verifiers 0.3.2.dev166__py3-none-any.whl → 0.3.2.dev168__py3-none-any.whl

verifiers/v1/graph.py

@@ -90,10 +90,11 @@ class MessageNode(BaseModel):
     tools: list[Tool] = Field(default_factory=list, exclude_if=lambda tools: not tools)
     """Tools rendered into this branch's prompt. Populated only on root nodes."""
     semantic_parents: list[ParentLink] = Field(default_factory=list)
-    """Additional harness-declared parents in the semantic execution graph.
+    """Typed incoming edges from other turns, declared by the harness (for example
+    ``subagent_return`` or ``subagent_cancel``).
 
-    Unlike ``parent``, these links do not imply an exact token prefix and therefore do
-    not affect physical branch construction. A list permits multiple parents of the same
+    They record causal links, not ancestry: unlike ``parent`` they imply no token prefix,
+    do not affect physical branch construction, and may form loops. A list permits multiple parents of the same
     type, supports incremental appends, and preserves their advertised wire order; edge
     application prevents duplicate ``(node, type)`` links.
     """

verifiers/v1/harnesses/rlm/harness.py

@@ -69,7 +69,7 @@ class CompactionConfig(BaseConfig):
 
 class RLMHarnessConfig(HarnessConfig):
     version: str = Field(
-        default="f18f10800f86f13913e19ef930abe5fcde4aa90f", min_length=1
+        default="c38e20b60c90bbf625274d3fde2b2a384f390a66", min_length=1
     )
     """Git ref (branch, tag, or commit) of nano-rlm to install. Must know every
     field this harness puts on the wire, i.e. be at least the default ref."""

verifiers/v1/runtimes/__init__.py

@@ -25,6 +25,7 @@ from verifiers.v1.runtimes.docker import (
     PodmanRuntime,
     PodmanRuntimeInfo,
 )
+from verifiers.v1.runtimes.e2b import E2BConfig, E2BRuntime, E2BRuntimeInfo
 from verifiers.v1.runtimes.modal import ModalConfig, ModalRuntime, ModalRuntimeInfo
 from verifiers.v1.runtimes.prime import (
     PrimeConfig,
@@ -44,7 +45,8 @@ RuntimeConfig = Annotated[
     | PodmanConfig
     | ApptainerConfig
     | PrimeConfig
-    | ModalConfig,
+    | ModalConfig
+    | E2BConfig,
     Field(discriminator="type"),
 ]
 
@@ -54,7 +56,8 @@ RuntimeInfo = Annotated[
     | PodmanRuntimeInfo
     | ApptainerRuntimeInfo
     | PrimeRuntimeInfo
-    | ModalRuntimeInfo,
+    | ModalRuntimeInfo
+    | E2BRuntimeInfo,
     Field(discriminator="type"),
 ]
 
@@ -67,6 +70,7 @@ def _runtime_cls(config: RuntimeConfig) -> type[Runtime]:
         "apptainer": ApptainerRuntime,
         "prime": PrimeRuntime,
         "modal": ModalRuntime,
+        "e2b": E2BRuntime,
     }[config.type]
 
 
@@ -109,6 +113,9 @@ __all__ = [
     "DockerConfig",
     "DockerRuntime",
     "DockerRuntimeInfo",
+    "E2BConfig",
+    "E2BRuntime",
+    "E2BRuntimeInfo",
     "ModalConfig",
     "ModalRuntime",
     "ModalRuntimeInfo",

verifiers/v1/runtimes/e2b.py

@@ -0,0 +1,711 @@
+"""Remote E2B sandbox runtime.
+
+`expose` (sandbox port -> public URL) uses E2B's built-in port proxy (`get_host`), so a
+host-side harness/framework can reach a tool server hosted in the sandbox. The reverse
+direction (a program in the sandbox reaching a host service) is the shared host-side
+`Tunnel` (interception.tunnel), not the runtime's concern.
+
+Two E2B SDK gaps shape the command plumbing here: every command runs through a login
+shell (``bash -l -c``, so profile output can pollute the streams — fenced by the start
+marker `_command` emits and consumers strip), and command output reaches callbacks as
+UTF-8 text with ``errors="replace"`` (lossy for bytes — `open_process` swaps the
+handle's decoders to latin-1 to recover exact bytes; see `E2BProcess`).
+"""
+
+import asyncio
+import codecs
+import contextlib
+import fcntl
+import hashlib
+import ipaddress
+import json
+import logging
+import os
+import re
+import shlex
+import uuid
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+from pathlib import PurePosixPath
+from typing import ClassVar, Literal
+from urllib.parse import urlsplit
+
+from pydantic import Field, model_validator
+
+from verifiers.v1.configs.runtime import NetworkPolicyConfig
+from verifiers.v1.errors import SandboxError
+from verifiers.v1.runtimes.base import (
+    SERVICE_PORT,
+    BaseRuntimeInfo,
+    ProgramResult,
+    Runtime,
+    RuntimeProcess,
+)
+from verifiers.v1.runtimes.limiters import creation_limiter
+from verifiers.v1.utils.aio import run_shielded
+from verifiers.v1.utils.paths import CACHE_DIR
+from verifiers.v1.utils.scope import run_scope
+
+logger = logging.getLogger(__name__)
+
+_TEMPLATE_SCHEMA = 1
+_TEMPLATE_LOCK_DIR = CACHE_DIR / "e2b-template-locks"
+
+# Run as the image's root like the sibling runtimes; the SDK's default is an
+# unprivileged `user`, which breaks root-only setup steps (package installs, restores).
+_USER = "root"
+
+# `run_program` can reconnect to the same pid without losing its file-backed output, so
+# each wait-stream drop gets its own budget of reconnect attempts (backing off from
+# `_WAIT_RECONNECT_BACKOFF` seconds, doubling per attempt): a rollout that runs for
+# hours may survive any number of drops as long as each one reconnects. Live process
+# streams cannot reconnect safely: E2B does not replay missed bytes.
+_WAIT_RECONNECTS = 4
+_WAIT_RECONNECT_BACKOFF = 0.25
+
+
+def _template_resources(cpu: float, memory: float) -> tuple[int, int]:
+    """Validate and convert the resource units shared with TaskData.resources."""
+    cpu_value = float(cpu)
+    if not cpu_value.is_integer():
+        raise ValueError(f"E2B templates require whole CPU cores, got {cpu_value:g}")
+    cpu_count = int(cpu_value)
+    if cpu_count != 1 and cpu_count % 2:
+        raise ValueError(
+            f"E2B templates require 1 or an even number of CPU cores, got {cpu_count}"
+        )
+
+    memory_mb_value = float(memory) * 1024
+    if not memory_mb_value.is_integer() or int(memory_mb_value) % 2:
+        raise ValueError(
+            "E2B template memory must resolve to an even whole number of MB, "
+            f"got {memory:g} GB ({memory_mb_value:g} MB)"
+        )
+    return cpu_count, int(memory_mb_value)
+
+
+_HOSTNAME = re.compile(
+    r"(?:\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*"
+    r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?",
+    re.IGNORECASE,
+)
+
+
+def _is_address(rule: str) -> bool:
+    try:
+        ipaddress.ip_network(rule, strict=False)
+    except ValueError:
+        return False
+    return True
+
+
+def _validate_egress_rules(allow: list[str], block: list[str]) -> None:
+    """Validate the two selector shapes E2B's network API accepts: allow rules take
+    hostnames (a leading ``*.`` wildcard included), IPs, and CIDRs; deny rules take IPs
+    and CIDRs only."""
+    for rule in block:
+        if not _is_address(rule):
+            raise ValueError(
+                f"E2B block rules must be IP addresses or CIDR blocks, got {rule!r}"
+            )
+    for rule in allow:
+        if not (_is_address(rule) or _HOSTNAME.fullmatch(rule)):
+            raise ValueError(
+                "E2B allow rules must be hostnames, wildcard hostnames, IP addresses, "
+                f"or CIDR blocks (no schemes, ports, or paths), got {rule!r}"
+            )
+
+
+def _egress_update(config: "E2BConfig", routes: list[str] | None) -> dict:
+    """The complete egress policy for `update_network`, which replaces all rules
+    atomically. None restores unrestricted egress for another trusted setup phase;
+    otherwise `routes` (the interception and MCP endpoints) stay reachable alongside
+    the configured allowlist. E2B resolves an `allow_out` entry over a same-host
+    `deny_out` one and requires the deny-everything floor whenever `allow_out` names
+    domains, so an allowlist is expressed as allow + deny-everything and a blocklist
+    as deny only (everything else, framework routes included, stays reachable)."""
+    if routes is None:
+        return {"allow_internet_access": True}
+    if config.allow == ["*"]:
+        return {"deny_out": list(config.block)}
+    hosts = list(
+        dict.fromkeys(
+            host for route in routes if (host := urlsplit(route).hostname) is not None
+        )
+    )
+    entries = list(dict.fromkeys([*hosts, *config.allow]))
+    if not entries:
+        return {"allow_internet_access": False}
+    return {"allow_out": entries, "deny_out": ["0.0.0.0/0"]}
+
+
+class E2BConfig(NetworkPolicyConfig):
+    """Requires an E2B Pro plan: sandboxes are created with E2B's 24-hour maximum
+    lifetime, which the Base plan caps at one hour (the API rejects the request)."""
+
+    type: Literal["e2b"] = "e2b"
+    image: str = "python:3.11-slim"
+    """Public Debian-based Docker image used to build a cached E2B template."""
+    workdir: str | None = None
+    """Working directory override; None uses the task's workdir, or /app."""
+    # TaskData.resources uses these units; non-default runtime config values take precedence.
+    cpu: float = Field(default=2.0, ge=1)
+    """CPU cores. E2B templates require 1 or an even whole number."""
+    memory: float = Field(default=1.0, ge=0.125)
+    """Memory in GB. The converted MB value must be a whole even number."""
+    disk: float = Field(default=5.0, gt=0)
+    """Advisory disk request in GB. E2B template builds have no disk-size knob, so this
+    is accepted (so a task can declare it without a warning) but not enforced."""
+    creates_per_sec: float | None = 1.0
+    """Pace sandbox creation to this many per second, enforced run-wide across every
+    env-server worker process (None/<= 0 disables it). Raise it to your plan's rate."""
+
+    @model_validator(mode="after")
+    def _validate_egress(self) -> "E2BConfig":
+        if self.network_restricted:
+            _validate_egress_rules(
+                [rule for rule in self.allow if rule != "*"],
+                [rule for rule in self.block if rule != "*"],
+            )
+        return self
+
+
+class E2BRuntimeInfo(E2BConfig, BaseRuntimeInfo):
+    template: str | None = None
+
+
+async def _queue_stream(
+    queue: asyncio.Queue[bytes | SandboxError | None],
+) -> AsyncIterator[bytes]:
+    while (chunk := await queue.get()) is not None:
+        if isinstance(chunk, SandboxError):
+            raise chunk
+        yield chunk
+
+
+def _byte_handle(handle):
+    """Make a command handle deliver exact bytes to its callbacks.
+
+    The SDK decodes chunks as UTF-8 with ``errors="replace"`` (lossy for arbitrary
+    bytes) through a per-handle incremental decoder. Swapping it for latin-1 — a 1:1 map
+    of bytes onto U+00–U+FF — lets ``chunk.encode("latin-1")`` recover the bytes. The
+    swap is safe right after the handle is returned: the SDK constructs it after its
+    last await, so no chunk is decoded before the caller runs again.
+
+    TODO(e2b): drop this once the SDK grows a bytes mode for command output; it rides
+    on private attrs the guard can only prove exist, not that chunks still route
+    through them (they do on 2.35.0–2.46.x, hence the ``<3`` pin)."""
+    for name in ("_stdout_decoder", "_stderr_decoder"):
+        if not hasattr(handle, name):
+            raise SandboxError(
+                "e2b SDK command handle no longer exposes its stream decoders; "
+                "cannot deliver byte-accurate process output"
+            )
+        setattr(handle, name, codecs.getincrementaldecoder("latin-1")())
+    return handle
+
+
+class E2BProcess(RuntimeProcess):
+    """Built in two steps: the queues (and their `on_*` callbacks) must exist before
+    `commands.run` is called with them, and the handle only exists after — so construct
+    first, then `attach` the started handle (made byte-exact by `_byte_handle`)."""
+
+    def __init__(self, sandbox, marker: bytes) -> None:
+        self._handle = None
+        self._sandbox = sandbox
+        self._marker = marker
+        # Pre-marker buffer per stream; None once the marker has been consumed.
+        self._prefix: dict[str, bytearray | None] = {
+            "stdout": bytearray(),
+            "stderr": bytearray(),
+        }
+        self._stdout_queue: asyncio.Queue[bytes | SandboxError | None] = asyncio.Queue()
+        self._stderr_queue: asyncio.Queue[bytes | SandboxError | None] = asyncio.Queue()
+        self.stdout = _queue_stream(self._stdout_queue)
+        self.stderr = _queue_stream(self._stderr_queue)
+        self._wait_task: asyncio.Task[int] | None = None
+        self._exit_code: int | None = None
+
+    def _payload(self, stream: str, chunk: str) -> bytes:
+        """Recover the raw bytes of a chunk and drop everything through the marker."""
+        data = chunk.encode("latin-1", errors="replace")
+        pending = self._prefix[stream]
+        if pending is None:
+            return data
+        # Resume the search where the last chunk left off (the marker can straddle
+        # a chunk boundary), so pathological pre-marker noise stays linear to scan.
+        search_from = max(0, len(pending) - len(self._marker) + 1)
+        pending.extend(data)
+        start = pending.find(self._marker, search_from)
+        if start < 0:
+            return b""
+        self._prefix[stream] = None
+        return bytes(pending[start + len(self._marker) :])
+
+    def on_stdout(self, chunk: str) -> None:
+        if data := self._payload("stdout", chunk):
+            self._stdout_queue.put_nowait(data)
+
+    def on_stderr(self, chunk: str) -> None:
+        if data := self._payload("stderr", chunk):
+            self._stderr_queue.put_nowait(data)
+
+    def attach(self, handle) -> None:
+        self._handle = handle
+        self._wait_task = asyncio.create_task(self._wait())
+
+    async def _wait(self) -> int:
+        # Importable here for sure: a live handle means the SDK import in `start` succeeded.
+        from e2b import CommandExitException
+
+        try:
+            self._exit_code = (await self._handle.wait()).exit_code
+        except CommandExitException as e:
+            self._exit_code = e.exit_code
+        except Exception as e:
+            with contextlib.suppress(Exception):
+                await self.kill()
+            error = SandboxError(f"e2b live process connection failed: {e}")
+            self._stdout_queue.put_nowait(error)
+            self._stderr_queue.put_nowait(error)
+            raise error from e
+        finally:
+            # A process that died before printing its marker produced only pre-marker
+            # output — the shell's own diagnosis of why it never started. Flush it so
+            # the failure is debuggable (mirrors run()'s missing-marker fallback).
+            for queue, stream in (
+                (self._stdout_queue, "stdout"),
+                (self._stderr_queue, "stderr"),
+            ):
+                if pending := self._prefix[stream]:
+                    queue.put_nowait(bytes(pending))
+                queue.put_nowait(None)
+        return self._exit_code
+
+    async def write(self, data: bytes) -> None:
+        try:
+            await self._handle.send_stdin(data)
+        except Exception as e:
+            raise SandboxError(f"e2b live process stdin failed: {e}") from e
+
+    async def wait(self) -> int:
+        assert self._wait_task is not None
+        return await asyncio.shield(self._wait_task)
+
+    async def poll(self) -> int | None:
+        if self._wait_task is not None and self._wait_task.done():
+            return self._wait_task.result()
+        return self._exit_code
+
+    async def terminate(self) -> None:
+        await self._signal("TERM")
+
+    async def kill(self) -> None:
+        await self._signal("KILL")
+
+    async def _signal(self, signal: str) -> None:
+        if self._exit_code is not None:
+            return
+        try:
+            await self._sandbox.commands.run(
+                f"kill -{signal} {self._handle.pid}", user=_USER
+            )
+        except Exception as e:
+            if self._exit_code is None:
+                raise SandboxError(f"e2b live process signal failed: {e}") from e
+
+
+@asynccontextmanager
+async def _template_lock(name: str):
+    """Serialize a deterministic template build across this user's worker processes."""
+    _TEMPLATE_LOCK_DIR.mkdir(parents=True, exist_ok=True)
+    fd = os.open(_TEMPLATE_LOCK_DIR / f"{name}.lock", os.O_CREAT | os.O_RDWR, 0o600)
+    try:
+        # Wait without occupying executor threads needed by the lock holder.
+        while True:
+            try:
+                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                break
+            except BlockingIOError:
+                await asyncio.sleep(0.1)
+        yield
+    finally:
+        # Closing releases the lock, including when the task is cancelled.
+        os.close(fd)
+
+
+class E2BRuntime(Runtime):
+    is_local: ClassVar[bool] = False
+
+    def __init__(self, config: E2BConfig, name: str | None = None) -> None:
+        super().__init__(name)
+        self.config = config.model_copy(update={"workdir": config.workdir or "/app"})
+        self.info = E2BRuntimeInfo(**self.config.model_dump())
+        self._sandbox = None
+        # Start marker for `_command`'s login-shell fence; random so no login-shell
+        # output can contain it (see `_command`).
+        self._marker = f"vf-start-{uuid.uuid4().hex}"
+
+    @property
+    def published_port(self) -> int | None:
+        return SERVICE_PORT
+
+    def _template_name(self) -> str:
+        definition = json.dumps(
+            {
+                "schema": _TEMPLATE_SCHEMA,
+                "image": self.config.image,
+                "cpu": self.config.cpu,
+                "memory": self.config.memory,
+            },
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+        digest = hashlib.sha256(definition.encode()).hexdigest()[:24]
+        return f"vf-{digest}"
+
+    async def _ensure_template(self) -> str:
+        from e2b import AsyncTemplate, Template
+
+        # Validated here, not in `__init__`: task-level resources arrive unvalidated
+        # (model_copy) and a bad task should fail its own rollout, like on other providers.
+        cpu_count, memory_mb = _template_resources(self.config.cpu, self.config.memory)
+        name = self._template_name()
+        async with _template_lock(name):
+            # An alias is registered before its build finishes; an explicit tag
+            # exists only when it resolves to a ready build.
+            if not await AsyncTemplate.exists(f"{name}:default"):
+                logger.info(
+                    "e2b: building template %s from image %s", name, self.config.image
+                )
+                template = Template().from_image(self.config.image)
+                await AsyncTemplate.build(
+                    template,
+                    name,
+                    cpu_count=cpu_count,
+                    memory_mb=memory_mb,
+                )
+        return name
+
+    async def start(self) -> None:
+        try:
+            from e2b import AsyncSandbox
+        except ModuleNotFoundError as e:
+            raise ModuleNotFoundError(
+                "E2BRuntime requires the E2B SDK; install `verifiers[e2b]`."
+            ) from e
+
+        try:
+            template = await self._ensure_template()
+            self.info.template = template
+
+            async def _create() -> None:
+                async with (
+                    creation_limiter(
+                        self.config.creates_per_sec, "e2b-sandbox", run_scope()
+                    )
+                    or contextlib.nullcontext()
+                ):
+                    # Created unrestricted: setup (uv installs, task staging) needs open
+                    # egress; `prepare_execution` locks the policy down before the agent.
+                    self._sandbox = await AsyncSandbox.create(
+                        template,
+                        # Maximum lifetime of any sandbox (Pro; Base's 1h cap rejects it).
+                        timeout=24 * 60 * 60,
+                        metadata={"runtime": "verifiers", "name": self.name},
+                    )
+                    # The atexit backstop kills by id, so record it the moment the sandbox
+                    # exists — the cancellation `run_shielded` re-raises can keep the code
+                    # after it from ever running.
+                    self.info.id = self._sandbox.sandbox_id
+
+            # Finish an accepted create request even if the rollout is cancelled so the
+            # surrounding provision_runtime finally can see and kill the sandbox.
+            await run_shielded(_create())
+            logger.info(
+                "e2b: sandbox %s up (image=%s, template=%s)",
+                self.info.id,
+                self.config.image,
+                template,
+            )
+            # The template is workdir-agnostic (one build serves every task workdir);
+            # every command passes `cwd`, so only the directory itself is needed.
+            await self._sandbox.files.make_dir(self.config.workdir, user=_USER)
+        except Exception as e:
+            raise SandboxError(f"e2b sandbox provisioning failed: {e}") from e
+
+    async def prepare_execution(self, routes: list[str] | None) -> None:
+        """Apply the host policy after setup; the update replaces all rules atomically."""
+        if not self.network_restricted:
+            return
+        network = _egress_update(self.config, routes)
+        try:
+            await self._sandbox.update_network(network)
+        except Exception as e:
+            raise SandboxError(f"e2b egress policy failed: {e}") from e
+        logger.info(
+            "e2b: egress policy applied on sandbox %s (%s)", self.info.id, network
+        )
+
+    def _command(
+        self, argv: list[str], env: dict[str, str]
+    ) -> tuple[str, dict[str, str]]:
+        """The wrapped command and its env.
+
+        E2B commands run through a login shell (the SDK hardcodes ``bash -l -c``),
+        which brings two hazards the wrapper fences off: profile initialization can
+        print to stdout/stderr (banners in /etc/profile.d) and it re-derives PATH. The
+        runtime's start marker, printed on both streams right before ``exec``, lets
+        consumers drop everything the shell produced; ``set +x`` comes first so a
+        profile that enabled tracing cannot echo the marker or the exec line to stderr
+        after it. The caller-supplied PATH is restored after initialization so it has
+        the same precedence as on other runtimes."""
+        command_env = self.process_env(env)
+        emit = f"printf %s {shlex.quote(self._marker)}"
+        command = f"{emit}; {emit} >&2; exec {shlex.join(argv)}"
+        if "PATH" in command_env:
+            command_env["VF_RUNTIME_PATH"] = command_env.pop("PATH")
+            command = f'export PATH="$VF_RUNTIME_PATH"; {command}'
+        return f"set +x; {command}", command_env
+
+    def _after_marker(self, text: str) -> str:
+        """Drop login-shell noise: everything through the start marker. Text without
+        the marker (the shell died before ``exec``) passes through whole — it is the
+        diagnosis of why the command never ran."""
+        _, sep, tail = text.partition(self._marker)
+        return tail if sep else text
+
+    async def run(self, argv: list[str], env: dict[str, str]) -> ProgramResult:
+        from e2b import CommandExitException  # importable once `start` succeeded
+
+        command, command_env = self._command(argv, env)
+        try:
+            result = await self._sandbox.commands.run(
+                command,
+                envs=command_env,
+                cwd=self.config.workdir,
+                user=_USER,
+                timeout=0,  # no command deadline; the agent's own timeouts govern
+            )
+        except CommandExitException as e:  # non-zero exit is a result, not a failure
+            result = e
+        except Exception as e:
+            raise SandboxError(f"e2b exec failed: {e}") from e
+        return ProgramResult(
+            result.exit_code,
+            self._after_marker(result.stdout or ""),
+            self._after_marker(result.stderr or ""),
+        )
+
+    async def _finished_status(self, status_path: str) -> str | None:
+        """The wrapper's recorded exit status, or None while the program still runs.
+        Read rather than test existence: the shell truncates the file before printf
+        fills it, so only non-empty content proves the program completed."""
+        try:
+            status = await self._sandbox.files.read(status_path, user=_USER)
+        except Exception:  # noqa: BLE001 - unreadable means "not finished yet"
+            return None
+        return status.strip() or None
+
+    async def _reconnect(self, pid: int, status_path: str, cause: Exception):
+        """Reattach to a durable program's wait stream after it dropped: the handle on
+        success, None once the program is found to have finished (its status file is
+        written) — completion beats a dead stream. Raises after `_WAIT_RECONNECTS`
+        consecutive failures; a drop that reconnects consumes none of a later drop's
+        budget, so a long rollout survives any number of transient drops."""
+        error: Exception = cause
+        for attempt in range(_WAIT_RECONNECTS):
+            await asyncio.sleep(_WAIT_RECONNECT_BACKOFF * 2**attempt)
+            try:
+                return await self._sandbox.commands.connect(pid, timeout=0)
+            except Exception as reconnect_error:  # noqa: BLE001 - re-raised after the loop
+                # The pid may be gone because the program finished during the backoff.
+                if await self._finished_status(status_path) is not None:
+                    return None
+                error = reconnect_error
+        raise SandboxError(
+            f"e2b durable program connection failed: {cause}; reconnect failed: {error}"
+        ) from error
+
+    async def run_program(self, argv: list[str], env: dict[str, str]) -> ProgramResult:
+        """Run the rollout through a durable E2B process without ever replaying it."""
+        from e2b import CommandExitException
+
+        prefix = f"/tmp/vf-program-{uuid.uuid4().hex}"
+        stdout_path, stderr_path, status_path = (
+            f"{prefix}.stdout",
+            f"{prefix}.stderr",
+            f"{prefix}.status",
+        )
+        wrapper = (
+            'out=$1; err=$2; status=$3; shift 3; "$@" >"$out" 2>"$err"; '
+            'rc=$?; printf "%s\\n" "$rc" >"$status"; exit 0'
+        )
+        command, command_env = self._command(
+            [
+                "sh",
+                "-c",
+                wrapper,
+                "vf-program",
+                stdout_path,
+                stderr_path,
+                status_path,
+                *argv,
+            ],
+            env,
+        )
+        try:
+            handle = await self._sandbox.commands.run(
+                command,
+                background=True,
+                envs=command_env,
+                cwd=self.config.workdir,
+                user=_USER,
+                stdin=False,
+                timeout=0,
+            )
+            # The status file, not the wait stream, is the source of truth: on any
+            # stream failure — including a reconnect finding the pid already gone
+            # because the program finished during the backoff — completion wins.
+            status: str | None = None
+            while True:
+                try:
+                    await handle.wait()
+                    break
+                except CommandExitException as e:
+                    # The wrapper always exits 0, so this is the login shell failing
+                    # before it ran (`exec` failure, a profile that exits): as in
+                    # `run`, its exit code and streams are the result.
+                    return ProgramResult(
+                        e.exit_code,
+                        self._after_marker(e.stdout or ""),
+                        self._after_marker(e.stderr or ""),
+                    )
+                except Exception as e:  # noqa: BLE001 - a dropped stream; _reconnect re-raises
+                    status = await self._finished_status(status_path)
+                    if status is not None:
+                        break
+                    handle = await self._reconnect(handle.pid, status_path, e)
+                    if handle is None:  # finished while the stream was down
+                        break
+            stdout, stderr = await asyncio.gather(
+                self._sandbox.files.read(stdout_path, user=_USER),
+                self._sandbox.files.read(stderr_path, user=_USER),
+            )
+            if status is None:
+                status = (
+                    await self._sandbox.files.read(status_path, user=_USER)
+                ).strip()
+            return ProgramResult(int(status), stdout, stderr)
+        except SandboxError:
+            raise
+        except Exception as e:
+            raise SandboxError(f"e2b durable program failed: {e}") from e
+        finally:
+            with contextlib.suppress(Exception):
+                await asyncio.gather(
+                    self._sandbox.files.remove(stdout_path, user=_USER),
+                    self._sandbox.files.remove(stderr_path, user=_USER),
+                    self._sandbox.files.remove(status_path, user=_USER),
+                )
+
+    async def open_process(
+        self, argv: list[str], env: dict[str, str]
+    ) -> RuntimeProcess:
+        command, command_env = self._command(argv, env)
+        process = E2BProcess(self._sandbox, self._marker.encode())
+        try:
+            handle = await self._sandbox.commands.run(
+                command,
+                background=True,
+                envs=command_env,
+                cwd=self.config.workdir,
+                user=_USER,
+                on_stdout=process.on_stdout,
+                on_stderr=process.on_stderr,
+                stdin=True,
+                timeout=0,
+            )
+        except Exception as e:
+            raise SandboxError(f"e2b live process failed to start: {e}") from e
+        try:
+            process.attach(_byte_handle(handle))
+        except SandboxError:
+            with contextlib.suppress(Exception):
+                await handle.kill()
+            raise
+        return process
+
+    async def run_background(
+        self, argv: list[str], env: dict[str, str], log: str
+    ) -> None:
+        inner = f"nohup {shlex.join(argv)} > {shlex.quote(log)} 2>&1 &"
+        result = await self.run(["sh", "-c", inner], env)
+        if result.exit_code != 0:
+            raise SandboxError(f"e2b background launch failed: {result.stderr.strip()}")
+
+    def _abs(self, path: str) -> str:
+        if path.startswith("/"):
+            return path
+        return f"{self.config.workdir.rstrip('/')}/{path}"
+
+    async def _read(self, path: str, max_bytes: int | None = None) -> bytes:
+        if max_bytes is not None:
+            return await super()._read(path, max_bytes)
+        try:
+            return bytes(
+                await self._sandbox.files.read(
+                    self._abs(path), format="bytes", user=_USER
+                )
+            )
+        except Exception as e:
+            raise SandboxError(f"read {path!r}: {e}") from e
+
+    async def write(self, path: str, data: bytes) -> None:
+        target = self._abs(path)
+        try:
+            await self._sandbox.files.make_dir(
+                str(PurePosixPath(target).parent), user=_USER
+            )
+            await self._sandbox.files.write(target, data, user=_USER)
+        except Exception as e:
+            raise SandboxError(f"write {path!r}: {e}") from e
+
+    async def expose(self, port: int) -> str | None:
+        # Publish a server hosted IN the sandbox: E2B proxies every sandbox port at a
+        # public HTTPS URL derived locally from the sandbox id — nothing to declare up
+        # front or tear down.
+        if self._sandbox is None:
+            return None
+        return f"https://{self._sandbox.get_host(port)}"
+
+    def cleanup(self) -> None:
+        # Synchronous atexit backstop (the async API can't run once the loop is gone): kill
+        # the sandbox by id via E2B's sync API so the paid resource isn't left to its
+        # timeout. Idempotent — the async `stop` handles the normal path, and a second kill
+        # is a no-op on E2B's side.
+        if self._sandbox is None or self.info.id is None:
+            return
+        from e2b import Sandbox
+
+        try:
+            Sandbox.kill(self.info.id)
+        except Exception:  # noqa: BLE001 - a later cleanup call may retry
+            return
+        self._sandbox = None
+
+    async def teardown(self) -> None:
+        # Best-effort, idempotent teardown on the normal path: kill the sandbox (the costly
+        # resource) via the async API. Runs via `stop`, shielded from cancellation, so it
+        # fires on success, error, and Ctrl-C. `_sandbox` — the atexit backstop's key — is
+        # consumed only after the kill attempt: if loop death (second Ctrl-C) truncates the
+        # await, the backstop can still kill by id.
+        sandbox = self._sandbox
+        if sandbox is None:
+            return
+        try:
+            await sandbox.kill()
+        except Exception as e:  # noqa: BLE001 - provider teardown is best-effort
+            logger.warning("e2b: failed to kill sandbox %s: %s", self.info.id, e)
+            return
+        self._sandbox = None

verifiers/v1/semantic.py

@@ -60,11 +60,14 @@ class ParentLink(BaseModel):
 
 
 class SemanticEdgeSet(BaseModel):
-    """A harness-published set of semantic edges over logical request IDs.
+    """A harness-published list of typed edges between logical request IDs.
+
+    Each edge records that one turn caused or fed another. They are not ancestry, so
+    they may form loops: a cancel can land on the child turn whose report triggered it.
 
     Edge labels are intentionally extensible. Initial harnesses use ``continuation``,
-    ``compaction_attempt``, ``compaction``, ``subagent_call``, and ``subagent_return``;
-    consumers must preserve unknown labels.
+    ``compaction_attempt``, ``compaction``, ``subagent_call``, ``subagent_return``,
+    ``agent_message``, and ``subagent_cancel``; consumers must preserve unknown labels.
     """
 
     model_config = ConfigDict(extra="forbid", strict=True)
@@ -74,8 +77,6 @@ class SemanticEdgeSet(BaseModel):
     @model_validator(mode="after")
     def validate_edges(self) -> SemanticEdgeSet:
         identities: set[tuple[str, str, str]] = set()
-        children: dict[str, list[str]] = {}
-        nodes: set[str] = set()
         for edge in self.edges:
             identity = (
                 edge.source_request_id,
@@ -85,27 +86,6 @@ class SemanticEdgeSet(BaseModel):
             if identity in identities:
                 raise ValueError(f"duplicate semantic edge: {identity!r}")
             identities.add(identity)
-            children.setdefault(edge.source_request_id, []).append(
-                edge.target_request_id
-            )
-            nodes.update((edge.source_request_id, edge.target_request_id))
-
-        indegree = dict.fromkeys(nodes, 0)
-        for targets in children.values():
-            for target in targets:
-                indegree[target] += 1
-
-        stack = [node for node, degree in indegree.items() if degree == 0]
-        visited = 0
-        while stack:
-            node = stack.pop()
-            visited += 1
-            for child in children.get(node, ()):
-                indegree[child] -= 1
-                if indegree[child] == 0:
-                    stack.append(child)
-        if visited != len(nodes):
-            raise ValueError("semantic edge cycle detected")
         return self
 
 

verifiers/v1/trace.py

@@ -568,7 +568,6 @@ class Trace(BaseModel, Generic[DataT, StateT, AgentConfigT]):
 
         resolved_identities: set[tuple[int, int, str]] = set()
         additions: list[tuple[int, ParentLink]] = []
-        pending_parents: dict[int, list[ParentLink]] = {}
         for edge in edge_set.edges:
             endpoints: list[int] = []
             for request_id in (
@@ -592,28 +591,7 @@ class Trace(BaseModel, Generic[DataT, StateT, AgentConfigT]):
             if link in self.nodes[target].semantic_parents:
                 continue
 
-            # Adding source -> target creates a cycle exactly when target is already an
-            # ancestor of source. Walk parent links directly so existing nodes and links
-            # are never rebuilt as cumulative ACP edge sets arrive.
-            stack = [source]
-            visited: set[int] = set()
-            while stack:
-                node_id = stack.pop()
-                if node_id == target:
-                    raise ValueError(
-                        "semantic edges create a cycle in the message graph"
-                    )
-                if node_id in visited:
-                    continue
-                visited.add(node_id)
-                node = self.nodes[node_id]
-                if node.parent is not None:
-                    stack.append(node.parent)
-                stack.extend(parent.node for parent in node.semantic_parents)
-                stack.extend(parent.node for parent in pending_parents.get(node_id, ()))
-
             additions.append((target, link))
-            pending_parents.setdefault(target, []).append(link)
 
         for target, link in additions:
             self.nodes[target].semantic_parents.append(link)

{verifiers-0.3.2.dev166.dist-info → verifiers-0.3.2.dev168.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev166
+Version: 0.3.2.dev168
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers
@@ -46,6 +46,8 @@ Requires-Dist: tenacity>=8.5.0
 Requires-Dist: tomli-w>=1.0.0
 Requires-Dist: typing-extensions>=4.12.2
 Requires-Dist: uvicorn>=0.52.0
+Provides-Extra: e2b
+Requires-Dist: e2b<3,>=2.35.0; extra == 'e2b'
 Provides-Extra: harbor
 Requires-Dist: harbor==0.21.0; (python_full_version >= '3.12') and extra == 'harbor'
 Provides-Extra: modal

{verifiers-0.3.2.dev166.dist-info → verifiers-0.3.2.dev168.dist-info}/RECORD

@@ -4,16 +4,16 @@ verifiers/v1/agent.py,sha256=746LE0HE4DPyxVcgEkAAs8z9qjsR7CQncfKhT1h4jek,32433
 verifiers/v1/env.py,sha256=fxXBjVyi0milYViHt6O0vBK3JdM2TYSOoQpXd0P0rFE,18110
 verifiers/v1/episode.py,sha256=UPtA02aGWA-fY8cJKEuYCMtQVnPN1C0BSN13LggNT8U,5986
 verifiers/v1/errors.py,sha256=nNabzi55J5aHmAmW9UHZVpI7kcBfy4Xcyt4cQthZbM8,5875
-verifiers/v1/graph.py,sha256=4EA1TzUBLf9HycfSifKI5J3XkeJzYjbsszZRVwXSGP0,41420
+verifiers/v1/graph.py,sha256=LW0pJRxCCOXZa2KwB0edHIIqmRrzLFBDNyEeOFVskl8,41502
 verifiers/v1/harness.py,sha256=AcsCmNHB1UQ75nD7RUawsb65q63NdkcMykD0E6oRDOA,15957
 verifiers/v1/judge.py,sha256=uqn-djkK2_7Q3kOjkDo6ipOvV_HOvuLa9y6AoDjRux8,9618
 verifiers/v1/rollout.py,sha256=WiMCJyAypsR1OaXvzJQx7G-T67v__AnnDNoXotuI_VE,25444
-verifiers/v1/semantic.py,sha256=VQ_buw6Ya6QtRoh_fiYI5Avs5RmIQCfWH0H0bQc4aoc,4704
+verifiers/v1/semantic.py,sha256=tX8FYEceuMYauuB3Bc8jLDMS2eR06JjLjTo66R190Fg,4053
 verifiers/v1/session.py,sha256=qVMgKmqkItemR3uYUDAFuDz7huP593kHQbge8FlRba8,28420
 verifiers/v1/state.py,sha256=EckF2bWp-vV4b1jYJ9sLI5xrfGuI5spIgYYwW926toI,595
 verifiers/v1/task.py,sha256=6-Tw0iBLsc4hinvVPl_b2EUX8unAAnxtHMXNSIHXsnU,12886
 verifiers/v1/taskset.py,sha256=LE_3ogL7itU2Amk-N20cHkZ7Ev6MznJ0HpC8B1xb4w0,9482
-verifiers/v1/trace.py,sha256=tgzkft4nKF4QGeGXwoqkfXjaUbG65Nn1oBFzMUFp-u0,32234
+verifiers/v1/trace.py,sha256=Npc-TrBh-B3H0OvtfA5X31VAlOhfgLDKGdXohqC2uIk,31156
 verifiers/v1/types.py,sha256=-In5plgB3mQLqtRKHC3QDCPDvuruAqVd8WIjKrsGB_I,10578
 verifiers/v1/acp/__init__.py,sha256=Omle2zo7aly_7CCg1N9yQjQcJe4UpqTw9xVBP8_tuT8,13891
 verifiers/v1/acp/runner.py,sha256=OrJ1VSWTnNosV8OklqM2YdERlbF7olT9PHEdQfXvgGQ,14137
@@ -113,7 +113,7 @@ verifiers/v1/harnesses/pi/harness.py,sha256=ysKOLSRQnbPkMtwvuUoJU7Hd4uM4bDF1duD0
 verifiers/v1/harnesses/prime_agent/__init__.py,sha256=xfPC4RrlnyYWaf38tPAOZq4YL6M55lMpj5BoRLmaK8I,171
 verifiers/v1/harnesses/prime_agent/harness.py,sha256=Zs_f5H2hQgDzUS4zwArM5UxCYJI5Zo0ELmayn1oBkK0,10663
 verifiers/v1/harnesses/rlm/__init__.py,sha256=hwx51xTdEWzzYgMj-p4ETNcptoub3IPMDbEdJ4uB8Ns,122
-verifiers/v1/harnesses/rlm/harness.py,sha256=NFJ3u1xC06d9NwjnxFD8cCqIXoGjAIwhmJly-hXSvMA,13538
+verifiers/v1/harnesses/rlm/harness.py,sha256=wyK3f1jYYnJniz9SCJBI8j2oUGycU22HdQN6zAf34ME,13538
 verifiers/v1/harnesses/terminus_2/__init__.py,sha256=l1pwfg1HyVDEqT9efdnFWcXqaZwtKwe7TrplkyxZSA0,166
 verifiers/v1/harnesses/terminus_2/harness.py,sha256=cKQJluW01mkxEccTLFwSWsVMavyiwq_w-NA4Hb_JkGU,3052
 verifiers/v1/harnesses/terminus_2/program.py,sha256=X8MZdyItU3gbXGXnGOlJ9LWcUTnqIDaxlhkZvoRiqKY,2703
@@ -140,10 +140,11 @@ verifiers/v1/mcp/__init__.py,sha256=pm8ZWBiL1q1tY4wHvJzM_QrZ9oR8aGm-bIRWiRJsgHI,
 verifiers/v1/mcp/launch.py,sha256=r2j1hxMCZtOOjbOFBCZpt1_Zpo56e83HFMg_4sB_kA4,25916
 verifiers/v1/mcp/server.py,sha256=Jqi8OMT8DnoZegXqM3UNNRzhVnbdrPEwx0DjOJo_K2A,13256
 verifiers/v1/mcp/toolset.py,sha256=G2wzNdEMGLXoQUcrwF0TartJkqokNPI3o7YUOAaaa6U,1007
-verifiers/v1/runtimes/__init__.py,sha256=JQlQ029J14asfYb-UxpENshMyPztWbSL0-ZqSyD6Xtk,3318
+verifiers/v1/runtimes/__init__.py,sha256=zOG9BYsK19VRNqvggqh3f6g1_UGIq7VjIBcK8kDlmnQ,3515
 verifiers/v1/runtimes/apptainer.py,sha256=Ru9QJna_l0goIzg71G-4RU_D-7wZUNz139S5TEvbzog,8211
 verifiers/v1/runtimes/base.py,sha256=GN2vTW3oSYpRcop_DRQYi7X31BG4NrzMrnkNiWSDp64,18160
 verifiers/v1/runtimes/container.py,sha256=_hNhGOo1Zvorj7THSj2UrZTkgewySUVJe4Kd777-QnI,12563
+verifiers/v1/runtimes/e2b.py,sha256=yBeocAutsv2l5x-C5IMqrlgBz6Cb-t6vWbX4qTjlztE,30306
 verifiers/v1/runtimes/limiters.py,sha256=rOfQJcMdYcLSKq8AL9O09BfGOLqpYmNgrCxXXNcHLmU,2849
 verifiers/v1/runtimes/modal.py,sha256=ZHA4vtNIZwTV-bnVUlambgc8l34j_ZulvtrwvvkE2Kg,17945
 verifiers/v1/runtimes/prime.py,sha256=PCakstDt-gdEUI0d5xM5dEFgn3yQie0RmVsXnUPkjNQ,19230
@@ -193,8 +194,8 @@ verifiers/v1/utils/scope.py,sha256=bzUEiWDOVdbj7dXOwGOlzsQ_-Xu0j9NR5TalQB-8TS8,8
 verifiers/v1/utils/score.py,sha256=493yJVMw8teCu9JxapxMFPFzI0hNUqdo0Y2nGW4kckk,6200
 verifiers/v1/utils/trace_store.py,sha256=RsCDonGR-bs-tvEstcppiJm3jFmAdIiG83fA5KtCbAw,2801
 verifiers/v1/utils/version.py,sha256=-obEo_-l9-D8FLef4hYxncOe-uJpxrM1g2Hig_37Sgs,1607
-verifiers-0.3.2.dev166.dist-info/METADATA,sha256=PR5ypxpzJMtmrYgaGC5NjI0RT2i-ArYUhlpYVlfZ_hg,4161
-verifiers-0.3.2.dev166.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-verifiers-0.3.2.dev166.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
-verifiers-0.3.2.dev166.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
-verifiers-0.3.2.dev166.dist-info/RECORD,,
+verifiers-0.3.2.dev168.dist-info/METADATA,sha256=gb78e_KMSGlVaIhDBXpMS56UnLRgcLe5rtTP4aah5Do,4227
+verifiers-0.3.2.dev168.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+verifiers-0.3.2.dev168.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
+verifiers-0.3.2.dev168.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
+verifiers-0.3.2.dev168.dist-info/RECORD,,