thunderjar 0.1.3-preview-e09ffa1 → 0.1.3-preview-d23f868

package/dist/cli.js

@@ -2047,7 +2047,7 @@ var program = new Command;
 // package.json
 var package_default = {
   name: "thunderjar",
-  version: "0.1.3-preview-e09ffa1",
+  version: "0.1.3-preview-d23f868",
   type: "module",
   description: "Thunderjar",
   license: "MIT",
@@ -3451,9 +3451,194 @@ function createGenerateCommand() {
   }));
 }
 
-// src/cli/commands/init/scaffold.ts
+// src/cli/commands/init/init.ts
+var {$: $5 } = globalThis.Bun;
+
+// src/cli/commands/init/starterHarnesses.ts
 var declaration = (fn, body) => `import { ${fn} } from "thunderjar";
 
+export default ${fn}(${body});
+`;
+var models = (comment, entries) => `import { declareHarnessModels } from "thunderjar";
+
+${comment}
+export default declareHarnessModels({
+${entries.map(([name, id]) => `  ${JSON.stringify(name)}: ${JSON.stringify(id)},`).join(`
+`)}
+});
+`;
+var versions = (version) => declaration("declareHarnessVersions", `{
+  ${JSON.stringify(version)}: { version: ${JSON.stringify(version)} },
+}`);
+var claudeCodeTokenCosts = `import { claudeCodeTokenCosts, declareTokenCostCollector } from "thunderjar";
+
+export default declareTokenCostCollector((raw) => claudeCodeTokenCosts(raw));
+`;
+var stubTokenCosts = (agent) => `import { declareTokenCostCollector } from "thunderjar";
+
+// Thunderjar has no reader for ${agent}'s output yet. \`raw\` is what the harness's \`cli\` wrote to
+// its result path. To collect token costs, read them from it:
+//
+//   return {
+//     outcome: "collected",
+//     models: [{ model: ctx.modelId, inputTokens, outputTokens, cacheCreationTokens, cacheReadTokens }],
+//   };
+export default declareTokenCostCollector((_raw, _ctx) => ({ outcome: "unavailable", reason: "notReported" }));
+`;
+var installAsRoot = (install) => `\`RUN ${install}
+RUN mkdir -p /thunderjar && chown -R node:node /workspace /thunderjar
+USER node\``;
+var stubReply = `  // Thunderjar has no reader for this agent's reply yet. To measure it, return the agent's final
+  // reply from what \`cli\` wrote to its result path:
+  // collectReply: (raw) => \u2026,`;
+var claudeCode = `import { claudeCodeReply, declareHarness } from "thunderjar";
+
+// Claude Code, installed as root, then run as the image's non-root \`node\` user: it won't skip its
+// permission prompts as root, and nobody is there to answer them.
+export default declareHarness({
+  applyParameter: (_config, ctx) => \`RUN npm install -g @anthropic-ai/claude-code@\${ctx.version}
+RUN mkdir -p /thunderjar && chown -R node:node /workspace /thunderjar
+USER node\`,
+  // The prompt is read from its file, so quotes and newlines reach the agent intact. Turn 0 starts
+  // the session, and any later turn resumes it.
+  cli: (ctx) =>
+    \`claude -p "$(cat \${ctx.promptPath})" --model \${ctx.modelId} --output-format json --dangerously-skip-permissions\` +
+    \` \${ctx.turn === 0 ? "--session-id" : "--resume"} \${ctx.sessionId} > \${ctx.resultPath}\`,
+  collectReply: claudeCodeReply,
+  requiredEnv: ["ANTHROPIC_API_KEY"],
+});
+`;
+var claudeCodeDeepseek = `import { claudeCodeReply, declareHarness } from "thunderjar";
+
+// The claude-code harness, on DeepSeek's Anthropic-compatible API. DEEPSEEK_API_KEY is passed to
+// Claude Code as its auth token, and Claude Code's background requests go to DeepSeek too.
+//
+// Claude Code, installed as root, then run as the image's non-root \`node\` user: it won't skip its
+// permission prompts as root, and nobody is there to answer them.
+export default declareHarness({
+  applyParameter: (_config, ctx) => \`RUN npm install -g @anthropic-ai/claude-code@\${ctx.version}
+ENV ANTHROPIC_BASE_URL=https://api.deepseek.com/anthropic \\\\
+    ANTHROPIC_SMALL_FAST_MODEL=deepseek-chat \\\\
+    ANTHROPIC_DEFAULT_HAIKU_MODEL=deepseek-chat \\\\
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
+RUN mkdir -p /thunderjar && chown -R node:node /workspace /thunderjar
+USER node\`,
+  // The prompt is read from its file, so quotes and newlines reach the agent intact. Turn 0 starts
+  // the session, and any later turn resumes it.
+  cli: (ctx) =>
+    \`ANTHROPIC_AUTH_TOKEN="$DEEPSEEK_API_KEY" claude -p "$(cat \${ctx.promptPath})" --model \${ctx.modelId} --output-format json --dangerously-skip-permissions\` +
+    \` \${ctx.turn === 0 ? "--session-id" : "--resume"} \${ctx.sessionId} > \${ctx.resultPath}\`,
+  collectReply: claudeCodeReply,
+  requiredEnv: ["DEEPSEEK_API_KEY"],
+});
+`;
+var copilot = `import { declareHarness } from "thunderjar";
+
+// GitHub Copilot CLI. COPILOT_GITHUB_TOKEN is a GitHub token with Copilot access: a fine-grained
+// personal access token with the "Copilot Requests" permission.
+export default declareHarness({
+  applyParameter: (_config, ctx) => ${installAsRoot("npm install -g @github/copilot@${ctx.version}")},
+  // The prompt is read from its file, so quotes and newlines reach the agent intact. Any turn after
+  // the first continues the session.
+  cli: (ctx) =>
+    \`copilot -p "$(cat \${ctx.promptPath})" --model \${ctx.modelId} --allow-all-tools --no-color\` +
+    \`\${ctx.turn === 0 ? "" : " --continue"} > \${ctx.resultPath}\`,
+${stubReply}
+  requiredEnv: ["COPILOT_GITHUB_TOKEN"],
+});
+`;
+var codex = `import { declareHarness } from "thunderjar";
+
+// OpenAI's Codex CLI, without its sandbox or approvals: the container is the sandbox.
+export default declareHarness({
+  applyParameter: (_config, ctx) => ${installAsRoot("npm install -g @openai/codex@${ctx.version}")},
+  // The prompt is read from its file, so quotes and newlines reach the agent intact. Any turn after
+  // the first resumes the session.
+  cli: (ctx) =>
+    \`codex exec\${ctx.turn === 0 ? "" : " resume --last"} --model \${ctx.modelId} --json --dangerously-bypass-approvals-and-sandbox\` +
+    \` "$(cat \${ctx.promptPath})" > \${ctx.resultPath}\`,
+${stubReply}
+  requiredEnv: ["OPENAI_API_KEY"],
+});
+`;
+var opencode = `import { declareHarness } from "thunderjar";
+
+// OpenCode, on OpenCode Zen. OPENCODE_API_KEY is an OpenCode Zen key.
+export default declareHarness({
+  applyParameter: (_config, ctx) => ${installAsRoot("npm install -g opencode-ai@${ctx.version}")},
+  // The prompt is read from its file, so quotes and newlines reach the agent intact. Any turn after
+  // the first continues the session.
+  cli: (ctx) =>
+    \`opencode run --model \${ctx.modelId} --format json\${ctx.turn === 0 ? "" : " --continue"}\` +
+    \` "$(cat \${ctx.promptPath})" > \${ctx.resultPath}\`,
+${stubReply}
+  requiredEnv: ["OPENCODE_API_KEY"],
+});
+`;
+var CHECK = (where) => `// Models come and go: check ${where} for the current IDs.`;
+var STARTER_HARNESSES = {
+  "claude-code": {
+    "index.ts": claudeCode,
+    "models.ts": models(CHECK("https://docs.claude.com/en/docs/about-claude/models"), [
+      ["haiku-4-5", "claude-haiku-4-5-20251001"],
+      ["haiku-5-5", "claude-haiku-5-5"],
+      ["sonnet-5-5", "claude-sonnet-5-5"],
+      ["opus-5-5", "claude-opus-5-5"]
+    ]),
+    "versions.ts": versions("2.1.283"),
+    "collectTokenCosts.ts": claudeCodeTokenCosts
+  },
+  copilot: {
+    "index.ts": copilot,
+    "models.ts": models(`${CHECK("`copilot --help`, or GitHub's supported models page,")}
+// Which you can use depends on your Copilot plan and your organization's policy.`, [
+      ["gpt-6-1-sol", "gpt-6.1-sol"],
+      ["gpt-5-6-luna", "gpt-5.6-luna"],
+      ["gpt-5-5", "gpt-5.5"],
+      ["haiku-5-5", "claude-haiku-5.5"],
+      ["sonnet-5-5", "claude-sonnet-5.5"],
+      ["opus-5-5", "claude-opus-5.5"]
+    ]),
+    "versions.ts": versions("1.0.105"),
+    "collectTokenCosts.ts": stubTokenCosts("Copilot CLI")
+  },
+  codex: {
+    "index.ts": codex,
+    "models.ts": models(CHECK("https://developers.openai.com/codex/models"), [
+      ["gpt-6-1-sol", "gpt-6.1-sol"],
+      ["gpt-6-astra", "gpt-6-astra"],
+      ["gpt-6-luna", "gpt-6-luna"],
+      ["gpt-5-6-luna", "gpt-5.6-luna"],
+      ["gpt-5-5", "gpt-5.5"]
+    ]),
+    "versions.ts": versions("0.166.0"),
+    "collectTokenCosts.ts": stubTokenCosts("Codex")
+  },
+  "claude-code-deepseek": {
+    "index.ts": claudeCodeDeepseek,
+    "models.ts": models(CHECK("https://api-docs.deepseek.com/quick_start/pricing"), [
+      ["deepseek-chat", "deepseek-chat"],
+      ["deepseek-reasoner", "deepseek-reasoner"]
+    ]),
+    "versions.ts": versions("2.1.283"),
+    "collectTokenCosts.ts": claudeCodeTokenCosts
+  },
+  opencode: {
+    "index.ts": opencode,
+    "models.ts": models(CHECK("https://opencode.ai/zen/v1/models"), [
+      ["opus-5", "opencode/claude-opus-5"],
+      ["gpt-5-6-luna", "opencode/gpt-5.6-luna"],
+      ["gpt-5-5", "opencode/gpt-5.5"],
+      ["deepseek-v4-pro", "opencode/deepseek-v4-pro"]
+    ]),
+    "versions.ts": versions("1.19.5"),
+    "collectTokenCosts.ts": stubTokenCosts("OpenCode")
+  }
+};
+
+// src/cli/commands/init/scaffold.ts
+var declaration2 = (fn, body) => `import { ${fn} } from "thunderjar";
+
 export default ${fn}(${body});
 `;
 var json = (value) => JSON.stringify(value, null, 2) + `
@@ -3478,7 +3663,7 @@ var tsconfig = json({
   include: ["**/*.ts"],
   exclude: ["node_modules", ".data", "**/*.template.ts"]
 });
-var testCase = declaration("declareTestCase", `{
+var testCase = declaration2("declareTestCase", `{
   baseImage: ["node20"],
   codeState: ["baseline"],
   promptSet: ["snerk"],
@@ -3487,47 +3672,70 @@ var testCase = declaration("declareTestCase", `{
   initialPrompt: ["plain"],
   iterations: 1,
 }`);
-var baseImage = declaration("declareBaseImage", `{
+var baseImage = declaration2("declareBaseImage", `{
   applyParameter: () => \`FROM node:20-bookworm\`,
 }`);
-var harness = `import { claudeCodeReply, declareHarness } from "thunderjar";
-
-// Claude Code, installed as root, then run as the image's non-root \`node\` user: it won't skip its
-// permission prompts as root, and nobody is there to answer them.
-export default declareHarness({
-  applyParameter: (_config, ctx) => \`RUN npm install -g @anthropic-ai/claude-code@\${ctx.version}
-RUN mkdir -p /thunderjar && chown -R node:node /workspace /thunderjar
-USER node\`,
-  // The prompt is read from its file, so quotes and newlines reach the agent intact. Turn 0 starts
-  // the session, and any later turn resumes it.
-  cli: (ctx) =>
-    \`claude -p "$(cat \${ctx.promptPath})" --model \${ctx.modelId} --output-format json --dangerously-skip-permissions\` +
-    \` \${ctx.turn === 0 ? "--session-id" : "--resume"} \${ctx.sessionId} > \${ctx.resultPath}\`,
-  collectReply: claudeCodeReply,
-  requiredEnv: ["ANTHROPIC_API_KEY"],
-});
-`;
-var harnessModels = declaration("declareHarnessModels", `{
-  "haiku-4-5": "claude-haiku-4-5-20251001",
-}`);
-var harnessVersions = declaration("declareHarnessVersions", `{
-  "2.1.283": { version: "2.1.283" },
-}`);
-var collectTokenCosts = `import { claudeCodeTokenCosts, declareTokenCostCollector } from "thunderjar";
-
-export default declareTokenCostCollector((raw) => claudeCodeTokenCosts(raw));
-`;
-var initialPrompt = declaration("declareInitialPrompt", `{
+var initialPrompt = declaration2("declareInitialPrompt", `{
   prompt: "Create a file isPrime.ts exporting a function that tests for primality.",
   timeoutSeconds: 600,
 }`);
-var measurement = declaration("declareMeasurement", `{
+var measurement = declaration2("declareMeasurement", `{
   instrument: "fileCreated",
   config: { glob: "**/isPrime.ts" },
   aggregate: ["rate"],
 }`);
+var codeState = (head) => head ? `import { checkoutCommit, declareCodeState } from "thunderjar";
+
+// The project's repository at a commit, checked out into /workspace. The commit must be in the
+// repository: commit it, or Thunderjar can't build it.
+export default declareCodeState({
+  config: { commit: "${head}" },
+  applyParameter: (config, ctx) => checkoutCommit(ctx, config.commit),
+});
+` : `import { declareCodeState } from "thunderjar";
+
+// An empty /workspace. The project wasn't a git repository when \`thunderjar init\` ran. Once it is,
+// check a commit of it out into /workspace:
+//
+//   import { checkoutCommit, declareCodeState } from "thunderjar";
+//
+//   export default declareCodeState({
+//     config: { commit: "<a commit hash>" },
+//     applyParameter: (config, ctx) => checkoutCommit(ctx, config.commit),
+//   });
+export default declareCodeState({});
+`;
+var snerk = (head) => `import { declarePromptSet } from "thunderjar";
+
+// Files from a commit of the project's repository, such as its AGENTS.md or skills, copied into
+// /workspace at the same paths, like \`git checkout <commit> -- <paths>\`. They're left uncommitted.
+// Each path is from the repository's root, e.g. "AGENTS.md" or ".agents/skills/review/SKILL.md".
+export default declarePromptSet<{ commit: string; paths: string[] }>({
+  config: {
+    commit: "${head ?? "<a commit hash>"}",
+    paths: [],
+  },
+  applyParameter: (config, ctx) =>
+    config.paths.map((path) => \`COPY \${ctx.git.show(config.commit, path)} /workspace/\${path}\`).join("\\n"),
+});
+`;
+var houseStyle = `import { declarePromptSet } from "thunderjar";
+
+// The files in this folder's files/, copied over /workspace and committed, so the agent's changes
+// can be told from them. \`git add -A\`, not \`git commit -a\`, which skips new files such as a new
+// skill. Use it with a code state that checks out a commit, so /workspace is a git repository.
+export default declarePromptSet({
+  applyParameter: (_config, ctx) => \`COPY \${ctx.dir}/files/ /workspace/
+RUN cd /workspace && git add -A && git commit --quiet -m "Thunderjar: apply promptSet"\`,
+});
+`;
+var houseStyleAgentsMd = `# House style
+
+- Write TypeScript, with strict types.
+- Add a test beside each new module.
+`;
 var P = "test-case-parameters";
-function scaffold({ nestedPackage }) {
+function scaffold({ nestedPackage, head }) {
   return {
     ...nestedPackage && {
       "package.json": json({ name: "thunderjar-config", private: true, type: "module", dependencies: { thunderjar: "latest" } })
@@ -3539,12 +3747,11 @@ function scaffold({ nestedPackage }) {
     "thunderjar.config.ts": config,
     "test-cases/example.ts": testCase,
     [`${P}/baseImages/node20/index.ts`]: baseImage,
-    [`${P}/codeStates/baseline/index.ts`]: declaration("declareCodeState", "{}"),
-    [`${P}/promptSets/snerk/index.ts`]: declaration("declarePromptSet", "{}"),
-    [`${P}/harnessModels/claude-code/index.ts`]: harness,
-    [`${P}/harnessModels/claude-code/models.ts`]: harnessModels,
-    [`${P}/harnessModels/claude-code/versions.ts`]: harnessVersions,
-    [`${P}/harnessModels/claude-code/collectTokenCosts.ts`]: collectTokenCosts,
+    [`${P}/codeStates/baseline/index.ts`]: codeState(head),
+    [`${P}/promptSets/snerk/index.ts`]: snerk(head),
+    [`${P}/promptSets/house-style/index.ts`]: houseStyle,
+    [`${P}/promptSets/house-style/files/AGENTS.md`]: houseStyleAgentsMd,
+    ...Object.fromEntries(Object.entries(STARTER_HARNESSES).flatMap(([harness, files]) => Object.entries(files).map(([file, content]) => [`${P}/harnessModels/${harness}/${file}`, content]))),
     [`${P}/tasks/is-prime/initial-prompts/plain.ts`]: initialPrompt,
     [`${P}/tasks/is-prime/measurements/isPrimeTsExists.ts`]: measurement
   };
@@ -3559,12 +3766,17 @@ async function isDirectory2(path2) {
     return false;
   }
 }
+async function headCommit(dir) {
+  const result = await $5`git rev-parse --verify --quiet HEAD`.cwd(dir).quiet().nothrow();
+  return result.exitCode === 0 ? result.stdout.toString().trim() : undefined;
+}
 async function init(projectDir) {
   const root = `${projectDir}/${FOLDER2}`;
   const createdFolder = !await isDirectory2(root);
   const nestedPackage = !await Bun.file(`${projectDir}/package.json`).exists();
+  const head = await headCommit(projectDir);
   const result = { createdFolder, created: [], existing: [] };
-  for (const [path2, content] of Object.entries(scaffold({ nestedPackage }))) {
+  for (const [path2, content] of Object.entries(scaffold({ nestedPackage, head }))) {
     const file = Bun.file(`${root}/${path2}`);
     if (await file.exists()) {
       result.existing.push(path2);
@@ -3576,7 +3788,7 @@ async function init(projectDir) {
   return result;
 }
 function createInitCommand() {
-  return new Command("init").description("Scaffold the .thunderjar/ configuration folder in the current directory, with an example test case. Existing files are left as they are.").action(async () => {
+  return new Command("init").description("Scaffold the .thunderjar/ configuration folder in the current directory, with an example test case, and starter prompt sets and harnesses to copy. Existing files are left as they are.").action(async () => {
     const { createdFolder, created, existing } = await init(process.cwd());
     if (createdFolder)
       console.log(`Created ${FOLDER2}/`);
@@ -3657,7 +3869,7 @@ var promptsOf = (initialPrompt2) => initialPrompt2.turns ?? [initialPrompt2.prom
 async function loadHarness(root, task, permutation, problems) {
   const { harness: name, version, model } = parsePair(permutation.harnessModel);
   const dir = `${PARAMETERS}/harnessModels/${name}`;
-  const [baseImage2, harness2, collectTokenCosts2, versions, models, initialPrompt2] = await Promise.all([
+  const [baseImage2, harness, collectTokenCosts, versions2, models2, initialPrompt2] = await Promise.all([
     loadDeclaration(root, `${PARAMETERS}/baseImages/${permutation.baseImage}/index.ts`, "declareBaseImage", problems),
     loadDeclaration(root, `${dir}/index.ts`, "declareHarness", problems),
     loadDeclaration(root, `${dir}/collectTokenCosts.ts`, "declareTokenCostCollector", problems),
@@ -3665,16 +3877,16 @@ async function loadHarness(root, task, permutation, problems) {
     loadDeclaration(root, `${dir}/models.ts`, "declareHarnessModels", problems),
     loadDeclaration(root, `${PARAMETERS}/tasks/${task}/initial-prompts/${permutation.initialPrompt}.ts`, "declareInitialPrompt", problems)
   ]);
-  if (!baseImage2 || !harness2 || !collectTokenCosts2 || !versions || !models || !initialPrompt2)
+  if (!baseImage2 || !harness || !collectTokenCosts || !versions2 || !models2 || !initialPrompt2)
     return;
-  const pinned = versions[version].version;
-  return { baseImage: baseImage2, harness: harness2, collectTokenCosts: collectTokenCosts2, version: pinned, modelId: models[model], initialPrompt: initialPrompt2 };
+  const pinned = versions2[version].version;
+  return { baseImage: baseImage2, harness, collectTokenCosts, version: pinned, modelId: models2[model], initialPrompt: initialPrompt2 };
 }
-function planTurns({ harness: harness2, version, modelId, initialPrompt: initialPrompt2 }, sessionId) {
+function planTurns({ harness, version, modelId, initialPrompt: initialPrompt2 }, sessionId) {
   const prompts = promptsOf(initialPrompt2);
   return prompts.map((prompt, turn) => {
     const paths = turnPaths(turn, prompts.length);
-    const command = harness2.cli({ version, modelId, initialPrompt: prompt, ...paths, turn, sessionId });
+    const command = harness.cli({ version, modelId, initialPrompt: prompt, ...paths, turn, sessionId });
     return { prompt, ...paths, command };
   });
 }
@@ -3799,8 +4011,8 @@ var message = (error) => error instanceof Error ? error.message : String(error);
 var recordable = (result) => result.outcome === "erroredWhileMeasuring" ? { outcome: "erroredWhileMeasuring", error: { message: message(result.error) } } : result;
 async function measureContainerRun(measurements, open, now = () => new Date) {
   const result = {};
-  for (const { name, declaration: declaration2, config: config2, contentHash } of measurements) {
-    const instrument = instruments[declaration2.instrument];
+  for (const { name, declaration: declaration3, config: config2, contentHash } of measurements) {
+    const instrument = instruments[declaration3.instrument];
     const ctx = await open(instrument.usesContainer !== false);
     let outcome;
     try {
@@ -3810,7 +4022,7 @@ async function measureContainerRun(measurements, open, now = () => new Date) {
     } finally {
       await ctx.close();
     }
-    result[name] = { instrument: declaration2.instrument, contentHash, measuredAt: now().toISOString(), outcome };
+    result[name] = { instrument: declaration3.instrument, contentHash, measuredAt: now().toISOString(), outcome };
   }
   return result;
 }
@@ -3925,7 +4137,7 @@ function add(a, b) {
     ...costBasis !== undefined && { costBasis }
   };
 }
-function collectTokenCosts2(collect, harnessResults, ctx) {
+function collectTokenCosts(collect, harnessResults, ctx) {
   const all = harnessResults.map((raw) => collectOne(collect, raw, ctx));
   const collected = all.filter((costs) => costs.outcome === "collected");
   if (collected.length === 0)
@@ -3943,7 +4155,7 @@ function collectTokenCosts2(collect, harnessResults, ctx) {
 // src/execution/runExecution.ts
 function containerRunRecord({ plan: plan2, name, testCase: testCase2 }, { number: permutationNumber, permutation }, iteration, execution, turns, tokenCosts) {
   const last = turns.at(-1);
-  const { harness: harness2, version, model } = parsePair(permutation.harnessModel);
+  const { harness, version, model } = parsePair(permutation.harnessModel);
   return {
     executionId: plan2.executionId,
     testCase: name,
@@ -3954,7 +4166,7 @@ function containerRunRecord({ plan: plan2, name, testCase: testCase2 }, { number
     postrunImage: iteration.postrunImage,
     ranAt: new Date(execution.startedAt).toISOString(),
     parameters: Object.fromEntries(AXES.map((axis) => [axis, { name: permutation[axis], parameterHash: permutation.parameterHashes[axis] }])),
-    harnessModel: { harness: harness2, version, model, modelId: permutation.modelId },
+    harnessModel: { harness, version, model, modelId: permutation.modelId },
     execution,
     harnessResult: last.harnessResult,
     reply: last.reply,
@@ -3996,7 +4208,7 @@ async function runExecution(run, store, hooks = {}) {
           container
         });
         const turns = harnessResults.map((harnessResult2) => ({ harnessResult: harnessResult2, reply: collectReply(permutation.harness.collectReply, harnessResult2) }));
-        const tokenCosts = collectTokenCosts2(permutation.collectTokenCosts, harnessResults, {
+        const tokenCosts = collectTokenCosts(permutation.collectTokenCosts, harnessResults, {
           version: permutation.version,
           modelId: permutation.modelId
         });
@@ -4084,8 +4296,8 @@ var showMeasures = (result) => Object.entries(result).map(([name, { outcome }])
 function label(testCase2, { permutation }) {
   const varying = AXES.filter((axis) => axis !== "harnessModel" && axis !== "initialPrompt" && testCase2[axis].length > 1);
   const harnesses = new Set(testCase2.harnessModel.map((pair) => parsePair(pair).harness));
-  const harness2 = harnesses.size === testCase2.harnessModel.length ? parsePair(permutation.harnessModel).harness : permutation.harnessModel;
-  return [...varying.map((axis) => permutation[axis]), harness2, permutation.initialPrompt].join(" | ");
+  const harness = harnesses.size === testCase2.harnessModel.length ? parsePair(permutation.harnessModel).harness : permutation.harnessModel;
+  return [...varying.map((axis) => permutation[axis]), harness, permutation.initialPrompt].join(" | ");
 }
 async function run(cwd, name, imagePrefix, dataDir) {
   const root = await findThunderjarRoot(cwd);
@@ -4202,12 +4414,12 @@ function aggregateValues(values, methods) {
   };
 }
 function aggregatePermutation(runs, measurements) {
-  return Object.fromEntries(measurements.map(({ name, declaration: declaration2 }) => {
+  return Object.fromEntries(measurements.map(({ name, declaration: declaration3 }) => {
     const values = runs.flatMap(({ result }) => {
       const outcome = result[name]?.outcome;
       return outcome?.outcome === "measured" ? [outcome.data] : [];
     });
-    const combined = aggregateValues(values, declaration2.aggregate);
+    const combined = aggregateValues(values, declaration3.aggregate);
     const measure = "incompatible" in combined ? { measured: values.length, values: {}, incompatible: combined.incompatible } : { measured: values.length, values: combined.values };
     return [name, measure];
   }));
@@ -4285,7 +4497,7 @@ function varyingAxes(runs) {
 }
 function permutationTable(execution, runs, measurements) {
   const axes = varyingAxes(runs);
-  const methodColumns = measurements.flatMap(({ name, declaration: declaration2 }) => declaration2.aggregate.map((method, i) => ({ name, method, first: i === 0 })));
+  const methodColumns = measurements.flatMap(({ name, declaration: declaration3 }) => declaration3.aggregate.map((method, i) => ({ name, method, first: i === 0 })));
   const numberWidth = String(execution.matrix.permutations).length;
   const withCosts = runs.some(({ tokenCosts }) => tokenCosts !== undefined);
   const rows = [];
@@ -4336,9 +4548,9 @@ function permutationTable(execution, runs, measurements) {
   }
   const header = ["", axes.join(" | "), "runs", ...methodColumns.map(({ method }) => method), ...withCosts ? ["tokens (mean)", "cost (mean)"] : []];
   const widths = header.map((cell, i) => Math.max(cell.length, ...rows.map((row) => row[i]?.length ?? 0)));
-  for (const { name, declaration: declaration2 } of measurements) {
+  for (const { name, declaration: declaration3 } of measurements) {
     const start = 3 + methodColumns.findIndex((column2) => column2.name === name);
-    const end = start + declaration2.aggregate.length - 1;
+    const end = start + declaration3.aggregate.length - 1;
     const span = widths.slice(start, end + 1).reduce((a, b) => a + b, 0) + GAP.length * (end - start);
     if (span < name.length)
       widths[end] += name.length - span;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thunderjar",
-  "version": "0.1.3-preview-e09ffa1",
+  "version": "0.1.3-preview-d23f868",
   "type": "module",
   "description": "Thunderjar",
   "license": "MIT",

package/src/api/declarations.ts

@@ -79,6 +79,9 @@ export type BaseImageDeclaration<C = unknown> = Applies<C, ApplyParameterCtx> &
    * namespaces: `["--security-opt", "seccomp=unconfined", "--security-opt", "apparmor=unconfined"]`.
    * Each option and value is its own string. Ask for the least you need: `--privileged` works, but
    * gives the agent the whole machine.
+   *
+   * Some hosts forbid what no option can allow. Ubuntu 23.10 and later stop unconfined processes
+   * making user namespaces until `sysctl kernel.apparmor_restrict_unprivileged_userns=0`.
    */
   runOptions?: string[];
 };