self-bench 0.3.5 → 0.3.8

package/dist/temporal/activities/gate-logs.js

@@ -0,0 +1,62 @@
+import { COMPOSE_DIAGNOSTICS_MARKER, excerptLog } from "../../log-excerpt.js";
+import { runCommand } from "../../process.js";
+/** Stores the complete raw log for a gate and returns the actionable excerpt alongside its ref. */
+export async function storeGateLog(store, key, raw) {
+    const log = await store.put(key, Buffer.from(raw.length > 0 ? raw : "(empty log)\n"), "text/plain");
+    return { logTail: excerptLog(raw), log };
+}
+export function isUnhealthyServiceFailure(text) {
+    return /unhealthy|dependency failed|healthcheck/i.test(text);
+}
+/**
+ * `docker compose ps` plus the last 30 log lines of each failed service for the trial's compose
+ * project (Harbor names it after the trial: `<trial_name>__env`). Harbor usually tears the project
+ * down before we get here, in which case the block says so instead of being silently empty.
+ */
+export async function composeDiagnostics(trial, harborEnvironment, run = runCommand) {
+    const trialName = trialNameOf(trial);
+    if (harborEnvironment !== "docker") {
+        return `${COMPOSE_DIAGNOSTICS_MARKER}: not available on the ${harborEnvironment} Harbor environment; the compose project cannot be inspected from the worker.`;
+    }
+    if (!trialName) {
+        return `${COMPOSE_DIAGNOSTICS_MARKER}: Harbor's trial name is missing from the result, so the compose project could not be located.`;
+    }
+    const project = composeProjectName(`${trialName}__env`);
+    const ps = await run("docker", ["compose", "-p", project, "ps", "-a", "--format", "table"], {
+        allowFailure: true,
+        timeoutMs: 30_000,
+    }).catch((error) => ({
+        exitCode: 1,
+        stdout: "",
+        stderr: error instanceof Error ? error.message : String(error),
+    }));
+    const services = ps.stdout.trim().split("\n").slice(1).filter(Boolean);
+    if (ps.exitCode !== 0 || services.length === 0) {
+        return `${COMPOSE_DIAGNOSTICS_MARKER} (project ${project}): the compose project is no longer available (Harbor deletes it after the run), so service status and logs could not be fetched.${ps.stderr.trim() ? ` docker said: ${ps.stderr.trim().slice(0, 300)}` : ""}`;
+    }
+    const lines = [`${COMPOSE_DIAGNOSTICS_MARKER} (project ${project})`, ps.stdout.trimEnd()];
+    for (const row of services) {
+        const service = row.split(/\s+/)[0];
+        if (!service || /\bhealthy\b|\brunning\b(?!.*unhealthy)/i.test(row) === true) {
+            continue;
+        }
+        const logs = await run("docker", ["compose", "-p", project, "logs", "--tail", "30", service], {
+            allowFailure: true,
+            timeoutMs: 30_000,
+        }).catch(() => ({ exitCode: 1, stdout: "", stderr: "" }));
+        lines.push(`--- ${service} (last 30 lines) ---`, logs.stdout.trimEnd() || logs.stderr.trimEnd() || "(no output)");
+    }
+    return lines.join("\n");
+}
+function trialNameOf(trial) {
+    const name = typeof trial === "object" && trial !== null
+        ? trial.trial_name
+        : undefined;
+    return typeof name === "string" && name.length > 0 ? name : undefined;
+}
+/** Mirrors Harbor's compose project sanitization: lowercase, alphanumeric start, safe characters. */
+export function composeProjectName(name) {
+    const lower = name.toLowerCase().replace(/[^a-z0-9_-]/g, "-");
+    return /^[a-z0-9]/.test(lower) ? lower : `0${lower}`;
+}
+//# sourceMappingURL=gate-logs.js.map

package/dist/temporal/activities/gate-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-logs.js","sourceRoot":"","sources":["../../../src/temporal/activities/gate-logs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAO9C,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAoB,EACpB,GAAW,EACX,GAAW;IAEX,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CACzB,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EACnD,YAAY,CACb,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,iBAAuD,EACvD,MAAyB,UAAU;IAEnC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,GAAG,0BAA0B,0BAA0B,iBAAiB,+EAA+E,CAAC;IACjK,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,0BAA0B,gGAAgG,CAAC;IACvI,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;QAC1F,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC/D,CAAC,CAAC,CAAC;IACJ,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,GAAG,0BAA0B,aAAa,OAAO,oIAAoI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1Q,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,0BAA0B,aAAa,OAAO,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAC5F,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,OAAO,OAAO,sBAAsB,EACpC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,aAAa,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAE,KAAkC,CAAC,UAAU;QAChD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;AACvD,CAAC"}

package/dist/temporal/activities/generation-runtime.d.ts

@@ -0,0 +1,6 @@
+import { type SelfBenchWorkerConfig } from "../../config.js";
+import type { RunRequest } from "../../contracts.js";
+import type { EncryptedRecordStore } from "../../evaluation/encrypted-records.js";
+import { type SandboxExecutor } from "../../sandbox/index.js";
+export declare function withGenerationRuntime<T>(config: SelfBenchWorkerConfig, records: EncryptedRecordStore | undefined, run: RunRequest, stage: "author" | "verifier", legacySandbox: SandboxExecutor, action: (sandbox: SandboxExecutor, environment: SelfBenchWorkerConfig["harborEnvironment"], configuredRun: RunRequest) => Promise<T>): Promise<T>;
+//# sourceMappingURL=generation-runtime.d.ts.map

package/dist/temporal/activities/generation-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generation-runtime.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/generation-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAElF,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIrF,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,oBAAoB,GAAG,SAAS,EACzC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,QAAQ,GAAG,UAAU,EAC5B,aAAa,EAAE,eAAe,EAC9B,MAAM,EAAE,CACN,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,EACvD,aAAa,EAAE,UAAU,KACtB,OAAO,CAAC,CAAC,CAAC,cA0DhB"}

package/dist/temporal/activities/generation-runtime.js

@@ -0,0 +1,56 @@
+import { ApplicationFailure } from "@temporalio/common";
+import { loadWorkerConfig } from "../../config.js";
+import { withExecutionEnvironment } from "../../execution-environment.js";
+import { createSandboxExecutor } from "../../sandbox/index.js";
+import { generationConfigEnvironment } from "../../site/generation-config.js";
+import { generationEnvironment } from "../../site/generation-credentials.js";
+export async function withGenerationRuntime(config, records, run, stage, legacySandbox, action) {
+    if (!run.generation)
+        return action(legacySandbox, config.harborEnvironment, run);
+    let env;
+    try {
+        if (!records)
+            throw new Error("Generation credentials are not configured on this worker.");
+        env = await generationEnvironment(records, run.runId, run.generation, process.env);
+    }
+    catch (error) {
+        throw ApplicationFailure.nonRetryable(error instanceof Error ? error.message : "Generation credentials unavailable", "GenerationConfiguration");
+    }
+    const settings = run.generation.settings;
+    let selected;
+    try {
+        if (run.version.executionBackend !== settings.sandbox ||
+            (settings.sandboxImage && settings.sandboxImage !== run.version.sandboxImage))
+            throw new Error("Generation runtime does not match its saved configuration.");
+        selected = loadWorkerConfig(generationConfigEnvironment(settings, env, run.version.sandboxImage));
+        if (selected.harborEnvironment !== run.version.harborEnvironment)
+            throw new Error("Harbor verification does not match its saved configuration.");
+    }
+    catch (error) {
+        throw ApplicationFailure.nonRetryable(error instanceof Error ? error.message : "Generation runtime unavailable", "GenerationConfiguration");
+    }
+    const execution = "timeoutCapMs" in selected.execution
+        ? {
+            ...selected.execution,
+            timeoutCapMs: Math.min(selected.execution.timeoutCapMs, run.version.sandboxTimeoutCapMs ?? selected.execution.timeoutCapMs),
+        }
+        : selected.execution;
+    const configuredRun = {
+        ...run,
+        authoring: {
+            ...run.authoring,
+            model: stage === "verifier" ? settings.verifierModel : settings.authorModel,
+            reasoningEffort: settings.reasoning,
+        },
+    };
+    return withExecutionEnvironment(env, async () => {
+        const sandbox = createSandboxExecutor(execution, env);
+        try {
+            return await action(sandbox, selected.harborEnvironment, configuredRun);
+        }
+        finally {
+            sandbox.close();
+        }
+    });
+}
+//# sourceMappingURL=generation-runtime.js.map

package/dist/temporal/activities/generation-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generation-runtime.js","sourceRoot":"","sources":["../../../src/temporal/activities/generation-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAA8B,MAAM,iBAAiB,CAAC;AAG/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAwB,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA6B,EAC7B,OAAyC,EACzC,GAAe,EACf,KAA4B,EAC5B,aAA8B,EAC9B,MAIe;IAEf,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,GAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC3F,GAAG,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,YAAY,CACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,EAC7E,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IACzC,IAAI,QAA+B,CAAC;IACpC,IAAI,CAAC;QACH,IACE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,OAAO;YACjD,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,KAAK,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;YAE7E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,QAAQ,GAAG,gBAAgB,CACzB,2BAA2B,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CACrE,CAAC;QACF,IAAI,QAAQ,CAAC,iBAAiB,KAAK,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC9D,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,YAAY,CACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,EACzE,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GACb,cAAc,IAAI,QAAQ,CAAC,SAAS;QAClC,CAAC,CAAC;YACE,GAAG,QAAQ,CAAC,SAAS;YACrB,YAAY,EAAE,IAAI,CAAC,GAAG,CACpB,QAAQ,CAAC,SAAS,CAAC,YAAY,EAC/B,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,QAAQ,CAAC,SAAS,CAAC,YAAY,CACnE;SACF;QACH,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IACzB,MAAM,aAAa,GAAG;QACpB,GAAG,GAAG;QACN,SAAS,EAAE;YACT,GAAG,GAAG,CAAC,SAAS;YAChB,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;YAC3E,eAAe,EAAE,QAAQ,CAAC,SAAS;SACpC;KACF,CAAC;IACF,OAAO,wBAAwB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/temporal/activities/harbor.d.ts

@@ -0,0 +1,11 @@
+import type { SelfBenchConfig } from "../../config.js";
+import { type HarborJobResult, readHarborJobResult } from "../../harbor-results.js";
+export declare function isHarborInfrastructureApplicationFailure(error: unknown): boolean;
+export declare function runHarborGate(taskDirectory: string, jobsDirectory: string, agent: "nop" | "oracle", taskId: string, environment: SelfBenchConfig["harborEnvironment"], signal: AbortSignal, quiet?: boolean): Promise<HarborJobResult>;
+export declare function harborGateFailureReason(nopPassed: boolean, nopChecks: Record<string, unknown>, oraclePassed: boolean, oracleChecks: Record<string, unknown>, nopOutput?: string, oracleOutput?: string): string;
+export declare function verifierOutput(result: Awaited<ReturnType<typeof readHarborJobResult>>): string | undefined;
+export declare function boundedTail(value: string, maxBytes?: number): string;
+export declare function rewards(trial: unknown): Record<string, unknown>;
+export declare function exception(trial: unknown): unknown;
+export declare function numberValue(value: unknown): number;
+//# sourceMappingURL=harbor.d.ts.map

package/dist/temporal/activities/harbor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harbor.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/harbor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD,OAAO,EACL,KAAK,eAAe,EAEpB,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AAKjC,wBAAgB,wCAAwC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAShF;AAED,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,KAAK,GAAG,QAAQ,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,eAAe,CAAC,mBAAmB,CAAC,EACjD,MAAM,EAAE,WAAW,EACnB,KAAK,UAAO,GACX,OAAO,CAAC,eAAe,CAAC,CA+C1B;AAUD,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,YAAY,EAAE,OAAO,EACrB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAqBR;AACD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,GACtD,MAAM,GAAG,SAAS,CAOpB;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAQ,GAAG,MAAM,CAKnE;AACD,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS/D;AACD,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEjD;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAElD"}

package/dist/temporal/activities/harbor.js

@@ -0,0 +1,112 @@
+import { ApplicationFailure } from "@temporalio/common";
+import { executionEnvironment } from "../../execution-environment.js";
+import { harborChildEnvironment } from "../../harbor-environment.js";
+import { harborInfrastructureError, readHarborJobResult, } from "../../harbor-results.js";
+import { runCommand } from "../../process.js";
+const HARBOR_INFRASTRUCTURE_FAILURE_TYPE = "HarborInfrastructureFailure";
+export function isHarborInfrastructureApplicationFailure(error) {
+    let cause = error;
+    while (cause instanceof Error) {
+        if (cause instanceof ApplicationFailure && cause.type === HARBOR_INFRASTRUCTURE_FAILURE_TYPE) {
+            return true;
+        }
+        cause = cause.cause;
+    }
+    return false;
+}
+export async function runHarborGate(taskDirectory, jobsDirectory, agent, taskId, environment, signal, quiet = true) {
+    const jobName = `${taskId}-${agent}-${crypto.randomUUID().slice(0, 8)}`;
+    const result = await runCommand("harbor", [
+        "run",
+        "--path",
+        taskDirectory,
+        "--agent",
+        agent,
+        "--env",
+        environment,
+        "--job-name",
+        jobName,
+        "--jobs-dir",
+        jobsDirectory,
+        "--delete",
+        "--yes",
+        ...(quiet ? ["--quiet"] : []),
+    ], {
+        allowFailure: true,
+        env: harborChildEnvironment(executionEnvironment(), environment),
+        timeoutMs: 3 * 60 * 60 * 1000,
+        signal,
+    });
+    if (result.exitCode !== 0) {
+        throw ApplicationFailure.create({
+            message: harborCommandFailureMessage(agent, taskId, result.exitCode, `${result.stdout}\n${result.stderr}`),
+            type: HARBOR_INFRASTRUCTURE_FAILURE_TYPE,
+        });
+    }
+    const parsed = await readHarborJobResult(jobsDirectory, jobName);
+    const infrastructureError = harborInfrastructureError(parsed.trial);
+    if (infrastructureError) {
+        throw ApplicationFailure.create({
+            message: `Harbor ${agent} infrastructure failure for ${taskId}: ${infrastructureError}`,
+            type: HARBOR_INFRASTRUCTURE_FAILURE_TYPE,
+        });
+    }
+    return parsed;
+}
+function harborCommandFailureMessage(agent, taskId, exitCode, output) {
+    const detail = output.trim();
+    return `Harbor ${agent} exited ${exitCode} for ${taskId}${detail ? `:\n${boundedTail(detail)}` : ""}`;
+}
+export function harborGateFailureReason(nopPassed, nopChecks, oraclePassed, oracleChecks, nopOutput, oracleOutput) {
+    const formatChecks = (checks) => [
+        "patch_applied",
+        "fail_to_pass",
+        "pass_to_pass",
+        "deterministic",
+        "setup_completed",
+        "fail_to_pass_exit_code",
+        "fail_to_pass_repeat_exit_code",
+        "pass_to_pass_exit_code",
+    ]
+        .map((key) => `${key}=${String(checks[key] ?? "missing")}`)
+        .join(", ");
+    const diagnostics = [
+        ...(!nopPassed && nopOutput ? [`nop verifier tail:\n${boundedTail(nopOutput)}`] : []),
+        ...(!oraclePassed && oracleOutput
+            ? [`oracle verifier tail:\n${boundedTail(oracleOutput)}`]
+            : []),
+    ];
+    return `Harbor gates failed: nop=${nopPassed} (${formatChecks(nopChecks)}); oracle=${oraclePassed} (${formatChecks(oracleChecks)})${diagnostics.length > 0 ? `\n${diagnostics.join("\n")}` : ""}`;
+}
+export function verifierOutput(result) {
+    const combined = result.verifier?.combined;
+    const stderr = result.verifier?.stderr;
+    if (combined && stderr) {
+        return `${combined.trimEnd()}\n\n--- verifier stderr ---\n${stderr}`;
+    }
+    return stderr ?? combined;
+}
+export function boundedTail(value, maxBytes = 8_000) {
+    const buffer = Buffer.from(value);
+    return buffer.length <= maxBytes
+        ? value.trimEnd()
+        : `[truncated ${buffer.length - maxBytes} bytes]\n${buffer.subarray(-maxBytes).toString("utf8").trimEnd()}`;
+}
+export function rewards(trial) {
+    if (!isRecord(trial) ||
+        !isRecord(trial.verifier_result) ||
+        !isRecord(trial.verifier_result.rewards)) {
+        return {};
+    }
+    return trial.verifier_result.rewards;
+}
+export function exception(trial) {
+    return isRecord(trial) ? trial.exception_info : undefined;
+}
+export function numberValue(value) {
+    return typeof value === "number" ? value : 0;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=harbor.js.map

package/dist/temporal/activities/harbor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harbor.js","sourceRoot":"","sources":["../../../src/temporal/activities/harbor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAEL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,kCAAkC,GAAG,6BAA6B,CAAC;AAEzE,MAAM,UAAU,wCAAwC,CAAC,KAAc;IACrE,IAAI,KAAK,GAAY,KAAK,CAAC;IAC3B,OAAO,KAAK,YAAY,KAAK,EAAE,CAAC;QAC9B,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,kCAAkC,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB,EACrB,aAAqB,EACrB,KAAuB,EACvB,MAAc,EACd,WAAiD,EACjD,MAAmB,EACnB,KAAK,GAAG,IAAI;IAEZ,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,QAAQ,EACR;QACE,KAAK;QACL,QAAQ;QACR,aAAa;QACb,SAAS;QACT,KAAK;QACL,OAAO;QACP,WAAW;QACX,YAAY;QACZ,OAAO;QACP,YAAY;QACZ,aAAa;QACb,UAAU;QACV,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,EACD;QACE,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,sBAAsB,CAAC,oBAAoB,EAAE,EAAE,WAAW,CAAC;QAChE,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC7B,MAAM;KACP,CACF,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,kBAAkB,CAAC,MAAM,CAAC;YAC9B,OAAO,EAAE,2BAA2B,CAClC,KAAK,EACL,MAAM,EACN,MAAM,CAAC,QAAQ,EACf,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CACrC;YACD,IAAI,EAAE,kCAAkC;SACzC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,kBAAkB,CAAC,MAAM,CAAC;YAC9B,OAAO,EAAE,UAAU,KAAK,+BAA+B,MAAM,KAAK,mBAAmB,EAAE;YACvF,IAAI,EAAE,kCAAkC;SACzC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,2BAA2B,CAClC,KAAuB,EACvB,MAAc,EACd,QAAgB,EAChB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,UAAU,KAAK,WAAW,QAAQ,QAAQ,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxG,CAAC;AACD,MAAM,UAAU,uBAAuB,CACrC,SAAkB,EAClB,SAAkC,EAClC,YAAqB,EACrB,YAAqC,EACrC,SAAkB,EAClB,YAAqB;IAErB,MAAM,YAAY,GAAG,CAAC,MAA+B,EAAU,EAAE,CAC/D;QACE,eAAe;QACf,cAAc;QACd,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,wBAAwB;QACxB,+BAA+B;QAC/B,wBAAwB;KACzB;SACE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC;SAC1D,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,WAAW,GAAG;QAClB,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,uBAAuB,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,CAAC,YAAY,IAAI,YAAY;YAC/B,CAAC,CAAC,CAAC,0BAA0B,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,4BAA4B,SAAS,KAAK,YAAY,CAAC,SAAS,CAAC,aAAa,YAAY,KAAK,YAAY,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpM,CAAC;AACD,MAAM,UAAU,cAAc,CAC5B,MAAuD;IAEvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;IACvC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,gCAAgC,MAAM,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,IAAI,QAAQ,CAAC;AAC5B,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAAQ,GAAG,KAAK;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,IAAI,QAAQ;QAC9B,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE;QACjB,CAAC,CAAC,cAAc,MAAM,CAAC,MAAM,GAAG,QAAQ,YAAY,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;AAChH,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC;QAChC,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,EACxC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC;AACvC,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/temporal/activities/modal-build-log.d.ts

@@ -0,0 +1,12 @@
+import { type CommandResult } from "../../process.js";
+/** Harbor's default Modal app; image builds for its sandboxes log under it. */
+export declare const HARBOR_MODAL_APP = "__harbor__";
+export type CommandRunner = (command: string, args: readonly string[]) => Promise<Pick<CommandResult, "exitCode" | "stdout" | "stderr">>;
+export declare function extractModalImageId(message: string): string | undefined;
+/**
+ * Best-effort Modal build log for an ImageBuildError. `modal image` cannot fetch build logs, so
+ * the recent logs of Harbor's Modal app are fetched and filtered around the image id. When that
+ * fails the report says so instead of carrying only the bare id.
+ */
+export declare function modalBuildLogTail(message: string, run?: CommandRunner): Promise<string | undefined>;
+//# sourceMappingURL=modal-build-log.d.ts.map

package/dist/temporal/activities/modal-build-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modal-build-log.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/modal-build-log.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,aAAa,EAAc,MAAM,kBAAkB,CAAC;AAElE,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAI7C,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,KACpB,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC;AAEpE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEvE;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,aAA6B,GACjC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAyB7B"}

package/dist/temporal/activities/modal-build-log.js

@@ -0,0 +1,57 @@
+import { executionEnvironment } from "../../execution-environment.js";
+import { harborChildEnvironment } from "../../harbor-environment.js";
+import { runCommand } from "../../process.js";
+/** Harbor's default Modal app; image builds for its sandboxes log under it. */
+export const HARBOR_MODAL_APP = "__harbor__";
+const LOG_TAIL_BYTES = 4_000;
+const LOG_ENTRIES = 400;
+export function extractModalImageId(message) {
+    return /\bim-[A-Za-z0-9]+\b/.exec(message)?.[0];
+}
+/**
+ * Best-effort Modal build log for an ImageBuildError. `modal image` cannot fetch build logs, so
+ * the recent logs of Harbor's Modal app are fetched and filtered around the image id. When that
+ * fails the report says so instead of carrying only the bare id.
+ */
+export async function modalBuildLogTail(message, run = defaultRunner) {
+    const imageId = extractModalImageId(message);
+    if (!imageId) {
+        return undefined;
+    }
+    let result;
+    try {
+        result = await run("modal", ["app", "logs", HARBOR_MODAL_APP, "--tail", String(LOG_ENTRIES)]);
+    }
+    catch (error) {
+        return unavailable(imageId, error instanceof Error ? error.message : String(error));
+    }
+    if (result.exitCode !== 0) {
+        return unavailable(imageId, result.stderr.trim() || `modal exited ${result.exitCode}`);
+    }
+    const lines = result.stdout.split("\n");
+    const around = lines.filter((line) => line.includes(imageId));
+    const selected = (around.length > 0 ? lines.slice(Math.max(0, lines.indexOf(around[0] ?? "") - 5)) : lines)
+        .join("\n")
+        .trim();
+    if (!selected) {
+        return unavailable(imageId, `no recent log entries in Modal app ${HARBOR_MODAL_APP}`);
+    }
+    return `Modal build log for ${imageId} (tail of \`modal app logs ${HARBOR_MODAL_APP}\`):\n${tail(selected)}`;
+}
+function unavailable(imageId, reason) {
+    return `Modal build log for ${imageId} could not be fetched (${tail(reason, 300)}); open the image in the Modal dashboard for the full build output.`;
+}
+function tail(value, maxBytes = LOG_TAIL_BYTES) {
+    const buffer = Buffer.from(value);
+    return buffer.length <= maxBytes
+        ? value
+        : `[truncated ${buffer.length - maxBytes} bytes]\n${buffer.subarray(-maxBytes).toString("utf8")}`;
+}
+async function defaultRunner(command, args) {
+    return await runCommand(command, args, {
+        allowFailure: true,
+        env: harborChildEnvironment(executionEnvironment()),
+        timeoutMs: 60_000,
+    });
+}
+//# sourceMappingURL=modal-build-log.js.map

package/dist/temporal/activities/modal-build-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modal-build-log.js","sourceRoot":"","sources":["../../../src/temporal/activities/modal-build-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAsB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAC7C,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,WAAW,GAAG,GAAG,CAAC;AAOxB,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,MAAqB,aAAa;IAElC,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,gBAAgB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,CACf,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CACzF;SACE,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,OAAO,EAAE,sCAAsC,gBAAgB,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,uBAAuB,OAAO,8BAA8B,gBAAgB,SAAS,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,OAAO,uBAAuB,OAAO,0BAA0B,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,qEAAqE,CAAC;AACxJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,QAAQ,GAAG,cAAc;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,IAAI,QAAQ;QAC9B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,cAAc,MAAM,CAAC,MAAM,GAAG,QAAQ,YAAY,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,IAAuB;IAEvB,OAAO,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE;QACrC,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,sBAAsB,CAAC,oBAAoB,EAAE,CAAC;QACnD,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC"}

package/dist/temporal/activities/prompts-authoring.d.ts

@@ -0,0 +1,6 @@
+import { type Candidate, type RunRequest } from "../../contracts.js";
+/** Round 1 prompt: the complete Harbor task (definition, environment contract, patches). */
+export declare function authoringPrompt(run: RunRequest, candidate: Candidate, feedback?: string): string;
+/** Prompt appended as the next user turn when an authoring session is resumed. */
+export declare function authoringResumePrompt(round: number, renderedReport: string, feedback?: string): string;
+//# sourceMappingURL=prompts-authoring.d.ts.map

package/dist/temporal/activities/prompts-authoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts-authoring.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/prompts-authoring.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAE5B,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA6EhG;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAYR"}

package/dist/temporal/activities/prompts-authoring.js

@@ -0,0 +1,87 @@
+import { AUTHOR_VERIFY_BUDGET, MAX_AUTHORING_ROUNDS, } from "../../contracts.js";
+/** Round 1 prompt: the complete Harbor task (definition, environment contract, patches). */
+export function authoringPrompt(run, candidate, feedback) {
+    return `Author exactly one SelfBench task for this assigned candidate. The initial ${candidate.difficulty} difficulty is only a heuristic; choose a lower tier when the actual implementation is smaller:
+
+${JSON.stringify({
+        sourcePr: candidate.sourcePr,
+        sourceUrl: candidate.sourceUrl,
+        baseCommit: candidate.baseCommit,
+        completedCommit: candidate.completedCommit,
+        request: candidate.request,
+    }, null, 2)}
+
+Use only this candidate. Do not discover alternatives and do not run Harbor. Read /work/provenance.json only to verify the supplied authentic request. Inspect the base and completed commits. Split the completed change into a non-test gold patch and a held-out test patch. Use the highest honest tier supported by the implementation and tests. Do not pad the change to reach a tier threshold. The initial estimate is ${candidate.difficulty}; downgrading it is expected when appropriate.${feedback
+        ? `
+
+# Read-only verifier suggestions
+
+${feedback}
+
+Address these suggestions in the deliverable, but do not add behavior beyond the authentic request.`
+        : ""}}
+
+# Test reuse and evidence
+
+Keep ownership of tests and the complete setup in this session; do not create a separate environment stage. First inspect tests added/changed by the PR and existing regression coverage. Reuse suitable public-behavior assertions; author only missing coverage. Record definition.testSelection with mode (reused, augmented, authored, or base-only), reused/added/excluded arrays identifying tests and reasons, and coverage explaining how tests cover the request. Existing tests still require fairness review. Do not invent test edits merely to produce a patch. For base-only mode, test.patch must be an empty file, reused must be nonempty and added empty; base tests remain visible to the solver.
+
+When the runner supports JUnit XML, use definition.testResults = {format: "junit", failToPass: ["classname::name"], passToPass: [...]}. These are exact XML testcase identities, separate from command selectors. Configure testCommand to write a fresh report to "$SELFBENCH_JUNIT_REPORT" on every invocation, including failures, and install python3 in rootSetupCommand. JUnit mode requires every declared target to assertion-fail on the base and pass with the reference; skipped, missing, duplicate and errored results fail closed. If a missing public API makes collection fail, prefer a public-boundary assertion or explicitly retain command-level mode and explain the limitation in coverage. Never rewrite a runner failure into a fake passing report.
+
+# Held-out tests
+
+Held-out tests must verify public behavior through an existing API, command, persistence boundary, or extension seam. When the request is about an endpoint/provider contract, exercise that boundary instead of manually composing internal translators, context/option builders, or model factories. Do not import gold-specific private helpers/modules or assert exact internal SQL, query counts, schema/index names, object identity, telemetry layout, error wording, endpoint/response shapes, or UI copy/order unless the authentic request explicitly makes that artifact public. Assert requested semantic values rather than larger retained/raw payloads that happen to contain them, and preserve valid adjacent input content unless the request says to discard it. Cover every material behavior in the prompt, including central authorization, error, and UI states. A different correct implementation with different helpers, file boundaries, API presentation, and UI composition must be able to pass; reject the candidate when no stable public seam exists.
+
+# Environment contract
+
+Your submission carries the complete environment contract; there is no separate environment agent. Work only at the currently checked-out pinned base commit. Inspect the test paths and test command, then identify the closest repository-native CI job that runs them. Inspect relevant .github/workflows files, Dockerfiles, devcontainers, lockfiles, version files, package scripts, Makefiles, and compose files. Prefer an image already used by CI or the repository, followed by a devcontainer, then an explicit translation of CI setup. Do not infer from the latest remote branch.
+
+The environment contract must be complete:
+- baseImage must be a Linux image pinned with @sha256; use skopeo inspect docker://IMAGE to resolve registry digests rather than inventing one;
+- rootSetupCommand runs as root under /bin/sh and must install the exact repository runtimes, package managers, native dependencies, and SelfBench substrate required by the chosen base image: bash, git, procps/pkill, runuser, tar, and useradd;
+- setupCommand runs from the task workdir under bash and must perform the frozen dependency install plus required builds, code generation, fixtures, browser installation, or other CI setup;
+- smokeCommand runs at runtime from the task workdir as the verifier user (HOME=/home/verifier) and must cheaply prove the runtime and service contract without depending on the hidden gold patch or new held-out tests. It must print what it checks; a silent failure returns nothing you can act on;
+- environmentVariables must contain only non-secret literal values needed by tests. A secret-named variable (TOKEN, SECRET, API_KEY, PASSWORD, ...) is accepted only with a fixed placeholder literal such as "test" or "selfbench-local-secret"; values shaped like real key material or interpolating host variables are rejected;
+- services must represent only services needed by the focused tests, use registry digests resolved with skopeo, provide health checks, and contain no external secrets; local throwaway service passwords are allowed only inside the service definition;
+- evidence must cite repository-relative files that exist at this exact commit and explain what each established.
+
+Never copy CI secrets, deployment steps, caches, artifact uploads, hosted runner credentials, or mutable image tags. Do not use Docker-in-Docker. Do not add fallback dependencies merely because a language ecosystem might need them: every runtime and system package must be justified by the selected CI/test path. If repository evidence is incomplete, use source "generated" but still cite the nearest manifests and scripts.
+
+Use bash/read/grep/find to inspect and, when feasible, execute exploratory setup or focused smoke commands in this sandbox. These exploratory checks are evidence for reasoning only; the worker's compile, audit, build, smoke, nop, and oracle gates are authoritative.
+
+# Deliverable
+
+Your deliverable is the directory /work/task/ with exactly four files, written with read/write/bash and git diff:
+- definition.json: the task definition (schemaVersion 2, difficulty matching the honest tier) including the environment contract; omit prompt or keep it identical to instruction.md;
+- instruction.md: the standalone instruction the evaluated agent reads (it is authoritative for the prompt);
+- test.patch: the held-out test patch (a Git patch starting with diff --git, LF line endings, final newline; produce it with git diff);
+- gold.patch: the non-test reference implementation patch, same format.
+Except for an explicitly empty base-only test.patch, both patches must apply cleanly to the base commit with git apply, and gold.patch must also apply on top of test.patch (the oracle order); verify proves this against a clean worktree before anything is built.
+The verify and submit_task tools take no arguments; they read /work/task/ and report missing or malformed files as static-check errors naming the file. The trusted compiler renders task.toml, both Dockerfiles, the scripts, and the repository snapshot; never write those yourself.
+
+# Submission and rounds
+
+Call submit_task exactly once per round, normally after verify is green. If no verify calls remain, still submit your best deliverable: the worker verifies it itself, and a red result starts the next round with the report instead of ending the task. Never end a round without submitting when /work/task/ holds a deliverable you believe is correct. definition.json must use schemaVersion 2 and its honest difficulty tier. testCommand must contain the literal {tests} exactly once as an unquoted shell argument list, and every selected test path must be supplied only through that placeholder—never quote the whole placeholder, assign it to one scalar, or hard-code a fail-to-pass or pass-to-pass path elsewhere in the command. Use one repository-native test mode and bundler per command rather than chaining equivalent suites or bypassing repository wrappers with a generic runner. The prompt must not mention the PR, commits, patches, test names, or implementation. Inspect repository test scripts and CI only to select the correct test command. Do not move dependency installation, native builds, fixture generation, or browser installation into testCommand; the environment contract owns those.
+
+When the change spans a backend contract and a frontend, the held-out tests must exercise the backend contract through its public boundary (API responses, computed fields, validation, query behaviour); frontend tests that mock that API prove nothing about the change and the verification agent rejects them. Pick frontend-only tests only for changes that are genuinely frontend-only.
+
+Before submission, verify from repository scripts and the pinned diff that the selected test identifiers belong to one repository-native test command and form the required nop/oracle split: on the base snapshot plus held-out tests, failToPass must fail while passToPass succeeds; with the gold patch applied, both must pass deterministically. Do not invent a test command when no stable test seam exists. Default resources are 4 CPU, 8192 MB memory, 20480 MB storage; default timeouts are 900 setup, 2400 agent, 900 tests.
+
+# Verify before you submit
+
+Write the deliverable to /work/task/, then call verify (no arguments) before you submit. It runs the static check, then the worker renders task.toml, both Dockerfiles, and the scripts from your contract, audits the patches, builds the image, and runs smoke, nop, and oracle exactly as the harness does, and returns the report (this can take up to an hour; wait for it). Fix the red gates and call verify again; you have ${AUTHOR_VERIFY_BUDGET} verify calls in this session and each result states how many remain. The gate-to-field mapping in the skill tells you which field a red gate points at. Call submit_task (no arguments) once verify is green, with the deliverable files unchanged since that verify so the worker can reuse the report. When the budget is exhausted before a green report, submit anyway rather than explaining; the worker's own verification decides, and a failing submission continues into the next round with the report. The only reason not to submit is a failure you cannot fix within the rules (for example no stable test seam exists); then explain why in your final message. If verify itself errors on the worker, the call is not charged; retry it. If your sandbox dies mid-session you may be resumed in a fresh sandbox with the last report (at most ${MAX_AUTHORING_ROUNDS} rounds in total). Do not return prose after a tool call.
+
+Pinned SelfBench version: ${run.version.selfbenchCommit}.`;
+}
+/** Prompt appended as the next user turn when an authoring session is resumed. */
+export function authoringResumePrompt(round, renderedReport, feedback) {
+    return `Round ${round} of ${MAX_AUTHORING_ROUNDS}. ${feedback ? "The read-only reviewer requested revisions. Address its suggestions below; the mechanical report describes the latest tested draft, not necessarily a failed check." : "Your previous submission did not pass mechanical verification. Address the failures in the report."} This is a fresh sandbox: the repository was re-cloned at the pinned base commit, your earlier working-tree edits are gone, and only this conversation carries over. Read the report, rewrite the deliverable in /work/task/ (definition.json with the environment contract, instruction.md, test.patch, gold.patch), call verify until it is green (the result states how many verify calls remain), then call submit_task exactly once. Every rule from the original brief still applies; do not weaken tests or move setup into the test command merely to turn a gate green. If the failure cannot be fixed within those rules, do not submit and explain why in your final message.
+
+${renderedReport.trim()}${feedback
+        ? `
+
+# Read-only verifier suggestions
+
+${feedback}`
+        : ""}`;
+}
+//# sourceMappingURL=prompts-authoring.js.map

package/dist/temporal/activities/prompts-authoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts-authoring.js","sourceRoot":"","sources":["../../../src/temporal/activities/prompts-authoring.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAE5B,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,SAAoB,EAAE,QAAiB;IACtF,OAAO,8EAA8E,SAAS,CAAC,UAAU;;EAEzG,IAAI,CAAC,SAAS,CACd;QACE,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,OAAO,EAAE,SAAS,CAAC,OAAO;KAC3B,EACD,IAAI,EACJ,CAAC,CACF;;kaAEia,SAAS,CAAC,UAAU,iDAClb,QAAQ;QACN,CAAC,CAAC;;;;EAIN,QAAQ;;oGAE0F;QAC9F,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;saAiDoa,oBAAoB,k0BAAk0B,oBAAoB;;4BAEpvC,GAAG,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,cAAsB,EACtB,QAAiB;IAEjB,OAAO,SAAS,KAAK,OAAO,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,qKAAqK,CAAC,CAAC,CAAC,oGAAoG;;EAE5U,cAAc,CAAC,IAAI,EAAE,GACrB,QAAQ;QACN,CAAC,CAAC;;;;EAIJ,QAAQ,EAAE;QACR,CAAC,CAAC,EACN,EAAE,CAAC;AACH,CAAC"}

package/dist/temporal/activities/prompts-verifier.d.ts

@@ -0,0 +1,17 @@
+import type { TaskDefinition, TaskEnvironment } from "../../contracts.js";
+import type { CouplingEvidence } from "../../coupling.js";
+export interface VerifierPromptInput {
+    readonly taskId: string;
+    readonly testSelection?: TaskDefinition["testSelection"];
+    readonly testResults?: TaskDefinition["testResults"];
+    readonly instruction: string;
+    readonly renderedReport: string;
+    readonly couplingEvidence: CouplingEvidence;
+    readonly environment: TaskEnvironment;
+    readonly testPatch: string;
+    readonly goldPatch: string;
+    readonly heldOutPaths: readonly string[];
+}
+/** Round 1 prompt for the independent verification agent. */
+export declare function verifierPrompt(input: VerifierPromptInput): string;
+//# sourceMappingURL=prompts-verifier.d.ts.map

package/dist/temporal/activities/prompts-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts-verifier.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/prompts-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CA+DjE"}

package/dist/temporal/activities/prompts-verifier.js

@@ -0,0 +1,66 @@
+/** Round 1 prompt for the independent verification agent. */
+export function verifierPrompt(input) {
+    return `You are the independent SelfBench verification agent for task ${input.taskId}. You have not seen the authoring conversation. Judge whether this Harbor task is a fair, self-contained benchmark and either accept it or submit suggestions for the next authoring agent.
+
+# Workspace
+
+- /work/task/harbor-task is the compiled task: instruction.md, task.toml, environment/ (Dockerfile, root-setup.sh, setup.sh, smoke.sh, repo.tar.gz), tests/ (Dockerfile, test.patch, test.sh), solution/gold.patch. Read these rendered files; never edit them.
+- /work/repo is the exact base snapshot with the held-out test patch applied as a Git working tree (HEAD is the base). It is read-only; do not edit it.
+- The verification report, deterministic coupling evidence, environment contract, and both patches are below.
+
+# Judge
+
+Read definition.json for testSelection and testResults. Assess reused tests as critically as authored tests; base-only tests are visible to the solver. Check the selection record against the test files and request, including omitted coverage. Command-level results do not establish individual test transitions. JUnit mode fails closed on collection/runtime errors. Repeatability is two target runs in one environment, not clean-run determinism. Review reference dependency preinstallation and ensure setup does not implement the solution.
+
+1. Instruction: it must preserve the human request without adding behavior inferred only from the implementation or tests, and must not leak PRs, commits, test names, or the solution.
+2. Public behavior: held-out tests must exercise an existing public API, command, persistence boundary, or extension seam. They may not import gold-specific private helpers or prescribe exact internal SQL, query counts, private schemas, object identity, telemetry layout, incidental error wording, endpoint/response shapes, or UI copy/order unless the request explicitly makes that artifact public. A coherent implementation with different names, file boundaries, payload presentation, or internal structure must pass.
+3. Coupling: for every exact endpoint path, response/request field, header, media type, helper/module, error string, schema/index name, UI copy/order, or other implementation artifact asserted by the held-out tests, cite either the authentic request text that requires it or deterministic evidence that the base repository already establishes it. A name merely appearing in the gold patch is not evidence. Resolve every artifact in couplingEvidence.blockers with a finding whose artifact exactly matches it. Use external_contract only when the request names a standard protocol that fixes the exact artifact independently of the gold patch, and cite that protocol. Use not_contract only for incidental test-language or framework syntax that is not an asserted product contract. Acceptance with a missing blocker finding is rejected automatically.
+4. Environment: the contract must be deterministic and reproducible: digest-pinned images, frozen dependency installs, a smoke command that proves the runtime without the gold patch, no secrets, no host interpolation, no Docker-in-Docker, services only when the focused tests need them, and evidence that exists at the pinned commit.
+5. Mechanical gates: accept only when the report is GREEN. The nop split must fail every fail-to-pass test on the base and pass every pass-to-pass test; the oracle must pass both deterministically.
+
+# Decide
+
+- accept_task: the task is fair and the report is GREEN. Findings must resolve every blocker; the counterexample must describe a plausible alternative correct implementation and whether the tests accept it.
+- submit_suggestions: the task needs changes, but you may not edit anything. Submit a concise summary and actionable suggestions for the next authoring agent. Do not prescribe private implementation details; identify fairness, public-seam, coupling, environment, or test issues.
+- reject_task: the task cannot be made fair within the authoring workflow; explain the blocker.
+
+The verifier has no bash, edit, write, or verify tools. It must not modify the task, tests, definition, patches, or repository.
+
+Use read, grep, find, and ls to inspect the existing test evidence; inspect solution/gold.patch only to understand the intended behavior and available seams, never to copy its private structure into assertions. Do not return prose after a tool call.
+
+# Selection and evidence contract
+
+${JSON.stringify({ testSelection: input.testSelection ?? null, testResults: input.testResults ?? "command-level", protectedTestPaths: input.heldOutPaths }, null, 2)}
+
+# Authentic request (instruction.md)
+
+${input.instruction.trim()}
+
+# Verification report
+
+${input.renderedReport.trim()}
+
+# Deterministic coupling evidence
+
+The exact-artifact scan compared the held-out tests with the authentic request, gold additions, and exact base snapshot. Every blocker is asserted by tests and introduced by gold, but absent verbatim from both request and base.
+
+${JSON.stringify(input.couplingEvidence, null, 2)}
+
+# Environment contract
+
+${JSON.stringify(input.environment, null, 2)}
+
+# Held-out test patch
+
+\`\`\`diff
+${input.testPatch}
+\`\`\`
+
+# Gold implementation patch
+
+\`\`\`diff
+${input.goldPatch}
+\`\`\`
+`;
+}
+//# sourceMappingURL=prompts-verifier.js.map

package/dist/temporal/activities/prompts-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts-verifier.js","sourceRoot":"","sources":["../../../src/temporal/activities/prompts-verifier.ts"],"names":[],"mappings":"AAgBA,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,OAAO,iEAAiE,KAAK,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8BpF,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,eAAe,EAAE,kBAAkB,EAAE,KAAK,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;;;;EAIlK,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;;;;EAIxB,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE;;;;;;EAM3B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;;;;EAI/C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;;;;;EAK1C,KAAK,CAAC,SAAS;;;;;;EAMf,KAAK,CAAC,SAAS;;CAEhB,CAAC;AACF,CAAC"}

package/dist/temporal/activities/provenance.d.ts

@@ -0,0 +1,4 @@
+import type { ArtifactStore } from "../../artifacts.js";
+import type { ArtifactRef, RunRequest } from "../../contracts.js";
+export declare function collectRunProvenance(store: ArtifactStore, run: RunRequest): Promise<ArtifactRef>;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/temporal/activities/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/provenance.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlE,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,WAAW,CAAC,CAqBtB"}

package/dist/temporal/activities/provenance.js

@@ -0,0 +1,18 @@
+import { Context } from "@temporalio/activity";
+import { ApplicationFailure } from "@temporalio/common";
+import { collectGitHubPullRequestProvenance, combineRunProvenance } from "../../provenance.js";
+import { githubToken } from "../../subscription-auth.js";
+import { parseProvenance, withActivityHeartbeats } from "./runtime.js";
+export async function collectRunProvenance(store, run) {
+    return await withActivityHeartbeats("collecting merged GitHub pull requests", async ({ signal }) => {
+        const [localBytes, token] = await Promise.all([store.get(run.provenance), githubToken()]);
+        const local = parseProvenance(localBytes);
+        const github = await collectGitHubPullRequestProvenance(run.repository.url, token, signal);
+        const messages = combineRunProvenance(run.repository.url, local, github);
+        if (messages.length === 0) {
+            throw ApplicationFailure.nonRetryable("no sanitized local-session or GitHub pull-request provenance was found", "NoProvenance");
+        }
+        return await store.put(`runs/${run.runId}/input/combined-provenance-attempt-${Context.current().info.attempt}.jsonl`, Buffer.from(`${messages.map((message) => JSON.stringify(message)).join("\n")}\n`), "application/x-ndjson");
+    });
+}
+//# sourceMappingURL=provenance.js.map