self-bench 0.3.6 → 0.3.8

package/src/setup/vercel/profile.ts

@@ -1,322 +0,0 @@
-import { randomUUID } from "node:crypto";
-import type { Stats } from "node:fs";
-import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-import { z } from "zod";
-import {
-  parseSandboxTimeoutCapText,
-  STANDARD_VERCEL_TIMEOUT_CAP_MS,
-} from "../../sandbox/timeout.js";
-
-const CONFIG_FILE = "config.json";
-const CREDENTIALS_FILE = "credentials.json";
-const PRIVATE_DIRECTORY_MODE = 0o700;
-const PRIVATE_FILE_MODE = 0o600;
-
-const profileNameSchema = z
-  .string()
-  .trim()
-  .regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/, {
-    error: "Vercel profile name must use 1-64 letters, digits, dots, underscores, or hyphens",
-  });
-
-const digestPinnedImageSchema = z
-  .string()
-  .regex(/^[^@\s]+@sha256:[0-9a-f]{64}$/i, "expected a digest-pinned VCR image");
-
-export const vercelProfileSchema = z
-  .object({
-    teamId: z.string().trim().min(1),
-    teamSlug: z.string().trim().min(1),
-    teamName: z.string().trim().min(1),
-    projectId: z.string().trim().min(1),
-    projectName: z.string().trim().min(1),
-    vcrRepository: z.string().trim().min(1),
-    image: digestPinnedImageSchema,
-    runtimeFingerprint: z.string().regex(/^[0-9a-f]{64}$/),
-    timeoutCapMs: z.number().int().min(100).max(STANDARD_VERCEL_TIMEOUT_CAP_MS),
-    capabilityCheckedAt: z.iso.datetime(),
-  })
-  .strict();
-
-export type VercelProfile = z.infer<typeof vercelProfileSchema>;
-
-const configSchema = z
-  .object({
-    schemaVersion: z.literal(1),
-    activeVercelProfile: profileNameSchema.optional(),
-    vercelProfiles: z.record(profileNameSchema, vercelProfileSchema),
-  })
-  .strict();
-
-const credentialsSchema = z
-  .object({
-    schemaVersion: z.literal(1),
-    vercelProfiles: z.record(
-      profileNameSchema,
-      z.object({ token: z.string().trim().min(1) }).strict(),
-    ),
-  })
-  .strict();
-
-export interface VercelProfileData {
-  readonly activeVercelProfile?: string;
-  readonly profiles: Readonly<Record<string, VercelProfile>>;
-  readonly tokens: Readonly<Record<string, string>>;
-}
-
-interface MutableProfileData {
-  activeVercelProfile?: string;
-  profiles: Record<string, VercelProfile>;
-  tokens: Record<string, string>;
-}
-
-export function selfBenchConfigDirectory(environment: NodeJS.ProcessEnv = process.env): string {
-  const override = environment.SELFBENCH_CONFIG_DIR?.trim();
-  return resolve(override || join(homedir(), ".selfbench"));
-}
-
-export function validateVercelProfileName(value: string): string {
-  return profileNameSchema.parse(value);
-}
-
-export async function loadVercelProfileData(
-  directory = selfBenchConfigDirectory(),
-): Promise<VercelProfileData> {
-  const mutable = await loadMutableProfileData(directory);
-  return {
-    ...(mutable.activeVercelProfile ? { activeVercelProfile: mutable.activeVercelProfile } : {}),
-    profiles: mutable.profiles,
-    tokens: mutable.tokens,
-  };
-}
-
-export async function saveVercelProfile(input: {
-  readonly directory?: string;
-  readonly profileName: string;
-  readonly profile: VercelProfile;
-  readonly token: string;
-}): Promise<void> {
-  const directory = resolve(input.directory ?? selfBenchConfigDirectory());
-  const profileName = validateVercelProfileName(input.profileName);
-  const token = input.token.trim();
-  if (!token) {
-    throw new Error("Vercel access token must not be blank");
-  }
-  const profile = vercelProfileSchema.parse(input.profile);
-  await ensurePrivateDirectory(directory);
-  const existing = await loadMutableProfileData(directory);
-  const nextCredentials = credentialsSchema.parse({
-    schemaVersion: 1,
-    vercelProfiles: {
-      ...Object.fromEntries(
-        Object.entries(existing.tokens).map(([name, existingToken]) => [
-          name,
-          { token: existingToken },
-        ]),
-      ),
-      [profileName]: { token },
-    },
-  });
-  const nextConfig = configSchema.parse({
-    schemaVersion: 1,
-    activeVercelProfile: profileName,
-    vercelProfiles: { ...existing.profiles, [profileName]: profile },
-  });
-
-  // Credentials are written first. A crash can leave an unreferenced token, but
-  // never an active profile whose credential has not reached disk.
-  await writePrivateJson(join(directory, CREDENTIALS_FILE), nextCredentials);
-  await writePrivateJson(join(directory, CONFIG_FILE), nextConfig);
-}
-
-export async function applyVercelProfile(
-  environment: NodeJS.ProcessEnv,
-  requestedProfile?: string,
-): Promise<NodeJS.ProcessEnv> {
-  const result = { ...environment };
-  const hasCompleteEnvironment = requiredEnvironmentKeys.every((key) => result[key]?.trim());
-  if (hasCompleteEnvironment && requestedProfile === undefined) {
-    return result;
-  }
-
-  const data = await loadVercelProfileData(selfBenchConfigDirectory(environment));
-  const profileName = selectProfileName(data, requestedProfile);
-  const profile = data.profiles[profileName];
-  const token = data.tokens[profileName];
-  if (!profile || !token) {
-    throw new Error(
-      `Vercel profile "${profileName}" is incomplete; rerun self-bench setup vercel --profile ${profileName}`,
-    );
-  }
-  assertCompatibleOverride("VERCEL_TEAM_ID", result.VERCEL_TEAM_ID, profile.teamId);
-  assertCompatibleOverride("VERCEL_PROJECT_ID", result.VERCEL_PROJECT_ID, profile.projectId);
-
-  result.VERCEL_TOKEN = result.VERCEL_TOKEN?.trim() || token;
-  result.VERCEL_TEAM_ID = result.VERCEL_TEAM_ID?.trim() || profile.teamId;
-  result.VERCEL_PROJECT_ID = result.VERCEL_PROJECT_ID?.trim() || profile.projectId;
-  result.SELFBENCH_VERCEL_IMAGE = result.SELFBENCH_VERCEL_IMAGE?.trim() || profile.image;
-  result.SELFBENCH_VERCEL_TIMEOUT_CAP = resolveProfileTimeoutCap(
-    result.SELFBENCH_VERCEL_TIMEOUT_CAP,
-    profile.timeoutCapMs,
-  );
-  return result;
-}
-
-export function profileFilePaths(directory = selfBenchConfigDirectory()): {
-  readonly config: string;
-  readonly credentials: string;
-} {
-  return {
-    config: join(directory, CONFIG_FILE),
-    credentials: join(directory, CREDENTIALS_FILE),
-  };
-}
-
-const requiredEnvironmentKeys = [
-  "VERCEL_TOKEN",
-  "VERCEL_TEAM_ID",
-  "VERCEL_PROJECT_ID",
-  "SELFBENCH_VERCEL_IMAGE",
-] as const;
-
-function selectProfileName(data: VercelProfileData, requestedProfile?: string): string {
-  if (requestedProfile !== undefined) {
-    return validateVercelProfileName(requestedProfile);
-  }
-  if (data.activeVercelProfile) {
-    return data.activeVercelProfile;
-  }
-  const names = Object.keys(data.profiles);
-  if (names.length === 1 && names[0]) {
-    return names[0];
-  }
-  throw new Error(
-    "Vercel is not configured; run self-bench setup vercel or provide VERCEL_TOKEN, VERCEL_TEAM_ID, VERCEL_PROJECT_ID, and SELFBENCH_VERCEL_IMAGE",
-  );
-}
-
-function resolveProfileTimeoutCap(value: string | undefined, verifiedCapMs: number): string {
-  const override = value?.trim();
-  if (!override) {
-    return `${verifiedCapMs}ms`;
-  }
-  const parsed = parseSandboxTimeoutCapText(override);
-  if (parsed === undefined || !Number.isInteger(parsed) || parsed < 100 || parsed > verifiedCapMs) {
-    throw new Error(
-      `SELFBENCH_VERCEL_TIMEOUT_CAP must be between 100ms and the selected profile's verified ${verifiedCapMs}ms ceiling`,
-    );
-  }
-  return override;
-}
-
-function assertCompatibleOverride(key: string, value: string | undefined, expected: string): void {
-  const override = value?.trim();
-  if (override && override !== expected) {
-    throw new Error(
-      `${key} does not match the selected Vercel profile; provide the complete Vercel environment instead of mixing project scopes`,
-    );
-  }
-}
-
-async function loadMutableProfileData(directory: string): Promise<MutableProfileData> {
-  await assertDirectoryIfPresent(directory);
-  const paths = profileFilePaths(directory);
-  const [rawConfig, rawCredentials] = await Promise.all([
-    readPrivateJson(paths.config),
-    readPrivateJson(paths.credentials),
-  ]);
-  const config = parseProfileDocument(paths.config, rawConfig, configSchema);
-  const credentials = parseProfileDocument(paths.credentials, rawCredentials, credentialsSchema);
-  return {
-    ...(config?.activeVercelProfile ? { activeVercelProfile: config.activeVercelProfile } : {}),
-    profiles: { ...(config?.vercelProfiles ?? {}) },
-    tokens: Object.fromEntries(
-      Object.entries(credentials?.vercelProfiles ?? {}).map(([name, value]) => [name, value.token]),
-    ),
-  };
-}
-
-function parseProfileDocument<T>(
-  path: string,
-  value: unknown | undefined,
-  schema: z.ZodType<T>,
-): T | undefined {
-  if (value === undefined) {
-    return undefined;
-  }
-  try {
-    return schema.parse(value);
-  } catch (error) {
-    throw new Error(
-      `SelfBench profile file has an incompatible format: ${path}. Move the file or set SELFBENCH_CONFIG_DIR to another directory.`,
-      { cause: error },
-    );
-  }
-}
-
-async function assertDirectoryIfPresent(directory: string): Promise<void> {
-  let stats: Stats;
-  try {
-    stats = await lstat(directory);
-  } catch (error) {
-    if (isFileNotFound(error)) {
-      return;
-    }
-    throw error;
-  }
-  if (!stats.isDirectory() || stats.isSymbolicLink()) {
-    throw new Error(
-      `SelfBench config path must be a directory, not a file or symlink: ${directory}`,
-    );
-  }
-}
-
-async function ensurePrivateDirectory(directory: string): Promise<void> {
-  await assertDirectoryIfPresent(directory);
-  await mkdir(directory, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
-  await chmod(directory, PRIVATE_DIRECTORY_MODE);
-}
-
-async function readPrivateJson(path: string): Promise<unknown | undefined> {
-  let stats: Stats;
-  try {
-    stats = await lstat(path);
-  } catch (error) {
-    if (isFileNotFound(error)) {
-      return undefined;
-    }
-    throw error;
-  }
-  if (!stats.isFile() || stats.isSymbolicLink()) {
-    throw new Error(`SelfBench profile path must be a regular file: ${path}`);
-  }
-  if ((stats.mode & 0o077) !== 0) {
-    throw new Error(`SelfBench profile file must be owner-only; run chmod 600 ${path}`);
-  }
-  try {
-    return JSON.parse(await readFile(path, "utf8"));
-  } catch (error) {
-    throw new Error(`Unable to parse SelfBench profile file ${path}`, { cause: error });
-  }
-}
-
-async function writePrivateJson(path: string, value: unknown): Promise<void> {
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
-    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, {
-      encoding: "utf8",
-      flag: "wx",
-      mode: PRIVATE_FILE_MODE,
-    });
-    await rename(temporary, path);
-    await chmod(path, PRIVATE_FILE_MODE);
-  } finally {
-    await rm(temporary, { force: true });
-  }
-}
-
-function isFileNotFound(error: unknown): boolean {
-  return error instanceof Error && "code" in error && error.code === "ENOENT";
-}

package/src/setup/vercel/runtime-image.ts

@@ -1,204 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { sha256 } from "../../hash.js";
-import type { CommandOutputHandler } from "../../process.js";
-import type { SetupPrompter } from "../../terminal-prompts.js";
-import type { SetupReporter } from "../../terminal-reporter.js";
-import type { VcrTag } from "./cli.js";
-
-export const DEFAULT_VCR_REPOSITORY = "selfbench-runtime";
-
-const IMAGE_TAG_PREFIX = "selfbench-";
-const IMAGE_PLATFORM = "linux/amd64";
-const IMAGE_READINESS_TIMEOUT_MS = 15 * 60 * 1_000;
-const IMAGE_POLL_INTERVAL_MS = 5_000;
-
-interface VcrScope {
-  readonly teamSlug: string;
-  readonly projectId: string;
-}
-
-export interface VercelRuntimeImageCli {
-  repositoryExists(input: VcrScope & { readonly repository: string }): Promise<boolean>;
-  createRepository(input: VcrScope & { readonly repository: string }): Promise<void>;
-  listTags(input: VcrScope & { readonly repository: string }): Promise<readonly VcrTag[]>;
-  inspectTag(
-    input: VcrScope & { readonly repository: string; readonly tag: string },
-  ): Promise<VcrTag | undefined>;
-  buildImage(
-    input: VcrScope & {
-      readonly repository: string;
-      readonly tag: string;
-      readonly projectRoot: string;
-      readonly onOutput?: CommandOutputHandler;
-    },
-  ): Promise<void>;
-}
-
-interface RuntimeImageServices {
-  readonly cli: VercelRuntimeImageCli;
-  readonly prompter: SetupPrompter;
-  readonly reporter: SetupReporter;
-  readonly sleep: (delayMs: number) => Promise<void>;
-}
-
-export interface VercelRuntimeImage {
-  readonly repository: string;
-  readonly image: string;
-  readonly published: boolean;
-}
-
-export async function ensureVercelRuntimeImage(input: {
-  readonly services: RuntimeImageServices;
-  readonly scope: VcrScope;
-  readonly projectRoot: string;
-  readonly fingerprint: string;
-  readonly preferredRepository: string;
-}): Promise<VercelRuntimeImage> {
-  const { services, scope, projectRoot, fingerprint } = input;
-  const tag = `${IMAGE_TAG_PREFIX}${fingerprint}`;
-  let repository = input.preferredRepository;
-
-  for (;;) {
-    if (!isValidVcrRepositoryName(repository)) {
-      throw new Error(`Invalid VCR repository name in saved profile: ${repository}`);
-    }
-    const exists = await services.cli.repositoryExists({ ...scope, repository });
-    if (!exists) {
-      try {
-        await services.cli.createRepository({ ...scope, repository });
-        break;
-      } catch (error) {
-        // A concurrent setup or a lost success response can leave the repository
-        // present. Re-inspect it before treating the operation as failed.
-        if (await services.cli.repositoryExists({ ...scope, repository })) {
-          continue;
-        }
-        throw error;
-      }
-    }
-
-    const tags = await services.cli.listTags({ ...scope, repository });
-    const compatible = tags.every((candidate) => candidate.tag.startsWith(IMAGE_TAG_PREFIX));
-    if (!compatible) {
-      services.reporter.warn(
-        `VCR repository "${repository}" contains unrelated images. SelfBench will not modify it.`,
-      );
-      repository = await requestVcrRepositoryName(services);
-      continue;
-    }
-
-    const matching = tags.find((candidate) => candidate.tag === tag);
-    if (matching) {
-      if (
-        matching.kind !== "index" &&
-        (matching.status === null || ["ready", "preparing"].includes(matching.status))
-      ) {
-        const ready = await services.reporter.task(
-          {
-            pending: "Checking the existing runtime image",
-            success: "Runtime image ready",
-            failure: "Runtime image check failed",
-          },
-          async () => await waitForReadyTag(services, { ...scope, repository, tag }, matching),
-        );
-        return {
-          repository,
-          image: `${repository}@${ready.manifestDigest}`,
-          published: false,
-        };
-      }
-      services.reporter.warn(
-        `Existing SelfBench image ${repository}:${tag} is ${tagState(matching)}; rebuilding it.`,
-      );
-      break;
-    }
-    break;
-  }
-
-  const ready = await services.reporter.task(
-    {
-      pending: `Building and publishing the ${IMAGE_PLATFORM} runtime image`,
-      success: "Runtime image published",
-      failure: "Runtime image publication failed",
-    },
-    async (onOutput) => {
-      await services.cli.buildImage({ ...scope, repository, tag, projectRoot, onOutput });
-      return await waitForReadyTag(services, { ...scope, repository, tag });
-    },
-  );
-  return {
-    repository,
-    image: `${repository}@${ready.manifestDigest}`,
-    published: true,
-  };
-}
-
-export async function vercelRuntimeFingerprint(projectRoot: string): Promise<string> {
-  const dockerfile = await readFile(resolve(projectRoot, "Dockerfile.sandbox"), "utf8");
-  if (/^\s*(?:ADD|COPY)\s/imu.test(dockerfile)) {
-    throw new Error(
-      "Dockerfile.sandbox now copies local files; update the VCR fingerprint inputs before publishing",
-    );
-  }
-  return sha256(
-    JSON.stringify({
-      schemaVersion: 2,
-      buildProvenance: false,
-      platform: IMAGE_PLATFORM,
-      dockerfile,
-    }),
-  );
-}
-
-async function waitForReadyTag(
-  services: RuntimeImageServices,
-  input: VcrScope & { readonly repository: string; readonly tag: string },
-  initial?: VcrTag,
-): Promise<VcrTag> {
-  const startedAt = Date.now();
-  let candidate = initial ?? (await services.cli.inspectTag(input));
-  for (;;) {
-    if (candidate?.kind === "index") {
-      throw new Error(
-        `VCR image ${input.repository}:${input.tag} is an OCI index; expected one linux/amd64 manifest`,
-      );
-    }
-    if (candidate?.status === "ready") {
-      return candidate;
-    }
-    if (candidate && candidate.status !== null && candidate.status !== "preparing") {
-      throw new Error(
-        `VCR image ${input.repository}:${input.tag} entered status ${candidate.status}`,
-      );
-    }
-    if (Date.now() - startedAt >= IMAGE_READINESS_TIMEOUT_MS) {
-      throw new Error(`VCR image ${input.repository}:${input.tag} was not ready within 15 minutes`);
-    }
-    await services.sleep(IMAGE_POLL_INTERVAL_MS);
-    candidate = await services.cli.inspectTag(input);
-  }
-}
-
-function tagState(tag: VcrTag): string {
-  if (tag.kind === "index") {
-    return "an unsupported OCI index";
-  }
-  return tag.status ?? "not yet classified by VCR";
-}
-
-function isValidVcrRepositoryName(value: string): boolean {
-  return /^[a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*$/.test(value);
-}
-
-async function requestVcrRepositoryName(services: RuntimeImageServices): Promise<string> {
-  for (;;) {
-    const value = (await services.prompter.text("Choose another VCR repository name")).trim();
-    if (isValidVcrRepositoryName(value)) {
-      return value;
-    }
-    services.reporter.warn(
-      "VCR repository names require lowercase letters or digits separated by dots, underscores, or hyphens.",
-    );
-  }
-}