 import glob
@@ -62,6 +63,10 @@ def _runs_in_container(cmd: list[str]) -> bool:
 
 
 _REAP_SECONDS = 5
+# How long a finished command's output is still read, for a job it left in the background that holds it open; and
+# how much of each stream is kept, the end of it: above the largest output core reads whole, run_code's 50 MiB result.
+_OUTPUT_GRACE_SECONDS = 1
+_OUTPUT_TAIL_BYTES = 64 * 1024 * 1024
 
 # Every command a local sandbox runs carries this, set to the sandbox's id, and so does whatever the command starts, so
 # teardown can find a process left running on this machine, such as the agent a host-mode install started.
@@ -282,6 +287,7 @@ class LocalSandbox(VmSandbox):
         logger.debug(f"LocalSandbox exec: {' '.join(cmd)}")
         process = await asyncio.create_subprocess_exec(
             *cmd,
+            stdin=asyncio.subprocess.DEVNULL,
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.PIPE,
             env={**os.environ, _SANDBOX_ENV: self.sandbox_id},
@@ -289,8 +295,10 @@ class LocalSandbox(VmSandbox):
         return process
 
     async def exec_with_output(self, *args: str) -> tuple[int, str, str]:
-        """Like the base, except that cancelling it kills the command and every process it started. This host
-        is the sandbox's VM, so nothing else would."""
+        """Like the base, but as a remote exec session behaves. Cancelling it kills the command and every process it
+        started; this host is the sandbox's VM, so nothing else would. The call ends with the command, even if a job
+        it left in the background still holds its output, which is then closed. Each stream keeps its last
+        ``_OUTPUT_TAIL_BYTES``, and bytes that aren't UTF-8 become replacement characters."""
         spawning = asyncio.ensure_future(self.exec(*args))
         try:
             process = await asyncio.shield(spawning)
@@ -298,13 +306,26 @@ class LocalSandbox(VmSandbox):
             with contextlib.suppress(Exception):
                 await _stop(await spawning)
             raise
+        stdout, stderr = _Tail(), _Tail()
+        reading = [asyncio.ensure_future(tail.drain(stream))
+                   for tail, stream in ((stdout, process.stdout), (stderr, process.stderr))]
         try:
-            stdout, stderr = await asyncio.gather(process.stdout.read(), process.stderr.read())
-            exit_code = await process.wait()
+            exit_code = await _exit_code(process)
+            await asyncio.wait(reading, timeout=_OUTPUT_GRACE_SECONDS)
         except asyncio.CancelledError:
             await _stop(process)
             raise
-        return exit_code, stdout.decode(), stderr.decode()
+        finally:
+            for reader in reading:
+                reader.cancel()
+            # Our ends of its pipes, which a background job may hold. asyncio has no public way to close them.
+            process._transport.close()
+        output = stdout.text(), stderr.text()
+        for name, tail in (("stdout", stdout), ("stderr", stderr)):
+            if tail.dropped:  # not the command itself: it can carry secrets
+                logger.warning("Kept the last %d bytes of a command's %s on sandbox %s; %d before them were dropped",
+                               _OUTPUT_TAIL_BYTES, name, self.sandbox_id, tail.dropped)
+        return exit_code, *output
 
     async def _write_unsigned_object(self, object_store: ObjectStore, object_url: str, vm_path: str) -> None:
         """This host is the VM, so the store writes the object in place, with no exec transport."""
@@ -319,12 +340,50 @@ class LocalSandbox(VmSandbox):
         pass
 
 
+class _Tail:
+    """The end of a stream as it is read: its last ``_OUTPUT_TAIL_BYTES``, and how many bytes before them were
+    dropped. Chunks, because cutting the front off one growing buffer keeps the memory it grew to."""
+
+    def __init__(self) -> None:
+        self.chunks: collections.deque[bytes] = collections.deque()
+        self.size = self.dropped = 0
+
+    async def drain(self, stream: asyncio.StreamReader) -> None:
+        while chunk := await stream.read(1 << 16):
+            self.chunks.append(chunk)
+            self.size += len(chunk)
+            while self.size - len(self.chunks[0]) >= _OUTPUT_TAIL_BYTES:
+                first = self.chunks.popleft()
+                self.size -= len(first)
+                self.dropped += len(first)
+
+    def text(self) -> str:
+        data = b"".join(self.chunks)
+        if (excess := len(data) - _OUTPUT_TAIL_BYTES) > 0:
+            data = data[excess:]
+            self.dropped += excess
+        return data.decode(errors="replace")
+
+
+async def _exit_code(process: asyncio.subprocess.Process) -> int:
+    """``process``'s exit code, as soon as it exits. ``Process.wait()`` also waits for its pipes to close, which a job
+    it left in the background can hold open, so the exit is checked for meanwhile."""
+    waiting = asyncio.ensure_future(process.wait())
+    try:
+        while process.returncode is None:
+            await asyncio.wait([waiting], timeout=0.05)
+        return process.returncode
+    finally:
+        waiting.cancel()
+
+
 async def _stop(process: asyncio.subprocess.Process) -> None:
-    """SIGKILL ``process`` and every process it started, then reap it, waiting a few seconds at most for one
-    that escaped the kill to let go of its output."""
+    """SIGKILL ``process`` and every process it started, wait a few seconds at most for it to exit, then close our
+    ends of its pipes, which a job that escaped the kill may still hold."""
     _kill_tree(process.pid)
     with contextlib.suppress(TimeoutError):
-        await asyncio.wait_for(process.wait(), _REAP_SECONDS)
+        await asyncio.wait_for(_exit_code(process), _REAP_SECONDS)
+    process._transport.close()
 
 
 def _kill_tree(root: int) -> None:

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/src/agent_env/providers/sandbox_providers/sandbox.py

@@ -23,6 +23,7 @@ from typing import IO, TYPE_CHECKING, Any, AsyncIterator, Callable, Iterable, Op
 
 from agent_env.config import get_config
 from agent_env.store.image_store.oci_registry_credentials import registry_host_from_ref
+from agent_env.utils.docker_build import DEFAULT_BUILD_PLATFORM
 from agent_env.utils.paths import validate_relative_filename
 
 if TYPE_CHECKING:
@@ -279,16 +280,54 @@ class VmSandbox(Sandbox):
         )
 
     async def load_docker_images(self, artifacts: list) -> None:
-        """Put each DockerImageArtifact's image on the VM: those with a tar.gz are loaded from it, in parallel, and the
-        rest are pulled by image name. An image no sandbox can get is refused before anything is loaded."""
+        """Put each DockerImageArtifact's image on the VM: those with a tar.gz are loaded from it, in parallel, those
+        with only a build context are built from it, and the rest are pulled by image name. An image no sandbox can get
+        is refused before anything is loaded."""
         if not artifacts:
             return
         if problems := [problem for artifact in artifacts if (problem := artifact.load_problem())]:
             raise RuntimeError(f"Can't load images: {'; '.join(problems)}")
         if tarballs := [artifact for artifact in artifacts if artifact.tar_gz_object_url]:
             await self._load_tarballs(tarballs)
-        if pulled := [artifact.image_name for artifact in artifacts if not artifact.tar_gz_object_url]:
+        if pulled := [artifact.image_name for artifact in artifacts
+                      if not artifact.tar_gz_object_url and not artifact.context_only]:
             await self.pull_images(pulled)
+        if built := [artifact for artifact in artifacts if artifact.context_only]:
+            await self.build_images(built)
+
+    async def build_images(self, artifacts: list) -> None:
+        """Build each context-only image from its build context, one build at a time, so heavy builds don't contend
+        for one VM; images with the same ``source_digest`` share a build. The build pulls its base images and packages
+        itself, so a network policy restricting egress must allow them; only the context's download is let through."""
+        builds: dict[str, list] = {}
+        for artifact in artifacts:
+            builds.setdefault(artifact.source_digest or artifact.build_context_object_url, []).append(artifact)
+        for source, images in builds.items():
+            await self._build_image(source, images)
+
+    async def _build_image(self, source: str, images: list) -> None:
+        """Download the context ``images`` share, extract it, and ``docker build`` it, tagged with each image's name."""
+        first = images[0]
+        names = list(dict.fromkeys(image.image_name for image in images))
+        work = f"/tmp/agent-env-build-{hashlib.sha256(source.encode()).hexdigest()[:16]}"
+        platform = first.platform or DEFAULT_BUILD_PLATFORM
+        tags = " ".join(f"-t {shlex.quote(name)}" for name in names)
+        logger.info(f"Building {', '.join(names)} from its build context, for {platform}...")
+        await self.exec_script(f"rm -rf {work} && mkdir -p {work}/context")
+        try:
+            await self.load_object_file(first.build_context_object_url, f"{work}/context.tar.gz")
+            await self.exec_script(
+                f"tar -xzf {work}/context.tar.gz -C {work}/context && cd {work}/context && "
+                f"docker build --platform {shlex.quote(platform)} -f {shlex.quote(first.dockerfile_path or 'Dockerfile')} "
+                f"{tags} ."
+            )
+        except RuntimeError as e:
+            raise RuntimeError(f"Building {', '.join(names)} from its build context failed: {e}") from e
+        finally:
+            try:
+                await self.exec_script(f"rm -rf {work}")
+            except Exception as e:  # the VM may be gone; the folder goes with it
+                logger.warning(f"Could not remove {work} on {self.sandbox_id}: {e}")
 
     async def _load_tarballs(self, artifacts: list) -> None:
         """Load the images of ``artifacts``, each with a tar.gz, in parallel."""

agentenv_framework-0.9.1304/tst/unit/a2a_agent/context_only_deploy_test.py

@@ -0,0 +1,67 @@
+"""An agent whose image is only a build context deploys only where a VM builds it: a provider that runs an agent in a
+container by its image's name refuses it before creating anything."""
+
+import pytest
+
+from agent_env.a2a_agent.a2a_agent import A2AAgent
+from agent_env.artifact.artifacts.docker_image import DockerImageArtifact
+from agent_env.providers.sandbox_providers import sandbox_provider
+from agent_env.providers.sandbox_providers.chained_sandbox_provider import ChainedSandboxProvider
+from agent_env.providers.sandbox_providers.local_sandbox import LocalSandboxProvider
+from agent_env.providers.sandbox_providers.sandbox_provider import SandboxProvider
+
+
+class _Created(Exception):
+    """Raised by a fake provider once asked for a sandbox, which is as far as a test needs to go."""
+
+
+class _LocalProvider(LocalSandboxProvider):
+    async def create_sandbox(self, **_):
+        raise AssertionError("an image that is only a build context was run by name")
+
+
+class _VmProvider(SandboxProvider):
+    async def create_sandbox(self, **_):
+        raise _Created
+
+
+IMAGE = DockerImageArtifact(id="solver-image", version=2, description="d", image_name="local/solver-0123456789ab:v2",
+                            build_context_object_url="s3://bucket/ctx.tar.gz")
+
+
+@pytest.fixture
+def litellm(monkeypatch):
+    monkeypatch.setenv("LITELLM_API_KEY", "k")
+    monkeypatch.setenv("LITELLM_BASE_URL", "http://litellm.example/v1")
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("provider", [_LocalProvider(), ChainedSandboxProvider([_VmProvider(), _LocalProvider()])],
+                         ids=["local", "chain-with-local"])
+async def test_a_provider_that_runs_the_agent_by_name_refuses_it(monkeypatch, local_stores, litellm, provider):
+    monkeypatch.setattr(sandbox_provider, "build_sandbox_provider", lambda name: provider)
+
+    with pytest.raises(ValueError, match="Can't deploy agent 'solver' with _LocalProvider, which runs an agent's image by "
+                                         "name: 'solver-image' v2 is only a build context, which only a VM sandbox builds"):
+        await A2AAgent(id="solver", version=1, docker_image_artifact=IMAGE).deploy(sandbox_type="any")
+
+
+@pytest.mark.asyncio
+async def test_a_vm_provider_is_asked_for_a_sandbox(monkeypatch, local_stores, litellm):
+    monkeypatch.setattr(sandbox_provider, "build_sandbox_provider", lambda name: _VmProvider())
+
+    with pytest.raises(_Created):
+        await A2AAgent(id="solver", version=1, docker_image_artifact=IMAGE).deploy(sandbox_type="any")
+
+
+class _ContainerSandbox:
+    sandbox_id = "sb-container"
+    mode = "container"
+    tunnel_urls = {}
+
+
+@pytest.mark.asyncio
+async def test_an_existing_container_sandbox_refuses_it_since_it_never_runs_the_agents_image(local_stores, litellm):
+    with pytest.raises(ValueError, match="Can't deploy agent 'solver' on the container sandbox 'sb-container', which runs its "
+                                         "own image, never the agent's: 'solver-image' v2 is only a build context"):
+        await A2AAgent(id="solver", version=1, docker_image_artifact=IMAGE).deploy(sandbox=_ContainerSandbox())

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/tst/unit/a2a_agent/deploy_cleanup_test.py

@@ -7,6 +7,7 @@ import types
 import pytest
 
 from agent_env.a2a_agent.a2a_agent import DEFAULT_A2A_PORT, A2AAgent
+from agent_env.artifact.artifacts.docker_image import DockerImageArtifact
 from agent_env.providers.sandbox_providers import sandbox_provider
 from agent_env.providers.sandbox_providers.sandbox_provider import SANDBOX_MODE_CONTAINER
 
@@ -37,7 +38,7 @@ async def test_a_deploy_that_stops_waiting_for_its_card_closes_its_sandbox(monke
 
     monkeypatch.setattr(sandbox_provider, "build_sandbox_provider", lambda name: _Provider())
     monkeypatch.setattr(A2AAgent, "_wait_for_agent_card", wait_for_card)
-    agent = A2AAgent(id="solver", version=1, docker_image_artifact=types.SimpleNamespace(image_name="img"))
+    agent = A2AAgent(id="solver", version=1, docker_image_artifact=DockerImageArtifact(id="img", description="d", image_name="img"))
     deploying = asyncio.ensure_future(agent.deploy(
         sandbox_type="fake", env_vars={"LITELLM_API_KEY": "k", "LITELLM_BASE_URL": "http://llm"}))
     await waiting.wait()

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/tst/unit/artifact/test_docker_image_build_context.py

@@ -66,11 +66,12 @@ def test_equal_sources_give_equal_digests_and_bytes(local_stores, context):
     assert three.version == 2
 
 
-def test_a_context_only_image_says_why_no_sandbox_can_get_it_yet(local_stores, context):
+def test_a_context_only_image_is_built_by_a_vm_and_refused_where_run_by_name(local_stores, context):
     image = DockerImageArtifact.put_context("a", description="d", context_path=str(context), dockerfile_path="Dockerfile")
 
-    assert image.load_problem() == "'a' v1 is only a build context, and sandboxes don't build images from one yet"
-    with pytest.raises(ValueError, match="is only a build context"):
+    assert image.context_only and image.load_problem() is None
+    assert image.by_name_problem() == "'a' v1 is only a build context, which only a VM sandbox builds"
+    with pytest.raises(ValueError, match="has no tar.gz; its image is built from its build context"):
         image.load()
 
 

{agentenv_framework-0.9.1302 → agentenv_framework-0.9.1304}/tst/unit/bundle/preflight_test.py

@@ -197,6 +197,57 @@ def test_an_env_image_with_no_tarball_and_no_registry_is_refused_where_a_gateway
     assert [entry.name for entry in dry_run_bundle(bundle_dir, sandbox="modal").runs] == ["t"]
 
 
+# Images with only a build context, which a VM sandbox builds and nothing else can run
+
+
+def _context_image(id):
+    with namespace_routing():
+        return get_artifact_store().put_document(DockerImageArtifact(
+            id=id, description=id, image_name=f"local/{id}-0123456789ab:v1", build_context_object_url="s3://bucket/ctx.tar.gz",
+            dockerfile_path="Dockerfile", platform="linux/amd64", source_digest="sha256:" + "1" * 64))
+
+
+BY_NAME = ("on the {sandbox!r} sandbox provider, which runs it by name: '{id}' v1 is only a build context, which only a "
+           "VM sandbox builds; run it on a provider whose VMs build it, such as --sandbox modal_vm")
+
+
+@pytest.mark.parametrize("sandbox, refused", [("modal_vm", False), ("local", True), ("modal", True), ("modal_vm,local", True)])
+def test_an_agent_image_that_is_only_a_build_context_runs_where_a_vm_builds_it(bundle_dir, sandbox, refused):
+    with namespace_routing():
+        A2AAgent.put(id="solver", docker_image_artifact=_context_image("solver-image"))
+    _task(bundle_dir, [AGENT])
+
+    if refused:
+        link = "local" if "local" in sandbox else sandbox
+        assert _problems(lambda: dry_run_bundle(bundle_dir, sandbox=sandbox)) == [
+            "tasks/t.json: step 'agent': deploys agent 'solver''s image "
+            + BY_NAME.format(sandbox=sandbox if link == sandbox else link, id="solver-image")]
+    else:
+        assert [entry.name for entry in dry_run_bundle(bundle_dir, sandbox=sandbox).runs] == ["t"]
+
+
+def test_an_env_image_that_is_only_a_build_context_runs_on_a_gateway_vm_and_not_on_modals_containers(bundle_dir):
+    with namespace_routing():
+        MCPServerEnv.put(id="crm", docker_image_artifact=_context_image("crm-image"), environment_name="crm")
+    _task(bundle_dir, [{"id": "env", "type": "deploy_env", "env_id": "crm"}])
+
+    assert [entry.name for entry in dry_run_bundle(bundle_dir, sandbox="local").runs] == ["t"]
+    _infra(REMOTE)
+    assert _problems(lambda: dry_run_bundle(bundle_dir, sandbox="modal")) == [
+        "tasks/t.json: step 'env': deploys env 'crm''s image 'crm-image' " + BY_NAME.format(sandbox="modal", id="crm-image")]
+
+
+@pytest.mark.parametrize("sandbox", ["local", "modal_vm"])
+def test_a_lone_server_whose_image_is_only_a_build_context_is_refused_on_any_provider(bundle_dir, sandbox):
+    with namespace_routing():
+        MCPServerEnv.put(id="crm", docker_image_artifact=_context_image("crm-image"), environment_name="crm",
+                         env_provider_type="server")
+    _task(bundle_dir, [{"id": "env", "type": "deploy_env", "env_id": "crm"}])
+
+    assert _problems(lambda: dry_run_bundle(bundle_dir, sandbox=sandbox)) == [
+        "tasks/t.json: step 'env': deploys env 'crm''s image 'crm-image' " + BY_NAME.format(sandbox=sandbox, id="crm-image")]
+
+
 # What a provider can create