agentnode-sdk 0.24.0__tar.gz → 0.24.1__tar.gz

{agentnode_sdk-0.24.0 → agentnode_sdk-0.24.1}/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## 0.24.1 — the sandbox does what it said
+
+Three defects in the local sandbox runtime, found by the backend conformance suite (EM-3B)
+measuring a real container rather than reading its configuration. Each is a case where
+AgentNode reported a property it was not enforcing.
+
+### Fixed
+
+- **A wall-clock timeout now ends the payload.** It killed the `docker run` client, which is
+  a pipe to a daemon that owns the process — so the SDK reported a timeout while the
+  container kept running, and `--rm` never removed it because it never exited. Every run now
+  carries an exact identity (a unique name *and* a cidfile); a timeout removes that exact
+  container, waits, and verifies that neither the id nor the name remains. If any of that
+  cannot be shown, `SandboxContainmentError` is raised instead of the ordinary timeout
+  result: a stop nobody could verify is not a stop. Nothing outside the run being stopped is
+  ever addressed, and an identity in doubt stops the removal rather than guessing.
+- **The declared memory ceiling now binds.** `--memory` was passed without `--memory-swap`,
+  and a runtime with only the first set grants a swap allowance of twice the limit — the
+  suite watched a 768 MiB allocation finish with exit code 0 under a 512 MiB "limit". The
+  two are now equal, so the total of memory and swap *is* the limit. Whether an engine can
+  account for swap at all is recorded from `docker info` rather than assumed, so a report can
+  say the ceiling is unproven on that engine instead of resting on the flag having been
+  passed.
+- **A refusal now carries a way out.** It said `no container runtime (docker or podman)
+  found on PATH` and nothing more. There were also two answers to the same question — the
+  SDK's bare sentence and the CLI doctor's structured checks — and only one of them ever had
+  a next step. Both now render one classifier, which distinguishes *not installed*, *not
+  running*, *not permitted*, *an engine in the wrong mode* and *a device where no local
+  sandbox is possible*, and offers only actions that exist on the platform in front of you,
+  each followed by the check that tells you whether it worked. Joining the `docker` group is
+  deliberately not among them: it is administrator-equivalent power on the machine.
+
+### Changed
+
+- `SandboxAvailability` carries `probe_error`, `engine_os` and `memory_limit_enforceable`;
+  `check_available(force=True)` re-asks rather than returning the cached answer, which is what
+  a re-check after a fix needs.
+- One-shot sandboxed runs are now named and labelled like the long-lived ones. Nothing
+  filters on that label; it makes a run identifiable, which is the point.
+
+### Not fixed in this release
+
+- **Declared network levels are still not distinguished from one another.** A toolpack that
+  declares `restricted` receives the same open container network as one that declares
+  `unrestricted`: six recognised level names all map to the engine's default bridge. An unknown or
+  missing level is still correctly isolated (`--network none`), so this is not a case of an
+  unrecognised value being let through — the recognised names simply do not differ in what they
+  grant. The risk score meanwhile rates `internal` below `external`, which points the opposite way
+  from what the runtime does.
+
+  This release deliberately does not correct it. The correction requires a declared domain
+  allowlist in the package manifest, registry validation for it, and a refusal for packages that
+  ask for `restricted` without one — a behaviour change that refuses packages which work today,
+  and too large to carry inside a patch that exists to get two proven runtime fixes to people.
+  It ships separately, at a version that reflects the break.
+
 ## 0.24.0 — The container is the boundary
 
 This release makes the execution boundary real rather than advisory. Third-party code

{agentnode_sdk-0.24.0 → agentnode_sdk-0.24.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentnode-sdk
-Version: 0.24.0
+Version: 0.24.1
 Summary: Python SDK for AgentNode — the open upgrade and discovery infrastructure for AI agents.
 Project-URL: Homepage, https://agentnode.net
 Project-URL: Repository, https://github.com/agentnode-ai/agentnode

{agentnode_sdk-0.24.0 → agentnode_sdk-0.24.1}/agentnode_sdk/__init__.py

@@ -38,7 +38,7 @@ from agentnode_sdk.runtime import AgentNodeRuntime
 Client = AgentNodeClient
 ToolError = AgentNodeToolError
 
-__version__ = "0.24.0"
+__version__ = "0.24.1"
 __all__ = [
     "AgentNode",
     "AsyncAgentNode",

{agentnode_sdk-0.24.0 → agentnode_sdk-0.24.1}/agentnode_sdk/cli/sandbox_commands.py

@@ -151,27 +151,54 @@ def _build_env_checks() -> tuple[list[dict], bool, bool]:
     beyond the cached availability probe."""
     from agentnode_sdk.sandbox.container_backend import _BASE_IMAGE, ContainerBackend
 
-    av = ContainerBackend().check_available()
+    # EM-3B-R1/R3: the refusal and this output come from ONE classifier, so the doctor cannot
+    # drift from what the SDK tells a caller. `fix` is the first action that applies here.
+    from agentnode_sdk.sandbox.refusal import RefusalCase, classify
+
+    backend = ContainerBackend()
+    av = backend.check_available()
     placeholder = _is_placeholder_digest(_BASE_IMAGE)
+    refusal = classify(av, placeholder=placeholder)
     checks: list[dict] = []
 
     def rec(name, ok, detail, fix=None):
         checks.append({"check": name, "ok": ok, "detail": detail, "fix": fix})
 
+    def first_action() -> str | None:
+        """Every action that applies on this platform, in one line.
+
+        Not just the first: the Windows start advice ends with the firmware and WSL2 case, and a
+        person whose engine will not start needs that as much as the first sentence.
+        """
+        if refusal is None or not refusal.actions:
+            return None
+        parts = []
+        for a in refusal.actions:
+            parts.append(a.text + (f" ({a.command or a.url})" if (a.command or a.url) else ""))
+        return "; ".join(parts)
+
     if av.backend == "none":
-        rec("runtime", False, "no Docker or Podman found",
-            "Install Docker or Podman (NOT auto-installed): https://docs.docker.com/get-docker/")
+        rec("runtime", False, "no Docker or Podman found", first_action()
+            or "Install Docker or Podman (NOT auto-installed): https://docs.docker.com/get-docker/")
         return checks, False, False
 
     rec("runtime", True, f"{av.backend} ({av.executable_path or 'on PATH'})")
 
     if not av.daemon_ok:
-        rec("daemon", False, f"{av.backend} found but its daemon is not reachable",
-            "Start the container runtime (e.g. Docker Desktop). On Windows this can also be "
-            "WSL2/Hyper-V not running or hardware virtualization disabled in BIOS.")
+        permitted = refusal is not None and refusal.case is RefusalCase.NOT_PERMITTED
+        rec("daemon", False,
+            f"{av.backend} is installed but this account may not use it" if permitted
+            else f"{av.backend} found but its daemon is not reachable",
+            first_action()
+            or ("Start the container runtime (e.g. Docker Desktop). On Windows this can also be "
+                "WSL2/Hyper-V not running or hardware virtualization disabled in BIOS."))
         return checks, False, False
     rec("daemon", True, "reachable")
 
+    if refusal is not None and refusal.case is RefusalCase.INCOMPATIBLE:
+        rec("engine", False, refusal.headline, first_action())
+        return checks, False, False
+
     if placeholder:
         rec("image", False, "this SDK build has no pinned sandbox image (placeholder digest)",
             "Update AgentNode to a build with an activated sandbox image.")

agentnode_sdk-0.24.1/agentnode_sdk/conformance/__init__.py

@@ -0,0 +1,47 @@
+"""EM-3B: the backend conformance suite.
+
+One question, asked the same way of every sandbox backend: **do the properties it claims actually
+hold?** The local container backend that exists today, a sandbox an operator runs themselves, and a
+managed one all have to answer it, and none of them can be trusted on description alone -- this
+codebase has already carried module docstrings that described a capability as inert while two run
+paths were calling it.
+
+So the suite measures. It runs a probe inside the payload, where untrusted code actually sits, and
+asks the runtime what it sees from outside where that is possible. Evidence that consists of an argv
+or of a Python object's assertion is capped at ``self-reported`` and cannot be promoted; a property
+nobody measured is ``not_checked``; and a required property that was not measured keeps the whole
+report from being conformant.
+
+Three assurance levels, and there is no fourth: ``self-reported``, ``observed``, ``attested``.
+``attested`` needs an external attestation document and no code path here has one. The word
+*certified* is rejected at construction, because no outside body has examined anything.
+
+    from agentnode_sdk.conformance import run_conformance
+    from agentnode_sdk.sandbox.policy import get_default_backend
+
+    report = run_conformance(get_default_backend(), generated_at="2026-09-03T00:00:00Z")
+    print(report.summary_line())
+"""
+from agentnode_sdk.conformance.checks import Context, run_all
+from agentnode_sdk.conformance.report import (
+    SUITE_VERSION,
+    Assurance,
+    CheckResult,
+    ConformanceReport,
+    Outcome,
+    Vantage,
+)
+from agentnode_sdk.conformance.runner import SuiteOptions, run_conformance
+
+__all__ = [
+    "Assurance",
+    "CheckResult",
+    "ConformanceReport",
+    "Context",
+    "Outcome",
+    "SUITE_VERSION",
+    "SuiteOptions",
+    "Vantage",
+    "run_all",
+    "run_conformance",
+]