diff --git a/strix/config/settings.py b/strix/config/settings.py index c6f6572f..78bcec9d 100644 --- a/strix/config/settings.py +++ b/strix/config/settings.py @@ -1,161 +1,60 @@ -r^fئ{O,y'vî"""Strix application settings — pydantic-settings powered.""" - -from __future__ import annotations - -from typing import Literal - -from pydantic import AliasChoices, Field -from pydantic_settings import BaseSettings, SettingsConfigDict - - -ReasoningEffort = Literal["none", "minimal", "low", "medium", "high", "xhigh", "max"] - -DEFAULT_MAX_TURNS = 500 - -_BASE_CONFIG = SettingsConfigDict( - case_sensitive=False, - populate_by_name=True, - extra="ignore", -) - - -class LlmSettings(BaseSettings): - model_config = _BASE_CONFIG - - model: str | None = Field(default=None, alias="STRIX_LLM") - api_key: str | None = Field( - default=None, - validation_alias=AliasChoices("LLM_API_KEY", "OPENAI_API_KEY"), - repr=False, - ) - api_base: str | None = Field( - default=None, - validation_alias=AliasChoices( - "LLM_API_BASE", - "OPENAI_API_BASE", - "OPENAI_BASE_URL", - "LITELLM_BASE_URL", - "OLLAMA_API_BASE", - ), - ) - extra_headers: dict[str, str] | None = Field( - default=None, - alias="LLM_EXTRA_HEADERS", - repr=False, - ) - reasoning_effort: ReasoningEffort = Field(default="high", alias="STRIX_REASONING_EFFORT") - force_required_tool_choice: bool = Field( - default=False, - alias="STRIX_FORCE_REQUIRED_TOOL_CHOICE", - ) - prompt_cache: bool = Field( - default=True, - alias="STRIX_PROMPT_CACHE", - ) - disable_streaming: bool = Field( - default=False, - alias="LLM_DISABLE_STREAMING", - ) - timeout: int = Field(default=300, alias="LLM_TIMEOUT") - stream_idle_timeout: int = Field(default=300, ge=0, alias="LLM_STREAM_IDLE_TIMEOUT") - max_tool_calls_per_turn: int = Field( - default=32, - ge=0, - alias="LLM_MAX_TOOL_CALLS_PER_TURN", - ) - - -class DedupeSettings(BaseSettings): - model_config = _BASE_CONFIG - - model: str | None = Field(default=None, alias="STRIX_DEDUPE_MODEL") - reasoning_effort: ReasoningEffort | None = Field( - default=None, - alias="STRIX_DEDUPE_REASONING_EFFORT", - ) - api_key: str | None = Field(default=None, alias="DEDUPE_LLM_API_KEY", repr=False) - api_base: str | None = Field(default=None, alias="DEDUPE_LLM_API_BASE") - extra_headers: dict[str, str] | None = Field( - default=None, - alias="DEDUPE_LLM_EXTRA_HEADERS", - repr=False, - ) - - -class ContextSettings(BaseSettings): - """Context-window management: per-tool-output caps and history compaction.""" - - model_config = _BASE_CONFIG - - auto_compact: bool = Field(default=True, alias="STRIX_CONTEXT_AUTO_COMPACT") - compact_buffer_tokens: int = Field(default=20_000, gt=0, alias="STRIX_CONTEXT_BUFFER_TOKENS") - keep_tokens: int = Field(default=8_000, gt=0, alias="STRIX_CONTEXT_KEEP_TOKENS") - fallback_context_tokens: int = Field( - default=200_000, gt=0, alias="STRIX_CONTEXT_FALLBACK_TOKENS" - ) - summary_max_tokens: int = Field(default=4_096, gt=0, alias="STRIX_CONTEXT_SUMMARY_TOKENS") - tool_output_max_tokens: int = Field(default=8_000, gt=0, alias="STRIX_TOOL_OUTPUT_MAX_TOKENS") - tool_output_max_lines: int = Field(default=2_000, gt=0, alias="STRIX_TOOL_OUTPUT_MAX_LINES") - # Floor above the truncation-notice size so a preview always fits. - tool_output_max_bytes: int = Field( - default=50 * 1024, ge=1024, alias="STRIX_TOOL_OUTPUT_MAX_BYTES" - ) - - -class RuntimeSettings(BaseSettings): - model_config = _BASE_CONFIG - - image: str = Field( - default="ghcr.io/usestrix/strix-sandbox:1.3.0", - alias="STRIX_IMAGE", - ) - image_pull_policy: Literal["auto", "never"] = Field( - default="auto", - alias="STRIX_IMAGE_PULL_POLICY", - ) - backend: str = Field(default="docker", alias="STRIX_RUNTIME_BACKEND") - caido_boot_wait_s: int = Field(default=300, gt=0, alias="STRIX_CAIDO_BOOT_WAIT_S") - # Max screenshot/image tool outputs kept live per agent context (0 = none). - max_context_images: int = Field(default=3, ge=0, alias="STRIX_MAX_CONTEXT_IMAGES") - - -class TelemetrySettings(BaseSettings): - model_config = _BASE_CONFIG - - enabled: bool = Field(default=True, alias="STRIX_TELEMETRY") - - -class IntegrationSettings(BaseSettings): - model_config = _BASE_CONFIG - - perplexity_api_key: str | None = Field( - default=None, - alias="PERPLEXITY_API_KEY", - repr=False, - ) - postman_api_key: str | None = Field( - default=None, - alias="POSTMAN_API_KEY", - repr=False, - ) - - -class ViewerSettings(BaseSettings): - model_config = _BASE_CONFIG - - # Base URL of the Strix relay the local viewer proxies to for email - # verification and encrypted report delivery. The browser never talks to - # the relay directly; the local server is the only caller. - app_url: str = Field(default="https://app.strix.ai", alias="STRIX_APP_URL") - - -class Settings(BaseSettings): - model_config = _BASE_CONFIG - - llm: LlmSettings = Field(default_factory=LlmSettings) - dedupe: DedupeSettings = Field(default_factory=DedupeSettings) - runtime: RuntimeSettings = Field(default_factory=RuntimeSettings) - context: ContextSettings = Field(default_factory=ContextSettings) - telemetry: TelemetrySettings = Field(default_factory=TelemetrySettings) - integrations: IntegrationSettings = Field(default_factory=IntegrationSettings) - viewer: ViewerSettings = Field(default_factory=ViewerSettings) +r^fئ{[rݰ뭦H^\X][ۈ][8%Y[X\][\Y Hٝ]\W[\ܝ[][ۜ‚H\[[\ܝ]\[HY[X[\ܝ[X\X\Y[HY[X][[\ܝ\T][][ۙYXX\ۚ[YܝH]\[țۙHZ[[X[ȋYY][HYYX^BQUSPVTH L АTWӑQH][ۙYX +\W[]]OQ[K[]W؞Wۘ[YOUYK^OHYۛܙHB\T][\T][N[[ۙYHАTWӑQ‚[[ۙHHY[ +Y][SۙK[X\HVHB\W^NۙHHY[ +Y][SۙK[Y][ۗ[X\P[X\X\WTWVHSRWTWVHK\Q[K +B\Wؘ\NۙHHY[ +Y][SۙK[Y][ۗ[X\P[X\X\WTWАTHSRWTWАTHSRWАTWTUSWАTWTSPWTWАTH +K +B^WXY\ΈXHۙHHY[ +Y][SۙK[X\HWVWPQTȋ\Q[K +BX\ۚ[YܝX\ۚ[YܝHY[ +Y][HY[X\HVԑPTӒSQԕBܘWܙ\]Z\YXNHY[ +Y][Q[K[X\HVѓԐWԑTURTQPH +B\XNHY[ +Y][UYK[X\HVTPH +B\XWX[Z[ΈHY[ +Y][Q[K[X\HWTPWPSRSȋ +B[Y[][HY[ +Y][L [X\HWSQSUBX[WYW[Y[][HY[ +Y][L OL [X\HWPSWQWSQSUBX^[\\[HY[ +Y][L̋OL [X\HWPVSTT +B\Y\T][\T][N[[ۙYHАTWӑQ‚[[ۙHHY[ +Y][SۙK[X\HVQTWSSBX\ۚ[YܝX\ۚ[YܝۙHHY[ +Y][SۙK[X\HVQTWԑPTӒSQԕ +B\W^NۙHHY[ +Y][SۙK[X\HQTWWTWVH\Q[JB\Wؘ\NۙHHY[ +Y][SۙK[X\HQTWWTWАTHB^WXY\ΈXHۙHHY[ +Y][SۙK[X\HQTWWVWPQTȋ\Q[K +B\۝^][\T][N۝^ ][X[Y[Y[\] []]\[\ܞH\X[ۋ[[ۙYHАTWӑQ‚]]\XHY[ +Y][UYK[X\HVӕVUUTPB\X؝Y\[Έ[HY[ +Y][L L [X\HVӕVЕQTSȊBY\[Έ[HY[ +Y][N L [X\HVӕVQTSȊB[X۝^[Έ[HY[ +Y][L  L [X\HVӕVѐSPSȂ +B[[X\WX^[Έ[HY[ +Y][MML [X\HVӕVSSPTWSȊB]]X^[Έ[HY[ +Y][N L [X\HVUUPVSȊB]]X^[\Έ[HY[ +Y][L L [X\HVUUPVSTȊB܈XݙHH[][ۋ[XH^HH]Y][^\]˂]]X^؞]\Έ[HY[ +Y][ML + L OLL [X\HVUUPVЖUTȂ +B\[[YT][\T][N[[ۙYHАTWӑQ‚[XYNHY[ +Y][H܋[\\^ ^ \[Kˌ[X\HVSPQH +B[XYW[XN]\[Ș]]ȋ]\HHY[ +Y][H]]ȋ[X\HVSPQWSPH +BX[HY[ +Y][H\[X\HVԕSSQWАPSBZY؛Z]Έ[HY[ +Y][L L [X\HVRQГRUȊBX^ܙY[ [XYH]]\]H\Y[۝^ + HۙJKX^۝^[XY\Έ[HY[ +Y][LOL [X\HVPVӕVSPQTȊB\[[Y]T][\T][N[[ۙYHАTWӑQ‚[XYHY[ +Y][UYK[X\HVSSQUHB\[Yܘ][۔][\T][N[[ۙYHАTWӑQ‚\^]W\W^NۙHHY[ +Y][SۙK[X\HTVUWTWVH\Q[K +BX[\W^NۙHHY[ +Y][SۙK[X\HPSTWVH\Q[K +B\Y]\][\T][N[[ۙYHАTWӑQ‚\HTوH^[^HH[Y]\Y\܈[XZ[\YX][ۈ[[ܞ\Y\ܝ[]\KH\]\[ˆH[^H\XNH[\\\HۛH[\\\HY[ +Y][H΋\ ^ ZH[X\HVTTB\][\T][N[[ۙYHАTWӑQ‚NT][HY[ +Y][٘XܞOST][BY\NY\T][HY[ +Y][٘XܞOQY\T][B[[YN[[YT][HY[ +Y][٘XܞOT[[YT][B۝^۝^][HY[ +Y][٘XܞOP۝^][B[[Y]N[[Y]T][HY[ +Y][٘XܞOU[[Y]T][B[Yܘ][ۜΈ[Yܘ][۔][HY[ +Y][٘XܞOR[Yܘ][۔][BY]\Y]\][HY[ +Y][٘XܞOUY]\][B \ No newline at end of file diff --git a/strix/interface/environment.py b/strix/interface/environment.py index 4e6379d5..8f6b3a03 100644 --- a/strix/interface/environment.py +++ b/strix/interface/environment.py @@ -1,115 +1,224 @@ -r^fئ{[rݰ뭦H\\[\ۛY[[Y][ۈ[\[XYHX[Y[Y[ [\ܝ[š[\ܝ][[\ܝ\‚HX ۜH[\ܝۜBHX [[[\ܝ[[HX ^[\ܝ^H^ ۙY[\ܝ^ Y][™H^ [\XK][[\ܝ -X\ۛX[ۋ[XYW^\\[[KB\H[˙]\ۘ[YWBY[Y]W[\ۛY[ +r^fئ{O,y'vî"""Startup environment validation and Docker image management.""" -H OۙN\[[Y][[\ۛY[BۜHHۜJ -BZ\[ܙ\]Z\Yݘ\HBZ\[[ۘ[ݘ\HB][HY][ -BY^ Xܚ\[ۗ[[ -][˛K[[ -NY^ \]][X]Y +import logging +import shutil +import sys -NۜK[ -ܙYTVO^][˛K[[H\\[\]Xܚ\[ۋ][IܙHYۙY[H[X[\^]][]H\  -B\˙^] - JB\[[\ۛY[ -]Xܚ\[ۊHB]\Y][˛K[[Z\[ܙ\]Z\Yݘ\˘\[ -VHBY][˛K\W^NZ\[[ۘ[ݘ\˘\[ -WTWVHBY][˛K\Wؘ\NZ\[[ۘ[ݘ\˘\[ -WTWАTHBY][˚[Yܘ][ۜ˜\^]W\W^NZ\[[ۘ[ݘ\˘\[ -TVUWTWVHBYZ\[ܙ\]Z\Yݘ\΂\ܗ^H^ +from rich.console import Console +from rich.panel import Panel +from rich.text import Text -B\ܗ^ \[ -RTSTURTQSTӓQSTPPTȋ[OHYB\ܗ^ \[ -[OH]HB܈\[Z\[ܙ\]Z\Yݘ\΂\ܗ^ \[ -(ݘ\H[OHY[ȊB\ܗ^ \[ -\][OH]HBYZ\[[ۘ[ݘ\΂\ܗ^ \[ -[ۘ[[\ۛY[\XX\Η[OH[H]HB܈\[Z\[[ۘ[ݘ\΂\ܗ^ \[ -(ݘ\H[OH[HY[ȊB\ܗ^ \[ -\][OH[H]HB\ܗ^ \[ -\]Z\Y[\ۛY[\XX\Η[OH]HB܈\[Z\[ܙ\]Z\Yݘ\΂Y\OHVH\ܗ^ \[ -([OH]HB\ܗ^ \[ -VH[OHX[B\ܗ^ \[ - H[[H\H -Kˋ [ZK MK ܈[X]YK[\M MW[OH]H -BYZ\[[ۘ[ݘ\΂\ܗ^ \[ -[ۘ[[\ۛY[\XX\Η[OH]HB܈\[Z\[[ۘ[ݘ\΂Y\OHWTWАTH\ܗ^ \[ -([OH]HB\ܗ^ \[ -WTWАTH[OHX[B\ܗ^ \[ - H\HTH\HTY\[[[[ -Kˋ[XKTY[W[OH]H -B[Y\OHTVUWTWVH\ܗ^ \[ -([OH]HB\ܗ^ \[ -TVUWTWVH[OHX[B\ܗ^ \[ - HTH^H܈\^]HRHXX\ -[X\X[ ][YH\X\ -W[OH]H -B[Y\OHVԑPTӒSQԕ\ܗ^ \[ -([OH]HB\ܗ^ \[ -VԑPTӒSQԕ[OHX[B\ܗ^ \[ - HX\ۚ[Yܝ][ۙKZ[[X[ YY][KY Y X^ -Y][Y -W[OH]H -B\ܗ^ \[ -^[\H]\[OH]HB\ܗ^ \[ -^ܝVOI[ZK MK [OH[H]HBYZ\[[ۘ[ݘ\΂܈\[Z\[[ۘ[ݘ\΂Y\OHWTWАTH\ܗ^ \[ -^ܝWTWАTOI[LM YYY܈[[[ۛW[OH[H]H -B[Y\OHTVUWTWVH\ܗ^ \[ -^ܝTVUWTWVOI[\\\^]KZ^KZ\I[OH[H]H -B[Y\OHVԑPTӒSQԕ\ܗ^ \[ -^ܝVԑPTӒSQԕIY [OH[H]H -B[[H[[ -\ܗ^ ]OH؛]WTV]W[YۏHYܙ\[OHYY[J K K -B\XYZ\[\]Z\Y[\Έ \ȋZ\[ܙ\]Z\Yݘ\BۜK[ -BۜK[ -[[ -BۜK[ +from strix.config import codex, load_settings +from strix.interface.utils import ( + check_docker_connection, + image_exists, + process_pull_line, +) -B\˙^] - JB\[[\ۛY[ -[ۘ[Z\[Έ \HZ\[[ۘ[ݘ\܈ۙH -BYX\[[Y -H OۙNY][ X -\H\ۙN\XY\H[[UBۜHHۜJ -B\ܗ^H^ +logger = logging.getLogger(__name__) -B\ܗ^ \[ -TSSQ[OHYB\ܗ^ \[ -[OH]HB\ܗ^ \[ -H \H\[[[\U [OH]HB\ܗ^ \[ -X\H[[\[[\HH \[X[\]Z[XK[OH]H -B[[H[[ -\ܗ^ ]OH؛]WTV]W[YۏHYܙ\[OHYY[J K K -BۜK[ -[[ B\˙^] - JB\XY\H\[BY[\[XYJ -H OۙNH\\ܜ[\ܝ\^\[ۂۜHHۜJ -BY[HX\ۛX[ۊ -B[[YHHY][ -K[[YB[XYHH[[YK[XYBY[XYW^\Y[ [XYJN\XY\[XYH[XYH\[[N \ȋ[XYJB]\Y[[YK[XYW[XHOH]\Z\H[[YQ\܊\[XYH[XYH\H\]Z[XH[H[VSPQWSPO[]\ܘY[[] -B\[[[\[XYN \ȋ[XYJBۜK[ -BۜK[ -[WT[[[XYVH[XY_HBۜK[ -[HY[U\ۛH\[ۈ\[[X^HZHH]Z[]\ˋHBۜK[ +def validate_environment() -> None: + logger.info("Validating environment") + console = Console() + missing_required_vars = [] + missing_optional_vars = [] -B]ۜK]\؛X[QۛY[[XYH^Y\ˋ[\HȊH\]\΂N^Y\[ΈXHHB\\]HH܈[H[Y[ \K[ -[XYKX[OUYKXOUYJN\\]HH\[[J[K^Y\[]\\\]JB^\\^\[ۈ\N\XYZ[Y[\[XYH \ȋ[XYK^[UYJBۜK[ + settings = load_settings() -B\ܗ^H^ + if codex.subscription_model(settings.llm.model): + if not codex.is_authenticated(): + console.print( + f"[red]STRIX_LLM={settings.llm.model} uses your ChatGPT subscription, " + "but you're not signed in.[/] Run [cyan]strix auth login chatgpt[/] first." + ) + sys.exit(1) + logger.info("Environment OK (ChatGPT subscription)") + return -B\ܗ^ \[ -RSQSSPQH[OHYB\ܗ^ \[ -[OH]HB\ܗ^ \[ -[ۛY[XY_W[OH]HB\ܗ^ \[ -JK[OH[HYB[[H[[ -\ܗ^ ]OH؛]WTV]W[YۏHYܙ\[OHYY[J K K -BۜK[ -[[ B\˙^] - JB\[\[XYH \XYH[XYJBX\^H^ + if not settings.llm.model: + missing_required_vars.append("STRIX_LLM") -BX\^ \[ -\[XYHXYH[OȞMYHBۜK[ -X\^ -BۜK[ + if not settings.llm.api_key: + missing_optional_vars.append("LLM_API_KEY") -B \ No newline at end of file + if not settings.llm.api_base: + missing_optional_vars.append("LLM_API_BASE") + + if not settings.integrations.perplexity_api_key: + missing_optional_vars.append("PERPLEXITY_API_KEY") + + if missing_required_vars: + error_text = Text() + error_text.append("MISSING REQUIRED ENVIRONMENT VARIABLES", style="bold red") + error_text.append("\n\n", style="white") + + for var in missing_required_vars: + error_text.append(f"• {var}", style="bold yellow") + error_text.append(" is not set\n", style="white") + + if missing_optional_vars: + error_text.append("\nOptional environment variables:\n", style="dim white") + for var in missing_optional_vars: + error_text.append(f"• {var}", style="dim yellow") + error_text.append(" is not set\n", style="dim white") + + error_text.append("\nRequired environment variables:\n", style="white") + for var in missing_required_vars: + if var == "STRIX_LLM": + error_text.append("• ", style="white") + error_text.append("STRIX_LLM", style="bold cyan") + error_text.append( + " - Model name to use (e.g., 'openai/gpt-5.4' or " + "'anthropic/claude-opus-4-7')\n", + style="white", + ) + + if missing_optional_vars: + error_text.append("\nOptional environment variables:\n", style="white") + for var in missing_optional_vars: + if var == "LLM_API_BASE": + error_text.append("• ", style="white") + error_text.append("LLM_API_BASE", style="bold cyan") + error_text.append( + " - Custom API base URL if using local models (e.g., Ollama, LMStudio)\n", + style="white", + ) + elif var == "PERPLEXITY_API_KEY": + error_text.append("• ", style="white") + error_text.append("PERPLEXITY_API_KEY", style="bold cyan") + error_text.append( + " - API key for Perplexity AI web search (enables real-time research)\n", + style="white", + ) + elif var == "STRIX_REASONING_EFFORT": + error_text.append("• ", style="white") + error_text.append("STRIX_REASONING_EFFORT", style="bold cyan") + error_text.append( + " - Reasoning effort level: none, minimal, low, medium, high, xhigh, " + "max (default: high)\n", + style="white", + ) + + error_text.append("\nExample setup:\n", style="white") + error_text.append("export STRIX_LLM='openai/gpt-5.4'\n", style="dim white") + + if missing_optional_vars: + for var in missing_optional_vars: + if var == "LLM_API_BASE": + error_text.append( + "export LLM_API_BASE='http://localhost:11434' " + "# needed for local models only\n", + style="dim white", + ) + elif var == "PERPLEXITY_API_KEY": + error_text.append( + "export PERPLEXITY_API_KEY='your-perplexity-key-here'\n", style="dim white" + ) + elif var == "STRIX_REASONING_EFFORT": + error_text.append( + "export STRIX_REASONING_EFFORT='high'\n", + style="dim white", + ) + + panel = Panel( + error_text, + title="[bold white]STRIX", + title_align="left", + border_style="red", + padding=(1, 2), + ) + + logger.debug("Missing required env vars: %s", missing_required_vars) + console.print("\n") + console.print(panel) + console.print() + sys.exit(1) + logger.info( + "Environment OK (optional missing: %s)", + missing_optional_vars or "none", + ) + + +def check_docker_installed() -> None: + if shutil.which("docker") is None: + logger.debug("Docker CLI not found in PATH") + console = Console() + error_text = Text() + error_text.append("DOCKER NOT INSTALLED", style="bold red") + error_text.append("\n\n", style="white") + error_text.append("The 'docker' CLI was not found in your PATH.\n", style="white") + error_text.append( + "Please install Docker and ensure the 'docker' command is available.\n\n", style="white" + ) + + panel = Panel( + error_text, + title="[bold white]STRIX", + title_align="left", + border_style="red", + padding=(1, 2), + ) + console.print("\n", panel, "\n") + sys.exit(1) + logger.debug("Docker CLI present") + + +def pull_docker_image() -> None: + from docker.errors import DockerException + + console = Console() + client = check_docker_connection() + + runtime = load_settings().runtime + image = runtime.image + + if image_exists(client, image): + logger.debug("Docker image already present locally: %s", image) + return + + if runtime.image_pull_policy == "never": + raise RuntimeError( + f"Docker image {image!r} is not available locally and " + "STRIX_IMAGE_PULL_POLICY=never forbids pulling it" + ) + + logger.info("Pulling docker image: %s", image) + console.print() + console.print(f"[dim]Pulling image[/] {image}") + console.print("[dim yellow]This only happens on first run and may take a few minutes...[/]") + console.print() + + with console.status("[bold cyan]Downloading image layers...", spinner="dots") as status: + try: + layers_info: dict[str, str] = {} + last_update = "" + + for line in client.api.pull(image, stream=True, decode=True): + last_update = process_pull_line(line, layers_info, status, last_update) + + except DockerException as e: + logger.debug("Failed to pull docker image %s", image, exc_info=True) + console.print() + error_text = Text() + error_text.append("FAILED TO PULL IMAGE", style="bold red") + error_text.append("\n\n", style="white") + error_text.append(f"Could not download: {image}\n", style="white") + error_text.append(str(e), style="dim red") + + panel = Panel( + error_text, + title="[bold white]STRIX", + title_align="left", + border_style="red", + padding=(1, 2), + ) + console.print(panel, "\n") + sys.exit(1) + + logger.info("Docker image %s ready", image) + success_text = Text() + success_text.append("Docker image ready", style="#22c55e") + console.print(success_text) + console.print() diff --git a/strix/runtime/backends.py b/strix/runtime/backends.py index 5398ed8b..7bc9b9e2 100644 --- a/strix/runtime/backends.py +++ b/strix/runtime/backends.py @@ -1,107 +1,31 @@ -r^fئ{O,y'vî"""Sandbox backend registry — selected via STRIX_RUNTIME_BACKEND (default: docker).""" +r^fئ{[rݰ뭦H[X[Y\H8%[XYXHVԕSSQWАPS +Y][\KHٝ]\W[\ܝ[][ۜ‚[\ܝ[™HX[ۜ˘X[\ܝ]Z]XK[XBH\[[\ܝTWPS[BYTWPS΂HY[˜[ X[Y\[\ܝX[Y\\H[˙]\ۘ[YWB[X[H[XVˋ]Z]XV\V[K[WWWB\[Y\ؘX[ + +[XYNX[Y\X[Y\ ^YܝΈ\V[  K[[[Έ\X[WWHۙHHۙKH O\V[K[WN[\H\[ۈXYHH[\Y[[ۋ\\\Θ^\[Y[[XUQRS ˆUԐU\ + \[\[ Y]]^K[\ܝˆ\^[H\[]\]HۋQ\X[ۉYYH\\HX\H[[Y \[ۋ\ -from __future__ import annotations +X\]X]\X[^\HX[Y\[H[[ˆ۝Z[\8%HY[ ܙX]J +XۛHZ[H[\\[ۂؚX]]\Z[] \[]\[ێ[[]]^X[Y\\[ۈY][YH^X]HXHY[ []J +XBY\\ -import logging -from collections.abc import Awaitable, Callable -from typing import TYPE_CHECKING, Any +X\[\˂[\ܝ\HY[˜[ [\˙\[\ܝ\[Y[[ۜ‚H^ ۙY˛Y\[\ܝY][ˆH^ [[YK\Y[[\ܝ^\[Y[Y[H^\[Y[ +\W[ +JBY[ ^ؚ[[[H[[[܈BY[ [XYW[XHHY][ +K[[YK[XYW[XB[ۜH\[Y[[ۜ[XYOZ[XYK^YܝY^YܝB\[ۈH]Z]Y[ ܙX]J[ۜ[[ۜX[Y\[X[Y\ +B]Z]\[ۋ\ - -if TYPE_CHECKING: - from agents.sandbox.manifest import Manifest - - -logger = logging.getLogger(__name__) - - -SandboxBackend = Callable[..., Awaitable[tuple[Any, Any]]] - - -async def _docker_backend( - *, - image: str, - manifest: Manifest, - exposed_ports: tuple[int, ...], - bind_mounts: list[dict[str, Any]] | None = None, -) -> tuple[Any, Any]: - """Bring up a session backed by the local Docker daemon. - - Uses :class:`StrixDockerSandboxClient` to inject NET_ADMIN / - NET_RAW caps + ``host.docker.internal`` host-gateway. Imports - ``docker`` lazily so deployments that target a non-Docker - backend don't need the docker-py library installed. - - ``session.start()`` is what materializes the manifest into the running - container — the SDK's ``client.create()`` only builds the inner session - object without applying it. ``async with session:`` would call it too, but - Strix manages session lifetime explicitly via ``client.delete()`` so we - trigger ``start()`` ourselves. - """ - import docker - from agents.sandbox.sandboxes.docker import DockerSandboxClientOptions - - from strix.config.loader import load_settings - from strix.runtime.docker_client import StrixDockerSandboxClient - - client = StrixDockerSandboxClient(docker.from_env()) - client.strix_bind_mounts = bind_mounts or [] - client.image_pull_policy = load_settings().runtime.image_pull_policy - options = DockerSandboxClientOptions(image=image, exposed_ports=exposed_ports) - session = await client.create(options=options, manifest=manifest) - await session.start() - return client, session - - -_BACKENDS: dict[str, SandboxBackend] = { - "docker": _docker_backend, -} - -_BIND_MOUNT_BACKENDS: set[str] = {"docker"} - - -def get_backend(name: str) -> SandboxBackend: - """Return the backend factory for ``name`` or raise. - - Args: - name: Backend identifier (e.g. ``"docker"``). Match is exact; - no fallback. Unknown values raise so config typos surface - immediately instead of silently picking a default. - """ - backend = _BACKENDS.get(name) - if backend is None: - supported = ", ".join(sorted(_BACKENDS)) - raise ValueError( - f"Unknown STRIX_RUNTIME_BACKEND: {name!r} (supported: {supported})", - ) - logger.debug("Selected sandbox backend: %s", name) - return backend - - -def register_backend( - name: str, - backend: SandboxBackend, - *, - supports_bind_mounts: bool = False, -) -> None: - """Register a custom backend under ``name``. - - Intended for downstream users who ship their own runtime — register - before any ``session_manager.create_or_reuse`` call. Re-registering - an existing name overwrites the prior entry. ``supports_bind_mounts`` - defaults to False: a remote runtime cannot see the caller's filesystem, so - it is handed local sources as manifest entries to upload instead. - """ - _BACKENDS[name] = backend - if supports_bind_mounts: - _BIND_MOUNT_BACKENDS.add(name) - else: - _BIND_MOUNT_BACKENDS.discard(name) - logger.info("Registered sandbox backend: %s (bind mounts: %s)", name, supports_bind_mounts) - - -def backend_supports_bind_mounts(name: str) -> bool: - return name in _BIND_MOUNT_BACKENDS - - -def supported_backends() -> list[str]: - return sorted(_BACKENDS) +B]\Y[ \[ۂАPSΈX[X[HHˆ\\ؘX[ BВSSSАPSΈ]HHș\BY]ؘX[ +NH O[X[]\HX[XܞH܈X܈Z\K\΂NX[Y[YY\ +Kˈ\ +KX]\^Xˆ[Xˈ[ۛۈ[Y\Z\HۙY\\XB[[YYX][H[XYو[[HX[HY][ X[HАPS˙] +JBYX[\ۙN\ܝYH[ܝY +АPSJBZ\H[YQ\܊[ۛۈVԕSSQWАPSۘ[YH\H +\ܝY\ܝYJH +B\XY[XY[X[ \ȋJB]\X[YY\\ؘX[ +NX[[X[  +\ܝؚ[[[ΈH[KH OۙNY\\H\HX[[\X [[Y܈ۜX[H\\\Z\ۈ[[YH8%Y\\YܙH[H\[ۗX[Y\ܙX]Wܗܙ]\X[ K\Y\\[ˆ[^\[Hݙ\ܚ]\H[܈[K\ܝؚ[[[Y][[NH[[H[[YH[YHH[\[\\[Kˆ]\[Y[\\\X[Y\[Y\\Y[XY АPSۘ[YWHHX[Y\ܝؚ[[[΂ВSSSАPS˘Y +JB[NВSSSАPS˙\\ +JB\[Y\\Y[X[ \ +[[[Έ \HK\ܝؚ[[[BYX[\ܝؚ[[[NH O]\H[ВSSSАPS‚Y\ܝYؘX[ +H O\N]\ܝY +АPSB \ No newline at end of file diff --git a/strix/runtime/docker_client.py b/strix/runtime/docker_client.py index c70f2d2d..fc3a56e5 100644 --- a/strix/runtime/docker_client.py +++ b/strix/runtime/docker_client.py @@ -1,114 +1,307 @@ -r^fئ{[rݰ뭦H^\[Y[8%\\\H[XYISTS[Y“UQRSӑUԐU\X[]Y\ - Y]]^KH\[Y[ ܙX]W۝Z[\\^HH܂^[[ܙX]W\YܙH۝Z[\˘ܙX]X\[Y HX\˜[Z[\[Y[HY]H\][HHH\K]YB[\΂KH[\[VȝZ[Xݙ\YN\HȝZ[Y]۝[X\[X[[XY \]\[XYIˆ\Y[\[ XX[H[8%]]] ZYXX]\\[YHH۝Z[\[\ZY]Y\YZ[BXYܝ \[UQRSӑUԐU\Y -\]Z\YHX\ \[\]\]KˈY \[\[8 Y]]^H^WBY[[XX \\Y\˂[Y[ZKXY[OL M  [\[H\]Z\\œK[Y\[H\[KX\X[H܈[[X[ۈ˂Hٝ]\W[\ܝ[][ۜ‚[\ܝ۝^X[\ܝ[š[\ܝš[\ܝ]ZYH\[[\ܝ[K]\[ \HY[˜[ \ܜ[\ܝ^Yܝ[]Z[XQ\܂HY[˜[ X[Y\[\ܝX[Y\HY[˜[ [\˙\[\ܝ -\[Y[ \[\[ۋ؝Z[\ݛ[YW[[\ܝ^KX[Y\ܙ\]Z\\ٝ\KX[Y\ܙ\]Z\\\YZ[BHY[˜[ \[ۋ[\[ۈ[\ܝ[\[ۂHY[˜[ \\[\ܝ^Yܝ[[H\[\ܝ\ܜ\\\ܜ\NYۛܙV[\ܝ ][\Y [\Y ZYۛܙWBH\[[˘۝Z[\[\ܝ۝Z[\\NYۛܙV[\ܝ ][\Y [\Y ZYۛܙWBH\\\[\ܝۙY\NYۛܙV[\ܝ ][\Y [\Y ZYۛܙWBH\\\[\ܝ[[\\[[\NYۛܙV[\ܝ ][\Y [\Y ZYۛܙWBH\][[\ܝ\Wܙ\]ܞWY\NYۛܙV[\ܝ ][\Y [\Y ZYۛܙWBH\]Y\˙^\[ۜ[\ܝ\]Y\^\[ۂ\H[˙]\ۘ[YWBSӑUԒSHVTSӑUԒȂY[\W[XYW]Z[XJY[[K[XYN[XN]\[Ș]]ȋ]\KH OۙNYY[ [XYW^\[XYJN]\Y[XHOH]\Z\H[[YQ\܊\[XYH[XYH\H\]Z[XH[H[VSPQWSPO[]\ܘY[[] -B\YH\Wܙ\]ܞWY[XYJBY[ \Y[ [XY\˜[ -\Y]Y܈ۙK[YQ[JBY[ۙ]ܚ -H OۙN[YHH˙[\ۋ] -SӑUԒSK\ +r^fئ{O,y'vî"""StrixDockerSandboxClient — preserves the image's ENTRYPOINT and adds +NET_ADMIN/NET_RAW capabilities + host-gateway. -B]\[YH܈ۙBY\W[ۙ]ܚܙX]W\ΈX[WJH OۙN]ܚH[ۙ]ܚ -BY]ܚ΂ܙX]W\ț]ܚȗHH]ܚˆܙX]W\˜ -ܝȋۙJBY\Wܙ\\W[Z]ܙX]W\ΈX[WJH OۙN\H[ۘ[ܛ\\\H\HH[\ۛY[ [] ؛[ˆ[Y\X]H\Y][ -[[Y -K\\ Z[\ Y[W[Z]H˙[\ۋ] -VSQSWSRUK\ +The SDK's ``DockerSandboxClient._create_container`` does not expose a hook for +extending ``create_kwargs`` before ``containers.create`` is called. We subclass +and reimplement the method body verbatim from the SDK source, with three +deltas: -BYY[W[Z]ܙX]W\țY[W[Z]HHY[W[Z]W^HH˙[\ۋ] -VSWVHK\ +1. Drop the SDK's ``entrypoint=["tail"]`` override; supply ``["tail", "-f", + "/dev/null"]`` as ``command`` instead. This lets our image's + ``docker-entrypoint.sh`` actually run — without it, ``caido-cli`` never + starts inside the container and ``bootstrap_caido`` retries against a + dead port. +2. Append NET_ADMIN/NET_RAW to ``cap_add`` (required by ``nmap -sS`` and + other raw-socket tools). +3. Add ``host.docker.internal`` → host-gateway to ``extra_hosts`` so the + agent can reach host-served apps. -BYW^NܙX]W\ȜW^HHHW^B\H˙[\ۋ] -VSTȋK\ +Pinned to ``openai-agents==0.14.6``. Bumping the SDK requires +re-merging the parent body. Track upstream for an injection hook. +""" -BY\΂]۝^X\\[YQ\܋ݙ\\܊N[\H[ -] -\H - W   -BY [\H H NܙX]W\ț[\ȗHH[\‚Y[Z]H˙[\ۋ] -VSQSRUK\ +from __future__ import annotations -BYY[Z]]۝^X\\[YQ\܊NܙX]W\ȜY[Z]HH[ -Y[Z] -BY\W[Z]ܙX]W\ΈX[WJH OۙN[H۝Z[\ۋY[HH[]^H\[H[ -KˈH]\K[ܚ][] -H[[H\ˆ[ZHH\Y[[ۈۈ]] [ZHHܛ\\XݙK\Y][ -ۊ8%\ۈY][\[[[YۋY[KX\[YH܈[]]ۛ[\Y[]^X]\\]\H[X[ˈX^ Y[X][ۈYX[HۋY\\\ˆX^ \^H -X^ Y[X ]VSPVVX  ٙX]\Y][ X^^HH˙[\ۋ] -VSPVVHLHK\ +import contextlib +import logging +import os +import uuid +from typing import Any, Literal, cast -BYX^^K\ -H[ -ٙۙH[[Z]YN]\X^ٚ[HH˙[\ۋ] -VSPVђSHȊK\ +from agents.sandbox.errors import ExposedPortUnavailableError +from agents.sandbox.manifest import Manifest +from agents.sandbox.sandboxes.docker import ( + DockerSandboxClient, + DockerSandboxSession, + _build_docker_volume_mounts, + _docker_port_key, + _manifest_requires_fuse, + _manifest_requires_sys_admin, +) +from agents.sandbox.session.sandbox_session import SandboxSession +from agents.sandbox.types import ExposedPortEndpoint +from docker import errors as docker_errors # type: ignore[import-untyped, unused-ignore] +from docker.models.containers import Container # type: ignore[import-untyped, unused-ignore] +from docker.types import LogConfig # type: ignore[import-untyped, unused-ignore] +from docker.types import Mount as DockerSDKMount # type: ignore[import-untyped, unused-ignore] +from docker.utils import parse_repository_tag # type: ignore[import-untyped, unused-ignore] +from requests.exceptions import RequestException -H܈ȂܙX]W\țۙYȗHHۙY\OSۙY˝\\˒ӋۙY^țX^ \^HX^^KX^ Y[HX^ٚ[_K -BY\Wܝ[X[ܙX]W\ΈX[WJH OۙN[YH˙][VԕSQBY[Y]\X[HܙX]W\˜]Y][ -X[ȋJBY\[[JX[X -N]\X[Ȝ^ \[ZYHH[Y[\HH˙][VԕSTHBY[\NX[Ȝ^ \[]\HHH[\B\^\[\[ۊ\[\[ۊN[ۙ]ܚΈH\[Yܙ\W^Yܝ -[ܝ[ -H O^Yܝ[[N[۝Z[\[Y -B^\\\ܜːTQ\܈\NZ\H^Yܝ[]Z[XQ\܊ܝ\ܝ ^Yܝ\[]K^YܝX\ۏHX[[]Z[XH۝^^ˆX[\]Z[۝Z[\ܙ[Y٘Z[Y]ܚȎ[[ۙ]ܚK]\OYK -HHB]H]][۝Z[\]ȋJH܈B]ܚH]˙] -]ܚ][ȋJK] -]ܚȋJB[[H]ܚ˙] -[[ۙ]ܚH܈B\H[[ ] -TY\ȊH܈[[ ] -ؘ[TY\ȊBY\[[J\ H܈\Z\H^Yܝ[]Z[XQ\܊ܝ\ܝ ^Yܝ\[]K^YܝX\ۏHX[[]Z[XH۝^^ˆX[\]Z[۝Z[\ۛۗۙ]ܚȋ]ܚȎ[[ۙ]ܚK -BH\WHY[\[H\]\^Yܝ[[ -Z ܝ\ܝ Q[JB\^\[Y[ -\[Y[ -N\XܚY\[ [[[[H۝Z[\]HH\X[YܙHܙX]J -X XX][H\\K\] XYۛ_X ^ؚ[[[Έ\X[WWHۙHHۙB[XYW[XN]\[Ș]]ȋ]\HH]]Ȃ\[YܙX]W۝Z[\[[XYN -X[Y\X[Y\ۙHHۙK^YܝΈ\V[  HH +logger = logging.getLogger(__name__) -K\[ۗY]ZY URQۙHHۙK -H O۝Z[\ KKKKHQSTUSHHو\[Y[ ܙX]W۝Z[\ KKKKBYܘY[[ [\\NM LM - M K[\W[XYW]Z[XJ[[XYK[[XYW[XJB\\[[XYW^\[XYJB[\ۛY[XHۙHHۙBYX[Y\[\ۛY[H]Z]X[Y\ [\ۛY[ \J -B^[HHHN[\[ݙ\YH[\HZ[ Y ]۝[\[X[H[XYIˆSTS -\Y[\[  -H[]\ [^XˆXY\^XZ[ Y ]۝[܈HY\ X[]K]]\ZYXH -H[X۝Z[\H\]\][]X[^Y ܙX]W\ΈX[WHHˆ[XYH[XYK]XYK[X[ȝZ[Y]۝[K[\ۛY[[\ۛY[ BYX[Y\\ۙN\[[H؝Z[\ݛ[YW[[X[Y\ \[ۗY\\[ۗY  -BY\[[΂ܙX]W\ț[[ȗHH\[[ˆYX[Y\ܙ\]Z\\ٝ\JX[Y\ -NܙX]W\˝\]J]X\Vȋ]ٝ\HK\YVȔTQRSKX\]WVȘ\\[܎[ۙ[YK -B[YX[Y\ܙ\]Z\\\YZ[X[Y\ -NܙX]W\˝\]J\YVȔTQRSKX\]WVȘ\\[܎[ۙ[YK -BY^Yܝ΂ܙX]W\ȜܝȗHHˆ\ܝ^Jܝ -N -Lˌ HۙJH܈ܝ[^YܝˆB KKKKHSTUSHH KKKKB^[X[ۜ8%\[ ۉݙ\ܚ]KTKTQRS\]\˂\YHܙX]W\˜]Y][ -\YJBY\[[J\Y \ -N\YH\ -\Y -BܙX]W\Ș\YHH\Y܈\[ -UQRSUԐUȊNY\[\Y\Y \[ -\ -B^WHܙX]W\˜]Y][ -^WȋJB^WȚ \[\[HH Y]]^H\W[ۙ]ܚܙX]W\B\Wܙ\\W[Z]ܙX]W\B\W[Z]ܙX]W\B\Wܝ[X[ܙX]W\B^[X[ێ[\HY\ܝY[\ Y\B\YX[ۈوHYH]ݙ\˂[[[H[^ؚ[[[܈ -BY[[[΂[[HܙX]W\˜]Y][ -[[ȋJB܈X[ܝY -[[[^O[[XHΈȝ\]JK[ -ȊJN[[˘\[ -\[[ -\]\Xȝ\]K\O\XȜ\HK\OH[XYۛO\X˙] -XYۛH[JK -B -B\XYܙX][[۝Z[\[XYOI\\I\^YܝI\ȋ[XYK\Y \ -^YܝK -B۝Z[\H[\Y[ ۝Z[\˘ܙX]J -ܙX]W\B\[[۝Z[\ܙX]YYI\[XYOI\ȋ۝Z[\ܝYY\]۝Z[\ܝYH[Hȋ[XYK -B]\۝Z[\\[YܙX]J[ -\Έ[JH O[\[ێ\[ۈH]Z]\\ -KܙX]J -\B]ܚH[ۙ]ܚ -B[\H\[ۋ[\Y]ܚ[\[[J[\\[\[ۊN[\\H^\[\[ۂ\ -^\[\[ۈ[\K[ۙ]ܚH]ܚˆ]\\[ۂ\[Y[]J[\[ێ[\[ۊH O[\[ێ۝Z[\YH]]]]\[ۋ[\]HۙJK۝Z[\YۙJBY۝Z[\Y\ YYܝ[[ TQ\܈ݙ\HۙH܈[\B۝Z[\\]Y\^\[ۈݙ\HܛYۈY[[ۈ]8%۝Z[\˙] +_SANDBOX_NETWORK_ENV = "STRIX_DOCKER_SANDBOX_NETWORK" -H O[X۝Z[\Z\\\]Y\ˆۛX[ۑ\܋X\HX[و\\ܜːTQ\܂[\\]Y\˔\]Y\^\[ۈ -HX\K]\\\ˆ[TQ\܋[ۛH\\[\X\H[XXX][Y\X\ۈ\YX[H\ YYܝ ]۝^X\\\\ܜ˓[ \\ܜːTQ\܋\]Y\^\[ۂ -N[\Y[ ۝Z[\˙] -۝Z[\Y -K[ -B]\]Z]\\ -K[]J\[ۊB \ No newline at end of file +def _ensure_image_available( + client: Any, + image: str, + pull_policy: Literal["auto", "never"], +) -> None: + if client.image_exists(image): + return + if pull_policy == "never": + raise RuntimeError( + f"Docker image {image!r} is not available locally and " + "STRIX_IMAGE_PULL_POLICY=never forbids pulling it" + ) + repo, tag = parse_repository_tag(image) + client.docker_client.images.pull(repo, tag=tag or None, all_tags=False) + + +def _sandbox_network() -> str | None: + value = os.environ.get(_SANDBOX_NETWORK_ENV, "").strip() + return value or None + + +def _apply_sandbox_network(create_kwargs: dict[str, Any]) -> None: + network = _sandbox_network() + if network: + create_kwargs["network"] = network + create_kwargs.pop("ports", None) + + +def _apply_resource_limits(create_kwargs: dict[str, Any]) -> None: + """Apply optional cgroup resource caps from the environment. Unset/blank + values leave docker's default (unbounded), so this is opt-in per host.""" + mem_limit = os.environ.get("STRIX_SANDBOX_MEM_LIMIT", "").strip() + if mem_limit: + create_kwargs["mem_limit"] = mem_limit + + shm_size = os.environ.get("STRIX_SANDBOX_SHM_SIZE", "").strip() + if shm_size: + create_kwargs["shm_size"] = shm_size + + cpus = os.environ.get("STRIX_SANDBOX_CPUS", "").strip() + if cpus: + with contextlib.suppress(ValueError, OverflowError): + nano_cpus = int(float(cpus) * 1_000_000_000) + if 0 < nano_cpus <= 2**63 - 1: + create_kwargs["nano_cpus"] = nano_cpus + + pids_limit = os.environ.get("STRIX_SANDBOX_PIDS_LIMIT", "").strip() + if pids_limit: + with contextlib.suppress(ValueError): + create_kwargs["pids_limit"] = int(pids_limit) + + +def _apply_log_limits(create_kwargs: dict[str, Any]) -> None: + """Bound the container's json-file log so a runaway process in the sandbox + (e.g. a tool that busy-loops writing to stdout) cannot fill the host disk + and take the Docker daemon down with it. + + Unlike the cgroup caps above, this defaults **on** — docker's own default + is an unbounded json-file, which is unsafe for an autonomous agent that + executes arbitrary commands. ``max-file`` rotation means the on-disk cap is + ``max-size * max-file``. Set ``STRIX_SANDBOX_LOG_MAX_SIZE`` to ``0``/``off`` + to opt back out to docker's default.""" + max_size = os.environ.get("STRIX_SANDBOX_LOG_MAX_SIZE", "50m").strip() + if max_size.lower() in ("0", "off", "none", "unlimited"): + return + max_file = os.environ.get("STRIX_SANDBOX_LOG_MAX_FILE", "3").strip() or "3" + create_kwargs["log_config"] = LogConfig( + type=LogConfig.types.JSON, + config={"max-size": max_size, "max-file": max_file}, + ) + + +def _apply_run_labels(create_kwargs: dict[str, Any]) -> None: + run_id = os.getenv("STRIX_RUN_ID") + if not run_id: + return + labels = create_kwargs.setdefault("labels", {}) + if not isinstance(labels, dict): + return + labels["strix-run-id"] = run_id + run_type = os.getenv("STRIX_RUN_TYPE") + if run_type: + labels["strix-run-type"] = run_type + + +class StrixDockerSandboxSession(DockerSandboxSession): + sandbox_network: str = "" + + async def _resolve_exposed_port(self, port: int) -> ExposedPortEndpoint: + try: + self._container.reload() + except docker_errors.APIError as e: + raise ExposedPortUnavailableError( + port=port, + exposed_ports=self.state.exposed_ports, + reason="backend_unavailable", + context={ + "backend": "docker", + "detail": "container_reload_failed", + "network": self.sandbox_network, + }, + cause=e, + ) from e + + attrs = getattr(self._container, "attrs", {}) or {} + networks = attrs.get("NetworkSettings", {}).get("Networks", {}) + endpoint = networks.get(self.sandbox_network) or {} + ip = endpoint.get("IPAddress") or endpoint.get("GlobalIPv6Address") + if not isinstance(ip, str) or not ip: + raise ExposedPortUnavailableError( + port=port, + exposed_ports=self.state.exposed_ports, + reason="backend_unavailable", + context={ + "backend": "docker", + "detail": "container_not_on_network", + "network": self.sandbox_network, + }, + ) + host = f"[{ip}]" if ":" in ip else ip + return ExposedPortEndpoint(host=host, port=port, tls=False) + + +class StrixDockerSandboxClient(DockerSandboxClient): + # Host directories to bind-mount into the container, set by the docker + # backend before ``create()``. Each item is ``{source, target, read_only}``. + strix_bind_mounts: list[dict[str, Any]] | None = None + image_pull_policy: Literal["auto", "never"] = "auto" + + async def _create_container( + self, + image: str, + *, + manifest: Manifest | None = None, + exposed_ports: tuple[int, ...] = (), + session_id: uuid.UUID | None = None, + ) -> Container: + # ----- BEGIN VERBATIM COPY of DockerSandboxClient._create_container ----- + # SDK ref: src/agents/sandbox/sandboxes/docker.py:1434-1477 (v0.14.6). + _ensure_image_available(self, image, self.image_pull_policy) + + assert self.image_exists(image) + environment: dict[str, str] | None = None + if manifest: + environment = await manifest.environment.resolve() + # Strix delta from the SDK body: drop ``entrypoint`` override and + # supply ``tail -f /dev/null`` as ``command`` so the image's + # ENTRYPOINT (``docker-entrypoint.sh``) runs setup, then ``exec + # "$@"`` becomes ``exec tail -f /dev/null`` for the keep-alive. + # Without this, caido-cli + the in-container CA trust never get + # initialized. + create_kwargs: dict[str, Any] = { + "image": image, + "detach": True, + "command": ["tail", "-f", "/dev/null"], + "environment": environment, + } + if manifest is not None: + docker_mounts = _build_docker_volume_mounts( + manifest, + session_id=session_id, + ) + if docker_mounts: + create_kwargs["mounts"] = docker_mounts + if _manifest_requires_fuse(manifest): + create_kwargs.update( + devices=["/dev/fuse"], + cap_add=["SYS_ADMIN"], + security_opt=["apparmor:unconfined"], + ) + elif _manifest_requires_sys_admin(manifest): + create_kwargs.update( + cap_add=["SYS_ADMIN"], + security_opt=["apparmor:unconfined"], + ) + if exposed_ports: + create_kwargs["ports"] = { + _docker_port_key(port): ("127.0.0.1", None) for port in exposed_ports + } + # ----- END VERBATIM COPY ----- + + # Strix injections — append, don't overwrite, so FUSE/SYS_ADMIN survives. + cap_add = create_kwargs.setdefault("cap_add", []) + if not isinstance(cap_add, list): + cap_add = list(cap_add) + create_kwargs["cap_add"] = cap_add + for cap in ("NET_ADMIN", "NET_RAW"): + if cap not in cap_add: + cap_add.append(cap) + + extra_hosts = create_kwargs.setdefault("extra_hosts", {}) + extra_hosts["host.docker.internal"] = "host-gateway" + + _apply_sandbox_network(create_kwargs) + _apply_resource_limits(create_kwargs) + _apply_log_limits(create_kwargs) + _apply_run_labels(create_kwargs) + + # Strix injection: local source trees, sorted shallowest-first so a + # nested spec lands on top of the tree it covers. + bind_mounts = self.strix_bind_mounts or () + if bind_mounts: + mounts = create_kwargs.setdefault("mounts", []) + for spec in sorted(bind_mounts, key=lambda s: str(s["target"]).count("/")): + mounts.append( + DockerSDKMount( + target=spec["target"], + source=spec["source"], + type="bind", + read_only=spec.get("read_only", False), + ) + ) + + logger.debug( + "Creating sandbox container: image=%s caps=%s exposed_ports=%s", + image, + cap_add, + list(exposed_ports), + ) + container = self.docker_client.containers.create(**create_kwargs) + logger.info( + "Sandbox container created: id=%s image=%s", + container.short_id if hasattr(container, "short_id") else "?", + image, + ) + return container + + async def create(self, **kwargs: Any) -> SandboxSession: + session = await super().create(**kwargs) + network = _sandbox_network() + inner = session._inner + if network and isinstance(inner, DockerSandboxSession): + inner.__class__ = StrixDockerSandboxSession + cast("StrixDockerSandboxSession", inner).sandbox_network = network + return session + + async def delete(self, session: SandboxSession) -> SandboxSession: + container_id = getattr(getattr(session._inner, "state", None), "container_id", None) + if container_id: + # Best-effort kill: NotFound/APIError cover a gone or unhappy + # container. RequestException covers a torn-down daemon socket — + # containers.get() -> inspect_container raises requests' + # ConnectionError, which is a sibling of docker.errors.APIError + # under requests.RequestException (not a subclass), so it escapes + # an APIError-only suppress and surfaces a full traceback even + # though this teardown is meant to be best-effort. + with contextlib.suppress( + docker_errors.NotFound, docker_errors.APIError, RequestException + ): + self.docker_client.containers.get(container_id).kill() + return await super().delete(session)