agent-hitch 0.2.6 → 0.2.8

package/dist/src/backends/harbor/environment-config.js

@@ -0,0 +1,92 @@
+import { HitchError, invalidInput } from "../../foundation/index.js";
+const HITCH_DOCKER_ENVIRONMENT = "hitch_harbor_environment:HitchHarborDockerEnvironment";
+export function harborEnvironmentConfig(resources, ownership, serviceLimits, resolvedImages, prebuiltTaskImage, modelProxyHostGateway = false) {
+    const environment = { type: "docker", delete: true };
+    let gpuCount = 0;
+    if (resources) {
+        if (Object.values(resources).some((value) => !Number.isSafeInteger(value) || value < 0))
+            throw invalidInput("Harbor execution resources are invalid");
+        const mib = 1024 * 1024;
+        if (resources.cpu_millis % 1_000 !== 0 || resources.memory_bytes % mib !== 0) {
+            throw new HitchError("Harbor cannot represent the requested CPU or memory limit", { code: "resource_limit_unrepresentable", exitCode: 10 });
+        }
+        const cpus = resources.cpu_millis / 1_000;
+        const memoryMb = resources.memory_bytes / mib;
+        gpuCount = resources.gpu_count ?? 0;
+        if (cpus > 0)
+            Object.assign(environment, { cpu_enforcement_policy: "limit", override_cpus: cpus });
+        if (memoryMb > 0)
+            Object.assign(environment, { memory_enforcement_policy: "limit", override_memory_mb: memoryMb });
+    }
+    if (serviceLimits && !ownership)
+        throw invalidInput("Harbor sidecar limits require Docker ownership");
+    const images = resolvedImages ? parseResolvedImages(resolvedImages) : {};
+    if (prebuiltTaskImage !== undefined && !/^sha256:[a-f0-9]{64}$/.test(prebuiltTaskImage))
+        throw invalidInput("Harbor prebuilt task image is invalid");
+    if (ownership || Object.keys(images).length > 0 || prebuiltTaskImage || modelProxyHostGateway || gpuCount > 0)
+        Object.assign(environment, {
+            import_path: HITCH_DOCKER_ENVIRONMENT,
+            kwargs: {
+                ...(ownership ? { hitch_ownership_labels: harborOwnershipLabels(ownership) } : {}),
+                ...(serviceLimits && Object.keys(serviceLimits).length > 0 ? { hitch_service_resource_limits: parseServiceLimits(serviceLimits) } : {}),
+                ...(Object.keys(images).length > 0 ? { hitch_resolved_images: images } : {}),
+                ...(prebuiltTaskImage ? { hitch_prebuilt_task_image: prebuiltTaskImage } : {}),
+                ...(modelProxyHostGateway ? { hitch_model_proxy_host_gateway: true } : {}),
+                ...(gpuCount > 0 ? { hitch_main_gpu_count: gpuCount } : {}),
+            },
+        });
+    if (ownership)
+        environment.delete = false;
+    return environment;
+}
+function parseResolvedImages(value) {
+    const result = {};
+    for (const [requested, resolved] of Object.entries(value).sort(([left], [right]) => left.localeCompare(right))) {
+        if (!validImageReference(requested) || !validImageReference(resolved)
+            || !/@sha256:[a-f0-9]{64}$/.test(resolved) || repositoryOf(requested) !== repositoryOf(resolved)) {
+            throw invalidInput("Harbor resolved image mapping is invalid");
+        }
+        result[requested] = resolved;
+    }
+    return result;
+}
+function validImageReference(value) {
+    return Boolean(value) && value.length <= 1_024 && !/[\s\0]/.test(value) && !value.includes("://") && !value.includes("$");
+}
+function repositoryOf(reference) {
+    const withoutDigest = reference.split("@")[0];
+    const slash = withoutDigest.lastIndexOf("/");
+    const colon = withoutDigest.lastIndexOf(":");
+    return colon > slash ? withoutDigest.slice(0, colon) : withoutDigest;
+}
+function parseServiceLimits(value) {
+    const result = {};
+    for (const [name, resources] of Object.entries(value).sort(([left], [right]) => left.localeCompare(right))) {
+        if (!name || name === "main" || name.length > 255 || /[\0\r\n]/.test(name)
+            || !resources || Object.keys(resources).some((field) => field !== "cpu_millis" && field !== "memory_bytes" && field !== "gpu_count")
+            || !Number.isSafeInteger(resources.cpu_millis) || resources.cpu_millis < 1
+            || !Number.isSafeInteger(resources.memory_bytes) || resources.memory_bytes < 1
+            || (resources.gpu_count !== undefined && (!Number.isSafeInteger(resources.gpu_count) || resources.gpu_count < 1)))
+            throw invalidInput("Harbor sidecar resource limits are invalid");
+        result[name] = { cpu_millis: resources.cpu_millis, memory_bytes: resources.memory_bytes, ...(resources.gpu_count === undefined ? {} : { gpu_count: resources.gpu_count }) };
+    }
+    return result;
+}
+function harborOwnershipLabels(value) {
+    if (!/^[a-f0-9]{24}$/.test(value.root_id) || !value.provider || value.provider.length > 128 || !/^[a-z0-9][a-z0-9._-]*$/.test(value.provider)
+        || !/^eval_[a-f0-9]{32}$/.test(value.eval_id) || !/^work_[a-f0-9]{32}$/.test(value.work_id)
+        || !/^lease_[a-f0-9]{32}$/.test(value.lease_id) || !Number.isSafeInteger(value.lease_epoch) || value.lease_epoch < 1
+        || (value.task_id !== undefined && (!value.task_id || value.task_id.length > 4_096 || /[\0\r\n]/.test(value.task_id)))) {
+        throw invalidInput("Harbor Docker ownership is invalid");
+    }
+    return {
+        "io.hitch.root-id": value.root_id,
+        "io.hitch.provider": value.provider,
+        "io.hitch.eval-id": value.eval_id,
+        "io.hitch.work-id": value.work_id,
+        "io.hitch.lease-id": value.lease_id,
+        "io.hitch.lease-epoch": String(value.lease_epoch),
+        ...(value.task_id === undefined ? {} : { "io.hitch.task-id": value.task_id }),
+    };
+}
+//# sourceMappingURL=environment-config.js.map

package/dist/src/backends/harbor/environment-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-config.js","sourceRoot":"","sources":["../../../../src/backends/harbor/environment-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAErE,MAAM,wBAAwB,GAAG,uDAAuD,CAAC;AAIzF,MAAM,UAAU,uBAAuB,CACrC,SAA4B,EAC5B,SAAqC,EACrC,aAA2C,EAC3C,cAAuC,EACvC,iBAA0B,EAC1B,qBAAqB,GAAG,KAAK;IAE7B,MAAM,WAAW,GAA4B,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9E,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAAE,MAAM,YAAY,CAAC,wCAAwC,CAAC,CAAC;QACtJ,MAAM,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;QACxB,IAAI,SAAS,CAAC,UAAU,GAAG,KAAK,KAAK,CAAC,IAAI,SAAS,CAAC,YAAY,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,UAAU,CAAC,2DAA2D,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,GAAG,GAAG,CAAC;QAC9C,QAAQ,GAAG,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,sBAAsB,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,IAAI,QAAQ,GAAG,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,yBAAyB,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,aAAa,IAAI,CAAC,SAAS;QAAE,MAAM,YAAY,CAAC,gDAAgD,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,IAAI,iBAAiB,KAAK,SAAS,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAAE,MAAM,YAAY,CAAC,uCAAuC,CAAC,CAAC;IACrJ,IAAI,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,IAAI,qBAAqB,IAAI,QAAQ,GAAG,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE;YACxI,WAAW,EAAE,wBAAwB;YACrC,MAAM,EAAE;gBACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;SACF,CAAC,CAAC;IACH,IAAI,SAAS;QAAE,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC;IAC1C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA6B;IACxD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/G,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;eAChE,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnG,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5H,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;IACxD,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAkC;IAC5D,MAAM,MAAM,GAAgC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3G,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;eACrE,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,WAAW,CAAC;eACjI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,UAAU,GAAG,CAAC;eACvE,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,YAAY,GAAG,CAAC;eAC3E,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,YAAY,CAAC,4CAA4C,CAAC,CAAC;QACtL,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9K,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAgC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;WACxI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WACxF,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC;WACjH,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzH,MAAM,YAAY,CAAC,oCAAoC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,KAAK,CAAC,OAAO;QACjC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;QACnC,kBAAkB,EAAE,KAAK,CAAC,OAAO;QACjC,kBAAkB,EAAE,KAAK,CAAC,OAAO;QACjC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;QACnC,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/src/backends/harbor/index.js

@@ -1,4 +1,9 @@
-export { buildHarborJobConfig, lockedHarnessRef, normalizeHarborResult, runHarborBackend } from "./backend.js";
+export { buildHarborJobConfig, lockedHarnessRef, normalizeHarborResult, readHarborRawResult, runHarborBackend } from "./backend.js";
+export { buildHarborRegradeConfig, runHarborRegrade, seedHarborRegradeTrial } from "./regrade.js";
+export { DEFAULT_HARBOR_TRIAL_DOCKER_PLATFORM, HARBOR_NODE_VERSION, HARBOR_NODE_VERSION_WITH_PREFIX, HARBOR_PNPM_VERSION, harborTrialRuntimeContract } from "./runtime-toolchain.js";
+export { harborEnvironmentConfig } from "./environment-config.js";
+export { readHarborProcessExitStatus } from "./process.js";
 export { DEFAULT_LOCAL_GIT_TRANSPORT_LIMITS, LOCAL_GIT_TRANSPORT_MANIFEST, LOCAL_GIT_TRANSPORT_PAYLOAD, LOCAL_GIT_TRANSPORT_SCHEMA_VERSION, buildLocalGitTransport, localGitTransportLimitsFromEnv, validateLocalGitTransportManifest, verifyLocalGitTransport, verifyMaterializedLocalGitSource } from "./local-git-transport.js";
+export { inspectHarborTaskResources, parseHarborTaskResourceDeclaration } from "./task-resources.js";
 export { DEFAULT_HARBOR_VERSION, HARBOR_CREDENTIAL_ENV, doctorHarbor, locateHarbor, managedHarborExecutable, setupHarbor } from "./tools.js";
 //# sourceMappingURL=index.js.map

package/dist/src/backends/harbor/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/backends/harbor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE/G,OAAO,EAAE,kCAAkC,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAGnU,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/backends/harbor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpI,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oCAAoC,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAGrL,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,kCAAkC,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,iCAAiC,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAGnU,OAAO,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,MAAM,qBAAqB,CAAC;AAErG,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/dist/src/backends/harbor/model-proxy-config.js

@@ -0,0 +1,23 @@
+import { invalidInput } from "../../foundation/index.js";
+export function parseHarborModelProxyRoute(value) {
+    if (value.schema_version !== "1" || !new Set(["proxy", "hybrid"]).has(value.mode)
+        || typeof value.required !== "boolean" || !new Set(["host-side", "in-sandbox"]).has(value.topology)
+        || !proxyTemplate(value.base_url_template, true) || !proxyTemplate(value.health_url_template, false)) {
+        throw invalidInput("Harbor model proxy route is invalid");
+    }
+    return { ...value };
+}
+function proxyTemplate(value, provider) {
+    if (typeof value !== "string" || value.length > 2_048 || /[\0\r\n]/.test(value))
+        return false;
+    if ((value.match(/\{run_id\}/g) ?? []).length !== 1 || (value.match(/\{provider\}/g) ?? []).length !== (provider ? 1 : 0))
+        return false;
+    try {
+        const parsed = new URL(value.replace("{run_id}", `run_${"a".repeat(32)}`).replace("{provider}", "openai"));
+        return parsed.protocol === "http:" || parsed.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=model-proxy-config.js.map

package/dist/src/backends/harbor/model-proxy-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-proxy-config.js","sourceRoot":"","sources":["../../../../src/backends/harbor/model-proxy-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,MAAM,UAAU,0BAA0B,CAAC,KAAwB;IACjE,IAAI,KAAK,CAAC,cAAc,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;WAC5E,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;WAChG,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC;QACvG,MAAM,YAAY,CAAC,qCAAqC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,QAAiB;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxI,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3G,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC"}

package/dist/src/backends/harbor/process.js

@@ -0,0 +1,177 @@
+import { spawn } from "node:child_process";
+import { createWriteStream } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { pipeline } from "node:stream/promises";
+import { fileURLToPath } from "node:url";
+import { HitchError, consumeLines, createCredentialRedactionTransform, credentialValuesFromEnv, terminateProcess } from "../../foundation/index.js";
+const SUPERVISOR_PATH = fileURLToPath(new URL("./supervisor.js", import.meta.url));
+export function invokeHarbor(executable, args, { cwd, env, stdoutPath, stderrPath, signal, emit, onStarted, onExited, persistAcrossParentExit, exitStatusPath, redactEnvNames = [] }) {
+    if (onStarted && persistAcrossParentExit) {
+        if (!exitStatusPath)
+            throw new TypeError("recoverable Harbor process requires an exit status path");
+        return invokeRecoverableHarbor(executable, args, {
+            cwd,
+            env,
+            stdoutPath,
+            stderrPath,
+            emit,
+            onStarted,
+            exitStatusPath,
+            redactEnvNames,
+            ...(signal ? { signal } : {}),
+            ...(onExited ? { onExited } : {}),
+        });
+    }
+    return new Promise((resolve, reject) => {
+        const credentialValues = credentialValuesFromEnv(redactEnvNames, env);
+        const stdout = createWriteStream(stdoutPath, { flags: "w", mode: 0o600 });
+        const stderr = createWriteStream(stderrPath, { flags: "w", mode: 0o600 });
+        const child = spawn(executable, args, {
+            cwd,
+            env,
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: process.platform !== "win32",
+            windowsHide: true,
+        });
+        const safeStdout = createCredentialRedactionTransform(credentialValues);
+        const safeStderr = createCredentialRedactionTransform(credentialValues);
+        consumeLines(safeStdout, (line) => emit({ type: "eval.backend.output", stream: "stdout", text: line }));
+        consumeLines(safeStderr, (line) => emit({ type: "eval.backend.output", stream: "stderr", text: line }));
+        let settled = false;
+        const abort = () => terminateProcess(child).catch(() => { });
+        const streams = Promise.all([
+            pipeline(child.stdout, safeStdout, stdout),
+            pipeline(child.stderr, safeStderr, stderr),
+        ]);
+        streams.catch((error) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            abort();
+            reject(new HitchError(`failed to persist Harbor output: ${error.message}`, {
+                code: "harbor_log_write_failed",
+                exitCode: 12,
+                cause: error,
+            }));
+        });
+        signal?.addEventListener("abort", abort, { once: true });
+        const started = child.pid === undefined ? Promise.resolve() : Promise.resolve(onStarted?.(child.pid));
+        started.catch((error) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            abort();
+            stdout.destroy();
+            stderr.destroy();
+            reject(new HitchError(`failed to record Harbor process identity: ${error.message}`, {
+                code: "provider_process_record_failed",
+                exitCode: 12,
+                cause: error,
+            }));
+        });
+        child.once("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            stdout.destroy();
+            stderr.destroy();
+            reject(new HitchError(`failed to launch Harbor: ${error.message}`, {
+                code: "harbor_launch_failed",
+                exitCode: 6,
+                cause: error,
+            }));
+        });
+        child.once("close", (code, processSignal) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            const result = { code, signal: processSignal };
+            Promise.all([started, streams])
+                .then(async () => { await onExited?.(result); resolve(result); })
+                .catch(reject);
+        });
+        if (signal?.aborted)
+            abort();
+    });
+}
+function invokeRecoverableHarbor(executable, args, { cwd, env, stdoutPath, stderrPath, signal, emit, onStarted, onExited, exitStatusPath, redactEnvNames }) {
+    return new Promise((resolve, reject) => {
+        credentialValuesFromEnv(redactEnvNames, env);
+        const child = spawn(process.execPath, [
+            SUPERVISOR_PATH, exitStatusPath, stdoutPath, stderrPath, JSON.stringify(redactEnvNames), executable, ...args,
+        ], {
+            cwd,
+            env,
+            stdio: "ignore",
+            detached: process.platform !== "win32",
+            windowsHide: true,
+        });
+        let settled = false;
+        const abort = () => terminateProcess(child).catch(() => { });
+        signal?.addEventListener("abort", abort, { once: true });
+        const started = child.pid === undefined
+            ? Promise.reject(new HitchError("Harbor process has no PID", { code: "harbor_launch_failed", exitCode: 6 }))
+            : Promise.resolve(onStarted(child.pid));
+        started.then(() => emit({ type: "eval.backend.process-recorded", process_id: child.pid })).catch((error) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            abort();
+            reject(new HitchError(`failed to record Harbor process identity: ${error.message}`, {
+                code: "provider_process_record_failed",
+                exitCode: 12,
+                cause: error,
+            }));
+        });
+        child.once("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            reject(new HitchError(`failed to launch Harbor: ${error.message}`, { code: "harbor_launch_failed", exitCode: 6, cause: error }));
+        });
+        child.once("close", (code, processSignal) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener("abort", abort);
+            started.then(async () => {
+                const result = await readHarborProcessExitStatus(exitStatusPath) ?? { code, signal: processSignal };
+                await onExited?.(result);
+                resolve(result);
+            }).catch(reject);
+        });
+        if (signal?.aborted)
+            abort();
+    });
+}
+export async function readHarborProcessExitStatus(file) {
+    let value;
+    try {
+        value = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        if (error instanceof SyntaxError)
+            throw new TypeError("Harbor process exit status is invalid");
+        throw error;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("Harbor process exit status is invalid");
+    const record = value;
+    if (Object.keys(record).some((key) => !new Set(["schema_version", "process_exit_code", "signal", "completed_at"]).has(key))
+        || record.schema_version !== "1"
+        || (record.process_exit_code !== null && !Number.isSafeInteger(record.process_exit_code))
+        || (record.signal !== null && typeof record.signal !== "string")
+        || typeof record.completed_at !== "string" || !Number.isFinite(Date.parse(record.completed_at))) {
+        throw new TypeError("Harbor process exit status is invalid");
+    }
+    return { code: record.process_exit_code, signal: record.signal };
+}
+//# sourceMappingURL=process.js.map

package/dist/src/backends/harbor/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../../../src/backends/harbor/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kCAAkC,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEpJ,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAUnF,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,IAAc,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,uBAAuB,EAAE,cAAc,EAAE,cAAc,GAAG,EAAE,EAQzG;IAE1B,IAAI,SAAS,IAAI,uBAAuB,EAAE,CAAC;QACzC,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QACpG,OAAO,uBAAuB,CAAC,UAAU,EAAE,IAAI,EAAE;YAC/C,GAAG;YACH,GAAG;YACH,UAAU;YACV,UAAU;YACV,IAAI;YACJ,SAAS;YACT,cAAc;YACd,cAAc;YACd,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACpC,GAAG;YACH,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;QACxE,YAAY,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxG,YAAY,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxG,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;YAC1B,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC;YAC1C,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,UAAU,CAAC,oCAAqC,KAAe,CAAC,OAAO,EAAE,EAAE;gBACpF,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,UAAU,CAAC,6CAA8C,KAAe,CAAC,OAAO,EAAE,EAAE;gBAC7F,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,UAAU,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,EAAE;gBACjE,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,aAAoC,EAAE,EAAE;YAChF,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;iBAC5B,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;iBAChE,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAkB,EAClB,IAAc,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAWpG;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,uBAAuB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAiB,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;YAClD,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,GAAG,IAAI;SAC7G,EAAE;YACD,GAAG;YACH,GAAG;YACH,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS;YACrC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5G,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACzG,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,UAAU,CAAC,6CAA8C,KAAe,CAAC,OAAO,EAAE,EAAE;gBAC7F,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,KAAK;aACb,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,UAAU,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACnI,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,aAAoC,EAAE,EAAE;YAChF,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACtB,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;gBACpG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACvE,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,KAAK,YAAY,WAAW;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/F,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;WACtH,MAAM,CAAC,cAAc,KAAK,GAAG;WAC7B,CAAC,MAAM,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;WACtF,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;WAC7D,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,iBAAkC,EAAE,MAAM,EAAE,MAAM,CAAC,MAA+B,EAAE,CAAC;AAC7G,CAAC"}

package/dist/src/backends/harbor/regrade.js

@@ -0,0 +1,77 @@
+import path from "node:path";
+import { copyFile, mkdir } from "node:fs/promises";
+import { HitchError, atomicWriteJSON, ensureDir, fingerprintExecutable, readJSON } from "../../foundation/index.js";
+import { locateHarbor } from "./tools.js";
+import { invokeHarbor } from "./process.js";
+/** Harbor 0.21 dispatches source_trial.action=regrade to RegradeTrial, which
+ * never initializes or runs the candidate. Keep the source agent config as
+ * provenance, and preserve every timeout/resource/verifier setting. */
+export function buildHarborRegradeConfig(input) {
+    const source = structuredClone(input.sourceConfig);
+    const environment = source.environment;
+    const agent = source.agent;
+    const verifier = source.verifier;
+    if (!environment || environment.import_path !== "hitch_harbor_environment:HitchHarborDockerEnvironment"
+        || agent?.import_path !== "hitch_harbor_agent:HitchHarborAgent" || !verifier || verifier.disable
+        || source.source_trial || source.install_only || typeof input.sourceResult.id !== "string") {
+        throw new HitchError("verifier-only requires an original managed Hitch Harbor trial with verification enabled", { code: "eval_verifier_only_unavailable", exitCode: 2 });
+    }
+    return {
+        ...source,
+        job_id: null,
+        trial_name: input.trialName,
+        trials_dir: input.outputDirectory,
+        source_trial: { action: "regrade", type: "local", trial_id: input.sourceResult.id, path: input.sourceDirectory },
+        environment: {
+            ...environment,
+            // The Hitch reaper releases exactly this lease, including on failure.
+            delete: false,
+            kwargs: { ...(environment.kwargs ?? {}), hitch_ownership_labels: input.ownershipLabels },
+        },
+    };
+}
+/** Harbor copies agent/ and artifacts/ only. The Hitch lifecycle journal is
+ * collected control evidence needed by the frozen metric normalizer as well.
+ * Copy it verbatim; never manufacture prepare/snapshot success for a regrade. */
+export async function seedHarborRegradeTrial(sourceDirectory, trialDirectory, trustedResult) {
+    const file = path.join(sourceDirectory, "benchmark-lifecycle.json");
+    const journal = await readJSON(file);
+    if (journal.schema_version !== "1" || journal.failure !== null || !journal.phases || typeof journal.phases !== "object" || Array.isArray(journal.phases)) {
+        throw new HitchError("source benchmark lifecycle is incomplete or failed", { code: "eval_verifier_only_unavailable", exitCode: 2 });
+    }
+    await mkdir(trialDirectory, { recursive: true });
+    await copyFile(file, path.join(trialDirectory, "benchmark-lifecycle.json"));
+    const responseFile = path.join(sourceDirectory, "hitch-final-response.json");
+    const response = await readJSON(responseFile, null);
+    if (response !== null) {
+        // Caller has verified the sealed result bundle. Never substitute the
+        // candidate-writable artifact for the host's authoritative export.
+        if (!trustedResult || typeof trustedResult.output !== "string"
+            || response.schema_version !== "1" || response.source !== "hitch-run-result"
+            || response.run_id !== trustedResult.run_id || response.termination !== trustedResult.status
+            || response.response !== trustedResult.output) {
+            throw new HitchError("canonical response differs from the sealed candidate result", { code: "eval_verifier_only_unavailable", exitCode: 2 });
+        }
+        await copyFile(responseFile, path.join(trialDirectory, "hitch-final-response.json"));
+    }
+}
+export async function runHarborRegrade(input) {
+    const located = await locateHarbor({ root: input.root, explicit: input.harborExecutable, env: input.env });
+    // Pin the SDK contract; upgrading this gate requires a regrade parity test.
+    if (!located.executable || located.version !== "0.21.0")
+        throw new HitchError("verifier-only requires Harbor 0.21.0", { code: "eval_verifier_only_backend_unavailable", exitCode: 2 });
+    await ensureDir(input.directory);
+    const configPath = path.join(input.directory, "regrade.json");
+    await atomicWriteJSON(configPath, input.config);
+    await seedHarborRegradeTrial(String(input.config.source_trial.path), path.join(String(input.config.trials_dir), String(input.config.trial_name)), input.trustedResult);
+    const outcome = await invokeHarbor(located.executable, ["trials", "start", "--config", configPath], {
+        cwd: input.directory,
+        env: { ...input.env, PYTHONPATH: [path.join(input.runtimeDirectory, "payload/integrations/harbor"), input.env.PYTHONPATH].filter(Boolean).join(path.delimiter) },
+        stdoutPath: path.join(input.directory, "stdout.log"), stderrPath: path.join(input.directory, "stderr.log"),
+        ...(input.signal ? { signal: input.signal } : {}), emit: () => { },
+        redactEnvNames: Object.keys(input.env).filter((key) => /TOKEN|SECRET|PASSWORD|API_KEY|AUTH_JSON/.test(key)),
+    });
+    const trial = await readJSON(path.join(String(input.config.trials_dir), String(input.config.trial_name), "result.json"));
+    return { trial, backend: { name: "harbor", version: located.version, identity: await fingerprintExecutable(located.executable), process_exit_code: outcome.code, signal: outcome.signal } };
+}
+//# sourceMappingURL=regrade.js.map

package/dist/src/backends/harbor/regrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regrade.js","sourceRoot":"","sources":["../../../../src/backends/harbor/regrade.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACpH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C;;uEAEuE;AACvE,MAAM,UAAU,wBAAwB,CAAC,KAOxC;IACC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAkD,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,KAA4C,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAA+C,CAAC;IACxE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,KAAK,uDAAuD;WAClG,KAAK,EAAE,WAAW,KAAK,qCAAqC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO;WAC7F,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,IAAI,UAAU,CAAC,yFAAyF,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3K,CAAC;IACD,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,UAAU,EAAE,KAAK,CAAC,eAAe;QACjC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,EAAE;QAChH,WAAW,EAAE;YACX,GAAG,WAAW;YACd,sEAAsE;YACtE,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,MAAiC,IAAI,EAAE,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,eAAe,EAAE;SACpH;KACF,CAAC;AACJ,CAAC;AAED;;iFAEiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,eAAuB,EAAE,cAAsB,EAAE,aAAuC;IACnI,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAA0B,IAAI,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,cAAc,KAAK,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzJ,MAAM,IAAI,UAAU,CAAC,oDAAoD,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAiC,YAAY,EAAE,IAAI,CAAC,CAAC;IACpF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,MAAM,KAAK,QAAQ;eACzD,QAAQ,CAAC,cAAc,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB;eACzE,QAAQ,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,IAAI,QAAQ,CAAC,WAAW,KAAK,aAAa,CAAC,MAAM;eACzF,QAAQ,CAAC,QAAQ,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,IAAI,UAAU,CAAC,6DAA6D,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAStC;IACC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3G,4EAA4E;IAC5E,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,sCAAsC,EAAE,EAAE,IAAI,EAAE,wCAAwC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACvL,MAAM,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,sBAAsB,CAAC,MAAM,CAAE,KAAK,CAAC,MAAM,CAAC,YAAwC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACpM,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE;QAClG,GAAG,EAAE,KAAK,CAAC,SAAS;QACpB,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QAChK,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC;QAC1G,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACjE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAC5G,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAA0B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IAClJ,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;AAC9L,CAAC"}

package/dist/src/backends/harbor/runtime-toolchain.js

@@ -0,0 +1,30 @@
+import { HitchError } from "../../foundation/index.js";
+export const HARBOR_NODE_VERSION = "22.23.0";
+export const HARBOR_NODE_VERSION_WITH_PREFIX = `v${HARBOR_NODE_VERSION}`;
+export const HARBOR_PNPM_VERSION = "10.17.1";
+export const DEFAULT_HARBOR_TRIAL_DOCKER_PLATFORM = "linux/amd64";
+export function harborTrialRuntimeContract(dockerPlatform) {
+    const normalized = normalizeDockerPlatform(dockerPlatform);
+    const artifactPlatform = normalized === "linux/amd64" ? "linux-x64"
+        : normalized === "linux/arm64" ? "linux-arm64"
+            : null;
+    if (artifactPlatform === null) {
+        throw new HitchError(`unsupported Harbor trial runtime platform: ${dockerPlatform || "unknown"}`, {
+            code: "harbor_trial_runtime_platform_unsupported",
+            exitCode: 12,
+        });
+    }
+    return {
+        dockerPlatform: normalized,
+        artifactPlatform,
+        nodeVersion: HARBOR_NODE_VERSION_WITH_PREFIX,
+    };
+}
+function normalizeDockerPlatform(value) {
+    const [os, rawArchitecture, extra] = value.trim().toLowerCase().split("/");
+    const architecture = rawArchitecture === "x86_64" || rawArchitecture === "x86-64" ? "amd64"
+        : rawArchitecture === "aarch64" ? "arm64"
+            : rawArchitecture;
+    return extra === undefined && os && architecture ? `${os}/${architecture}` : value.trim().toLowerCase();
+}
+//# sourceMappingURL=runtime-toolchain.js.map

package/dist/src/backends/harbor/runtime-toolchain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-toolchain.js","sourceRoot":"","sources":["../../../../src/backends/harbor/runtime-toolchain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAC7C,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,mBAAmB,EAAE,CAAC;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAa7C,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAC;AAElE,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,MAAM,UAAU,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,UAAU,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW;QACjE,CAAC,CAAC,UAAU,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa;YAC5C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,8CAA8C,cAAc,IAAI,SAAS,EAAE,EAAE;YAChG,IAAI,EAAE,2CAA2C;YACjD,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,cAAc,EAAE,UAAU;QAC1B,gBAAgB;QAChB,WAAW,EAAE,+BAA+B;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,eAAe,KAAK,QAAQ,IAAI,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO;QACzF,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO;YACvC,CAAC,CAAC,eAAe,CAAC;IACtB,OAAO,KAAK,KAAK,SAAS,IAAI,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1G,CAAC"}

package/dist/src/backends/harbor/supervisor.js

@@ -0,0 +1,74 @@
+import { spawn } from "node:child_process";
+import { createWriteStream } from "node:fs";
+import { rename, writeFile } from "node:fs/promises";
+import { pipeline } from "node:stream/promises";
+import { createCredentialRedactionTransform, credentialValuesFromEnv } from "../../foundation/index.js";
+async function main() {
+    const [, , statusPath, stdoutPath, stderrPath, redactionNamesJSON, executable, ...args] = process.argv;
+    if (!statusPath || !stdoutPath || !stderrPath || !redactionNamesJSON || !executable) {
+        process.stderr.write("Harbor supervisor requires status/log paths, redaction names, and executable\n");
+        process.exitCode = 2;
+        return;
+    }
+    const redactionNames = parseRedactionNames(redactionNamesJSON);
+    const result = await supervise(executable, args, stdoutPath, stderrPath, redactionNames);
+    await persist(statusPath, result);
+    process.exitCode = result.process_exit_code === null ? 1 : Math.max(0, Math.min(255, result.process_exit_code));
+}
+function supervise(executable, args, stdoutPath, stderrPath, redactionNames) {
+    return new Promise((resolve) => {
+        const credentialValues = credentialValuesFromEnv(redactionNames, process.env);
+        const child = spawn(executable, args, {
+            cwd: process.cwd(),
+            env: process.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        const streams = Promise.all([
+            pipeline(child.stdout, createCredentialRedactionTransform(credentialValues), createWriteStream(stdoutPath, { flags: "w", mode: 0o600 })),
+            pipeline(child.stderr, createCredentialRedactionTransform(credentialValues), createWriteStream(stderrPath, { flags: "w", mode: 0o600 })),
+        ]);
+        let settled = false;
+        const finish = (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            streams.then(() => resolve(status(code, signal)), () => resolve(status(74, null)));
+        };
+        child.once("error", () => finish(127, null));
+        child.once("close", (code, signal) => {
+            finish(code, signal);
+        });
+    });
+}
+function parseRedactionNames(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new TypeError("Harbor supervisor redaction names are invalid JSON");
+    }
+    if (!Array.isArray(parsed) || parsed.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+        || new Set(parsed).size !== parsed.length)
+        throw new TypeError("Harbor supervisor redaction names are invalid");
+    return [...parsed].sort();
+}
+function status(processExitCode, signal) {
+    return {
+        schema_version: "1",
+        process_exit_code: processExitCode,
+        signal,
+        completed_at: new Date().toISOString(),
+    };
+}
+async function persist(file, result) {
+    const temporary = `${file}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(result)}\n`, { mode: 0o600 });
+    await rename(temporary, file);
+}
+main().catch((error) => {
+    process.stderr.write(`Harbor supervisor failed: ${error.message}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=supervisor.js.map

package/dist/src/backends/harbor/supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../../src/backends/harbor/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,kCAAkC,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AASxG,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,EAAE,AAAD,EAAG,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACvG,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,kBAAkB,IAAI,CAAC,UAAU,EAAE,CAAC;QACpF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACvG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACzF,MAAM,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAc,EAAE,UAAkB,EAAE,UAAkB,EAAE,cAAwB;IACrH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;YAC1B,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACzI,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAQ,EAAE;YAC1E,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAAC,CAAC;IACnI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;WAClH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IAClH,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,MAAM,CAAC,eAA8B,EAAE,MAA6B;IAC3E,OAAO;QACL,cAAc,EAAE,GAAG;QACnB,iBAAiB,EAAE,eAAe;QAClC,MAAM;QACN,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAkB;IACrD,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA8B,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;IAChF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}