self-bench 0.3.2 → 0.3.4

package/src/reaudit-main.ts

@@ -10,7 +10,7 @@ import {
   couplingReviewInput,
   couplingReviewSchema,
 } from "./codex-review.js";
-import { loadConfig } from "./config.js";
+import { defaultStandaloneConcurrency, loadWorkerConfig } from "./config.js";
 import {
   buildCouplingEvidence,
   discoverContractArtifacts,
@@ -20,14 +20,14 @@ import {
 import { parallelMap } from "./parallel.js";
 import { runCommand } from "./process.js";
 import { createSandboxExecutor, type SandboxExecutor } from "./sandbox.js";
-import { loadPiSubscriptionAuth } from "./subscription-auth.js";
+import { loadPiModelAuth } from "./subscription-auth.js";
 
 const parsed = parseArgs({
   options: {
     tasks: { type: "string" },
     task: { type: "string" },
     output: { type: "string" },
-    concurrency: { type: "string", default: "10" },
+    concurrency: { type: "string" },
     help: { type: "boolean", short: "h" },
   },
   strict: true,
@@ -39,7 +39,7 @@ Usage:
   self-bench-reaudit --tasks DIRECTORY --output REPORT.json [options]
 
 Options:
-  --concurrency N  Concurrent Sol reviews (default: 10)
+  --concurrency N  Concurrent Sol reviews (default: 10; Vercel: worker setting, default 4)
   --task ID        Review only one task ID
   -h, --help       Show this help`);
   process.exit(0);
@@ -47,12 +47,15 @@ Options:
 
 const tasksDirectory = resolve(parsed.values.tasks ?? fail("--tasks is required"));
 const outputPath = resolve(parsed.values.output ?? fail("--output is required"));
-const concurrency = positiveInteger(parsed.values.concurrency, "--concurrency");
-const config = loadConfig();
+const config = loadWorkerConfig();
+const concurrency = positiveInteger(
+  parsed.values.concurrency ?? String(defaultStandaloneConcurrency(config, 10)),
+  "--concurrency",
+);
 const sandbox = createSandboxExecutor(config.execution);
-const [taskIds, piAuth, reviewer] = await Promise.all([
+const [taskIds, modelAuth, reviewer] = await Promise.all([
   readdir(tasksDirectory),
-  loadPiSubscriptionAuth(),
+  loadPiModelAuth(),
   readFile(join(assetRoot(), "dist/sandbox-review.bundle.js")),
 ]);
 const directories = (
@@ -79,7 +82,7 @@ const tasks = await parallelMap(directories, concurrency, async (taskDirectory)
   const taskId = basename(taskDirectory);
   console.error(`reviewing ${taskId}`);
   try {
-    const report = await auditTask(taskDirectory, taskId, piAuth, reviewer, sandbox);
+    const report = await auditTask(taskDirectory, taskId, modelAuth, reviewer, sandbox);
     console.error(`${taskId}: ${report.resolution.verdict}`);
     return report;
   } catch (error) {
@@ -113,7 +116,7 @@ console.log(JSON.stringify({ output: outputPath, ...report.summary }, null, 2));
 async function auditTask(
   taskDirectory: string,
   taskId: string,
-  piAuth: string,
+  modelAuth: { apiKey?: string; authJson?: string },
   reviewer: Uint8Array,
   sandbox: SandboxExecutor,
 ) {
@@ -151,7 +154,10 @@ async function auditTask(
         },
       ],
       outputPaths: ["/work/review.json"],
-      secrets: { SELFBENCH_PI_AUTH_JSON: piAuth },
+      secrets: {
+        ...(modelAuth.apiKey ? { OPENAI_API_KEY: modelAuth.apiKey } : {}),
+        ...(modelAuth.authJson ? { SELFBENCH_PI_AUTH_JSON: modelAuth.authJson } : {}),
+      },
       environment: { SELFBENCH_REVIEW_OUTPUT: "/work/review.json" },
       command: ["node", "/work/sandbox-review.js"],
     });

package/src/repair-main.ts

@@ -5,11 +5,11 @@ import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { loadConfig } from "./config.js";
+import { defaultStandaloneConcurrency, loadWorkerConfig } from "./config.js";
 import { parallelMap } from "./parallel.js";
 import { runCommand } from "./process.js";
 import { createSandboxExecutor } from "./sandbox.js";
-import { loadCodexSubscriptionAuth } from "./subscription-auth.js";
+import { loadCodexModelAuth } from "./subscription-auth.js";
 
 const parsed = parseArgs({
   options: {
@@ -17,7 +17,7 @@ const parsed = parseArgs({
     review: { type: "string" },
     output: { type: "string" },
     task: { type: "string" },
-    concurrency: { type: "string", default: "9" },
+    concurrency: { type: "string" },
     model: { type: "string", default: "gpt-5.6-sol" },
     help: { type: "boolean", short: "h" },
   },
@@ -30,7 +30,7 @@ Usage:
   self-bench-repair --tasks DIRECTORY --review REPORT.json --output DIRECTORY [options]
 
 Options:
-  --concurrency N  Concurrent repair sandboxes (default: 9)
+  --concurrency N  Concurrent repair sandboxes (default: 9; Vercel: worker setting, default 4)
   --model MODEL    Codex subscription model (default: gpt-5.6-sol)
   --task ID        Repair only one coupled task
   -h, --help       Show this help`);
@@ -43,7 +43,11 @@ const outputDirectory = resolve(parsed.values.output ?? fail("--output is requir
 if (outputDirectory === tasksDirectory || outputDirectory.startsWith(`${tasksDirectory}/`)) {
   throw new Error("--output must be outside --tasks");
 }
-const concurrency = positiveInteger(parsed.values.concurrency, "--concurrency");
+const config = loadWorkerConfig();
+const concurrency = positiveInteger(
+  parsed.values.concurrency ?? String(defaultStandaloneConcurrency(config, 9)),
+  "--concurrency",
+);
 const rawReview = JSON.parse(await readFile(reviewPath, "utf8")) as unknown;
 const review = reviewReport(rawReview);
 const coupled = new Map(
@@ -77,10 +81,9 @@ for (const source of sourceTasks) {
   }
 }
 
-const config = loadConfig();
 const sandbox = createSandboxExecutor(config.execution);
-const [authJson, repairer] = await Promise.all([
-  loadCodexSubscriptionAuth(),
+const [modelAuth, repairer] = await Promise.all([
+  loadCodexModelAuth(),
   readFile(join(assetRoot(), "dist/sandbox-repair.bundle.js")),
 ]);
 const results = await parallelMap([...coupled.values()], concurrency, async (taskReview) => {
@@ -103,7 +106,10 @@ const results = await parallelMap([...coupled.values()], concurrency, async (tas
         { path: "/work/sandbox-repair.js", contents: repairer },
       ],
       outputPaths: ["/work/repaired-task.tar.gz", "/work/repair-report.json"],
-      secrets: { SELFBENCH_CODEX_AUTH_JSON: authJson },
+      secrets: {
+        ...(modelAuth.apiKey ? { OPENAI_API_KEY: modelAuth.apiKey } : {}),
+        ...(modelAuth.authJson ? { SELFBENCH_CODEX_AUTH_JSON: modelAuth.authJson } : {}),
+      },
       environment: { SELFBENCH_REPAIR_MODEL: parsed.values.model ?? "gpt-5.6-sol" },
       command: [
         "node",

package/src/sandbox-repair.ts

@@ -50,13 +50,15 @@ await runCommand("git", [
 ]);
 await runCommand("git", ["-C", repositoryDirectory, "add", "-N", "--all"]);
 
+const codexAuth = process.env.SELFBENCH_CODEX_AUTH_JSON;
+const apiKey = process.env.OPENAI_API_KEY;
+if (!apiKey && !codexAuth) {
+  fail("OPENAI_API_KEY or SELFBENCH_CODEX_AUTH_JSON is required");
+}
 const codexHome = join(homedir(), ".codex");
 const authPath = join(codexHome, "auth.json");
 await mkdir(codexHome, { recursive: true });
-await writeFile(
-  authPath,
-  process.env.SELFBENCH_CODEX_AUTH_JSON ?? fail("SELFBENCH_CODEX_AUTH_JSON is required"),
-);
+await writeFile(authPath, codexAuth ?? `${JSON.stringify({ OPENAI_API_KEY: apiKey })}\n`);
 await chmod(authPath, 0o600);
 const promptPath = join(tmpdir(), `selfbench-repair-${taskId}.md`);
 await writeFile(
@@ -86,7 +88,7 @@ const codex = await runCommand(
   {
     allowFailure: true,
     timeoutMs: 90 * 60 * 1000,
-    env: withoutApiKey(process.env),
+    env: process.env,
     input: await readFile(promptPath, "utf8"),
     onOutput: (stream, chunk) => {
       (stream === "stdout" ? process.stdout : process.stderr).write(chunk);
@@ -149,12 +151,6 @@ await writeFile(
   )}\n`,
 );
 
-function withoutApiKey(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  const output = { ...environment };
-  delete output.OPENAI_API_KEY;
-  return output;
-}
-
 function fail(message: string): never {
   throw new Error(message);
 }

package/src/sandbox-review.ts

@@ -1,17 +1,19 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { reviewCouplingWithCodex } from "./codex-review.js";
 
+const apiKey = process.env.OPENAI_API_KEY;
 const authJson = process.env.SELFBENCH_PI_AUTH_JSON;
 const outputPath = process.env.SELFBENCH_REVIEW_OUTPUT;
-if (!authJson) {
-  throw new Error("SELFBENCH_PI_AUTH_JSON is required");
+if (!apiKey && !authJson) {
+  throw new Error("OPENAI_API_KEY or SELFBENCH_PI_AUTH_JSON is required");
 }
 if (!outputPath) {
   throw new Error("SELFBENCH_REVIEW_OUTPUT is required");
 }
 
 const review = await reviewCouplingWithCodex({
-  authJson,
+  ...(apiKey ? { apiKey } : {}),
+  ...(authJson ? { authJson } : {}),
   prompt: await readFile("/work/review-input.md", "utf8"),
 });
 await writeFile(outputPath, `${JSON.stringify(review, null, 2)}\n`, { flag: "wx" });

package/src/sandbox-timeout.ts

@@ -0,0 +1,56 @@
+import type {
+  SandboxExecutor,
+  SandboxRequest,
+  SandboxResult,
+  SandboxRunOptions,
+} from "./sandbox.js";
+
+export const STANDARD_VERCEL_TIMEOUT_CAP_MS = 2 * 60 * 60 * 1_000;
+export const HOBBY_VERCEL_TIMEOUT_CAP_MS = 45 * 60 * 1_000;
+
+export function parseSandboxTimeoutCapText(value: string): number | undefined {
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "") {
+    return undefined;
+  }
+  const match = /^(\d+)(ms|s|m|h)?$/.exec(normalized);
+  if (!match?.[1]) {
+    return Number.NaN;
+  }
+  const amount = Number(match[1]);
+  const multiplier =
+    match[2] === "h"
+      ? 60 * 60 * 1_000
+      : match[2] === "m"
+        ? 60 * 1_000
+        : match[2] === "s"
+          ? 1_000
+          : 1;
+  return amount * multiplier;
+}
+
+export class TimeoutCappedSandboxExecutor implements SandboxExecutor {
+  readonly #delegate: SandboxExecutor;
+  readonly #timeoutCapMs: number;
+
+  constructor(delegate: SandboxExecutor, timeoutCapMs: number) {
+    if (!Number.isInteger(timeoutCapMs) || timeoutCapMs < 100) {
+      throw new Error("sandbox timeout cap must be an integer of at least 100ms");
+    }
+    this.#delegate = delegate;
+    this.#timeoutCapMs = timeoutCapMs;
+  }
+
+  async run(request: SandboxRequest, options?: SandboxRunOptions): Promise<SandboxResult> {
+    return await this.#delegate.run(
+      request.timeoutMs > this.#timeoutCapMs
+        ? { ...request, timeoutMs: this.#timeoutCapMs }
+        : request,
+      options,
+    );
+  }
+
+  close(): void {
+    this.#delegate.close();
+  }
+}

package/src/sandbox-validation-repair.ts

@@ -68,10 +68,19 @@ await Promise.all([
 ]);
 
 const piHome = join(homedir(), ".pi/agent");
-const piAuth = process.env.SELFBENCH_PI_AUTH_JSON ?? fail("SELFBENCH_PI_AUTH_JSON is required");
+const piAuth = process.env.SELFBENCH_PI_AUTH_JSON;
+if (!process.env.OPENAI_API_KEY && !piAuth) {
+  fail("OPENAI_API_KEY or SELFBENCH_PI_AUTH_JSON is required");
+}
 await mkdir(piHome, { recursive: true });
 await Promise.all([
-  writeFile(join(piHome, "auth.json"), piAuth).then(() => chmod(join(piHome, "auth.json"), 0o600)),
+  ...(piAuth
+    ? [
+        writeFile(join(piHome, "auth.json"), piAuth).then(() =>
+          chmod(join(piHome, "auth.json"), 0o600),
+        ),
+      ]
+    : []),
   writeFile(join(piHome, "settings.json"), `${JSON.stringify({ transport: "auto" })}\n`),
 ]);
 const promptPath = join(tmpdir(), `selfbench-validation-repair-${originalDefinition.taskId}.md`);
@@ -98,7 +107,7 @@ const pi = await runCommand(
     "--no-context-files",
     "--no-extensions",
     "--provider",
-    "openai-codex",
+    process.env.OPENAI_API_KEY ? "openai" : "openai-codex",
     "--model",
     process.env.SELFBENCH_REPAIR_MODEL ?? "gpt-5.6-sol",
     "--thinking",
@@ -111,7 +120,7 @@ const pi = await runCommand(
     allowFailure: true,
     timeoutMs: 90 * 60 * 1000,
     cwd: repositoryDirectory,
-    env: withoutApiKey(process.env),
+    env: process.env,
     onOutput: (stream, chunk) => {
       (stream === "stdout" ? process.stdout : process.stderr).write(chunk);
     },
@@ -163,12 +172,6 @@ await Promise.all([
   ),
 ]);
 
-function withoutApiKey(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  const output = { ...environment };
-  delete output.OPENAI_API_KEY;
-  return output;
-}
-
 function fail(message: string): never {
   throw new Error(message);
 }

package/src/sandbox.ts

@@ -1,6 +1,8 @@
-import type { SelfBenchConfig } from "./config.js";
+import type { SelfBenchWorkerConfig } from "./config.js";
 import { DockerSandboxExecutor } from "./docker-executor.js";
 import { ModalSandboxExecutor } from "./modal-executor.js";
+import { TimeoutCappedSandboxExecutor } from "./sandbox-timeout.js";
+import { VercelSandboxExecutor } from "./vercel-executor.js";
 
 export interface SandboxFile {
   readonly path: string;
@@ -44,8 +46,16 @@ export interface SandboxExecutor {
   close(): void;
 }
 
-export function createSandboxExecutor(config: SelfBenchConfig["execution"]): SandboxExecutor {
-  return config.kind === "modal"
-    ? new ModalSandboxExecutor(config)
-    : new DockerSandboxExecutor(config);
+export function createSandboxExecutor(config: SelfBenchWorkerConfig["execution"]): SandboxExecutor {
+  switch (config.kind) {
+    case "docker":
+      return new DockerSandboxExecutor(config);
+    case "modal":
+      return new ModalSandboxExecutor(config);
+    case "vercel":
+      return new TimeoutCappedSandboxExecutor(
+        new VercelSandboxExecutor(config),
+        config.timeoutCapMs,
+      );
+  }
 }

package/src/subscription-auth.ts

@@ -3,6 +3,34 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { runCommand } from "./process.js";
 
+export interface PiModelAuth {
+  readonly provider: "openai" | "openai-codex";
+  readonly apiKey?: string;
+  readonly authJson?: string;
+}
+
+export interface CodexModelAuth {
+  readonly apiKey?: string;
+  readonly authJson?: string;
+}
+
+export function openAiApiKey(): string | undefined {
+  const key = process.env.OPENAI_API_KEY?.trim();
+  return key || undefined;
+}
+
+export async function loadPiModelAuth(): Promise<PiModelAuth> {
+  const apiKey = openAiApiKey();
+  return apiKey
+    ? { provider: "openai", apiKey }
+    : { provider: "openai-codex", authJson: await loadPiSubscriptionAuth() };
+}
+
+export async function loadCodexModelAuth(): Promise<CodexModelAuth> {
+  const apiKey = openAiApiKey();
+  return apiKey ? { apiKey } : { authJson: await loadCodexSubscriptionAuth() };
+}
+
 export async function loadPiSubscriptionAuth(): Promise<string> {
   const raw =
     process.env.SELFBENCH_PI_AUTH_JSON ??
@@ -28,7 +56,8 @@ export function assertCodexSubscriptionAuth(value: unknown, source = "Codex auth
 
 export async function loadCodexSubscriptionAuth(): Promise<string> {
   const path = process.env.CODEX_AUTH_JSON_PATH ?? join(homedir(), ".codex/auth.json");
-  const parsed = JSON.parse(await readFile(path, "utf8")) as unknown;
+  const raw = process.env.SELFBENCH_CODEX_AUTH_JSON ?? (await readFile(path, "utf8"));
+  const parsed = JSON.parse(raw) as unknown;
   assertCodexSubscriptionAuth(parsed, path);
   const auth = parsed as Record<string, unknown>;
   return JSON.stringify({
@@ -38,22 +67,6 @@ export async function loadCodexSubscriptionAuth(): Promise<string> {
   });
 }
 
-export async function subscriptionBearerToken(model: string): Promise<string> {
-  const result = await runCommand("pi", [
-    "auth",
-    "print-bearer-token",
-    "--provider",
-    "openai-codex",
-    "--model",
-    model,
-  ]);
-  const token = result.stdout.trim();
-  if (!token) {
-    throw new Error(`Pi returned no openai-codex subscription bearer token for ${model}`);
-  }
-  return token;
-}
-
 export async function githubToken(): Promise<string | undefined> {
   if (process.env.GH_TOKEN) {
     return process.env.GH_TOKEN;

package/src/{activities.ts → temporal/activities.ts}

@@ -5,20 +5,19 @@ import { fileURLToPath } from "node:url";
 import { CancelledFailure, Context } from "@temporalio/activity";
 import { ApplicationFailure } from "@temporalio/common";
 import { z } from "zod";
-import { type ArtifactStore, createArtifactStore } from "./artifacts.js";
-import { auditTaskDefinition } from "./audit.js";
+import { type ArtifactStore, createArtifactStore } from "../artifacts.js";
+import { auditTaskDefinition } from "../audit.js";
 import {
   COUPLING_REVIEW_MODEL,
   couplingReviewInput,
   couplingReviewSchema,
-} from "./codex-review.js";
-import type { SelfBenchConfig } from "./config.js";
+} from "../codex-review.js";
+import type { SelfBenchConfig, SelfBenchWorkerConfig } from "../config.js";
 import {
   type ArtifactRef,
   type AuditResult,
   type AuthoredTask,
   type AuthorOutcome,
-  artifactRefSchema,
   type Candidate,
   candidateSchema,
   type Difficulty,
@@ -27,29 +26,26 @@ import {
   type RunRequest,
   taskDefinitionSchema,
   type ValidationResult,
-} from "./contracts.js";
+} from "../contracts.js";
 import {
   buildCouplingEvidence,
   discoverContractArtifacts,
   resolveCouplingReview,
   scanBaseContractArtifacts,
-} from "./coupling.js";
-import { assertPullRequestBelongsToRepository } from "./github.js";
+} from "../coupling.js";
+import { assertPullRequestBelongsToRepository } from "../github.js";
+import { harborChildEnvironment } from "../harbor-environment.js";
 import {
   type HarborJobResult,
   harborInfrastructureError,
   readHarborJobResult,
-} from "./harbor-results.js";
-import { refreshHarborTask } from "./harbor-task.js";
-import { sha256 } from "./hash.js";
-import { runCommand } from "./process.js";
-import { assertProvenanceMatchesPullRequest, type ProvenanceMessage } from "./provenance.js";
-import { createSandboxExecutor, type SandboxExecutor, type SandboxRunOptions } from "./sandbox.js";
-import {
-  githubToken,
-  loadCodexSubscriptionAuth,
-  loadPiSubscriptionAuth,
-} from "./subscription-auth.js";
+} from "../harbor-results.js";
+import { refreshHarborTask } from "../harbor-task.js";
+import { sha256 } from "../hash.js";
+import { runCommand } from "../process.js";
+import { assertProvenanceMatchesPullRequest, type ProvenanceMessage } from "../provenance.js";
+import { createSandboxExecutor, type SandboxExecutor, type SandboxRunOptions } from "../sandbox.js";
+import { githubToken, loadCodexModelAuth, loadPiModelAuth } from "../subscription-auth.js";
 
 const HARBOR_INFRASTRUCTURE_FAILURE_TYPE = "HarborInfrastructureFailure";
 const DISCOVERY_TIMEOUT_MS = 45 * 60 * 1000;
@@ -119,7 +115,7 @@ export interface SelfBenchActivities {
   buildExport(input: ExportInput): Promise<ArtifactRef>;
 }
 
-export function createActivities(config: SelfBenchConfig): SelfBenchActivities {
+export function createActivities(config: SelfBenchWorkerConfig): SelfBenchActivities {
   const store = createArtifactStore(config.artifact);
   const sandbox = createSandboxExecutor(config.execution);
   return {
@@ -178,7 +174,7 @@ async function discoverCandidateShard(
   } else {
     const [extension, piAuth, ghToken] = await Promise.all([
       readAsset("src/extensions/discovery.ts"),
-      loadPiSubscriptionAuth(),
+      loadPiModelAuth(),
       githubToken(),
     ]);
     Context.current().heartbeat(
@@ -200,7 +196,8 @@ async function discoverCandidateShard(
             ],
             outputPaths: ["/work/discovery.json"],
             secrets: {
-              SELFBENCH_PI_AUTH_JSON: piAuth,
+              ...(piAuth.apiKey ? { OPENAI_API_KEY: piAuth.apiKey } : {}),
+              ...(piAuth.authJson ? { SELFBENCH_PI_AUTH_JSON: piAuth.authJson } : {}),
               ...(ghToken ? { GH_TOKEN: ghToken } : {}),
             },
             environment: {
@@ -356,7 +353,7 @@ async function authorCandidate(
     readAsset("src/extensions/authoring.ts"),
     readAsset("src/skills/selfbench/SKILL.md"),
     readAsset("dist/sandbox-author.bundle.js"),
-    loadPiSubscriptionAuth(),
+    loadPiModelAuth(),
     githubToken(),
   ]);
   const prompt = authoringPrompt(run, candidate);
@@ -378,7 +375,8 @@ async function authorCandidate(
           ],
           outputPaths: ["/work/task.tar.gz", "/work/definition.json"],
           secrets: {
-            SELFBENCH_PI_AUTH_JSON: piAuth,
+            ...(piAuth.apiKey ? { OPENAI_API_KEY: piAuth.apiKey } : {}),
+            ...(piAuth.authJson ? { SELFBENCH_PI_AUTH_JSON: piAuth.authJson } : {}),
             ...(ghToken ? { GH_TOKEN: ghToken } : {}),
           },
           environment: {
@@ -591,9 +589,8 @@ async function repairValidationTask(
     store.get(input.task.bundle),
     store.get(input.task.definition),
     readAsset("dist/sandbox-validation-repair.bundle.js"),
-    loadPiSubscriptionAuth(),
-  ]);
-  // Full verifier logs remain durable artifacts. The validation reason already carries bounded
+    loadPiModelAuth(),
+  ]); // Full verifier logs remain durable artifacts. The validation reason already carries bounded
   // tails for failed gates, which keeps the repair prompt within the model context window.
   const diagnostics = Buffer.from(input.validation.reason ?? "validation failed without a reason");
   const result = await withActivityHeartbeats(
@@ -616,7 +613,10 @@ async function repairValidationTask(
             "/work/repaired-test.patch",
             "/work/repair-report.json",
           ],
-          secrets: { SELFBENCH_PI_AUTH_JSON: authJson },
+          secrets: {
+            ...(authJson.apiKey ? { OPENAI_API_KEY: authJson.apiKey } : {}),
+            ...(authJson.authJson ? { SELFBENCH_PI_AUTH_JSON: authJson.authJson } : {}),
+          },
           environment: { SELFBENCH_REPAIR_MODEL: input.run.authoring.model },
           command: [
             "node",
@@ -704,7 +704,7 @@ async function reviewTask(
     });
     const [reviewer, authJson] = await Promise.all([
       readAsset("dist/sandbox-review.bundle.js"),
-      loadPiSubscriptionAuth(),
+      loadPiModelAuth(),
     ]);
     const result = await withActivityHeartbeats(
       `running sandboxed coupling review for ${input.task.taskId}`,
@@ -728,7 +728,10 @@ async function reviewTask(
               },
             ],
             outputPaths: ["/work/review.json"],
-            secrets: { SELFBENCH_PI_AUTH_JSON: authJson },
+            secrets: {
+              ...(authJson.apiKey ? { OPENAI_API_KEY: authJson.apiKey } : {}),
+              ...(authJson.authJson ? { SELFBENCH_PI_AUTH_JSON: authJson.authJson } : {}),
+            },
             environment: { SELFBENCH_REVIEW_OUTPUT: "/work/review.json" },
             command: ["node", "/work/sandbox-review.js"],
           },
@@ -796,7 +799,7 @@ async function repairTask(
     store.get(input.task.bundle),
     store.get(input.review),
     readAsset("dist/sandbox-repair.bundle.js"),
-    loadCodexSubscriptionAuth(),
+    loadCodexModelAuth(),
   ]);
   const result = await withActivityHeartbeats(
     `running test repair sandbox for ${input.task.taskId}`,
@@ -813,7 +816,10 @@ async function repairTask(
             { path: "/work/sandbox-repair.js", contents: repairer },
           ],
           outputPaths: ["/work/repaired-task.tar.gz", "/work/repair-report.json"],
-          secrets: { SELFBENCH_CODEX_AUTH_JSON: authJson },
+          secrets: {
+            ...(authJson.apiKey ? { OPENAI_API_KEY: authJson.apiKey } : {}),
+            ...(authJson.authJson ? { SELFBENCH_CODEX_AUTH_JSON: authJson.authJson } : {}),
+          },
           environment: { SELFBENCH_REPAIR_MODEL: input.run.authoring.model },
           command: [
             "node",
@@ -980,7 +986,7 @@ function modalAgentScript(extension: string, tool: string): string {
 clone_source
 cd /work/repo
 pi --print --mode json --no-session --no-approve --no-skills --no-prompt-templates --no-context-files --no-extensions \\
-  --extension /work/${extension} --provider openai-codex --model "$AUTHOR_MODEL" --thinking high \\
+  --extension /work/${extension} --provider "$(model_provider)" --model "$AUTHOR_MODEL" --thinking high \\
   --tools read,bash,grep,find,ls,${tool} "$(cat /work/prompt.txt)" 2>&1`;
 }
 
@@ -991,7 +997,7 @@ mkdir -p /work/tasks
 cd /work/repo
 pi --print --mode json --no-session --no-approve --no-prompt-templates --no-context-files --no-extensions \\
   --skill /work/selfbench-skill --extension /work/authoring.ts \\
-  --provider openai-codex --model "$AUTHOR_MODEL" --thinking high \\
+  --provider "$(model_provider)" --model "$AUTHOR_MODEL" --thinking high \\
   --tools read,bash,grep,find,ls,submit_task "$(cat /work/prompt.txt)" 2>&1
 node /work/sandbox-author.js /work/tasks /work/repo /work/harbor-task
 cp /work/tasks/*/definition.json /work/definition.json
@@ -1001,9 +1007,13 @@ tar -czf /work/task.tar.gz -C /work harbor-task`;
 function sandboxBootstrap(): string {
   return `set -euo pipefail
 mkdir -p "$HOME/.pi/agent"
-printf '%s' "$SELFBENCH_PI_AUTH_JSON" > "$HOME/.pi/agent/auth.json"
+if [ -n "\${SELFBENCH_PI_AUTH_JSON:-}" ]; then
+  printf '%s' "$SELFBENCH_PI_AUTH_JSON" > "$HOME/.pi/agent/auth.json"
+  chmod 600 "$HOME/.pi/agent/auth.json"
+fi
 printf '%s\n' '{"transport":"auto"}' > "$HOME/.pi/agent/settings.json"
-chmod 600 "$HOME/.pi/agent/auth.json" "$HOME/.pi/agent/settings.json"
+chmod 600 "$HOME/.pi/agent/settings.json"
+model_provider() { [ -n "\${OPENAI_API_KEY:-}" ] && printf openai || printf openai-codex; }
 cleanup() { rm -f "$HOME/.pi/agent/auth.json" "$HOME/.pi/agent/settings.json" "$HOME/.git-credentials"; }
 trap cleanup EXIT
 clone_source() {
@@ -1045,7 +1055,12 @@ async function runHarborGate(
       "--yes",
       "--quiet",
     ],
-    { allowFailure: true, timeoutMs: 3 * 60 * 60 * 1000, signal },
+    {
+      allowFailure: true,
+      env: harborChildEnvironment(),
+      timeoutMs: 3 * 60 * 60 * 1000,
+      signal,
+    },
   );
   if (result.exitCode !== 0) {
     throw ApplicationFailure.create({
@@ -1204,7 +1219,7 @@ function parseProvenance(value: Uint8Array): ProvenanceMessage[] {
 }
 
 function readAsset(relativePath: string): Promise<Buffer> {
-  const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+  const root = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
   return readFile(join(root, relativePath));
 }
 
@@ -1230,7 +1245,3 @@ function numberValue(value: unknown): number {
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-
-export function parseArtifactReference(value: unknown): ArtifactRef {
-  return artifactRefSchema.parse(value);
-}

package/src/{temporal.ts → temporal/connection.ts}

@@ -1,6 +1,6 @@
 import { Connection } from "@temporalio/client";
 import { NativeConnection } from "@temporalio/worker";
-import type { SelfBenchConfig } from "./config.js";
+import type { SelfBenchConfig } from "../config.js";
 
 export async function connectTemporalClient(
   config: SelfBenchConfig["temporal"],