tenant.openagents/omega

1"""The in-sandbox judge proxy shim, shared by the Harbor verifier and the
2offline rejudge path so judge calls go through one identical code path
3everywhere.
4
5Stdlib-only and free of any `harbor`/`modal` imports on purpose: `verifier.py`
6imports these constants for the live in-sandbox install, and `rejudge.py` runs
7the very same proxy in a plain container to re-grade stored runs. Keeping the
8shim here means there is exactly one implementation of the upstream fixups
9(Anthropic `response_format` stripping, `max_tokens` -> `max_completion_tokens`,
10the `ZED_JUDGE_MAX_TOKENS` floor) rather than a copy per call site.
11"""
12
13from __future__ import annotations
14
15# Stdlib-only OpenAI-protocol shim. The SWE-Atlas RF judge hardcodes
16# `response_format={"type": "json_object"}`, which Anthropic's OpenAI-compatible
17# endpoint rejects (400: "response_format.type: Input should be 'json_schema'").
18# The shim listens on 127.0.0.1:PORT and forwards to ZED_JUDGE_UPSTREAM, applying
19# upstream-specific fixups:
20#   - `response_format` is stripped ONLY for Anthropic (Baseten/OpenAI accept
21#     json_object, and the Kimi/DeepSeek judges rely on it);
22#   - `max_tokens` is renamed to `max_completion_tokens` (accepted by both
23#     Anthropic-compat and OpenAI, including GPT-5.x reasoning models that reject
24#     `max_tokens`) and raised to the ZED_JUDGE_MAX_TOKENS floor so the runtime
25#     judge matches the offline-calibrated token budget.
26# When ZED_JUDGE_AUTH_ENV is set, it replaces verifier auth with the named
27# sandbox env var; otherwise it passes auth headers through unchanged.
28JUDGE_PROXY_SCRIPT = """\
29import json, os, urllib.request, urllib.error
30from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
31
32UPSTREAM = os.environ.get("ZED_JUDGE_UPSTREAM", "https://api.anthropic.com/v1").rstrip("/")
33PORT = int(os.environ.get("ZED_JUDGE_PROXY_PORT", "8089"))
34AUTH_ENV = os.environ.get("ZED_JUDGE_AUTH_ENV")
35MAX_TOKENS_FLOOR = int(os.environ.get("ZED_JUDGE_MAX_TOKENS", "0"))
36
37class Handler(BaseHTTPRequestHandler):
38    def do_POST(self):
39        length = int(self.headers.get("Content-Length", 0))
40        body = self.rfile.read(length)
41        try:
42            payload = json.loads(body)
43            if "anthropic" in UPSTREAM:
44                payload.pop("response_format", None)
45            sent = payload.pop("max_tokens", None)
46            current = sent if sent is not None else payload.get("max_completion_tokens")
47            if current is not None or MAX_TOKENS_FLOOR:
48                payload["max_completion_tokens"] = max(current or 0, MAX_TOKENS_FLOOR)
49            body = json.dumps(payload).encode()
50        except Exception as error:
51            print(f"proxy: passing body through unmodified: {error}", flush=True)
52        path = self.path
53        if path.startswith("/v1/"):
54            path = path[len("/v1"):]
55        request = urllib.request.Request(UPSTREAM + path, data=body, method="POST")
56        request.add_header("Content-Type", "application/json")
57        auth_value = os.environ.get(AUTH_ENV, "") if AUTH_ENV else ""
58        if auth_value:
59            request.add_header("Authorization", f"Bearer {auth_value}")
60        else:
61            for header in ("Authorization", "x-api-key"):
62                value = self.headers.get(header)
63                if value:
64                    request.add_header(header, value)
65        for header in ("anthropic-version",):
66            value = self.headers.get(header)
67            if value:
68                request.add_header(header, value)
69        try:
70            with urllib.request.urlopen(request, timeout=900) as response:
71                data = response.read()
72                status = response.status
73        except urllib.error.HTTPError as error:
74            data = error.read()
75            status = error.code
76        except Exception as error:
77            data = json.dumps({"error": {"message": str(error)}}).encode()
78            status = 502
79        self.send_response(status)
80        self.send_header("Content-Type", "application/json")
81        self.send_header("Content-Length", str(len(data)))
82        self.end_headers()
83        self.wfile.write(data)
84
85    def log_message(self, format, *args):
86        print("proxy: " + format % args, flush=True)
87
88if __name__ == "__main__":
89    print(f"judge proxy listening on 127.0.0.1:{PORT} -> {UPSTREAM}", flush=True)
90    ThreadingHTTPServer(("127.0.0.1", PORT), Handler).serve_forever()
91"""
92
93# Idempotent starter. Uses bash's /dev/tcp (pgrep isn't in every image) to check
94# the port; the daemon inherits ZED_JUDGE_UPSTREAM from the verifier setup exec
95# env. stdout/stderr/stdin are fully detached so the spawning exec doesn't hang
96# on open pipes.
97JUDGE_PROXY_ENSURE_SCRIPT = """\
98#!/bin/bash
99if ! (exec 3<>/dev/tcp/127.0.0.1/${ZED_JUDGE_PROXY_PORT:-8089}) 2>/dev/null; then
100    nohup python3 /usr/local/lib/zed_judge_proxy.py \\
101        >>/tmp/zed-judge-proxy.log 2>&1 </dev/null &
102    sleep 1
103fi
104"""
105