self-bench 0.3.3 → 0.3.4

package/src/api.ts

@@ -11,6 +11,7 @@ import type { SelfBenchConfig } from "./config.js";
 import {
   artifactRefSchema,
   type RunPhase,
+  type RunRequest,
   type RunStatus,
   repositoryRefSchema,
   runRequestSchema,
@@ -68,26 +69,10 @@ export async function startApi(config: SelfBenchConfig): Promise<() => Promise<v
         return;
       }
       if (request.method === "POST" && url.pathname === "/v1/runs") {
-        const submission = submissionSchema.parse(
+        const workflowInput = buildRunRequest(
+          config,
           JSON.parse((await readBody(request)).toString("utf8")),
         );
-        const workflowInput = runRequestSchema.parse({
-          runId: submission.runId,
-          repository: submission.repository,
-          provenance: submission.provenance,
-          candidateCounts: submission.candidateCounts,
-          authoring: {
-            provider: "openai-codex",
-            model: submission.authoringModel,
-            reasoningEffort: "high",
-          },
-          version: {
-            selfbenchCommit: config.buildCommit ?? submission.selfbenchCommit,
-            executionBackend: config.execution.kind,
-            sandboxImage: config.execution.image,
-            schema: 1,
-          },
-        });
         await client.workflow.start(selfBenchRunWorkflow, {
           workflowId: workflowInput.runId,
           taskQueue: config.temporal.taskQueue,
@@ -167,6 +152,34 @@ export async function startApi(config: SelfBenchConfig): Promise<() => Promise<v
   };
 }
 
+export function buildRunRequest(
+  config: SelfBenchConfig,
+  submission: z.input<typeof submissionSchema>,
+): RunRequest {
+  const parsed = submissionSchema.parse(submission);
+  return runRequestSchema.parse({
+    runId: parsed.runId,
+    repository: parsed.repository,
+    provenance: parsed.provenance,
+    candidateCounts: parsed.candidateCounts,
+    authoring: {
+      provider: "openai-codex",
+      model: parsed.authoringModel,
+      reasoningEffort: "high",
+    },
+    version: {
+      selfbenchCommit: config.buildCommit ?? parsed.selfbenchCommit,
+      executionBackend: config.execution.kind,
+      harborEnvironment: config.harborEnvironment,
+      sandboxImage: config.execution.image,
+      ...(config.execution.kind === "vercel"
+        ? { sandboxTimeoutCapMs: config.execution.timeoutCapMs }
+        : {}),
+      schema: 1,
+    },
+  });
+}
+
 async function queryStatus(
   handle: ReturnType<Client["workflow"]["getHandle"]>,
 ): Promise<RunStatus | object> {

package/src/cli.ts

@@ -10,12 +10,20 @@ import type { ReadableStream as NodeReadableStream } from "node:stream/web";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { buildCommit } from "./build-metadata.js";
+import { loadWorkerConfig } from "./config.js";
 import { runCommand } from "./process.js";
 import { collectGitHubPullRequestProvenance, collectRepositoryProvenance } from "./provenance.js";
+import { isExecutionBackend, isHarborEnvironment, matchingHarborEnvironment } from "./providers.js";
 import { type PolledRunStatus, waitForRun } from "./run-wait.js";
+import { SetupCanceledError } from "./terminal-prompts.js";
+import { applyVercelProfile } from "./vercel-profile.js";
+import { setupVercel } from "./vercel-setup.js";
 
 const [command, ...rest] = process.argv.slice(2);
 switch (command) {
+  case "setup":
+    await setup(rest);
+    break;
   case "up":
     await up(rest);
     break;
@@ -47,31 +55,74 @@ switch (command) {
     throw new Error(`unknown command: ${command}`);
 }
 
+async function setup(args: string[]): Promise<void> {
+  const [provider, ...providerArgs] = args;
+  if (provider !== "vercel") {
+    fail("setup currently supports only: self-bench setup vercel");
+  }
+  const parsed = parseArgs({
+    args: providerArgs,
+    options: {
+      profile: { type: "string", default: "default" },
+      verbose: { type: "boolean", default: false },
+    },
+    strict: true,
+  });
+  try {
+    await setupVercel({
+      profileName: parsed.values.profile,
+      verbose: parsed.values.verbose,
+    });
+  } catch (error) {
+    if (error instanceof SetupCanceledError) {
+      process.exitCode = 130;
+      return;
+    }
+    throw error;
+  }
+}
+
 async function up(args: string[]): Promise<void> {
   const parsed = parseArgs({
     args,
     options: {
       backend: { type: "string", default: "docker" },
+      "harbor-environment": { type: "string" },
       "modal-config": { type: "string" },
+      "vercel-profile": { type: "string" },
     },
     strict: true,
   });
-  if (parsed.values.backend !== "docker" && parsed.values.backend !== "modal") {
-    fail('--backend must be "docker" or "modal"');
+  if (!isExecutionBackend(parsed.values.backend)) {
+    fail('--backend must be "docker", "modal", or "vercel"');
   }
-  if (parsed.values.backend === "docker" && parsed.values["modal-config"] !== undefined) {
-    fail("--modal-config requires --backend modal");
+  if (
+    parsed.values["harbor-environment"] !== undefined &&
+    !isHarborEnvironment(parsed.values["harbor-environment"])
+  ) {
+    fail('--harbor-environment must be "docker" or "modal"');
   }
 
   const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
   const composeFile = resolve(projectRoot, "compose.yaml");
   const backend = parsed.values.backend;
-  const environment = {
+  const harborEnvironment =
+    parsed.values["harbor-environment"] ??
+    matchingHarborEnvironment(backend) ??
+    fail(`--harbor-environment is required with --backend ${backend}`);
+  const usesModal = backend === "modal" || harborEnvironment === "modal";
+  if (!usesModal && parsed.values["modal-config"] !== undefined) {
+    fail("--modal-config requires Modal generation or Harbor");
+  }
+  if (backend !== "vercel" && parsed.values["vercel-profile"] !== undefined) {
+    fail("--vercel-profile requires Vercel generation");
+  }
+  let environment: NodeJS.ProcessEnv = {
     ...process.env,
     SELFBENCH_BUILD_COMMIT: await resolveSelfBenchCommit(),
     SELFBENCH_EXECUTION_BACKEND: backend,
-    SELFBENCH_HARBOR_ENVIRONMENT: backend,
-    ...(backend === "modal"
+    SELFBENCH_HARBOR_ENVIRONMENT: harborEnvironment,
+    ...(usesModal
       ? {
           SELFBENCH_MODAL_CONFIG_PATH: resolve(
             parsed.values["modal-config"] ?? resolve(homedir(), ".modal.toml"),
@@ -79,6 +130,10 @@ async function up(args: string[]): Promise<void> {
         }
       : {}),
   };
+  if (backend === "vercel") {
+    environment = await applyVercelProfile(environment, parsed.values["vercel-profile"]);
+    loadWorkerConfig(environment);
+  }
 
   if (backend === "docker") {
     await runCommand(
@@ -97,7 +152,9 @@ async function up(args: string[]): Promise<void> {
   await runCommand("docker", ["compose", "--file", composeFile, "up", "-d", "--build"], {
     env: environment,
   });
-  console.log(`SelfBench is running with the ${backend} backend at http://127.0.0.1:8080`);
+  console.log(
+    `SelfBench is running with ${backend} generation and ${harborEnvironment} Harbor at http://127.0.0.1:8080`,
+  );
 }
 
 async function down(): Promise<void> {
@@ -340,7 +397,9 @@ function printHelp(): void {
   console.log(`SelfBench creates durable tiered Harbor evaluations.
 
 Usage:
-  self-bench up [--backend docker|modal] [--modal-config PATH]
+  self-bench setup vercel [--profile NAME] [--verbose]
+  self-bench up [--backend docker|modal|vercel] [--harbor-environment docker|modal]
+                [--modal-config PATH] [--vercel-profile NAME]
   self-bench down
   self-bench run --repo PATH [--easy-count N] [--medium-count N] [--hard-count N]
                   [--model MODEL] [--run-id ID] [--wait] [--output OUTPUT.tar.gz]
@@ -349,8 +408,10 @@ Usage:
   self-bench download RUN_ID OUTPUT.tar.gz
   self-bench list
 
-The up command starts the local stack and configures both sandbox execution and Harbor validation for
-one backend. Modal uses ~/.modal.toml unless --modal-config overrides it.
+The up command starts the local stack. Docker and Modal default Harbor to the matching backend; Vercel
+requires --harbor-environment because Harbor does not support Vercel. Modal generation or Harbor uses
+~/.modal.toml unless --modal-config overrides it. Run self-bench setup vercel once to create or select a
+project, publish the pinned runtime image, verify access, and save an owner-only local profile.
 
 The tier counts are candidate authoring budgets, not accepted-task targets. Rejected candidates are not
 replaced, and the export contains only accepted tasks. The run command performs only repository metadata

package/src/config.ts

@@ -1,4 +1,15 @@
 import { z } from "zod";
+import {
+  EXECUTION_BACKENDS,
+  type ExecutionBackend,
+  HARBOR_ENVIRONMENTS,
+  type HarborEnvironment,
+  matchingHarborEnvironment,
+} from "./providers.js";
+import { parseSandboxTimeoutCapText, STANDARD_VERCEL_TIMEOUT_CAP_MS } from "./sandbox-timeout.js";
+
+const emptyStringAsUndefined = (value: unknown): unknown =>
+  typeof value === "string" && value.trim() === "" ? undefined : value;
 
 const environmentSchema = z.object({
   SELFBENCH_API_HOST: z.string().default("127.0.0.1"),
@@ -8,12 +19,19 @@ const environmentSchema = z.object({
   SELFBENCH_ARTIFACT_DIR: z.string().default(".selfbench/artifacts"),
   SELFBENCH_GCS_BUCKET: z.string().optional(),
   SELFBENCH_GCS_PREFIX: z.string().default("selfbench"),
-  SELFBENCH_EXECUTION_BACKEND: z.enum(["docker", "modal"]).default("docker"),
+  SELFBENCH_EXECUTION_BACKEND: z.enum(EXECUTION_BACKENDS).default("docker"),
   SELFBENCH_DOCKER_IMAGE: z.string().default("selfbench-sandbox:local"),
-  SELFBENCH_HARBOR_ENVIRONMENT: z.enum(["docker", "modal"]).optional(),
+  SELFBENCH_HARBOR_ENVIRONMENT: z.preprocess(
+    emptyStringAsUndefined,
+    z.enum(HARBOR_ENVIRONMENTS).optional(),
+  ),
   SELFBENCH_MODAL_APP: z.string().default("selfbench"),
   SELFBENCH_MODAL_ENVIRONMENT: z.string().optional(),
   SELFBENCH_MODAL_IMAGE: z.string().default("node:22-bookworm"),
+  SELFBENCH_VERCEL_IMAGE: z.preprocess(emptyStringAsUndefined, z.string().trim().min(1).optional()),
+  // Keep provider-specific validation in the Vercel branch so a stale Vercel
+  // variable cannot break an otherwise unrelated Docker or Modal worker.
+  SELFBENCH_VERCEL_TIMEOUT_CAP: z.preprocess(emptyStringAsUndefined, z.string().optional()),
   SELFBENCH_BUILD_COMMIT: z.preprocess(
     (value) => (value === "" ? undefined : value),
     z
@@ -21,7 +39,10 @@ const environmentSchema = z.object({
       .regex(/^[0-9a-f]{40}$/i)
       .optional(),
   ),
-  SELFBENCH_ACTIVITY_CONCURRENCY: z.coerce.number().int().min(1).max(100).optional(),
+  SELFBENCH_ACTIVITY_CONCURRENCY: z.preprocess(
+    emptyStringAsUndefined,
+    z.coerce.number().int().min(1).max(100).optional(),
+  ),
   SELFBENCH_TASK_QUEUE: z.string().default("selfbench-dev"),
   SELFBENCH_TEMPORAL_ADDRESS: z.string().default("127.0.0.1:7233"),
   SELFBENCH_TEMPORAL_NAMESPACE: z.string().default("default"),
@@ -32,6 +53,37 @@ const environmentSchema = z.object({
     .default(false),
 });
 
+export interface VercelCredentials {
+  readonly token: string;
+  readonly teamId: string;
+  readonly projectId: string;
+}
+
+type ExecutionConfig =
+  | { readonly kind: "docker"; readonly image: string }
+  | {
+      readonly kind: "modal";
+      readonly app: string;
+      readonly environment?: string;
+      readonly image: string;
+    }
+  | { readonly kind: "vercel"; readonly image: string; readonly timeoutCapMs: number };
+
+type WorkerExecutionConfig =
+  | Exclude<ExecutionConfig, { readonly kind: "vercel" }>
+  | {
+      readonly kind: "vercel";
+      readonly image: string;
+      readonly timeoutCapMs: number;
+      readonly credentials: VercelCredentials;
+    };
+
+const DEFAULT_ACTIVITY_CONCURRENCY = {
+  docker: 1,
+  modal: 20,
+  vercel: 4,
+} as const satisfies Record<ExecutionBackend, number>;
+
 export interface SelfBenchConfig {
   readonly apiHost: string;
   readonly apiPort: number;
@@ -41,15 +93,8 @@ export interface SelfBenchConfig {
   readonly artifact:
     | { readonly kind: "local"; readonly directory: string }
     | { readonly kind: "gcs"; readonly bucket: string; readonly prefix: string };
-  readonly execution:
-    | { readonly kind: "docker"; readonly image: string }
-    | {
-        readonly kind: "modal";
-        readonly app: string;
-        readonly environment?: string;
-        readonly image: string;
-      };
-  readonly harborEnvironment: "docker" | "modal";
+  readonly execution: ExecutionConfig;
+  readonly harborEnvironment: HarborEnvironment;
   readonly temporal: {
     readonly address: string;
     readonly namespace: string;
@@ -59,6 +104,14 @@ export interface SelfBenchConfig {
   };
 }
 
+export interface SelfBenchWorkerConfig extends Omit<SelfBenchConfig, "execution"> {
+  readonly execution: WorkerExecutionConfig;
+}
+
+export function isDigestPinnedOciImage(image: string): boolean {
+  return /^[^@\s]+@sha256:[0-9a-f]{64}$/i.test(image);
+}
+
 export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBenchConfig {
   const value = environmentSchema.parse(environment);
   if (
@@ -76,6 +129,43 @@ export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBe
         }
       : { kind: "local" as const, directory: value.SELFBENCH_ARTIFACT_DIR };
 
+  const harborEnvironment =
+    value.SELFBENCH_HARBOR_ENVIRONMENT ??
+    matchingHarborEnvironment(value.SELFBENCH_EXECUTION_BACKEND) ??
+    fail(
+      `SELFBENCH_HARBOR_ENVIRONMENT is required for ${value.SELFBENCH_EXECUTION_BACKEND} execution`,
+    );
+  let execution: ExecutionConfig;
+  switch (value.SELFBENCH_EXECUTION_BACKEND) {
+    case "docker":
+      execution = { kind: "docker", image: value.SELFBENCH_DOCKER_IMAGE };
+      break;
+    case "modal":
+      execution = {
+        kind: "modal",
+        app: value.SELFBENCH_MODAL_APP,
+        image: value.SELFBENCH_MODAL_IMAGE,
+        ...(value.SELFBENCH_MODAL_ENVIRONMENT
+          ? { environment: value.SELFBENCH_MODAL_ENVIRONMENT }
+          : {}),
+      };
+      break;
+    case "vercel": {
+      const image =
+        value.SELFBENCH_VERCEL_IMAGE ??
+        fail("SELFBENCH_VERCEL_IMAGE is required for Vercel execution");
+      if (!isDigestPinnedOciImage(image)) {
+        fail("SELFBENCH_VERCEL_IMAGE must be pinned by sha256 digest");
+      }
+      execution = {
+        kind: "vercel",
+        image,
+        timeoutCapMs: vercelTimeoutCap(value.SELFBENCH_VERCEL_TIMEOUT_CAP),
+      };
+      break;
+    }
+  }
+
   return {
     apiHost: value.SELFBENCH_API_HOST,
     apiPort: value.SELFBENCH_API_PORT,
@@ -85,20 +175,10 @@ export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBe
       : {}),
     activityConcurrency:
       value.SELFBENCH_ACTIVITY_CONCURRENCY ??
-      (value.SELFBENCH_EXECUTION_BACKEND === "modal" ? 20 : 1),
+      DEFAULT_ACTIVITY_CONCURRENCY[value.SELFBENCH_EXECUTION_BACKEND],
     artifact,
-    harborEnvironment: value.SELFBENCH_HARBOR_ENVIRONMENT ?? value.SELFBENCH_EXECUTION_BACKEND,
-    execution:
-      value.SELFBENCH_EXECUTION_BACKEND === "modal"
-        ? {
-            kind: "modal",
-            app: value.SELFBENCH_MODAL_APP,
-            image: value.SELFBENCH_MODAL_IMAGE,
-            ...(value.SELFBENCH_MODAL_ENVIRONMENT
-              ? { environment: value.SELFBENCH_MODAL_ENVIRONMENT }
-              : {}),
-          }
-        : { kind: "docker", image: value.SELFBENCH_DOCKER_IMAGE },
+    harborEnvironment,
+    execution,
     temporal: {
       address: value.SELFBENCH_TEMPORAL_ADDRESS,
       namespace: value.SELFBENCH_TEMPORAL_NAMESPACE,
@@ -109,6 +189,51 @@ export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBe
   };
 }
 
+export function loadWorkerConfig(
+  environment: NodeJS.ProcessEnv = process.env,
+): SelfBenchWorkerConfig {
+  const config = loadConfig(environment);
+  if (config.execution.kind !== "vercel") {
+    return { ...config, execution: config.execution };
+  }
+  return {
+    ...config,
+    execution: {
+      ...config.execution,
+      credentials: vercelCredentials(environment),
+    },
+  };
+}
+
+export function defaultStandaloneConcurrency(
+  config: Pick<SelfBenchConfig, "activityConcurrency" | "execution">,
+  existingDefault: number,
+): number {
+  return config.execution.kind === "vercel" ? config.activityConcurrency : existingDefault;
+}
+
+function vercelCredentials(environment: NodeJS.ProcessEnv): VercelCredentials {
+  const token = environment.VERCEL_TOKEN?.trim();
+  const teamId = environment.VERCEL_TEAM_ID?.trim();
+  const projectId = environment.VERCEL_PROJECT_ID?.trim();
+  if (!token || !teamId || !projectId) {
+    fail("VERCEL_TOKEN, VERCEL_TEAM_ID, and VERCEL_PROJECT_ID are required for Vercel execution");
+  }
+  return { token, teamId, projectId };
+}
+
+function vercelTimeoutCap(value: string | undefined): number {
+  if (value === undefined) {
+    return STANDARD_VERCEL_TIMEOUT_CAP_MS;
+  }
+  return z
+    .number()
+    .int()
+    .min(100)
+    .max(STANDARD_VERCEL_TIMEOUT_CAP_MS)
+    .parse(parseSandboxTimeoutCapText(value));
+}
+
 function fail(message: string): never {
   throw new Error(message);
 }

package/src/contracts.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { EXECUTION_BACKENDS, HARBOR_ENVIRONMENTS, matchingHarborEnvironment } from "./providers.js";
 
 export const commitSchema = z.string().regex(/^[0-9a-f]{40}$/i, "expected a full commit SHA");
 
@@ -34,6 +35,37 @@ const candidateCountsSchema = z
     message: "at most 100 candidates may be requested",
   });
 
+const runVersionSchema = z
+  .object({
+    selfbenchCommit: commitSchema,
+    executionBackend: z.enum(EXECUTION_BACKENDS),
+    harborEnvironment: z.enum(HARBOR_ENVIRONMENTS).optional(),
+    sandboxImage: z.string().min(1),
+    sandboxTimeoutCapMs: z.number().int().min(100).optional(),
+    schema: z.literal(1),
+  })
+  .transform((version, context) => {
+    const harborEnvironment =
+      version.harborEnvironment ?? matchingHarborEnvironment(version.executionBackend);
+    if (!harborEnvironment) {
+      context.addIssue({
+        code: "custom",
+        message: `harborEnvironment is required for ${version.executionBackend} execution`,
+        path: ["harborEnvironment"],
+      });
+      return z.NEVER;
+    }
+    if (version.sandboxTimeoutCapMs !== undefined && version.executionBackend !== "vercel") {
+      context.addIssue({
+        code: "custom",
+        message: "sandboxTimeoutCapMs is only valid for Vercel execution",
+        path: ["sandboxTimeoutCapMs"],
+      });
+      return z.NEVER;
+    }
+    return { ...version, harborEnvironment };
+  });
+
 export const runRequestSchema = z.object({
   runId: z.string().regex(/^[a-z0-9][a-z0-9-]{2,62}$/),
   repository: repositoryRefSchema,
@@ -44,12 +76,7 @@ export const runRequestSchema = z.object({
     model: z.string().min(1),
     reasoningEffort: z.literal("high"),
   }),
-  version: z.object({
-    selfbenchCommit: commitSchema,
-    executionBackend: z.enum(["docker", "modal"]),
-    sandboxImage: z.string().min(1),
-    schema: z.literal(1),
-  }),
+  version: runVersionSchema,
 });
 
 export type RunRequest = z.infer<typeof runRequestSchema>;

package/src/eval-main.ts

@@ -2,6 +2,7 @@
 
 import { parseArgs } from "node:util";
 import { MATRIX_MODELS, type MatrixModel, runMatrix } from "./evaluate.js";
+import { isHarborEnvironment } from "./providers.js";
 
 const parsed = parseArgs({
   options: {
@@ -33,8 +34,8 @@ Options:
   -h, --help                 Show this help`);
   process.exit(0);
 }
-const environment = parsed.values.environment;
-if (environment !== "docker" && environment !== "modal") {
+const environment = parsed.values.environment ?? "modal";
+if (!isHarborEnvironment(environment)) {
   throw new Error("--environment must be docker or modal");
 }
 const concurrency = positiveInteger(parsed.values.concurrency, "--concurrency");

package/src/evaluate.ts

@@ -1,9 +1,11 @@
 import { cp, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { basename, join, resolve } from "node:path";
+import { harborChildEnvironment } from "./harbor-environment.js";
 import { archiveIncompleteHarborJob, tryReadHarborJobResult } from "./harbor-results.js";
 import { parallelMap } from "./parallel.js";
 import { runCommand } from "./process.js";
+import type { HarborEnvironment } from "./providers.js";
 import { assertCodexSubscriptionAuth, openAiApiKey } from "./subscription-auth.js";
 
 export const MATRIX_MODELS = ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"] as const;
@@ -15,7 +17,7 @@ export interface MatrixOptions {
   readonly tasksPath?: string;
   readonly jobsDirectory: string;
   readonly harborPath?: string;
-  readonly environment?: "docker" | "modal";
+  readonly environment?: HarborEnvironment;
   readonly concurrency?: number;
   readonly authPath?: string;
   readonly models?: readonly MatrixModel[];
@@ -114,7 +116,7 @@ async function runTrial(input: {
   readonly model: MatrixModel;
   readonly jobsDirectory: string;
   readonly harborPath: string;
-  readonly environment: "docker" | "modal";
+  readonly environment: HarborEnvironment;
   readonly authPath?: string;
 }): Promise<MatrixTrialSummary> {
   const taskId = basename(input.taskDirectory);
@@ -125,7 +127,7 @@ async function runTrial(input: {
   }
   await archiveIncompleteHarborJob(input.jobsDirectory, jobName);
 
-  const environment = { ...process.env };
+  const environment = harborChildEnvironment();
   if (input.authPath) {
     delete environment.OPENAI_API_KEY;
     environment.CODEX_FORCE_AUTH_JSON = "1";

package/src/harbor-environment.ts

@@ -0,0 +1,17 @@
+const VERCEL_CONTROL_CREDENTIALS = [
+  "VERCEL_AUTH_TOKEN",
+  "VERCEL_TOKEN",
+  "VERCEL_TEAM_ID",
+  "VERCEL_PROJECT_ID",
+  "VERCEL_OIDC_TOKEN",
+] as const;
+
+export function harborChildEnvironment(
+  environment: NodeJS.ProcessEnv = process.env,
+): NodeJS.ProcessEnv {
+  const child = { ...environment };
+  for (const key of VERCEL_CONTROL_CREDENTIALS) {
+    delete child[key];
+  }
+  return child;
+}

package/src/harbor-results.ts

@@ -20,6 +20,8 @@ const infrastructurePatterns = [
   /modal.*(?:unavailable|timed out|timeout)/i,
   /image build for im-[a-z0-9]+ failed/i,
   /all predefined address pools have been fully subnetted/i,
+  /mounts denied/i,
+  /network-policy[\s\S]*could not process rule/i,
 ];
 
 class IncompleteHarborJobError extends Error {}

package/src/process.ts

@@ -6,6 +6,8 @@ export interface CommandResult {
   readonly exitCode: number;
 }
 
+export type CommandOutputHandler = (stream: "stdout" | "stderr", chunk: Uint8Array) => void;
+
 export interface CommandOptions {
   readonly cwd?: string;
   readonly env?: NodeJS.ProcessEnv;
@@ -14,7 +16,7 @@ export interface CommandOptions {
   readonly inactivityTimeoutMs?: number;
   readonly allowFailure?: boolean;
   readonly signal?: AbortSignal;
-  readonly onOutput?: (stream: "stdout" | "stderr", chunk: Uint8Array) => void;
+  readonly onOutput?: CommandOutputHandler;
 }
 
 export class InactivityTimeoutError extends Error {

package/src/providers.ts

@@ -0,0 +1,22 @@
+export const EXECUTION_BACKENDS = ["docker", "modal", "vercel"] as const;
+export type ExecutionBackend = (typeof EXECUTION_BACKENDS)[number];
+
+export const HARBOR_ENVIRONMENTS = ["docker", "modal"] as const;
+export type HarborEnvironment = (typeof HARBOR_ENVIRONMENTS)[number];
+
+const executionBackends: ReadonlySet<string> = new Set(EXECUTION_BACKENDS);
+const harborEnvironments: ReadonlySet<string> = new Set(HARBOR_ENVIRONMENTS);
+
+export function isExecutionBackend(value: string): value is ExecutionBackend {
+  return executionBackends.has(value);
+}
+
+export function isHarborEnvironment(value: string): value is HarborEnvironment {
+  return harborEnvironments.has(value);
+}
+
+export function matchingHarborEnvironment(
+  backend: ExecutionBackend,
+): HarborEnvironment | undefined {
+  return isHarborEnvironment(backend) ? backend : undefined;
+}

package/src/reaudit-main.ts

@@ -10,7 +10,7 @@ import {
   couplingReviewInput,
   couplingReviewSchema,
 } from "./codex-review.js";
-import { loadConfig } from "./config.js";
+import { defaultStandaloneConcurrency, loadWorkerConfig } from "./config.js";
 import {
   buildCouplingEvidence,
   discoverContractArtifacts,
@@ -27,7 +27,7 @@ const parsed = parseArgs({
     tasks: { type: "string" },
     task: { type: "string" },
     output: { type: "string" },
-    concurrency: { type: "string", default: "10" },
+    concurrency: { type: "string" },
     help: { type: "boolean", short: "h" },
   },
   strict: true,
@@ -39,7 +39,7 @@ Usage:
   self-bench-reaudit --tasks DIRECTORY --output REPORT.json [options]
 
 Options:
-  --concurrency N  Concurrent Sol reviews (default: 10)
+  --concurrency N  Concurrent Sol reviews (default: 10; Vercel: worker setting, default 4)
   --task ID        Review only one task ID
   -h, --help       Show this help`);
   process.exit(0);
@@ -47,8 +47,11 @@ Options:
 
 const tasksDirectory = resolve(parsed.values.tasks ?? fail("--tasks is required"));
 const outputPath = resolve(parsed.values.output ?? fail("--output is required"));
-const concurrency = positiveInteger(parsed.values.concurrency, "--concurrency");
-const config = loadConfig();
+const config = loadWorkerConfig();
+const concurrency = positiveInteger(
+  parsed.values.concurrency ?? String(defaultStandaloneConcurrency(config, 10)),
+  "--concurrency",
+);
 const sandbox = createSandboxExecutor(config.execution);
 const [taskIds, modelAuth, reviewer] = await Promise.all([
   readdir(tasksDirectory),