orizu 0.4.1 → 0.5.0

package/dist/hosted-bootstrap.js

@@ -0,0 +1,365 @@
+/**
+ * Host-driven hosted-sandbox bootstrap (ALI-925 / P3.3, per ADR-005 §8).
+ *
+ * Given a live `SandboxSession` (from the Orizu `SandboxProvider` seam — works
+ * with BOTH the Daytona adapter and local-sim), an Orizu API base URL, a bearer,
+ * and the workspace/session/run ids + session branch, `bootstrapHostedSandbox`
+ * performs the in-sandbox boot flow forked in DESIGN from OpenInspect's
+ * `entrypoint.py` supervisor:
+ *
+ *   1. inject boot context (env/config) as run-scoped files — the bearer only in
+ *      a 0600 file reaped at teardown, never in git config or the clone URL (G3);
+ *   2. install the git credential helper (self-contained script asset) and scope
+ *      it to the repo dir ONLY (never --global);
+ *   3. clone the session branch via the helper (no token in URL / .git/config);
+ *   4. install the Orizu CLI (non-fatal, recorded);
+ *   5. run the customer `.orizu/setup.sh` hook if present (fresh-boot, non-fatal);
+ *   6. record lifecycle events to the RunAPI with client-assigned sequences
+ *      (generic event types only — never the reserved run_* lifecycle types);
+ *   7. on failure, record `bootstrap_failed`, tear down, and sweep for residue.
+ *
+ * P3.4/P3.5 (OpenCode driver, event bridge, `orizu session start --hosted`)
+ * build ON TOP of this — `bootstrapHostedSandbox` is the single writer for the
+ * run at this stage and returns the run cursor so a follow-on can continue it.
+ */
+import { sweepForTokenResidue } from './daytona-slice.js';
+import { redactSecrets } from './secret-redaction.js';
+import { BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, PREBAKED_MARKER_PATH, REPO_CRED_CACHE_BASENAME, SETUP_HOOK_RELATIVE_PATH, parsePrebakedMarker, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
+function newEventId() {
+    const cryptoObj = globalThis.crypto;
+    if (cryptoObj?.randomUUID)
+        return cryptoObj.randomUUID();
+    return `evt-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+export function createBootstrapRunEventSink(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const now = options.now ?? (() => Date.now());
+    const base = options.apiBaseUrl.replace(/\/$/, '');
+    const secretList = [options.bearer, ...(options.redactSecretsList ?? [])];
+    const recorded = [];
+    let sequence = options.startSequence ?? 1;
+    return {
+        recorded,
+        async append(eventType, payload = {}) {
+            const redactedPayload = redactSecrets(payload, { secrets: secretList });
+            const event = {
+                eventId: newEventId(),
+                sequence: sequence,
+                eventType,
+                payload: redactedPayload,
+            };
+            const response = await fetchImpl(`${base}/api/cli/workbench-runs/${encodeURIComponent(options.runId)}/events`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${options.bearer}` },
+                body: JSON.stringify({
+                    eventId: event.eventId,
+                    sequence: event.sequence,
+                    eventType: event.eventType,
+                    occurredAt: new Date(now()).toISOString(),
+                    payload: redactedPayload,
+                }),
+            });
+            if (!response.ok) {
+                // Best-effort: the event log must not sink the whole boot. Surface the
+                // status but never the body (could echo internals); never a token. The
+                // sequence number is NOT consumed on failure (P3d) — a failed POST must
+                // not leave a server-visible gap in the run's sequence.
+                throw new Error(`run-event append failed (${response.status}) for ${eventType}`);
+            }
+            sequence += 1;
+            recorded.push(event);
+            return event;
+        },
+    };
+}
+const DEFAULT_WORKSPACE_DIR = 'repo';
+const DEFAULT_TOKEN_PURPOSES = { primary: 'write', fallback: 'read' };
+const DEFAULT_AGENT_TOKEN_PURPOSES = { primary: 'session_write', fallback: 'session_read' };
+const DEFAULT_CLI_INSTALL = (version) => `bun add -g orizu@${version} >/dev/null 2>&1 || npm install -g orizu@${version} >/dev/null 2>&1`;
+// Values we interpolate into shell commands must contain nothing a shell could
+// treat specially. Allow the characters legitimately used by branch names, run
+// ids, paths, and clone URLs — reject everything else rather than trust it.
+const SAFE_SHELL_VALUE = /^[A-Za-z0-9._/:@-]+$/;
+function assertSafeShellValue(name, value) {
+    if (!SAFE_SHELL_VALUE.test(value)) {
+        throw new Error(`unsafe characters in ${name} — refusing to interpolate into a shell command`);
+    }
+}
+/** Single-quote a value for safe embedding inside a shell command. */
+function shellSingleQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** Resolve the sandbox absolute root so helper paths are cwd-independent. */
+async function resolveRoot(session) {
+    const res = await session.exec('pwd');
+    const root = res.stdout.trim();
+    if (!root)
+        throw new Error('could not resolve sandbox root (pwd returned empty)');
+    return root;
+}
+/**
+ * The credential helper runs under a JS runtime (node >=18 for global fetch, or
+ * bun). If NEITHER is on PATH, the whole credential path is dead — abort before
+ * the clone with a message that names the missing runtime.
+ */
+async function assertJsRuntimeAvailable(session) {
+    const res = await session.exec('if command -v node >/dev/null 2>&1 || command -v bun >/dev/null 2>&1; then echo ok; else echo missing; fi');
+    if (res.stdout.trim() !== 'ok') {
+        throw new Error('no JS runtime on PATH: the git credential helper requires node (>=18) or bun, neither found');
+    }
+}
+/**
+ * Decide whether the sandbox is running the PRE-BAKED runtime image (ALI-1017).
+ * Prefers the explicit boot-context flag (the host KNOWS what image it passed —
+ * testable, no filesystem dependency); falls back to a belt read of the
+ * `/opt/orizu/prebaked.json` marker (validated via `parsePrebakedMarker`, so a
+ * stray same-named file cannot trigger a skip). Either signal → pre-baked.
+ */
+async function detectPrebaked(session, flag) {
+    if (flag)
+        return true;
+    try {
+        const raw = await session.readFile(PREBAKED_MARKER_PATH);
+        return parsePrebakedMarker(raw) !== null;
+    }
+    catch {
+        return false;
+    }
+}
+/** Detect a JS runtime on the sandbox PATH for the credential helper. */
+async function resolveHelperRuntime(session) {
+    const res = await session.exec('if command -v node >/dev/null 2>&1; then echo node; elif command -v bun >/dev/null 2>&1; then echo bun; else echo node; fi');
+    const runtime = res.stdout.trim();
+    return runtime === 'bun' ? 'bun' : 'node';
+}
+function credentialHelperValue(runtime, scriptAbs, contextAbs) {
+    // `!` makes git run the value as a shell command with the action appended.
+    // Only PATHS live here — never the bearer (G3).
+    return `!${runtime} ${scriptAbs} ${contextAbs}`;
+}
+export function computeRuntimePaths(root, runId, workspaceDir) {
+    const runDirRel = `.orizu-run/${runId}`;
+    const runDirAbs = `${root}/${runDirRel}`;
+    return {
+        root,
+        runDirRel,
+        runDirAbs,
+        repoDirRel: workspaceDir,
+        helperScriptAbs: `${runDirAbs}/${HELPER_SCRIPT_BASENAME}`,
+        bootContextAbs: `${runDirAbs}/${BOOT_CONTEXT_BASENAME}`,
+        bearerFileAbs: `${runDirAbs}/${BEARER_BASENAME}`,
+        cacheFileAbs: `${runDirAbs}/${REPO_CRED_CACHE_BASENAME}`,
+    };
+}
+export async function bootstrapHostedSandbox(opts) {
+    const { session } = opts;
+    const workspaceDir = opts.workspaceDir ?? DEFAULT_WORKSPACE_DIR;
+    const host = opts.host ?? 'github.com';
+    const tokenPurposes = opts.tokenPurposes ??
+        (opts.bearerKind === 'agent' ? { ...DEFAULT_AGENT_TOKEN_PURPOSES } : { ...DEFAULT_TOKEN_PURPOSES });
+    const cloneUrl = opts.resolveCloneUrl(opts.repoFullName);
+    const runDirRel = `.orizu-run/${opts.runId}`;
+    // P3a — refuse shell metacharacters in any value interpolated into a command,
+    // BEFORE we touch the sandbox (so a tainted value never reaches a shell).
+    assertSafeShellValue('runId', opts.runId);
+    assertSafeShellValue('runDirRel', runDirRel);
+    assertSafeShellValue('sessionBranch', opts.sessionBranch);
+    assertSafeShellValue('workspaceDir', workspaceDir);
+    assertSafeShellValue('cloneUrl', cloneUrl);
+    const sink = opts.sink ??
+        createBootstrapRunEventSink({
+            apiBaseUrl: opts.apiBaseUrl,
+            runId: opts.runId,
+            bearer: opts.bearer,
+            fetchImpl: opts.fetchImpl,
+            now: opts.now,
+        });
+    const steps = [];
+    const record = (key, ok, detail) => {
+        steps.push({ key, ok, detail });
+    };
+    const root = await resolveRoot(session);
+    const paths = computeRuntimePaths(root, opts.runId, workspaceDir);
+    const runtime = await resolveHelperRuntime(session);
+    const helperValue = credentialHelperValue(runtime, paths.helperScriptAbs, paths.bootContextAbs);
+    let currentStep = 'sandbox_provisioned';
+    try {
+        // 0 — Preflight: the credential helper needs a JS runtime; abort before the
+        // clone (with a recorded bootstrap_failed) if neither node nor bun is present.
+        currentStep = 'runtime_preflight';
+        await assertJsRuntimeAvailable(session);
+        // Pre-baked detection (ALI-1017): the boot-context flag (preferred) or the
+        // filesystem marker. Decided ONCE here; step 4 uses it to skip the CLI install.
+        const prebaked = await detectPrebaked(session, opts.prebaked);
+        // 1 — Inject boot context. Run dir is 0700; bearer + context are 0600.
+        currentStep = 'inject_context';
+        await session.exec(`mkdir -p ${paths.runDirRel} && chmod 700 ${paths.runDirRel}`);
+        const bootContext = {
+            apiBaseUrl: opts.apiBaseUrl.replace(/\/$/, ''),
+            workspaceId: opts.workspaceId,
+            sessionId: opts.sessionId,
+            runId: opts.runId,
+            sessionBranch: opts.sessionBranch,
+            repoFullName: opts.repoFullName,
+            host,
+            bearerFile: paths.bearerFileAbs,
+            cacheFile: paths.cacheFileAbs,
+            tokenPurposes,
+            insecureHttpHosts: opts.insecureHttpHosts,
+            cacheBufferMs: opts.cacheBufferMs ?? DEFAULT_CACHE_REFRESH_BUFFER_MS,
+        };
+        await session.writeFile(`${paths.runDirRel}/${HELPER_SCRIPT_BASENAME}`, renderCredentialHelperScript());
+        await session.writeFile(`${paths.runDirRel}/${BOOT_CONTEXT_BASENAME}`, serializeBootContext(bootContext));
+        // P3b — the bearer is the one true secret on disk. Create it ATOMICALLY at
+        // 0600 (umask 077 + redirect) so it never exists world-readable, even for an
+        // instant — the SandboxSession.writeFile seam cannot express file perms.
+        await session.exec(`umask 077 && printf '%s\\n' ${shellSingleQuote(opts.bearer)} > ${paths.runDirRel}/${BEARER_BASENAME}`);
+        // The boot context holds only paths (no secret), but keep it 0600 too.
+        await session.exec(`chmod 600 ${paths.runDirRel}/${BOOT_CONTEXT_BASENAME}`);
+        await sink.append('sandbox_provisioned', {
+            sandboxId: session.id,
+            runtime,
+            sessionBranch: opts.sessionBranch,
+            repo: opts.repoFullName,
+        });
+        // 2/3 — Clone the session branch VIA the credential helper. The helper is
+        // supplied ephemerally with `-c` (persisted nowhere); no token in the URL.
+        currentStep = 'repo_cloned';
+        const cloneCommand = `git clone --depth 1 --branch ${opts.sessionBranch} ` +
+            `-c credential.helper=${shellSingleQuote(helperValue)} -c credential.useHttpPath=true ` +
+            `${cloneUrl} ${workspaceDir}`;
+        const clone = await session.exec(cloneCommand);
+        if (clone.exitCode !== 0) {
+            const detail = (clone.stderr && clone.stderr.trim()) || clone.stdout.trim() || `exit ${clone.exitCode}`;
+            throw new Error(`git clone failed: ${detail}`);
+        }
+        // Persist the helper repo-LOCAL (never --global) for subsequent fetch/push.
+        await session.exec(`git -C ${workspaceDir} config credential.helper ${shellSingleQuote(helperValue)}`);
+        await session.exec(`git -C ${workspaceDir} config credential.useHttpPath true`);
+        record('repo_cloned', true, `cloned ${opts.sessionBranch}`);
+        await sink.append('repo_cloned', { branch: opts.sessionBranch, workspaceDir });
+        // 4 — Provision the Orizu CLI (non-fatal, recorded — OpenInspect setup.sh
+        // discipline). PRE-BAKED (ALI-1017): the image already ships `orizu` on PATH,
+        // so SKIP the install (npm is blocked under G5 default-deny egress) and record
+        // `cli_prebaked` instead. FROM-SCRATCH (local-sim / fallback): install the
+        // published `orizu` npm package as before. assertJsRuntimeAvailable already
+        // ran in the preflight above, so the pre-baked node/bun is proven present.
+        currentStep = 'cli_installed';
+        if (prebaked) {
+            record('cli_prebaked', true, 'orizu CLI pre-baked in the runtime image');
+            await sink.append('cli_prebaked', { detail: 'orizu CLI pre-baked in the runtime image' });
+        }
+        else {
+            const installCommand = opts.cliInstallCommand ?? DEFAULT_CLI_INSTALL(opts.cliVersion ?? 'latest');
+            const install = await session.exec(installCommand, { cwd: workspaceDir });
+            const installOk = install.exitCode === 0;
+            record('cli_installed', installOk, installOk ? 'orizu CLI installed' : `install exit ${install.exitCode}`);
+            await sink.append('cli_installed', {
+                ok: installOk,
+                exitCode: install.exitCode,
+                outputTail: tail(install.stdout, install.stderr),
+            });
+        }
+        // 5 — Customer setup hook (fresh-boot only, non-fatal, output captured).
+        // P3-a: for enforced-egress providers the host DEFERS this hook to the loop,
+        // which runs it AFTER the egress canary proves the firewall is live — so the
+        // hook's network access can never precede detection of a silent firewall
+        // failure. Here we only record the deferral (the loop emits the real result).
+        currentStep = 'setup_hook';
+        if (opts.deferSetupHook) {
+            record('setup_hook_deferred', true, 'deferred to loop (runs after egress canary)');
+            await sink.append('setup_hook_deferred', { reason: 'egress canary must pass before customer setup.sh runs' });
+            return { ok: true, steps, events: sink.recorded, paths, sweep: null, failure: null };
+        }
+        const hookRel = `${workspaceDir}/${SETUP_HOOK_RELATIVE_PATH}`;
+        if (await session.fileExists(hookRel)) {
+            const hook = await session.exec(`bash ${SETUP_HOOK_RELATIVE_PATH}`, { cwd: workspaceDir });
+            const hookOk = hook.exitCode === 0;
+            record('setup_hook_completed', hookOk, hookOk ? 'setup.sh ok' : `setup.sh exit ${hook.exitCode}`);
+            await sink.append('setup_hook_completed', {
+                ok: hookOk,
+                exitCode: hook.exitCode,
+                outputTail: tail(hook.stdout, hook.stderr),
+            });
+        }
+        else {
+            record('setup_hook_skipped', true, 'no .orizu/setup.sh');
+            await sink.append('setup_hook_skipped', { reason: 'no .orizu/setup.sh' });
+        }
+        return { ok: true, steps, events: sink.recorded, paths, sweep: null, failure: null };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        record(currentStep, false, message);
+        // Record the failure (redacted), then tear down + prove no residue remains.
+        await safeAppend(sink, 'bootstrap_failed', { step: currentStep, error: message });
+        const sweep = await teardownHostedSandbox({ session, paths, bearer: opts.bearer, workspaceDir });
+        return { ok: false, steps, events: sink.recorded, paths, sweep, failure: { step: currentStep, error: message } };
+    }
+}
+/** Never let a failure-path event append mask the original error. */
+async function safeAppend(sink, eventType, payload) {
+    try {
+        await sink.append(eventType, payload);
+    }
+    catch {
+        // The run-event log is best-effort on the failure path; teardown proceeds.
+    }
+}
+function tail(stdout, stderr) {
+    const combined = [stdout, stderr ?? ''].join('\n');
+    return combined.split('\n').slice(-20).join('\n').trim();
+}
+/**
+ * Tear the run-scoped credential material down and PROVE no token residue
+ * remains (G3, extends ALI-973's `sweepForTokenResidue`). Removes the run dir
+ * (bearer + boot context + minted-token cache), unsets the repo-local credential
+ * helper, then sweeps .git/config, the git credential cache, env, argv, and
+ * ~/.git-credentials for the bearer, any extra tokens, and the token markers.
+ */
+export async function teardownHostedSandbox(opts) {
+    const { session, paths } = opts;
+    const workspaceDir = opts.workspaceDir ?? paths.repoDirRel;
+    // Unset the repo-local helper (no secret in it, but leave nothing behind),
+    // then remove the whole run dir (bearer, boot context, minted-token cache).
+    await session.exec(`git -C ${workspaceDir} config --unset-all credential.helper 2>/dev/null || true`);
+    await session.exec(`rm -rf ${paths.runDirRel}`);
+    const findings = await sweepHostedResidue(session, {
+        bearer: opts.bearer,
+        paths,
+        workspaceDir,
+        extraTokens: opts.extraTokens,
+    });
+    return { clean: findings.length === 0, findings };
+}
+/**
+ * Extend the ALI-973 sweep with hosted-specific probes: the run dir (bearer +
+ * cache) must be gone, and the standard leak surfaces (.git/config, ~/.git-
+ * credentials, credential cache, env, argv) must be free of the bearer.
+ */
+export async function sweepHostedResidue(session, opts) {
+    const tokens = [opts.bearer, ...(opts.extraTokens ?? [])].filter(t => t.length > 0);
+    const probes = [
+        { location: `${opts.workspaceDir}/.git/config`, command: `cat ${opts.workspaceDir}/.git/config 2>/dev/null || true` },
+        {
+            location: `${opts.workspaceDir}/.git/logs (reflog)`,
+            command: `find ${opts.workspaceDir}/.git/logs -type f -exec cat {} + 2>/dev/null || true`,
+        },
+        { location: 'run dir (bearer + minted-token cache)', command: `find ${opts.paths.runDirRel} -type f -exec cat {} + 2>/dev/null || true` },
+        { location: '~/.git-credentials', command: 'cat "$HOME/.git-credentials" 2>/dev/null || true' },
+        { location: '~/.gitconfig (global)', command: 'cat "$HOME/.gitconfig" 2>/dev/null || true' },
+        {
+            location: 'git credential cache/store',
+            command: 'cat "$HOME/.cache/git/credential/"* "${XDG_CACHE_HOME:-$HOME/.cache}/git/credential/"* 2>/dev/null || true',
+        },
+        { location: 'shell history', command: 'cat "$HOME/.bash_history" "$HOME/.zsh_history" 2>/dev/null || true' },
+        { location: 'process listing / argv', command: 'ps -eo args 2>/dev/null || ps aux 2>/dev/null || true' },
+        { location: 'process env', command: 'env' },
+    ];
+    return sweepForTokenResidue(session, {
+        tokens,
+        repoPath: opts.workspaceDir,
+        markers: ['x-access-token'],
+        probes,
+    });
+}

package/dist/hosted-broker-server.js

@@ -0,0 +1,220 @@
+/**
+ * Standalone fake Orizu control-plane broker for the ALI-925 rehearsal + tests.
+ *
+ * This runs as its OWN process (spawned via `bun <this file>`), NOT in-process,
+ * for a specific reason: the local-sim `SandboxSession.exec` uses a blocking
+ * `spawnSync`, and the in-sandbox credential helper it runs makes a real HTTP
+ * call back to this broker. An in-process server can't answer that call while
+ * the test thread is blocked in `spawnSync` — so the broker must be a separate
+ * process with its own event loop.
+ *
+ * It implements exactly the two contracts the bootstrap depends on:
+ *   - POST /api/cli/workspaces/:id/repo-token → {token, expiresAt, repo, mintId}
+ *   - POST /api/cli/workbench-runs/:id/events → 201 (rejects reserved run_* 400)
+ * and it journals every accepted event / issued token to newline-delimited JSON
+ * files so the parent test can read them back. Config comes from env (below).
+ *
+ * Not shipped to end users — a test/rehearsal fixture only.
+ */
+import { appendFileSync } from 'fs';
+const RESERVED_EVENT_TYPES = new Set(['run_started', 'run_completed', 'run_failed', 'run_cancelled']);
+// Mirror the PRODUCTION route (app/api/cli/workspaces/[id]/repo-token/route.ts):
+// it accepts 'read' | 'write' (human) and 'session_read' | 'session_write'
+// (agent, ALI-928 — flipped in lockstep with the route). Unknown purpose → 400;
+// a known purpose the caller is not authorized for → 403.
+const VALID_PURPOSES = new Set(['read', 'write', 'session_read', 'session_write']);
+// Purposes that require write access (subject to the denyWrite simulation).
+const WRITE_PURPOSES = new Set(['write', 'session_write']);
+function bun() {
+    const b = globalThis.Bun;
+    if (!b?.serve)
+        throw new Error('hosted-broker-server requires bun');
+    return b;
+}
+export function readBrokerConfigFromEnv(env) {
+    return {
+        bearer: env.HB_BEARER ?? '',
+        repo: env.HB_REPO ?? 'acme/repo',
+        eventsFile: env.HB_EVENTS_FILE,
+        tokensFile: env.HB_TOKENS_FILE,
+        repoTokenStatus: env.HB_REPO_TOKEN_STATUS ? Number.parseInt(env.HB_REPO_TOKEN_STATUS, 10) : undefined,
+        eventsStatus: env.HB_EVENTS_STATUS ? Number.parseInt(env.HB_EVENTS_STATUS, 10) : undefined,
+        denyWrite: env.HB_DENY_WRITE === '1',
+        port: env.HB_PORT ? Number.parseInt(env.HB_PORT, 10) : 0,
+        fullRunApi: env.HB_FULL_RUN_API === '1',
+        sessionId: env.HB_SESSION_ID,
+        sessionBranch: env.HB_SESSION_BRANCH,
+    };
+}
+export function startBrokerServer(config) {
+    let mints = 0;
+    let agentTokens = 0;
+    let sessions = 0;
+    let runs = 0;
+    // In-memory RunAPI state (E2E mode): events + status per run, terminal record.
+    const runEvents = new Map();
+    const runStatus = new Map();
+    // E2E: the CURRENT valid agent token — the most recently issued by the
+    // agent-token endpoint. A rotation (a fresh mint) invalidates the previous
+    // token, so agent-authenticated WRITES (run start / events / terminal PATCH)
+    // must present the current value; a rotated-out token is 401 (an honest
+    // "old token invalidated at the broker"). Reads stay permissive so a fresh
+    // human can still tail the run.
+    let currentAgentToken = null;
+    const json = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+    const authOk = (header) => config.fullRunApi ? header.startsWith('Bearer ') && header.length > 'Bearer '.length : header === `Bearer ${config.bearer}`;
+    // Agent-write auth (E2E only): once an agent token has been issued, an
+    // agent-authenticated write MUST carry the current one.
+    const agentWriteOk = (header) => currentAgentToken === null || header === `Bearer ${currentAgentToken}`;
+    const recordEvent = (runId, event) => {
+        const list = runEvents.get(runId) ?? [];
+        list.push(event);
+        runEvents.set(runId, list);
+        if (config.eventsFile) {
+            appendFileSync(config.eventsFile, `${JSON.stringify({ runId, ...event })}\n`);
+        }
+    };
+    return bun().serve({
+        port: config.port ?? 0,
+        hostname: '127.0.0.1',
+        async fetch(request) {
+            const url = new URL(request.url);
+            const method = request.method.toUpperCase();
+            if (!authOk(request.headers.get('authorization') ?? '')) {
+                return json({ error: 'Unauthorized' }, 401);
+            }
+            const body = method === 'POST' || method === 'PATCH'
+                ? (await request.json().catch(() => ({})))
+                : {};
+            // -- Full RunAPI + session + agent-token (E2E mode only) --------------
+            if (config.fullRunApi) {
+                const sessionsMatch = url.pathname.match(/^\/api\/cli\/workspaces\/([^/]+)\/sessions$/);
+                if (method === 'POST' && sessionsMatch) {
+                    sessions += 1;
+                    const id = config.sessionId ?? `sess-e2e-${sessions}`;
+                    const repoBranch = config.sessionBranch ?? `orizu/session-${id}`;
+                    return json({ session: { id, workspaceId: sessionsMatch[1], repoBranch, status: 'active' } }, 201);
+                }
+                const agentTokenMatch = url.pathname.match(/^\/api\/cli\/sessions\/([^/]+)\/agent-token$/);
+                if (method === 'POST' && agentTokenMatch) {
+                    agentTokens += 1;
+                    const issued = `orizu_agent_e2e_${agentTokens}_${Math.random().toString(36).slice(2)}`;
+                    // A fresh mint rotates the current token: the previous one is now stale
+                    // for agent-authenticated writes.
+                    currentAgentToken = issued;
+                    return json({
+                        token: issued,
+                        agentUserId: 'agent-user-e2e',
+                        sessionId: agentTokenMatch[1],
+                        expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+                    }, 201);
+                }
+                if (method === 'POST' && url.pathname === '/api/cli/workbench-runs') {
+                    if (!agentWriteOk(request.headers.get('authorization') ?? '')) {
+                        return json({ error: 'stale agent token' }, 401);
+                    }
+                    runs += 1;
+                    const runId = `run-e2e-${runs}`;
+                    runStatus.set(runId, 'running');
+                    recordEvent(runId, { eventId: 'run_started', sequence: 1, eventType: 'run_started', payload: {} });
+                    return json({ run: { id: runId, status: 'running' } }, 201);
+                }
+                const runEventsGet = url.pathname.match(/^\/api\/cli\/workbench-runs\/([^/]+)\/events$/);
+                if (method === 'GET' && runEventsGet) {
+                    const runId = runEventsGet[1];
+                    const after = Number.parseInt(url.searchParams.get('after') ?? '0', 10) || 0;
+                    const limit = Number.parseInt(url.searchParams.get('limit') ?? '500', 10) || 500;
+                    const all = runEvents.get(runId) ?? [];
+                    const page = all.filter(e => e.sequence > after).slice(0, limit);
+                    const cursor = page.length > 0 ? page[page.length - 1].sequence : after;
+                    return json({ events: page, cursor, runStatus: runStatus.get(runId) ?? 'running' });
+                }
+                const runDetail = url.pathname.match(/^\/api\/cli\/workbench-runs\/([^/]+)$/);
+                if (method === 'GET' && runDetail) {
+                    return json({ run: { id: runDetail[1], status: runStatus.get(runDetail[1]) ?? 'running' } });
+                }
+                if (method === 'PATCH' && runDetail) {
+                    if (!agentWriteOk(request.headers.get('authorization') ?? '')) {
+                        return json({ error: 'stale agent token' }, 401);
+                    }
+                    const runId = runDetail[1];
+                    const status = String(body.status ?? '');
+                    if (!['succeeded', 'failed', 'cancelled'].includes(status)) {
+                        return json({ error: 'invalid terminal status' }, 400);
+                    }
+                    const existing = runStatus.get(runId);
+                    if (existing && ['succeeded', 'failed', 'cancelled'].includes(existing)) {
+                        // Already terminal — Orizu records win (concurrent finisher).
+                        return json({ error: `Run already ${existing}` }, 409);
+                    }
+                    runStatus.set(runId, status);
+                    return json({ run: { id: runId, status } });
+                }
+            }
+            const tokenMatch = url.pathname.match(/^\/api\/cli\/workspaces\/([^/]+)\/repo-token$/);
+            if (method === 'POST' && tokenMatch) {
+                if (config.repoTokenStatus && config.repoTokenStatus >= 400) {
+                    return json({ error: 'forced broker failure' }, config.repoTokenStatus);
+                }
+                const purpose = String(body.purpose ?? '');
+                // Unknown purpose → 400 with the production route's exact error body.
+                if (!VALID_PURPOSES.has(purpose)) {
+                    return json({ error: 'purpose must be "read", "write", "session_read", or "session_write"' }, 400);
+                }
+                // Simulate a read-only caller: known purpose, but unauthorized to write.
+                if (config.denyWrite && WRITE_PURPOSES.has(purpose)) {
+                    return json({ error: 'Access denied' }, 403);
+                }
+                mints += 1;
+                const mintId = `mint-${mints}`;
+                const token = `ghs_sim_${purpose}_${mintId}_${Math.random().toString(36).slice(2)}`;
+                if (config.tokensFile)
+                    appendFileSync(config.tokensFile, `${token}\n`);
+                return json({ token, expiresAt: new Date(Date.now() + 3600_000).toISOString(), repo: config.repo, mintId });
+            }
+            const eventsMatch = url.pathname.match(/^\/api\/cli\/workbench-runs\/([^/]+)\/events$/);
+            if (method === 'POST' && eventsMatch) {
+                // E2E: appending events is an agent-authenticated write — a rotated-out
+                // token is rejected so the honest rotation test can prove re-resolve.
+                if (config.fullRunApi && !agentWriteOk(request.headers.get('authorization') ?? '')) {
+                    return json({ error: 'stale agent token' }, 401);
+                }
+                if (config.eventsStatus && config.eventsStatus >= 400) {
+                    return json({ error: 'forced events failure' }, config.eventsStatus);
+                }
+                const eventType = String(body.eventType ?? '');
+                const sequence = body.sequence;
+                const eventId = String(body.eventId ?? '');
+                if (!eventId)
+                    return json({ error: 'eventId is required' }, 400);
+                if (!Number.isInteger(sequence) || Number(sequence) <= 0) {
+                    return json({ error: 'sequence must be a positive integer' }, 400);
+                }
+                if (!eventType)
+                    return json({ error: 'eventType is required' }, 400);
+                if (RESERVED_EVENT_TYPES.has(eventType))
+                    return json({ error: `${eventType} is a lifecycle event` }, 400);
+                const runId = eventsMatch[1];
+                const seq = Number(sequence);
+                const existingForRun = runEvents.get(runId) ?? [];
+                // Idempotent replay: same eventId → 201 without re-recording. Same
+                // sequence, different eventId → 409 (mirrors the ingest RPC contract).
+                if (existingForRun.some(e => e.eventId === eventId)) {
+                    return json({ eventId, id: `stored-${eventId}`, inserted: false }, 201);
+                }
+                if (existingForRun.some(e => e.sequence === seq)) {
+                    return json({ error: 'Workbench event sequence already exists for a different event_id' }, 409);
+                }
+                recordEvent(runId, { eventId, sequence: seq, eventType, payload: body.payload });
+                return json({ eventId, id: `stored-${eventId}` }, 201);
+            }
+            return json({ error: `unexpected ${method} ${url.pathname}` }, 404);
+        },
+    });
+}
+// When executed directly (`bun hosted-broker-server.ts`), start the server and
+// print `LISTENING <port>` so the spawning parent can resolve the port.
+if (import.meta.main) {
+    const server = startBrokerServer(readBrokerConfigFromEnv(process.env));
+    process.stdout.write(`LISTENING ${server.port}\n`);
+}