refactor(agent_utils): run sandboxed harnesses with only bash in the task image

benchmarks/swe_together/opencode.yaml

@@ -61,7 +61,6 @@ swe_together_candidate:
       model: ${policy_model_name}
       opencode_version: 1.15.13
       sandbox_model_id: ${policy_model_name}
-      sandbox_python_executable: /opt/gym-runtime/python/bin/python3
       sandbox_path_prefix: [/opt/gym-runtime]
       sandbox_executable_path: /opt/gym-runtime/opencode
       sandbox_executable_sha256: 8e97f83175c84daeb51e96b34baf9ee9839ae54e5e848a3cce1e0e32dcf41a6c  # pragma: allowlist secret (public runtime digest)

benchmarks/terminal_bench_2_1/README.md

@@ -156,24 +156,23 @@ a successful smoke, and one task does not establish a benchmark baseline.
 
 ## Tasks that start services
 
-The supervisor stops live processes in the harness group and reaps its children before
-capture or verification. On timeout or close, it first records its already adopted
-children. It then stops the harness and repeatedly drains newly adopted children,
-including in-flight tools in separate sessions, within the cleanup deadline. Previously
-adopted children outside the harness group remain for Resources to stop after verification
-or episode failure. This includes unfinished background jobs such as `make &` left by an
+The supervisor stops live processes in the harness group before capture or verification.
+On timeout or close, it stops the harness, then kills within the cleanup deadline the group,
+the harness's descendants in other process groups (such as in-flight tools in separate
+sessions) and processes that inherited the harness's `NEMO_GYM_SUPERVISOR` environment
+marker. Processes that left the harness before the stop remain for Resources to stop after verification or episode
+failure. This includes unfinished background jobs such as `make &` left by an
 earlier tool call, as well as services; either can continue writing during verification.
 
-To survive this forced-stop cleanup, a service must be outside the harness group and,
-before the stop, adopted by the supervisor or descended from a process that was. In the
-usual tool-launch path, let the process that launched it exit before the harness deadline
-or stop so that adoption can occur. A service still parented by an in-flight tool is
-adopted when that tool exits or is killed during the stop, and is drained with the
-in-flight tools.
+To survive this forced-stop cleanup, a service must be outside the harness group and no
+longer descend from the harness when the stop begins. In the usual tool-launch path, let the
+process that launched it exit before the harness deadline or stop. A service still parented
+by an in-flight tool descends from the harness at the stop and is killed with the in-flight
+tools.
 
 Natural CLI exit has no such cutoff: unfinished tools in separate sessions cannot be
-distinguished from services and may still change task files. Adoption races, PID reuse,
-and a preserved service orphaning more children during cleanup also limit this rule.
+distinguished from services and may still change task files. PID reuse and a tool
+that starts a new session after the stop is recorded also limit this rule.
 A confirmed receipt is not a guarantee that the sandbox is idle or a security boundary.
 Unconfirmed termination blocks verification; a final failure receipt still lets agent
 close release its connection for owner teardown.

nemo_gym/agent_utils/__init__.py

@@ -8,9 +8,11 @@
 implements the shell protocol over session control files. All three run on the
 agent server.
 
-Only process_supervisor.py is copied from this package into the task sandbox. It
-uses the standard library to enforce deadlines, stop and reap the harness process
-group, and write its termination receipt. Explicitly detached task services remain
-for the sandbox owner to stop. Core sandbox APIs and providers live in
+Only process_supervisor.sh and harness_runner.sh are copied from this package into
+the task sandbox; they need bash, not Python. The supervisor enforces deadlines, stops
+the harness process group and writes its termination receipt. A forced stop also kills the
+harness's descendants in other groups and processes that inherited its marker; processes
+that had left the harness before the stop, and detached processes after a natural exit,
+remain for the sandbox owner to stop. Core sandbox APIs and providers live in
 :mod:`nemo_gym.sandbox`.
 """

nemo_gym/agent_utils/harness_runner.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Harness runner uploaded into task sandboxes; runs under process_supervisor.sh with only bash.
+#
+# usage: harness_runner.sh PARAMS
+#
+# PARAMS is bash source written by shell_assignments() on the agent server. It sets:
+#   cwd, command (array), env (array of KEY=VALUE), stdin, stdout, stderr
+# and optionally:
+#   setup      bash code run first, before env is applied
+#   unset_env  array of extglob patterns naming inherited variables to drop
+#   events     file receiving each JSON object line of stdout as [seen_at, object]
+# Writes runtime.json beside PARAMS. Exits with the command's status, 125 when the runner fails before
+# starting it (including an exit from setup), or 126 or 127 when the command could not be started.
+
+# An inherited BASH_ENV or SHELLOPTS must not stop the runner at an expected failure.
+set +o errexit +o nounset +o pipefail
+IFS=$' \t\n'
+shopt -s extglob
+# Inherited variables with these names must not configure the runner or leak into the CLI.
+unset -v cwd command env stdin stdout stderr setup unset_env events
+trap 'exit 125' EXIT
+source "$1" || exit
+printf '{"hostname": "%s", "pid": %d}\n' "$HOSTNAME" "$$" >"$(dirname "$1")/runtime.json"
+eval "${setup-}" || exit
+for pattern in "${unset_env[@]}"; do
+    for name in $(compgen -e); do
+        [[ $name == $pattern ]] && unset "$name"
+    done
+done
+((${#env[@]})) && export "${env[@]}"
+cd "$cwd" || exit
+# A failed redirection does not end bash at exec; the CLI did not start.
+if [[ -z ${events-} ]]; then
+    trap - EXIT
+    exec "${command[@]}" <"$stdin" >"$stdout" 2>"$stderr"
+    exit 126
+fi
+
+# Stamp stdout lines as they appear. A file, unlike a pipe, cannot be held open by a detached tool.
+: >"$stdout" && exec 3<"$stdout" 4>"$events" || exit
+trap - EXIT
+# The runner's own descriptors stay out of the CLI.
+{ exec "${command[@]}" <"$stdin" >>"$stdout" 2>"$stderr" 3<&- 4>&-; exit 126; } &
+cli=$!
+trap 'kill -TERM "$cli" 2>/dev/null' TERM
+pending=""
+emit() {
+    # ${1%$'\r'} would try the suffix at every position of a long line.
+    local line=$1
+    [[ ${line: -1} == $'\r' ]] && line=${line%?}
+    [[ $line == {* ]] && printf '[%s, %s]\n' "$seen" "$line" >&4
+}
+# Stamp new complete lines, keeping a partial one for the next pass. Bash < 5 has whole seconds;
+# bash < 4.2 has no strftime in printf and forks date.
+stamp() {
+    local line
+    seen=${EPOCHREALTIME/,/.}
+    [[ -n $seen ]] || printf -v seen '%(%s)T' -1 2>/dev/null
+    [[ $seen =~ ^[0-9.]+$ ]] || seen=$(date +%s)
+    while IFS= read -r line <&3; do
+        emit "$pending$line"
+        pending=""
+    done
+    pending+=$line
+}
+while kill -0 "$cli" 2>/dev/null; do
+    stamp
+    sleep 0.05
+done
+wait "$cli"
+status=$?
+stamp
+emit "$pending"
+exit "$status"