sbxloop-worker 0.2.0__tar.gz

sbxloop_worker-0.2.0/.gitignore

@@ -0,0 +1,223 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# sbxloop
+.sbxloop/
+.sdxloop/
+packages/sbxloop/src/sbxloop/_vendor/

sbxloop_worker-0.2.0/PKG-INFO

@@ -0,0 +1,33 @@
+Metadata-Version: 2.4
+Name: sbxloop-worker
+Version: 0.2.0
+Summary: In-sandbox worker runtime for sbxloop (protocol models, agent backends, job runner)
+Project-URL: Homepage, https://github.com/brettbergin/sbxloop
+Project-URL: Repository, https://github.com/brettbergin/sbxloop
+Author: Brett Bergin
+License-Expression: MIT
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: pydantic>=2.7
+Provides-Extra: copilot
+Requires-Dist: github-copilot-sdk>=1.0.8; extra == 'copilot'
+Description-Content-Type: text/markdown
+
+# sbxloop-worker
+
+The in-sandbox runtime for [sbxloop](https://github.com/brettbergin/sbxloop):
+shared host/worker protocol models, the job runner (`python -m sbxloop_worker`),
+and agent backends. Install with the `copilot` extra inside agent sandboxes:
+
+```bash
+pip install "sbxloop-worker[copilot]"
+```
+
+You normally never install this directly — the sbxloop host package provisions
+it into sandboxes automatically.

sbxloop_worker-0.2.0/README.md

@@ -0,0 +1,12 @@
+# sbxloop-worker
+
+The in-sandbox runtime for [sbxloop](https://github.com/brettbergin/sbxloop):
+shared host/worker protocol models, the job runner (`python -m sbxloop_worker`),
+and agent backends. Install with the `copilot` extra inside agent sandboxes:
+
+```bash
+pip install "sbxloop-worker[copilot]"
+```
+
+You normally never install this directly — the sbxloop host package provisions
+it into sandboxes automatically.

sbxloop_worker-0.2.0/pyproject.toml

@@ -0,0 +1,32 @@
+[project]
+name = "sbxloop-worker"
+version = "0.2.0"
+description = "In-sandbox worker runtime for sbxloop (protocol models, agent backends, job runner)"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+authors = [{ name = "Brett Bergin" }]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Typing :: Typed",
+]
+dependencies = ["pydantic>=2.7"]
+
+[project.optional-dependencies]
+copilot = ["github-copilot-sdk>=1.0.8"]
+
+[project.urls]
+Homepage = "https://github.com/brettbergin/sbxloop"
+Repository = "https://github.com/brettbergin/sbxloop"
+
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/sbxloop_worker"]

sbxloop_worker-0.2.0/src/sbxloop_worker/__init__.py

@@ -0,0 +1,10 @@
+"""sbxloop-worker — the in-sandbox runtime for sbxloop.
+
+Runs inside a Docker Sandbox microVM. Hosts the shared host/worker protocol
+models, the agent backends (GitHub Copilot SDK), and the job runner invoked
+via ``python -m sbxloop_worker``.
+"""
+
+__version__ = "0.2.0"
+
+__all__ = ["__version__"]

sbxloop_worker-0.2.0/src/sbxloop_worker/__main__.py

@@ -0,0 +1,93 @@
+"""Worker entry point: ``python -m sbxloop_worker run --job J --events E --result R``.
+
+Exit codes: 0 when a result file was written (including error/timeout
+results — the result file is the outcome channel); 64 for usage errors;
+70 when the result could not be produced at all.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import shlex
+import sys
+from pathlib import Path
+
+from sbxloop_worker.protocol import JobRequest
+from sbxloop_worker.runner import JobRunner
+
+DEFAULT_ENV_FILE = Path.home() / ".sbxloop" / "env.sh"
+# sbx documents this file as the place persistent sandbox env lives; load
+# it too so secrets reach the worker even outside login-shell contexts.
+PERSISTENT_ENV_FILE = Path("/etc/sandbox-persistent.sh")
+
+_EXPORT_RE = re.compile(r"^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$")
+
+
+def load_env_file(path: Path) -> dict[str, str]:
+    """Parse ``export KEY=VALUE`` lines (shell-quoted values supported).
+
+    Used by the plain-env secret strategy: the provisioner writes tokens to
+    ``~/.sbxloop/env.sh`` and the worker loads them at startup. Existing
+    process environment always wins.
+    """
+    loaded: dict[str, str] = {}
+    if not path.is_file():
+        return loaded
+    for line in path.read_text().splitlines():
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        match = _EXPORT_RE.match(line)
+        if not match:
+            continue
+        key, raw = match.groups()
+        try:
+            parts = shlex.split(raw)
+        except ValueError:
+            continue
+        loaded[key] = parts[0] if parts else ""
+    return loaded
+
+
+def apply_env_file(path: Path) -> None:
+    for key, value in load_env_file(path).items():
+        os.environ.setdefault(key, value)
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="sbxloop_worker")
+    sub = parser.add_subparsers(dest="command", required=True)
+    run = sub.add_parser("run", help="run one job")
+    run.add_argument("--job", required=True, type=Path)
+    run.add_argument("--events", required=True, type=Path)
+    run.add_argument("--result", required=True, type=Path)
+    run.add_argument("--heartbeat", type=float, default=15.0)
+    run.add_argument("--env-file", type=Path, default=DEFAULT_ENV_FILE)
+    args = parser.parse_args(argv)
+
+    apply_env_file(args.env_file)
+    apply_env_file(PERSISTENT_ENV_FILE)
+
+    try:
+        job = JobRequest.model_validate_json(args.job.read_text())
+    except (OSError, ValueError) as exc:
+        print(f"sbxloop_worker: invalid job file {args.job}: {exc}", file=sys.stderr)
+        return 64
+
+    try:
+        JobRunner(
+            job,
+            events_path=args.events,
+            result_path=args.result,
+            heartbeat_s=args.heartbeat,
+        ).run()
+    except BaseException as exc:
+        print(f"sbxloop_worker: fatal: {exc}", file=sys.stderr)
+        return 70
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

sbxloop_worker-0.2.0/src/sbxloop_worker/_json.py

@@ -0,0 +1,29 @@
+"""Extraction of structured JSON from agent output text."""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Any
+
+_FENCE_RE = re.compile(r"```(?:json)?\s*\n(.*?)```", re.DOTALL)
+
+
+def extract_json(text: str) -> dict[str, Any] | list[Any] | None:
+    """Pull a JSON object/array out of agent output.
+
+    Preference order: the last fenced ``json`` block (agents often narrate
+    before the final answer), then the whole text. Returns None when nothing
+    parses to a dict or list.
+    """
+    candidates = [match.group(1) for match in _FENCE_RE.finditer(text)]
+    candidates.reverse()
+    candidates.append(text)
+    for candidate in candidates:
+        try:
+            value = json.loads(candidate.strip())
+        except json.JSONDecodeError:
+            continue
+        if isinstance(value, dict | list):
+            return value
+    return None

sbxloop_worker-0.2.0/src/sbxloop_worker/backends/__init__.py

@@ -0,0 +1,48 @@
+"""Agent backends: the pluggable engine that runs one agent session."""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Callable
+from dataclasses import dataclass, field
+from typing import Any, Protocol
+
+from sbxloop_worker.protocol import Event, JobRequest, Usage
+
+# emit("agent.message", content="...") -> Event
+EmitFn = Callable[..., Event]
+
+BACKEND_ENV = "SBXLOOP_WORKER_BACKEND"
+
+
+class BackendUnavailableError(RuntimeError):
+    """The requested backend cannot run in this environment."""
+
+
+@dataclass
+class BackendResult:
+    output_text: str = ""
+    output_json: dict[str, Any] | list[Any] | None = None
+    session_id: str | None = None
+    usage: Usage | None = None
+    artifacts: list[str] = field(default_factory=list)
+
+
+class AgentBackend(Protocol):
+    name: str
+
+    def run_session(self, job: JobRequest, emit: EmitFn) -> BackendResult: ...
+
+
+def get_backend(name: str | None = None) -> AgentBackend:
+    """Resolve a backend by name (default: $SBXLOOP_WORKER_BACKEND or copilot)."""
+    resolved = name or os.environ.get(BACKEND_ENV) or "copilot"
+    if resolved == "echo":
+        from sbxloop_worker.backends.echo import EchoBackend
+
+        return EchoBackend()
+    if resolved == "copilot":
+        from sbxloop_worker.backends.copilot import CopilotBackend
+
+        return CopilotBackend()
+    raise BackendUnavailableError(f"unknown agent backend {resolved!r}")

sbxloop_worker-0.2.0/src/sbxloop_worker/backends/copilot.py

@@ -0,0 +1,183 @@
+"""GitHub Copilot SDK backend.
+
+Runs one agentic session inside the sandbox via the ``github-copilot-sdk``
+package (installed with the ``[copilot]`` extra; wheels bundle the Copilot
+CLI runtime). Imports are deferred so the worker package works without the
+SDK for shell/github jobs and for test environments.
+
+Auth: the SDK auto-detects ``COPILOT_GITHUB_TOKEN``, which the sbxloop
+provisioner injects into the agent sandbox (proxy-bound to the Copilot API
+hosts under the default secret strategy).
+
+This module is exercised by the real-sbx e2e workflow rather than unit
+tests (it needs the SDK runtime + a Copilot subscription), and is excluded
+from unit coverage accordingly.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+from typing import Any
+
+from sbxloop_worker._json import extract_json
+from sbxloop_worker.backends import BackendResult, BackendUnavailableError, EmitFn
+from sbxloop_worker.protocol import EventTypes, JobRequest, Usage
+
+READ_ONLY_DENIED_KINDS = {"shell", "write"}
+
+_TOKEN_PREFIXES = ("gho_", "ghu_", "github_pat_")
+
+
+def _auth_diagnostic() -> str:
+    """Describe the COPILOT_GITHUB_TOKEN this process can actually see."""
+    token = os.environ.get("COPILOT_GITHUB_TOKEN", "")
+    if not token:
+        return (
+            "auth diagnostic: COPILOT_GITHUB_TOKEN is NOT set in the worker "
+            "environment - sbx secret injection did not reach this process; "
+            'try secret_strategy="plain-env"'
+        )
+    if token.startswith(_TOKEN_PREFIXES):
+        return (
+            "auth diagnostic: COPILOT_GITHUB_TOKEN is set with a recognized "
+            "format; the failure is likely subscription/permissions "
+            "(the PAT needs the Copilot Requests permission) or network policy"
+        )
+    return (
+        f"auth diagnostic: COPILOT_GITHUB_TOKEN is set but has an unrecognized "
+        f"format ({token[:6]}...) - likely the sbx secret-proxy sentinel. The "
+        "Copilot SDK validates token format client-side and cannot use proxy "
+        'sentinels; set secret_strategy="plain-env" for the agent sandbox'
+    )
+
+
+class CopilotBackend:
+    name = "copilot"
+
+    def run_session(self, job: JobRequest, emit: EmitFn) -> BackendResult:
+        try:
+            import copilot  # noqa: F401
+        except ImportError as exc:
+            raise BackendUnavailableError(
+                "github-copilot-sdk is not installed; install sbxloop-worker[copilot]"
+            ) from exc
+        try:
+            return asyncio.run(self._run(job, emit))
+        except Exception as exc:
+            # Auth failures surface as opaque SDK errors ("Session was not
+            # created with authentication info..."); say what the token
+            # environment actually looks like from inside the sandbox.
+            raise RuntimeError(f"{exc} | {_auth_diagnostic()}") from exc
+
+    async def _run(self, job: JobRequest, emit: EmitFn) -> BackendResult:
+        from copilot import CopilotClient
+
+        usage = Usage()
+        final_text: list[str] = []
+
+        def on_event(event: Any) -> None:
+            nonlocal usage
+            data = getattr(event, "data", None)
+            type_name = type(data).__name__ if data is not None else type(event).__name__
+            if type_name == "AssistantMessageDeltaData":
+                emit(
+                    EventTypes.AGENT_MESSAGE_DELTA,
+                    delta=getattr(data, "delta_content", "") or "",
+                )
+            elif type_name == "AssistantMessageData":
+                content = getattr(data, "content", "") or ""
+                if content:
+                    final_text.append(content)
+                emit(EventTypes.AGENT_MESSAGE, content=content)
+            elif type_name.startswith("ToolExecutionStart"):
+                emit(
+                    EventTypes.AGENT_TOOL_START,
+                    tool=getattr(data, "tool_name", None) or getattr(data, "toolName", None),
+                    tool_call_id=getattr(data, "tool_call_id", None)
+                    or getattr(data, "toolCallId", None),
+                )
+            elif type_name.startswith("ToolExecutionComplete"):
+                emit(
+                    EventTypes.AGENT_TOOL_END,
+                    tool_call_id=getattr(data, "tool_call_id", None)
+                    or getattr(data, "toolCallId", None),
+                    success=getattr(data, "success", None),
+                )
+            elif type_name == "AssistantUsageData":
+                sample = Usage(
+                    model=getattr(data, "model", None),
+                    input_tokens=getattr(data, "input_tokens", None)
+                    or getattr(data, "inputTokens", None),
+                    output_tokens=getattr(data, "output_tokens", None)
+                    or getattr(data, "outputTokens", None),
+                )
+                usage = usage.merged(sample)
+                emit(EventTypes.AGENT_USAGE, **sample.model_dump(exclude_none=True))
+
+        async with CopilotClient() as client:
+            session = await self._open_session(client, job)
+            try:
+                session.on(on_event)
+                assert job.prompt is not None
+                response = await session.send_and_wait(job.prompt, timeout=job.timeout_s)
+                text = self._response_text(response) or "\n".join(final_text)
+                output_json = extract_json(text) if job.expect == "json" else None
+                session_id = getattr(session, "session_id", None) or getattr(session, "id", None)
+                return BackendResult(
+                    output_text=text,
+                    output_json=output_json,
+                    session_id=session_id,
+                    usage=usage if usage != Usage() else None,
+                )
+            finally:
+                await self._close_session(session)
+
+    async def _open_session(self, client: Any, job: JobRequest) -> Any:
+        kwargs: dict[str, Any] = {
+            "on_permission_request": self._permission_handler(job),
+            "streaming": True,
+        }
+        if job.model and job.model != "auto":
+            kwargs["model"] = job.model
+        if job.system_message:
+            kwargs["system_message"] = {"mode": "append", "content": job.system_message}
+        if job.resume_session_id:
+            return await client.resume_session(job.resume_session_id, **kwargs)
+        return await client.create_session(**kwargs)
+
+    def _permission_handler(self, job: JobRequest) -> Any:
+        if job.permission_mode == "auto":
+            # The microVM (network policy + secret proxy) is the security
+            # boundary; inside it the agent runs unattended.
+            from copilot.session import PermissionHandler
+
+            return PermissionHandler.approve_all
+
+        def read_only_handler(request: Any, invocation: Any = None) -> Any:
+            from copilot.rpc import PermissionDecisionApproveOnce, PermissionDecisionReject
+
+            kind = getattr(request, "kind", None)
+            if kind in READ_ONLY_DENIED_KINDS:
+                return PermissionDecisionReject(
+                    feedback="this is a read-only review session; do not modify anything"
+                )
+            return PermissionDecisionApproveOnce()
+
+        return read_only_handler
+
+    @staticmethod
+    def _response_text(response: Any) -> str:
+        data = getattr(response, "data", None)
+        return getattr(data, "content", None) or getattr(response, "content", None) or ""
+
+    @staticmethod
+    async def _close_session(session: Any) -> None:
+        disconnect = getattr(session, "disconnect", None)
+        if disconnect is not None:
+            try:
+                result = disconnect()
+                if asyncio.iscoroutine(result):
+                    await result
+            except Exception:
+                pass