Skip to content

docs(cybergym): simplify README into a script-driven walkthrough - #60

Merged
sklinglernv merged 2 commits into
mainfrom
docs/cybergym-readme-scripts
Jul 30, 2026
Merged

docs(cybergym): simplify README into a script-driven walkthrough#60
sklinglernv merged 2 commits into
mainfrom
docs/cybergym-readme-scripts

Conversation

@sklinglernv

Copy link
Copy Markdown
Collaborator

Summary

Cleans up the CyberGym example README, which had grown into a long, command-heavy transcript that was hard to follow. Replaces it with a four-step, script-driven walkthrough backed by small scripts under examples/cybergym/scripts/, reasoned through from a first-time user's perspective.

What changed

  • New scripts/config.sh — single source of truth for paths, model, server, and the per-task timeout; every other script sources it.
  • New scripts/setup.sh — one-time setup (venv, install/clone CyberGym, fetch the subset via Git LFS, pull the Docker images, install this runner, build the agent image).
  • New scripts/start_server.sh — starts the CyberGym submission server.
  • scripts/run_10_tasks.shscripts/run_subset.sh — renamed and slimmed to source shared config.
  • New scripts/validate.sh — post-validates submitted PoCs and prints a per-task pass/fail summary (collapses the two old, partly-redundant validation sections into one).
  • README rewritten as: setup.shstart_server.shrun_subset.shvalidate.sh, keeping the direct runner invocation inline to show how the agent is called.

Notable fixes surfaced along the way

  • No secret in the repo. The CyberGym API key was the upstream default (would trip gitleaks). setup.sh now generates a random key into the gitignored .env; server and validation read it from there. Only local /submit-fix, /query-poc, /verify-agent-pocs use it — the agent's own /submit-vul is public.
  • Per-task timeout defaults to 4h. The old 3600s hard cap sat below the agent's soft timeout (13920s), so the graceful "return best PoC" path never fired. TIMEOUT now defaults to 14400s.
  • Removed a redundant curl in validation (verify_agent_result.py already POSTs to /verify-agent-pocs).

CI notes

  • Header checks (pre-commit and CI) are Python-only; the new .sh files need no SPDX header (matches the prior run_10_tasks.sh).
  • No hardcoded secrets in the diff; gitleaks-clean.

🤖 Generated with Claude Code

sklinglernv and others added 2 commits July 30, 2026 14:54
Replace the long command-heavy README with a four-step flow backed by
small scripts under scripts/:

- config.sh: single source for paths, model, server, and 4h timeout
- setup.sh: one-time env/install/data/image setup
- start_server.sh: run the CyberGym submission server
- run_subset.sh (renamed from run_10_tasks.sh): run the subset
- validate.sh: post-validate submitted PoCs with a pass/fail summary

Generate the CyberGym API key into the gitignored .env instead of
hardcoding the upstream default (avoids secret-scanner flags). Default
the per-task hard timeout to 4h so the agent's soft timeout can fire.
Keep the direct runner invocation in the README to show how the agent
is called.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
llm_config.yaml only names the env var (api_key_env); the key itself lives in .env.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@sklinglernv
sklinglernv merged commit 3bb36bd into main Jul 30, 2026
5 checks passed
@alessiodevoto
alessiodevoto deleted the docs/cybergym-readme-scripts branch July 31, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant