self-bench 0.3.4 → 0.3.6

package/review/src/styles.css

@@ -0,0 +1,162 @@
+:root {
+  --bg: #f4f5f7;
+  --surface: #ffffff;
+  --border: #d8dce3;
+  --text: #1a1d23;
+  --muted: #6b7280;
+  --accent: #2563eb;
+  --danger: #dc2626;
+  --success: #059669;
+  --code-bg: #f1f3f5;
+  --font: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
+  --mono: "SF Mono", "Cascadia Code", "Fira Code", monospace;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #0d1117;
+    --surface: #161b22;
+    --border: #30363d;
+    --text: #e6edf3;
+    --muted: #8b949e;
+    --accent: #58a6ff;
+    --danger: #f85149;
+    --success: #3fb950;
+    --code-bg: #1c2128;
+  }
+}
+
+* { margin: 0; padding: 0; box-sizing: border-box; }
+
+body {
+  font-family: var(--font);
+  background: var(--bg);
+  color: var(--text);
+  font-size: 14px;
+  line-height: 1.5;
+}
+
+.app-shell { min-height: 100vh; display: flex; flex-direction: column; }
+
+.topbar {
+  display: flex; justify-content: space-between; align-items: center;
+  padding: 16px 24px; border-bottom: 1px solid var(--border);
+  background: var(--surface);
+}
+
+.eyebrow {
+  font-size: 11px; font-weight: 600; letter-spacing: 0.08em;
+  text-transform: uppercase; color: var(--muted);
+}
+
+.topbar h1 { font-size: 18px; font-weight: 600; margin-top: 2px; }
+.topbar-actions { display: flex; gap: 8px; align-items: center; }
+.token-input {
+  padding: 6px 10px; border: 1px solid var(--border); border-radius: 6px;
+  background: var(--surface); color: var(--text); font-size: 12px; width: 180px;
+}
+
+.error-banner {
+  padding: 12px 24px; background: var(--danger); color: #fff; font-size: 13px;
+}
+
+.workspace {
+  flex: 1; display: grid; grid-template-columns: 280px 1fr; gap: 16px;
+  padding: 16px 24px;
+}
+
+.surface { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; }
+
+.run-list { padding: 16px; overflow-y: auto; max-height: calc(100vh - 100px); }
+
+.section-heading {
+  display: flex; justify-content: space-between; align-items: baseline;
+  margin-bottom: 12px; padding-bottom: 8px; border-bottom: 1px solid var(--border);
+}
+
+.section-heading h2 { font-size: 13px; font-weight: 600; }
+.section-heading span { font-size: 11px; color: var(--muted); }
+
+.run-row {
+  width: 100%; display: flex; flex-direction: column; gap: 2px;
+  padding: 10px 12px; margin-bottom: 6px; border: 1px solid var(--border);
+  border-radius: 6px; background: var(--surface); cursor: pointer; text-align: left;
+  font: inherit; color: inherit;
+}
+
+.run-row:hover { border-color: var(--accent); }
+.run-row.selected { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
+.run-row strong { font-size: 13px; }
+.run-row span { font-size: 11px; color: var(--muted); }
+.run-row small { font-size: 10px; color: var(--muted); }
+
+.content { display: flex; flex-direction: column; gap: 16px; }
+
+.empty {
+  padding: 64px 32px; text-align: center; display: flex; flex-direction: column;
+  align-items: center; gap: 8px; min-height: 400px; justify-content: center;
+}
+.empty h2 { font-size: 16px; font-weight: 600; }
+.empty p { color: var(--muted); }
+
+.summary {
+  display: flex; justify-content: space-between; align-items: center;
+  padding: 16px 20px;
+}
+.summary h2 { font-size: 16px; font-weight: 600; }
+.summary .muted { font-size: 12px; color: var(--muted); margin-top: 2px; }
+
+.review-grid { display: grid; grid-template-columns: 240px 1fr; gap: 16px; }
+
+.task-list { padding: 16px; max-height: calc(100vh - 280px); overflow-y: auto; }
+
+.task-row {
+  width: 100%; display: flex; justify-content: space-between; align-items: center;
+  padding: 8px 10px; margin-bottom: 4px; border: 1px solid var(--border);
+  border-radius: 5px; background: var(--surface); cursor: pointer; text-align: left;
+  font: inherit; color: inherit; font-size: 12px;
+}
+.task-row:hover { border-color: var(--accent); }
+.task-row.selected { border-color: var(--accent); }
+.task-row.removed { opacity: 0.5; }
+.task-row.removed strong { text-decoration: line-through; }
+.task-row span { font-size: 10px; color: var(--muted); }
+
+.task-detail { padding: 20px 24px; max-height: calc(100vh - 280px); overflow-y: auto; }
+
+.detail-header {
+  display: flex; justify-content: space-between; align-items: flex-start;
+  margin-bottom: 20px; padding-bottom: 16px; border-bottom: 1px solid var(--border);
+}
+.detail-header h2 { font-size: 18px; font-weight: 600; }
+
+.detail-block { margin-bottom: 20px; }
+.detail-block h3 {
+  font-size: 12px; font-weight: 600; letter-spacing: 0.04em;
+  text-transform: uppercase; color: var(--muted); margin-bottom: 6px;
+}
+.detail-block pre {
+  padding: 12px 16px; background: var(--code-bg); border-radius: 6px;
+  font-family: var(--mono); font-size: 12px; white-space: pre-wrap;
+  word-break: break-all; max-height: 400px; overflow-y: auto; line-height: 1.6;
+}
+.patch-files {
+  display: grid; gap: 10px; padding: 8px; max-height: 600px; overflow: auto;
+  background: var(--code-bg); border-radius: 6px;
+}
+.patch-files > div { overflow: hidden; border: 1px solid var(--border); border-radius: 4px; }
+
+.button {
+  padding: 7px 14px; border: 1px solid var(--border); border-radius: 6px;
+  background: var(--surface); color: var(--text); font-size: 12px; font-weight: 500;
+  cursor: pointer; font-family: var(--font);
+}
+.button:hover { border-color: var(--accent); color: var(--accent); }
+.button.primary { background: var(--accent); color: #fff; border-color: var(--accent); }
+.button.primary:hover { opacity: 0.9; color: #fff; }
+.button.danger { color: var(--danger); border-color: var(--danger); }
+.button.danger:hover { background: var(--danger); color: #fff; }
+.button.undo { color: var(--success); border-color: var(--success); }
+.button.undo:hover { background: var(--success); color: #fff; }
+
+.muted { color: var(--muted); }

package/review/src/types.ts

@@ -0,0 +1,47 @@
+export interface RunSummary {
+  runId: string;
+  status: string;
+  startedAt: string;
+  closedAt?: string;
+}
+
+export interface TaskProgress {
+  taskId: string;
+  candidateId: string;
+  difficulty: "easy" | "medium" | "hard";
+  status: string;
+  reason?: string;
+}
+
+export interface RunStatus {
+  runId: string;
+  phase: string;
+  requested: number;
+  accepted: number;
+  rejected: number;
+  tasks: TaskProgress[];
+  export?: { uri: string; sizeBytes: number; contentType: string };
+  error?: string;
+}
+
+export interface ExportManifest {
+  schemaVersion: number;
+  runId: string;
+  candidateCounts: Record<string, number>;
+  repository: { url: string; commit: string };
+  version: Record<string, unknown>;
+  acceptedCount: number;
+  tasks: { taskId: string; sha256: string }[];
+}
+
+export interface ExportTask {
+  taskId: string;
+  files: Map<string, Uint8Array>;
+  textFiles: Map<string, string>;
+}
+
+export interface LoadedExport {
+  manifest: ExportManifest;
+  tasks: ExportTask[];
+  taskArchives: Map<string, Uint8Array>;
+}

package/review/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "jsx": "react-jsx",
+    "lib": ["DOM", "DOM.Iterable", "ES2023"],
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "noEmit": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "target": "ES2022",
+    "types": ["bun", "vite/client"]
+  },
+  "include": ["src", "vite.config.ts"]
+}

package/review/vite.config.ts

@@ -0,0 +1,20 @@
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  root: "review",
+  plugins: [react()],
+  build: {
+    outDir: "../dist/review",
+    emptyOutDir: true,
+  },
+  server: {
+    allowedHosts: ["avyays-mac-mini.tailf3cee5.ts.net"],
+    proxy: {
+      "/v1": "http://127.0.0.1:8080",
+    },
+  },
+  preview: {
+    allowedHosts: ["avyays-mac-mini.tailf3cee5.ts.net"],
+  },
+});

package/scripts/build-sandbox-programs.ts

@@ -0,0 +1,22 @@
+import { mkdir } from "node:fs/promises";
+import { join, resolve } from "node:path";
+
+const root = resolve(import.meta.dir, "..");
+const outputDirectory = join(root, "dist");
+
+const programs = ["author", "review", "repair", "validation-repair"] as const;
+
+await mkdir(outputDirectory, { recursive: true });
+await Promise.all(
+  programs.map(async (program) => {
+    const result = await Bun.build({
+      entrypoints: [join(root, "src/sandbox/programs", `${program}.ts`)],
+      outdir: outputDirectory,
+      naming: `sandbox-${program}.bundle.js`,
+      target: "node",
+    });
+    if (!result.success) {
+      throw new AggregateError(result.logs, `failed to bundle sandbox ${program} program`);
+    }
+  }),
+);

package/scripts/verify-package.ts

@@ -2,8 +2,14 @@ import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 
+const options = process.argv.slice(2);
+const dockerBuild = options.length === 1 && options[0] === "--docker-build";
+if (options.length > 0 && !dockerBuild) {
+  throw new Error(`unknown verify-package argument: ${options.join(" ")}`);
+}
 const root = resolve(import.meta.dir, "..");
 const temporary = await mkdtemp(join(tmpdir(), "self-bench-package-"));
+
 async function run(command: string, args: string[], cwd = root): Promise<string> {
   const child = Bun.spawn([command, ...args], {
     cwd,
@@ -26,12 +32,15 @@ try {
   const tarballs = (await Array.fromAsync(new Bun.Glob("*.tgz").scan({ cwd: temporary }))).map(
     (name) => join(temporary, name),
   );
-  const tarball = tarballs[0] ?? (() => {
-    throw new Error("bun pm pack did not create a tarball");
-  })();
+  const tarball =
+    tarballs[0] ??
+    (() => {
+      throw new Error("bun pm pack did not create a tarball");
+    })();
   const packageJson = JSON.parse(await readFile(join(root, "package.json"), "utf8")) as {
     name: string;
     version: string;
+    bin: Record<string, string>;
   };
   const installRoot = join(temporary, "install");
   await run("mkdir", ["-p", installRoot]);
@@ -42,15 +51,51 @@ try {
   if (!help.includes("self-bench up")) {
     throw new Error("installed self-bench did not print the expected CLI help");
   }
-  for (const asset of ["compose.yaml", "Dockerfile", "Dockerfile.sandbox", "src/skills/selfbench/SKILL.md"]) {
-    await readFile(join(installRoot, "node_modules", packageJson.name, asset));
+  const installedRoot = join(installRoot, "node_modules", packageJson.name);
+  for (const [name, target] of Object.entries(packageJson.bin)) {
+    await readFile(join(installedRoot, target));
+    await readFile(join(installRoot, "node_modules", ".bin", name));
+  }
+  for (const asset of [
+    "dist/api-main.js",
+    "dist/temporal/worker-main.js",
+    "dist/sandbox-author.bundle.js",
+    "dist/sandbox-review.bundle.js",
+    "dist/sandbox-repair.bundle.js",
+    "dist/sandbox-validation-repair.bundle.js",
+    "dist/review/index.html",
+  ]) {
+    await readFile(join(installedRoot, asset));
+  }
+  for (const asset of [
+    ".dockerignore",
+    "compose.yaml",
+    "Dockerfile",
+    "Dockerfile.sandbox",
+    "review/index.html",
+    "review/src/App.tsx",
+    "review/vite.config.ts",
+    "src/extensions/authoring.ts",
+    "src/skills/selfbench/SKILL.md",
+  ]) {
+    await readFile(join(installedRoot, asset));
   }
   const installedPackage = JSON.parse(
-    await readFile(join(installRoot, "node_modules", packageJson.name, "package.json"), "utf8"),
+    await readFile(join(installedRoot, "package.json"), "utf8"),
   ) as { name: string; version: string };
-  if (installedPackage.name !== packageJson.name || installedPackage.version !== packageJson.version) {
+  if (
+    installedPackage.name !== packageJson.name ||
+    installedPackage.version !== packageJson.version
+  ) {
     throw new Error("installed package metadata does not match the workspace package");
   }
+  if (dockerBuild) {
+    await run(
+      "docker",
+      ["build", "--target", "build", "--file", join(installedRoot, "Dockerfile"), installedRoot],
+      installedRoot,
+    );
+  }
   console.log(`verified ${installedPackage.name}@${installedPackage.version}`);
 } finally {
   await rm(temporary, { recursive: true, force: true });

package/scripts/write-build-metadata.ts

@@ -1,5 +1,5 @@
-import { mkdir, writeFile } from "node:fs/promises";
 import { execFile } from "node:child_process";
+import { mkdir, writeFile } from "node:fs/promises";
 import { promisify } from "node:util";
 
 const execFileAsync = promisify(execFile);

package/src/api.ts

@@ -1,21 +1,22 @@
 import { timingSafeEqual } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { pipeline } from "node:stream/promises";
-import { fileURLToPath } from "node:url";
 import { Client } from "@temporalio/client";
 import { z } from "zod";
 import { createArtifactStore } from "./artifacts.js";
 import type { SelfBenchConfig } from "./config.js";
 import {
   artifactRefSchema,
+  MAX_CANDIDATES_PER_RUN,
   type RunPhase,
   type RunRequest,
   type RunStatus,
   repositoryRefSchema,
   runRequestSchema,
 } from "./contracts.js";
+import { projectRoot } from "./project-paths.js";
 import { connectTemporalClient } from "./temporal/connection.js";
 import { selfBenchRunWorkflow, statusQuery } from "./temporal/workflow.js";
 
@@ -24,9 +25,9 @@ const submissionSchema = z.object({
   repository: repositoryRefSchema,
   provenance: artifactRefSchema,
   candidateCounts: z.object({
-    easy: z.number().int().min(0).max(100),
-    medium: z.number().int().min(0).max(100),
-    hard: z.number().int().min(0).max(100),
+    easy: z.number().int().min(0).max(MAX_CANDIDATES_PER_RUN),
+    medium: z.number().int().min(0).max(MAX_CANDIDATES_PER_RUN),
+    hard: z.number().int().min(0).max(MAX_CANDIDATES_PER_RUN),
   }),
   authoringModel: z.string().min(1).default("gpt-5.6-sol"),
   selfbenchCommit: z.string().regex(/^[0-9a-f]{40}$/i),
@@ -254,7 +255,7 @@ function authorized(request: IncomingMessage, token: string | undefined): boolea
 
 async function sendReviewAsset(response: ServerResponse, pathname: string): Promise<void> {
   const relativePath = pathname === "/" ? "index.html" : pathname.slice(1);
-  const root = join(dirname(fileURLToPath(import.meta.url)), "review");
+  const root = join(projectRoot(import.meta.url), "dist/review");
   const path = join(root, relativePath);
   if (!path.startsWith(`${root}/`)) {
     sendJson(response, 400, { error: "invalid asset path" });

package/src/cli.ts

@@ -11,13 +11,23 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { buildCommit } from "./build-metadata.js";
 import { loadWorkerConfig } from "./config.js";
+import { MAX_CANDIDATES_PER_RUN } from "./contracts.js";
 import { runCommand } from "./process.js";
-import { collectGitHubPullRequestProvenance, collectRepositoryProvenance } from "./provenance.js";
+import {
+  collectRepositoryProvenance,
+  collectRepositoryProvenanceWithMetadata,
+} from "./provenance.js";
+import {
+  applyProvenanceAssociationManifests,
+  associationSessionSummaries,
+  createProvenanceAssociationManifest,
+  resolveMergedPullRequest,
+  writeProvenanceAssociationManifest,
+} from "./provenance-associations.js";
 import { isExecutionBackend, isHarborEnvironment, matchingHarborEnvironment } from "./providers.js";
 import { type PolledRunStatus, waitForRun } from "./run-wait.js";
+import { applyVercelProfile, setupVercel } from "./setup/vercel/index.js";
 import { SetupCanceledError } from "./terminal-prompts.js";
-import { applyVercelProfile } from "./vercel-profile.js";
-import { setupVercel } from "./vercel-setup.js";
 
 const [command, ...rest] = process.argv.slice(2);
 switch (command) {
@@ -30,6 +40,9 @@ switch (command) {
   case "run":
     await run(rest);
     break;
+  case "associate":
+    await associate(rest);
+    break;
   case "down":
     await down();
     break;
@@ -162,6 +175,57 @@ async function down(): Promise<void> {
   await runCommand("docker", ["compose", "--file", resolve(projectRoot, "compose.yaml"), "down"]);
 }
 
+async function associate(args: string[]): Promise<void> {
+  const parsed = parseArgs({
+    args,
+    options: {
+      repo: { type: "string", short: "r" },
+      pr: { type: "string" },
+      session: { type: "string", multiple: true },
+      output: { type: "string", short: "o" },
+      "list-sessions": { type: "boolean", default: false },
+    },
+    strict: true,
+  });
+  const repositoryPath = resolve(parsed.values.repo ?? fail("--repo is required"));
+  const [repository, collected] = await Promise.all([
+    resolveRepository(repositoryPath),
+    collectRepositoryProvenanceWithMetadata(repositoryPath, process.env.HOME ?? homedir()),
+  ]);
+  const localMessages = collected.messages;
+  const sessions = associationSessionSummaries(localMessages, collected.sessions);
+  if (parsed.values["list-sessions"]) {
+    console.log(JSON.stringify({ repository: repository.url, sessions }, null, 2));
+    return;
+  }
+
+  const sourcePr = positiveInteger(parsed.values.pr ?? fail("--pr is required"), "--pr");
+  const output = resolve(parsed.values.output ?? fail("--output is required"));
+  const selectors = parsed.values.session ?? [];
+  const pullRequest = await resolveMergedPullRequest(repository.url, sourcePr);
+  const manifest = createProvenanceAssociationManifest({
+    repositoryUrl: repository.url,
+    pullRequest,
+    messages: localMessages,
+    sessionSelectors: selectors,
+  });
+  await writeProvenanceAssociationManifest(output, manifest);
+  console.log(
+    JSON.stringify(
+      {
+        output,
+        repository: manifest.repository,
+        sourcePr: manifest.sourcePr,
+        sourceUrl: manifest.sourceUrl,
+        sessions: selectors.length,
+        messages: manifest.messages.length,
+      },
+      null,
+      2,
+    ),
+  );
+}
+
 async function run(args: string[]): Promise<void> {
   const parsed = parseArgs({
     args,
@@ -174,6 +238,7 @@ async function run(args: string[]): Promise<void> {
       model: { type: "string", default: "gpt-5.6-sol" },
       wait: { type: "boolean", default: false },
       output: { type: "string", short: "o" },
+      association: { type: "string", multiple: true },
     },
     strict: true,
   });
@@ -184,21 +249,25 @@ async function run(args: string[]): Promise<void> {
     hard: nonnegativeInteger(parsed.values["hard-count"] ?? "0", "--hard-count"),
   };
   const totalCandidates = candidateCounts.easy + candidateCounts.medium + candidateCounts.hard;
-  if (totalCandidates < 1 || totalCandidates > 100) {
-    fail("the total candidate count must be between 1 and 100");
+  if (totalCandidates < 1 || totalCandidates > MAX_CANDIDATES_PER_RUN) {
+    fail(`the total candidate count must be between 1 and ${MAX_CANDIDATES_PER_RUN}`);
   }
   const runId = parsed.values["run-id"] ?? defaultRunId();
-  const [repository, localMessages, selfbenchCommit] = await Promise.all([
+  const [repository, collectedMessages, selfbenchCommit] = await Promise.all([
     resolveRepository(repositoryPath),
     collectRepositoryProvenance(repositoryPath, process.env.HOME ?? homedir()),
     resolveSelfBenchCommit(),
   ]);
-  const githubMessages = await collectGitHubPullRequestProvenance(repository.url);
-  const messages = [...localMessages, ...githubMessages];
-  if (messages.length === 0) {
-    throw new Error("no sanitized local-session or GitHub pull-request provenance was found");
-  }
-  const corpus = Buffer.from(`${messages.map((message) => JSON.stringify(message)).join("\n")}\n`);
+  const localMessages = await applyProvenanceAssociationManifests(
+    collectedMessages,
+    repository.url,
+    parsed.values.association ?? [],
+  );
+  const corpus = Buffer.from(
+    localMessages.length > 0
+      ? `${localMessages.map((message) => JSON.stringify(message)).join("\n")}\n`
+      : "",
+  );
   const provenance = await requestJson(`/v1/provenance?runId=${encodeURIComponent(runId)}`, {
     method: "POST",
     body: corpus,
@@ -222,9 +291,8 @@ async function run(args: string[]): Promise<void> {
     JSON.stringify(
       {
         ...response,
-        provenanceMessages: messages.length,
         localProvenanceMessages: localMessages.length,
-        githubPullRequestMessages: githubMessages.length,
+        associationManifests: parsed.values.association?.length ?? 0,
       },
       null,
       2,
@@ -377,6 +445,14 @@ function asPolledRunStatus(value: Record<string, unknown>): PolledRunStatus {
   return { ...value, phase: value.phase };
 }
 
+function positiveInteger(value: string, label: string): number {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw new Error(`${label} must be a positive integer`);
+  }
+  return parsed;
+}
+
 function nonnegativeInteger(value: string, label: string): number {
   const parsed = Number(value);
   if (!Number.isInteger(parsed) || parsed < 0) {
@@ -401,8 +477,12 @@ Usage:
   self-bench up [--backend docker|modal|vercel] [--harbor-environment docker|modal]
                 [--modal-config PATH] [--vercel-profile NAME]
   self-bench down
+  self-bench associate --repo PATH --list-sessions
+  self-bench associate --repo PATH --pr NUMBER --session TYPE:SESSION_ID [...]
+                       --output ASSOCIATION.json
   self-bench run --repo PATH [--easy-count N] [--medium-count N] [--hard-count N]
-                  [--model MODEL] [--run-id ID] [--wait] [--output OUTPUT.tar.gz]
+                  [--model MODEL] [--association ASSOCIATION.json ...]
+                  [--run-id ID] [--wait] [--output OUTPUT.tar.gz]
   self-bench status RUN_ID
   self-bench cancel RUN_ID
   self-bench download RUN_ID OUTPUT.tar.gz
@@ -413,6 +493,10 @@ requires --harbor-environment because Harbor does not support Vercel. Modal gene
 ~/.modal.toml unless --modal-config overrides it. Run self-bench setup vercel once to create or select a
 project, publish the pinned runtime image, verify access, and save an owner-only local profile.
 
+The associate command runs locally. --list-sessions prints selectors, counts, local paths, and modification
+times, but never request text. Association writes a create-only, text-free manifest; it never uploads or
+starts a run. Pass the manifest to run with --association (repeatable). No LLM participates in association.
+
 The tier counts are candidate authoring budgets, not accepted-task targets. Rejected candidates are not
 replaced, and the export contains only accepted tasks. The run command performs only repository metadata
 and sanitized provenance upload locally; discovery, authoring, validation, review, and audit run remotely.

package/src/config.ts

@@ -6,7 +6,7 @@ import {
   type HarborEnvironment,
   matchingHarborEnvironment,
 } from "./providers.js";
-import { parseSandboxTimeoutCapText, STANDARD_VERCEL_TIMEOUT_CAP_MS } from "./sandbox-timeout.js";
+import { parseSandboxTimeoutCapText, STANDARD_VERCEL_TIMEOUT_CAP_MS } from "./sandbox/timeout.js";
 
 const emptyStringAsUndefined = (value: unknown): unknown =>
   typeof value === "string" && value.trim() === "" ? undefined : value;

package/src/contracts.ts

@@ -22,17 +22,19 @@ export type ArtifactRef = z.infer<typeof artifactRefSchema>;
 export const difficultySchema = z.enum(["easy", "medium", "hard"]);
 export type Difficulty = z.infer<typeof difficultySchema>;
 
+export const MAX_CANDIDATES_PER_RUN = 10_000;
+
 const candidateCountsSchema = z
   .object({
-    easy: z.number().int().min(0).max(100),
-    medium: z.number().int().min(0).max(100),
-    hard: z.number().int().min(0).max(100),
+    easy: z.number().int().min(0).max(MAX_CANDIDATES_PER_RUN),
+    medium: z.number().int().min(0).max(MAX_CANDIDATES_PER_RUN),
+    hard: z.number().int().min(0).max(MAX_CANDIDATES_PER_RUN),
   })
   .refine(({ easy, medium, hard }) => easy + medium + hard >= 1, {
     message: "at least one candidate must be requested",
   })
-  .refine(({ easy, medium, hard }) => easy + medium + hard <= 100, {
-    message: "at most 100 candidates may be requested",
+  .refine(({ easy, medium, hard }) => easy + medium + hard <= MAX_CANDIDATES_PER_RUN, {
+    message: `at most ${MAX_CANDIDATES_PER_RUN} candidates may be requested`,
   });
 
 const runVersionSchema = z

package/src/extensions/discovery.ts

@@ -1,4 +1,4 @@
-import { writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync } from "node:fs";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "@sinclair/typebox";
 
@@ -22,7 +22,6 @@ export default function discoveryExtension(pi: ExtensionAPI): void {
               sourceUrl: Type.String({ minLength: 1 }),
               baseCommit: Type.String({ pattern: "^[0-9a-fA-F]{40}$" }),
               completedCommit: Type.String({ pattern: "^[0-9a-fA-F]{40}$" }),
-              request: Type.String({ minLength: 1 }),
               provenance: Type.Object({
                 sourceType: Type.Union([
                   Type.Literal("pi"),
@@ -51,10 +50,20 @@ export default function discoveryExtension(pi: ExtensionAPI): void {
       if (!candidates) {
         throw new Error("submit_discovery received no candidates");
       }
-      writeFileSync(output, `${JSON.stringify({ candidates }, null, 2)}\n`, { flag: "wx" });
+      const exclusionsPath = process.env.SELFBENCH_DISCOVERY_EXCLUSIONS;
+      if (!exclusionsPath) {
+        throw new Error("SELFBENCH_DISCOVERY_EXCLUSIONS is not configured");
+      }
+      const excluded = new Set<number>(JSON.parse(readFileSync(exclusionsPath, "utf8")));
+      const accepted = candidates.filter(
+        ({ sourcePr }) => sourcePr !== undefined && !excluded.has(sourcePr),
+      );
+      writeFileSync(output, `${JSON.stringify({ candidates: accepted }, null, 2)}\n`, {
+        flag: "wx",
+      });
       return {
-        content: [{ type: "text", text: `Submitted ${candidates.length} candidates.` }],
-        details: { candidates },
+        content: [{ type: "text", text: `Submitted ${accepted.length} new candidates.` }],
+        details: { candidates: accepted },
       };
     },
   });