self-bench 0.3.2 → 0.3.4

package/src/codex-review.ts

@@ -28,45 +28,54 @@ export const couplingReviewSchema = z.object({
 export type CouplingReview = z.infer<typeof couplingReviewSchema>;
 
 export async function reviewCouplingWithCodex(input: {
-  readonly authJson: string;
+  readonly apiKey?: string;
+  readonly authJson?: string;
   readonly prompt: string;
   readonly signal?: AbortSignal;
   readonly fetch?: typeof fetch;
 }): Promise<CouplingReview> {
-  const credential = parseCredential(input.authJson);
-  const accountId = accountIdFromToken(credential.access);
+  const subscription =
+    !input.apiKey && input.authJson ? parseCredential(input.authJson) : undefined;
+  if (!input.apiKey && !subscription) {
+    throw new Error("OpenAI model authentication is required");
+  }
   const request = input.fetch ?? fetch;
-  const response = await request("https://chatgpt.com/backend-api/codex/responses", {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${credential.access}`,
-      "ChatGPT-Account-Id": accountId,
-      Originator: "selfbench",
-      "OpenAI-Beta": "responses=experimental",
-      Accept: "text/event-stream",
-      "Content-Type": "application/json",
+  const response = await request(
+    subscription
+      ? "https://chatgpt.com/backend-api/codex/responses"
+      : "https://api.openai.com/v1/responses",
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${subscription?.access ?? input.apiKey}`,
+        ...(subscription ? { "ChatGPT-Account-Id": accountIdFromToken(subscription.access) } : {}),
+        Originator: "selfbench",
+        "OpenAI-Beta": "responses=experimental",
+        Accept: "text/event-stream",
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        model: COUPLING_REVIEW_MODEL,
+        store: false,
+        stream: true,
+        instructions:
+          "You are an independent benchmark-quality reviewer. Analyze the supplied evidence and call submit_review exactly once.",
+        input: [
+          {
+            role: "user",
+            content: [{ type: "input_text", text: input.prompt }],
+          },
+        ],
+        reasoning: { effort: "high", summary: "auto" },
+        text: { verbosity: "low" },
+        include: ["reasoning.encrypted_content"],
+        tools: [reviewTool()],
+        tool_choice: { type: "function", name: "submit_review" },
+        parallel_tool_calls: false,
+      }),
+      ...(input.signal ? { signal: input.signal } : {}),
     },
-    body: JSON.stringify({
-      model: COUPLING_REVIEW_MODEL,
-      store: false,
-      stream: true,
-      instructions:
-        "You are an independent benchmark-quality reviewer. Analyze the supplied evidence and call submit_review exactly once.",
-      input: [
-        {
-          role: "user",
-          content: [{ type: "input_text", text: input.prompt }],
-        },
-      ],
-      reasoning: { effort: "high", summary: "auto" },
-      text: { verbosity: "low" },
-      include: ["reasoning.encrypted_content"],
-      tools: [reviewTool()],
-      tool_choice: { type: "function", name: "submit_review" },
-      parallel_tool_calls: false,
-    }),
-    ...(input.signal ? { signal: input.signal } : {}),
-  });
+  );
   const responseText = await response.text();
   if (!response.ok) {
     throw new Error(
@@ -76,6 +85,27 @@ export async function reviewCouplingWithCodex(input: {
   return parseCodexReviewEvents(responseText);
 }
 
+function parseCredential(value: string): { access: string } {
+  const parsed = JSON.parse(value) as unknown;
+  const credential = isRecord(parsed) ? parsed["openai-codex"] : undefined;
+  if (!isRecord(credential) || typeof credential.access !== "string") {
+    throw new Error("Pi auth does not contain an OpenAI Codex subscription access token");
+  }
+  return { access: credential.access };
+}
+
+function accountIdFromToken(token: string): string {
+  const payload = JSON.parse(
+    Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"),
+  ) as unknown;
+  const auth = isRecord(payload) ? payload["https://api.openai.com/auth"] : undefined;
+  const accountId = isRecord(auth) ? auth.chatgpt_account_id : undefined;
+  if (typeof accountId !== "string" || !accountId) {
+    throw new Error("OpenAI Codex subscription token has no ChatGPT account ID");
+  }
+  return accountId;
+}
+
 export function parseCodexReviewEvents(value: string): CouplingReview {
   for (const line of value.split("\n")) {
     if (!line.startsWith("data: ")) {
@@ -148,27 +178,6 @@ ${goldPatch}
 `;
 }
 
-function parseCredential(value: string): { access: string } {
-  const parsed = JSON.parse(value) as unknown;
-  const credential = isRecord(parsed) ? parsed["openai-codex"] : undefined;
-  if (!isRecord(credential) || typeof credential.access !== "string") {
-    throw new Error("Pi auth does not contain an OpenAI Codex subscription access token");
-  }
-  return { access: credential.access };
-}
-
-function accountIdFromToken(token: string): string {
-  const payload = JSON.parse(
-    Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"),
-  ) as unknown;
-  const auth = isRecord(payload) ? payload["https://api.openai.com/auth"] : undefined;
-  const accountId = isRecord(auth) ? auth.chatgpt_account_id : undefined;
-  if (typeof accountId !== "string" || !accountId) {
-    throw new Error("OpenAI Codex subscription token has no ChatGPT account ID");
-  }
-  return accountId;
-}
-
 function reviewTool(): Record<string, unknown> {
   return {
     type: "function",

package/src/config.ts

@@ -1,20 +1,37 @@
 import { z } from "zod";
+import {
+  EXECUTION_BACKENDS,
+  type ExecutionBackend,
+  HARBOR_ENVIRONMENTS,
+  type HarborEnvironment,
+  matchingHarborEnvironment,
+} from "./providers.js";
+import { parseSandboxTimeoutCapText, STANDARD_VERCEL_TIMEOUT_CAP_MS } from "./sandbox-timeout.js";
+
+const emptyStringAsUndefined = (value: unknown): unknown =>
+  typeof value === "string" && value.trim() === "" ? undefined : value;
 
 const environmentSchema = z.object({
   SELFBENCH_API_HOST: z.string().default("127.0.0.1"),
   SELFBENCH_API_PORT: z.coerce.number().int().min(1).max(65535).default(8080),
-  SELFBENCH_API_URL: z.string().url().default("http://127.0.0.1:8080"),
   SELFBENCH_API_TOKEN: z.string().min(1).optional(),
   SELFBENCH_ARTIFACT_BACKEND: z.enum(["local", "gcs"]).default("local"),
   SELFBENCH_ARTIFACT_DIR: z.string().default(".selfbench/artifacts"),
   SELFBENCH_GCS_BUCKET: z.string().optional(),
   SELFBENCH_GCS_PREFIX: z.string().default("selfbench"),
-  SELFBENCH_EXECUTION_BACKEND: z.enum(["docker", "modal"]).default("docker"),
+  SELFBENCH_EXECUTION_BACKEND: z.enum(EXECUTION_BACKENDS).default("docker"),
   SELFBENCH_DOCKER_IMAGE: z.string().default("selfbench-sandbox:local"),
-  SELFBENCH_HARBOR_ENVIRONMENT: z.enum(["docker", "modal"]).optional(),
+  SELFBENCH_HARBOR_ENVIRONMENT: z.preprocess(
+    emptyStringAsUndefined,
+    z.enum(HARBOR_ENVIRONMENTS).optional(),
+  ),
   SELFBENCH_MODAL_APP: z.string().default("selfbench"),
   SELFBENCH_MODAL_ENVIRONMENT: z.string().optional(),
   SELFBENCH_MODAL_IMAGE: z.string().default("node:22-bookworm"),
+  SELFBENCH_VERCEL_IMAGE: z.preprocess(emptyStringAsUndefined, z.string().trim().min(1).optional()),
+  // Keep provider-specific validation in the Vercel branch so a stale Vercel
+  // variable cannot break an otherwise unrelated Docker or Modal worker.
+  SELFBENCH_VERCEL_TIMEOUT_CAP: z.preprocess(emptyStringAsUndefined, z.string().optional()),
   SELFBENCH_BUILD_COMMIT: z.preprocess(
     (value) => (value === "" ? undefined : value),
     z
@@ -22,7 +39,10 @@ const environmentSchema = z.object({
       .regex(/^[0-9a-f]{40}$/i)
       .optional(),
   ),
-  SELFBENCH_ACTIVITY_CONCURRENCY: z.coerce.number().int().min(1).max(100).optional(),
+  SELFBENCH_ACTIVITY_CONCURRENCY: z.preprocess(
+    emptyStringAsUndefined,
+    z.coerce.number().int().min(1).max(100).optional(),
+  ),
   SELFBENCH_TASK_QUEUE: z.string().default("selfbench-dev"),
   SELFBENCH_TEMPORAL_ADDRESS: z.string().default("127.0.0.1:7233"),
   SELFBENCH_TEMPORAL_NAMESPACE: z.string().default("default"),
@@ -33,25 +53,48 @@ const environmentSchema = z.object({
     .default(false),
 });
 
+export interface VercelCredentials {
+  readonly token: string;
+  readonly teamId: string;
+  readonly projectId: string;
+}
+
+type ExecutionConfig =
+  | { readonly kind: "docker"; readonly image: string }
+  | {
+      readonly kind: "modal";
+      readonly app: string;
+      readonly environment?: string;
+      readonly image: string;
+    }
+  | { readonly kind: "vercel"; readonly image: string; readonly timeoutCapMs: number };
+
+type WorkerExecutionConfig =
+  | Exclude<ExecutionConfig, { readonly kind: "vercel" }>
+  | {
+      readonly kind: "vercel";
+      readonly image: string;
+      readonly timeoutCapMs: number;
+      readonly credentials: VercelCredentials;
+    };
+
+const DEFAULT_ACTIVITY_CONCURRENCY = {
+  docker: 1,
+  modal: 20,
+  vercel: 4,
+} as const satisfies Record<ExecutionBackend, number>;
+
 export interface SelfBenchConfig {
   readonly apiHost: string;
   readonly apiPort: number;
-  readonly apiUrl: string;
   readonly apiToken?: string;
   readonly buildCommit?: string;
   readonly activityConcurrency: number;
   readonly artifact:
     | { readonly kind: "local"; readonly directory: string }
     | { readonly kind: "gcs"; readonly bucket: string; readonly prefix: string };
-  readonly execution:
-    | { readonly kind: "docker"; readonly image: string }
-    | {
-        readonly kind: "modal";
-        readonly app: string;
-        readonly environment?: string;
-        readonly image: string;
-      };
-  readonly harborEnvironment: "docker" | "modal";
+  readonly execution: ExecutionConfig;
+  readonly harborEnvironment: HarborEnvironment;
   readonly temporal: {
     readonly address: string;
     readonly namespace: string;
@@ -61,6 +104,14 @@ export interface SelfBenchConfig {
   };
 }
 
+export interface SelfBenchWorkerConfig extends Omit<SelfBenchConfig, "execution"> {
+  readonly execution: WorkerExecutionConfig;
+}
+
+export function isDigestPinnedOciImage(image: string): boolean {
+  return /^[^@\s]+@sha256:[0-9a-f]{64}$/i.test(image);
+}
+
 export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBenchConfig {
   const value = environmentSchema.parse(environment);
   if (
@@ -78,30 +129,56 @@ export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBe
         }
       : { kind: "local" as const, directory: value.SELFBENCH_ARTIFACT_DIR };
 
+  const harborEnvironment =
+    value.SELFBENCH_HARBOR_ENVIRONMENT ??
+    matchingHarborEnvironment(value.SELFBENCH_EXECUTION_BACKEND) ??
+    fail(
+      `SELFBENCH_HARBOR_ENVIRONMENT is required for ${value.SELFBENCH_EXECUTION_BACKEND} execution`,
+    );
+  let execution: ExecutionConfig;
+  switch (value.SELFBENCH_EXECUTION_BACKEND) {
+    case "docker":
+      execution = { kind: "docker", image: value.SELFBENCH_DOCKER_IMAGE };
+      break;
+    case "modal":
+      execution = {
+        kind: "modal",
+        app: value.SELFBENCH_MODAL_APP,
+        image: value.SELFBENCH_MODAL_IMAGE,
+        ...(value.SELFBENCH_MODAL_ENVIRONMENT
+          ? { environment: value.SELFBENCH_MODAL_ENVIRONMENT }
+          : {}),
+      };
+      break;
+    case "vercel": {
+      const image =
+        value.SELFBENCH_VERCEL_IMAGE ??
+        fail("SELFBENCH_VERCEL_IMAGE is required for Vercel execution");
+      if (!isDigestPinnedOciImage(image)) {
+        fail("SELFBENCH_VERCEL_IMAGE must be pinned by sha256 digest");
+      }
+      execution = {
+        kind: "vercel",
+        image,
+        timeoutCapMs: vercelTimeoutCap(value.SELFBENCH_VERCEL_TIMEOUT_CAP),
+      };
+      break;
+    }
+  }
+
   return {
     apiHost: value.SELFBENCH_API_HOST,
     apiPort: value.SELFBENCH_API_PORT,
-    apiUrl: value.SELFBENCH_API_URL,
     ...(value.SELFBENCH_API_TOKEN ? { apiToken: value.SELFBENCH_API_TOKEN } : {}),
     ...(value.SELFBENCH_BUILD_COMMIT
       ? { buildCommit: value.SELFBENCH_BUILD_COMMIT.toLowerCase() }
       : {}),
     activityConcurrency:
       value.SELFBENCH_ACTIVITY_CONCURRENCY ??
-      (value.SELFBENCH_EXECUTION_BACKEND === "modal" ? 20 : 1),
+      DEFAULT_ACTIVITY_CONCURRENCY[value.SELFBENCH_EXECUTION_BACKEND],
     artifact,
-    harborEnvironment: value.SELFBENCH_HARBOR_ENVIRONMENT ?? value.SELFBENCH_EXECUTION_BACKEND,
-    execution:
-      value.SELFBENCH_EXECUTION_BACKEND === "modal"
-        ? {
-            kind: "modal",
-            app: value.SELFBENCH_MODAL_APP,
-            image: value.SELFBENCH_MODAL_IMAGE,
-            ...(value.SELFBENCH_MODAL_ENVIRONMENT
-              ? { environment: value.SELFBENCH_MODAL_ENVIRONMENT }
-              : {}),
-          }
-        : { kind: "docker", image: value.SELFBENCH_DOCKER_IMAGE },
+    harborEnvironment,
+    execution,
     temporal: {
       address: value.SELFBENCH_TEMPORAL_ADDRESS,
       namespace: value.SELFBENCH_TEMPORAL_NAMESPACE,
@@ -112,6 +189,51 @@ export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBe
   };
 }
 
+export function loadWorkerConfig(
+  environment: NodeJS.ProcessEnv = process.env,
+): SelfBenchWorkerConfig {
+  const config = loadConfig(environment);
+  if (config.execution.kind !== "vercel") {
+    return { ...config, execution: config.execution };
+  }
+  return {
+    ...config,
+    execution: {
+      ...config.execution,
+      credentials: vercelCredentials(environment),
+    },
+  };
+}
+
+export function defaultStandaloneConcurrency(
+  config: Pick<SelfBenchConfig, "activityConcurrency" | "execution">,
+  existingDefault: number,
+): number {
+  return config.execution.kind === "vercel" ? config.activityConcurrency : existingDefault;
+}
+
+function vercelCredentials(environment: NodeJS.ProcessEnv): VercelCredentials {
+  const token = environment.VERCEL_TOKEN?.trim();
+  const teamId = environment.VERCEL_TEAM_ID?.trim();
+  const projectId = environment.VERCEL_PROJECT_ID?.trim();
+  if (!token || !teamId || !projectId) {
+    fail("VERCEL_TOKEN, VERCEL_TEAM_ID, and VERCEL_PROJECT_ID are required for Vercel execution");
+  }
+  return { token, teamId, projectId };
+}
+
+function vercelTimeoutCap(value: string | undefined): number {
+  if (value === undefined) {
+    return STANDARD_VERCEL_TIMEOUT_CAP_MS;
+  }
+  return z
+    .number()
+    .int()
+    .min(100)
+    .max(STANDARD_VERCEL_TIMEOUT_CAP_MS)
+    .parse(parseSandboxTimeoutCapText(value));
+}
+
 function fail(message: string): never {
   throw new Error(message);
 }

package/src/contracts.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { EXECUTION_BACKENDS, HARBOR_ENVIRONMENTS, matchingHarborEnvironment } from "./providers.js";
 
 export const commitSchema = z.string().regex(/^[0-9a-f]{40}$/i, "expected a full commit SHA");
 
@@ -34,6 +35,37 @@ const candidateCountsSchema = z
     message: "at most 100 candidates may be requested",
   });
 
+const runVersionSchema = z
+  .object({
+    selfbenchCommit: commitSchema,
+    executionBackend: z.enum(EXECUTION_BACKENDS),
+    harborEnvironment: z.enum(HARBOR_ENVIRONMENTS).optional(),
+    sandboxImage: z.string().min(1),
+    sandboxTimeoutCapMs: z.number().int().min(100).optional(),
+    schema: z.literal(1),
+  })
+  .transform((version, context) => {
+    const harborEnvironment =
+      version.harborEnvironment ?? matchingHarborEnvironment(version.executionBackend);
+    if (!harborEnvironment) {
+      context.addIssue({
+        code: "custom",
+        message: `harborEnvironment is required for ${version.executionBackend} execution`,
+        path: ["harborEnvironment"],
+      });
+      return z.NEVER;
+    }
+    if (version.sandboxTimeoutCapMs !== undefined && version.executionBackend !== "vercel") {
+      context.addIssue({
+        code: "custom",
+        message: "sandboxTimeoutCapMs is only valid for Vercel execution",
+        path: ["sandboxTimeoutCapMs"],
+      });
+      return z.NEVER;
+    }
+    return { ...version, harborEnvironment };
+  });
+
 export const runRequestSchema = z.object({
   runId: z.string().regex(/^[a-z0-9][a-z0-9-]{2,62}$/),
   repository: repositoryRefSchema,
@@ -44,12 +76,7 @@ export const runRequestSchema = z.object({
     model: z.string().min(1),
     reasoningEffort: z.literal("high"),
   }),
-  version: z.object({
-    selfbenchCommit: commitSchema,
-    executionBackend: z.enum(["docker", "modal"]),
-    sandboxImage: z.string().min(1),
-    schema: z.literal(1),
-  }),
+  version: runVersionSchema,
 });
 
 export type RunRequest = z.infer<typeof runRequestSchema>;
@@ -130,15 +157,10 @@ export type RunPhase =
   | "queued"
   | "discovering"
   | "authoring"
-  | "validating"
-  | "reviewing"
-  | "repairing"
-  | "auditing"
   | "exporting"
   | "complete"
   | "blocked"
   | "failed"
-  | "cancelling"
   | "cancelled";
 
 export interface TaskProgress {

package/src/eval-main.ts

@@ -2,6 +2,7 @@
 
 import { parseArgs } from "node:util";
 import { MATRIX_MODELS, type MatrixModel, runMatrix } from "./evaluate.js";
+import { isHarborEnvironment } from "./providers.js";
 
 const parsed = parseArgs({
   options: {
@@ -18,7 +19,7 @@ const parsed = parseArgs({
   strict: true,
 });
 if (parsed.values.help) {
-  console.log(`Run Harbor tasks through the fixed Codex subscription model matrix.
+  console.log(`Run Harbor tasks through the fixed Codex model matrix.
 
 Usage:
   self-bench-eval (--export FILE.tar.gz | --tasks DIRECTORY) --jobs DIRECTORY [options]
@@ -29,12 +30,12 @@ Options:
   --environment docker|modal Execution environment (default: modal)
   --concurrency N            Concurrent trials (default: 3)
   --model MODEL              Run only this model; may be repeated
-  --auth FILE                Codex ChatGPT auth.json path
+  --auth FILE                Optional Codex ChatGPT auth.json fallback
   -h, --help                 Show this help`);
   process.exit(0);
 }
-const environment = parsed.values.environment;
-if (environment !== "docker" && environment !== "modal") {
+const environment = parsed.values.environment ?? "modal";
+if (!isHarborEnvironment(environment)) {
   throw new Error("--environment must be docker or modal");
 }
 const concurrency = positiveInteger(parsed.values.concurrency, "--concurrency");

package/src/evaluate.ts

@@ -1,10 +1,12 @@
 import { cp, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { basename, join, resolve } from "node:path";
+import { harborChildEnvironment } from "./harbor-environment.js";
 import { archiveIncompleteHarborJob, tryReadHarborJobResult } from "./harbor-results.js";
 import { parallelMap } from "./parallel.js";
 import { runCommand } from "./process.js";
-import { assertCodexSubscriptionAuth } from "./subscription-auth.js";
+import type { HarborEnvironment } from "./providers.js";
+import { assertCodexSubscriptionAuth, openAiApiKey } from "./subscription-auth.js";
 
 export const MATRIX_MODELS = ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"] as const;
 export type MatrixModel = (typeof MATRIX_MODELS)[number];
@@ -15,7 +17,7 @@ export interface MatrixOptions {
   readonly tasksPath?: string;
   readonly jobsDirectory: string;
   readonly harborPath?: string;
-  readonly environment?: "docker" | "modal";
+  readonly environment?: HarborEnvironment;
   readonly concurrency?: number;
   readonly authPath?: string;
   readonly models?: readonly MatrixModel[];
@@ -40,8 +42,11 @@ export async function runMatrix(options: MatrixOptions): Promise<readonly Matrix
   const tasksDirectory = join(root, "tasks");
   await mkdir(root, { recursive: true });
   const taskDirectories = await resolveMatrixTasks(options, tasksDirectory);
+  const apiKey = openAiApiKey();
   const authPath = resolve(options.authPath ?? join(homedir(), ".codex/auth.json"));
-  await assertSubscriptionAuth(authPath);
+  if (!apiKey) {
+    await assertSubscriptionAuth(authPath);
+  }
   const models = options.models ?? MATRIX_MODELS;
   if (models.length < 1) {
     throw new Error("provide at least one evaluation model");
@@ -55,7 +60,7 @@ export async function runMatrix(options: MatrixOptions): Promise<readonly Matrix
       jobsDirectory: root,
       harborPath: options.harborPath ?? "harbor",
       environment: options.environment ?? "modal",
-      authPath,
+      ...(!apiKey ? { authPath } : {}),
       ...item,
     });
     completed += 1;
@@ -69,7 +74,7 @@ export async function runMatrix(options: MatrixOptions): Promise<readonly Matrix
         schemaVersion: 1,
         agent: "codex",
         agentVersion: CODEX_VERSION,
-        auth: "codex-subscription",
+        auth: apiKey ? "openai-api-key" : "codex-subscription",
         reasoningEffort: "high",
         models,
         taskCount: taskDirectories.length,
@@ -111,8 +116,8 @@ async function runTrial(input: {
   readonly model: MatrixModel;
   readonly jobsDirectory: string;
   readonly harborPath: string;
-  readonly environment: "docker" | "modal";
-  readonly authPath: string;
+  readonly environment: HarborEnvironment;
+  readonly authPath?: string;
 }): Promise<MatrixTrialSummary> {
   const taskId = basename(input.taskDirectory);
   const jobName = `${taskId}-${input.model}`.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
@@ -122,10 +127,12 @@ async function runTrial(input: {
   }
   await archiveIncompleteHarborJob(input.jobsDirectory, jobName);
 
-  const environment = { ...process.env };
-  delete environment.OPENAI_API_KEY;
-  environment.CODEX_FORCE_AUTH_JSON = "1";
-  environment.CODEX_AUTH_JSON_PATH = input.authPath;
+  const environment = harborChildEnvironment();
+  if (input.authPath) {
+    delete environment.OPENAI_API_KEY;
+    environment.CODEX_FORCE_AUTH_JSON = "1";
+    environment.CODEX_AUTH_JSON_PATH = input.authPath;
+  }
   let result: Awaited<ReturnType<typeof runCommand>>;
   try {
     result = await runCommand(

package/src/harbor-environment.ts

@@ -0,0 +1,17 @@
+const VERCEL_CONTROL_CREDENTIALS = [
+  "VERCEL_AUTH_TOKEN",
+  "VERCEL_TOKEN",
+  "VERCEL_TEAM_ID",
+  "VERCEL_PROJECT_ID",
+  "VERCEL_OIDC_TOKEN",
+] as const;
+
+export function harborChildEnvironment(
+  environment: NodeJS.ProcessEnv = process.env,
+): NodeJS.ProcessEnv {
+  const child = { ...environment };
+  for (const key of VERCEL_CONTROL_CREDENTIALS) {
+    delete child[key];
+  }
+  return child;
+}

package/src/harbor-results.ts

@@ -20,6 +20,8 @@ const infrastructurePatterns = [
   /modal.*(?:unavailable|timed out|timeout)/i,
   /image build for im-[a-z0-9]+ failed/i,
   /all predefined address pools have been fully subnetted/i,
+  /mounts denied/i,
+  /network-policy[\s\S]*could not process rule/i,
 ];
 
 class IncompleteHarborJobError extends Error {}

package/src/process.ts

@@ -6,6 +6,8 @@ export interface CommandResult {
   readonly exitCode: number;
 }
 
+export type CommandOutputHandler = (stream: "stdout" | "stderr", chunk: Uint8Array) => void;
+
 export interface CommandOptions {
   readonly cwd?: string;
   readonly env?: NodeJS.ProcessEnv;
@@ -14,7 +16,7 @@ export interface CommandOptions {
   readonly inactivityTimeoutMs?: number;
   readonly allowFailure?: boolean;
   readonly signal?: AbortSignal;
-  readonly onOutput?: (stream: "stdout" | "stderr", chunk: Uint8Array) => void;
+  readonly onOutput?: CommandOutputHandler;
 }
 
 export class InactivityTimeoutError extends Error {

package/src/provenance.ts

@@ -4,7 +4,6 @@ import { assertPullRequestBelongsToRepository, githubRepository } from "./github
 import { runCommand } from "./process.js";
 
 export type SessionProvenanceFormat = "codex" | "claude-code" | "pi" | "generic";
-export type ProvenanceFormat = SessionProvenanceFormat | "github-pull-request";
 
 interface ProvenanceMessageBase {
   readonly sessionId: string;

package/src/providers.ts

@@ -0,0 +1,22 @@
+export const EXECUTION_BACKENDS = ["docker", "modal", "vercel"] as const;
+export type ExecutionBackend = (typeof EXECUTION_BACKENDS)[number];
+
+export const HARBOR_ENVIRONMENTS = ["docker", "modal"] as const;
+export type HarborEnvironment = (typeof HARBOR_ENVIRONMENTS)[number];
+
+const executionBackends: ReadonlySet<string> = new Set(EXECUTION_BACKENDS);
+const harborEnvironments: ReadonlySet<string> = new Set(HARBOR_ENVIRONMENTS);
+
+export function isExecutionBackend(value: string): value is ExecutionBackend {
+  return executionBackends.has(value);
+}
+
+export function isHarborEnvironment(value: string): value is HarborEnvironment {
+  return harborEnvironments.has(value);
+}
+
+export function matchingHarborEnvironment(
+  backend: ExecutionBackend,
+): HarborEnvironment | undefined {
+  return isHarborEnvironment(backend) ? backend : undefined;
+}