self-bench 0.3.6 → 0.3.8

package/src/sandbox/programs/repair.ts

@@ -1,132 +0,0 @@
-#!/usr/bin/env node
-
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
-import { sha256 } from "../../hash.js";
-import { runCommand } from "../../process.js";
-import { assertRepairPaths, patchPaths, repairPrompt } from "../../repair.js";
-import { prepareRepairTask } from "./prepare-repair.js";
-
-const [archivePath, reviewPath, outputArchive, outputReport] = process.argv.slice(2);
-if (!archivePath || !reviewPath || !outputArchive || !outputReport) {
-  throw new Error("usage: sandbox-repair TASK.tar.gz REVIEW.json OUTPUT.tar.gz OUTPUT-REPORT.json");
-}
-
-const { extractedDirectory, taskDirectory, repositoryDirectory } =
-  await prepareRepairTask(archivePath);
-
-const [instruction, originalPatch, review] = await Promise.all([
-  readFile(join(taskDirectory, "instruction.md"), "utf8"),
-  readFile(join(taskDirectory, "tests/test.patch"), "utf8"),
-  readFile(reviewPath, "utf8"),
-]);
-const manifestPath = join(taskDirectory, ".selfbench-manifest.json");
-const manifest = JSON.parse(await readFile(manifestPath, "utf8")) as Record<string, unknown>;
-const taskId = typeof manifest.taskId === "string" ? manifest.taskId : "unknown-task";
-const allowedPaths = patchPaths(originalPatch);
-
-const codexAuth = process.env.SELFBENCH_CODEX_AUTH_JSON;
-const apiKey = process.env.OPENAI_API_KEY;
-if (!apiKey && !codexAuth) {
-  fail("OPENAI_API_KEY or SELFBENCH_CODEX_AUTH_JSON is required");
-}
-const codexHome = join(homedir(), ".codex");
-const authPath = join(codexHome, "auth.json");
-await mkdir(codexHome, { recursive: true });
-await writeFile(authPath, codexAuth ?? `${JSON.stringify({ OPENAI_API_KEY: apiKey })}\n`);
-await chmod(authPath, 0o600);
-const promptPath = join(tmpdir(), `selfbench-repair-${taskId}.md`);
-await writeFile(
-  promptPath,
-  repairPrompt({
-    taskId,
-    authenticRequest: instruction,
-    couplingReport: review,
-    allowedPaths,
-  }),
-);
-
-const codex = await runCommand(
-  "codex",
-  [
-    "exec",
-    "--model",
-    process.env.SELFBENCH_REPAIR_MODEL ?? "gpt-5.6-sol",
-    "--dangerously-bypass-approvals-and-sandbox",
-    "--ephemeral",
-    "--ignore-user-config",
-    "--json",
-    "-C",
-    repositoryDirectory,
-    "-",
-  ],
-  {
-    allowFailure: true,
-    timeoutMs: 90 * 60 * 1000,
-    env: process.env,
-    input: await readFile(promptPath, "utf8"),
-    onOutput: (stream, chunk) => {
-      (stream === "stdout" ? process.stdout : process.stderr).write(chunk);
-    },
-  },
-);
-if (codex.exitCode !== 0) {
-  throw new Error(`Codex repair exited ${codex.exitCode}: ${codex.stderr.slice(-2_000)}`);
-}
-
-const [tracked, untracked] = await Promise.all([
-  runCommand("git", ["-C", repositoryDirectory, "diff", "--name-only", "HEAD"]),
-  runCommand("git", ["-C", repositoryDirectory, "ls-files", "--others", "--exclude-standard"]),
-]);
-const changedPaths = [...tracked.stdout.split("\n"), ...untracked.stdout.split("\n")]
-  .filter(Boolean)
-  .sort();
-assertRepairPaths(originalPatch, changedPaths);
-const repaired = await runCommand("git", ["-C", repositoryDirectory, "diff", "--binary", "HEAD"]);
-if (!repaired.stdout.startsWith("diff --git ")) {
-  throw new Error(
-    `repair produced no held-out test patch; status=${JSON.stringify(changedPaths)}; Codex tail=${codex.stdout.slice(-4_000)}`,
-  );
-}
-if (repaired.stdout === originalPatch) {
-  throw new Error("repair left the held-out test patch unchanged");
-}
-
-await writeFile(join(taskDirectory, "tests/test.patch"), repaired.stdout);
-await writeFile(
-  manifestPath,
-  `${JSON.stringify(
-    {
-      ...manifest,
-      testPatchSha256: sha256(repaired.stdout),
-      repair: {
-        model: process.env.SELFBENCH_REPAIR_MODEL ?? "gpt-5.6-sol",
-        originalTestPatchSha256: sha256(originalPatch),
-      },
-    },
-    null,
-    2,
-  )}\n`,
-);
-await runCommand("tar", ["-czf", outputArchive, "-C", extractedDirectory, "."]);
-await writeFile(
-  outputReport,
-  `${JSON.stringify(
-    {
-      schemaVersion: 1,
-      taskId,
-      model: process.env.SELFBENCH_REPAIR_MODEL ?? "gpt-5.6-sol",
-      changedPaths,
-      originalTestPatchSha256: sha256(originalPatch),
-      repairedTestPatchSha256: sha256(repaired.stdout),
-      codexOutputTail: codex.stdout.slice(-4_000),
-    },
-    null,
-    2,
-  )}\n`,
-);
-
-function fail(message: string): never {
-  throw new Error(message);
-}

package/src/sandbox/programs/review.ts

@@ -1,19 +0,0 @@
-import { readFile, writeFile } from "node:fs/promises";
-import { reviewCouplingWithCodex } from "../../codex-review.js";
-
-const apiKey = process.env.OPENAI_API_KEY;
-const authJson = process.env.SELFBENCH_PI_AUTH_JSON;
-const outputPath = process.env.SELFBENCH_REVIEW_OUTPUT;
-if (!apiKey && !authJson) {
-  throw new Error("OPENAI_API_KEY or SELFBENCH_PI_AUTH_JSON is required");
-}
-if (!outputPath) {
-  throw new Error("SELFBENCH_REVIEW_OUTPUT is required");
-}
-
-const review = await reviewCouplingWithCodex({
-  ...(apiKey ? { apiKey } : {}),
-  ...(authJson ? { authJson } : {}),
-  prompt: await readFile("/work/review-input.md", "utf8"),
-});
-await writeFile(outputPath, `${JSON.stringify(review, null, 2)}\n`, { flag: "wx" });

package/src/sandbox/programs/validation-repair.ts

@@ -1,153 +0,0 @@
-#!/usr/bin/env node
-
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
-import { taskDefinitionSchema } from "../../contracts.js";
-import { runCommand } from "../../process.js";
-import {
-  assertValidationRepair,
-  validationRepairPaths,
-  validationRepairPrompt,
-} from "../../validation-repair.js";
-import { prepareRepairTask } from "./prepare-repair.js";
-
-const [archivePath, definitionPath, diagnosticsPath, outputDefinition, outputPatch, outputReport] =
-  process.argv.slice(2);
-if (
-  !archivePath ||
-  !definitionPath ||
-  !diagnosticsPath ||
-  !outputDefinition ||
-  !outputPatch ||
-  !outputReport
-) {
-  throw new Error(
-    "usage: sandbox-validation-repair TASK.tar.gz DEFINITION.json DIAGNOSTICS.txt OUTPUT-DEFINITION.json OUTPUT-PATCH OUTPUT-REPORT.json",
-  );
-}
-
-const { taskDirectory, repositoryDirectory } = await prepareRepairTask(archivePath);
-const [instruction, originalPatch, diagnostics, originalDefinitionBytes] = await Promise.all([
-  readFile(join(taskDirectory, "instruction.md"), "utf8"),
-  readFile(join(taskDirectory, "tests/test.patch"), "utf8"),
-  readFile(diagnosticsPath, "utf8"),
-  readFile(definitionPath, "utf8"),
-]);
-const originalDefinition = taskDefinitionSchema.parse(JSON.parse(originalDefinitionBytes));
-const allowedPaths = validationRepairPaths(originalPatch);
-
-await Promise.all([
-  writeFile("/work/definition.json", `${JSON.stringify(originalDefinition, null, 2)}\n`),
-  writeFile("/work/gold.patch", await readFile(join(taskDirectory, "solution/gold.patch"))),
-  writeFile("/work/test.sh", await readFile(join(taskDirectory, "tests/test.sh"))),
-]);
-
-const piHome = join(homedir(), ".pi/agent");
-const piAuth = process.env.SELFBENCH_PI_AUTH_JSON;
-if (!process.env.OPENAI_API_KEY && !piAuth) {
-  fail("OPENAI_API_KEY or SELFBENCH_PI_AUTH_JSON is required");
-}
-await mkdir(piHome, { recursive: true });
-await Promise.all([
-  ...(piAuth
-    ? [
-        writeFile(join(piHome, "auth.json"), piAuth).then(() =>
-          chmod(join(piHome, "auth.json"), 0o600),
-        ),
-      ]
-    : []),
-  writeFile(join(piHome, "settings.json"), `${JSON.stringify({ transport: "auto" })}\n`),
-]);
-const promptPath = join(tmpdir(), `selfbench-validation-repair-${originalDefinition.taskId}.md`);
-await writeFile(
-  promptPath,
-  validationRepairPrompt({
-    definition: originalDefinition,
-    authenticRequest: instruction,
-    diagnostics,
-    allowedPaths,
-  }),
-);
-
-const pi = await runCommand(
-  "pi",
-  [
-    "--print",
-    "--mode",
-    "json",
-    "--no-session",
-    "--no-approve",
-    "--no-skills",
-    "--no-prompt-templates",
-    "--no-context-files",
-    "--no-extensions",
-    "--provider",
-    process.env.OPENAI_API_KEY ? "openai" : "openai-codex",
-    "--model",
-    process.env.SELFBENCH_REPAIR_MODEL ?? "gpt-5.6-sol",
-    "--thinking",
-    "high",
-    "--tools",
-    "read,bash,grep,find,ls",
-    `@${promptPath}`,
-  ],
-  {
-    allowFailure: true,
-    timeoutMs: 90 * 60 * 1000,
-    cwd: repositoryDirectory,
-    env: process.env,
-    onOutput: (stream, chunk) => {
-      (stream === "stdout" ? process.stdout : process.stderr).write(chunk);
-    },
-  },
-);
-if (pi.exitCode !== 0) {
-  throw new Error(`Pi validation repair exited ${pi.exitCode}: ${pi.stderr.slice(-2_000)}`);
-}
-
-const repairedDefinition = taskDefinitionSchema.parse(
-  JSON.parse(await readFile("/work/definition.json", "utf8")),
-);
-const [tracked, untracked] = await Promise.all([
-  runCommand("git", ["-C", repositoryDirectory, "diff", "--name-only", "HEAD"]),
-  runCommand("git", ["-C", repositoryDirectory, "ls-files", "--others", "--exclude-standard"]),
-]);
-const changedPaths = [...tracked.stdout.split("\n"), ...untracked.stdout.split("\n")]
-  .filter(Boolean)
-  .sort();
-assertValidationRepair(originalDefinition, repairedDefinition, originalPatch, changedPaths);
-const repaired = await runCommand("git", ["-C", repositoryDirectory, "diff", "--binary", "HEAD"]);
-const repairedPatch = repaired.stdout.startsWith("diff --git ") ? repaired.stdout : originalPatch;
-if (
-  repairedPatch === originalPatch &&
-  JSON.stringify(repairedDefinition) === JSON.stringify(originalDefinition)
-) {
-  throw new Error("validation repair left the task unchanged");
-}
-
-await Promise.all([
-  writeFile(outputDefinition, `${JSON.stringify(repairedDefinition, null, 2)}\n`),
-  writeFile(outputPatch, repairedPatch),
-  writeFile(
-    outputReport,
-    `${JSON.stringify(
-      {
-        schemaVersion: 1,
-        taskId: originalDefinition.taskId,
-        model: process.env.SELFBENCH_REPAIR_MODEL ?? "gpt-5.6-sol",
-        changedPaths,
-        definitionChanged:
-          JSON.stringify(repairedDefinition) !== JSON.stringify(originalDefinition),
-        testsChanged: repairedPatch !== originalPatch,
-        piOutputTail: pi.stdout.slice(-4_000),
-      },
-      null,
-      2,
-    )}\n`,
-  ),
-]);
-
-function fail(message: string): never {
-  throw new Error(message);
-}

package/src/sandbox/providers/docker/executor.ts

@@ -1,115 +0,0 @@
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, join, relative, resolve } from "node:path";
-import type { SelfBenchConfig } from "../../../config.js";
-import { runCommand } from "../../../process.js";
-import type {
-  SandboxExecutor,
-  SandboxRequest,
-  SandboxResult,
-  SandboxRunOptions,
-} from "../../contracts.js";
-
-export class DockerSandboxExecutor implements SandboxExecutor {
-  readonly #config: Extract<SelfBenchConfig["execution"], { kind: "docker" }>;
-
-  constructor(config: Extract<SelfBenchConfig["execution"], { kind: "docker" }>) {
-    this.#config = config;
-  }
-
-  async run(request: SandboxRequest, options: SandboxRunOptions = {}): Promise<SandboxResult> {
-    const root = await mkdtemp(join(tmpdir(), "selfbench-docker-"));
-    const sandboxId = sandboxName(request.runId, request.stage);
-    try {
-      for (const file of request.files ?? []) {
-        const destination = hostPath(root, file.path);
-        await mkdir(dirname(destination), { recursive: true });
-        await writeFile(destination, file.contents);
-      }
-
-      const environment = { ...request.environment, ...request.secrets };
-      const args = [
-        "create",
-        "--name",
-        sandboxId,
-        "--cpus",
-        String(request.cpu ?? 4),
-        "--memory",
-        `${request.memoryMiB ?? 8192}m`,
-        "--volume",
-        `${sandboxId}:/work`,
-        "--workdir",
-        "/work",
-      ];
-      for (const key of Object.keys(environment)) {
-        args.push("--env", key);
-      }
-      args.push(this.#config.image, ...request.command);
-
-      await runCommand("docker", ["volume", "create", sandboxId]);
-      await runCommand("docker", args, { env: { ...process.env, ...environment } });
-      await runCommand("docker", ["cp", `${root}/.`, `${sandboxId}:/work/`]);
-
-      const abort = () => {
-        void runCommand("docker", ["rm", "--force", sandboxId], { allowFailure: true });
-      };
-      options.signal?.addEventListener("abort", abort, { once: true });
-      try {
-        const result = await runCommand("docker", ["start", "--attach", sandboxId], {
-          allowFailure: true,
-          timeoutMs: request.timeoutMs,
-          ...(request.inactivityTimeoutMs
-            ? { inactivityTimeoutMs: request.inactivityTimeoutMs }
-            : {}),
-          onOutput: (stream, chunk) => options.onProgress?.({ stream, bytes: chunk.byteLength }),
-        });
-        const outputs: Record<string, Uint8Array> = {};
-        for (const path of request.outputPaths ?? []) {
-          const destination = hostPath(root, path);
-          await mkdir(dirname(destination), { recursive: true });
-          const copied = await runCommand("docker", ["cp", `${sandboxId}:${path}`, destination], {
-            allowFailure: true,
-          });
-          if (copied.exitCode === 0) {
-            outputs[path] = await readFile(destination);
-          } else if (result.exitCode === 0) {
-            throw new Error(`sandbox ${sandboxId} exited successfully without output ${path}`);
-          }
-        }
-        return { sandboxId, ...result, outputs };
-      } finally {
-        options.signal?.removeEventListener("abort", abort);
-        await runCommand("docker", ["rm", "--force", sandboxId], { allowFailure: true });
-        await runCommand("docker", ["volume", "rm", "--force", sandboxId], {
-          allowFailure: true,
-        });
-      }
-    } finally {
-      await runCommand("docker", ["rm", "--force", sandboxId], { allowFailure: true });
-      await runCommand("docker", ["volume", "rm", "--force", sandboxId], {
-        allowFailure: true,
-      });
-      await rm(root, { recursive: true, force: true });
-    }
-  }
-
-  close(): void {}
-}
-
-function hostPath(root: string, containerPath: string): string {
-  if (!containerPath.startsWith("/work/")) {
-    throw new Error(`sandbox path must be beneath /work: ${containerPath}`);
-  }
-  const path = resolve(root, relative("/work", containerPath));
-  if (path !== root && !path.startsWith(`${root}/`)) {
-    throw new Error(`sandbox path escapes /work: ${containerPath}`);
-  }
-  return path;
-}
-
-function sandboxName(runId: string, stage: string): string {
-  const suffix = crypto.randomUUID().slice(0, 8);
-  return `selfbench-${runId.slice(0, 20)}-${stage.slice(0, 16)}-${suffix}`
-    .toLowerCase()
-    .replace(/[^a-z0-9_.-]/g, "-");
-}

package/src/sandbox/providers/modal/executor.ts

@@ -1,217 +0,0 @@
-import { setTimeout as delay } from "node:timers/promises";
-import { type Image, ModalClient, type Secret } from "modal";
-import type { SelfBenchConfig } from "../../../config.js";
-import { InactivityTimeoutError, RollingOutput } from "../../../process.js";
-import {
-  SandboxExecutionError,
-  type SandboxExecutor,
-  type SandboxRequest,
-  type SandboxResult,
-  type SandboxRunOptions,
-} from "../../contracts.js";
-
-const FAILURE_DRAIN_TIMEOUT_MS = 1_000;
-
-export class ModalSandboxExecutor implements SandboxExecutor {
-  readonly #client: ModalClient;
-  readonly #config: Extract<SelfBenchConfig["execution"], { kind: "modal" }>;
-  #image: Image | undefined;
-
-  constructor(
-    config: Extract<SelfBenchConfig["execution"], { kind: "modal" }>,
-    client = new ModalClient(),
-  ) {
-    this.#config = config;
-    this.#client = client;
-  }
-
-  async run(request: SandboxRequest, options: SandboxRunOptions = {}): Promise<SandboxResult> {
-    options.signal?.throwIfAborted();
-    const app = await this.#client.apps.fromName(this.#config.app, {
-      createIfMissing: true,
-      ...(this.#config.environment ? { environment: this.#config.environment } : {}),
-    });
-    options.signal?.throwIfAborted();
-    if (!this.#image) {
-      this.#image = this.#buildImage();
-    }
-    const sandbox = await this.#client.sandboxes.create(app, this.#image, {
-      timeoutMs: request.timeoutMs,
-      idleTimeoutMs: Math.min(request.timeoutMs, 10 * 60 * 1000),
-      cpu: request.cpu ?? 4,
-      memoryMiB: request.memoryMiB ?? 8192,
-      workdir: "/work",
-      name: sandboxName(request.runId, request.stage),
-      tags: { run_id: request.runId, stage: request.stage },
-    });
-
-    let notifyFailure = (): void => {};
-    const abort = () => {
-      notifyFailure();
-      void sandbox.terminate();
-    };
-    options.signal?.addEventListener("abort", abort, { once: true });
-    try {
-      options.signal?.throwIfAborted();
-      for (const file of request.files ?? []) {
-        if (typeof file.contents === "string") {
-          await sandbox.filesystem.writeText(file.contents, file.path);
-        } else {
-          await sandbox.filesystem.writeBytes(file.contents, file.path);
-        }
-      }
-
-      const secrets = await this.#secrets(request.secrets);
-      const process = await sandbox.exec([...request.command], {
-        env: { ...request.environment },
-        ...(secrets.length > 0 ? { secrets } : {}),
-      });
-      await process.closeStdin();
-      const stdoutOutput = new RollingOutput();
-      const stderrOutput = new RollingOutput();
-      const readers = new Set<ReadableStreamDefaultReader<string | Uint8Array>>();
-      let inactivityTimer: ReturnType<typeof setTimeout> | undefined;
-      let inactivityError: InactivityTimeoutError | undefined;
-      const failure = new Promise<void>((resolve) => {
-        notifyFailure = resolve;
-      });
-      const clearInactivityTimer = (): void => {
-        if (inactivityTimer) {
-          clearTimeout(inactivityTimer);
-          inactivityTimer = undefined;
-        }
-      };
-      const armInactivityTimer = (): void => {
-        clearInactivityTimer();
-        if (!request.inactivityTimeoutMs) {
-          return;
-        }
-        inactivityTimer = setTimeout(() => {
-          inactivityError = new InactivityTimeoutError(
-            `Modal sandbox ${sandbox.sandboxId} stage ${request.stage}`,
-            request.inactivityTimeoutMs ?? 0,
-          );
-          notifyFailure();
-        }, request.inactivityTimeoutMs);
-        inactivityTimer.unref();
-      };
-      const consume = async (
-        streamName: "stdout" | "stderr",
-        stream: ReadableStream<string | Uint8Array>,
-        output: RollingOutput,
-      ): Promise<void> => {
-        const reader = stream.getReader();
-        readers.add(reader);
-        try {
-          while (true) {
-            const { value, done } = await reader.read();
-            if (done) {
-              return;
-            }
-            if (value !== undefined) {
-              const chunk = typeof value === "string" ? Buffer.from(value) : Buffer.from(value);
-              output.push(chunk);
-              options.onProgress?.({ stream: streamName, bytes: chunk.byteLength });
-              armInactivityTimer();
-            }
-          }
-        } finally {
-          readers.delete(reader);
-          reader.releaseLock();
-        }
-      };
-      let exitCode: number | undefined;
-      let processError: unknown;
-      let streamError: unknown;
-      const captureFailure = (error: unknown): void => {
-        streamError ??= error;
-        notifyFailure();
-      };
-      armInactivityTimer();
-      const completion = Promise.all([
-        process.wait().then(
-          (value) => {
-            exitCode = value;
-          },
-          (error: unknown) => {
-            processError = error;
-            notifyFailure();
-          },
-        ),
-        consume("stdout", process.stdout, stdoutOutput).catch(captureFailure),
-        consume("stderr", process.stderr, stderrOutput).catch(captureFailure),
-      ]);
-      await Promise.race([completion, failure.then(() => delay(FAILURE_DRAIN_TIMEOUT_MS))]).finally(
-        clearInactivityTimer,
-      );
-      if (readers.size > 0) {
-        void Promise.allSettled([...readers].map((reader) => reader.cancel()));
-      }
-      const executionError = inactivityError ?? processError ?? streamError;
-      const outputs: Record<string, Uint8Array> = {};
-      for (const path of request.outputPaths ?? []) {
-        try {
-          outputs[path] = await sandbox.filesystem.readBytes(path);
-        } catch {
-          // Callers validate required outputs after persisting stdout/stderr. Returning an
-          // absent output keeps the model or command failure diagnosable.
-        }
-      }
-      const result = {
-        sandboxId: sandbox.sandboxId,
-        exitCode: exitCode ?? 1,
-        stdout: stdoutOutput.text(),
-        stderr: stderrOutput.text(),
-        outputs,
-      };
-      if (executionError) {
-        throw new SandboxExecutionError(
-          `${executionError instanceof Error ? executionError.message : String(executionError)}; sandbox ${sandbox.sandboxId}`,
-          result,
-          { cause: executionError },
-        );
-      }
-      return result;
-    } finally {
-      options.signal?.removeEventListener("abort", abort);
-      await sandbox.terminate().catch(() => undefined);
-    }
-  }
-
-  close(): void {
-    this.#client.close();
-  }
-
-  #buildImage(): Image {
-    return this.#client.images
-      .fromRegistry(this.#config.image)
-      .dockerfileCommands([
-        "USER root",
-        "RUN apt-get update && apt-get install -y --no-install-recommends bash ca-certificates curl git jq ripgrep unzip xz-utils && rm -rf /var/lib/apt/lists/*",
-        "RUN curl -fsSL https://github.com/cli/cli/releases/download/v2.89.0/gh_2.89.0_linux_amd64.tar.gz -o /tmp/gh.tar.gz && echo 'd0422caade520530e76c1c558da47daebaa8e1203d6b7ff10ad7d6faba3490d8  /tmp/gh.tar.gz' | sha256sum -c - && tar -xzf /tmp/gh.tar.gz -C /tmp && mv /tmp/gh_2.89.0_linux_amd64/bin/gh /usr/local/bin/gh && rm -rf /tmp/gh.tar.gz /tmp/gh_2.89.0_linux_amd64",
-        "RUN npm install --global --ignore-scripts @earendil-works/pi-coding-agent@0.84.0",
-        "RUN npm install --global @openai/codex@0.146.1",
-        "ENV PATH=/root/.local/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin",
-        "WORKDIR /work",
-      ]);
-  }
-
-  async #secrets(entries: Readonly<Record<string, string>> | undefined): Promise<Secret[]> {
-    if (!entries || Object.keys(entries).length === 0) {
-      return [];
-    }
-    return [
-      await this.#client.secrets.fromObject(
-        { ...entries },
-        {
-          ...(this.#config.environment ? { environment: this.#config.environment } : {}),
-        },
-      ),
-    ];
-  }
-}
-
-function sandboxName(runId: string, stage: string): string {
-  const suffix = crypto.randomUUID().slice(0, 8);
-  return `${runId.slice(0, 24)}-${stage.slice(0, 16)}-${suffix}`.replace(/[^a-zA-Z0-9._-]/g, "-");
-}