verifiers 0.3.2.dev167__py3-none-any.whl → 0.3.2.dev169__py3-none-any.whl

verifiers/v1/rollout.py

@@ -14,6 +14,7 @@ from verifiers.v1.configs.runtime import NetworkPolicyConfig
 from verifiers.v1.errors import (
     HarnessError,
     RolloutError,
+    SandboxError,
     TaskError,
     ToolsetError,
     boundary,
@@ -52,6 +53,39 @@ class RolloutTimeouts:
     """Timeout (in seconds) for the task + harness metrics + scoring hooks."""
 
 
+_HOME_PROBE = (
+    "home=$(awk -F: -v u=\"$1\" '$1 == u { print $6 }' /etc/passwd); "
+    'echo "$home"; test -n "$home" && test -d "$home"'
+)
+
+
+async def agent_runtime(runtime: Runtime, user: str | None) -> Runtime:
+    """The runtime the harness runs on: `runtime` itself, or a view running as `user`
+    with `HOME` set to its home. `user` must exist with a home directory it can write
+    (task authors ship it in the image), and the view must really run as it, so a
+    runtime ignoring the user never runs the agent as root."""
+    if user is None:
+        return runtime
+    lookup = await runtime.run(["sh", "-c", _HOME_PROBE, "sh", user], {})
+    home = lookup.stdout.strip()
+    if not home:
+        raise TaskError(f"agent_user {user!r} does not exist in the image")
+    if lookup.exit_code != 0:
+        raise TaskError(f"agent_user {user!r} has no home directory ({home})")
+    view = runtime.with_user(user)
+    view = view.with_env({**view.env, "HOME": home})
+    probe = await view.run(["sh", "-c", 'id -un; test -w "$HOME" && echo writable'], {})
+    effective, *rest = probe.stdout.split() or [""]
+    if effective != user:
+        raise SandboxError(
+            f"{type(runtime).__name__} ran as {effective!r} instead of agent_user "
+            f"{user!r}; refusing to run the agent"
+        )
+    if rest != ["writable"]:
+        raise TaskError(f"agent_user {user!r} cannot write its home directory ({home})")
+    return view
+
+
 class Rollout:
     """Manages one rollout's lifecycle (open, step, close)."""
 
@@ -341,7 +375,7 @@ class Rollout:
                     self._harness_session = await self.harness.session(
                         self.ctx,
                         self.trace,
-                        runtime,
+                        await agent_runtime(runtime, harness_data.agent_user),
                         self._endpoint,
                         self._secret,
                         self._urls,

verifiers/v1/runtimes/__init__.py

@@ -25,6 +25,7 @@ from verifiers.v1.runtimes.docker import (
     PodmanRuntime,
     PodmanRuntimeInfo,
 )
+from verifiers.v1.runtimes.e2b import E2BConfig, E2BRuntime, E2BRuntimeInfo
 from verifiers.v1.runtimes.modal import ModalConfig, ModalRuntime, ModalRuntimeInfo
 from verifiers.v1.runtimes.prime import (
     PrimeConfig,
@@ -44,7 +45,8 @@ RuntimeConfig = Annotated[
     | PodmanConfig
     | ApptainerConfig
     | PrimeConfig
-    | ModalConfig,
+    | ModalConfig
+    | E2BConfig,
     Field(discriminator="type"),
 ]
 
@@ -54,7 +56,8 @@ RuntimeInfo = Annotated[
     | PodmanRuntimeInfo
     | ApptainerRuntimeInfo
     | PrimeRuntimeInfo
-    | ModalRuntimeInfo,
+    | ModalRuntimeInfo
+    | E2BRuntimeInfo,
     Field(discriminator="type"),
 ]
 
@@ -67,6 +70,7 @@ def _runtime_cls(config: RuntimeConfig) -> type[Runtime]:
         "apptainer": ApptainerRuntime,
         "prime": PrimeRuntime,
         "modal": ModalRuntime,
+        "e2b": E2BRuntime,
     }[config.type]
 
 
@@ -109,6 +113,9 @@ __all__ = [
     "DockerConfig",
     "DockerRuntime",
     "DockerRuntimeInfo",
+    "E2BConfig",
+    "E2BRuntime",
+    "E2BRuntimeInfo",
     "ModalConfig",
     "ModalRuntime",
     "ModalRuntimeInfo",

verifiers/v1/runtimes/base.py

@@ -136,13 +136,16 @@ class BaseRuntimeInfo(BaseConfig):
 
 
 class Runtime(ABC):
-    __slots__ = ("env",)
+    __slots__ = ("env", "user")
 
     is_local: bool = True
     """Whether this runtime exchanges host-local URLs without a public tunnel. True for
     subprocess and the local container runtimes; remote runtimes override to False and
     use a host `Tunnel` inward plus `expose` outward."""
 
+    supports_user: ClassVar[bool] = False
+    """Whether `with_user` can run this runtime's commands as another existing user."""
+
     scripts_dir: ClassVar[str] = "/tmp/vf-scripts"
     """Digest-keyed PEP 723 scripts inside the runtime. Sandboxes own their `/tmp`;
     the host subprocess runtime overrides this with its per-user cache."""
@@ -159,6 +162,8 @@ class Runtime(ABC):
         # Per-run task values live on the runtime rather than its serializable config/info.
         # Explicit process values (model credentials, proxy settings, etc.) override these.
         self.env: dict[str, str] = {}
+        self.user: str | None = None
+        """Existing user this view runs commands as; None uses the runtime's default."""
         self._uv_interpreters: dict[str, str] = {}
         self._uv_script_locks: dict[str, asyncio.Lock] = {}
         self._mcp_sources: set[str] = set()
@@ -215,6 +220,19 @@ class Runtime(ABC):
         runtime.env = dict(env)
         return runtime
 
+    def with_user(self, user: str | None) -> "Runtime":
+        """Share this physical runtime through a view that runs commands as `user`, an
+        existing user in the box (None keeps the default). Only the view runs as `user`:
+        setup, collection, and grading keep using the original runtime."""
+        if user is not None and not self.supports_user:
+            raise ValueError(
+                f"{type(self).__name__} cannot run commands as another user"
+            )
+        runtime = copy.copy(self)
+        runtime.__dict__ = self.__dict__
+        runtime.user = user
+        return runtime
+
     async def alive(self) -> bool:
         """Whether the box still executes anything. Not every runtime raises when
         the box is gone — some surface it as `exec`'s own non-zero result,

verifiers/v1/runtimes/docker/__init__.py

@@ -70,6 +70,7 @@ control.sendmsg([b"listener"], [(socket.SOL_SOCKET, socket.SCM_RIGHTS, array.arr
 
 
 class DockerRuntime(ContainerRuntime):
+    supports_user: ClassVar[bool] = True
     engine: ClassVar[str] = "docker"
     """The CLI binary for the shared OCI container operations."""
     info_cls: ClassVar[type[BaseRuntimeInfo]] = DockerRuntimeInfo
@@ -529,6 +530,7 @@ class DockerRuntime(ContainerRuntime):
             "exec",
             *(("-i",) if stdin else ()),
             *(arg for key, value in env.items() for arg in ("--env", f"{key}={value}")),
+            *(("--user", self.user) if self.user is not None else ()),
             "--workdir",
             self.config.workdir,
             self._container,

verifiers/v1/runtimes/e2b.py

@@ -0,0 +1,711 @@
+"""Remote E2B sandbox runtime.
+
+`expose` (sandbox port -> public URL) uses E2B's built-in port proxy (`get_host`), so a
+host-side harness/framework can reach a tool server hosted in the sandbox. The reverse
+direction (a program in the sandbox reaching a host service) is the shared host-side
+`Tunnel` (interception.tunnel), not the runtime's concern.
+
+Two E2B SDK gaps shape the command plumbing here: every command runs through a login
+shell (``bash -l -c``, so profile output can pollute the streams — fenced by the start
+marker `_command` emits and consumers strip), and command output reaches callbacks as
+UTF-8 text with ``errors="replace"`` (lossy for bytes — `open_process` swaps the
+handle's decoders to latin-1 to recover exact bytes; see `E2BProcess`).
+"""
+
+import asyncio
+import codecs
+import contextlib
+import fcntl
+import hashlib
+import ipaddress
+import json
+import logging
+import os
+import re
+import shlex
+import uuid
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+from pathlib import PurePosixPath
+from typing import ClassVar, Literal
+from urllib.parse import urlsplit
+
+from pydantic import Field, model_validator
+
+from verifiers.v1.configs.runtime import NetworkPolicyConfig
+from verifiers.v1.errors import SandboxError
+from verifiers.v1.runtimes.base import (
+    SERVICE_PORT,
+    BaseRuntimeInfo,
+    ProgramResult,
+    Runtime,
+    RuntimeProcess,
+)
+from verifiers.v1.runtimes.limiters import creation_limiter
+from verifiers.v1.utils.aio import run_shielded
+from verifiers.v1.utils.paths import CACHE_DIR
+from verifiers.v1.utils.scope import run_scope
+
+logger = logging.getLogger(__name__)
+
+_TEMPLATE_SCHEMA = 1
+_TEMPLATE_LOCK_DIR = CACHE_DIR / "e2b-template-locks"
+
+# Run as the image's root like the sibling runtimes; the SDK's default is an
+# unprivileged `user`, which breaks root-only setup steps (package installs, restores).
+_USER = "root"
+
+# `run_program` can reconnect to the same pid without losing its file-backed output, so
+# each wait-stream drop gets its own budget of reconnect attempts (backing off from
+# `_WAIT_RECONNECT_BACKOFF` seconds, doubling per attempt): a rollout that runs for
+# hours may survive any number of drops as long as each one reconnects. Live process
+# streams cannot reconnect safely: E2B does not replay missed bytes.
+_WAIT_RECONNECTS = 4
+_WAIT_RECONNECT_BACKOFF = 0.25
+
+
+def _template_resources(cpu: float, memory: float) -> tuple[int, int]:
+    """Validate and convert the resource units shared with TaskData.resources."""
+    cpu_value = float(cpu)
+    if not cpu_value.is_integer():
+        raise ValueError(f"E2B templates require whole CPU cores, got {cpu_value:g}")
+    cpu_count = int(cpu_value)
+    if cpu_count != 1 and cpu_count % 2:
+        raise ValueError(
+            f"E2B templates require 1 or an even number of CPU cores, got {cpu_count}"
+        )
+
+    memory_mb_value = float(memory) * 1024
+    if not memory_mb_value.is_integer() or int(memory_mb_value) % 2:
+        raise ValueError(
+            "E2B template memory must resolve to an even whole number of MB, "
+            f"got {memory:g} GB ({memory_mb_value:g} MB)"
+        )
+    return cpu_count, int(memory_mb_value)
+
+
+_HOSTNAME = re.compile(
+    r"(?:\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*"
+    r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?",
+    re.IGNORECASE,
+)
+
+
+def _is_address(rule: str) -> bool:
+    try:
+        ipaddress.ip_network(rule, strict=False)
+    except ValueError:
+        return False
+    return True
+
+
+def _validate_egress_rules(allow: list[str], block: list[str]) -> None:
+    """Validate the two selector shapes E2B's network API accepts: allow rules take
+    hostnames (a leading ``*.`` wildcard included), IPs, and CIDRs; deny rules take IPs
+    and CIDRs only."""
+    for rule in block:
+        if not _is_address(rule):
+            raise ValueError(
+                f"E2B block rules must be IP addresses or CIDR blocks, got {rule!r}"
+            )
+    for rule in allow:
+        if not (_is_address(rule) or _HOSTNAME.fullmatch(rule)):
+            raise ValueError(
+                "E2B allow rules must be hostnames, wildcard hostnames, IP addresses, "
+                f"or CIDR blocks (no schemes, ports, or paths), got {rule!r}"
+            )
+
+
+def _egress_update(config: "E2BConfig", routes: list[str] | None) -> dict:
+    """The complete egress policy for `update_network`, which replaces all rules
+    atomically. None restores unrestricted egress for another trusted setup phase;
+    otherwise `routes` (the interception and MCP endpoints) stay reachable alongside
+    the configured allowlist. E2B resolves an `allow_out` entry over a same-host
+    `deny_out` one and requires the deny-everything floor whenever `allow_out` names
+    domains, so an allowlist is expressed as allow + deny-everything and a blocklist
+    as deny only (everything else, framework routes included, stays reachable)."""
+    if routes is None:
+        return {"allow_internet_access": True}
+    if config.allow == ["*"]:
+        return {"deny_out": list(config.block)}
+    hosts = list(
+        dict.fromkeys(
+            host for route in routes if (host := urlsplit(route).hostname) is not None
+        )
+    )
+    entries = list(dict.fromkeys([*hosts, *config.allow]))
+    if not entries:
+        return {"allow_internet_access": False}
+    return {"allow_out": entries, "deny_out": ["0.0.0.0/0"]}
+
+
+class E2BConfig(NetworkPolicyConfig):
+    """Requires an E2B Pro plan: sandboxes are created with E2B's 24-hour maximum
+    lifetime, which the Base plan caps at one hour (the API rejects the request)."""
+
+    type: Literal["e2b"] = "e2b"
+    image: str = "python:3.11-slim"
+    """Public Debian-based Docker image used to build a cached E2B template."""
+    workdir: str | None = None
+    """Working directory override; None uses the task's workdir, or /app."""
+    # TaskData.resources uses these units; non-default runtime config values take precedence.
+    cpu: float = Field(default=2.0, ge=1)
+    """CPU cores. E2B templates require 1 or an even whole number."""
+    memory: float = Field(default=1.0, ge=0.125)
+    """Memory in GB. The converted MB value must be a whole even number."""
+    disk: float = Field(default=5.0, gt=0)
+    """Advisory disk request in GB. E2B template builds have no disk-size knob, so this
+    is accepted (so a task can declare it without a warning) but not enforced."""
+    creates_per_sec: float | None = 1.0
+    """Pace sandbox creation to this many per second, enforced run-wide across every
+    env-server worker process (None/<= 0 disables it). Raise it to your plan's rate."""
+
+    @model_validator(mode="after")
+    def _validate_egress(self) -> "E2BConfig":
+        if self.network_restricted:
+            _validate_egress_rules(
+                [rule for rule in self.allow if rule != "*"],
+                [rule for rule in self.block if rule != "*"],
+            )
+        return self
+
+
+class E2BRuntimeInfo(E2BConfig, BaseRuntimeInfo):
+    template: str | None = None
+
+
+async def _queue_stream(
+    queue: asyncio.Queue[bytes | SandboxError | None],
+) -> AsyncIterator[bytes]:
+    while (chunk := await queue.get()) is not None:
+        if isinstance(chunk, SandboxError):
+            raise chunk
+        yield chunk
+
+
+def _byte_handle(handle):
+    """Make a command handle deliver exact bytes to its callbacks.
+
+    The SDK decodes chunks as UTF-8 with ``errors="replace"`` (lossy for arbitrary
+    bytes) through a per-handle incremental decoder. Swapping it for latin-1 — a 1:1 map
+    of bytes onto U+00–U+FF — lets ``chunk.encode("latin-1")`` recover the bytes. The
+    swap is safe right after the handle is returned: the SDK constructs it after its
+    last await, so no chunk is decoded before the caller runs again.
+
+    TODO(e2b): drop this once the SDK grows a bytes mode for command output; it rides
+    on private attrs the guard can only prove exist, not that chunks still route
+    through them (they do on 2.35.0–2.46.x, hence the ``<3`` pin)."""
+    for name in ("_stdout_decoder", "_stderr_decoder"):
+        if not hasattr(handle, name):
+            raise SandboxError(
+                "e2b SDK command handle no longer exposes its stream decoders; "
+                "cannot deliver byte-accurate process output"
+            )
+        setattr(handle, name, codecs.getincrementaldecoder("latin-1")())
+    return handle
+
+
+class E2BProcess(RuntimeProcess):
+    """Built in two steps: the queues (and their `on_*` callbacks) must exist before
+    `commands.run` is called with them, and the handle only exists after — so construct
+    first, then `attach` the started handle (made byte-exact by `_byte_handle`)."""
+
+    def __init__(self, sandbox, marker: bytes) -> None:
+        self._handle = None
+        self._sandbox = sandbox
+        self._marker = marker
+        # Pre-marker buffer per stream; None once the marker has been consumed.
+        self._prefix: dict[str, bytearray | None] = {
+            "stdout": bytearray(),
+            "stderr": bytearray(),
+        }
+        self._stdout_queue: asyncio.Queue[bytes | SandboxError | None] = asyncio.Queue()
+        self._stderr_queue: asyncio.Queue[bytes | SandboxError | None] = asyncio.Queue()
+        self.stdout = _queue_stream(self._stdout_queue)
+        self.stderr = _queue_stream(self._stderr_queue)
+        self._wait_task: asyncio.Task[int] | None = None
+        self._exit_code: int | None = None
+
+    def _payload(self, stream: str, chunk: str) -> bytes:
+        """Recover the raw bytes of a chunk and drop everything through the marker."""
+        data = chunk.encode("latin-1", errors="replace")
+        pending = self._prefix[stream]
+        if pending is None:
+            return data
+        # Resume the search where the last chunk left off (the marker can straddle
+        # a chunk boundary), so pathological pre-marker noise stays linear to scan.
+        search_from = max(0, len(pending) - len(self._marker) + 1)
+        pending.extend(data)
+        start = pending.find(self._marker, search_from)
+        if start < 0:
+            return b""
+        self._prefix[stream] = None
+        return bytes(pending[start + len(self._marker) :])
+
+    def on_stdout(self, chunk: str) -> None:
+        if data := self._payload("stdout", chunk):
+            self._stdout_queue.put_nowait(data)
+
+    def on_stderr(self, chunk: str) -> None:
+        if data := self._payload("stderr", chunk):
+            self._stderr_queue.put_nowait(data)
+
+    def attach(self, handle) -> None:
+        self._handle = handle
+        self._wait_task = asyncio.create_task(self._wait())
+
+    async def _wait(self) -> int:
+        # Importable here for sure: a live handle means the SDK import in `start` succeeded.
+        from e2b import CommandExitException
+
+        try:
+            self._exit_code = (await self._handle.wait()).exit_code
+        except CommandExitException as e:
+            self._exit_code = e.exit_code
+        except Exception as e:
+            with contextlib.suppress(Exception):
+                await self.kill()
+            error = SandboxError(f"e2b live process connection failed: {e}")
+            self._stdout_queue.put_nowait(error)
+            self._stderr_queue.put_nowait(error)
+            raise error from e
+        finally:
+            # A process that died before printing its marker produced only pre-marker
+            # output — the shell's own diagnosis of why it never started. Flush it so
+            # the failure is debuggable (mirrors run()'s missing-marker fallback).
+            for queue, stream in (
+                (self._stdout_queue, "stdout"),
+                (self._stderr_queue, "stderr"),
+            ):
+                if pending := self._prefix[stream]:
+                    queue.put_nowait(bytes(pending))
+                queue.put_nowait(None)
+        return self._exit_code
+
+    async def write(self, data: bytes) -> None:
+        try:
+            await self._handle.send_stdin(data)
+        except Exception as e:
+            raise SandboxError(f"e2b live process stdin failed: {e}") from e
+
+    async def wait(self) -> int:
+        assert self._wait_task is not None
+        return await asyncio.shield(self._wait_task)
+
+    async def poll(self) -> int | None:
+        if self._wait_task is not None and self._wait_task.done():
+            return self._wait_task.result()
+        return self._exit_code
+
+    async def terminate(self) -> None:
+        await self._signal("TERM")
+
+    async def kill(self) -> None:
+        await self._signal("KILL")
+
+    async def _signal(self, signal: str) -> None:
+        if self._exit_code is not None:
+            return
+        try:
+            await self._sandbox.commands.run(
+                f"kill -{signal} {self._handle.pid}", user=_USER
+            )
+        except Exception as e:
+            if self._exit_code is None:
+                raise SandboxError(f"e2b live process signal failed: {e}") from e
+
+
+@asynccontextmanager
+async def _template_lock(name: str):
+    """Serialize a deterministic template build across this user's worker processes."""
+    _TEMPLATE_LOCK_DIR.mkdir(parents=True, exist_ok=True)
+    fd = os.open(_TEMPLATE_LOCK_DIR / f"{name}.lock", os.O_CREAT | os.O_RDWR, 0o600)
+    try:
+        # Wait without occupying executor threads needed by the lock holder.
+        while True:
+            try:
+                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                break
+            except BlockingIOError:
+                await asyncio.sleep(0.1)
+        yield
+    finally:
+        # Closing releases the lock, including when the task is cancelled.
+        os.close(fd)
+
+
+class E2BRuntime(Runtime):
+    is_local: ClassVar[bool] = False
+
+    def __init__(self, config: E2BConfig, name: str | None = None) -> None:
+        super().__init__(name)
+        self.config = config.model_copy(update={"workdir": config.workdir or "/app"})
+        self.info = E2BRuntimeInfo(**self.config.model_dump())
+        self._sandbox = None
+        # Start marker for `_command`'s login-shell fence; random so no login-shell
+        # output can contain it (see `_command`).
+        self._marker = f"vf-start-{uuid.uuid4().hex}"
+
+    @property
+    def published_port(self) -> int | None:
+        return SERVICE_PORT
+
+    def _template_name(self) -> str:
+        definition = json.dumps(
+            {
+                "schema": _TEMPLATE_SCHEMA,
+                "image": self.config.image,
+                "cpu": self.config.cpu,
+                "memory": self.config.memory,
+            },
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+        digest = hashlib.sha256(definition.encode()).hexdigest()[:24]
+        return f"vf-{digest}"
+
+    async def _ensure_template(self) -> str:
+        from e2b import AsyncTemplate, Template
+
+        # Validated here, not in `__init__`: task-level resources arrive unvalidated
+        # (model_copy) and a bad task should fail its own rollout, like on other providers.
+        cpu_count, memory_mb = _template_resources(self.config.cpu, self.config.memory)
+        name = self._template_name()
+        async with _template_lock(name):
+            # An alias is registered before its build finishes; an explicit tag
+            # exists only when it resolves to a ready build.
+            if not await AsyncTemplate.exists(f"{name}:default"):
+                logger.info(
+                    "e2b: building template %s from image %s", name, self.config.image
+                )
+                template = Template().from_image(self.config.image)
+                await AsyncTemplate.build(
+                    template,
+                    name,
+                    cpu_count=cpu_count,
+                    memory_mb=memory_mb,
+                )
+        return name
+
+    async def start(self) -> None:
+        try:
+            from e2b import AsyncSandbox
+        except ModuleNotFoundError as e:
+            raise ModuleNotFoundError(
+                "E2BRuntime requires the E2B SDK; install `verifiers[e2b]`."
+            ) from e
+
+        try:
+            template = await self._ensure_template()
+            self.info.template = template
+
+            async def _create() -> None:
+                async with (
+                    creation_limiter(
+                        self.config.creates_per_sec, "e2b-sandbox", run_scope()
+                    )
+                    or contextlib.nullcontext()
+                ):
+                    # Created unrestricted: setup (uv installs, task staging) needs open
+                    # egress; `prepare_execution` locks the policy down before the agent.
+                    self._sandbox = await AsyncSandbox.create(
+                        template,
+                        # Maximum lifetime of any sandbox (Pro; Base's 1h cap rejects it).
+                        timeout=24 * 60 * 60,
+                        metadata={"runtime": "verifiers", "name": self.name},
+                    )
+                    # The atexit backstop kills by id, so record it the moment the sandbox
+                    # exists — the cancellation `run_shielded` re-raises can keep the code
+                    # after it from ever running.
+                    self.info.id = self._sandbox.sandbox_id
+
+            # Finish an accepted create request even if the rollout is cancelled so the
+            # surrounding provision_runtime finally can see and kill the sandbox.
+            await run_shielded(_create())
+            logger.info(
+                "e2b: sandbox %s up (image=%s, template=%s)",
+                self.info.id,
+                self.config.image,
+                template,
+            )
+            # The template is workdir-agnostic (one build serves every task workdir);
+            # every command passes `cwd`, so only the directory itself is needed.
+            await self._sandbox.files.make_dir(self.config.workdir, user=_USER)
+        except Exception as e:
+            raise SandboxError(f"e2b sandbox provisioning failed: {e}") from e
+
+    async def prepare_execution(self, routes: list[str] | None) -> None:
+        """Apply the host policy after setup; the update replaces all rules atomically."""
+        if not self.network_restricted:
+            return
+        network = _egress_update(self.config, routes)
+        try:
+            await self._sandbox.update_network(network)
+        except Exception as e:
+            raise SandboxError(f"e2b egress policy failed: {e}") from e
+        logger.info(
+            "e2b: egress policy applied on sandbox %s (%s)", self.info.id, network
+        )
+
+    def _command(
+        self, argv: list[str], env: dict[str, str]
+    ) -> tuple[str, dict[str, str]]:
+        """The wrapped command and its env.
+
+        E2B commands run through a login shell (the SDK hardcodes ``bash -l -c``),
+        which brings two hazards the wrapper fences off: profile initialization can
+        print to stdout/stderr (banners in /etc/profile.d) and it re-derives PATH. The
+        runtime's start marker, printed on both streams right before ``exec``, lets
+        consumers drop everything the shell produced; ``set +x`` comes first so a
+        profile that enabled tracing cannot echo the marker or the exec line to stderr
+        after it. The caller-supplied PATH is restored after initialization so it has
+        the same precedence as on other runtimes."""
+        command_env = self.process_env(env)
+        emit = f"printf %s {shlex.quote(self._marker)}"
+        command = f"{emit}; {emit} >&2; exec {shlex.join(argv)}"
+        if "PATH" in command_env:
+            command_env["VF_RUNTIME_PATH"] = command_env.pop("PATH")
+            command = f'export PATH="$VF_RUNTIME_PATH"; {command}'
+        return f"set +x; {command}", command_env
+
+    def _after_marker(self, text: str) -> str:
+        """Drop login-shell noise: everything through the start marker. Text without
+        the marker (the shell died before ``exec``) passes through whole — it is the
+        diagnosis of why the command never ran."""
+        _, sep, tail = text.partition(self._marker)
+        return tail if sep else text
+
+    async def run(self, argv: list[str], env: dict[str, str]) -> ProgramResult:
+        from e2b import CommandExitException  # importable once `start` succeeded
+
+        command, command_env = self._command(argv, env)
+        try:
+            result = await self._sandbox.commands.run(
+                command,
+                envs=command_env,
+                cwd=self.config.workdir,
+                user=_USER,
+                timeout=0,  # no command deadline; the agent's own timeouts govern
+            )
+        except CommandExitException as e:  # non-zero exit is a result, not a failure
+            result = e
+        except Exception as e:
+            raise SandboxError(f"e2b exec failed: {e}") from e
+        return ProgramResult(
+            result.exit_code,
+            self._after_marker(result.stdout or ""),
+            self._after_marker(result.stderr or ""),
+        )
+
+    async def _finished_status(self, status_path: str) -> str | None:
+        """The wrapper's recorded exit status, or None while the program still runs.
+        Read rather than test existence: the shell truncates the file before printf
+        fills it, so only non-empty content proves the program completed."""
+        try:
+            status = await self._sandbox.files.read(status_path, user=_USER)
+        except Exception:  # noqa: BLE001 - unreadable means "not finished yet"
+            return None
+        return status.strip() or None
+
+    async def _reconnect(self, pid: int, status_path: str, cause: Exception):
+        """Reattach to a durable program's wait stream after it dropped: the handle on
+        success, None once the program is found to have finished (its status file is
+        written) — completion beats a dead stream. Raises after `_WAIT_RECONNECTS`
+        consecutive failures; a drop that reconnects consumes none of a later drop's
+        budget, so a long rollout survives any number of transient drops."""
+        error: Exception = cause
+        for attempt in range(_WAIT_RECONNECTS):
+            await asyncio.sleep(_WAIT_RECONNECT_BACKOFF * 2**attempt)
+            try:
+                return await self._sandbox.commands.connect(pid, timeout=0)
+            except Exception as reconnect_error:  # noqa: BLE001 - re-raised after the loop
+                # The pid may be gone because the program finished during the backoff.
+                if await self._finished_status(status_path) is not None:
+                    return None
+                error = reconnect_error
+        raise SandboxError(
+            f"e2b durable program connection failed: {cause}; reconnect failed: {error}"
+        ) from error
+
+    async def run_program(self, argv: list[str], env: dict[str, str]) -> ProgramResult:
+        """Run the rollout through a durable E2B process without ever replaying it."""
+        from e2b import CommandExitException
+
+        prefix = f"/tmp/vf-program-{uuid.uuid4().hex}"
+        stdout_path, stderr_path, status_path = (
+            f"{prefix}.stdout",
+            f"{prefix}.stderr",
+            f"{prefix}.status",
+        )
+        wrapper = (
+            'out=$1; err=$2; status=$3; shift 3; "$@" >"$out" 2>"$err"; '
+            'rc=$?; printf "%s\\n" "$rc" >"$status"; exit 0'
+        )
+        command, command_env = self._command(
+            [
+                "sh",
+                "-c",
+                wrapper,
+                "vf-program",
+                stdout_path,
+                stderr_path,
+                status_path,
+                *argv,
+            ],
+            env,
+        )
+        try:
+            handle = await self._sandbox.commands.run(
+                command,
+                background=True,
+                envs=command_env,
+                cwd=self.config.workdir,
+                user=_USER,
+                stdin=False,
+                timeout=0,
+            )
+            # The status file, not the wait stream, is the source of truth: on any
+            # stream failure — including a reconnect finding the pid already gone
+            # because the program finished during the backoff — completion wins.
+            status: str | None = None
+            while True:
+                try:
+                    await handle.wait()
+                    break
+                except CommandExitException as e:
+                    # The wrapper always exits 0, so this is the login shell failing
+                    # before it ran (`exec` failure, a profile that exits): as in
+                    # `run`, its exit code and streams are the result.
+                    return ProgramResult(
+                        e.exit_code,
+                        self._after_marker(e.stdout or ""),
+                        self._after_marker(e.stderr or ""),
+                    )
+                except Exception as e:  # noqa: BLE001 - a dropped stream; _reconnect re-raises
+                    status = await self._finished_status(status_path)
+                    if status is not None:
+                        break
+                    handle = await self._reconnect(handle.pid, status_path, e)
+                    if handle is None:  # finished while the stream was down
+                        break
+            stdout, stderr = await asyncio.gather(
+                self._sandbox.files.read(stdout_path, user=_USER),
+                self._sandbox.files.read(stderr_path, user=_USER),
+            )
+            if status is None:
+                status = (
+                    await self._sandbox.files.read(status_path, user=_USER)
+                ).strip()
+            return ProgramResult(int(status), stdout, stderr)
+        except SandboxError:
+            raise
+        except Exception as e:
+            raise SandboxError(f"e2b durable program failed: {e}") from e
+        finally:
+            with contextlib.suppress(Exception):
+                await asyncio.gather(
+                    self._sandbox.files.remove(stdout_path, user=_USER),
+                    self._sandbox.files.remove(stderr_path, user=_USER),
+                    self._sandbox.files.remove(status_path, user=_USER),
+                )
+
+    async def open_process(
+        self, argv: list[str], env: dict[str, str]
+    ) -> RuntimeProcess:
+        command, command_env = self._command(argv, env)
+        process = E2BProcess(self._sandbox, self._marker.encode())
+        try:
+            handle = await self._sandbox.commands.run(
+                command,
+                background=True,
+                envs=command_env,
+                cwd=self.config.workdir,
+                user=_USER,
+                on_stdout=process.on_stdout,
+                on_stderr=process.on_stderr,
+                stdin=True,
+                timeout=0,
+            )
+        except Exception as e:
+            raise SandboxError(f"e2b live process failed to start: {e}") from e
+        try:
+            process.attach(_byte_handle(handle))
+        except SandboxError:
+            with contextlib.suppress(Exception):
+                await handle.kill()
+            raise
+        return process
+
+    async def run_background(
+        self, argv: list[str], env: dict[str, str], log: str
+    ) -> None:
+        inner = f"nohup {shlex.join(argv)} > {shlex.quote(log)} 2>&1 &"
+        result = await self.run(["sh", "-c", inner], env)
+        if result.exit_code != 0:
+            raise SandboxError(f"e2b background launch failed: {result.stderr.strip()}")
+
+    def _abs(self, path: str) -> str:
+        if path.startswith("/"):
+            return path
+        return f"{self.config.workdir.rstrip('/')}/{path}"
+
+    async def _read(self, path: str, max_bytes: int | None = None) -> bytes:
+        if max_bytes is not None:
+            return await super()._read(path, max_bytes)
+        try:
+            return bytes(
+                await self._sandbox.files.read(
+                    self._abs(path), format="bytes", user=_USER
+                )
+            )
+        except Exception as e:
+            raise SandboxError(f"read {path!r}: {e}") from e
+
+    async def write(self, path: str, data: bytes) -> None:
+        target = self._abs(path)
+        try:
+            await self._sandbox.files.make_dir(
+                str(PurePosixPath(target).parent), user=_USER
+            )
+            await self._sandbox.files.write(target, data, user=_USER)
+        except Exception as e:
+            raise SandboxError(f"write {path!r}: {e}") from e
+
+    async def expose(self, port: int) -> str | None:
+        # Publish a server hosted IN the sandbox: E2B proxies every sandbox port at a
+        # public HTTPS URL derived locally from the sandbox id — nothing to declare up
+        # front or tear down.
+        if self._sandbox is None:
+            return None
+        return f"https://{self._sandbox.get_host(port)}"
+
+    def cleanup(self) -> None:
+        # Synchronous atexit backstop (the async API can't run once the loop is gone): kill
+        # the sandbox by id via E2B's sync API so the paid resource isn't left to its
+        # timeout. Idempotent — the async `stop` handles the normal path, and a second kill
+        # is a no-op on E2B's side.
+        if self._sandbox is None or self.info.id is None:
+            return
+        from e2b import Sandbox
+
+        try:
+            Sandbox.kill(self.info.id)
+        except Exception:  # noqa: BLE001 - a later cleanup call may retry
+            return
+        self._sandbox = None
+
+    async def teardown(self) -> None:
+        # Best-effort, idempotent teardown on the normal path: kill the sandbox (the costly
+        # resource) via the async API. Runs via `stop`, shielded from cancellation, so it
+        # fires on success, error, and Ctrl-C. `_sandbox` — the atexit backstop's key — is
+        # consumed only after the kill attempt: if loop death (second Ctrl-C) truncates the
+        # await, the backstop can still kill by id.
+        sandbox = self._sandbox
+        if sandbox is None:
+            return
+        try:
+            await sandbox.kill()
+        except Exception as e:  # noqa: BLE001 - provider teardown is best-effort
+            logger.warning("e2b: failed to kill sandbox %s: %s", self.info.id, e)
+            return
+        self._sandbox = None

verifiers/v1/runtimes/prime.py

@@ -144,6 +144,7 @@ class PrimeProcess(RuntimeProcess):
 
 
 class PrimeRuntime(Runtime):
+    supports_user: ClassVar[bool] = True
     is_local: ClassVar[bool] = False
 
     def __init__(self, config: PrimeConfig, name: str | None = None) -> None:
@@ -292,6 +293,7 @@ class PrimeRuntime(Runtime):
                 shlex.join(argv),
                 working_dir=self.config.workdir,
                 env=self.process_env(env),
+                user=self.user,
             )
             delay = 0.1
             output_retries = 0
@@ -335,6 +337,7 @@ class PrimeRuntime(Runtime):
                 shlex.join(argv),
                 working_dir=self.config.workdir,
                 env=self.process_env(env),
+                user=self.user,
             )
         except Exception as e:
             raise SandboxError(f"prime live process failed to start: {e}") from e
@@ -356,6 +359,7 @@ class PrimeRuntime(Runtime):
                 command,
                 working_dir=self.config.workdir,
                 env=self.process_env(env),
+                user=self.user,
             )
         except Exception as e:
             raise SandboxError(f"prime background launch failed: {e}") from e
@@ -370,6 +374,7 @@ class PrimeRuntime(Runtime):
                     f"head -c {max_bytes} -- {shlex.quote(path)}",
                     working_dir=self.config.workdir,
                     env=self.process_env({}),
+                    user=self.user,
                 )
                 async with contextlib.aclosing(process):
                     with io.BytesIO() as data:

verifiers/v1/task.py

@@ -99,6 +99,10 @@ class TaskData(BaseModel):
     """Optional Docker image to use for the task. Only relevant for tasks that run in a container."""
     workdir: str | None = None
     """Optional working directory to use for the task. Only relevant for tasks that run in a container."""
+    agent_user: str | None = None
+    """Existing user in the task's box that the harness, and so every command the agent
+    runs, executes as. None uses the runtime's default user (usually root). Task setup,
+    harness setup, artifact collection, and grading keep running as the default user."""
 
     skills: list[SkillSource] = Field(default_factory=list)
     """Skill sources installed before the harness's configured skills for this task."""

verifiers/v1/tasksets/harbor/taskset.py

@@ -676,6 +676,7 @@ def parse_task(task_dir: Path, idx: int, harbor_config: HarborConfig) -> HarborD
         prompt=harbor_task.instruction.strip(),
         image=image,
         workdir=environment.workdir,
+        agent_user=None if parsed.agent.user is None else str(parsed.agent.user),
         network_allow=(
             ["*"]
             if network.network_mode == NetworkMode.PUBLIC

{verifiers-0.3.2.dev167.dist-info → verifiers-0.3.2.dev169.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev167
+Version: 0.3.2.dev169
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers
@@ -36,7 +36,7 @@ Requires-Dist: numpy>=2.1.0
 Requires-Dist: openai<3.0.0,>=2.54.0
 Requires-Dist: prime-pydantic-config[toml]>=0.4.3
 Requires-Dist: prime-runs>=0.1.3
-Requires-Dist: prime-sandboxes>=0.3.0
+Requires-Dist: prime-sandboxes>=0.4.1
 Requires-Dist: prime-tunnel>=0.1.8
 Requires-Dist: pydantic>=2.12.3
 Requires-Dist: pyzmq>=27.1.0
@@ -46,6 +46,8 @@ Requires-Dist: tenacity>=8.5.0
 Requires-Dist: tomli-w>=1.0.0
 Requires-Dist: typing-extensions>=4.12.2
 Requires-Dist: uvicorn>=0.52.0
+Provides-Extra: e2b
+Requires-Dist: e2b<3,>=2.35.0; extra == 'e2b'
 Provides-Extra: harbor
 Requires-Dist: harbor==0.21.0; (python_full_version >= '3.12') and extra == 'harbor'
 Provides-Extra: modal

{verifiers-0.3.2.dev167.dist-info → verifiers-0.3.2.dev169.dist-info}/RECORD

@@ -7,11 +7,11 @@ verifiers/v1/errors.py,sha256=nNabzi55J5aHmAmW9UHZVpI7kcBfy4Xcyt4cQthZbM8,5875
 verifiers/v1/graph.py,sha256=LW0pJRxCCOXZa2KwB0edHIIqmRrzLFBDNyEeOFVskl8,41502
 verifiers/v1/harness.py,sha256=AcsCmNHB1UQ75nD7RUawsb65q63NdkcMykD0E6oRDOA,15957
 verifiers/v1/judge.py,sha256=uqn-djkK2_7Q3kOjkDo6ipOvV_HOvuLa9y6AoDjRux8,9618
-verifiers/v1/rollout.py,sha256=WiMCJyAypsR1OaXvzJQx7G-T67v__AnnDNoXotuI_VE,25444
+verifiers/v1/rollout.py,sha256=sx9ilprIu-5zrYH9G4yBWZdqzDdb_ctwLJVItLdTo88,26960
 verifiers/v1/semantic.py,sha256=tX8FYEceuMYauuB3Bc8jLDMS2eR06JjLjTo66R190Fg,4053
 verifiers/v1/session.py,sha256=qVMgKmqkItemR3uYUDAFuDz7huP593kHQbge8FlRba8,28420
 verifiers/v1/state.py,sha256=EckF2bWp-vV4b1jYJ9sLI5xrfGuI5spIgYYwW926toI,595
-verifiers/v1/task.py,sha256=6-Tw0iBLsc4hinvVPl_b2EUX8unAAnxtHMXNSIHXsnU,12886
+verifiers/v1/task.py,sha256=YN_P3912NYbK4VPTPHu6kyYCpeyoyhDVxBbhpjg8AA0,13185
 verifiers/v1/taskset.py,sha256=LE_3ogL7itU2Amk-N20cHkZ7Ev6MznJ0HpC8B1xb4w0,9482
 verifiers/v1/trace.py,sha256=Npc-TrBh-B3H0OvtfA5X31VAlOhfgLDKGdXohqC2uIk,31156
 verifiers/v1/types.py,sha256=-In5plgB3mQLqtRKHC3QDCPDvuruAqVd8WIjKrsGB_I,10578
@@ -140,15 +140,16 @@ verifiers/v1/mcp/__init__.py,sha256=pm8ZWBiL1q1tY4wHvJzM_QrZ9oR8aGm-bIRWiRJsgHI,
 verifiers/v1/mcp/launch.py,sha256=r2j1hxMCZtOOjbOFBCZpt1_Zpo56e83HFMg_4sB_kA4,25916
 verifiers/v1/mcp/server.py,sha256=Jqi8OMT8DnoZegXqM3UNNRzhVnbdrPEwx0DjOJo_K2A,13256
 verifiers/v1/mcp/toolset.py,sha256=G2wzNdEMGLXoQUcrwF0TartJkqokNPI3o7YUOAaaa6U,1007
-verifiers/v1/runtimes/__init__.py,sha256=JQlQ029J14asfYb-UxpENshMyPztWbSL0-ZqSyD6Xtk,3318
+verifiers/v1/runtimes/__init__.py,sha256=zOG9BYsK19VRNqvggqh3f6g1_UGIq7VjIBcK8kDlmnQ,3515
 verifiers/v1/runtimes/apptainer.py,sha256=Ru9QJna_l0goIzg71G-4RU_D-7wZUNz139S5TEvbzog,8211
-verifiers/v1/runtimes/base.py,sha256=GN2vTW3oSYpRcop_DRQYi7X31BG4NrzMrnkNiWSDp64,18160
+verifiers/v1/runtimes/base.py,sha256=2ShKZypScklVl9r0ZgN9LjdZB1e471plTxLyHg7-Tyo,19035
 verifiers/v1/runtimes/container.py,sha256=_hNhGOo1Zvorj7THSj2UrZTkgewySUVJe4Kd777-QnI,12563
+verifiers/v1/runtimes/e2b.py,sha256=yBeocAutsv2l5x-C5IMqrlgBz6Cb-t6vWbX4qTjlztE,30306
 verifiers/v1/runtimes/limiters.py,sha256=rOfQJcMdYcLSKq8AL9O09BfGOLqpYmNgrCxXXNcHLmU,2849
 verifiers/v1/runtimes/modal.py,sha256=ZHA4vtNIZwTV-bnVUlambgc8l34j_ZulvtrwvvkE2Kg,17945
-verifiers/v1/runtimes/prime.py,sha256=PCakstDt-gdEUI0d5xM5dEFgn3yQie0RmVsXnUPkjNQ,19230
+verifiers/v1/runtimes/prime.py,sha256=pkrHMWzBdmkNRBBelnu_fV5LO2kdEQmVlm0G2p7uZEk,19403
 verifiers/v1/runtimes/subprocess.py,sha256=vnGVAI3J7pYmRei4MQ7MN4nb8SglLi70NtVTINMPVvQ,8855
-verifiers/v1/runtimes/docker/__init__.py,sha256=1QJF08StAXanR9XdJfLfjN4Hzy8K-Ge9_prVOv_RT0A,21716
+verifiers/v1/runtimes/docker/__init__.py,sha256=QoFOTMgRjoWD--O25Jsft9eD2vjcrMpJQyhfQXqWraI,21828
 verifiers/v1/runtimes/docker/egress.py,sha256=wtKWTL2_zFidxMR7lDRmfevQlOsl2Iyk88ebdO4Kqqw,24566
 verifiers/v1/serve/__init__.py,sha256=wOKuwfugzmDT4yIniwzCXlf4G6tv6Cg8Kc--WMa38Bs,553
 verifiers/v1/serve/client.py,sha256=E2y2x4qqYveWRWC9VZYQEu19aMEryPWTdXnYzbq5uTA,9829
@@ -161,7 +162,7 @@ verifiers/v1/tasksets/__init__.py,sha256=2ijE3qIlLoUA02g6iysOwWQylyBBQL1GhSpjv8_
 verifiers/v1/tasksets/harbor/__init__.py,sha256=JxThzHFYEkuSfQbVf3pEnjordgdfe4MU-QOsSSbyovU,326
 verifiers/v1/tasksets/harbor/compose.py,sha256=Ab-vpMPFXy7Y7C_82-IRznrlaN3FLEuFDz8w3LDsE-I,14094
 verifiers/v1/tasksets/harbor/env.py,sha256=-U-CeyeuWysXCNHi3cew0XtakUa7TqJVnVzElKtG41w,6356
-verifiers/v1/tasksets/harbor/taskset.py,sha256=IaGeCoH012wcnPmCauk4kgGRdXsDt1qpMnOBKuUkV3Q,36421
+verifiers/v1/tasksets/harbor/taskset.py,sha256=ggz26hWv9XFZAfkzp72vsrQjaXKShO4AOCzrSg2K4ds,36503
 verifiers/v1/tasksets/harbor/toolset.py,sha256=_7HXu-uuvqzhmJ1EX6c3KWLg0g0eRrLjCq1kBsZhIwo,3159
 verifiers/v1/tasksets/nemo_gym/__init__.py,sha256=654gAvG3Wd_Z_nh6mypeKn4s_IIQ0Ge6vcZvxTHC2_E,306
 verifiers/v1/tasksets/nemo_gym/response.py,sha256=EhrsquEP8g0bjzAThGfE6Ypgy86_nVX235NiFYtVDVM,4463
@@ -193,8 +194,8 @@ verifiers/v1/utils/scope.py,sha256=bzUEiWDOVdbj7dXOwGOlzsQ_-Xu0j9NR5TalQB-8TS8,8
 verifiers/v1/utils/score.py,sha256=493yJVMw8teCu9JxapxMFPFzI0hNUqdo0Y2nGW4kckk,6200
 verifiers/v1/utils/trace_store.py,sha256=RsCDonGR-bs-tvEstcppiJm3jFmAdIiG83fA5KtCbAw,2801
 verifiers/v1/utils/version.py,sha256=-obEo_-l9-D8FLef4hYxncOe-uJpxrM1g2Hig_37Sgs,1607
-verifiers-0.3.2.dev167.dist-info/METADATA,sha256=_Pni8Imgl22DFAVEK6sGzXCFAipSjzTx9GTRc3PKwGg,4161
-verifiers-0.3.2.dev167.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-verifiers-0.3.2.dev167.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
-verifiers-0.3.2.dev167.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
-verifiers-0.3.2.dev167.dist-info/RECORD,,
+verifiers-0.3.2.dev169.dist-info/METADATA,sha256=gGCq6PfSW4uT2QFaSSV4A2aFBRZ-J2_jssUE0-jZdpc,4227
+verifiers-0.3.2.dev169.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+verifiers-0.3.2.dev169.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
+verifiers-0.3.2.dev169.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
+verifiers-0.3.2.dev169.dist-info/RECORD,,