verifiers 0.3.2.dev168__py3-none-any.whl → 0.3.2.dev170__py3-none-any.whl

verifiers/v1/rollout.py

@@ -14,6 +14,7 @@ from verifiers.v1.configs.runtime import NetworkPolicyConfig
 from verifiers.v1.errors import (
     HarnessError,
     RolloutError,
+    SandboxError,
     TaskError,
     ToolsetError,
     boundary,
@@ -52,6 +53,39 @@ class RolloutTimeouts:
     """Timeout (in seconds) for the task + harness metrics + scoring hooks."""
 
 
+_HOME_PROBE = (
+    "home=$(awk -F: -v u=\"$1\" '$1 == u { print $6 }' /etc/passwd); "
+    'echo "$home"; test -n "$home" && test -d "$home"'
+)
+
+
+async def agent_runtime(runtime: Runtime, user: str | None) -> Runtime:
+    """The runtime the harness runs on: `runtime` itself, or a view running as `user`
+    with `HOME` set to its home. `user` must exist with a home directory it can write
+    (task authors ship it in the image), and the view must really run as it, so a
+    runtime ignoring the user never runs the agent as root."""
+    if user is None:
+        return runtime
+    lookup = await runtime.run(["sh", "-c", _HOME_PROBE, "sh", user], {})
+    home = lookup.stdout.strip()
+    if not home:
+        raise TaskError(f"agent_user {user!r} does not exist in the image")
+    if lookup.exit_code != 0:
+        raise TaskError(f"agent_user {user!r} has no home directory ({home})")
+    view = runtime.with_user(user)
+    view = view.with_env({**view.env, "HOME": home})
+    probe = await view.run(["sh", "-c", 'id -un; test -w "$HOME" && echo writable'], {})
+    effective, *rest = probe.stdout.split() or [""]
+    if effective != user:
+        raise SandboxError(
+            f"{type(runtime).__name__} ran as {effective!r} instead of agent_user "
+            f"{user!r}; refusing to run the agent"
+        )
+    if rest != ["writable"]:
+        raise TaskError(f"agent_user {user!r} cannot write its home directory ({home})")
+    return view
+
+
 class Rollout:
     """Manages one rollout's lifecycle (open, step, close)."""
 
@@ -341,7 +375,7 @@ class Rollout:
                     self._harness_session = await self.harness.session(
                         self.ctx,
                         self.trace,
-                        runtime,
+                        await agent_runtime(runtime, harness_data.agent_user),
                         self._endpoint,
                         self._secret,
                         self._urls,

verifiers/v1/runtimes/base.py

@@ -136,13 +136,16 @@ class BaseRuntimeInfo(BaseConfig):
 
 
 class Runtime(ABC):
-    __slots__ = ("env",)
+    __slots__ = ("env", "user")
 
     is_local: bool = True
     """Whether this runtime exchanges host-local URLs without a public tunnel. True for
     subprocess and the local container runtimes; remote runtimes override to False and
     use a host `Tunnel` inward plus `expose` outward."""
 
+    supports_user: ClassVar[bool] = False
+    """Whether `with_user` can run this runtime's commands as another existing user."""
+
     scripts_dir: ClassVar[str] = "/tmp/vf-scripts"
     """Digest-keyed PEP 723 scripts inside the runtime. Sandboxes own their `/tmp`;
     the host subprocess runtime overrides this with its per-user cache."""
@@ -159,6 +162,8 @@ class Runtime(ABC):
         # Per-run task values live on the runtime rather than its serializable config/info.
         # Explicit process values (model credentials, proxy settings, etc.) override these.
         self.env: dict[str, str] = {}
+        self.user: str | None = None
+        """Existing user this view runs commands as; None uses the runtime's default."""
         self._uv_interpreters: dict[str, str] = {}
         self._uv_script_locks: dict[str, asyncio.Lock] = {}
         self._mcp_sources: set[str] = set()
@@ -215,6 +220,19 @@ class Runtime(ABC):
         runtime.env = dict(env)
         return runtime
 
+    def with_user(self, user: str | None) -> "Runtime":
+        """Share this physical runtime through a view that runs commands as `user`, an
+        existing user in the box (None keeps the default). Only the view runs as `user`:
+        setup, collection, and grading keep using the original runtime."""
+        if user is not None and not self.supports_user:
+            raise ValueError(
+                f"{type(self).__name__} cannot run commands as another user"
+            )
+        runtime = copy.copy(self)
+        runtime.__dict__ = self.__dict__
+        runtime.user = user
+        return runtime
+
     async def alive(self) -> bool:
         """Whether the box still executes anything. Not every runtime raises when
         the box is gone — some surface it as `exec`'s own non-zero result,

verifiers/v1/runtimes/docker/__init__.py

@@ -70,6 +70,7 @@ control.sendmsg([b"listener"], [(socket.SOL_SOCKET, socket.SCM_RIGHTS, array.arr
 
 
 class DockerRuntime(ContainerRuntime):
+    supports_user: ClassVar[bool] = True
     engine: ClassVar[str] = "docker"
     """The CLI binary for the shared OCI container operations."""
     info_cls: ClassVar[type[BaseRuntimeInfo]] = DockerRuntimeInfo
@@ -529,6 +530,7 @@ class DockerRuntime(ContainerRuntime):
             "exec",
             *(("-i",) if stdin else ()),
             *(arg for key, value in env.items() for arg in ("--env", f"{key}={value}")),
+            *(("--user", self.user) if self.user is not None else ()),
             "--workdir",
             self.config.workdir,
             self._container,

verifiers/v1/runtimes/prime.py

@@ -144,6 +144,7 @@ class PrimeProcess(RuntimeProcess):
 
 
 class PrimeRuntime(Runtime):
+    supports_user: ClassVar[bool] = True
     is_local: ClassVar[bool] = False
 
     def __init__(self, config: PrimeConfig, name: str | None = None) -> None:
@@ -292,6 +293,7 @@ class PrimeRuntime(Runtime):
                 shlex.join(argv),
                 working_dir=self.config.workdir,
                 env=self.process_env(env),
+                user=self.user,
             )
             delay = 0.1
             output_retries = 0
@@ -335,6 +337,7 @@ class PrimeRuntime(Runtime):
                 shlex.join(argv),
                 working_dir=self.config.workdir,
                 env=self.process_env(env),
+                user=self.user,
             )
         except Exception as e:
             raise SandboxError(f"prime live process failed to start: {e}") from e
@@ -356,6 +359,7 @@ class PrimeRuntime(Runtime):
                 command,
                 working_dir=self.config.workdir,
                 env=self.process_env(env),
+                user=self.user,
             )
         except Exception as e:
             raise SandboxError(f"prime background launch failed: {e}") from e
@@ -370,6 +374,7 @@ class PrimeRuntime(Runtime):
                     f"head -c {max_bytes} -- {shlex.quote(path)}",
                     working_dir=self.config.workdir,
                     env=self.process_env({}),
+                    user=self.user,
                 )
                 async with contextlib.aclosing(process):
                     with io.BytesIO() as data:

verifiers/v1/task.py

@@ -99,6 +99,10 @@ class TaskData(BaseModel):
     """Optional Docker image to use for the task. Only relevant for tasks that run in a container."""
     workdir: str | None = None
     """Optional working directory to use for the task. Only relevant for tasks that run in a container."""
+    agent_user: str | None = None
+    """Existing user in the task's box that the harness, and so every command the agent
+    runs, executes as. None uses the runtime's default user (usually root). Task setup,
+    harness setup, artifact collection, and grading keep running as the default user."""
 
     skills: list[SkillSource] = Field(default_factory=list)
     """Skill sources installed before the harness's configured skills for this task."""

verifiers/v1/tasksets/harbor/taskset.py

@@ -676,6 +676,7 @@ def parse_task(task_dir: Path, idx: int, harbor_config: HarborConfig) -> HarborD
         prompt=harbor_task.instruction.strip(),
         image=image,
         workdir=environment.workdir,
+        agent_user=None if parsed.agent.user is None else str(parsed.agent.user),
         network_allow=(
             ["*"]
             if network.network_mode == NetworkMode.PUBLIC

verifiers/v1/utils/artifacts.py

@@ -190,7 +190,17 @@ async def _tar_out(runtime: Runtime, artifact: Artifact, budget: int) -> bytes:
         )
         # The runtime enforces the remaining collection budget while transferring the
         # bytes, so replacing or growing the archive cannot race a separate size probe.
-        return await runtime.read(path, max_bytes=budget)
+        archive, dropped = _drop_special_files(
+            await runtime.read(path, max_bytes=budget)
+        )
+        if dropped:
+            logger.warning(
+                "artifact %r: dropped %d FIFO or device node(s), e.g. %s",
+                artifact.source,
+                len(dropped),
+                dropped[:3],
+            )
+        return archive
     finally:
         # Best-effort: the box is about to be destroyed and the name is unique per call.
         try:
@@ -199,6 +209,32 @@ async def _tar_out(runtime: Runtime, artifact: Artifact, budget: int) -> bytes:
             logger.debug("failed to remove %s", path, exc_info=True)
 
 
+def _drop_special_files(archive: bytes) -> tuple[bytes, list[str]]:
+    """Remove FIFOs and device nodes, plus hard links to them, from a collected archive.
+
+    They carry no content, and `restore` refuses them, so one an agent leaves in its
+    workspace (e.g. a named pipe it made to test streaming input) would otherwise fail
+    the whole restore. Returns the archive and the dropped member names."""
+    with tarfile.open(fileobj=io.BytesIO(archive), mode="r:") as source:
+        members = source.getmembers()
+        special = {m.name for m in members if m.isfifo() or m.ischr() or m.isblk()}
+        if not special:
+            return archive, []
+        dropped = [
+            m.name
+            for m in members
+            if m.name in special or (m.islnk() and m.linkname in special)
+        ]
+        out = io.BytesIO()
+        with tarfile.open(fileobj=out, mode="w:", format=source.format) as target:
+            for member in members:
+                if member.name in dropped:
+                    continue
+                content = source.extractfile(member) if member.isfile() else None
+                target.addfile(member, content)
+    return out.getvalue(), dropped
+
+
 def _validate_restore(root: str, archive: bytes | None) -> None:
     """Reject archive content that could restore outside its declared root."""
     root_path = PurePosixPath(root)

{verifiers-0.3.2.dev168.dist-info → verifiers-0.3.2.dev170.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev168
+Version: 0.3.2.dev170
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers
@@ -36,7 +36,7 @@ Requires-Dist: numpy>=2.1.0
 Requires-Dist: openai<3.0.0,>=2.54.0
 Requires-Dist: prime-pydantic-config[toml]>=0.4.3
 Requires-Dist: prime-runs>=0.1.3
-Requires-Dist: prime-sandboxes>=0.3.0
+Requires-Dist: prime-sandboxes>=0.4.1
 Requires-Dist: prime-tunnel>=0.1.8
 Requires-Dist: pydantic>=2.12.3
 Requires-Dist: pyzmq>=27.1.0

{verifiers-0.3.2.dev168.dist-info → verifiers-0.3.2.dev170.dist-info}/RECORD

@@ -7,11 +7,11 @@ verifiers/v1/errors.py,sha256=nNabzi55J5aHmAmW9UHZVpI7kcBfy4Xcyt4cQthZbM8,5875
 verifiers/v1/graph.py,sha256=LW0pJRxCCOXZa2KwB0edHIIqmRrzLFBDNyEeOFVskl8,41502
 verifiers/v1/harness.py,sha256=AcsCmNHB1UQ75nD7RUawsb65q63NdkcMykD0E6oRDOA,15957
 verifiers/v1/judge.py,sha256=uqn-djkK2_7Q3kOjkDo6ipOvV_HOvuLa9y6AoDjRux8,9618
-verifiers/v1/rollout.py,sha256=WiMCJyAypsR1OaXvzJQx7G-T67v__AnnDNoXotuI_VE,25444
+verifiers/v1/rollout.py,sha256=sx9ilprIu-5zrYH9G4yBWZdqzDdb_ctwLJVItLdTo88,26960
 verifiers/v1/semantic.py,sha256=tX8FYEceuMYauuB3Bc8jLDMS2eR06JjLjTo66R190Fg,4053
 verifiers/v1/session.py,sha256=qVMgKmqkItemR3uYUDAFuDz7huP593kHQbge8FlRba8,28420
 verifiers/v1/state.py,sha256=EckF2bWp-vV4b1jYJ9sLI5xrfGuI5spIgYYwW926toI,595
-verifiers/v1/task.py,sha256=6-Tw0iBLsc4hinvVPl_b2EUX8unAAnxtHMXNSIHXsnU,12886
+verifiers/v1/task.py,sha256=YN_P3912NYbK4VPTPHu6kyYCpeyoyhDVxBbhpjg8AA0,13185
 verifiers/v1/taskset.py,sha256=LE_3ogL7itU2Amk-N20cHkZ7Ev6MznJ0HpC8B1xb4w0,9482
 verifiers/v1/trace.py,sha256=Npc-TrBh-B3H0OvtfA5X31VAlOhfgLDKGdXohqC2uIk,31156
 verifiers/v1/types.py,sha256=-In5plgB3mQLqtRKHC3QDCPDvuruAqVd8WIjKrsGB_I,10578
@@ -142,14 +142,14 @@ verifiers/v1/mcp/server.py,sha256=Jqi8OMT8DnoZegXqM3UNNRzhVnbdrPEwx0DjOJo_K2A,13
 verifiers/v1/mcp/toolset.py,sha256=G2wzNdEMGLXoQUcrwF0TartJkqokNPI3o7YUOAaaa6U,1007
 verifiers/v1/runtimes/__init__.py,sha256=zOG9BYsK19VRNqvggqh3f6g1_UGIq7VjIBcK8kDlmnQ,3515
 verifiers/v1/runtimes/apptainer.py,sha256=Ru9QJna_l0goIzg71G-4RU_D-7wZUNz139S5TEvbzog,8211
-verifiers/v1/runtimes/base.py,sha256=GN2vTW3oSYpRcop_DRQYi7X31BG4NrzMrnkNiWSDp64,18160
+verifiers/v1/runtimes/base.py,sha256=2ShKZypScklVl9r0ZgN9LjdZB1e471plTxLyHg7-Tyo,19035
 verifiers/v1/runtimes/container.py,sha256=_hNhGOo1Zvorj7THSj2UrZTkgewySUVJe4Kd777-QnI,12563
 verifiers/v1/runtimes/e2b.py,sha256=yBeocAutsv2l5x-C5IMqrlgBz6Cb-t6vWbX4qTjlztE,30306
 verifiers/v1/runtimes/limiters.py,sha256=rOfQJcMdYcLSKq8AL9O09BfGOLqpYmNgrCxXXNcHLmU,2849
 verifiers/v1/runtimes/modal.py,sha256=ZHA4vtNIZwTV-bnVUlambgc8l34j_ZulvtrwvvkE2Kg,17945
-verifiers/v1/runtimes/prime.py,sha256=PCakstDt-gdEUI0d5xM5dEFgn3yQie0RmVsXnUPkjNQ,19230
+verifiers/v1/runtimes/prime.py,sha256=pkrHMWzBdmkNRBBelnu_fV5LO2kdEQmVlm0G2p7uZEk,19403
 verifiers/v1/runtimes/subprocess.py,sha256=vnGVAI3J7pYmRei4MQ7MN4nb8SglLi70NtVTINMPVvQ,8855
-verifiers/v1/runtimes/docker/__init__.py,sha256=1QJF08StAXanR9XdJfLfjN4Hzy8K-Ge9_prVOv_RT0A,21716
+verifiers/v1/runtimes/docker/__init__.py,sha256=QoFOTMgRjoWD--O25Jsft9eD2vjcrMpJQyhfQXqWraI,21828
 verifiers/v1/runtimes/docker/egress.py,sha256=wtKWTL2_zFidxMR7lDRmfevQlOsl2Iyk88ebdO4Kqqw,24566
 verifiers/v1/serve/__init__.py,sha256=wOKuwfugzmDT4yIniwzCXlf4G6tv6Cg8Kc--WMa38Bs,553
 verifiers/v1/serve/client.py,sha256=E2y2x4qqYveWRWC9VZYQEu19aMEryPWTdXnYzbq5uTA,9829
@@ -162,7 +162,7 @@ verifiers/v1/tasksets/__init__.py,sha256=2ijE3qIlLoUA02g6iysOwWQylyBBQL1GhSpjv8_
 verifiers/v1/tasksets/harbor/__init__.py,sha256=JxThzHFYEkuSfQbVf3pEnjordgdfe4MU-QOsSSbyovU,326
 verifiers/v1/tasksets/harbor/compose.py,sha256=Ab-vpMPFXy7Y7C_82-IRznrlaN3FLEuFDz8w3LDsE-I,14094
 verifiers/v1/tasksets/harbor/env.py,sha256=-U-CeyeuWysXCNHi3cew0XtakUa7TqJVnVzElKtG41w,6356
-verifiers/v1/tasksets/harbor/taskset.py,sha256=IaGeCoH012wcnPmCauk4kgGRdXsDt1qpMnOBKuUkV3Q,36421
+verifiers/v1/tasksets/harbor/taskset.py,sha256=ggz26hWv9XFZAfkzp72vsrQjaXKShO4AOCzrSg2K4ds,36503
 verifiers/v1/tasksets/harbor/toolset.py,sha256=_7HXu-uuvqzhmJ1EX6c3KWLg0g0eRrLjCq1kBsZhIwo,3159
 verifiers/v1/tasksets/nemo_gym/__init__.py,sha256=654gAvG3Wd_Z_nh6mypeKn4s_IIQ0Ge6vcZvxTHC2_E,306
 verifiers/v1/tasksets/nemo_gym/response.py,sha256=EhrsquEP8g0bjzAThGfE6Ypgy86_nVX235NiFYtVDVM,4463
@@ -175,7 +175,7 @@ verifiers/v1/tasksets/textarena/__init__.py,sha256=Os2OlBY_pSH0B1DP32RitumgSLpq2
 verifiers/v1/tasksets/textarena/taskset.py,sha256=zGslerxmH2ZT7FJdP-72R6a9p71kr2pNS3r5_xnq1lQ,4406
 verifiers/v1/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 verifiers/v1/utils/aio.py,sha256=0yNFOqB2oO6Qktc6NI_ZSAGuo1aHsIK_wuT1BtmoZ3I,1532
-verifiers/v1/utils/artifacts.py,sha256=3QL2ELwqXuek9OLwF4hJdzZb_hwfVjjenw8VjepdLlo,12855
+verifiers/v1/utils/artifacts.py,sha256=1FHD0BQPB2NOSBphOGAODWbFQQlPKLmUIBPhFnfBtP8,14354
 verifiers/v1/utils/compile.py,sha256=5pxy31wx2Q-3pQjOO5B9SH6OT-wwb8r4F1LAl6HMeQA,5835
 verifiers/v1/utils/decorators.py,sha256=vhoN6YoKb15-Fkqmc9RaNlUIbt9WRvNK4zAn2bAxfS4,5367
 verifiers/v1/utils/format.py,sha256=yX160sGewMMZn9iJqTHRbYYt4Z9pHasjMlFT1dXrKD8,2446
@@ -194,8 +194,8 @@ verifiers/v1/utils/scope.py,sha256=bzUEiWDOVdbj7dXOwGOlzsQ_-Xu0j9NR5TalQB-8TS8,8
 verifiers/v1/utils/score.py,sha256=493yJVMw8teCu9JxapxMFPFzI0hNUqdo0Y2nGW4kckk,6200
 verifiers/v1/utils/trace_store.py,sha256=RsCDonGR-bs-tvEstcppiJm3jFmAdIiG83fA5KtCbAw,2801
 verifiers/v1/utils/version.py,sha256=-obEo_-l9-D8FLef4hYxncOe-uJpxrM1g2Hig_37Sgs,1607
-verifiers-0.3.2.dev168.dist-info/METADATA,sha256=gb78e_KMSGlVaIhDBXpMS56UnLRgcLe5rtTP4aah5Do,4227
-verifiers-0.3.2.dev168.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-verifiers-0.3.2.dev168.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
-verifiers-0.3.2.dev168.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
-verifiers-0.3.2.dev168.dist-info/RECORD,,
+verifiers-0.3.2.dev170.dist-info/METADATA,sha256=g1Gd_EgCwA-0xc4QtXPfFLMaFdLZ8ge7KxRGidGFbGI,4227
+verifiers-0.3.2.dev170.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+verifiers-0.3.2.dev170.dist-info/entry_points.txt,sha256=iugElcdWPKbQM7uFF0lZ8iUpHsNr17-BwEAAjJWxV3U,259
+verifiers-0.3.2.dev170.dist-info/licenses/LICENSE,sha256=v0RrUsdV3IDoZhrRce297IXS3xMHNJ-_LdLpFAUWb9k,1072
+verifiers-0.3.2.dev170.dist-info/RECORD,,