self-bench 0.3.3 → 0.3.5

package/src/config.ts

@@ -1,4 +1,15 @@
 import { z } from "zod";
+import {
+  EXECUTION_BACKENDS,
+  type ExecutionBackend,
+  HARBOR_ENVIRONMENTS,
+  type HarborEnvironment,
+  matchingHarborEnvironment,
+} from "./providers.js";
+import { parseSandboxTimeoutCapText, STANDARD_VERCEL_TIMEOUT_CAP_MS } from "./sandbox-timeout.js";
+
+const emptyStringAsUndefined = (value: unknown): unknown =>
+  typeof value === "string" && value.trim() === "" ? undefined : value;
 
 const environmentSchema = z.object({
   SELFBENCH_API_HOST: z.string().default("127.0.0.1"),
@@ -8,12 +19,19 @@ const environmentSchema = z.object({
   SELFBENCH_ARTIFACT_DIR: z.string().default(".selfbench/artifacts"),
   SELFBENCH_GCS_BUCKET: z.string().optional(),
   SELFBENCH_GCS_PREFIX: z.string().default("selfbench"),
-  SELFBENCH_EXECUTION_BACKEND: z.enum(["docker", "modal"]).default("docker"),
+  SELFBENCH_EXECUTION_BACKEND: z.enum(EXECUTION_BACKENDS).default("docker"),
   SELFBENCH_DOCKER_IMAGE: z.string().default("selfbench-sandbox:local"),
-  SELFBENCH_HARBOR_ENVIRONMENT: z.enum(["docker", "modal"]).optional(),
+  SELFBENCH_HARBOR_ENVIRONMENT: z.preprocess(
+    emptyStringAsUndefined,
+    z.enum(HARBOR_ENVIRONMENTS).optional(),
+  ),
   SELFBENCH_MODAL_APP: z.string().default("selfbench"),
   SELFBENCH_MODAL_ENVIRONMENT: z.string().optional(),
   SELFBENCH_MODAL_IMAGE: z.string().default("node:22-bookworm"),
+  SELFBENCH_VERCEL_IMAGE: z.preprocess(emptyStringAsUndefined, z.string().trim().min(1).optional()),
+  // Keep provider-specific validation in the Vercel branch so a stale Vercel
+  // variable cannot break an otherwise unrelated Docker or Modal worker.
+  SELFBENCH_VERCEL_TIMEOUT_CAP: z.preprocess(emptyStringAsUndefined, z.string().optional()),
   SELFBENCH_BUILD_COMMIT: z.preprocess(
     (value) => (value === "" ? undefined : value),
     z
@@ -21,7 +39,10 @@ const environmentSchema = z.object({
       .regex(/^[0-9a-f]{40}$/i)
       .optional(),
   ),
-  SELFBENCH_ACTIVITY_CONCURRENCY: z.coerce.number().int().min(1).max(100).optional(),
+  SELFBENCH_ACTIVITY_CONCURRENCY: z.preprocess(
+    emptyStringAsUndefined,
+    z.coerce.number().int().min(1).max(100).optional(),
+  ),
   SELFBENCH_TASK_QUEUE: z.string().default("selfbench-dev"),
   SELFBENCH_TEMPORAL_ADDRESS: z.string().default("127.0.0.1:7233"),
   SELFBENCH_TEMPORAL_NAMESPACE: z.string().default("default"),
@@ -32,6 +53,37 @@ const environmentSchema = z.object({
     .default(false),
 });
 
+export interface VercelCredentials {
+  readonly token: string;
+  readonly teamId: string;
+  readonly projectId: string;
+}
+
+type ExecutionConfig =
+  | { readonly kind: "docker"; readonly image: string }
+  | {
+      readonly kind: "modal";
+      readonly app: string;
+      readonly environment?: string;
+      readonly image: string;
+    }
+  | { readonly kind: "vercel"; readonly image: string; readonly timeoutCapMs: number };
+
+type WorkerExecutionConfig =
+  | Exclude<ExecutionConfig, { readonly kind: "vercel" }>
+  | {
+      readonly kind: "vercel";
+      readonly image: string;
+      readonly timeoutCapMs: number;
+      readonly credentials: VercelCredentials;
+    };
+
+const DEFAULT_ACTIVITY_CONCURRENCY = {
+  docker: 1,
+  modal: 20,
+  vercel: 4,
+} as const satisfies Record<ExecutionBackend, number>;
+
 export interface SelfBenchConfig {
   readonly apiHost: string;
   readonly apiPort: number;
@@ -41,15 +93,8 @@ export interface SelfBenchConfig {
   readonly artifact:
     | { readonly kind: "local"; readonly directory: string }
     | { readonly kind: "gcs"; readonly bucket: string; readonly prefix: string };
-  readonly execution:
-    | { readonly kind: "docker"; readonly image: string }
-    | {
-        readonly kind: "modal";
-        readonly app: string;
-        readonly environment?: string;
-        readonly image: string;
-      };
-  readonly harborEnvironment: "docker" | "modal";
+  readonly execution: ExecutionConfig;
+  readonly harborEnvironment: HarborEnvironment;
   readonly temporal: {
     readonly address: string;
     readonly namespace: string;
@@ -59,6 +104,14 @@ export interface SelfBenchConfig {
   };
 }
 
+export interface SelfBenchWorkerConfig extends Omit<SelfBenchConfig, "execution"> {
+  readonly execution: WorkerExecutionConfig;
+}
+
+export function isDigestPinnedOciImage(image: string): boolean {
+  return /^[^@\s]+@sha256:[0-9a-f]{64}$/i.test(image);
+}
+
 export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBenchConfig {
   const value = environmentSchema.parse(environment);
   if (
@@ -76,6 +129,43 @@ export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBe
         }
       : { kind: "local" as const, directory: value.SELFBENCH_ARTIFACT_DIR };
 
+  const harborEnvironment =
+    value.SELFBENCH_HARBOR_ENVIRONMENT ??
+    matchingHarborEnvironment(value.SELFBENCH_EXECUTION_BACKEND) ??
+    fail(
+      `SELFBENCH_HARBOR_ENVIRONMENT is required for ${value.SELFBENCH_EXECUTION_BACKEND} execution`,
+    );
+  let execution: ExecutionConfig;
+  switch (value.SELFBENCH_EXECUTION_BACKEND) {
+    case "docker":
+      execution = { kind: "docker", image: value.SELFBENCH_DOCKER_IMAGE };
+      break;
+    case "modal":
+      execution = {
+        kind: "modal",
+        app: value.SELFBENCH_MODAL_APP,
+        image: value.SELFBENCH_MODAL_IMAGE,
+        ...(value.SELFBENCH_MODAL_ENVIRONMENT
+          ? { environment: value.SELFBENCH_MODAL_ENVIRONMENT }
+          : {}),
+      };
+      break;
+    case "vercel": {
+      const image =
+        value.SELFBENCH_VERCEL_IMAGE ??
+        fail("SELFBENCH_VERCEL_IMAGE is required for Vercel execution");
+      if (!isDigestPinnedOciImage(image)) {
+        fail("SELFBENCH_VERCEL_IMAGE must be pinned by sha256 digest");
+      }
+      execution = {
+        kind: "vercel",
+        image,
+        timeoutCapMs: vercelTimeoutCap(value.SELFBENCH_VERCEL_TIMEOUT_CAP),
+      };
+      break;
+    }
+  }
+
   return {
     apiHost: value.SELFBENCH_API_HOST,
     apiPort: value.SELFBENCH_API_PORT,
@@ -85,20 +175,10 @@ export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBe
       : {}),
     activityConcurrency:
       value.SELFBENCH_ACTIVITY_CONCURRENCY ??
-      (value.SELFBENCH_EXECUTION_BACKEND === "modal" ? 20 : 1),
+      DEFAULT_ACTIVITY_CONCURRENCY[value.SELFBENCH_EXECUTION_BACKEND],
     artifact,
-    harborEnvironment: value.SELFBENCH_HARBOR_ENVIRONMENT ?? value.SELFBENCH_EXECUTION_BACKEND,
-    execution:
-      value.SELFBENCH_EXECUTION_BACKEND === "modal"
-        ? {
-            kind: "modal",
-            app: value.SELFBENCH_MODAL_APP,
-            image: value.SELFBENCH_MODAL_IMAGE,
-            ...(value.SELFBENCH_MODAL_ENVIRONMENT
-              ? { environment: value.SELFBENCH_MODAL_ENVIRONMENT }
-              : {}),
-          }
-        : { kind: "docker", image: value.SELFBENCH_DOCKER_IMAGE },
+    harborEnvironment,
+    execution,
     temporal: {
       address: value.SELFBENCH_TEMPORAL_ADDRESS,
       namespace: value.SELFBENCH_TEMPORAL_NAMESPACE,
@@ -109,6 +189,51 @@ export function loadConfig(environment: NodeJS.ProcessEnv = process.env): SelfBe
   };
 }
 
+export function loadWorkerConfig(
+  environment: NodeJS.ProcessEnv = process.env,
+): SelfBenchWorkerConfig {
+  const config = loadConfig(environment);
+  if (config.execution.kind !== "vercel") {
+    return { ...config, execution: config.execution };
+  }
+  return {
+    ...config,
+    execution: {
+      ...config.execution,
+      credentials: vercelCredentials(environment),
+    },
+  };
+}
+
+export function defaultStandaloneConcurrency(
+  config: Pick<SelfBenchConfig, "activityConcurrency" | "execution">,
+  existingDefault: number,
+): number {
+  return config.execution.kind === "vercel" ? config.activityConcurrency : existingDefault;
+}
+
+function vercelCredentials(environment: NodeJS.ProcessEnv): VercelCredentials {
+  const token = environment.VERCEL_TOKEN?.trim();
+  const teamId = environment.VERCEL_TEAM_ID?.trim();
+  const projectId = environment.VERCEL_PROJECT_ID?.trim();
+  if (!token || !teamId || !projectId) {
+    fail("VERCEL_TOKEN, VERCEL_TEAM_ID, and VERCEL_PROJECT_ID are required for Vercel execution");
+  }
+  return { token, teamId, projectId };
+}
+
+function vercelTimeoutCap(value: string | undefined): number {
+  if (value === undefined) {
+    return STANDARD_VERCEL_TIMEOUT_CAP_MS;
+  }
+  return z
+    .number()
+    .int()
+    .min(100)
+    .max(STANDARD_VERCEL_TIMEOUT_CAP_MS)
+    .parse(parseSandboxTimeoutCapText(value));
+}
+
 function fail(message: string): never {
   throw new Error(message);
 }

package/src/contracts.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { EXECUTION_BACKENDS, HARBOR_ENVIRONMENTS, matchingHarborEnvironment } from "./providers.js";
 
 export const commitSchema = z.string().regex(/^[0-9a-f]{40}$/i, "expected a full commit SHA");
 
@@ -34,6 +35,37 @@ const candidateCountsSchema = z
     message: "at most 100 candidates may be requested",
   });
 
+const runVersionSchema = z
+  .object({
+    selfbenchCommit: commitSchema,
+    executionBackend: z.enum(EXECUTION_BACKENDS),
+    harborEnvironment: z.enum(HARBOR_ENVIRONMENTS).optional(),
+    sandboxImage: z.string().min(1),
+    sandboxTimeoutCapMs: z.number().int().min(100).optional(),
+    schema: z.literal(1),
+  })
+  .transform((version, context) => {
+    const harborEnvironment =
+      version.harborEnvironment ?? matchingHarborEnvironment(version.executionBackend);
+    if (!harborEnvironment) {
+      context.addIssue({
+        code: "custom",
+        message: `harborEnvironment is required for ${version.executionBackend} execution`,
+        path: ["harborEnvironment"],
+      });
+      return z.NEVER;
+    }
+    if (version.sandboxTimeoutCapMs !== undefined && version.executionBackend !== "vercel") {
+      context.addIssue({
+        code: "custom",
+        message: "sandboxTimeoutCapMs is only valid for Vercel execution",
+        path: ["sandboxTimeoutCapMs"],
+      });
+      return z.NEVER;
+    }
+    return { ...version, harborEnvironment };
+  });
+
 export const runRequestSchema = z.object({
   runId: z.string().regex(/^[a-z0-9][a-z0-9-]{2,62}$/),
   repository: repositoryRefSchema,
@@ -44,12 +76,7 @@ export const runRequestSchema = z.object({
     model: z.string().min(1),
     reasoningEffort: z.literal("high"),
   }),
-  version: z.object({
-    selfbenchCommit: commitSchema,
-    executionBackend: z.enum(["docker", "modal"]),
-    sandboxImage: z.string().min(1),
-    schema: z.literal(1),
-  }),
+  version: runVersionSchema,
 });
 
 export type RunRequest = z.infer<typeof runRequestSchema>;

package/src/eval-main.ts

@@ -2,6 +2,7 @@
 
 import { parseArgs } from "node:util";
 import { MATRIX_MODELS, type MatrixModel, runMatrix } from "./evaluate.js";
+import { isHarborEnvironment } from "./providers.js";
 
 const parsed = parseArgs({
   options: {
@@ -33,8 +34,8 @@ Options:
   -h, --help                 Show this help`);
   process.exit(0);
 }
-const environment = parsed.values.environment;
-if (environment !== "docker" && environment !== "modal") {
+const environment = parsed.values.environment ?? "modal";
+if (!isHarborEnvironment(environment)) {
   throw new Error("--environment must be docker or modal");
 }
 const concurrency = positiveInteger(parsed.values.concurrency, "--concurrency");

package/src/evaluate.ts

@@ -1,9 +1,11 @@
 import { cp, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { basename, join, resolve } from "node:path";
+import { harborChildEnvironment } from "./harbor-environment.js";
 import { archiveIncompleteHarborJob, tryReadHarborJobResult } from "./harbor-results.js";
 import { parallelMap } from "./parallel.js";
 import { runCommand } from "./process.js";
+import type { HarborEnvironment } from "./providers.js";
 import { assertCodexSubscriptionAuth, openAiApiKey } from "./subscription-auth.js";
 
 export const MATRIX_MODELS = ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"] as const;
@@ -15,7 +17,7 @@ export interface MatrixOptions {
   readonly tasksPath?: string;
   readonly jobsDirectory: string;
   readonly harborPath?: string;
-  readonly environment?: "docker" | "modal";
+  readonly environment?: HarborEnvironment;
   readonly concurrency?: number;
   readonly authPath?: string;
   readonly models?: readonly MatrixModel[];
@@ -114,7 +116,7 @@ async function runTrial(input: {
   readonly model: MatrixModel;
   readonly jobsDirectory: string;
   readonly harborPath: string;
-  readonly environment: "docker" | "modal";
+  readonly environment: HarborEnvironment;
   readonly authPath?: string;
 }): Promise<MatrixTrialSummary> {
   const taskId = basename(input.taskDirectory);
@@ -125,7 +127,7 @@ async function runTrial(input: {
   }
   await archiveIncompleteHarborJob(input.jobsDirectory, jobName);
 
-  const environment = { ...process.env };
+  const environment = harborChildEnvironment();
   if (input.authPath) {
     delete environment.OPENAI_API_KEY;
     environment.CODEX_FORCE_AUTH_JSON = "1";

package/src/harbor-environment.ts

@@ -0,0 +1,17 @@
+const VERCEL_CONTROL_CREDENTIALS = [
+  "VERCEL_AUTH_TOKEN",
+  "VERCEL_TOKEN",
+  "VERCEL_TEAM_ID",
+  "VERCEL_PROJECT_ID",
+  "VERCEL_OIDC_TOKEN",
+] as const;
+
+export function harborChildEnvironment(
+  environment: NodeJS.ProcessEnv = process.env,
+): NodeJS.ProcessEnv {
+  const child = { ...environment };
+  for (const key of VERCEL_CONTROL_CREDENTIALS) {
+    delete child[key];
+  }
+  return child;
+}

package/src/harbor-results.ts

@@ -20,6 +20,8 @@ const infrastructurePatterns = [
   /modal.*(?:unavailable|timed out|timeout)/i,
   /image build for im-[a-z0-9]+ failed/i,
   /all predefined address pools have been fully subnetted/i,
+  /mounts denied/i,
+  /network-policy[\s\S]*could not process rule/i,
 ];
 
 class IncompleteHarborJobError extends Error {}

package/src/process.ts

@@ -6,6 +6,8 @@ export interface CommandResult {
   readonly exitCode: number;
 }
 
+export type CommandOutputHandler = (stream: "stdout" | "stderr", chunk: Uint8Array) => void;
+
 export interface CommandOptions {
   readonly cwd?: string;
   readonly env?: NodeJS.ProcessEnv;
@@ -14,7 +16,7 @@ export interface CommandOptions {
   readonly inactivityTimeoutMs?: number;
   readonly allowFailure?: boolean;
   readonly signal?: AbortSignal;
-  readonly onOutput?: (stream: "stdout" | "stderr", chunk: Uint8Array) => void;
+  readonly onOutput?: CommandOutputHandler;
 }
 
 export class InactivityTimeoutError extends Error {

package/src/providers.ts

@@ -0,0 +1,22 @@
+export const EXECUTION_BACKENDS = ["docker", "modal", "vercel"] as const;
+export type ExecutionBackend = (typeof EXECUTION_BACKENDS)[number];
+
+export const HARBOR_ENVIRONMENTS = ["docker", "modal"] as const;
+export type HarborEnvironment = (typeof HARBOR_ENVIRONMENTS)[number];
+
+const executionBackends: ReadonlySet<string> = new Set(EXECUTION_BACKENDS);
+const harborEnvironments: ReadonlySet<string> = new Set(HARBOR_ENVIRONMENTS);
+
+export function isExecutionBackend(value: string): value is ExecutionBackend {
+  return executionBackends.has(value);
+}
+
+export function isHarborEnvironment(value: string): value is HarborEnvironment {
+  return harborEnvironments.has(value);
+}
+
+export function matchingHarborEnvironment(
+  backend: ExecutionBackend,
+): HarborEnvironment | undefined {
+  return isHarborEnvironment(backend) ? backend : undefined;
+}

package/src/reaudit-main.ts

@@ -10,7 +10,7 @@ import {
   couplingReviewInput,
   couplingReviewSchema,
 } from "./codex-review.js";
-import { loadConfig } from "./config.js";
+import { defaultStandaloneConcurrency, loadWorkerConfig } from "./config.js";
 import {
   buildCouplingEvidence,
   discoverContractArtifacts,
@@ -27,7 +27,7 @@ const parsed = parseArgs({
     tasks: { type: "string" },
     task: { type: "string" },
     output: { type: "string" },
-    concurrency: { type: "string", default: "10" },
+    concurrency: { type: "string" },
     help: { type: "boolean", short: "h" },
   },
   strict: true,
@@ -39,7 +39,7 @@ Usage:
   self-bench-reaudit --tasks DIRECTORY --output REPORT.json [options]
 
 Options:
-  --concurrency N  Concurrent Sol reviews (default: 10)
+  --concurrency N  Concurrent Sol reviews (default: 10; Vercel: worker setting, default 4)
   --task ID        Review only one task ID
   -h, --help       Show this help`);
   process.exit(0);
@@ -47,8 +47,11 @@ Options:
 
 const tasksDirectory = resolve(parsed.values.tasks ?? fail("--tasks is required"));
 const outputPath = resolve(parsed.values.output ?? fail("--output is required"));
-const concurrency = positiveInteger(parsed.values.concurrency, "--concurrency");
-const config = loadConfig();
+const config = loadWorkerConfig();
+const concurrency = positiveInteger(
+  parsed.values.concurrency ?? String(defaultStandaloneConcurrency(config, 10)),
+  "--concurrency",
+);
 const sandbox = createSandboxExecutor(config.execution);
 const [taskIds, modelAuth, reviewer] = await Promise.all([
   readdir(tasksDirectory),

package/src/repair-main.ts

@@ -5,7 +5,7 @@ import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { loadConfig } from "./config.js";
+import { defaultStandaloneConcurrency, loadWorkerConfig } from "./config.js";
 import { parallelMap } from "./parallel.js";
 import { runCommand } from "./process.js";
 import { createSandboxExecutor } from "./sandbox.js";
@@ -17,7 +17,7 @@ const parsed = parseArgs({
     review: { type: "string" },
     output: { type: "string" },
     task: { type: "string" },
-    concurrency: { type: "string", default: "9" },
+    concurrency: { type: "string" },
     model: { type: "string", default: "gpt-5.6-sol" },
     help: { type: "boolean", short: "h" },
   },
@@ -30,7 +30,7 @@ Usage:
   self-bench-repair --tasks DIRECTORY --review REPORT.json --output DIRECTORY [options]
 
 Options:
-  --concurrency N  Concurrent repair sandboxes (default: 9)
+  --concurrency N  Concurrent repair sandboxes (default: 9; Vercel: worker setting, default 4)
   --model MODEL    Codex subscription model (default: gpt-5.6-sol)
   --task ID        Repair only one coupled task
   -h, --help       Show this help`);
@@ -43,7 +43,11 @@ const outputDirectory = resolve(parsed.values.output ?? fail("--output is requir
 if (outputDirectory === tasksDirectory || outputDirectory.startsWith(`${tasksDirectory}/`)) {
   throw new Error("--output must be outside --tasks");
 }
-const concurrency = positiveInteger(parsed.values.concurrency, "--concurrency");
+const config = loadWorkerConfig();
+const concurrency = positiveInteger(
+  parsed.values.concurrency ?? String(defaultStandaloneConcurrency(config, 9)),
+  "--concurrency",
+);
 const rawReview = JSON.parse(await readFile(reviewPath, "utf8")) as unknown;
 const review = reviewReport(rawReview);
 const coupled = new Map(
@@ -77,7 +81,6 @@ for (const source of sourceTasks) {
   }
 }
 
-const config = loadConfig();
 const sandbox = createSandboxExecutor(config.execution);
 const [modelAuth, repairer] = await Promise.all([
   loadCodexModelAuth(),

package/src/sandbox-timeout.ts

@@ -0,0 +1,56 @@
+import type {
+  SandboxExecutor,
+  SandboxRequest,
+  SandboxResult,
+  SandboxRunOptions,
+} from "./sandbox.js";
+
+export const STANDARD_VERCEL_TIMEOUT_CAP_MS = 2 * 60 * 60 * 1_000;
+export const HOBBY_VERCEL_TIMEOUT_CAP_MS = 45 * 60 * 1_000;
+
+export function parseSandboxTimeoutCapText(value: string): number | undefined {
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "") {
+    return undefined;
+  }
+  const match = /^(\d+)(ms|s|m|h)?$/.exec(normalized);
+  if (!match?.[1]) {
+    return Number.NaN;
+  }
+  const amount = Number(match[1]);
+  const multiplier =
+    match[2] === "h"
+      ? 60 * 60 * 1_000
+      : match[2] === "m"
+        ? 60 * 1_000
+        : match[2] === "s"
+          ? 1_000
+          : 1;
+  return amount * multiplier;
+}
+
+export class TimeoutCappedSandboxExecutor implements SandboxExecutor {
+  readonly #delegate: SandboxExecutor;
+  readonly #timeoutCapMs: number;
+
+  constructor(delegate: SandboxExecutor, timeoutCapMs: number) {
+    if (!Number.isInteger(timeoutCapMs) || timeoutCapMs < 100) {
+      throw new Error("sandbox timeout cap must be an integer of at least 100ms");
+    }
+    this.#delegate = delegate;
+    this.#timeoutCapMs = timeoutCapMs;
+  }
+
+  async run(request: SandboxRequest, options?: SandboxRunOptions): Promise<SandboxResult> {
+    return await this.#delegate.run(
+      request.timeoutMs > this.#timeoutCapMs
+        ? { ...request, timeoutMs: this.#timeoutCapMs }
+        : request,
+      options,
+    );
+  }
+
+  close(): void {
+    this.#delegate.close();
+  }
+}

package/src/sandbox.ts

@@ -1,6 +1,8 @@
-import type { SelfBenchConfig } from "./config.js";
+import type { SelfBenchWorkerConfig } from "./config.js";
 import { DockerSandboxExecutor } from "./docker-executor.js";
 import { ModalSandboxExecutor } from "./modal-executor.js";
+import { TimeoutCappedSandboxExecutor } from "./sandbox-timeout.js";
+import { VercelSandboxExecutor } from "./vercel-executor.js";
 
 export interface SandboxFile {
   readonly path: string;
@@ -44,8 +46,16 @@ export interface SandboxExecutor {
   close(): void;
 }
 
-export function createSandboxExecutor(config: SelfBenchConfig["execution"]): SandboxExecutor {
-  return config.kind === "modal"
-    ? new ModalSandboxExecutor(config)
-    : new DockerSandboxExecutor(config);
+export function createSandboxExecutor(config: SelfBenchWorkerConfig["execution"]): SandboxExecutor {
+  switch (config.kind) {
+    case "docker":
+      return new DockerSandboxExecutor(config);
+    case "modal":
+      return new ModalSandboxExecutor(config);
+    case "vercel":
+      return new TimeoutCappedSandboxExecutor(
+        new VercelSandboxExecutor(config),
+        config.timeoutCapMs,
+      );
+  }
 }

package/src/temporal/activities.ts

@@ -12,7 +12,7 @@ import {
   couplingReviewInput,
   couplingReviewSchema,
 } from "../codex-review.js";
-import type { SelfBenchConfig } from "../config.js";
+import type { SelfBenchConfig, SelfBenchWorkerConfig } from "../config.js";
 import {
   type ArtifactRef,
   type AuditResult,
@@ -34,6 +34,7 @@ import {
   scanBaseContractArtifacts,
 } from "../coupling.js";
 import { assertPullRequestBelongsToRepository } from "../github.js";
+import { harborChildEnvironment } from "../harbor-environment.js";
 import {
   type HarborJobResult,
   harborInfrastructureError,
@@ -114,7 +115,7 @@ export interface SelfBenchActivities {
   buildExport(input: ExportInput): Promise<ArtifactRef>;
 }
 
-export function createActivities(config: SelfBenchConfig): SelfBenchActivities {
+export function createActivities(config: SelfBenchWorkerConfig): SelfBenchActivities {
   const store = createArtifactStore(config.artifact);
   const sandbox = createSandboxExecutor(config.execution);
   return {
@@ -1054,7 +1055,12 @@ async function runHarborGate(
       "--yes",
       "--quiet",
     ],
-    { allowFailure: true, timeoutMs: 3 * 60 * 60 * 1000, signal },
+    {
+      allowFailure: true,
+      env: harborChildEnvironment(),
+      timeoutMs: 3 * 60 * 60 * 1000,
+      signal,
+    },
   );
   if (result.exitCode !== 0) {
     throw ApplicationFailure.create({

package/src/temporal/worker-main.ts

@@ -1,13 +1,13 @@
 import { fileURLToPath } from "node:url";
 import { Worker } from "@temporalio/worker";
-import { loadConfig } from "../config.js";
+import { loadWorkerConfig } from "../config.js";
 import { removeEmptyModalCredentialOverrides } from "../modal-auth.js";
 import { runCommand } from "../process.js";
 import { createActivities } from "./activities.js";
 import { connectTemporalWorker } from "./connection.js";
 
 removeEmptyModalCredentialOverrides();
-const config = loadConfig();
+const config = loadWorkerConfig();
 if (config.execution.kind === "docker" || config.harborEnvironment === "docker") {
   await runCommand("docker", ["info"], { timeoutMs: 30_000 });
   await runCommand("docker", ["compose", "version"], { timeoutMs: 30_000 });