Add anti-reward hacking controls (no internet, git history purging)

Author: john-b-yang

codeclash/agents/minisweagent.py

@@ -11,6 +11,7 @@
 from codeclash.agents.player import Player
 from codeclash.agents.utils import GameContext
 from codeclash.utils.environment import copy_to_container
+from codeclash.utils.internet_control import turn_off_internet, turn_on_internet
 
 os.environ["MSWEA_MODEL_RETRY_STOP_AFTER_ATTEMPT"] = "90"
 os.environ["LITELLM_MODEL_REGISTRY_PATH"] = str(
@@ -55,6 +56,16 @@ def run(self):
             logger=self.logger,
             **self.config["config"]["agent"],
         )
+        # Disable the container's internet DURING the agent's editing turn so it can't look up
+        # solutions online (setup fetch + post-round push happen outside run(), with net on).
+        # Composes with Player._isolate_git (which removes opponent branches). Default on.
+        no_internet = self.config.get("no_internet", True)
+        if no_internet:
+            try:
+                turn_off_internet(self.environment)
+            except Exception as e:
+                self.logger.critical(f"FAILED to disable internet — agent runs WITH network: {e}")
+                no_internet = False  # nothing to restore later
         exit_status = None
         exc_message = None
         try:
@@ -65,6 +76,11 @@ def run(self):
             exc_message = traceback.format_exc()
             self.logger.critical(exc_message)
         finally:
+            if no_internet:
+                try:
+                    turn_on_internet(self.environment)
+                except Exception as e:
+                    self.logger.error(f"Failed to restore internet after agent turn: {e}")
             traj_path = (
                 self.game_context.log_local
                 / "players"

codeclash/agents/player.py

@@ -101,6 +101,13 @@ def __init__(
                         logger=self.logger,
                     )
 
+        # SECURITY: the container's clone carries every opponent's branch + round tags
+        # (origin/human/*, <uuid>-round-N) — an agent can `git show` them to copy solutions.
+        # After the starting codebase is checked out, strip git so there is no path to opponent
+        # code during the agent's turn. Local commits still work; push re-adds origin transiently.
+        if self.push:
+            self._isolate_git()
+
     # --- Main methods ---
 
     def pre_run_hook(self, *, new_round: int) -> None:
@@ -143,10 +150,15 @@ def post_run_hook(self, *, round: int) -> None:
         self._write_changes_to_file(round=round)
 
         if self.push:
+            token = os.getenv("GITHUB_TOKEN")
             force = " --force-with-lease" if self._force_push else ""
+            # origin is absent during the agent's turn (see _isolate_git); re-add it only to push,
+            # then remove it again so the next round's agent still can't reach opponent code.
             for cmd in [
+                f"git remote add origin https://x-access-token:{token}@github.com/{GH_ORG}/{self.game_context.name}.git",
                 f"git push{force} -u origin {self._branch_name}",
                 "git push origin --tags",
+                "git remote remove origin",
             ]:
                 assert_zero_exit_code(self.environment.execute(cmd), logger=self.logger)
             self.logger.info(f"Pushed {self.name} commit history to remote repository (branch {self._branch_name})")
@@ -214,6 +226,20 @@ def _get_commit_hash(self) -> str:
         )
         return out["output"].strip()
 
+    def _isolate_git(self) -> None:
+        """Strip the git remote + all remote-tracking refs and tags so the agent cannot read
+        opponents' pushed code (origin/human/*, <uuid>-round-N). The local working branch and its
+        history remain, so the agent can still commit; push (post_run_hook) re-adds origin briefly.
+        Best-effort — failures here must not abort a run."""
+        for cmd in [
+            "git remote remove origin",
+            "git for-each-ref --format='%(refname)' refs/remotes refs/tags | xargs -r -n1 git update-ref -d",
+            "git reflog expire --expire=now --all",
+            "git gc --prune=now --quiet",
+        ]:
+            self.environment.execute(cmd)
+        self.logger.info("Isolated git: removed origin + opponent branches/tags (anti-cheat)")
+
     def _commit(self) -> None:
         """Commit changes to the agent's codebase."""
         r = self.game_context.round

codeclash/utils/internet_control.py

@@ -0,0 +1,78 @@
+"""Toggle a running container's internet access via iptables in its network namespace.
+
+Ported from RevEngBench (reveng/utils/environment_internet_control.py), Linux-only path.
+Used to disable internet DURING the agent's editing turn (so it can't look up solutions),
+while leaving it on for setup (git fetch of the starting codebase) and the post-round push.
+Loopback is always kept up, so localhost gameplay (bot servers on 0.0.0.0:PORT) is unaffected.
+DNS is left reachable so container tools fail fast instead of hanging on resolution.
+
+Host-side (nsenter + sudo iptables) so an in-container root agent cannot undo it. Composes with
+Player._isolate_git — internet-off stops re-fetching, git-strip hides the already-cloned branches.
+"""
+
+import os
+import subprocess
+import threading
+
+from minisweagent.environments.docker import DockerEnvironment
+
+from codeclash.utils.log import get_logger
+
+logger = get_logger(__name__)
+
+_dns_lock = threading.Lock()
+_container_dns: dict[str, set[str]] = {}
+
+
+def _docker_pid(env: DockerEnvironment) -> str:
+    return subprocess.run(
+        [env.config.executable, "inspect", "--format", "{{.State.Pid}}", env.container_id],
+        capture_output=True,
+        text=True,
+        check=True,
+    ).stdout.strip()
+
+
+def _iptables(env: DockerEnvironment, rule_args: list[str]) -> None:
+    """Run one iptables command in the container's net namespace (sudo nsenter on Linux)."""
+    pid = _docker_pid(env)
+    prefix = [] if os.getuid() == 0 else ["sudo", "-n"]
+    subprocess.run([*prefix, "nsenter", "-t", pid, "-n", "iptables", *rule_args], check=True)
+
+
+def _dns_servers(env: DockerEnvironment) -> set[str]:
+    r = env.execute({"command": "grep '^nameserver' /etc/resolv.conf | awk '{print $2}'"})
+    return {ip.strip() for ip in r["output"].splitlines() if ip.strip()}
+
+
+def turn_off_internet(env: DockerEnvironment) -> None:
+    """Drop all inbound/outbound traffic except loopback and DNS."""
+    dns = _dns_servers(env)
+    with _dns_lock:
+        _container_dns[env.container_id] = dns
+    for chain in ("OUTPUT", "INPUT"):
+        _iptables(env, ["-I", chain, "-j", "DROP"])
+    _iptables(env, ["-I", "OUTPUT", "-o", "lo", "-j", "ACCEPT"])
+    _iptables(env, ["-I", "INPUT", "-i", "lo", "-j", "ACCEPT"])
+    for ip in sorted(dns):
+        _iptables(env, ["-I", "OUTPUT", "-d", ip, "-p", "udp", "--dport", "53", "-j", "ACCEPT"])
+        _iptables(env, ["-I", "OUTPUT", "-d", ip, "-p", "tcp", "--dport", "53", "-j", "ACCEPT"])
+        _iptables(env, ["-I", "INPUT", "-s", ip, "-p", "udp", "--sport", "53", "-j", "ACCEPT"])
+        _iptables(env, ["-I", "INPUT", "-s", ip, "-p", "tcp", "--sport", "53", "-j", "ACCEPT"])
+    logger.info("Internet disabled for container %s (loopback+DNS kept)", env.container_id[:12])
+
+
+def turn_on_internet(env: DockerEnvironment) -> None:
+    """Remove the drop rules inserted by turn_off_internet (restores full connectivity)."""
+    with _dns_lock:
+        dns = _container_dns.pop(env.container_id, set())
+    for ip in sorted(dns):
+        _iptables(env, ["-D", "OUTPUT", "-d", ip, "-p", "udp", "--dport", "53", "-j", "ACCEPT"])
+        _iptables(env, ["-D", "OUTPUT", "-d", ip, "-p", "tcp", "--dport", "53", "-j", "ACCEPT"])
+        _iptables(env, ["-D", "INPUT", "-s", ip, "-p", "udp", "--sport", "53", "-j", "ACCEPT"])
+        _iptables(env, ["-D", "INPUT", "-s", ip, "-p", "tcp", "--sport", "53", "-j", "ACCEPT"])
+    _iptables(env, ["-D", "OUTPUT", "-o", "lo", "-j", "ACCEPT"])
+    _iptables(env, ["-D", "INPUT", "-i", "lo", "-j", "ACCEPT"])
+    for chain in ("OUTPUT", "INPUT"):
+        _iptables(env, ["-D", chain, "-j", "DROP"])
+    logger.info("Internet restored for container %s", env.container_id[:12])

configs/ladder/ladder_prompt.yaml

@@ -13,3 +13,7 @@ game_description: |-
 
   Your goal is to beat the opponent. The game's rules and your bot's entry point are documented in the
   codebase (`docs/`).
+
+  Rules: build and improve the bot yourself, using only the code, assets, and documentation already in
+  {{working_dir}}. Internet use is NOT allowed — do not attempt web searches, downloads, package
+  installs, or any external network requests (the environment has no internet access during your turn).