verifiers 0.3.2.dev207__tar.gz → 0.3.2.dev209__tar.gz

{verifiers-0.3.2.dev207 → verifiers-0.3.2.dev209}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev207
+Version: 0.3.2.dev209
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev207 → verifiers-0.3.2.dev209}/tests/v1/conftest.py

@@ -134,6 +134,7 @@ def _eval_config(
     runtime: dict | None = None,
     env: dict | None = None,
     reasoning_effort: str | None = None,
+    client: dict | None = None,
 ) -> EvalConfig:
     """Build the smallest `EvalConfig` that still exercises the path, shared by the in-process
     (`run_v1`) and env-server (`run_v1_server`) fixtures. `taskset_overrides` merges onto the
@@ -195,6 +196,7 @@ def _eval_config(
         run={"dir": output_dir.name},
         model=CI_MODEL,
         push=False,
+        **({"client": client} if client else {}),
     )
 
 
@@ -280,3 +282,102 @@ async def live_ctx():
         client=EvalClientConfig(),
         sampling=SamplingConfig(max_tokens=2048),
     )
+
+
+@pytest.fixture
+async def scripted_model():
+    """A deterministic upstream model: every call gets a plain "OK" in the caller's own
+    dialect (chat completions, Responses, or Anthropic messages), streamed through that
+    dialect's own encoder when asked. Yields a client config pointing at it."""
+    from aiohttp import web
+
+    from verifiers.v1.dialects.anthropic import AnthropicDialect
+    from verifiers.v1.dialects.chat import ChatDialect
+    from verifiers.v1.dialects.responses import ResponsesDialect
+
+    def chat(model: str) -> dict:
+        message = {"role": "assistant", "content": "OK"}
+        return {
+            "id": "chatcmpl-scripted",
+            "object": "chat.completion",
+            "created": 0,
+            "model": model,
+            "choices": [{"index": 0, "message": message, "finish_reason": "stop"}],
+            "usage": {"prompt_tokens": 1, "completion_tokens": 1, "total_tokens": 2},
+        }
+
+    def responses(model: str) -> dict:
+        text = {"type": "output_text", "text": "OK", "annotations": []}
+        return {
+            "id": "resp_scripted",
+            "object": "response",
+            "created_at": 0,
+            "model": model,
+            "status": "completed",
+            "output": [
+                {
+                    "type": "message",
+                    "id": "msg_scripted",
+                    "status": "completed",
+                    "role": "assistant",
+                    "content": [text],
+                }
+            ],
+            "parallel_tool_calls": True,
+            "tool_choice": "auto",
+            "tools": [],
+            "usage": {
+                "input_tokens": 1,
+                "output_tokens": 1,
+                "total_tokens": 2,
+                "input_tokens_details": {"cached_tokens": 0},
+                "output_tokens_details": {"reasoning_tokens": 0},
+            },
+        }
+
+    def anthropic(model: str) -> dict:
+        return {
+            "id": "msg_scripted",
+            "type": "message",
+            "role": "assistant",
+            "model": model,
+            "content": [{"type": "text", "text": "OK"}],
+            "stop_reason": "end_turn",
+            "stop_sequence": None,
+            "usage": {"input_tokens": 1, "output_tokens": 1},
+        }
+
+    routes = [
+        ("/chat/completions", ChatDialect(), chat),
+        ("/responses", ResponsesDialect(), responses),
+        ("/messages", AnthropicDialect(), anthropic),
+    ]
+
+    async def answer(request: web.Request) -> web.StreamResponse:
+        body = await request.json()
+        dialect, build = next(
+            (dialect, build)
+            for suffix, dialect, build in routes
+            if request.path.endswith(suffix)
+        )
+        raw = build(str(body.get("model", "scripted")))
+        if not dialect.streaming(body):
+            return web.json_response(raw)
+        response = web.StreamResponse(headers={"Content-Type": "text/event-stream"})
+        await response.prepare(request)
+        for event in dialect.stream_events(raw):
+            await response.write(event)
+        await response.write_eof()
+        return response
+
+    app = web.Application()
+    app.router.add_post("/{tail:.*}", answer)
+    runner = web.AppRunner(app)
+    await runner.setup()
+    site = web.TCPSite(runner, "127.0.0.1", 0)
+    await site.start()
+    port = site._server.sockets[0].getsockname()[1]
+    try:
+        yield {"base_url": f"http://127.0.0.1:{port}/v1"}
+    finally:
+        await runner.cleanup()

verifiers-0.3.2.dev209/tests/v1/fixtures/agent_user_harness_v1.py

@@ -0,0 +1,37 @@
+"""agent-user-harness-v1: one turn of any harness running as a non-root agent user.
+
+Root setup creates the task's `agent_user` (images normally ship one) and hands it the
+workdir; the harness then installs, launches as that user, and answers a one-line prompt.
+With the e2e suite's scripted upstream answering, the run is deterministic: it fails only if
+the harness can't set up or run without root.
+"""
+
+import verifiers.v1 as vf
+from verifiers.v1.runtimes import Runtime
+
+__all__ = ["AgentUserHarnessTaskset"]
+
+AGENT_USER = "vf-agent"
+
+
+class AgentUserHarnessTask(vf.Task):
+    async def setup(self, trace: vf.Trace, runtime: Runtime) -> None:
+        # Stands in for the image, which normally ships the user and gives it the
+        # workdir: kimi-code, pi, and openclaw keep per-rollout state there.
+        setup = f"useradd -m {AGENT_USER} && chown -R {AGENT_USER} ."
+        result = await runtime.run(["sh", "-c", setup], {})
+        if result.exit_code != 0:
+            raise RuntimeError(f"root setup failed: {result.stderr}")
+
+    @vf.reward(weight=1.0)
+    async def answered(self, trace: vf.Trace) -> float:
+        return float(trace.num_turns >= 1)
+
+
+class AgentUserHarnessTaskset(vf.Taskset[AgentUserHarnessTask, vf.TasksetConfig]):
+    def load(self) -> list[AgentUserHarnessTask]:
+        return [
+            AgentUserHarnessTask(
+                vf.TaskData(idx=0, prompt="Reply with OK.", agent_user=AGENT_USER)
+            )
+        ]

verifiers-0.3.2.dev209/tests/v1/fixtures/agent_user_v1.py

@@ -0,0 +1,161 @@
+"""agent-user-v1: a scripted, model-free agent that runs as a non-root user and tries root actions.
+
+Root setup creates the task's `agent_user`, plants a root-only secret, and prepares a uv
+script; the workdir stays root-owned, like a typical image WORKDIR. The scripted harness runs
+as that user and records whether root-only actions are denied, whether its own uv script, its
+runtime file I/O, and its colocated tool server all act as the user, and whether that server
+can reach uv. The reward is 1 only if every check holds. Needs docker or prime.
+"""
+
+import json
+import os
+import pwd
+import shutil
+from pathlib import Path
+
+import verifiers.v1 as vf
+from verifiers.v1.clients import ModelContext
+from verifiers.v1.configs.harness import HarnessConfig
+from verifiers.v1.errors import SandboxError
+from verifiers.v1.harness import Harness
+from verifiers.v1.mcp.launch import serve
+from verifiers.v1.runtimes import ProgramResult, Runtime
+
+__all__ = ["AgentUserTaskset", "ScriptedAgentUserHarness"]
+
+AGENT_USER = "vf-agent"
+SECRET = "/opt/vf-agent-user-secret"
+REPORT = "/tmp/agent-user-report.json"
+WRITTEN = "/home/vf-agent/agent-user-written.txt"
+TOOL_USER = "/tmp/vf-agent-user-tool-user"
+TOOL_UV = "/tmp/vf-agent-user-tool-uv"
+ROOT_ACTIONS = ("read_secret", "write_etc", "chmod_secret", "signal_init")
+
+SETUP = f"useradd -m {AGENT_USER} && echo secret > {SECRET} && chmod 600 {SECRET}"
+
+UV_SCRIPT = """# /// script
+# dependencies = []
+# ///
+import os, pwd, sys
+print(pwd.getpwuid(os.getuid()).pw_name, sys.executable)
+"""
+
+PROBE = f"""
+r() {{ "$@" >/dev/null 2>&1 && echo ok || echo denied; }}
+printf '{{"user":"%s","secret_exists":"%s","read_secret":"%s","write_etc":"%s","chmod_secret":"%s","signal_init":"%s","write_home":"%s","written_owner":"%s","tool_user":"%s","tool_uv":"%s"}}' \\
+  "$(id -un)" "$(r test -e {SECRET})" "$(r cat {SECRET})" "$(r touch /etc/vf-agent-user-probe)" \\
+  "$(r chmod 644 {SECRET})" "$(r kill -0 1)" "$(r touch "$HOME/probe")" "$(stat -c %U {WRITTEN})" \\
+  "$(cat {TOOL_USER})" "$(cat {TOOL_UV})" > {REPORT}
+"""
+
+
+def current_user() -> str:
+    return pwd.getpwuid(os.getuid()).pw_name
+
+
+class AgentUserToolset(vf.Toolset[vf.ToolsetConfig]):
+    TOOL_PREFIX = "agentuser"
+
+    @vf.tool
+    def whoami(self) -> str:
+        """Return the user this tool server runs as."""
+        return current_user()
+
+
+class ScriptedAgentUserHarness(Harness[HarnessConfig]):
+    SUPPORTS_MCP = True
+
+    async def launch(
+        self,
+        ctx: ModelContext,
+        trace: vf.Trace,
+        runtime: Runtime,
+        endpoint: str,
+        secret: str,
+        mcp_urls: dict[str, str],
+        data: vf.TaskData,
+        tool_interception_url: str | None = None,
+    ) -> ProgramResult:
+        script = await runtime.prepare_uv_script(UV_SCRIPT)
+        uv_user, uv_python = (await runtime.run(script, {})).stdout.split()
+        await runtime.write(WRITTEN, b"written by the agent user")
+        try:
+            await runtime.read(SECRET)
+            read_api = "ok"
+        except SandboxError:
+            read_api = "denied"
+        trace.info["agent_user_harness"] = {
+            "uv_user": uv_user,
+            "uv_python": uv_python,
+            "uv_script": script[-1],
+            "read_secret_api": read_api,
+        }
+        return await runtime.run_program(["sh", "-c", PROBE], {})
+
+
+class AgentUserData(vf.TaskData):
+    preinstalled_tools: bool = False
+
+
+class AgentUserTask(vf.Task[AgentUserData]):
+    @classmethod
+    def toolsets(cls, config: vf.TaskConfig) -> list[vf.Toolset]:
+        return [AgentUserToolset(vf.ToolsetConfig(colocated=True))]
+
+    async def setup(self, trace: vf.Trace, runtime: Runtime) -> None:
+        result = await runtime.run(["sh", "-c", SETUP], {})
+        if result.exit_code != 0:
+            raise RuntimeError(f"root setup failed: {result.stderr}")
+        trace.info["root_uv_script"] = (await runtime.prepare_uv_script(UV_SCRIPT))[-1]
+        if self.data.preinstalled_tools:
+            # As an earlier rollout on a reused runtime would: the agent's server then
+            # finds its package already installed by the default user.
+            async with serve(
+                AgentUserToolset(vf.ToolsetConfig(colocated=True)), runtime
+            ):
+                pass
+            await runtime.run(["rm", "-f", TOOL_USER, TOOL_UV], {})
+
+    @vf.reward(weight=1.0)
+    async def agent_user_contained(self, trace: vf.Trace, runtime: Runtime) -> float:
+        report = {
+            **json.loads(await runtime.read(REPORT)),
+            **trace.info["agent_user_harness"],
+            "root_uv_script": trace.info["root_uv_script"],
+        }
+        trace.info["agent_user_report"] = report
+        users = ("user", "uv_user", "written_owner", "tool_user")
+        return float(
+            all(report[key] == AGENT_USER for key in users)
+            and report["secret_exists"] == report["write_home"] == "ok"
+            and all(report[action] == "denied" for action in ROOT_ACTIONS)
+            and report["read_secret_api"] == "denied"
+            and report["tool_uv"] == "ok"
+            and not report["uv_python"].startswith("/root/")
+            and report["uv_script"] != report["root_uv_script"]
+        )
+
+
+class AgentUserConfig(vf.TasksetConfig):
+    preinstalled_tools: bool = False
+    """Bring the colocated tool up once as the default user before the agent's run."""
+
+
+class AgentUserTaskset(vf.Taskset[AgentUserTask, AgentUserConfig]):
+    def load(self) -> list[AgentUserTask]:
+        return [
+            AgentUserTask(
+                AgentUserData(
+                    idx=0,
+                    prompt="Scripted: try root-only actions as a non-root user.",
+                    agent_user=AGENT_USER,
+                    preinstalled_tools=self.config.preinstalled_tools,
+                )
+            )
+        ]
+
+
+if __name__ == "__main__":
+    Path(TOOL_USER).write_text(current_user())
+    Path(TOOL_UV).write_text("ok" if shutil.which("uv") else "missing")
+    AgentUserToolset.run()

{verifiers-0.3.2.dev207 → verifiers-0.3.2.dev209}/tests/v1/fixtures/pyproject.toml

@@ -14,6 +14,7 @@ build-backend = "hatchling.build"
 # never get installed.
 [tool.hatch.build]
 include = [
+    "agent_user_v1.py",
     "counter_tool_v1.py",
     "echo_acp_resume_v1.py",
     "echo_tool_v1.py",

{verifiers-0.3.2.dev207 → verifiers-0.3.2.dev209}/tests/v1/test_e2e.py

@@ -190,12 +190,40 @@ USER_RUNTIMES = [
     pytest.param("e2b", marks=[mark.e2b], id="harness-in-e2b"),
 ]
 
-# Runtimes that can switch users (`Runtime.with_user`).
 AGENT_USER_RUNTIMES = [
     pytest.param("docker", marks=[mark.docker], id="harness-in-docker"),
     pytest.param("prime", marks=[mark.prime], id="harness-in-prime"),
 ]
 
+
+# Boxed harnesses (terminus-2 drives the host tmux; browser-use needs its own image).
+def _agent_user_placements():
+    harnesses = [
+        ("null", "null"),
+        ("bash", "bash"),
+        ("rlm", "rlm"),
+        ("codex", "codex"),
+        ("claude-code", "claude_code"),
+        ("hermes-agent", "hermes_agent"),
+        ({"id": "kimi-code", "transport": "responses"}, "kimi_code"),
+        ({"id": "pi", "transport": "responses"}, "pi"),
+        ("openclaw", "openclaw"),
+        ("mini-swe-agent", None),
+        ("prime-agent", None),
+    ]
+    for harness, harness_mark in harnesses:
+        name = harness if isinstance(harness, str) else harness["id"]
+        for runtime in ("docker", "prime"):
+            if name == "prime-agent" and runtime != "prime":
+                continue
+            marks = [getattr(mark, runtime)]
+            if harness_mark:
+                marks.append(getattr(mark, harness_mark))
+            yield pytest.param(harness, runtime, marks=marks, id=f"{name}-in-{runtime}")
+
+
+AGENT_USER_HARNESS_PLACEMENTS = list(_agent_user_placements())
+
 # ACP-backed harnesses: each must preserve an exchange across interaction segments and
 # retain MCP access after resuming. Cover every harness in the local container runtime,
 # plus remote placements for the sandbox/tunnel and native-process boundaries.
@@ -339,28 +367,59 @@ async def test_browser_use(run_v1, tmp_path):
 
 
 @pytest.mark.e2e
+@pytest.mark.parametrize(
+    "preinstalled_tools", [False, True], ids=["fresh", "preinstalled"]
+)
 @pytest.mark.parametrize("harness_runtime", AGENT_USER_RUNTIMES, indirect=True)
-async def test_agent_user_cannot_act_as_root(run_v1, harness_runtime, tmp_path):
-    """A scripted, model-free agent runs as the task's non-root `agent_user`: it can see
-    the secret the root-run setup planted and write its own workspace, but every
-    root-only action (read the secret, write /etc, chmod the secret, signal PID 1) is
-    denied."""
+async def test_agent_user_cannot_act_as_root(
+    run_v1, harness_runtime, preinstalled_tools, tmp_path
+):
+    """A scripted, model-free agent runs as the task's non-root `agent_user`. Root-only
+    actions are denied, while its uv script, runtime file I/O, and colocated tool server
+    all act as the user. With `preinstalled_tools`, the tool's package was first installed
+    by the default user, as on a reused runtime."""
     (trace,) = await run_v1(
         "agent-user-v1",
         harness="agent-user-v1",
         runtime={"type": harness_runtime},
         output_dir=tmp_path,
+        taskset_overrides={"preinstalled_tools": preinstalled_tools},
     )
     report = trace.info["agent_user_report"]
-    assert report["user"] == "vf-agent"
-    assert report["secret_exists"] == "ok" and report["write_workdir"] == "ok"
+    for key in ("user", "uv_user", "written_owner", "tool_user"):
+        assert report[key] == "vf-agent", key
+    assert report["secret_exists"] == "ok" and report["write_home"] == "ok"
     root_actions = ("read_secret", "write_etc", "chmod_secret", "signal_init")
     assert {action: report[action] for action in root_actions} == dict.fromkeys(
         root_actions, "denied"
     )
+    assert report["read_secret_api"] == "denied"
+    assert report["tool_uv"] == "ok"
+    assert not report["uv_python"].startswith("/root/")
+    assert report["uv_script"] != report["root_uv_script"]
     assert trace.reward == 1.0
 
 
+@pytest.mark.e2e
+@pytest.mark.parametrize(
+    "harness,harness_runtime", AGENT_USER_HARNESS_PLACEMENTS, indirect=True
+)
+async def test_agent_user_harness(
+    run_v1, harness, harness_runtime, scripted_model, tmp_path
+):
+    """Each harness installs and runs a turn as a non-root agent user against a scripted
+    upstream, so the run fails only if the harness can't set up or run without root."""
+    (trace,) = await run_v1(
+        "agent-user-harness-v1",
+        harness=harness,
+        runtime={"type": harness_runtime},
+        output_dir=tmp_path,
+        client=scripted_model,
+    )
+    assert trace.ok, [error.message for error in trace.errors]
+    assert trace.num_turns >= 1
+
+
 @pytest.mark.e2e
 @pytest.mark.parametrize("harness_runtime", USER_RUNTIMES, indirect=True)
 async def test_user(run_v1, harness_runtime, tmp_path):

{verifiers-0.3.2.dev207 → verifiers-0.3.2.dev209}/verifiers/v1/harnesses/utils/install.py

@@ -50,7 +50,16 @@ async def ensure_installed(
         f"mkdir -p {shlex.quote(directory)} && "
         f'if l=$(command -v flock || command -v lockf); then "$l" {lock} {run}; else {spinlock}; fi'
     )
-    result = await runtime.run(["sh", "-c", guarded], env)
+    if runtime.user is None:
+        result = await runtime.run(["sh", "-c", guarded], env)
+    else:
+        # Install as root (system packages), keeping uv's Python in `directory`, then
+        # open it to the agent user: some installers leave it private.
+        python_dir = {"UV_PYTHON_INSTALL_DIR": f"{directory}/python"}
+        shareable = f"{guarded} && chmod -R a+rX {shlex.quote(directory)}"
+        result = await runtime.with_user(None).run(
+            ["sh", "-c", shareable], {**python_dir, **env}
+        )
     if result.exit_code != 0:
         detail = (result.stderr.strip() or result.stdout.strip())[-500:]
         raise RuntimeError(f"{label} install failed: {detail}")

{verifiers-0.3.2.dev207 → verifiers-0.3.2.dev209}/verifiers/v1/mcp/launch.py

@@ -234,7 +234,9 @@ async def _cached_package(src: Path) -> tuple[str, bytes]:
             del _PACKAGE_BUILD_STATES[key]
 
 
-async def _install_in_sandbox(server: ServerBase, runtime: Runtime) -> str:
+async def _install_in_sandbox(server: ServerBase, agent: Runtime) -> str:
+    # Install as root; the agent user only runs the server.
+    runtime = agent if agent.user is None else agent.with_user(None)
     # Prime VMs mount /tmp as a small tmpfs, while the runtime workdir lives on
     # the VM's root disk. Keep source, build scratch space, and uv's cache on the
     # durable runtime filesystem so ordinary dependency installs cannot exhaust
@@ -244,35 +246,51 @@ async def _install_in_sandbox(server: ServerBase, runtime: Runtime) -> str:
     temp = str(PurePosixPath(workdir) / ".vf-tmp")
     cache = str(PurePosixPath(workdir) / ".vf-uv-cache")
     venv = str(PurePosixPath(workdir) / ".vf-venv")
+    python_dir = str(PurePosixPath(workdir) / ".vf-python")
     root_q, temp_q, cache_q, venv_q = map(shlex.quote, (root, temp, cache, venv))
     # Colocated servers and borrowed views install into one physical environment.
     # Serialize its mutations and only remember sources after a successful install.
     async with runtime._mcp_install_lock:
         sources = dict.fromkeys((_package_dir(ServerBase), _package_dir(type(server))))
         pending = [source for source in sources if source not in runtime._mcp_sources]
-        if not pending:
-            return f"{venv}/bin/python"
-        setup = (
-            f"set -e; mkdir -p {root_q} {temp_q} {cache_q}; "
-            f"export TMPDIR={temp_q} UV_CACHE_DIR={cache_q}; "
-            'export PATH="$HOME/.local/bin:$PATH"; '
-        )
-        if not runtime._mcp_sources:
-            # Failed installs can leave the venv behind; retain it when retrying.
-            setup += f"{_ENSURE_UV}; uv venv --allow-existing {venv_q}; "
-        # Drain remote writes and installs before cancellation releases the lock.
-        for source in pending:
-            name, data = await _cached_package(Path(source))
-            remote = f"{root}/{name}"
-            await run_shielded(runtime.write(remote, data))
-            setup += f"uv pip install --python {venv_q} {shlex.quote(remote)}; "
-        result = await run_shielded(runtime.run(["sh", "-c", setup], {}))
-        if result.exit_code != 0:
-            raise ToolsetError(
-                f"server {server.server_name!r} install failed in runtime: "
-                f"{(result.stderr or result.stdout).strip()[-2000:]}"
+        if pending:
+            setup = (
+                f"set -e; mkdir -p {root_q} {temp_q} {cache_q}; "
+                f"export TMPDIR={temp_q} UV_CACHE_DIR={cache_q}; "
+                'export PATH="$HOME/.local/bin:$PATH"; '
             )
-        runtime._mcp_sources.update(pending)
+            if agent.user is not None:
+                setup += f"export UV_PYTHON_INSTALL_DIR={shlex.quote(python_dir)}; "
+            if not runtime._mcp_sources:
+                # Failed installs can leave the venv behind; retain it when retrying.
+                setup += f"{_ENSURE_UV}; uv venv --allow-existing {venv_q}; "
+            # Drain remote writes and installs before cancellation releases the lock.
+            for source in pending:
+                name, data = await _cached_package(Path(source))
+                remote = f"{root}/{name}"
+                await run_shielded(runtime.write(remote, data))
+                setup += f"uv pip install --python {venv_q} {shlex.quote(remote)}; "
+            result = await run_shielded(runtime.run(["sh", "-c", setup], {}))
+            if result.exit_code != 0:
+                raise ToolsetError(
+                    f"server {server.server_name!r} install failed in runtime: "
+                    f"{(result.stderr or result.stdout).strip()[-2000:]}"
+                )
+            runtime._mcp_sources.update(pending)
+        if agent.user is not None:
+            # Root's uv lives in its home; copy it into the venv, open to the agent.
+            python_q = shlex.quote(python_dir)
+            share = (
+                'set -e; export PATH="$HOME/.local/bin:$PATH"; '
+                f'cp "$(command -v uv)" {venv_q}/bin/uv; chmod -R a+rX {venv_q}; '
+                f"[ ! -d {python_q} ] || chmod -R a+rX {python_q}"
+            )
+            result = await run_shielded(runtime.run(["sh", "-c", share], {}))
+            if result.exit_code != 0:
+                raise ToolsetError(
+                    f"server {server.server_name!r} could not be shared with "
+                    f"{agent.user!r}: {(result.stderr or result.stdout).strip()[-2000:]}"
+                )
     return f"{venv}/bin/python"
 
 
@@ -338,12 +356,18 @@ async def serve_in_runtime(
     command = [python, "-m", type(server).__module__]
     if runtime.type != "subprocess":
         # Providers may invoke uv after the install shell exits, so preserve its PATH.
+        path = "$HOME/.local/bin:$PATH"
+        if runtime.user is not None:
+            path = f"{PurePosixPath(python).parent}:{path}"
         command = [
             "sh",
             "-c",
-            f'export PATH="$HOME/.local/bin:$PATH"; exec {shlex.join(command)}',
+            f'export PATH="{path}"; exec {shlex.join(command)}',
         ]
     log = f"vf_tool_{server.server_name}.log"
+    if runtime.user is not None:
+        # The agent user may not be able to write the workdir.
+        log = f"/tmp/vf_tool_{server.server_name}-{uuid.uuid4().hex[:8]}.log"
     await runtime.run_background(command, env, log)
     if fixed is not None:
         port = fixed

{verifiers-0.3.2.dev207 → verifiers-0.3.2.dev209}/verifiers/v1/rollout.py

@@ -59,7 +59,7 @@ _HOME_PROBE = (
 )
 
 
-async def agent_runtime(runtime: Runtime, user: str | None) -> Runtime:
+async def resolve_agent_runtime(runtime: Runtime, user: str | None) -> Runtime:
     """The runtime the harness runs on: `runtime` itself, or a view running as `user`
     with `HOME` set to its home. `user` must exist with a home directory it can write
     (task authors ship it in the image), and the view must really run as it, so a
@@ -72,8 +72,7 @@ async def agent_runtime(runtime: Runtime, user: str | None) -> Runtime:
         raise TaskError(f"agent_user {user!r} does not exist in the image")
     if lookup.exit_code != 0:
         raise TaskError(f"agent_user {user!r} has no home directory ({home})")
-    view = runtime.with_user(user)
-    view = view.with_env({**view.env, "HOME": home})
+    view = runtime.with_user(user, home=home)
     probe = await view.run(["sh", "-c", 'id -un; test -w "$HOME" && echo writable'], {})
     effective, *rest = probe.stdout.split() or [""]
     if effective != user:
@@ -168,6 +167,7 @@ class Rollout:
         self._endpoint: str | None = None
         self._urls: dict[str, str] = {}
         self._harness_session: HarnessSession | None = None
+        self._agent_runtime: Runtime | None = None
         self.deadline_at: float | None = None
         """The active harness segment's absolute deadline (event-loop clock), or
         None between segments / when unbounded. An interaction spends one cumulative
@@ -279,7 +279,13 @@ class Rollout:
                 asyncio.timeout_at(setup_deadline) as setup_timeout,
                 boundary(HarnessError, "harness setup"),
             ):
-                await self.harness.setup(runtime)
+                # The harness, its colocated tools, and its session run as the task's
+                # `agent_user` (just `runtime` when unset). Task setup and scoring,
+                # interception, and the execution policy keep the default `runtime`.
+                self._agent_runtime = await resolve_agent_runtime(
+                    runtime, self.task.data.agent_user
+                )
+                await self.harness.setup(self._agent_runtime)
             async with boundary(ToolsetError, "building tool servers"):
                 toolsets = self.task.toolsets(self.task.config)
             # `base_url` is the interception server's reachable URL for this rollout.
@@ -304,7 +310,7 @@ class Rollout:
             self._urls = await self._stack.enter_async_context(
                 serve_tools(
                     toolsets,
-                    runtime,
+                    self._agent_runtime,
                     shared=self._shared_tools,
                     state_secret=state_secret,
                     state_route=self.trace.id,
@@ -415,7 +421,7 @@ class Rollout:
                     self._harness_session = await self.harness.session(
                         self.ctx,
                         self.trace,
-                        await agent_runtime(runtime, harness_data.agent_user),
+                        self._agent_runtime,
                         self._endpoint,
                         self._secret,
                         self._urls,
@@ -606,7 +612,7 @@ class Rollout:
                         # Cross-trace judgement runs later, after the runtime is gone.
                         await asyncio.gather(
                             self.task.score(trace, runtime),
-                            self.harness.score(trace, runtime),
+                            self.harness.score(trace, self._agent_runtime or runtime),
                         )
                 except TimeoutError:
                     self.timeout("scoring")