Enhance PVM runtime with import tracing and version updates

- Added `trace_imports`, `trace_allow_all`, and `trace_path` options to `DeterminismOptions` for improved import tracking. - Implemented import tracing functionality in the PVM runtime, allowing for detailed logging of module imports. - Updated `Cargo.toml` to include a new dependency on `pvm-runtime` and incremented the PVM version to "0.1.3". - Enhanced demo scripts to support new tracing features and provide clearer usage instructions for import tracing. - Refactored the `determinism_check.py` script to include options for generating and printing suggested import whitelists.
RustPython · yusufyian · Dec 18, 2025 · Dec 18, 2025 · Dec 19, 2025 · Dec 19, 2025
commit 5e014666bafa0e0cdceb516188fc41dcdd2ade0c
diff --git a/Cargo.toml b/Cargo.toml
@@ -56,14 +56,15 @@ criterion = { workspace = true }
 pyo3 = { version = "0.27", features = ["auto-initialize"] }
 pvm-alto = { path = "crates/pvm-alto" }
 pvm-host = { path = "crates/pvm-host" }
+pvm-runtime = { path = "crates/pvm-runtime" }
 
-[[bench]]
-name = "execution"
-harness = false
+# [[bench]]
+# name = "execution"
+# harness = false
 
-[[bench]]
-name = "microbenchmarks"
-harness = false
+# [[bench]]
+# name = "microbenchmarks"
+# harness = false
 
 [[bin]]
 name = "pvm"
@@ -123,7 +124,7 @@ template = "installer-config/installer.wxs"
 
 # PVM Current Version 
 [package.metadata.pvm]
-version = "0.0.2"
+version = "0.1.3"
 
 
 [workspace]

diff --git a/Lib/pvm_sdk/pvm_random.py b/Lib/pvm_sdk/pvm_random.py
@@ -1,23 +1,195 @@
 import pvm_host
 
+_seed_prefix = b"N"
 _counter = 0
+_buffer = b""
+_buffer_pos = 0
 
 
 def _next_block():
     global _counter
-    domain = b"random" + _counter.to_bytes(8, "little")
+    domain = b"random" + _seed_prefix + _counter.to_bytes(8, "little")
     _counter += 1
     return pvm_host.randomness(domain)
 
 
+def _reset_state():
+    global _counter, _buffer, _buffer_pos
+    _counter = 0
+    _buffer = b""
+    _buffer_pos = 0
+
+
+def _coerce_seed(a):
+    if a is None:
+        return b"N"
+    if isinstance(a, (bytes, bytearray)):
+        return b"B" + bytes(a)
+    if isinstance(a, str):
+        return b"S" + a.encode("utf-8")
+    if isinstance(a, int):
+        if a == 0:
+            data = b"\x00"
+        else:
+            bits = a.bit_length()
+            if a < 0:
+                bits += 1
+            data = a.to_bytes((bits + 7) // 8, "big", signed=True)
+        return b"I" + data
+    raise TypeError("seed must be int, bytes, bytearray, str, or None")
+
+
+def seed(a=None, version=2):
+    global _seed_prefix
+    _seed_prefix = _coerce_seed(a)
+    _reset_state()
+
+
+def getstate():
+    return (1, _seed_prefix, _counter, _buffer, _buffer_pos)
+
+
+def setstate(state):
+    if not isinstance(state, tuple) or len(state) != 5:
+        raise ValueError("state must be a 5-item tuple from getstate()")
+    version, seed_prefix, counter, buffer_data, buffer_pos = state
+    if version != 1:
+        raise ValueError("unsupported state version")
+    if isinstance(seed_prefix, bytearray):
+        seed_prefix = bytes(seed_prefix)
+    if not isinstance(seed_prefix, (bytes, bytearray)):
+        raise TypeError("seed_prefix must be bytes")
+    if not isinstance(counter, int):
+        raise TypeError("counter must be int")
+    if isinstance(buffer_data, bytearray):
+        buffer_data = bytes(buffer_data)
+    if not isinstance(buffer_data, (bytes, bytearray)):
+        raise TypeError("buffer must be bytes")
+    if not isinstance(buffer_pos, int):
+        raise TypeError("buffer_pos must be int")
+    if buffer_pos < 0 or buffer_pos > len(buffer_data):
+        raise ValueError("buffer_pos out of range")
+    global _seed_prefix, _counter, _buffer, _buffer_pos
+    _seed_prefix = bytes(seed_prefix)
+    _counter = counter
+    _buffer = bytes(buffer_data)
+    _buffer_pos = buffer_pos
+
+
+def _compact_buffer():
+    global _buffer, _buffer_pos
+    if _buffer_pos <= 0:
+        return
+    if _buffer_pos >= len(_buffer):
+        _buffer = b""
+        _buffer_pos = 0
+        return
+    _buffer = _buffer[_buffer_pos :]
+    _buffer_pos = 0
+
+
+def _fill(n):
+    global _buffer, _buffer_pos
+    if _buffer_pos > 0:
+        _compact_buffer()
+    needed = n - (len(_buffer) - _buffer_pos)
+    while needed > 0:
+        _buffer += _next_block()
+        needed = n - (len(_buffer) - _buffer_pos)
+
+
+def _randbytes(n):
+    global _buffer_pos
+    if n <= 0:
+        return b""
+    _fill(n)
+    start = _buffer_pos
+    end = start + n
+    _buffer_pos = end
+    return _buffer[start:end]
+
+
+def _randbelow(n):
+    if n <= 0:
+        raise ValueError("n must be > 0")
+    k = n.bit_length()
+    while True:
+        r = getrandbits(k)
+        if r < n:
+            return r
+
+
+def getrandbits(k):
+    if k < 0:
+        raise ValueError("number of bits must be non-negative")
+    if k == 0:
+        return 0
+    nbytes = (k + 7) // 8
+    value = int.from_bytes(_randbytes(nbytes), "big")
+    return value >> (nbytes * 8 - k)
+
+
 def random():
-    block = _next_block()
-    value = int.from_bytes(block[:8], "little") >> 11
-    return value / (1 << 53)
+    return getrandbits(53) / (1 << 53)
 
 
 def randbytes(n):
-    out = bytearray()
-    while len(out) < n:
-        out.extend(_next_block())
-    return bytes(out[:n])
+    return _randbytes(n)
+
+
+def randint(a, b):
+    if a > b:
+        raise ValueError("empty range for randint()")
+    return randrange(a, b + 1, 1)
+
+
+def randrange(start, stop=None, step=1):
+    if stop is None:
+        if start > 0:
+            return _randbelow(start)
+        raise ValueError("empty range for randrange()")
+    if step == 0:
+        raise ValueError("step must not be zero")
+    width = stop - start
+    if step == 1:
+        if width > 0:
+            return start + _randbelow(width)
+        raise ValueError("empty range for randrange()")
+    if step > 0:
+        n = (width + step - 1) // step
+    else:
+        n = (width + step + 1) // step
+    if n <= 0:
+        raise ValueError("empty range for randrange()")
+    return start + step * _randbelow(n)
+
+
+def choice(seq):
+    if not seq:
+        raise IndexError("cannot choose from an empty sequence")
+    return seq[_randbelow(len(seq))]
+
+
+def shuffle(x):
+    for i in range(len(x) - 1, 0, -1):
+        j = _randbelow(i + 1)
+        x[i], x[j] = x[j], x[i]
+
+
+def uniform(a, b):
+    return a + (b - a) * random()
+
+
+def sample(population, k):
+    if k < 0:
+        raise ValueError("sample size must be non-negative")
+    pool = list(population)
+    n = len(pool)
+    if k > n:
+        raise ValueError("sample larger than population")
+    result = []
+    for i in range(k):
+        j = _randbelow(n - i)
+        result.append(pool[j])
+        pool[j] = pool[n - i - 1]
+    return result
diff --git a/crates/pvm-runtime/src/determinism.rs b/crates/pvm-runtime/src/determinism.rs
@@ -7,6 +7,9 @@ pub struct DeterminismOptions {
     pub stdlib_hash: Option<String>,
     pub enable_softfloat: bool,
     pub enable_gas: bool,
+    pub trace_imports: bool,
+    pub trace_allow_all: bool,
+    pub trace_path: Option<String>,
 }
 
 impl DeterminismOptions {
@@ -129,6 +132,9 @@ impl Default for DeterminismOptions {
             stdlib_hash: None,
             enable_softfloat: false,
             enable_gas: false,
+            trace_imports: false,
+            trace_allow_all: false,
+            trace_path: None,
         }
     }
 }
diff --git a/crates/pvm-runtime/src/guard.rs b/crates/pvm-runtime/src/guard.rs
@@ -13,6 +13,12 @@ _ALLOW = set(PVM_WHITELIST)
 _DENY = set(PVM_BLACKLIST)
 _REAL_IMPORT = builtins.__import__
 _HOST = _REAL_IMPORT(PVM_HOST_MODULE, None, None, (), 0)
+_TRACE_IMPORTS = bool(PVM_TRACE_IMPORTS)
+_TRACE_ALLOW_ALL = bool(PVM_TRACE_ALLOW_ALL)
+_TRACE = []
+_TRACE_BLOCKED = []
+sys._pvm_import_trace = _TRACE
+sys._pvm_import_blocked = _TRACE_BLOCKED
 
 _ALIAS = {
     "time": "pvm_sdk.pvm_time",
@@ -89,6 +95,16 @@ def _alias(name, target):
     sys.modules[name] = mod
 
 
+def _record_import(name, allowed):
+    if not _TRACE_IMPORTS:
+        return
+    if not name:
+        return
+    _TRACE.append(name)
+    if not allowed:
+        _TRACE_BLOCKED.append(name)
+
+
 if PVM_SYS_PATH is not None:
     sys.path[:] = PVM_SYS_PATH
     try:
@@ -103,11 +119,14 @@ for _name, _target in _ALIAS.items():
 def _pvm_import(name, globals=None, locals=None, fromlist=(), level=0):
     resolved = _resolve_name(name, globals, level)
     if resolved in _ALIAS:
+        _record_import(_ALIAS[resolved], True)
         mod = sys.modules.get(resolved)
         if mod is None:
             raise _HOST.DeterministicValidationError("alias module missing: " + resolved)
         return mod
-    if not _is_allowed(name, globals, level):
+    allowed = _is_allowed(name, globals, level)
+    _record_import(resolved or name, allowed)
+    if not allowed and not _TRACE_ALLOW_ALL:
         raise _HOST.NonDeterministicError("module not allowed: " + name)
     return _REAL_IMPORT(name, globals, locals, fromlist, level)
 
@@ -118,7 +137,8 @@ builtins.__import__ = _pvm_import
 class _PvmImportGuard:
     def find_spec(self, fullname, path=None, target=None):
         if not _is_allowed(fullname):
-            raise _HOST.NonDeterministicError("module not allowed: " + fullname)
+            if not _TRACE_ALLOW_ALL:
+                raise _HOST.NonDeterministicError("module not allowed: " + fullname)
         return None
 
 
@@ -174,6 +194,16 @@ pub(crate) fn install(
         vm.ctx.new_str(host_module_name).into(),
         vm,
     )?;
+    scope.globals.set_item(
+        "PVM_TRACE_IMPORTS",
+        vm.ctx.new_bool(options.trace_imports).into(),
+        vm,
+    )?;
+    scope.globals.set_item(
+        "PVM_TRACE_ALLOW_ALL",
+        vm.ctx.new_bool(options.trace_allow_all).into(),
+        vm,
+    )?;
 
     let code = vm
         .compile(GUARD_SOURCE, Mode::Exec, "<pvm_guard>".to_owned())