`gj$%FdZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZmZmZmZej$eZe dz Zdefd Zdefd Zdefd Zd eddfd ZdefdZdefdZej<ZddededefdZ GddeZ!y)aSingularity/Apptainer persistent container environment. Security-hardened with --containall, --no-home, capability dropping. Supports configurable resource limits and optional filesystem persistence via writable overlay directories that survive across sessions. N)Path)Optional)get_hermes_home)BaseEnvironment_load_json_store _popen_bash_save_json_storezsingularity_snapshots.jsonreturncptjdrytjdrytd)z/Locate the apptainer or singularity CLI binary. apptainer singularityzNeither 'apptainer' nor 'singularity' was found in PATH. Install Apptainer (https://apptainer.org/docs/admin/main/installation.html) or Singularity and ensure the CLI is available.)shutilwhich RuntimeErrorQ/root/.hermes/venv/lib/python3.12/site-packages/tools/environments/singularity.py_find_singularity_executablers2 ||K  ||M"  : rc~t} tj|dgdddtj}|jd k7r;|jjd d }t d|d |jd ||S#t$rt d|dtj $rt d|dwxYw)z?Preflight check: resolve the executable and verify it responds.versionT capture_outputtexttimeoutstdinz"Singularity backend selected but 'z' could not be executed.'z version' timed out.rNz version' failed (exit code z): ) r subprocessrunDEVNULLFileNotFoundErrorrTimeoutExpired returncodestderrstrip)exeresultr%s r_ensure_singularity_availabler)+s & (C : ) Tb$$ A$$&t,Qse#?@Q@Q?RRUV\U]^__ J  05M N    $ $:Qse#7899:s *B:B<c ttSN)r_SNAPSHOT_STORErrr_load_snapshotsr-@s O ,,rdatac$tt|yr+)r r,)r.s r_save_snapshotsr0Ds _d+rctjd}|r t|}|jdd|Sddlm}|dz }td}|j rktj|tjrG|tjdd z d z }|jddtjd ||S|jdd|S) NTERMINAL_SCRATCH_DIRTparentsexist_okr)get_sandbox_dirr z/scratchUSERhermesz hermes-agentz Using /scratch for sandboxes: %s) osgetenvrmkdirtools.environments.baser6existsaccessW_OKloggerinfo)custom_scratch scratch_pathr6sandboxscratch user_scratchs r_get_scratch_dirrGHsYY56NN+ 4$77-/G:G~~BIIgrww768!<<~M 4$7 6 E MM$M. Nrctjd}|r t|}|jdd|St }|dz }|jdd|S)NAPPTAINER_CACHEDIRTr3z .apptainer)r9r:rr;rG) cache_dir cache_pathrEs r_get_apptainer_cache_dirrL]sa ./I)_ 5 G<'JTD1 rimage executablec L|jdrt|jr|S|jds|S|j ddj ddj dd}t }||dz }|jr t |St5|jrt |cdddStjdtjd|tjd ||d z }|jd d tjj}t ||d <t ||d< tj|dt ||gd d d|tj }|j"dk7rCtj%dtj%d|j&dd|cdddStjdt |cdddS#tj($rCtj%d|jr|j+|cYcdddSt,$r+}tj%d||cYd}~cdddSd}~wwxYw#1swYyxYw)Nz.sifz docker:///-:z&Building SIF image (one-time setup)...z Source: %sz Target: %stmpTr3APPTAINER_TMPDIRrIbuildiX)rrrenvrrz/SIF build failed, falling back to docker:// URLz Error: %sizSIF image built successfullyz2SIF build timed out, falling back to docker:// URLz2SIF build error: %s, falling back to docker:// URL)endswithrr= startswithreplacerLstr_sif_build_lockr@rAr;r9environcopyrr r!r$warningr%r#unlink Exception) rMrN image_namerJsif_pathtmp_dirrWr(es r_get_or_build_sifrfls: ~~f$u+"4"4"6   K ( {B/77SAII#sSJ(*Ij\..H8} " ?? x=""  <= NE* NH-e# dT 2jjoo"%g, $' N ! ^^Wc(mU;#$ ((F   A%PQ}fmmDS.AB1""2 KK6 7x=5""6((  NNO P !L?""@  NNOQR SLE""@ A""sQ%J BJA>H&HA JJ$J,JJJJJJ#ceZdZdZ ddedededededed ed effd Zd Z dd dddededededzde jf dZ dZ xZS)SingularityEnvironmentaHardened Singularity/Apptainer container with resource limits and persistence. Spawn-per-call: every execute() spawns a fresh ``apptainer exec ... bash -c`` process. Session snapshot preserves env vars across calls. CWD persists via in-band stdout markers. FrMcwdrcpumemorydiskpersistent_filesystemtask_idc t |||t|_t ||j|_dt jjdd|_ d|_ ||_ ||_ d|_ ||_||_|jrJt!dz } | j#dd| d|z |_ |jj#dd|j%|j'y) N)rirhermes_ Fzhermes-overlaysTr3zoverlay-)super__init__r)rNrfrMuuiduuid4hex instance_id_instance_started _persistent_task_id _overlay_dir_cpu_memoryrGr;_start_instance init_session) selfrMrirrjrkrlrmrn overlay_base __class__s rrszSingularityEnvironment.__init__s S'279&udoo> $TZZ\%5%5cr%:$;<!&0 ,0    +-0AAL   td  ; ,'/C CD     # #D4 # @  rcr|jddg}|jddg|jr3|jr'|jdt |jgn|j d ddlm}m}|D]!}|jd |d d |d d g#|D]!}|jd |d d |d d g# |jdkDr |jd|jdg|jdkDr&|jdt |jg|jt |j|jg t!j"|dddt j$}|j&dk7rt)d|j*d|_tj/d|j|jy#t$r!}tjd|Yd}~!;F;@!$+/,C,4,,!Dj,4>4D4D, 'rrh)r )"rloggingr9rr threadingrtpathlibrtypingrhermes_constantsrr<rrrr getLoggerrr@r,r[rr)dictr-r0rGrLLockr\rfrhrrrrs  ,   8 $!#&BB c s*--,$,4,$* $ !).."/S/c/C/dk'_k'r