verifiers 0.3.2.dev30__tar.gz → 0.3.2.dev32__tar.gz

{verifiers-0.3.2.dev30 → verifiers-0.3.2.dev32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.3.2.dev30
+Version: 0.3.2.dev32
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers

{verifiers-0.3.2.dev30 → verifiers-0.3.2.dev32}/tests/v1/fixtures/echo_agentic_v1.py

@@ -31,13 +31,6 @@ class EchoAgenticData(vf.TaskData):
 
 
 class EchoAgenticTask(vf.Task[EchoAgenticData]):
-    async def finalize(self, trace: vf.Trace, runtime: Runtime) -> None:
-        # Subprocess uses a runtime-owned temporary cwd, not a restorable absolute
-        # path; isolated agentic judging requires a container anyway.
-        if runtime.type == "subprocess":
-            return
-        trace.state.artifacts = await vf.collect(runtime, self.data.artifacts)
-
     @vf.reward(weight=1.0)
     async def wrote_phrase(self, runtime: Runtime) -> float:
         try:

{verifiers-0.3.2.dev30 → verifiers-0.3.2.dev32}/verifiers/v1/agent.py

@@ -362,21 +362,26 @@ class Agent:
         runtime: Runtime | None = None,
         tools: Mapping[str, SharedToolServer] | None = None,
         on_trace: Callable[[Trace], None] | None = None,
+        collect_artifacts: bool = False,
     ) -> Trace:
         """Run this agent on `task` once and return the trace: one segment — the
         program runs on the task's prompt until it exits (a multi-turn exchange
         is `interaction()`). `runtime` places it into a live borrowed box instead of
         provisioning one; `tools` are live servers borrowed from their
         owner, counted in the pairing check; `on_trace` observes the trace the
-        moment it's minted, before any I/O. Retries whole while the trace ends
-        with a retryable error (`config.retries`) — never into a borrowed box;
-        the final trace keeps earlier attempts' errors."""
+        moment it's minted, before any I/O. `collect_artifacts` captures the task's
+        declared artifacts after its finalizer while its container runtime is still
+        alive. Retries whole while the trace ends with a retryable error
+        (`config.retries`) — never into a borrowed box; the final trace keeps earlier
+        attempts' errors."""
         if self._closed:
             raise RuntimeError("Agent is closed; create a new agent")
         retry = self.config.retries
         history: list = []
         for attempt in range(retry.max_retries + 1):
-            trace = await self._run_once(task, runtime, tools, on_trace)
+            trace = await self._run_once(
+                task, runtime, tools, on_trace, collect_artifacts
+            )
             if attempt == retry.max_retries or not trace_should_retry(trace, retry):
                 break
             if runtime is not None:
@@ -407,9 +412,20 @@ class Agent:
         runtime: Runtime | None,
         shared_tools: Mapping[str, SharedToolServer] | None,
         on_trace: Callable[[Trace], None] | None,
+        collect_artifacts: bool,
     ) -> Trace:
         params = self._rollout_params(task, runtime, dict(shared_tools or {}))
-        run = Rollout(task=task, on_trace=on_trace, **params)
+        if collect_artifacts and isinstance(params["runtime_config"], SubprocessConfig):
+            raise TypeError(
+                "artifact collection requires a container runtime; subprocess "
+                "artifacts live in a host-only temporary working directory"
+            )
+        run = Rollout(
+            task=task,
+            on_trace=on_trace,
+            collect_artifacts=collect_artifacts,
+            **params,
+        )
         try:
             if await run.open():
                 await run.step()
@@ -626,6 +642,7 @@ class _EpisodeAgent(Agent):
         runtime: Runtime | None = None,
         tools: Mapping[str, SharedToolServer] | None = None,
         on_trace: Callable[[Trace], None] | None = None,
+        collect_artifacts: bool = False,
     ) -> Trace:
         async with self._gate or nullcontext():
             trace = await super().run(
@@ -633,6 +650,7 @@ class _EpisodeAgent(Agent):
                 runtime=runtime,
                 tools=tools if tools is not None else self._shared_for(task),
                 on_trace=self._watch(on_trace),
+                collect_artifacts=collect_artifacts,
             )
         self._completed.append(trace)
         return trace

{verifiers-0.3.2.dev30 → verifiers-0.3.2.dev32}/verifiers/v1/envs/agentic_judge/env.py

@@ -342,7 +342,7 @@ class IsolatedAgenticJudgeEnv(AgenticJudgeEnv):
     """Judge only collected artifacts in a fresh box with the solver's policy."""
 
     async def run(self, task: vf.Task, agents: vf.Agents) -> None:
-        solution = await agents.solver.run(task)
+        solution = await agents.solver.run(task, collect_artifacts=True)
         if not solution.ok:
             raise RuntimeError("the solver's rollout failed, so the judge never ran")
         await agents.judge.run(

{verifiers-0.3.2.dev30 → verifiers-0.3.2.dev32}/verifiers/v1/rollout.py

@@ -32,6 +32,7 @@ from verifiers.v1.state import state_cls
 from verifiers.v1.task import Task
 from verifiers.v1.trace import AgentInfo, Trace, TraceTask
 from verifiers.v1.types import Messages, Request, Response, SystemMessage, UserMessage
+from verifiers.v1.utils.artifacts import collect
 from verifiers.v1.utils.decorators import discover_decorated, invoke
 
 logger = logging.getLogger(__name__)
@@ -69,6 +70,7 @@ class Rollout:
         interception: Interception | None = None,
         runtime: Runtime | None = None,
         on_trace: Callable[[Trace], None] | None = None,
+        collect_artifacts: bool = False,
     ) -> None:
         self.task = task
         self.harness = harness
@@ -81,6 +83,7 @@ class Rollout:
         self._interception = interception
         self.runtime = runtime
         self._borrowed_runtime = runtime
+        self._collect_artifacts = collect_artifacts
         self.trace: Trace = Trace(
             task=TraceTask(
                 type=type(task).__name__,
@@ -466,12 +469,14 @@ class Rollout:
             if not self._failed and self._opened:
                 trace.timing.finalize.start = time.time()
                 async with boundary(TaskError, "task finalize"):
-                    await asyncio.wait_for(
-                        invoke(
+                    async with asyncio.timeout(self._timeouts.finalize):
+                        await invoke(
                             self.task.finalize, {"trace": trace, "runtime": runtime}
-                        ),
-                        self._timeouts.finalize,
-                    )
+                        )
+                        if self._collect_artifacts and not trace.state.artifacts:
+                            trace.state.artifacts = await collect(
+                                runtime, self.task.data.artifacts
+                            )
                 now = time.time()
                 trace.timing.finalize.end = now
                 trace.timing.scoring.start = now

{verifiers-0.3.2.dev30 → verifiers-0.3.2.dev32}/verifiers/v1/utils/artifacts.py

@@ -1,9 +1,11 @@
-"""Artifact collection and restoration across runtimes."""
+"""Bounded, validated artifact collection and restoration across runtimes."""
 
 from __future__ import annotations
 
+import io
 import logging
 import shlex
+import tarfile
 import uuid
 from pathlib import PurePosixPath
 from typing import TYPE_CHECKING
@@ -110,7 +112,12 @@ async def collect(
 
 
 async def restore(runtime: Runtime, collected: dict[str, bytes | None]) -> None:
-    """Extract `collected` in `runtime` at the original absolute paths."""
+    """Extract `collected` in `runtime` at the original absolute paths.
+
+    Archive bytes are untrusted: the agent controls both their source files and the
+    runtime tooling that creates them. Every archive is therefore validated on the host
+    before the grading runtime is changed. Only regular files and directories travel.
+    """
     if not collected:
         return
     # Restoring into the subprocess runtime would extract absolute paths onto the
@@ -120,6 +127,8 @@ async def restore(runtime: Runtime, collected: dict[str, bytes | None]) -> None:
             "refusing to restore artifacts into the subprocess runtime: extraction "
             "writes to absolute paths on the host. Grade in a container."
         )
+    for root, archive in collected.items():
+        _validate_restore(root, archive)
     # Clear every root up front, not per entry: a later nested root would otherwise
     # delete content an earlier one just restored. Clearing also drops any file or
     # symlink the image left at the target.
@@ -141,23 +150,16 @@ async def _tar_out(runtime: Runtime, artifact: Artifact, budget: int) -> bytes:
     path = f"/tmp/vf-artifact-{uuid.uuid4().hex}.tar"
     excludes = " ".join(f"--exclude={shlex.quote(p)}" for p in artifact.exclude)
     try:
+        # macOS tar otherwise adds AppleDouble sidecars next to a directory root.
         await _run(
             runtime,
-            f"tar -cf {shlex.quote(path)} -C / {excludes} -- "
+            f"COPYFILE_DISABLE=1 tar -cf {shlex.quote(path)} -C / {excludes} -- "
             f"{shlex.quote(artifact.source.lstrip('/'))}",
             f"collect artifact {artifact.source!r}",
         )
-        # Size it in the box: an oversized collection is refused before it reaches host
-        # memory, not after.
-        sized = await runtime.run(["sh", "-c", f"wc -c < {shlex.quote(path)}"], {})
-        if (raw := sized.stdout.strip()).isdigit() and int(raw) > budget:
-            raise RuntimeError(
-                f"artifact {artifact.source!r} takes the collection over the "
-                f"{MAX_ARTIFACT_BYTES} byte limit. The grading box boots from the "
-                "agent's image, so only the delta needs to travel — narrow the source "
-                "or add `exclude` patterns."
-            )
-        return await runtime.read(path)
+        # The runtime enforces the remaining collection budget while transferring the
+        # bytes, so replacing or growing the archive cannot race a separate size probe.
+        return await runtime.read(path, max_bytes=budget)
     finally:
         # Best-effort: the box is about to be destroyed and the name is unique per call.
         try:
@@ -166,6 +168,43 @@ async def _tar_out(runtime: Runtime, artifact: Artifact, budget: int) -> bytes:
             logger.debug("failed to remove %s", path, exc_info=True)
 
 
+def _validate_restore(root: str, archive: bytes | None) -> None:
+    """Reject archive content that could restore outside its declared root."""
+    root_path = PurePosixPath(root)
+    if (
+        root_path.anchor != "/"
+        or ".." in root_path.parts
+        or root_path == PurePosixPath("/")
+    ):
+        raise RuntimeError(
+            f"artifact root {root!r} must be an absolute path below '/' with no '..'"
+        )
+    if archive is None:
+        return
+
+    try:
+        with tarfile.open(fileobj=io.BytesIO(archive), mode="r:") as tar:
+            for member in tar:
+                member_path = PurePosixPath(member.name)
+                destination = PurePosixPath("/") / member_path
+                if (
+                    not member.name
+                    or member_path.is_absolute()
+                    or ".." in member_path.parts
+                    or not destination.is_relative_to(root_path)
+                ):
+                    raise RuntimeError(
+                        f"artifact member {member.name!r} is outside declared root "
+                        f"{root!r}"
+                    )
+                if not (member.isfile() or member.isdir()):
+                    raise RuntimeError(
+                        f"artifact member {member.name!r} is a link or special file"
+                    )
+    except tarfile.TarError as exc:
+        raise RuntimeError(f"unreadable artifact archive for {root!r}: {exc}") from exc
+
+
 async def _run(runtime: Runtime, command: str, action: str) -> None:
     result = await runtime.run(["sh", "-c", command], {})
     if result.exit_code: