opendsec-harbor 0.1.0__tar.gz

opendsec_harbor-0.1.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

opendsec_harbor-0.1.0/PKG-INFO

@@ -0,0 +1,50 @@
+Metadata-Version: 2.4
+Name: opendsec-harbor
+Version: 0.1.0
+Summary: Harbor environment provider for opendsec: run each Harbor trial as an opendsec World.
+Keywords: harbor,sandbox,reinforcement-learning,evals,agents
+Author: Vibrant Labs
+License-Expression: Apache-2.0
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Science/Research
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Typing :: Typed
+Requires-Dist: harbor>=0.8.1
+Requires-Dist: opendsec>=0.1,<0.2
+Requires-Dist: pyyaml>=6.0.3
+Requires-Python: >=3.12
+Project-URL: Documentation, https://opendsec.vibrantlabs.com
+Description-Content-Type: text/markdown
+
+# opendsec-harbor
+
+A [Harbor](https://github.com/harbor-framework/harbor) environment provider for [opendsec](https://opendsec.vibrantlabs.com): each Harbor trial runs as one opendsec World, and each service in the task's compose file as one Sandbox in it.
+
+```sh
+pip install opendsec-harbor
+```
+
+```sh
+export OPENDSEC_URL=https://your-apiserver OPENDSEC_TOKEN=...
+harbor run -p path/to/task -a oracle -e opendsec_harbor:OpenDSecEnvironment
+```
+
+The agent and the task stay the same; only the environment flag changes. The provider builds each task's images and pushes them to `OPENDSEC_REGISTRY`, which your opendsec nodes pull from, so the machine running Harbor needs `docker` and [`crane`](https://github.com/google/go-containerregistry/tree/main/cmd/crane) on `PATH` and push access to that registry.
+
+| Option (`--ek key=value`) | Variable | Default |
+|---|---|---|
+| `url` | `OPENDSEC_URL` | `http://localhost:7700` |
+| `token` | `OPENDSEC_TOKEN` | none |
+| `registry` | `OPENDSEC_REGISTRY` | `localhost:5001` |
+| `pull_registry` | `OPENDSEC_PULL_REGISTRY` | `registry`; `host.lima.internal:5001` when `registry` is the local default |
+| `platform` | `OPENDSEC_PLATFORM` | this machine's architecture |
+| `ttl` | | `3h` |
+
+Tasks may use only the compose keys `image`, `build`, `command`, `environment`, `volumes`, `expose`, `networks`, `healthcheck` and `depends_on`; anything else fails the trial before it starts rather than running it wrong.
+
+Full guide: https://opendsec.vibrantlabs.com/how-to/run-a-harbor-job/
+
+Licensed under Apache-2.0.

opendsec_harbor-0.1.0/README.md

@@ -0,0 +1,29 @@
+# opendsec-harbor
+
+A [Harbor](https://github.com/harbor-framework/harbor) environment provider for [opendsec](https://opendsec.vibrantlabs.com): each Harbor trial runs as one opendsec World, and each service in the task's compose file as one Sandbox in it.
+
+```sh
+pip install opendsec-harbor
+```
+
+```sh
+export OPENDSEC_URL=https://your-apiserver OPENDSEC_TOKEN=...
+harbor run -p path/to/task -a oracle -e opendsec_harbor:OpenDSecEnvironment
+```
+
+The agent and the task stay the same; only the environment flag changes. The provider builds each task's images and pushes them to `OPENDSEC_REGISTRY`, which your opendsec nodes pull from, so the machine running Harbor needs `docker` and [`crane`](https://github.com/google/go-containerregistry/tree/main/cmd/crane) on `PATH` and push access to that registry.
+
+| Option (`--ek key=value`) | Variable | Default |
+|---|---|---|
+| `url` | `OPENDSEC_URL` | `http://localhost:7700` |
+| `token` | `OPENDSEC_TOKEN` | none |
+| `registry` | `OPENDSEC_REGISTRY` | `localhost:5001` |
+| `pull_registry` | `OPENDSEC_PULL_REGISTRY` | `registry`; `host.lima.internal:5001` when `registry` is the local default |
+| `platform` | `OPENDSEC_PLATFORM` | this machine's architecture |
+| `ttl` | | `3h` |
+
+Tasks may use only the compose keys `image`, `build`, `command`, `environment`, `volumes`, `expose`, `networks`, `healthcheck` and `depends_on`; anything else fails the trial before it starts rather than running it wrong.
+
+Full guide: https://opendsec.vibrantlabs.com/how-to/run-a-harbor-job/
+
+Licensed under Apache-2.0.

opendsec_harbor-0.1.0/pyproject.toml

@@ -0,0 +1,45 @@
+[project]
+name = "opendsec-harbor"
+version = "0.1.0"
+description = "Harbor environment provider for opendsec: run each Harbor trial as an opendsec World."
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.12"
+keywords = [
+    "harbor",
+    "sandbox",
+    "reinforcement-learning",
+    "evals",
+    "agents",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Science/Research",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+    "Typing :: Typed",
+]
+dependencies = [
+    "harbor>=0.8.1",
+    "opendsec>=0.1,<0.2",
+    "pyyaml>=6.0.3",
+]
+
+[[project.authors]]
+name = "Vibrant Labs"
+
+[project.urls]
+Documentation = "https://opendsec.vibrantlabs.com"
+
+[build-system]
+requires = ["uv_build>=0.13.0,<0.14.0"]
+build-backend = "uv_build"
+
+[tool.uv.sources.opendsec]
+path = "../../sdk/python"
+editable = true
+
+[dependency-groups]
+dev = ["pytest>=9.1.1"]

opendsec_harbor-0.1.0/pyproject.toml.orig

@@ -0,0 +1,39 @@
+[project]
+name = "opendsec-harbor"
+version = "0.1.0"
+description = "Harbor environment provider for opendsec: run each Harbor trial as an opendsec World."
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+authors = [{ name = "Vibrant Labs" }]
+requires-python = ">=3.12"
+keywords = ["harbor", "sandbox", "reinforcement-learning", "evals", "agents"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Science/Research",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+    "Typing :: Typed",
+]
+dependencies = [
+    "harbor>=0.8.1",
+    # Released together with the SDK; a minor bump may break the API.
+    "opendsec>=0.1,<0.2",
+    "pyyaml>=6.0.3",
+]
+
+[project.urls]
+Documentation = "https://opendsec.vibrantlabs.com"
+
+[build-system]
+requires = ["uv_build>=0.13.0,<0.14.0"]
+build-backend = "uv_build"
+
+[tool.uv.sources]
+opendsec = { path = "../../sdk/python", editable = true }
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+]

opendsec_harbor-0.1.0/src/opendsec_harbor/__init__.py

@@ -0,0 +1,5 @@
+"""Harbor environment provider for opendsec."""
+
+from opendsec_harbor.environment import OpenDSecEnvironment
+
+__all__ = ["OpenDSecEnvironment"]

opendsec_harbor-0.1.0/src/opendsec_harbor/compose.py

@@ -0,0 +1,183 @@
+"""Translate the subset of docker-compose Harbor tasks use into a World's Sandboxes.
+
+Anything outside the subset is rejected, never approximated: a silently
+dropped key (a missing alias, a missing mount) produces a degraded task setup that
+can still score, which is worse than a trial that refuses to start.
+"""
+
+from __future__ import annotations
+
+import shlex
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import yaml
+
+MAIN = "main"
+
+SUPPORTED_KEYS = {
+    "image",
+    "build",
+    "command",
+    "environment",
+    "volumes",
+    "expose",
+    "networks",
+    "healthcheck",
+    "depends_on",
+}
+
+
+class UnsupportedCompose(ValueError):
+    pass
+
+
+@dataclass
+class FileMount:
+    source: Path  # on the host, resolved against the compose file's directory
+    target: str  # inside the Sandbox
+
+
+@dataclass
+class ServicePlan:
+    """One compose service, before images are built and pushed."""
+
+    name: str
+    image: str | None = None
+    build_context: Path | None = None
+    dockerfile: str | None = None
+    command: list[str] | None = None
+    env: dict[str, str] = field(default_factory=dict)
+    files: list[FileMount] = field(default_factory=list)
+    aliases: list[str] = field(default_factory=list)
+    readiness: list[str] | None = None
+    readiness_interval_s: float = 1.0
+    readiness_timeout_s: float = 60.0
+
+
+def plan_services(
+    environment_dir: Path, docker_image: str | None, prefer_prebuilt: bool
+) -> list[ServicePlan]:
+    """Harbor's base `main` service merged with the task's compose file."""
+    main = ServicePlan(name=MAIN, command=["sh", "-c", "sleep infinity"])
+    dockerfile = environment_dir / "Dockerfile"
+    if docker_image and (prefer_prebuilt or not dockerfile.exists()):
+        main.image = docker_image
+    elif dockerfile.exists():
+        main.build_context = environment_dir
+    plans = {MAIN: main}
+
+    compose_path = environment_dir / "docker-compose.yaml"
+    if compose_path.exists():
+        doc = yaml.safe_load(compose_path.read_text()) or {}
+        if extra := set(doc) - {"services"}:
+            raise UnsupportedCompose(f"top-level keys not supported: {sorted(extra)}")
+        for name, svc in (doc.get("services") or {}).items():
+            plans[name] = _merge(plans.get(name) or ServicePlan(name=name), svc or {}, environment_dir)
+
+    for p in plans.values():
+        if not p.image and not p.build_context:
+            raise UnsupportedCompose(f"service {p.name!r} has neither image nor build")
+    return list(plans.values())
+
+
+def _merge(p: ServicePlan, svc: dict, base: Path) -> ServicePlan:
+    if extra := set(svc) - SUPPORTED_KEYS:
+        raise UnsupportedCompose(f"service {p.name!r}: keys not supported: {sorted(extra)}")
+    if "image" in svc:
+        p.image = svc["image"]
+    if "build" in svc:
+        b = svc["build"]
+        if isinstance(b, str):
+            b = {"context": b}
+        if extra := set(b) - {"context", "dockerfile"}:
+            raise UnsupportedCompose(f"service {p.name!r}: build keys not supported: {sorted(extra)}")
+        p.build_context = (base / b.get("context", ".")).resolve()
+        p.dockerfile = b.get("dockerfile")
+        p.image = None
+    if "command" in svc:
+        c = svc["command"]
+        p.command = shlex.split(c) if isinstance(c, str) else [str(x) for x in c]
+    if "environment" in svc:
+        env = svc["environment"]
+        if isinstance(env, list):
+            env = dict(e.split("=", 1) for e in env)
+        p.env.update({k: str(v) for k, v in env.items()})
+    for v in svc.get("volumes", []):
+        p.files.append(_file_mount(p.name, v, base))
+    p.aliases += _aliases(p.name, svc.get("networks"))
+    if "healthcheck" in svc:
+        _readiness(p, svc["healthcheck"])
+    # depends_on is satisfied by construction: a World is ready only when
+    # every Sandbox's readiness probe passes, and nothing runs before that.
+    for dep, cond in _depends_on(svc.get("depends_on")).items():
+        if cond not in ("service_started", "service_healthy"):
+            raise UnsupportedCompose(f"service {p.name!r}: depends_on {dep} condition {cond!r}")
+    return p
+
+
+def _file_mount(service: str, v, base: Path) -> FileMount:
+    if not isinstance(v, str):
+        raise UnsupportedCompose(f"service {service!r}: long-form volumes not supported")
+    parts = v.split(":")
+    if len(parts) not in (2, 3) or not parts[0].startswith("."):
+        raise UnsupportedCompose(
+            f"service {service!r}: only read-only binds of task files are supported, got {v!r}"
+        )
+    if len(parts) == 3 and parts[2] != "ro":
+        raise UnsupportedCompose(f"service {service!r}: volume {v!r} must be :ro")
+    src = (base / parts[0]).resolve()
+    if not src.exists():
+        raise UnsupportedCompose(f"service {service!r}: volume source {src} does not exist")
+    return FileMount(source=src, target=parts[1])
+
+
+def _aliases(service: str, networks) -> list[str]:
+    if networks is None or isinstance(networks, list):
+        if networks and networks != ["default"]:
+            raise UnsupportedCompose(f"service {service!r}: only the default network is supported")
+        return []
+    out = []
+    for net, cfg in networks.items():
+        if net != "default":
+            raise UnsupportedCompose(f"service {service!r}: only the default network is supported")
+        cfg = cfg or {}
+        if extra := set(cfg) - {"aliases"}:
+            raise UnsupportedCompose(f"service {service!r}: network keys not supported: {sorted(extra)}")
+        out += cfg.get("aliases", [])
+    return out
+
+
+def _readiness(p: ServicePlan, hc: dict) -> None:
+    if extra := set(hc) - {"test", "interval", "timeout", "retries", "start_period"}:
+        raise UnsupportedCompose(f"service {p.name!r}: healthcheck keys not supported: {sorted(extra)}")
+    test = hc["test"]
+    if isinstance(test, str):
+        p.readiness = ["sh", "-c", test]
+    elif test[0] == "CMD":
+        p.readiness = [str(x) for x in test[1:]]
+    elif test[0] == "CMD-SHELL":
+        p.readiness = ["sh", "-c", test[1]]
+    else:
+        raise UnsupportedCompose(f"service {p.name!r}: healthcheck test {test[0]!r}")
+    interval = _seconds(hc.get("interval", "30s"))
+    p.readiness_interval_s = interval
+    p.readiness_timeout_s = _seconds(hc.get("start_period", "0s")) + interval * hc.get("retries", 3)
+
+
+def _depends_on(d) -> dict[str, str]:
+    if d is None:
+        return {}
+    if isinstance(d, list):
+        return {k: "service_started" for k in d}
+    return {k: (v or {}).get("condition", "service_started") for k, v in d.items()}
+
+
+def _seconds(s) -> float:
+    if isinstance(s, (int, float)):
+        return float(s)
+    units = {"ms": 0.001, "s": 1, "m": 60, "h": 3600}
+    for u in ("ms", "s", "m", "h"):
+        if s.endswith(u) and s[: -len(u)].replace(".", "", 1).isdigit():
+            return float(s[: -len(u)]) * units[u]
+    raise UnsupportedCompose(f"duration {s!r}")

opendsec_harbor-0.1.0/src/opendsec_harbor/environment.py

@@ -0,0 +1,210 @@
+"""Harbor environment provider backed by opendsec.
+
+    harbor run -e opendsec_harbor:OpenDSecEnvironment \\
+        --ek url=http://localhost:7700 --ek registry=localhost:5001 ...
+
+Each Harbor trial is one World; each compose service is one Sandbox in it.
+
+Works with upstream Harbor (0.22) and Marin's fork (0.8.1); the two differ in
+how they express network policy, handled in `_egress`.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import time
+from pathlib import Path
+
+from harbor.environments.base import BaseEnvironment, ExecResult
+from harbor.environments.capabilities import EnvironmentCapabilities
+from harbor.environments.definition import require_agent_environment_definition
+
+import opendsec
+from opendsec_harbor.compose import MAIN, plan_services
+from opendsec_harbor.images import resolve_image
+
+
+class OpenDSecEnvironment(BaseEnvironment):
+    def __init__(self, *args, **kwargs):
+        self._url = kwargs.pop("url", None) or os.environ.get("OPENDSEC_URL", "http://localhost:7700")
+        self._token = kwargs.pop("token", None) or os.environ.get("OPENDSEC_TOKEN")
+        # Where images are pushed from this machine, and the same registry as
+        # the platform's nodes reach it (they differ in local dev: Docker
+        # Desktop's localhost is the Lima VM's host.lima.internal).
+        self._registry = kwargs.pop("registry", None) or os.environ.get("OPENDSEC_REGISTRY", "localhost:5001")
+        self._pull_registry = (
+            kwargs.pop("pull_registry", None)
+            or os.environ.get("OPENDSEC_PULL_REGISTRY")
+            or ("host.lima.internal:5001" if self._registry == "localhost:5001" else self._registry)
+        )
+        self._ttl = kwargs.pop("ttl", "3h")
+        self._platform = kwargs.pop("platform", None)
+        self._metrics: dict = {}
+        self._started_at: float | None = None
+        self._client: opendsec.Client | None = None
+        self._world: opendsec.World | None = None
+        super().__init__(*args, **kwargs)
+
+    @staticmethod
+    def type() -> str:
+        return "opendsec"
+
+    @property
+    def capabilities(self) -> EnvironmentCapabilities:
+        # Egress is all-or-nothing for now: no allowlists, and no switching
+        # policy mid-trial. Harbor rejects tasks that need either rather than
+        # run them with the wrong network.
+        return EnvironmentCapabilities(docker_compose=True, disable_internet=True)
+
+    def _egress(self) -> str:
+        policy = getattr(self, "_network_policy", None)
+        if policy is not None:  # upstream Harbor
+            mode = str(getattr(policy.network_mode, "value", policy.network_mode))
+            if mode == "public":
+                return "public"
+            if mode == "no-network":
+                return "none"
+            raise NotImplementedError(f"opendsec: network mode {mode!r} is not supported yet")
+        # Marin's fork: a boolean on the task's environment config.
+        return "public" if getattr(self.task_env_config, "allow_internet", True) else "none"
+
+    def _validate_definition(self):
+        require_agent_environment_definition(
+            self.environment_dir, docker_image=self.task_env_config.docker_image
+        )
+
+    async def start(self, force_build: bool) -> None:
+        t0 = time.monotonic()
+        plans = plan_services(
+            self.environment_dir, self.task_env_config.docker_image, prefer_prebuilt=not force_build
+        )
+        reports = await asyncio.gather(
+            *(resolve_image(p, self._registry, force_build=force_build, platform=self._platform) for p in plans)
+        )
+        t_images = time.monotonic()
+        cpus, memory_mb = self._effective_cpus or 1, self._effective_memory_mb or 2048
+        egress = self._egress()
+        sandboxes = []
+        for p, rep in zip(plans, reports):
+            env = dict(p.env)
+            if p.name == MAIN:
+                env.update(self.task_env_config.env or {})
+            sandboxes.append(
+                opendsec.Sandbox(
+                    name=p.name,
+                    # Nodes may reach the registry by another name (local dev).
+                    image=self._pull_registry + rep.ref.removeprefix(self._registry),
+                    cpus=cpus,
+                    memory_mb=memory_mb,
+                    command=p.command,
+                    env=env,
+                    aliases=p.aliases,
+                    egress=egress,
+                    readiness=opendsec.Readiness(
+                        command=p.readiness,
+                        interval=f"{p.readiness_interval_s}s",
+                        timeout=f"{p.readiness_timeout_s}s",
+                    )
+                    if p.readiness
+                    else None,
+                )
+            )
+        self._client = opendsec.Client(self._url, self._token)
+        self.logger.debug(f"creating world with sandboxes {[sb.name for sb in sandboxes]}")
+        try:
+            self._world = await self._client.create_world(sandboxes, ttl=self._ttl)
+        finally:
+            self._metrics = {
+                "egress": egress,
+                "images": [vars(r) for r in reports],
+                "images_s": round(t_images - t0, 3),
+                "create_s": round(time.monotonic() - t_images, 3),
+            }
+        self._metrics |= {"world_id": self._world.id, "node_timings_ms": self._world.timings}
+        self.logger.debug(f"world {self._world.id} ready")
+        # Harbor's /logs/* mounts become plain directories it copies back.
+        await self.ensure_dirs(self._mount_targets(writable_only=True))
+        await self._upload_environment_dir_after_start()
+        self._metrics["start_s"] = round(time.monotonic() - t0, 3)
+        self._started_at = time.monotonic()
+
+    async def stop(self, delete: bool):
+        try:
+            if self._started_at is not None:
+                self._metrics["in_world_s"] = round(time.monotonic() - self._started_at, 3)
+            if self._world:
+                await self._world.stop()
+        finally:
+            self._write_metrics()
+            if self._client:
+                await self._client.close()
+            self._world = self._client = None
+
+    def _write_metrics(self) -> None:
+        if not self._metrics:
+            return
+        role = "verifier" if "__verifier__" in self.session_id else "agent"
+        try:
+            path = Path(str(self.trial_paths.trial_dir)) / f"opendsec-{role}.json"
+            path.write_text(json.dumps(self._metrics, indent=2) + "\n")
+        except OSError as e:
+            self.logger.warning(f"opendsec: could not write metrics: {e}")
+
+    @property
+    def world(self) -> opendsec.World:
+        if not self._world:
+            raise RuntimeError("environment not started")
+        return self._world
+
+    async def exec(self, command, cwd=None, env=None, timeout_sec=None, user=None) -> ExecResult:
+        return await self.service_exec(
+            command, service=MAIN, cwd=cwd, env=env, timeout_sec=timeout_sec, user=user
+        )
+
+    async def service_exec(
+        self, command, *, service=None, cwd=None, env=None, timeout_sec=None, user=None
+    ) -> ExecResult:
+        sandbox = service or MAIN
+        user = self._resolve_user(user)
+        if user not in (None, 0, "0", "root"):
+            raise NotImplementedError(f"opendsec: exec as user {user!r} is not supported yet")
+        if sandbox == MAIN:
+            # Harbor builds main and it always has bash; sidecars may not.
+            argv = ["bash", "-c", command]
+            cwd = cwd or self.task_env_config.workdir
+            env = self._merge_env(env)
+        else:
+            argv = ["sh", "-c", command]
+        res = await self.world.exec(sandbox, argv, env=env, workdir=cwd, timeout=timeout_sec)
+        if res.timed_out:
+            raise RuntimeError(f"Command timed out after {timeout_sec} seconds")
+        return ExecResult(stdout=res.stdout, stderr=res.stderr, return_code=res.exit_code)
+
+    async def upload_file(self, source_path, target_path):
+        await self.world.upload(MAIN, source_path, target_path)
+
+    async def upload_dir(self, source_dir, target_dir):
+        await self.world.upload(MAIN, source_dir, target_dir)
+
+    async def download_file(self, source_path, target_path):
+        await self.world.download(MAIN, source_path, Path(target_path))
+
+    async def download_dir(self, source_dir, target_dir):
+        await self.world.download(MAIN, source_dir, Path(target_dir))
+
+    async def service_download_file(self, source_path, target_path, *, service=None):
+        await self.world.download(service or MAIN, source_path, Path(target_path))
+
+    async def service_download_dir(self, source_dir, target_dir, *, service=None):
+        await self.world.download(service or MAIN, source_dir, Path(target_dir))
+
+    async def stop_service(self, service: str) -> None:
+        # Stopping one Sandbox would fail the whole World (a World is placed
+        # and destroyed as a unit), taking the service holding the evidence
+        # with it. Recorded as a divergent-lifecycle case for the World-model
+        # experiment (docs/plan.md, M2); main is left running.
+        self.logger.warning(
+            f"opendsec: stop_service({service!r}) is a no-op; Sandboxes cannot stop independently"
+        )

opendsec_harbor-0.1.0/src/opendsec_harbor/images.py

@@ -0,0 +1,202 @@
+"""Content-addressed task images.
+
+The platform never builds. Every compose service becomes an image in a
+registry, tagged by a hash of everything that determines it: the build
+context's files, the Dockerfile name, any bind-mounted task files baked in,
+and the platform. If the registry already holds that tag, nothing is built, so
+`prebuild` (run ahead of a batch) and the provider (at trial start) share one
+code path and one cache: the registry itself.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import os
+import platform as host_platform
+import re
+import shutil
+import tempfile
+import time
+from dataclasses import dataclass
+from pathlib import Path
+
+from opendsec_harbor.compose import ServicePlan
+
+REPO = "opendsec/task-images"
+_IGNORE = {".DS_Store", ".git", "__pycache__"}
+_locks: dict[str, asyncio.Lock] = {}
+_cache: dict[str, str] = {}
+
+
+@dataclass
+class ImageReport:
+    service: str
+    ref: str  # registry/repo@sha256:...
+    status: str  # "cached" (already in registry) or "built"
+    seconds: float
+
+
+def default_platform() -> str:
+    """OPENDSEC_PLATFORM, else this machine's architecture.
+
+    Images must match the nodes'; this default suits a driver that shares
+    the nodes' architecture (an amd64 VM next to amd64 nodes, or a Mac next
+    to its arm64 Lima VM).
+    """
+    if p := os.environ.get("OPENDSEC_PLATFORM"):
+        return p
+    arch = host_platform.machine().lower()
+    return "linux/arm64" if arch in ("arm64", "aarch64") else "linux/amd64"
+
+
+def content_hash(plan: ServicePlan, platform: str) -> str:
+    """Hash of every input that determines the service's image."""
+    h = hashlib.sha256()
+
+    def add(*parts: str | bytes) -> None:
+        for p in parts:
+            b = p.encode() if isinstance(p, str) else p
+            h.update(len(b).to_bytes(8, "big") + b)
+
+    add("v1", platform, plan.dockerfile or "Dockerfile")
+    if plan.build_context:
+        add("context")
+        _add_tree(add, plan.build_context)
+    else:
+        add("image", plan.image or "")
+    for f in plan.files:
+        add("file", f.target)
+        _add_tree(add, f.source)
+    return h.hexdigest()[:24]
+
+
+def _add_tree(add, root: Path) -> None:
+    if root.is_file():
+        add(root.read_bytes())
+        return
+    for p in sorted(root.rglob("*")):
+        if any(part in _IGNORE for part in p.relative_to(root).parts) or not p.is_file():
+            continue
+        add(p.relative_to(root).as_posix(), oct(p.stat().st_mode & 0o111), p.read_bytes())
+
+
+async def resolve_image(
+    plan: ServicePlan, registry: str, *, force_build: bool = False, platform: str | None = None
+) -> ImageReport:
+    """Ensure the service's image is in the registry; return it by digest."""
+    platform = platform or default_platform()
+    tag = f"{registry}/{REPO}:{content_hash(plan, platform)}"
+    lock = _locks.setdefault(tag, asyncio.Lock())
+    async with lock:
+        start = time.monotonic()
+        if tag in _cache and not force_build:
+            return ImageReport(plan.name, _cache[tag], "cached", 0.0)
+        if not force_build and (digest := await _digest(tag)):
+            ref = _by_digest(tag, digest)
+            status = "cached"
+        else:
+            await _build(plan, tag, platform, no_cache=force_build)
+            await _docker("push", "-q", tag)
+            digest = await _digest(tag)
+            if not digest:
+                raise RuntimeError(f"pushed {tag} but the registry does not report a digest")
+            ref = _by_digest(tag, digest)
+            status = "built"
+        _cache[tag] = ref
+        return ImageReport(plan.name, ref, status, time.monotonic() - start)
+
+
+async def compressed_size(ref: str, plat: str | None = None) -> int:
+    """Total compressed layer bytes of an image, as a node would pull it."""
+    _, out = await _crane("manifest", "--platform", plat or default_platform(), ref)
+    return sum(layer["size"] for layer in json.loads(out).get("layers", []))
+
+
+async def _build(plan: ServicePlan, tag: str, platform: str, no_cache: bool) -> None:
+    if plan.build_context:
+        args = ["build", "-q", "--platform", platform, "-t", tag]
+        if plan.dockerfile:
+            args += ["-f", str(plan.build_context / plan.dockerfile)]
+        if no_cache:
+            args.append("--no-cache")
+        await _docker(*args, str(plan.build_context))
+    else:
+        assert plan.image
+        # Prefer a local image (e.g. one built by the environment's own
+        # tooling) when it matches the platform; otherwise pull.
+        code, local = await _docker(
+            "image", "inspect", "--format", "{{.Os}}/{{.Architecture}}", plan.image, check=False
+        )
+        if code != 0 or local.strip() != platform:
+            await _docker("pull", "-q", "--platform", platform, plan.image)
+        await _docker("tag", plan.image, tag)
+    if plan.files:
+        # A remote World cannot see this machine's files: bake them in.
+        with tempfile.TemporaryDirectory() as ctx:
+            lines = [f"FROM {tag}"]
+            for i, f in enumerate(plan.files):
+                name = f"f{i}"
+                if f.source.is_dir():
+                    shutil.copytree(f.source, Path(ctx) / name)
+                else:
+                    shutil.copy2(f.source, Path(ctx) / name)
+                lines.append(f"COPY {name} {f.target}")
+            (Path(ctx) / "Dockerfile").write_text("\n".join(lines) + "\n")
+            await _docker("build", "-q", "--platform", platform, "-t", tag, ctx)
+
+
+_NOT_FOUND = ("MANIFEST_UNKNOWN", "NAME_UNKNOWN", "NOT_FOUND", "404 Not Found")
+
+
+async def _digest(tag: str) -> str | None:
+    """The tag's digest, or None if the registry does not have it.
+
+    Only a definite "not found" is a cache miss. Any other failure (expired
+    credentials, network) raises: treating it as a miss would rebuild and
+    push an image that already exists, and fail confusingly at the push.
+    """
+    code, out = await _crane("digest", tag, check=False)
+    if code == 0 and out.startswith("sha256:"):
+        return out.strip()
+    if any(marker in out for marker in _NOT_FOUND):
+        return None
+    raise RuntimeError(f"cannot query registry for {tag} (credentials expired?):\n{out.strip()[-500:]}")
+
+
+def _by_digest(tag: str, digest: str) -> str:
+    return tag.rsplit(":", 1)[0] + "@" + digest
+
+
+def _insecure(ref: str) -> bool:
+    host = ref.split("/", 1)[0].split(":", 1)[0]
+    return host in ("localhost", "127.0.0.1")
+
+
+async def _crane(*args: str, check: bool = True) -> tuple[int, str]:
+    """Run crane; on failure the returned text includes stderr."""
+    ref = args[-1]
+    extra = ["--insecure"] if _insecure(ref) else []
+    return await _run("crane", *args[:-1], *extra, ref, check=check, stderr_on_error=True)
+
+
+async def _docker(*args: str, check: bool = True) -> tuple[int, str]:
+    return await _run("docker", *args, check=check)
+
+
+async def _run(*argv: str, check: bool = True, stderr_on_error: bool = False) -> tuple[int, str]:
+    proc = await asyncio.create_subprocess_exec(
+        *argv, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE
+    )
+    out, err = await proc.communicate()
+    if check and proc.returncode != 0:
+        raise RuntimeError(
+            f"{' '.join(argv[:3])} failed ({proc.returncode}):\n{(out + err).decode(errors='replace')[-2000:]}"
+        )
+    text = out if proc.returncode == 0 or not stderr_on_error else out + err
+    return proc.returncode or 0, text.decode(errors="replace")
+
+
+def slug(s: str) -> str:
+    return re.sub(r"[^a-z0-9._-]+", "-", s.lower()).strip("-.")[:60]

opendsec_harbor-0.1.0/src/opendsec_harbor/prebuild.py

@@ -0,0 +1,90 @@
+"""Build and push the images for many Harbor tasks ahead of a run.
+
+    uv run python -m opendsec_harbor.prebuild --registry myacr.azurecr.io -j 8 \\
+        --out prebuild.jsonl tasks/*
+
+Uses the provider's own content-addressed path, so anything built here is a
+cache hit at trial start. Writes one JSON line per image, failures included.
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import sys
+import time
+import tomllib
+from pathlib import Path
+
+from opendsec_harbor.compose import plan_services
+from opendsec_harbor.images import compressed_size, default_platform, resolve_image
+
+
+def task_environments(task: Path) -> list[tuple[str, Path, str | None]]:
+    """(role, environment dir, prebuilt docker_image) for each environment a
+    trial of this task starts: the agent's, and a separate verifier's."""
+    cfg = tomllib.loads((task / "task.toml").read_text())
+    envs = [("agent", task / "environment", cfg.get("environment", {}).get("docker_image"))]
+    verifier = cfg.get("verifier", {})
+    if verifier.get("environment_mode") == "separate":
+        envs.append(("verifier", task / "tests", verifier.get("environment", {}).get("docker_image")))
+    return envs
+
+
+async def prebuild_task(task: Path, registry: str, platform: str, sem: asyncio.Semaphore) -> list[dict]:
+    rows = []
+    async with sem:
+        for role, env_dir, docker_image in task_environments(task):
+            try:
+                plans = plan_services(env_dir, docker_image, prefer_prebuilt=True)
+            except Exception as e:  # noqa: BLE001 - report every failure, keep going
+                rows.append({"task": task.name, "role": role, "error": f"plan: {e}"})
+                continue
+            for plan in plans:
+                row = {"task": task.name, "role": role, "service": plan.name}
+                start = time.monotonic()
+                try:
+                    rep = await resolve_image(plan, registry, platform=platform)
+                    row |= {
+                        "status": rep.status,
+                        "seconds": round(rep.seconds, 2),
+                        "ref": rep.ref,
+                        "compressed_bytes": await compressed_size(rep.ref, platform),
+                    }
+                except Exception as e:  # noqa: BLE001
+                    row |= {"error": str(e)[-1000:], "seconds": round(time.monotonic() - start, 2)}
+                rows.append(row)
+    return rows
+
+
+async def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("tasks", nargs="+", type=Path, help="Harbor task directories")
+    ap.add_argument("--registry", required=True)
+    ap.add_argument("--platform", default=default_platform())
+    ap.add_argument("-j", "--jobs", type=int, default=4, help="tasks built concurrently")
+    ap.add_argument("--out", type=Path, default=Path("prebuild.jsonl"))
+    args = ap.parse_args()
+
+    sem = asyncio.Semaphore(args.jobs)
+    tasks = [t for t in args.tasks if (t / "task.toml").exists()]
+    failures = built = cached = 0
+    with args.out.open("w") as out:
+        for coro in asyncio.as_completed([prebuild_task(t, args.registry, args.platform, sem) for t in tasks]):
+            for row in await coro:
+                out.write(json.dumps(row) + "\n")
+                out.flush()
+                if "error" in row:
+                    failures += 1
+                    print(f"FAIL {row['task']}/{row.get('service', '?')}: {row['error'][:200]}", file=sys.stderr)
+                elif row["status"] == "built":
+                    built += 1
+                else:
+                    cached += 1
+    print(f"{len(tasks)} tasks: {built} built, {cached} cached, {failures} failed -> {args.out}")
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(asyncio.run(main()))