Pmj&LdZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZmZmZmZejeZe dz Zdefd Zdefd Zdefd Zd eddfd ZdefdZdefdZejZddededefdZ GddeZ!dS)aSingularity/Apptainer persistent container environment. Security-hardened with --containall, --no-home, capability dropping. Supports configurable resource limits and optional filesystem persistence via writable overlay directories that survive across sessions. N)Path)Optional)get_hermes_home)BaseEnvironment_load_json_store _popen_bash_save_json_storezsingularity_snapshots.jsonreturncxtjdrdStjdrdStd)z/Locate the apptainer or singularity CLI binary. apptainer singularityzNeither 'apptainer' nor 'singularity' was found in PATH. Install Apptainer (https://apptainer.org/docs/admin/main/installation.html) or Singularity and ensure the CLI is available.)shutilwhich RuntimeErrorD/home/thesage/.hermes/hermes-agent/tools/environments/singularity.py_find_singularity_executablersG |K  { |M""}  :  rc t} tj|dgdddddtj}nB#t$rt d|dtj$rt d |d wxYw|jd kr>|j d d }t d |d|jd||S)z?Preflight check: resolve the executable and verify it responds.versionTutf-8replace capture_outputtextencodingerrorstimeoutstdinz"Singularity backend selected but 'z' could not be executed.'z version' timed out.rNz version' failed (exit code z): ) r subprocessrunDEVNULLFileNotFoundErrorrTimeoutExpired returncodestderrstrip)exeresultr)s r_ensure_singularity_availabler-+s & ( (C : ) TwW`jl$        N N N N     $:::8s888999:A$$&&tt,^s^^@Q^^V\^^___ Js '8?A7c*ttSN)r_SNAPSHOT_STORErrr_load_snapshotsr1@s O , ,,rdatac0tt|dSr/)r r0)r2s r_save_snapshotsr4Ds_d+++++rctjd}|r(t|}|dd|Sddlm}|dz }td}|rntj|tjrO|tjdd z d z }|ddt d ||S|dd|S) NTERMINAL_SCRATCH_DIRTparentsexist_okr)get_sandbox_dirr z/scratchUSERhermesz hermes-agentz Using /scratch for sandboxes: %s) osgetenvrmkdirtools.environments.baser:existsaccessW_OKloggerinfo)custom_scratch scratch_pathr:sandboxscratch user_scratchs r_get_scratch_dirrKHsY566NN++ 4$777777777o-/G:G~~BIgrw7768!rr?rK) cache_dir cache_pathrIs r_get_apptainer_cache_dirrP]sx .//I)__ 555  G<'JTD111 rr image executablec ,|dr#t|r|S|ds|S|dddddd}t }||dz }|rt |St5|rt |cdddSt dt d|t d ||d z }| d d d dl m }|dd}t ||d<t ||d< tj|dt ||gd d ddd|tj}|jd krPtdtd|jdd|cdddSt dt |cdddS#tj$rStd|r||cYcdddSt*$r3} td| |cYd} ~ cdddSd} ~ wwxYw#1swxYwYdS)Nz.sifz docker:///-:z&Building SIF image (one-time setup)...z Source: %sz Target: %stmpTr7r)build_subprocess_envF) scrub_secretsinherit_profile_homeAPPTAINER_TMPDIRrMbuildrriX)rrrrrenvr z/SIF build failed, falling back to docker:// URLz Error: %sizSIF image built successfullyz2SIF build timed out, falling back to docker:// URLz2SIF build error: %s, falling back to docker:// URL)endswithrrA startswithrrPstr_sif_build_lockrDrEr?tools.environments.localrYr#r$r%r(warningr)r'unlink Exception) rQrR image_namerNsif_pathtmp_dirrYr^r,es r_get_or_build_sifrkls ~~f$u++"4"4"6"6   K ( ( {B//77SAAII#sSSJ(**Ij....H8}} %% ??   !x==%%%%%%%%  <=== NE*** NH---e# dT 222 BAAAAA""USSS"%g,, $' NN ! ^Wc(mmU;#$\_eh (F  A%%PQQQ}fmDSD.ABBB7%%%%%%%%8 KK6 7 7 7x==;%%%%%%%%<(    NNO P P P   "!!!LLE%%%%%%%%F    NNOQR S S SLLLLLK%%%%%%%%F G%%%%%%%%%%sW#L >B#L "BI)4(I))AL<L  LL/L0L LL  L L ceZdZdZ ddeded ed ed ed ed edeffd ZdZ dddddeded ededzde j f dZ dZ xZS)SingularityEnvironmentaHardened Singularity/Apptainer container with resource limits and persistence. Spawn-per-call: every execute() spawns a fresh ``apptainer exec ... bash -c`` process. Session snapshot preserves env vars across calls. CWD persists via in-band stdout markers. ~<rFdefaultrQcwdrcpumemorydiskpersistent_filesystemtask_idc Lt||t|_t ||j|_dt jjdd|_ d|_ ||_ ||_ d|_ ||_||_|j rQt!dz } | dd| d|z |_ |j dd||dS) N)rqrhermes_ Fzhermes-overlaysTr7zoverlay-)super__init__r-rRrkrQuuiduuid4hex instance_id_instance_started _persistent_task_id _overlay_dir_cpu_memoryrKr?_start_instance init_session) selfrQrqrrrrsrtrurv overlay_base __class__s rr{zSingularityEnvironment.__init__s# S'222799&udo>> !;!;!;F;@!$+/,,,C,4,,!Dj,4>4D,,,, '''''''rrm)r )"rloggingr=rr# threadingr|pathlibrtypingrhermes_constantsrr@rrrr getLoggerrrDr0rarr-dictr1r4rKrPLockrbrkrmrrrrs   ,,,,,,  8 $ $!/##&BB c    s*-----,$,4,,,,$* $    !).""22S2c2C2222jk'k'k'k'k'_k'k'k'k'k'r