openreward 0.1.159.dev2__tar.gz → 0.1.161.dev0__tar.gz

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openreward
-Version: 0.1.159.dev2
+Version: 0.1.161.dev0
 Summary: Python SDK for the OpenReward platform.
 Author-email: GR Inc <hello@gr.inc>
 License-Expression: MIT
@@ -85,6 +85,8 @@ An `Environment` subclass defines a benchmark or task distribution. Implement th
 
 Actions are defined as `async` methods decorated with `@tool`. Each tool receives a Pydantic model as input and returns a `ToolOutput`.
 
+Calls to the same tool run one at a time per session (different tools still overlap), so parallel calls (e.g. from a multi-agent harness) cannot race a grader or submit twice; once a call returns `finished=True`, queued calls are refused without running. Mark tools that never grant reward with `@tool(concurrent=True)` to let them run in parallel. The built-in shell, file and web toolsets already do.
+
 ### ToolOutput
 
 Every tool returns a `ToolOutput` containing:

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/README.md

@@ -39,6 +39,8 @@ An `Environment` subclass defines a benchmark or task distribution. Implement th
 
 Actions are defined as `async` methods decorated with `@tool`. Each tool receives a Pydantic model as input and returns a `ToolOutput`.
 
+Calls to the same tool run one at a time per session (different tools still overlap), so parallel calls (e.g. from a multi-agent harness) cannot race a grader or submit twice; once a call returns `finished=True`, queued calls are refused without running. Mark tools that never grant reward with `@tool(concurrent=True)` to let them run in parallel. The built-in shell, file and web toolsets already do.
+
 ### ToolOutput
 
 Every tool returns a `ToolOutput` containing:

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/api/environments/client.py

@@ -635,7 +635,7 @@ def _validate_toolset_name(toolset: Optional[str]) -> Optional[str]:
     return toolset
 
 
-_VALID_REASONS: set[str] = {"not_found", "name_collision", "input_validation", "bad_input_shape"}
+_VALID_REASONS: set[str] = {"not_found", "name_collision", "input_validation", "bad_input_shape", "episode_finished"}
 
 
 def _infer_invalid_reason(error: str) -> ToolCallErrorReason:

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/api/errors.py

@@ -88,11 +88,15 @@ ToolCallErrorReason = Literal[
     "name_collision",
     "input_validation",
     "bad_input_shape",
+    # The session's episode already finished (a tool returned
+    # finished=True); the server refuses every later call.
+    "episode_finished",
 ]
 
 
 class ToolCallError(OpenRewardError):
-    """Tool call was malformed — won't succeed by retrying the same args.
+    """Tool call was malformed, or the episode already finished — won't
+    succeed by retrying the same args.
 
     The ``reason`` discriminates between the specific malformation, so the
     caller can phrase the feedback to the model appropriately.

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/api/sandboxes/client.py

@@ -1,14 +1,14 @@
 import asyncio
 import base64
 import re
+import shlex
 import threading
 from pathlib import Path
 from typing import ClassVar, Mapping, Optional, Union
 
 import aiohttp
 from tenacity import AsyncRetrying, retry_if_exception, stop_after_attempt
-from openreward._version import USER_AGENT
-from openreward.api._session.http import _raise_for_status_with_auth, request_retryable, resumable_sse
+from openreward.api._session.http import request_retryable, resumable_sse
 from openreward.api._session.session import BaseAsyncSession, SessionKind, SessionTerminatedError
 from openreward.api.sandboxes.secrets import build_secrets_header, augment_secrets_with_api_key
 from openreward.api.sandboxes.types import PodTerminatedError, RunResult, SandboxSettings
@@ -155,58 +155,37 @@ class AsyncSandboxesAPI(BaseAsyncSession):
             raise RuntimeError(f"Command failed: {cmd}\n{result.output}")
         return result.output
 
-    # Files move through the exec-agent's /files endpoint as raw bytes rather
-    # than through a shell command. The old `echo <base64> | base64 -d > path`
-    # needed a base64 binary in the image (the retro-1999 image has none), put
-    # a 13 MB command on the wire for a 10 MB file, and its exit code depended
-    # on the image's shell. No shell also means the container path needs no
-    # quoting: it travels as a query parameter and is used verbatim.
-    MAX_UPLOAD_BYTES: ClassVar[int] = 10 * 1024 * 1024
-
-    def _file_headers(self) -> dict[str, str]:
-        return {"User-Agent": USER_AGENT, "X-API-Key": self.api_key, "X-Session-ID": self.sid}
-
-    async def upload_bytes(self, data: bytes, container_path: str) -> None:
-        """Write ``data`` to ``container_path`` in the container.
-
-        The file is created with mode 0644, or truncated if it already exists,
-        as a shell ``>`` redirection would. Parent directories are not created.
-        """
-        self._ensure_alive()
-        self._ensure_started()
-        if len(data) > self.MAX_UPLOAD_BYTES:
-            raise ValueError(f"File is too large: {len(data)} bytes > {self.MAX_UPLOAD_BYTES} bytes")
-        headers = {**self._file_headers(), "Content-Type": "application/octet-stream"}
-        async with self.client.request(
-            "PUT", "/files", params={"path": container_path}, data=data, headers=headers
-        ) as resp:
-            await _raise_for_status_with_auth(resp)
-
     async def upload(self, local_path: Union[str, Path], container_path: str) -> None:
         """Upload a single file from local filesystem to the container."""
         self._ensure_alive()
         local_path = Path(local_path)
         if not local_path.exists():
             raise FileNotFoundError(f"Local file not found: {local_path}")
-        size = local_path.stat().st_size
-        if size > self.MAX_UPLOAD_BYTES:
-            raise ValueError(f"File is too large: {size} bytes > {self.MAX_UPLOAD_BYTES} bytes")
-        await self.upload_bytes(local_path.read_bytes(), container_path)
 
-    async def download(self, container_path: str) -> bytes:
-        """Download a single file from the container.
+        max_size = 10 * 1024 * 1024
+        if local_path.stat().st_size > max_size:
+            raise ValueError(f"File is too large: {local_path.stat().st_size} bytes > {max_size} bytes")
 
-        Raises :class:`FileNotFoundError` if there is no such file.
-        """
+        file_content = local_path.read_bytes()
+        encoded_content = base64.b64encode(file_content).decode('ascii')
+
+        # Quote the destination: unquoted, a path with a space writes to two
+        # places and one with `;` or `$VAR` runs/expands. The base64 payload is
+        # [A-Za-z0-9+/=], so it needs no quoting.
+        cmd = f"echo '{encoded_content}' | base64 -d > {shlex.quote(container_path)}"
+        await self.check_run(cmd, max_bytes=max_size)
+
+    async def download(self, container_path: str) -> bytes:
+        """Download a single file from the container."""
         self._ensure_alive()
-        self._ensure_started()
-        async with self.client.request(
-            "GET", "/files", params={"path": container_path}, headers=self._file_headers()
-        ) as resp:
-            if resp.status == 404:
-                raise FileNotFoundError(f"No such file in the container: {container_path}")
-            await _raise_for_status_with_auth(resp)
-            return await resp.read()
+        cmd = f"base64 {shlex.quote(container_path)}"
+        output = await self.check_run(cmd, max_bytes=None)
+
+        try:
+            file_content = base64.b64decode(output.encode('ascii'))
+            return file_content
+        except Exception as e:
+            raise RuntimeError(f"Failed to decode and write file: {e}")
 
     async def start(self) -> None:
         await self.__aenter__()
@@ -290,14 +269,6 @@ class SandboxesAPI:
             self._async.upload(local_path, container_path)
         )
 
-    def upload_bytes(self, data: bytes, container_path: str) -> None:
-        """Write bytes to a file in the container."""
-        if self._async is None:
-            raise RuntimeError("Sandbox not started. Call start() or use as context manager.")
-        self._run(
-            self._async.upload_bytes(data, container_path)
-        )
-
     def download(self, container_path: str) -> bytes:
         """Download a single file from the container."""
         if self._async is None:

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/api/sandboxes/types.py

@@ -8,14 +8,19 @@ MachineSize = Literal[
     '1:1',
     '2:2',
     '4:4',
+    '8:8',
+    '16:16',
     '0.5:1',
     '1:2',
     '2:4',
     '4:8',
+    '8:16',
     '0.5:2',
     '1:4',
     '2:8',
     '4:16',
+    '8:32',
+    '16:64',
     'nvidia-l4'
 ]
 

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/environments/_sandbox_tools.py

@@ -15,8 +15,11 @@ Public exports:
 """
 from __future__ import annotations
 
+import asyncio
+import base64
 import os
 import shlex
+import weakref
 from typing import Any, Dict, List, Optional, overload
 
 from ..api.errors import SessionTerminatedError, TransportError
@@ -40,6 +43,25 @@ def _tool_error(e: Exception, what: str) -> ToolOutput:
     )
 
 
+# ── Per-file locks ──────────────────────────────────────────────────────────
+
+# Keyed by sandbox (not toolset) so toolsets sharing one sandbox share locks.
+_file_locks: "weakref.WeakKeyDictionary[Any, Dict[str, asyncio.Lock]]" = weakref.WeakKeyDictionary()
+_file_locks_by_id: Dict[int, Dict[str, asyncio.Lock]] = {}
+
+
+def file_lock(sandbox: Any, path: str) -> asyncio.Lock:
+    """Lock serialising read-modify-write of ``path`` in ``sandbox``.
+
+    Only guards calls that take it (the edit/write tools); ``bash`` is not covered.
+    """
+    try:
+        locks = _file_locks.setdefault(sandbox, {})
+    except TypeError:
+        locks = _file_locks_by_id.setdefault(id(sandbox), {})
+    return locks.setdefault(os.path.normpath(path), asyncio.Lock())
+
+
 # ── Public text helpers ─────────────────────────────────────────────────────
 
 async def download_text(sandbox: Any, path: str, encoding: str = "utf-8") -> str:
@@ -61,13 +83,15 @@ async def upload_text(
 ) -> None:
     """Write text content to a file in the sandbox.
 
-    Goes through ``sandbox.upload_bytes`` (the exec-agent's ``/files``
-    endpoint), so no shell and no ``base64`` binary are involved and the
-    path needs no quoting. Parent directories are not created.
+    Uses ``check_run`` with a base64-encoded payload so binary-safe
+    transfer works without depending on ``sandbox.upload`` (which expects
+    a local-FS path, not in-memory bytes).
     """
     if ensure_trailing_newline and not content.endswith("\n"):
         content = content + "\n"
-    await sandbox.upload_bytes(content.encode("utf-8"), path)
+    encoded = base64.b64encode(content.encode("utf-8")).decode("ascii")
+    # Quote the destination; the base64 payload is [A-Za-z0-9+/=] and needs none.
+    await sandbox.check_run(f"echo '{encoded}' | base64 -d > {shlex.quote(path)}")
 
 
 # ── Workspace rooting ───────────────────────────────────────────────────────
@@ -233,6 +257,17 @@ async def _write_impl(
     content: str,
     *,
     root: Optional[str],
+) -> ToolOutput:
+    async with file_lock(sandbox, _rooted(file_path, root)):
+        return await _write_unlocked(sandbox, file_path, content, root=root)
+
+
+async def _write_unlocked(
+    sandbox: Any,
+    file_path: str,
+    content: str,
+    *,
+    root: Optional[str],
 ) -> ToolOutput:
     try:
         file_path = _rooted(file_path, root)
@@ -257,6 +292,19 @@ async def _edit_impl(
     replace_all: bool,
     *,
     root: Optional[str],
+) -> ToolOutput:
+    async with file_lock(sandbox, _rooted(file_path, root)):
+        return await _edit_unlocked(sandbox, file_path, old_string, new_string, replace_all, root=root)
+
+
+async def _edit_unlocked(
+    sandbox: Any,
+    file_path: str,
+    old_string: str,
+    new_string: str,
+    replace_all: bool,
+    *,
+    root: Optional[str],
 ) -> ToolOutput:
     """Strict-uniqueness edit: errors if ``old_string`` is non-unique and ``replace_all=False``.
 
@@ -307,6 +355,17 @@ async def _multi_edit_impl(
     edits: List[Dict[str, Any]],
     *,
     root: Optional[str],
+) -> ToolOutput:
+    async with file_lock(sandbox, _rooted(file_path, root)):
+        return await _multi_edit_unlocked(sandbox, file_path, edits, root=root)
+
+
+async def _multi_edit_unlocked(
+    sandbox: Any,
+    file_path: str,
+    edits: List[Dict[str, Any]],
+    *,
+    root: Optional[str],
 ) -> ToolOutput:
     """Apply a sequence of edits to a file in one round-trip.
 

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/environments/environment.py

@@ -18,23 +18,35 @@ T = TypeVar("T")
 
 logger = _get_logger("openreward.environments")
 
+# A serialised call queued this long suggests a slow tool that should be concurrent=True.
+_SLOW_LOCK_WAIT_S = 30.0
+
 
 @overload
 def tool(fn: Callable[..., Any]) -> Callable[..., Any]: ...
 @overload
-def tool(*, shared: bool = True) -> Callable[[Callable[..., Any]], Callable[..., Any]]: ...
-def tool(fn: Optional[Callable[..., Any]] = None, *, shared: bool = True) -> Callable[..., Any]:
-    if fn is None:
-        # Called with arguments: @tool(shared=False)
-        def wrapper(f: Callable[..., Any]) -> Callable[..., Any]:
-            setattr(f, "_env_tool", True)
-            setattr(f, "_env_tool_shared", shared)
-            return f
-        return wrapper
-    # Called without arguments: @tool
-    setattr(fn, "_env_tool", True)
-    setattr(fn, "_env_tool_shared", True)
-    return fn
+def tool(*, shared: bool = True, concurrent: bool = False) -> Callable[[Callable[..., Any]], Callable[..., Any]]: ...
+def tool(
+    fn: Optional[Callable[..., Any]] = None, *, shared: bool = True, concurrent: bool = False
+) -> Callable[..., Any]:
+    """Declare a method as a tool.
+
+    By default calls to a tool run one at a time per session (one lock per
+    tool, so different tools still overlap), so parallel calls cannot race a
+    grader or an attempt counter, and a call queued behind one that returned
+    ``finished=True`` is refused without running. Tools sharing mutable state
+    need their own lock. Pass
+    ``concurrent=True`` only for tools that never grant reward (shell, file
+    reads, search); those skip the session lock. ``@terminal`` tools cannot
+    be concurrent.
+    """
+    def mark(f: Callable[..., Any]) -> Callable[..., Any]:
+        setattr(f, "_env_tool", True)
+        setattr(f, "_env_tool_shared", shared)
+        setattr(f, "_env_tool_concurrent", concurrent)
+        return f
+    # @tool(...) returns the marker; bare @tool applies it.
+    return mark if fn is None else mark(fn)
 
 
 def terminal(fn: Callable[..., Any]) -> Callable[..., Any]:
@@ -66,6 +78,10 @@ def terminal(fn: Callable[..., Any]) -> Callable[..., Any]:
     return fn
 
 
+def _is_concurrent(fn: Callable[..., Any]) -> bool:
+    return bool(getattr(fn, "_env_tool_concurrent", False)) and not getattr(fn, "_env_tool_terminal", False)
+
+
 def _terminal_arg(name: str, fn: Callable[..., Any]) -> Optional[str]:
     """Return the single input field name of a terminal tool, or None.
 
@@ -110,6 +126,11 @@ def _find_terminal_tool(owner: Any, found: Optional[TerminalToolSpec] = None) ->
                 f"@terminal tool {name!r} is not a valid tool. It must take a single "
                 f"Pydantic model argument and return ToolOutput."
             )
+        if getattr(fn, "_env_tool_concurrent", False):
+            raise ValueError(
+                f"@terminal tool {name!r} is marked concurrent=True. A terminal "
+                f"tool grades the episode, so it must run serialised."
+            )
         if found is not None:
             raise ValueError(
                 f"Multiple @terminal tools defined: {found.name!r} and {name!r}. "
@@ -140,6 +161,13 @@ class Environment(ABC):
     file.
     """
     toolsets: ClassVar[Sequence[type]] = ()
+    # Set once any tool returns finished=True. From then on the episode is
+    # over and `_invoke_tool_fn` refuses every call on this instance (one
+    # instance per session). A class-level default so subclasses that skip
+    # `super().__init__` still get the latch.
+    _episode_finished: bool = False
+    # Per-tool locks serialising non-concurrent calls; created lazily for the same reason.
+    _tool_locks: Optional[dict[str, asyncio.Lock]] = None
 
     def __init__(self, task_spec: JSONObject = {}, secrets: dict[str, str] = {}) -> None:
         self.task_spec = task_spec
@@ -490,6 +518,28 @@ class Environment(ABC):
         start: float,
     ) -> RunToolOutput:
         """Validate input against the tool's Pydantic model and invoke it."""
+        if self._episode_finished:
+            return self._episode_finished_error(name)
+        if _is_concurrent(fn):
+            return await self._run_tool_fn(name, fn, input, start)
+        if self._tool_locks is None:
+            self._tool_locks = {}
+        async with self._tool_locks.setdefault(name, asyncio.Lock()):
+            waited = time.monotonic() - start
+            if waited > _SLOW_LOCK_WAIT_S:
+                logger.warning("tool_call_waited_for_tool_lock", tool=name, waited_s=round(waited, 1))
+            # The call we queued behind may have ended the episode.
+            if self._episode_finished:
+                return self._episode_finished_error(name)
+            return await self._run_tool_fn(name, fn, input, start)
+
+    async def _run_tool_fn(
+        self,
+        name: str,
+        fn: Callable[..., Any],
+        input: JSONObject,
+        start: float,
+    ) -> RunToolOutput:
         _, hints, params = _introspect_tool(fn)
         try:
             if not params:
@@ -513,10 +563,27 @@ class Environment(ABC):
         if not isinstance(res, ToolOutput):
             raise TypeError(f"{name!r} returned {type(res).__name__}; expected ToolOutput")
 
+        # A concurrent call on this session finished the episode while this
+        # one ran: the first finished=True wins, so this result is discarded
+        # rather than handed back as a second grade.
+        if self._episode_finished:
+            return self._episode_finished_error(name)
+        if res.finished:
+            self._episode_finished = True
+
         duration_ms = (time.monotonic() - start) * 1000
         logger.info("tool_call_completed", tool=name, duration_ms=duration_ms)
         return RunToolOutput(RunToolSuccess(output=res))
 
+    @staticmethod
+    def _episode_finished_error(name: str) -> RunToolOutput:
+        logger.warning("tool_call_after_episode_finished", tool=name)
+        return RunToolOutput(RunToolError(
+            reason="episode_finished",
+            error=f"{name!r} was not run: the episode has finished (a tool "
+                  f"returned finished=True), so no further tool calls are accepted.",
+        ))
+
     @classmethod
     def name(cls) -> str:
         return cls.__name__

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/environments/server.py

@@ -631,7 +631,8 @@ class Server:
                     raise
                 if isinstance(res.root, RunToolError):
                     # Framework populates reason for the three malformed-call
-                    # cases (not_found / name_collision / input_validation).
+                    # cases (not_found / name_collision / input_validation) and
+                    # for calls refused after the episode finished.
                     status = res.root.reason or "input_validation"
                 else:
                     status = "success"

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/environments/types.py

@@ -118,7 +118,7 @@ class RunToolSuccess(BaseModel, extra="forbid"):
     ok: Literal[True] = True
     output: ToolOutput
 
-RunToolErrorReason = Literal["not_found", "name_collision", "input_validation"]
+RunToolErrorReason = Literal["not_found", "name_collision", "input_validation", "episode_finished"]
 
 
 class RunToolError(BaseModel, extra="forbid"):

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/templates/sandbox/sandbox_env.py

@@ -44,7 +44,7 @@ class SandboxEnv(Environment):
     async def teardown(self) -> None:
         await self.sandbox.stop()
 
-    @tool
+    @tool(concurrent=True)
     async def bash(self, params: BashParams) -> ToolOutput:
         """Executes a bash command in the environment."""
 

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/toolsets/backsearch.py

@@ -124,7 +124,7 @@ class BackSearchToolset(Toolset):
         """
         return resolve_as_of(self.env, self._pinned_as_of)
 
-    @tool
+    @tool(concurrent=True)
     async def web_search(self, params: WebSearchParams) -> ToolOutput:
         result = await run_search(
             query=params.query,
@@ -135,7 +135,7 @@ class BackSearchToolset(Toolset):
         )
         return _to_tool_output(result)
 
-    @tool
+    @tool(concurrent=True)
     async def web_fetch(self, params: WebFetchParams) -> ToolOutput:
         result = await run_fetch(
             url=params.url,

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/toolsets/claude_code.py

@@ -207,31 +207,31 @@ class ClaudeCodeToolset(Toolset):
     # root=None throughout: the tool prompt tells the agent to use absolute
     # paths and avoid `cd`, so paths arrive already resolved.
 
-    @tool
+    @tool(concurrent=True)
     async def bash(self, params: BashParams) -> ToolOutput:
         return await _bash_impl(self.sandbox, params.command, root=None)
 
-    @tool
+    @tool(concurrent=True)
     async def glob(self, params: GlobParams) -> ToolOutput:
         return await _glob_impl(self.sandbox, params.pattern, params.path, root=None)
 
-    @tool
+    @tool(concurrent=True)
     async def grep(self, params: GrepParams) -> ToolOutput:
         return await _grep_impl(
             self.sandbox, params.pattern, params.path, params.glob, root=None
         )
 
-    @tool
+    @tool(concurrent=True)
     async def read(self, params: ReadParams) -> ToolOutput:
         return await _read_impl(
             self.sandbox, params.file_path, params.offset, params.limit, root=None
         )
 
-    @tool
+    @tool(concurrent=True)
     async def write(self, params: WriteParams) -> ToolOutput:
         return await _write_impl(self.sandbox, params.file_path, params.content, root=None)
 
-    @tool
+    @tool(concurrent=True)
     async def edit(self, params: EditParams) -> ToolOutput:
         return await _edit_impl(
             self.sandbox,
@@ -242,7 +242,7 @@ class ClaudeCodeToolset(Toolset):
             root=None,
         )
 
-    @tool
+    @tool(concurrent=True)
     def todo_write(self, params: TodoWriteParams) -> ToolOutput:
         try:
             self.todos = params.todos

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/toolsets/cli.py

@@ -141,45 +141,45 @@ class CLIToolset(Toolset):
             root = getattr(env, "workspace_root", None) or type(self).root
         self.root = root
 
-    @tool
+    @tool(concurrent=True)
     async def bash(self, params: BashParams) -> ToolOutput:
         """Execute a bash command in the sandbox."""
         return await _bash_impl(
             self.sandbox, params.command, params.timeout, root=self.root
         )
 
-    @tool
+    @tool(concurrent=True)
     async def glob(self, params: GlobParams) -> ToolOutput:
         """Find files matching a glob pattern."""
         return await _glob_impl(self.sandbox, params.pattern, params.path, root=self.root)
 
-    @tool
+    @tool(concurrent=True)
     async def grep(self, params: GrepParams) -> ToolOutput:
         """Recursively search file contents for a pattern."""
         return await _grep_impl(
             self.sandbox, params.pattern, params.path, params.include, root=self.root
         )
 
-    @tool
+    @tool(concurrent=True)
     async def ls(self, params: LSParams) -> ToolOutput:
         """List directory contents (``ls -la``)."""
         return await _ls_impl(self.sandbox, params.path, root=self.root)
 
-    @tool
+    @tool(concurrent=True)
     async def read(self, params: ReadParams) -> ToolOutput:
         """Read a file with optional line-range slicing; output has ``cat -n`` line numbers."""
         return await _read_impl(
             self.sandbox, params.file_path, params.offset, params.limit, root=self.root
         )
 
-    @tool
+    @tool(concurrent=True)
     async def write(self, params: WriteParams) -> ToolOutput:
         """Write content to a file, creating parent directories as needed."""
         return await _write_impl(
             self.sandbox, params.file_path, params.content, root=self.root
         )
 
-    @tool
+    @tool(concurrent=True)
     async def edit(self, params: EditParams) -> ToolOutput:
         """Exact-string replace in a file.
 
@@ -195,14 +195,14 @@ class CLIToolset(Toolset):
             root=self.root,
         )
 
-    @tool
+    @tool(concurrent=True)
     async def multi_edit(self, params: MultiEditParams) -> ToolOutput:
         """Apply a sequence of edits to a single file atomically (in-memory)."""
         return await _multi_edit_impl(
             self.sandbox, params.file_path, params.edits, root=self.root
         )
 
-    @tool
+    @tool(concurrent=True)
     async def todo_write(self, params: TodoWriteParams) -> ToolOutput:
         """Replace the session todo list and return a formatted view.
 

{openreward-0.1.159.dev2 → openreward-0.1.161.dev0}/openreward/toolsets/codex.py

@@ -45,7 +45,7 @@ class CodexToolset(Toolset):
     def name(cls) -> str:
         return "codex"
 
-    @tool
+    @tool(concurrent=True)
     async def bash(self, params: BashParams) -> ToolOutput:
         try:
             output, code = await self.sandbox.run(params.command.strip())