self-bench 0.3.6 → 0.3.8

package/dist/site/temporal-status.js

@@ -0,0 +1,41 @@
+import { candidateStatusQuery, selfBenchCandidateWorkflow } from "../temporal/workflow.js";
+const QUERY_TIMEOUT_MS = 5_000;
+/** Starts candidate workflows top-level on the configured task queue. */
+export function temporalStarter(client, taskQueue) {
+    return async (workflowId, input) => {
+        await client.workflow.start(selfBenchCandidateWorkflow, {
+            workflowId,
+            taskQueue,
+            args: [input],
+            workflowExecutionTimeout: "3 days",
+        });
+    };
+}
+/** Reads a candidate workflow's state: describe, then the status query while it runs. */
+export function temporalStatus(client) {
+    return {
+        async snapshot(workflowId) {
+            const handle = client.workflow.getHandle(workflowId);
+            const description = await handle.describe();
+            const status = description.status.name;
+            if (status === "RUNNING") {
+                const progress = await Promise.race([
+                    handle.query(candidateStatusQuery),
+                    new Promise((resolve) => setTimeout(() => resolve(undefined), QUERY_TIMEOUT_MS)),
+                ]).catch(() => undefined);
+                return { kind: "running", ...(progress ? { progress } : {}) };
+            }
+            if (status === "COMPLETED") {
+                const result = (await handle.result());
+                return { kind: "completed", result };
+            }
+            if (status === "FAILED" || status === "TIMED_OUT" || status === "TERMINATED") {
+                return { kind: "failed", status };
+            }
+            if (status === "CANCELLED")
+                return { kind: "failed", status };
+            return { kind: "unknown" };
+        },
+    };
+}
+//# sourceMappingURL=temporal-status.js.map

package/dist/site/temporal-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"temporal-status.js","sourceRoot":"","sources":["../../src/site/temporal-status.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAI3F,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,SAAiB;IAC/D,OAAO,KAAK,EAAE,UAAkB,EAAE,KAA6B,EAAE,EAAE;QACjE,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,0BAA0B,EAAE;YACtD,UAAU;YACV,SAAS;YACT,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,wBAAwB,EAAE,QAAQ;SACnC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,UAAU;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBAClC,MAAM,CAAC,KAAK,CAAe,oBAAoB,CAAC;oBAChD,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE,CACjC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CACvD;iBACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAA4B,CAAC;gBAClE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;YACvC,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACpC,CAAC;YACD,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/site/tenant.d.ts

@@ -0,0 +1,4 @@
+import type { Org, User, UserStore } from "../auth/users.js";
+/** The tenant a signed-in user asked for, if they belong to it (login compared case-insensitively). */
+export declare function tenantFor(users: UserStore, user: User, login: string): Promise<Org | undefined>;
+//# sourceMappingURL=tenant.d.ts.map

package/dist/site/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/site/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7D,uGAAuG;AACvG,wBAAsB,SAAS,CAC7B,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAG1B"}

package/dist/site/tenant.js

@@ -0,0 +1,6 @@
+/** The tenant a signed-in user asked for, if they belong to it (login compared case-insensitively). */
+export async function tenantFor(users, user, login) {
+    const wanted = login.toLowerCase();
+    return (await users.orgsFor(user.id)).find((org) => org.login.toLowerCase() === wanted);
+}
+//# sourceMappingURL=tenant.js.map

package/dist/site/tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/site/tenant.ts"],"names":[],"mappings":"AAEA,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAgB,EAChB,IAAU,EACV,KAAa;IAEb,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AAC1F,CAAC"}

package/dist/static-check.d.ts

@@ -0,0 +1,38 @@
+import { type TaskDefinition } from "./contracts.js";
+export type StaticCheckGate = "schema" | "policy" | "paths" | "patches" | "patch" | "audit" | "render" | "fix";
+export interface StaticCheckError {
+    readonly gate: StaticCheckGate;
+    readonly message: string;
+}
+/** Relative path → contents of every text file the compiler renders from a submission. */
+export type RenderedTaskFiles = Readonly<Record<string, string>>;
+export interface StaticCheckResult {
+    readonly ok: boolean;
+    readonly errors: readonly StaticCheckError[];
+    readonly rendered?: RenderedTaskFiles;
+}
+export interface StaticCheckInput {
+    readonly definitionJson: string;
+    readonly testPatch: string;
+    readonly goldPatch: string;
+    /** When present, the submission is a verifier fix and must stay within the fix boundary. */
+    readonly original?: {
+        readonly definitionJson: string;
+        readonly testPatch: string;
+        readonly goldPatch: string;
+    };
+}
+/**
+ * Every check that needs no Docker, run inside the sandbox at submit time so the agent fixes
+ * schema, policy, path, audit, and rendering problems in the same session. The worker repeats
+ * these checks; only real build, smoke, nop, and oracle failures cost a round.
+ */
+export declare function staticCheckSubmission(input: StaticCheckInput): StaticCheckResult;
+/**
+ * Dry render of the Harbor tree (everything except the repository snapshot and the held-out
+ * patch copies), mirroring src/harbor-task/compiler.ts so the agent can inspect what will be built.
+ */
+export declare function renderTaskFiles(definition: TaskDefinition, goldPatch: string, testPatch?: string): RenderedTaskFiles;
+/** Human-readable summary for a tool result. */
+export declare function formatStaticCheckErrors(errors: readonly StaticCheckError[]): string;
+//# sourceMappingURL=static-check.d.ts.map

package/dist/static-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-check.d.ts","sourceRoot":"","sources":["../src/static-check.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,gBAAgB,CAAC;AAmB3E,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,OAAO,GACP,QAAQ,GACR,KAAK,CAAC;AAEV,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CA2ChF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,EACjB,SAAS,SAAK,GACb,iBAAiB,CAuBnB;AAUD,gDAAgD;AAChD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAEnF"}

package/dist/static-check.js

@@ -0,0 +1,131 @@
+import { auditTaskDefinition } from "./audit.js";
+import { taskDefinitionSchema } from "./contracts.js";
+import { assertEnvironmentPolicy } from "./environment.js";
+import { dependencyManifestPatch } from "./harbor-task/dependencies.js";
+import { assertSafePatchPaths, assertSafeTaskPaths } from "./harbor-task/paths.js";
+import { agentDockerfile, bashScript, posixShellScript, serviceComposeYaml, smokeScript, taskToml, verifierDockerfile, } from "./harbor-task/render.js";
+import { verifierRuntimeFiles } from "./harbor-task/runtime-assets.js";
+import { isBaseOnlyTestPatch } from "./harbor-task/test-patch.js";
+import { solutionScript, testScript } from "./harbor-task/verifier.js";
+import { malformedPatchProblems } from "./patch-check.js";
+import { assertVerifierFix } from "./verifier-fix.js";
+/**
+ * Every check that needs no Docker, run inside the sandbox at submit time so the agent fixes
+ * schema, policy, path, audit, and rendering problems in the same session. The worker repeats
+ * these checks; only real build, smoke, nop, and oracle failures cost a round.
+ */
+export function staticCheckSubmission(input) {
+    const errors = [];
+    const definition = parseDefinition(input.definitionJson, errors);
+    if (!definition) {
+        return { ok: false, errors };
+    }
+    guard(errors, "policy", () => assertEnvironmentPolicy(definition.environment));
+    guard(errors, "paths", () => assertSafeTaskPaths(definition));
+    for (const [patch, label] of [
+        [input.testPatch, "test patch"],
+        [input.goldPatch, "gold patch"],
+    ]) {
+        if (label === "test patch" && isBaseOnlyTestPatch(definition, patch))
+            continue;
+        const problems = malformedPatchProblems(patch, label);
+        errors.push(...problems.map((message) => ({ gate: "patches", message })));
+        if (problems.length === 0) {
+            guard(errors, "paths", () => assertSafePatchPaths(patch, label));
+        }
+    }
+    if (errors.length === 0) {
+        const audit = auditTaskDefinition(definition, input.goldPatch, input.testPatch);
+        errors.push(...audit.blockers.map((message) => ({ gate: "audit", message })));
+    }
+    if (input.original) {
+        guard(errors, "fix", () => {
+            const original = taskDefinitionSchema.parse(JSON.parse(input.original?.definitionJson ?? ""));
+            assertVerifierFix({
+                original,
+                fixed: definition,
+                originalTestPatch: input.original?.testPatch ?? "",
+                fixedTestPatch: input.testPatch,
+                originalGoldPatch: input.original?.goldPatch ?? "",
+                fixedGoldPatch: input.goldPatch,
+            });
+        });
+    }
+    let rendered;
+    if (!errors.some((error) => error.gate === "patches")) {
+        guard(errors, "render", () => {
+            rendered = renderTaskFiles(definition, input.goldPatch, input.testPatch);
+        });
+    }
+    return { ok: errors.length === 0, errors, ...(rendered ? { rendered } : {}) };
+}
+/**
+ * Dry render of the Harbor tree (everything except the repository snapshot and the held-out
+ * patch copies), mirroring src/harbor-task/compiler.ts so the agent can inspect what will be built.
+ */
+export function renderTaskFiles(definition, goldPatch, testPatch = "") {
+    const dependencySetupPatch = dependencyManifestPatch(goldPatch);
+    const preinstallGoldDependencies = dependencySetupPatch.length > 0;
+    const verifierScript = testScript(definition, testPatch);
+    return {
+        "task.toml": taskToml(definition),
+        "instruction.md": `${definition.prompt.trim()}\n`,
+        "definition.json": `${JSON.stringify(definition, null, 2)}\n`,
+        "environment/Dockerfile": agentDockerfile(definition),
+        ...environmentScripts("environment", definition),
+        ...Object.fromEntries(Object.entries(verifierRuntimeFiles()).map(([path, content]) => [`tests/${path}`, content])),
+        "tests/Dockerfile": verifierDockerfile(definition, dependencySetupPatch),
+        "tests/test.sh": verifierScript,
+        "tests/task-test.sh": verifierScript,
+        ...environmentScripts("tests", definition),
+        ...(definition.environment.services.length > 0
+            ? { "tests/docker-compose.yaml": serviceComposeYaml(definition) }
+            : {}),
+        ...(preinstallGoldDependencies ? { "tests/dependency-setup.patch": dependencySetupPatch } : {}),
+        "solution/solve.sh": solutionScript(),
+    };
+}
+function environmentScripts(directory, definition) {
+    return {
+        [`${directory}/root-setup.sh`]: posixShellScript(definition.environment.rootSetupCommand),
+        [`${directory}/setup.sh`]: bashScript(definition.environment.setupCommand),
+        [`${directory}/smoke.sh`]: smokeScript(definition),
+    };
+}
+/** Human-readable summary for a tool result. */
+export function formatStaticCheckErrors(errors) {
+    return errors.map((error) => `- [${error.gate}] ${error.message}`).join("\n");
+}
+function parseDefinition(json, errors) {
+    let raw;
+    try {
+        raw = JSON.parse(json);
+    }
+    catch (error) {
+        errors.push({ gate: "schema", message: `definition is not valid JSON: ${messageOf(error)}` });
+        return undefined;
+    }
+    const parsed = taskDefinitionSchema.safeParse(raw);
+    if (!parsed.success) {
+        for (const issue of parsed.error.issues) {
+            errors.push({
+                gate: "schema",
+                message: `${issue.path.join(".") || "(root)"}: ${issue.message}`,
+            });
+        }
+        return undefined;
+    }
+    return parsed.data;
+}
+function guard(errors, gate, action) {
+    try {
+        action();
+    }
+    catch (error) {
+        errors.push({ gate, message: messageOf(error) });
+    }
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=static-check.js.map

package/dist/static-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-check.js","sourceRoot":"","sources":["../src/static-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAuB,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EACL,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,QAAQ,EACR,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAsCtD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAuB;IAC3D,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IACD,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC;QAC/B,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC;KACvB,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,YAAY,IAAI,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,SAAS;QAC/E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;YACxB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9F,iBAAiB,CAAC;gBAChB,QAAQ;gBACR,KAAK,EAAE,UAAU;gBACjB,iBAAiB,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE;gBAClD,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,iBAAiB,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE;gBAClD,cAAc,EAAE,KAAK,CAAC,SAAS;aAChC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAuC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE;YAC3B,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA0B,EAC1B,SAAiB,EACjB,SAAS,GAAG,EAAE;IAEd,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACzD,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC;QACjC,gBAAgB,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI;QACjD,iBAAiB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC7D,wBAAwB,EAAE,eAAe,CAAC,UAAU,CAAC;QACrD,GAAG,kBAAkB,CAAC,aAAa,EAAE,UAAU,CAAC;QAChD,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAC5F;QACD,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,EAAE,oBAAoB,CAAC;QACxE,eAAe,EAAE,cAAc;QAC/B,oBAAoB,EAAE,cAAc;QACpC,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC;QAC1C,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC5C,CAAC,CAAC,EAAE,2BAA2B,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,mBAAmB,EAAE,cAAc,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,UAA0B;IACvE,OAAO;QACL,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC;QACzF,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC;QAC1E,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,uBAAuB,CAAC,MAAmC;IACzE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAA0B;IAC/D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iCAAiC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,KAAK,CAAC,MAA0B,EAAE,IAAqB,EAAE,MAAkB;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/submission-hash.d.ts

@@ -0,0 +1,18 @@
+export interface SubmissionPayload {
+    /** The definition as an object or its JSON text; hashed in compact canonical-order form. */
+    readonly definition: unknown;
+    readonly testPatch: string;
+    readonly goldPatch: string;
+}
+/**
+ * Identity of a submission for matching an in-session `verify` against the final `submit_task`
+ * or `submit_fix` payload. The sandbox extension computes the same value over the same fields.
+ */
+export declare function submissionHash(payload: SubmissionPayload): string;
+export interface VerifyRecord {
+    readonly hash: string;
+    readonly green: boolean;
+}
+/** The last green in-session verify whose payload equals the submitted one, if any. */
+export declare function matchingGreenVerify<T extends VerifyRecord>(submission: string, verifies: readonly T[]): T | undefined;
+//# sourceMappingURL=submission-hash.d.ts.map

package/dist/submission-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-hash.d.ts","sourceRoot":"","sources":["../src/submission-hash.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAMjE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,YAAY,EACxD,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,SAAS,CAAC,EAAE,GACrB,CAAC,GAAG,SAAS,CAEf"}

package/dist/submission-hash.js

@@ -0,0 +1,16 @@
+import { sha256 } from "./hash.js";
+/**
+ * Identity of a submission for matching an in-session `verify` against the final `submit_task`
+ * or `submit_fix` payload. The sandbox extension computes the same value over the same fields.
+ */
+export function submissionHash(payload) {
+    const definition = typeof payload.definition === "string"
+        ? JSON.stringify(JSON.parse(payload.definition))
+        : JSON.stringify(payload.definition);
+    return sha256(`${definition}\0${payload.testPatch}\0${payload.goldPatch}`);
+}
+/** The last green in-session verify whose payload equals the submitted one, if any. */
+export function matchingGreenVerify(submission, verifies) {
+    return [...verifies].reverse().find((record) => record.green && record.hash === submission);
+}
+//# sourceMappingURL=submission-hash.js.map

package/dist/submission-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-hash.js","sourceRoot":"","sources":["../src/submission-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AASnC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAA0B;IACvD,MAAM,UAAU,GACd,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;QACpC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;AAC7E,CAAC;AAOD,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,QAAsB;IAEtB,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;AAC9F,CAAC"}

package/dist/subscription-auth.d.ts

@@ -3,15 +3,8 @@ export interface PiModelAuth {
     readonly apiKey?: string;
     readonly authJson?: string;
 }
-export interface CodexModelAuth {
-    readonly apiKey?: string;
-    readonly authJson?: string;
-}
 export declare function openAiApiKey(): string | undefined;
 export declare function loadPiModelAuth(): Promise<PiModelAuth>;
-export declare function loadCodexModelAuth(): Promise<CodexModelAuth>;
 export declare function loadPiSubscriptionAuth(): Promise<string>;
-export declare function assertCodexSubscriptionAuth(value: unknown, source?: string): void;
-export declare function loadCodexSubscriptionAuth(): Promise<string>;
 export declare function githubToken(): Promise<string | undefined>;
 //# sourceMappingURL=subscription-auth.d.ts.map

package/dist/subscription-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-auth.d.ts","sourceRoot":"","sources":["../src/subscription-auth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAGjD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC,CAK5D;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAe9D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,SAAe,GAAG,IAAI,CAIvF;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAWjE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM/D"}
+{"version":3,"file":"subscription-auth.d.ts","sourceRoot":"","sources":["../src/subscription-auth.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAGjD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC,CAK5D;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAe9D;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM/D"}

package/dist/subscription-auth.js

@@ -1,9 +1,10 @@
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { executionEnvironment } from "./execution-environment.js";
 import { runCommand } from "./process.js";
 export function openAiApiKey() {
-    const key = process.env.OPENAI_API_KEY?.trim();
+    const key = executionEnvironment().OPENAI_API_KEY?.trim();
     return key || undefined;
 }
 export async function loadPiModelAuth() {
@@ -12,12 +13,8 @@ export async function loadPiModelAuth() {
         ? { provider: "openai", apiKey }
         : { provider: "openai-codex", authJson: await loadPiSubscriptionAuth() };
 }
-export async function loadCodexModelAuth() {
-    const apiKey = openAiApiKey();
-    return apiKey ? { apiKey } : { authJson: await loadCodexSubscriptionAuth() };
-}
 export async function loadPiSubscriptionAuth() {
-    const raw = process.env.SELFBENCH_PI_AUTH_JSON ??
+    const raw = executionEnvironment().SELFBENCH_PI_AUTH_JSON ??
         (await readFile(join(homedir(), ".pi/agent/auth.json"), "utf8"));
     const parsed = JSON.parse(raw);
     const credential = isRecord(parsed) ? parsed["openai-codex"] : undefined;
@@ -29,23 +26,6 @@ export async function loadPiSubscriptionAuth() {
     }
     return JSON.stringify({ "openai-codex": credential });
 }
-export function assertCodexSubscriptionAuth(value, source = "Codex auth") {
-    if (!isRecord(value) || value.auth_mode !== "chatgpt" || !isRecord(value.tokens)) {
-        throw new Error(`${source} does not contain a ChatGPT subscription token set`);
-    }
-}
-export async function loadCodexSubscriptionAuth() {
-    const path = process.env.CODEX_AUTH_JSON_PATH ?? join(homedir(), ".codex/auth.json");
-    const raw = process.env.SELFBENCH_CODEX_AUTH_JSON ?? (await readFile(path, "utf8"));
-    const parsed = JSON.parse(raw);
-    assertCodexSubscriptionAuth(parsed, path);
-    const auth = parsed;
-    return JSON.stringify({
-        auth_mode: "chatgpt",
-        tokens: auth.tokens,
-        ...(typeof auth.last_refresh === "string" ? { last_refresh: auth.last_refresh } : {}),
-    });
-}
 export async function githubToken() {
     if (process.env.GH_TOKEN) {
         return process.env.GH_TOKEN;

package/dist/subscription-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-auth.js","sourceRoot":"","sources":["../src/subscription-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAa1C,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,OAAO,GAAG,IAAI,SAAS,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,MAAM;QACX,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE;QAChC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,yBAAyB,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IACE,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrB,UAAU,CAAC,IAAI,KAAK,OAAO;QAC3B,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACrC,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc,EAAE,MAAM,GAAG,YAAY;IAC/E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,oDAAoD,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IAC1C,2BAA2B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"subscription-auth.js","sourceRoot":"","sources":["../src/subscription-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQ1C,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO,GAAG,IAAI,SAAS,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,MAAM;QACX,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE;QAChC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,GAAG,GACP,oBAAoB,EAAE,CAAC,sBAAsB;QAC7C,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IACE,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrB,UAAU,CAAC,IAAI,KAAK,OAAO;QAC3B,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACrC,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/temporal/activities/agent-feed.d.ts

@@ -0,0 +1,5 @@
+import type { ArtifactStore } from "../../artifacts.js";
+import type { SandboxRunOptions } from "../../sandbox/index.js";
+/** Capture Pi's native stdout events; publish immutable, bounded snapshots for the UI. */
+export declare function withAgentFeed<T>(store: ArtifactStore, prefix: string, secrets: readonly string[], run: (onOutput: NonNullable<SandboxRunOptions["onOutput"]>) => Promise<T>): Promise<T>;
+//# sourceMappingURL=agent-feed.d.ts.map

package/dist/temporal/activities/agent-feed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-feed.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/agent-feed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,0FAA0F;AAC1F,wBAAsB,aAAa,CAAC,CAAC,EACnC,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,GAAG,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACxE,OAAO,CAAC,CAAC,CAAC,CA0CZ"}

package/dist/temporal/activities/agent-feed.js

@@ -0,0 +1,41 @@
+import { PiEventFeed } from "../../pi-event-feed.js";
+/** Capture Pi's native stdout events; publish immutable, bounded snapshots for the UI. */
+export async function withAgentFeed(store, prefix, secrets, run) {
+    const feed = new PiEventFeed(secrets);
+    let sequence = 0;
+    let previous = "";
+    let pending;
+    const flush = () => {
+        if (pending)
+            return pending;
+        const snapshot = JSON.stringify(feed.events());
+        if (snapshot === previous || snapshot === "[]")
+            return Promise.resolve();
+        pending = store
+            .put(`${prefix}/live/${String(sequence).padStart(8, "0")}.json`, Buffer.from(JSON.stringify({ events: JSON.parse(snapshot), capturedAt: new Date().toISOString() })), "application/json")
+            .then(() => {
+            previous = snapshot;
+            sequence += 1;
+        }, () => {
+            // Observation failures must not fail generation; retry this snapshot on the next tick.
+        })
+            .finally(() => {
+            pending = undefined;
+        });
+        return pending;
+    };
+    const timer = setInterval(() => void flush(), 2000);
+    timer.unref();
+    try {
+        return await run((stream, chunk) => {
+            if (stream === "stdout")
+                feed.push(chunk);
+        });
+    }
+    finally {
+        clearInterval(timer);
+        await pending;
+        await flush();
+    }
+}
+//# sourceMappingURL=agent-feed.js.map

package/dist/temporal/activities/agent-feed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-feed.js","sourceRoot":"","sources":["../../../src/temporal/activities/agent-feed.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAoB,EACpB,MAAc,EACd,OAA0B,EAC1B,GAAyE;IAEzE,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAkC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACzE,OAAO,GAAG,KAAK;aACZ,GAAG,CACF,GAAG,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,EAC1D,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CACvF,EACD,kBAAkB,CACnB;aACA,IAAI,CACH,GAAG,EAAE;YACH,QAAQ,GAAG,QAAQ,CAAC;YACpB,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC,EACD,GAAG,EAAE;YACH,uFAAuF;QACzF,CAAC,CACF;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACL,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,OAAO,CAAC;QACd,MAAM,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/temporal/activities/agent-scripts.d.ts

@@ -0,0 +1,16 @@
+import type { DiscoveryShardInput } from "./types.js";
+export declare function discoveryShardPrompt(input: DiscoveryShardInput, provenanceCount: number): string;
+export declare function modalAgentScript(extension: string, tool: string): string;
+/**
+ * One authoring round. Round 1 starts a new pi session; later rounds resume the restored session
+ * with the verification report as the next user message. The session file is always collected,
+ * even when the agent submits nothing, so the conversation survives a rejected round's diagnosis.
+ */
+export declare function authoringRoundScript(resume: boolean): string;
+/**
+ * One verification round. The sandbox program unpacks the compiled task and materializes the
+ * base snapshot with the held-out patch applied; pi then accepts or submits review suggestions. Outputs are always
+ * written so providers that require every declared output on success stay satisfied.
+ */
+export declare function verifierRoundScript(resume: boolean): string;
+//# sourceMappingURL=agent-scripts.d.ts.map

package/dist/temporal/activities/agent-scripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-scripts.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/agent-scripts.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAgBhG;AACD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAOxE;AACD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAmB5D;AACD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAmB3D"}

package/dist/temporal/activities/agent-scripts.js

@@ -0,0 +1,162 @@
+import { collectPiSessionScript, PI_SESSION_DIRECTORY, PI_SESSION_OUTPUT_PATH, piSessionArguments, } from "../../pi-session.js";
+import { MAILBOX_DIRECTORY, MAILBOX_DONE } from "../../sandbox/supervisor.js";
+import { WRAPPER_STATUS_PATH } from "./round-outcome.js";
+export function discoveryShardPrompt(input, provenanceCount) {
+    return `Discover and rank SelfBench candidates from this assigned provenance shard. Return at most easy=${input.targetCounts.easy}, medium=${input.targetCounts.medium}, hard=${input.targetCounts.hard}. Before selecting a pull request, query its number against /work/excluded-source-prs.json with jq; do not print or read the full exclusion list into context. The submit_discovery tool also removes any already-considered pull requests as a final safeguard.
+
+Before proposing a pull request, list its changed files and check them against the repository's .gitattributes: any path marked export-ignore (for PostHog, everything under .github/) is absent from the task snapshot the solver receives, so it can carry neither gold changes nor tests. Never propose a pull request whose implementation lives in such paths.
+
+Assign each candidate exactly one difficulty using the separable implementation core, excluding tests, generated code, formatting churn, unrelated cleanup, and files under export-ignored paths:
+- easy: at least 20 changed implementation lines across at least 1 implementation file, with at least 1 viable fail-to-pass test;
+- medium: at least 50 changed implementation lines across at least 2 implementation files, with at least 1 fail-to-pass and 1 pass-to-pass test;
+- hard: at least 100 changed implementation lines across at least 3 implementation files, with at least 1 fail-to-pass and 2 pass-to-pass tests.
+Choose the highest tier whose thresholds the candidate honestly meets. Every tier also requires focused public behavior, separable held-out tests, deterministic setup, and an authentic pre-implementation request. Prefer stable public APIs, commands, persistence boundaries, or extension seams.
+
+Every candidate must be a pull request from SOURCE_REPO_URL. Repository names or pull requests mentioned inside provenance messages are context only; never follow them into another repository. sourceUrl must be the canonical GitHub pull-request URL for SOURCE_REPO_URL and sourcePr must match its number.
+
+The sanitized corpus at /work/provenance.jsonl contains ${provenanceCount} human requests. Local Pi, Claude Code, and Codex requests are preferred when they clearly correspond to the same change. A local record with sourcePr and sourceUrl has an explicit user-supplied association and may be used only for that PR. Records with sourceType github-pull-request contain the non-bot PR author's exact title and optional body and are valid fallback provenance; they too may be used only for their own sourcePr and sourceUrl. Select provenance only by an exact sourceType, sessionId, and messageIndex present in the corpus. Never invent or reconstruct request text from implementation or tests. Inspect merged PR metadata and diffs with gh and git. Resolve the exact base and completed 40-character commits. Do not modify the repository.
+
+Return fewer candidates when the shard does not contain enough valid requests; an empty candidate list is valid. Call submit_discovery exactly once. Do not return prose after the tool call.`;
+}
+export function modalAgentScript(extension, tool) {
+    return `${sandboxBootstrap()}
+clone_source
+cd /work/repo
+run_with_heartbeat pi --print --mode json --no-session --no-approve --no-skills --no-prompt-templates --no-context-files --no-extensions \\
+  --extension /work/${extension} --provider "$(model_provider)" --model "$AUTHOR_MODEL" --thinking "\${AUTHOR_THINKING:-high}" \\
+  --tools read,bash,grep,find,ls,${tool} "$(cat /work/prompt.txt)"`;
+}
+/**
+ * One authoring round. Round 1 starts a new pi session; later rounds resume the restored session
+ * with the verification report as the next user message. The session file is always collected,
+ * even when the agent submits nothing, so the conversation survives a rejected round's diagnosis.
+ */
+export function authoringRoundScript(resume) {
+    return `${sandboxBootstrap()}
+${collectPiSessionScript()}
+${mailboxSetup()}
+clone_source
+mkdir -p /work/tasks /work/task ${PI_SESSION_DIRECTORY}
+cd /work/repo
+${promptArguments()}
+agent_status=0
+run_with_heartbeat pi --print --mode json ${piSessionArguments(resume).join(" ")} --no-approve --no-prompt-templates --no-context-files --no-extensions \\
+  --skill /work/selfbench-skill --extension /work/authoring.js \\
+  --provider "$(model_provider)" --model "$AUTHOR_MODEL" --thinking "\${AUTHOR_THINKING:-high}" \\
+  --tools read,bash,grep,find,ls,verify,submit_task "\${prompt_args[@]}" || agent_status=$?
+collect_session
+echo "[selfbench] pi exited with $agent_status"
+[ "$agent_status" -eq 0 ] || { wrapper_status=$agent_status; exit "$agent_status"; }
+node /work/sandbox-author.js /work/tasks /work/source-task.tar.gz /work/definition.json
+${reportOutputs(["/work/source-task.tar.gz", "/work/definition.json", PI_SESSION_OUTPUT_PATH])}
+wrapper_status=0`;
+}
+/**
+ * One verification round. The sandbox program unpacks the compiled task and materializes the
+ * base snapshot with the held-out patch applied; pi then accepts or submits review suggestions. Outputs are always
+ * written so providers that require every declared output on success stay satisfied.
+ */
+export function verifierRoundScript(resume) {
+    return `${sandboxBootstrap()}
+${collectPiSessionScript()}
+${mailboxSetup()}
+mkdir -p /work/verdict ${PI_SESSION_DIRECTORY}
+node /work/sandbox-verifier.js /work/task.tar.gz
+cd /work/repo
+${promptArguments()}
+agent_status=0
+run_with_heartbeat pi --print --mode json ${piSessionArguments(resume).join(" ")} --no-approve --no-skills --no-prompt-templates --no-context-files --no-extensions \\
+  --extension /work/verifier.js --provider "$(model_provider)" --model "$AUTHOR_MODEL" --thinking "\${AUTHOR_THINKING:-high}" \\
+  --tools read,grep,find,ls,accept_task,submit_suggestions,reject_task "\${prompt_args[@]}" || agent_status=$?
+collect_session
+echo "[selfbench] pi exited with $agent_status"
+[ -f /work/verdict/verdict.json ] || printf '{"kind": "none"}\\n' > /work/verdict/verdict.json
+[ -f ${PI_SESSION_OUTPUT_PATH} ] || : > ${PI_SESSION_OUTPUT_PATH}
+${reportOutputs(["/work/verdict/verdict.json", PI_SESSION_OUTPUT_PATH])}
+wrapper_status=$agent_status
+exit "$agent_status"`;
+}
+/** Prints which declared outputs exist so the archived sandbox result explains a missing read. */
+function reportOutputs(paths) {
+    return `outputs_report=""
+for output_path in ${paths.join(" ")}; do
+  if [ -f "$output_path" ]; then outputs_report="$outputs_report $output_path:present($(wc -c < "$output_path" | tr -d ' ')B)"; else outputs_report="$outputs_report $output_path:missing"; fi
+done
+echo "[selfbench] outputs:$outputs_report"`;
+}
+/**
+ * Mailbox directories for the in-session verify tool; the done marker tells the worker's
+ * supervisor that the agent command is over even if the provider exit signal lags.
+ */
+/**
+ * The prompt is normally the last pi argument. Linux caps a single argument at 128 KiB, and a
+ * verifier prompt embedding both patches of a large PR has exceeded it ("Argument list too
+ * long"), so larger prompts go in as an @file attachment with a one-line instruction instead.
+ */
+function promptArguments() {
+    return `if [ "$(wc -c < /work/prompt.txt | tr -d ' ')" -lt 100000 ]; then
+  prompt_args=("$(cat /work/prompt.txt)")
+else
+  prompt_args=(@/work/prompt.txt "Your complete task prompt is the attached file above; follow it exactly.")
+fi`;
+}
+/**
+ * The EXIT trap records the wrapper's status for the worker. The script sets `wrapper_status`
+ * to the status it intends right before it ends, because with a real pi session `$?` at trap
+ * entry has been observed as 1 after `exit 0`; the trap also logs the command it fired on.
+ */
+function mailboxSetup() {
+    return `mkdir -p ${MAILBOX_DIRECTORY}/requests ${MAILBOX_DIRECTORY}/responses
+finish_round() {
+  local status=$?
+  printf '[selfbench] exit trap: status=%s command=[%s] line=%s\\n' "$status" "$BASH_COMMAND" "$LINENO" >&2
+  if [ -n "\${wrapper_status:-}" ]; then status=$wrapper_status; fi
+  cleanup
+  printf '%s\\n' "$status" > ${WRAPPER_STATUS_PATH}
+  : > ${MAILBOX_DONE}
+}
+trap finish_round EXIT`;
+}
+function sandboxBootstrap() {
+    return `set -euo pipefail
+mkdir -p "$HOME/.pi/agent"
+if [ -n "\${SELFBENCH_PI_AUTH_JSON:-}" ]; then
+  printf '%s' "$SELFBENCH_PI_AUTH_JSON" > "$HOME/.pi/agent/auth.json"
+  chmod 600 "$HOME/.pi/agent/auth.json"
+fi
+printf '%s\n' '{"transport":"auto"}' > "$HOME/.pi/agent/settings.json"
+chmod 600 "$HOME/.pi/agent/settings.json"
+model_provider() { [ -n "\${OPENAI_API_KEY:-}" ] && printf openai || printf openai-codex; }
+run_with_heartbeat() {
+  "$@" 2>&1 &
+  local command_pid=$!
+  (
+    while sleep 60; do
+      printf '[selfbench] agent process %s still running at %s\n' "$command_pid" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >&2
+    done
+  ) &
+  local heartbeat_pid=$!
+  trap 'kill "$command_pid" "$heartbeat_pid" 2>/dev/null || true' TERM INT
+  set +e
+  wait "$command_pid"
+  local command_status=$?
+  set -e
+  kill "$heartbeat_pid" 2>/dev/null || true
+  wait "$heartbeat_pid" 2>/dev/null || true
+  trap - TERM INT
+  return "$command_status"
+}
+cleanup() { rm -f "$HOME/.pi/agent/auth.json" "$HOME/.pi/agent/settings.json" "$HOME/.git-credentials"; }
+trap cleanup EXIT
+clone_source() {
+  if [ -n "\${GH_TOKEN:-}" ]; then
+    git config --global credential.helper store
+    printf 'https://x-access-token:%s@github.com\n' "$GH_TOKEN" > "$HOME/.git-credentials"
+    chmod 600 "$HOME/.git-credentials"
+  fi
+  git clone --no-checkout --filter=blob:none "$SOURCE_REPO_URL" /work/repo
+  git -C /work/repo fetch origin "$SOURCE_COMMIT"
+  git -C /work/repo checkout --detach "$SOURCE_COMMIT"
+}`;
+}
+//# sourceMappingURL=agent-scripts.js.map