wip v28

Author: geraldarthurdavis

.gitignore

@@ -89,3 +89,5 @@ uapi/tailwind.config.js
 
 # Miscellaneous
 .tmp/
+.vercel
+.env*.local

package.json

@@ -2,6 +2,7 @@
   "private": true,
   "name": "bitcode-monorepo",
   "version": "0.0.0",
+  "packageManager": "pnpm@10.33.0",
   "engines": {
     "node": ">=21"
   },

packages/agent-generics/src/substeps/factories.ts

@@ -683,7 +683,7 @@ export function factoryReason<T>(): Executor<T, T & { reasoning: Reasoning }> {
     GenerationSubMetaSubStep.REASON,
     {
       buildUserPrompt: (input) => {
-        const typedInput = input as any;
+        const typedInput = input && typeof input === 'object' ? input as any : {};
         // Check context to provide appropriate reasoning prompt
         const isStitch = typedInput.partialOutput !== undefined;
         const isSum = typedInput.chunkResults !== undefined;
@@ -694,7 +694,7 @@ export function factoryReason<T>(): Executor<T, T & { reasoning: Reasoning }> {
         if (isSum) {
           return `Reason about how to combine these chunk results:\n\n${JSON.stringify(typedInput.chunkResults, null, 2)}`;
         }
-        return `Apply logical reasoning to solve:\n\n${JSON.stringify(input, null, 2)}`;
+        return `Apply logical reasoning to solve:\n\n${JSON.stringify(input ?? null, null, 2)}`;
       },
 
       parseOutput: async (output, input) => {

packages/pipeline-hosts/README.md

@@ -38,6 +38,11 @@ return `blocked_readiness` rather than a worthy fit.
 The exported evidence must include the AssetPack embedding policy
 (`text-embedding-3-small`, `1536` dimensions, cosine
 `match_deliverable_vectors`) so SQL readback can detect vector-space drift.
+The harness prepares the repo-pinned `pnpm` runtime before installing so
+Corepack's latest release cannot drift the frozen lockfile contract. Runtime
+helpers used only by the harness are installed under `.bitcode/pipeline-harness`
+so historical deposited source revisions do not need to carry newer harness
+dependencies.
 
 Structured database telemetry is part of the harness contract. A real Read/Fit
 pipeline run must write the deliverable hierarchy:

packages/pipeline-hosts/src/__tests__/asset-pack-harness.test.ts

@@ -70,8 +70,13 @@ describe('asset-pack sandbox harness plan', () => {
       'runtime-readiness',
       'package-manager-readiness',
       'workspace-install',
+      'harness-runtime-install',
       'asset-pack-pipeline-run',
     ]);
+    expect(plan.commands.find((command) => command.label === 'package-manager-readiness')).toMatchObject({
+      cmd: 'corepack',
+      args: ['prepare', 'pnpm@10.33.0', '--activate'],
+    });
   });
 
   it('generates a syntactically valid live pipeline runner', () => {

packages/pipeline-hosts/src/asset-pack-harness.ts

@@ -20,8 +20,10 @@ const HOST_SMOKE_RUNNER_PATH = `${HARNESS_DIRECTORY}/run-host-smoke.mjs`;
 const LIVE_PIPELINE_RUNNER_PATH = `${HARNESS_DIRECTORY}/run-live-asset-pack-pipeline.ts`;
 const EVIDENCE_PATH = `${HARNESS_DIRECTORY}/evidence.json`;
 const TELEMETRY_PATH = `${HARNESS_DIRECTORY}/telemetry.jsonl`;
+const TSCONFIG_PATHS_REGISTER_PATH = `${HARNESS_DIRECTORY}/node_modules/tsconfig-paths/register`;
 const SANDBOX_WORKING_DIRECTORY = '/vercel/sandbox';
 const DEFAULT_LONG_TIMEOUT_MS = 45 * 60 * 1000;
+const SANDBOX_PNPM_VERSION = '10.33.0';
 
 export interface BuildAssetPackSandboxHarnessOptions {
   mode?: PipelineHarnessMode;
@@ -116,7 +118,7 @@ function buildCommands(
     commands.push({
       label: 'package-manager-readiness',
       cmd: 'corepack',
-      args: ['enable'],
+      args: ['prepare', `pnpm@${SANDBOX_PNPM_VERSION}`, '--activate'],
       required: true,
     });
 
@@ -129,6 +131,13 @@ function buildCommands(
       });
     }
 
+    commands.push({
+      label: 'harness-runtime-install',
+      cmd: 'npm',
+      args: ['install', '--prefix', HARNESS_DIRECTORY, 'tsconfig-paths@4.2.0'],
+      required: true,
+    });
+
     commands.push({
       label: 'asset-pack-pipeline-run',
       cmd: 'pnpm',
@@ -137,6 +146,10 @@ function buildCommands(
         '@bitcode/pipeline-hosts',
         'exec',
         'ts-node',
+        '--project',
+        '../../tsconfig.json',
+        '-r',
+        `../../${TSCONFIG_PATHS_REGISTER_PATH}`,
         '--transpile-only',
         `../../${LIVE_PIPELINE_RUNNER_PATH}`,
       ],
@@ -229,18 +242,16 @@ await writeFile(\`\${artifactDir}/evidence.json\`, JSON.stringify(evidence, null
 function createLiveAssetPackPipelineRunner(): string {
   return `import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
-import { assetPackPipeline } from '../../packages/pipelines/asset-pack/src/index';
-import { enablePipelineStreaming, factoryPipelineExecution } from '../../packages/pipelines-generics/src/index';
 
 const manifestPath = process.env.BITCODE_PIPELINE_HARNESS_MANIFEST || '${MANIFEST_PATH}';
 const artifactDir = process.env.BITCODE_PIPELINE_HARNESS_ARTIFACT_DIR || '${HARNESS_DIRECTORY}';
-const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
 const runId = process.env.BITCODE_PIPELINE_RUN_ID || randomUUID();
 const DEFAULT_USER_ID = '00000000-0000-4000-8000-000000000000';
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-let userId = process.env.BITCODE_PIPELINE_USER_ID || manifest.deposit?.userId || DEFAULT_USER_ID;
 const startedAt = new Date().toISOString();
-const manifestRoot = createHash('sha256').update(JSON.stringify(manifest)).digest('hex');
+let manifest = null;
+let manifestRoot = null;
+let userId = process.env.BITCODE_PIPELINE_USER_ID || DEFAULT_USER_ID;
 const events = [];
 let resultState = 'blocked_readiness';
 let output = null;
@@ -334,14 +345,14 @@ async function insertPipelineRun() {
       started_at: startedAt,
       metadata: {
         bitcodePipelineHarness: true,
-        harnessMode: manifest.harnessMode,
+        harnessMode: manifest?.harnessMode || 'asset_pack_pipeline',
         manifestRoot,
-        sourceRevision: manifest.sourceRevision,
+        sourceRevision: manifest?.sourceRevision || null,
       },
       input: {
-        read: manifest.read,
-        deposit: manifest.deposit,
-        sourceRevision: manifest.sourceRevision,
+        read: manifest?.read || null,
+        deposit: manifest?.deposit || null,
+        sourceRevision: manifest?.sourceRevision || null,
       },
     }).select('id').single();
     if (insertError) {
@@ -444,17 +455,25 @@ async function insertHarnessStreamLog(status) {
         status,
         resultState,
         manifestRoot,
-        harnessMode: manifest.harnessMode,
+        harnessMode: manifest?.harnessMode || 'asset_pack_pipeline',
       },
     });
   } catch (persistError) {
     record({ type: 'stream-log-persist-blocked', stage: 'telemetry-readback', error: persistError?.message || String(persistError) });
   }
 }
 
+async function main() {
 await mkdir(artifactDir, { recursive: true });
 
 try {
+  manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  manifestRoot = createHash('sha256').update(JSON.stringify(manifest)).digest('hex');
+  userId = process.env.BITCODE_PIPELINE_USER_ID || manifest.deposit?.userId || DEFAULT_USER_ID;
+  const [{ assetPackPipeline }, { enablePipelineStreaming, factoryPipelineExecution }] = await Promise.all([
+    import('../../packages/pipelines/asset-pack/src/index'),
+    import('../../packages/pipelines-generics/src/index'),
+  ]);
   const execution = factoryPipelineExecution('asset_pack', undefined, {
     pipelineName: 'asset_pack',
     family: 'asset_pack',
@@ -548,7 +567,7 @@ try {
 
   const evidence = {
     schema: 'bitcode.pipeline-harness.evidence',
-    harnessMode: manifest.harnessMode,
+    harnessMode: manifest?.harnessMode || 'asset_pack_pipeline',
     resultState: 'blocked_readiness',
     resultReasons: [
       'AssetPack pipeline execution did not produce admissible commercial result evidence.',
@@ -577,5 +596,12 @@ try {
   await insertHarnessStreamLog(process.exitCode ? 'failed' : 'completed');
   await writeFile(\`\${artifactDir}/telemetry.jsonl\`, events.map((event) => JSON.stringify(event)).join('\\n') + '\\n');
 }
+
+}
+
+main().catch((caught) => {
+  process.stderr.write(\`\${caught?.message || String(caught)}\\n\`);
+  process.exitCode = 1;
+});
 `;
 }

packages/pipeline-hosts/src/dev/run-asset-pack-sandbox-harness.ts

@@ -22,19 +22,36 @@ const TRUSTED_SANDBOX_ENV_KEYS = [
   'BITCODE_PIPELINE_USER_ID',
 ] as const;
 
+const REDACTED_OUTPUT_ENV_KEYS = [
+  ...TRUSTED_SANDBOX_ENV_KEYS,
+  'BITCODE_SANDBOX_SOURCE_GIT_PASSWORD',
+  'GITHUB_TOKEN',
+  'GITHUB_PAT',
+  'GH_TOKEN',
+  'VERCEL_OIDC_TOKEN',
+  'VERCEL_TOKEN',
+] as const;
+
 function loadLocalEnvFiles(): void {
-  for (const relativePath of ['.env.local', 'uapi/.env.local']) {
-    const path = resolve(process.cwd(), relativePath);
-    if (!existsSync(path)) continue;
-    const body = readFileSync(path, 'utf8');
-    for (const line of body.split(/\r?\n/)) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith('#')) continue;
-      const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(trimmed);
-      if (!match) continue;
-      const [, key, rawValue] = match;
-      if (process.env[key] !== undefined) continue;
-      process.env[key] = rawValue.trim().replace(/^(['"])(.*)\1$/, '$2');
+  const roots = [process.cwd(), resolve(process.cwd(), '..'), resolve(process.cwd(), '../..')];
+  const seen = new Set<string>();
+
+  for (const root of roots) {
+    for (const relativePath of ['.env.local', 'uapi/.env.local']) {
+      const path = resolve(root, relativePath);
+      if (seen.has(path)) continue;
+      seen.add(path);
+      if (!existsSync(path)) continue;
+      const body = readFileSync(path, 'utf8');
+      for (const line of body.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) continue;
+        const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(trimmed);
+        if (!match) continue;
+        const [, key, rawValue] = match;
+        if (process.env[key] !== undefined) continue;
+        process.env[key] = rawValue.trim().replace(/^(['"])(.*)\1$/, '$2');
+      }
     }
   }
 }
@@ -102,6 +119,48 @@ function sourceCredentials(): { username?: string; password?: string } {
   };
 }
 
+function redactKnownSecrets(text: string): string {
+  let redacted = text;
+  for (const key of REDACTED_OUTPUT_ENV_KEYS) {
+    const value = process.env[key];
+    if (typeof value !== 'string' || value.length < 8) continue;
+    redacted = redacted.split(value).join('[redacted]');
+  }
+  return redacted;
+}
+
+function summarizeEvidence(evidence: unknown): Record<string, unknown> | null {
+  if (!evidence || typeof evidence !== 'object' || Array.isArray(evidence)) return null;
+  const record = evidence as Record<string, unknown>;
+  const error = record.error && typeof record.error === 'object'
+    ? record.error as Record<string, unknown>
+    : null;
+  const events = Array.isArray(record.events) ? record.events : [];
+
+  return {
+    schema: record.schema,
+    harnessMode: record.harnessMode,
+    resultState: record.resultState,
+    resultReasons: Array.isArray(record.resultReasons)
+      ? record.resultReasons.map((reason) => redactKnownSecrets(String(reason)))
+      : [],
+    error: error
+      ? {
+          name: error.name,
+          message: redactKnownSecrets(String(error.message || '')),
+        }
+      : null,
+    outputKeys: record.output && typeof record.output === 'object'
+      ? Object.keys(record.output as Record<string, unknown>)
+      : [],
+    eventTypes: events
+      .map((event) => event && typeof event === 'object'
+        ? (event as Record<string, unknown>).type
+        : null)
+      .filter(Boolean),
+  };
+}
+
 async function main(): Promise<void> {
   loadLocalEnvFiles();
   requireHarnessOptIn();
@@ -166,8 +225,18 @@ async function main(): Promise<void> {
           label: command.label,
           exitCode: command.exitCode,
         })),
+        commands: result.commands.map((command) => ({
+          label: command.label,
+          exitCode: command.exitCode,
+          stdoutTail: redactKnownSecrets(command.stdout.slice(-1200)),
+          stderrTail: redactKnownSecrets(command.stderr.slice(-1200)),
+        })),
         evidencePresent: result.artifacts.evidence !== null,
         telemetryPresent: result.artifacts.telemetry !== null,
+        evidence: summarizeEvidence(result.artifacts.evidence),
+        telemetryLineCount: result.artifacts.telemetry
+          ? result.artifacts.telemetry.split(/\r?\n/).filter(Boolean).length
+          : 0,
       },
       null,
       2

packages/pipeline-hosts/src/vercel-sandbox-host.ts

@@ -184,10 +184,7 @@ function withVercelAccessTokenAuth(createOptions: PipelineHarnessPlan['createOpt
 }
 
 export async function loadVercelSandboxFactory(): Promise<SandboxFactory> {
-  const dynamicImport = new Function('specifier', 'return import(specifier)') as (
-    specifier: string
-  ) => Promise<{ Sandbox?: SandboxFactory }>;
-  const module = await dynamicImport('@vercel/sandbox');
+  const module = await import('@vercel/sandbox') as { Sandbox?: SandboxFactory };
   if (!module.Sandbox?.create) {
     throw new Error('@vercel/sandbox did not expose Sandbox.create().');
   }

uapi/next.config.mjs

@@ -61,6 +61,9 @@ let nextConfig = {
   experimental: {
     // Allow importing source files from outside the `uapi` package directory.
     externalDir: true,
+    // Keep the Vercel Sandbox SDK as a traced Node runtime package. Bundling it
+    // pulls in undici syntax newer than this Next/SWC build pipeline accepts.
+    serverComponentsExternalPackages: ['@vercel/sandbox'],
   },
   // Transpile workspace packages that the Next app imports directly or
   // transitively so webpack/SWC can handle TS/ESM + monorepo paths.