orizu 0.5.10 → 0.5.11

package/dist/daytona-slice-rehearsal.js

@@ -51,17 +51,17 @@ export function seedLocalBareRepo(baseDir, config) {
     const work = mkdtempSync(join(baseDir, 'seed-'));
     gitOrThrow(['init', '--initial-branch=main', work]);
     const ident = ['-c', 'user.email=seed@orizu.local', '-c', 'user.name=Seed'];
+    // ALI-1075: no `canonical`/`repoState` liveness fields — manifests carry
+    // machine-readable ids only; the DB label is the sole production pointer.
     const teamManifest = {
         schemaVersion: WORKSPACE_SCHEMA_VERSION,
         kind: 'team',
         slug: config.teamSlug,
-        canonical: { owner: 'repo', repoState: 'source', objectRef: null },
     };
     const projectManifest = {
         schemaVersion: WORKSPACE_SCHEMA_VERSION,
         kind: 'project',
         slug: config.projectSlug,
-        canonical: { owner: 'repo', repoState: 'draft', objectRef: null },
     };
     writeFileSync(join(work, 'orizu.team.json'), `${JSON.stringify(teamManifest, null, 2)}\n`);
     writeFileSync(join(work, '.gitignore'), '# Orizu workspace policy\n.orizu/\n');

package/dist/git-credential.js

@@ -45,17 +45,20 @@ export function resolveAttachedWorkspaceId(cwd) {
         const manifestPath = join(dir, 'orizu.team.json');
         if (existsSync(manifestPath)) {
             const manifest = readJsonManifest(manifestPath);
-            const canonical = manifest?.canonical;
-            const serviceId = canonical && typeof canonical === 'object' && !Array.isArray(canonical)
-                ? canonical.serviceId
-                : null;
-            if (typeof serviceId === 'string' && serviceId)
-                return serviceId;
+            // `setup.attachedWorkspaceId` is the attachment id; `canonical.serviceId`
+            // is a legacy duplicate kept only as a read fallback for old repos
+            // (ALI-1075: fresh manifests carry no `canonical` block).
             const setup = manifest?.setup;
             const attached = setup && typeof setup === 'object' && !Array.isArray(setup)
                 ? setup.attachedWorkspaceId
                 : null;
-            return typeof attached === 'string' && attached ? attached : null;
+            if (typeof attached === 'string' && attached)
+                return attached;
+            const canonical = manifest?.canonical;
+            const serviceId = canonical && typeof canonical === 'object' && !Array.isArray(canonical)
+                ? canonical.serviceId
+                : null;
+            return typeof serviceId === 'string' && serviceId ? serviceId : null;
         }
         const parent = dirname(dir);
         if (parent === dir)

package/dist/github-setup.js

@@ -14,7 +14,7 @@
  *      is immediately rewritten to a clean origin.
  */
 import { spawnSync } from 'child_process';
-import { mkdirSync } from 'fs';
+import { existsSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { authedFetch } from './http.js';
 import { assertWorkspaceDirUsable } from './workspace.js';
@@ -196,6 +196,23 @@ export async function runHostedAttach(options, io) {
         }
     }
     const cleanUrl = `https://github.com/${repoFullName}.git`;
+    const ensureOrizuDir = io.ensureOrizuDir ?? ((repoDir) => mkdirSync(join(repoDir, '.orizu'), { recursive: true }));
+    // Idempotent re-run (ALI-1069): `orizu setup` in an ALREADY-attached workspace
+    // reaches here with `targetDir` holding the prior clone (its `.git` plus the
+    // committed orizu.team.json — `assertWorkspaceDirUsable` deliberately exempts
+    // that dir as the idempotent case). `git clone` refuses ANY non-empty dir, so
+    // an unconditional clone would abort the re-run with a misleading "not an empty
+    // directory" error. Short-circuit: re-affirm the credential helper config
+    // (idempotent) and return without recloning.
+    const repoAlreadyCloned = io.repoAlreadyCloned ?? ((dir) => existsSync(join(dir, '.git')));
+    if (repoAlreadyCloned(options.targetDir)) {
+        io.print('   Workbench repo already attached — skipping clone.');
+        gitOrThrow(io.git, ['config', 'credential.helper', CREDENTIAL_HELPER], { cwd: options.targetDir });
+        gitOrThrow(io.git, ['config', 'credential.useHttpPath', 'true'], { cwd: options.targetDir });
+        ensureOrizuDir(options.targetDir);
+        io.print('   Attached. Configured the Orizu credential helper for git.');
+        return { repoFullName, provisioned, targetDir: options.targetDir };
+    }
     io.print(`   Cloning ${repoFullName}...`);
     // Clone with the helper inline + the workspace id in the env so the token is
     // brokered on demand and never materializes in the URL or on disk.
@@ -211,7 +228,6 @@ export async function runHostedAttach(options, io) {
     // Persist the helper repo-locally for future pull/push (cwd-resolved).
     gitOrThrow(io.git, ['config', 'credential.helper', CREDENTIAL_HELPER], { cwd: options.targetDir });
     gitOrThrow(io.git, ['config', 'credential.useHttpPath', 'true'], { cwd: options.targetDir });
-    const ensureOrizuDir = io.ensureOrizuDir ?? ((repoDir) => mkdirSync(join(repoDir, '.orizu'), { recursive: true }));
     ensureOrizuDir(options.targetDir);
     io.print('   Attached. Configured the Orizu credential helper for git.');
     return { repoFullName, provisioned, targetDir: options.targetDir };

package/dist/help.js

@@ -318,8 +318,8 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['prompts', 'push'],
-        usage: 'orizu prompts push <dir> [--runner-version <id>] [--project <team/project>] [--parent <version-id>] [--json]',
-        summary: 'Push a local prompt artifact directory as a new version.',
+        usage: 'orizu prompts push <dir> [--runner-version <id>] [--project <team/project>] [--parent <version-id>] [--session <session-id>] [--json]',
+        summary: 'Push a local prompt artifact directory as a new version (with --session: a commit-first git draft).',
         group: 'Prompts and judges',
     },
     {
@@ -354,8 +354,8 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['judges', 'push'],
-        usage: 'orizu judges push <dir> [--runner-version <id>] [--project <team/project>] [--parent <version-id>] [--json]',
-        summary: 'Push a local judge artifact directory as a new version.',
+        usage: 'orizu judges push <dir> [--runner-version <id>] [--project <team/project>] [--parent <version-id>] [--session <session-id>] [--json]',
+        summary: 'Push a local judge artifact directory as a new version (with --session: a commit-first git draft).',
         group: 'Prompts and judges',
     },
     {
@@ -747,23 +747,25 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['session', 'start'],
-        usage: 'orizu session start [--project <team/project>] [--json]',
-        summary: 'Start a durable workspace session for the attached workspace and print the session id for later resume.',
+        usage: 'orizu session start [--project <team/project>] [--workspace <dir>] [--json]',
+        summary: 'Start a durable workspace session and print the session id. When run inside the workbench clone (or with --workspace), the remote session branch is fetched and checked out locally, and the exact next git commands are printed.',
         group: 'Sessions',
         options: [
             { name: '--project <team/project>', help: 'Optionally scope the session to a project in the attached workspace.' },
+            { name: '--workspace <dir>', help: 'Workbench clone directory when not running from inside it.' },
             { name: '--json', help: 'Emit the machine-readable session payload.' },
         ],
         examples: ['orizu session start', 'orizu session start --project highlight/hip --json'],
     },
     {
         path: ['session', 'status'],
-        usage: 'orizu session status [--session <id> | --status active|ended] [--json]',
-        summary: 'Inspect one session by id, including run summaries, or list sessions for the attached workspace.',
+        usage: 'orizu session status [--session <id> | --status active|ended] [--workspace <dir>] [--json]',
+        summary: 'Inspect one session by id (including run summaries and, when run inside the workbench clone, the session branch with local ahead/behind vs origin), or list sessions for the attached workspace.',
         group: 'Sessions',
         options: [
             { name: '--session <id>', help: 'Resume by session id; does not require the original terminal.' },
             { name: '--status <status>', help: 'Filter attached-workspace sessions when --session is omitted.', choices: ['active', 'ended'] },
+            { name: '--workspace <dir>', help: 'Workbench clone directory when not running from inside it.' },
             { name: '--json', help: 'Emit the machine-readable session or session-list payload.' },
         ],
         examples: ['orizu session status --session sess_123 --json', 'orizu session status --status active'],
@@ -781,15 +783,18 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['session', 'finish'],
-        usage: 'orizu session finish --session <id> [--project <team/project>] [--json]',
-        summary: 'Finish a hosted session branch: no changes deletes the branch; changes create a repo_merge promotion manifest to review and approve (no GitHub PR).',
+        usage: 'orizu session finish --session <id> [--project <team/project>] [--push [--message <text>]] [--workspace <dir>] [--json]',
+        summary: 'Finish a hosted session branch: no changes deletes the branch; changes create a repo_merge promotion manifest to review and approve (no GitHub PR). Warns when your local session-branch checkout has uncommitted/unpushed work; --push stages, commits, and pushes it first.',
         group: 'Sessions',
         options: [
             { name: '--session <id>', help: 'Session id whose branch to finish.', required: true },
             { name: '--project <team/project>', help: 'Project scope for the manifest when the session is not already project-scoped.' },
+            { name: '--push', help: 'Opt-in: stage, commit, and push local session-branch work before finishing (raw git stays the default workflow).' },
+            { name: '--message <text>', help: 'Commit message for --push (a default is used when omitted).' },
+            { name: '--workspace <dir>', help: 'Workbench clone directory when not running from inside it.' },
             { name: '--json', help: 'Emit the machine-readable outcome (no-changes or the created manifest).' },
         ],
-        examples: ['orizu session finish --session sess_123', 'orizu session finish --session sess_123 --project highlight/hip --json'],
+        examples: ['orizu session finish --session sess_123', 'orizu session finish --session sess_123 --push --message "tune judge prompt"'],
     },
     {
         path: ['run', 'start'],

package/dist/hosted-boot.js

@@ -34,6 +34,8 @@ import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeSync } f
 import { AGENT_GIT_IDENTITY, BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, REPO_CRED_CACHE_BASENAME, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
 import { INJECTED_ENV_VARS_ENV, runHostedLoop, } from './hosted-loop.js';
 import { DEFAULT_EGRESS_CANARY_HOST } from './hosted-loop-lifecycle.js';
+import { resumeRunEventSink } from './hosted-run-event-sink.js';
+import { stageOrizuSkill } from './hosted-skill-staging.js';
 /** Non-secret placeholder model key (firewall brokers the real org key on
  *  egress). Byte-for-byte the operator path's constant
  *  (packages/cli/src/hosted-session-cli.ts `ANTHROPIC_DUMMY_KEY` and the
@@ -72,6 +74,10 @@ export function resolveHostedBootEnv(env) {
         value: {
             bootSecret,
             agentTokenUrl,
+            // The boot-status route is the agent-token route's sibling on the same
+            // coordinator, same boot-secret auth (ALI-1060). Deriving it here means no
+            // new env var in the frozen contract / planSandboxEnv.
+            bootStatusUrl: deriveBootStatusUrl(agentTokenUrl),
             envBundleUrl,
             baseUrl: baseUrl.replace(/\/+$/, ''),
             sessionId,
@@ -81,6 +87,51 @@ export function resolveHostedBootEnv(env) {
         },
     };
 }
+/** The boot-status route is the agent-token route's sibling; swap the trailing
+ *  path segment. Falls back to appending when the shape is unexpected. */
+export function deriveBootStatusUrl(agentTokenUrl) {
+    if (/\/agent-token\/?$/.test(agentTokenUrl)) {
+        return agentTokenUrl.replace(/\/agent-token\/?$/, '/boot-status');
+    }
+    return `${agentTokenUrl.replace(/\/+$/, '')}/boot-status`;
+}
+// -- Boot-status callback (ALI-1060) ------------------------------------------
+/** Max chars of the failure reason reported to the coordinator. A boot reason
+ *  is never a place for a secret; this bounds it anyway, and we scrub the boot
+ *  secret defensively before sending. */
+const MAX_BOOT_REASON_CHARS = 800;
+/** Best-effort scrub + truncate for a reported failure reason: never leak the
+ *  boot secret (the one credential the boot always holds), and keep it short. */
+export function redactBootReason(reason, bootSecret) {
+    let out = reason;
+    if (bootSecret && out.includes(bootSecret)) {
+        out = out.split(bootSecret).join('[redacted]');
+    }
+    return out.slice(0, MAX_BOOT_REASON_CHARS);
+}
+/**
+ * Report the boot outcome to the coordinator's boot-status route (ALI-1060),
+ * authed with the boot secret (same as the agent-token pull). Best-effort: the
+ * DO's own readiness-timeout is the backstop if this never lands, so a failed
+ * report must never mask the boot result. NEVER logs the secret.
+ */
+export async function postBootStatus(opts) {
+    try {
+        const res = await opts.fetchImpl(opts.bootStatusUrl, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${opts.bootSecret}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                status: opts.status,
+                ...(opts.runId ? { runId: opts.runId } : {}),
+                ...(opts.reason ? { reason: opts.reason } : {}),
+            }),
+        });
+        opts.log?.(`boot-status ${opts.status} reported (${res.status})`);
+    }
+    catch (error) {
+        opts.log?.(`boot-status ${opts.status} report failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 /**
  * Exchange the boot secret for a fresh Orizu agent bearer at the coordinator's
  * agent-token route (`GET`, `Authorization: Bearer <boot secret>` → 200
@@ -187,6 +238,9 @@ async function bearerJson(fetchImpl, url, bearer, init = {}) {
 function asString(value) {
     return typeof value === 'string' && value.length > 0 ? value : null;
 }
+function asPositiveNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null;
+}
 /** GET the session (agent-capable, RLS-scoped) to learn its workspace, branch,
  *  task, and any existing run — the DO start body carries none of these. */
 export async function resolveSession(opts) {
@@ -210,6 +264,7 @@ export async function resolveSession(opts) {
         task,
         model: asString(clientInfo.model),
         reasoningEffort: asString(clientInfo.reasoningEffort),
+        durationMinutes: asPositiveNumber(clientInfo.durationMinutes),
         runId,
     };
 }
@@ -233,8 +288,7 @@ export async function ensureRun(opts) {
     return runId;
 }
 /** Mint a session_read repo token to learn the repo full name, then build the
- *  GitHub clone URL (mirrors the operator path's `defaultResolveRepo`). The
- *  minted token is best-effort revoked — the credential helper mints its own. */
+ *  GitHub clone URL (mirrors the operator path's `defaultResolveRepo`). */
 export async function resolveRepo(opts) {
     const url = `${opts.baseUrl}/api/cli/workspaces/${encodeURIComponent(opts.workspaceId)}/repo-token`;
     const minted = await bearerJson(opts.fetchImpl, url, opts.bearer, {
@@ -245,20 +299,13 @@ export async function resolveRepo(opts) {
     const repoFullName = asString(minted.repo);
     if (!repoFullName)
         throw new Error('repo-token response carried no repo');
-    const token = asString(minted.token);
-    const mintId = asString(minted.mintId);
-    if (token && mintId) {
-        try {
-            await opts.fetchImpl(url, {
-                method: 'DELETE',
-                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${opts.bearer}` },
-                body: JSON.stringify({ mintId, token }),
-            });
-        }
-        catch {
-            // best-effort revoke — the short TTL is the backstop.
-        }
-    }
+    // We deliberately do NOT early-revoke this probe token (ALI-1069): the
+    // repo-token DELETE route is HUMAN-ONLY (`requireCliSupabase` default-denies
+    // agent bearers), so an agent-bearer revoke would always 401 — a guaranteed
+    // failed request per boot, not a real revoke. Let the short (~60-min)
+    // session_read TTL expire on its own; the credential helper mints its own
+    // per-op tokens for the actual clone/fetch/push, so this probe token is never
+    // reused after we read `repo` from it.
     return { repoFullName, cloneUrl: `https://github.com/${repoFullName}.git` };
 }
 const defaultExec = (cmd, args, opts) => {
@@ -274,6 +321,21 @@ function assertSafeGitValue(name, value) {
         throw new Error(`unsafe characters in ${name}; refusing to pass to git`);
     }
 }
+/**
+ * Path-safety for the run id BEFORE it is interpolated into `.orizu-run/${runId}`
+ * (ALI-1060). ORIZU_RUN_ID can be CALLER-SUPPLIED (resume flows), and unlike the
+ * boot-created uuid it is untrusted — a `../` value would escape the run dir and
+ * let boot assets (0600 bearer/boot-secret files) land outside it. A run id is a
+ * single opaque segment: allow only `[A-Za-z0-9._-]` and reject any `..`, so no
+ * separators or traversal survive. Stricter than the operator path's shared
+ * shell-value assertion (which allows `/`), applied to the same value.
+ */
+const SAFE_RUN_ID = /^[A-Za-z0-9._-]+$/;
+export function assertSafeRunId(runId) {
+    if (!SAFE_RUN_ID.test(runId) || runId.includes('..')) {
+        throw new Error('unsafe run id; refusing to build run-dir paths');
+    }
+}
 function writeSecretFile(path, contents, write) {
     write(path, contents.endsWith('\n') ? contents : `${contents}\n`);
 }
@@ -334,6 +396,12 @@ export async function runHostedBoot(opts) {
         fetchImpl,
         existingRunId: env.runId ?? session.runId,
     });
+    // Path-safety BEFORE the run id reaches any `.orizu-run/${runId}` path
+    // (ALI-1060): a caller-supplied ORIZU_RUN_ID must not escape the run dir.
+    assertSafeRunId(runId);
+    // Hand the run id + bearer to the caller so a throw AFTER this point can mark
+    // the run failed + report the boot failure (the DO is the backstop otherwise).
+    opts.onBootContext?.({ runId, bearer: bearer.token });
     const repo = await resolveRepo({ baseUrl: env.baseUrl, workspaceId, sessionId: env.sessionId, bearer: bearer.token, fetchImpl });
     log(`resolved run ${runId} on ${repo.repoFullName}@${session.repoBranch}`);
     // 4 — Write the run-scoped assets: boot secret + initial bearer (0600), the
@@ -398,6 +466,37 @@ export async function runHostedBoot(opts) {
     exec('git', ['-C', workspaceDir, 'config', 'user.name', AGENT_GIT_IDENTITY.name]);
     exec('git', ['-C', workspaceDir, 'config', 'user.email', AGENT_GIT_IDENTITY.email]);
     log(`cloned ${session.repoBranch}`);
+    // 5b — Stage the orizu-cli skill into the cloned repo so the agent discovers the
+    // Orizu workflows (ALI-1059). SHARED with the operator path via `stageOrizuSkill`
+    // (one resolution chain + the harvest-safe .git/info/exclude append). Non-fatal:
+    // a staging failure is logged, never aborts the boot. The DO `BootExec` is
+    // shell-less, so the staging script runs under `sh -c`.
+    try {
+        const skillStage = await stageOrizuSkill({
+            workspaceDir,
+            exec: async (command) => {
+                const res = exec('sh', ['-c', command]);
+                return { exitCode: res.status, stdout: res.stdout, stderr: res.stderr ?? '' };
+            },
+        });
+        log(`orizu-cli skill staged: ${skillStage.ok ? skillStage.method : 'unresolved'}`);
+    }
+    catch (error) {
+        log(`orizu-cli skill staging failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    // ALI-1060: the agent is now genuinely LIVE — bearer minted, connectors
+    // applied, session/run resolved, repo cloned, skill staged. Signal the
+    // coordinator's readiness gate BEFORE the loop so the DO stops waiting (and
+    // never tears down a healthy box on timeout). Best-effort; the DO's timeout is
+    // the backstop.
+    await postBootStatus({
+        bootStatusUrl: env.bootStatusUrl,
+        bootSecret: env.bootSecret,
+        status: 'ready',
+        runId,
+        fetchImpl,
+        log,
+    });
     // 6 — Launch the hosted loop, reused in-process. The bearer PROVIDER keeps the
     // event sink's bearer fresh from the same pull-mode source; the DO-provisioned
     // sandbox always runs the pre-baked image under an enforced egress policy, so
@@ -414,6 +513,10 @@ export async function runHostedBoot(opts) {
         messageId: `${runId}:task`,
         author: AGENT_GIT_IDENTITY,
         anthropicDummyKey: env.anthropicDummyKey ?? ANTHROPIC_DUMMY_KEY,
+        // Derive the per-prompt max-duration cap from the session duration so a long
+        // run is not killed at the hard-coded 90-min prompt cap (ALI-1061). Unset →
+        // the harness default (5400s) floor holds.
+        sandboxBudgetMs: session.durationMinutes != null ? session.durationMinutes * 60 * 1000 : undefined,
         prebaked: true,
         egressCanaryHost: DEFAULT_EGRESS_CANARY_HOST,
         runSetupHook: true,
@@ -518,10 +621,18 @@ export async function hostedBootCommand(io) {
             '(the DO sandbox env contract — see planSandboxEnv)');
         return 1;
     }
+    const env = resolved.value;
+    const log = (line) => io.printErr?.(`[hosted-boot] ${line}`);
+    // Captured once the run id + bearer are known, so a LATER throw can mark the
+    // run failed with an authenticated bearer (ALI-1060).
+    let bootCtx = null;
     try {
         const result = await runHostedBoot({
-            env: resolved.value,
-            log: line => io.printErr?.(`[hosted-boot] ${line}`),
+            env,
+            log,
+            onBootContext: ctx => {
+                bootCtx = ctx;
+            },
         });
         io.print(io.json
             ? JSON.stringify({ ok: result.ok, runId: result.runId, status: result.loopStatus, error: result.error })
@@ -531,6 +642,72 @@ export async function hostedBootCommand(io) {
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         io.printErr?.(`hosted-boot failed: ${message}`);
+        // A boot THROW (before/around ensureRun) means the agent never came alive.
+        // Report it so the DO stops + destroys the sandbox NOW instead of waiting
+        // for the readiness timeout, and mark the run failed so it never stays
+        // 'running' forever (the DO also marks it — both are idempotent).
+        await reportBootFailure({ env, ctx: bootCtx, reason: message, log });
         return 1;
     }
 }
+/**
+ * Failure fan-out on a boot throw (ALI-1060): mark the run terminally `failed`
+ * (the operator path's agent-bearer terminal PATCH) and always signal the
+ * coordinator's boot-status route so the DO tears the sandbox down promptly.
+ * Best-effort throughout — the boot secret is scrubbed from the reported reason.
+ *
+ * PRE-BEARER failures (a throw before `onBootContext` — `pullAgentBearer` /
+ * `fetchEnvBundle` blew up, so `ctx` is null) still have a run id: the server
+ * PRE-CREATES it and injects ORIZU_RUN_ID. We attempt a SHORT bearer pull here
+ * so we can self-mark that run failed rather than leaving it `running` until the
+ * DO's readiness timeout. If even that pull fails, the DO backstop (boot-status
+ * failure now, readiness timeout otherwise) is the last line.
+ */
+export async function reportBootFailure(opts) {
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const reason = redactBootReason(opts.reason, opts.env.bootSecret);
+    // The run id is known from the boot context, or (pre-created / resume flows)
+    // straight from the env contract.
+    const runId = opts.ctx?.runId ?? opts.env.runId;
+    // Prefer the bearer we already hold; otherwise pull a fresh one (bounded — the
+    // DO is the backstop) so a pre-bearer failure can still self-mark the run.
+    let bearer = opts.ctx?.bearer ?? null;
+    if (!bearer && runId) {
+        try {
+            bearer = (await pullAgentBearer({
+                agentTokenUrl: opts.env.agentTokenUrl,
+                bootSecret: opts.env.bootSecret,
+                fetchImpl,
+                attempts: 2,
+                log: opts.log,
+            })).token;
+        }
+        catch (error) {
+            opts.log(`failure-path bearer pull failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (bearer && runId) {
+        try {
+            const sink = await resumeRunEventSink({
+                apiBaseUrl: opts.env.baseUrl,
+                runId,
+                bearer,
+                fetchImpl,
+            });
+            await sink.finish('failed', { summary: { error: reason } });
+            opts.log('marked run failed');
+        }
+        catch (error) {
+            opts.log(`run-failed mark failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    await postBootStatus({
+        bootStatusUrl: opts.env.bootStatusUrl,
+        bootSecret: opts.env.bootSecret,
+        status: 'failed',
+        runId,
+        reason,
+        fetchImpl,
+        log: opts.log,
+    });
+}

package/dist/hosted-bootstrap.js

@@ -22,6 +22,7 @@
  * build ON TOP of this — `bootstrapHostedSandbox` is the single writer for the
  * run at this stage and returns the run cursor so a follow-on can continue it.
  */
+import { stageOrizuSkill } from './hosted-skill-staging.js';
 import { sweepForTokenResidue } from './sandbox-hygiene.js';
 import { redactSecrets } from './secret-redaction.js';
 import { AGENT_GIT_IDENTITY, BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, PREBAKED_MARKER_PATH, REPO_CRED_CACHE_BASENAME, SETUP_HOOK_RELATIVE_PATH, parsePrebakedMarker, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
@@ -266,48 +267,25 @@ export async function bootstrapHostedSandbox(opts) {
             });
         }
         // 4b — Stage the orizu-cli skill into the workspace so the agent discovers it
-        // (ALI-1044). Resolve the CLI's OWN vendored skill dir in-sandbox, preferring:
-        //   (1) $ORIZU_SKILL_SOURCE_DIR  — explicit override (also honored by the CLI's
-        //       skill-installer; the local-sim rehearsal sets it),
-        //   (2) `orizu skills path`      — the packaged vendor/skills/orizu-cli of the
-        //       globally-installed CLI (the production path),
-        //   (3) `$(npm root -g)/orizu/vendor/skills/orizu-cli` — belt fallback.
-        // Then SYMLINK it under <workspaceDir>/.claude/skills/orizu-cli, falling back
-        // to a copy if the symlink cannot be created. Non-fatal + recorded, exactly
-        // like the CLI install. Resolved paths stay in shell vars (never interpolated),
-        // so they cannot inject into the command.
+        // (ALI-1044). SHARED with the DO path (ALI-1059): the resolution chain + the
+        // .git/info/exclude append live in `stageOrizuSkill`; here we only adapt the
+        // sandbox exec seam and record the outcome. Non-fatal + recorded, exactly like
+        // the CLI install.
         currentStep = 'skill_staged';
-        const skillSkillsDirRel = `${workspaceDir}/.claude/skills`;
-        const stage = await session.exec([
-            `mkdir -p ${skillSkillsDirRel}`,
-            // The staged skill is bootstrap-injected RUNTIME scaffolding (a symlink to
-            // the sandbox-local CLI vendor dir), NOT the agent's work. Exclude it
-            // repo-LOCALLY (.git/info/exclude — invisible to the diff, never committed)
-            // so auto-harvest's `git add -A` can't sweep it into the session branch and
-            // (ALI-1051) auto-apply a broken symlink to the customer's main.
-            `if [ -d ${workspaceDir}/.git ]; then printf '%s\\n' '/.claude/skills/' >> ${workspaceDir}/.git/info/exclude; fi`,
-            `src="${'${ORIZU_SKILL_SOURCE_DIR:-}'}"`,
-            `if [ -z "$src" ] || [ ! -d "$src" ]; then src="$(orizu skills path 2>/dev/null || true)"; fi`,
-            `if [ -z "$src" ] || [ ! -d "$src" ]; then r="$(npm root -g 2>/dev/null || true)"; if [ -n "$r" ] && [ -d "$r/orizu/vendor/skills/orizu-cli" ]; then src="$r/orizu/vendor/skills/orizu-cli"; fi; fi`,
-            `if [ -z "$src" ] || [ ! -d "$src" ]; then echo "NO_SOURCE"; exit 0; fi`,
-            `dest="${skillSkillsDirRel}/orizu-cli"`,
-            `rm -rf "$dest"`,
-            `if ln -s "$src" "$dest" 2>/dev/null; then echo "SYMLINK $src"; else cp -R "$src" "$dest" && echo "COPY $src"; fi`,
-        ].join('\n'));
-        const stageOut = stage.stdout.trim();
-        const stagedMethod = stageOut.startsWith('SYMLINK')
-            ? 'symlink'
-            : stageOut.startsWith('COPY')
-                ? 'copy'
-                : null;
-        const stagedOk = stage.exitCode === 0 && stagedMethod !== null;
-        record('skill_staged', stagedOk, stagedOk
-            ? `orizu-cli skill staged (${stagedMethod})`
-            : `skill staging unresolved: ${stageOut || `exit ${stage.exitCode}`}`);
+        const stage = await stageOrizuSkill({
+            workspaceDir,
+            exec: async (command) => {
+                const res = await session.exec(command);
+                return { exitCode: res.exitCode, stdout: res.stdout, stderr: res.stderr ?? '' };
+            },
+        });
+        record('skill_staged', stage.ok, stage.ok
+            ? `orizu-cli skill staged (${stage.method})`
+            : `skill staging unresolved: ${stage.stdout.trim() || `exit ${stage.exitCode}`}`);
         await sink.append('skill_staged', {
-            ok: stagedOk,
-            method: stagedMethod,
-            dest: `${skillSkillsDirRel}/orizu-cli`,
+            ok: stage.ok,
+            method: stage.method,
+            dest: stage.dest,
             outputTail: tail(stage.stdout, stage.stderr),
         });
         // 5 — Customer setup hook (fresh-boot only, non-fatal, output captured).

package/dist/hosted-harness-opencode.js

@@ -62,8 +62,10 @@ const DEFAULT_SSE_INACTIVITY_MS = 120_000;
 const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
 // Wall-clock ceiling on a single prompt (port of bridge.py PROMPT_MAX_DURATION,
 // 5400s). Runs alongside the inactivity deadline: inactivity catches a stalled
-// stream, this catches a stream that stays busy forever.
-const DEFAULT_PROMPT_MAX_DURATION_MS = 5_400_000;
+// stream, this catches a stream that stays busy forever. Exported so the hosted
+// loop can use it as the FLOOR when deriving a duration-aware cap (ALI-1061):
+// the cap is never shortened below this default for short/undated runs.
+export const DEFAULT_PROMPT_MAX_DURATION_MS = 5_400_000;
 // Placeholder titles OpenCode auto-assigns ("New session - <ISO8601>Z" /
 // "Child session - <ISO8601>Z"); noise, never forwarded (port of bridge.py
 // OPENCODE_DEFAULT_TITLE_RE).

package/dist/hosted-headless.js

@@ -26,7 +26,7 @@ export class AgentStalledError extends Error {
     }
 }
 /** Render the idle window for the error message. Minutes (the operator-facing
- *  unit; default window is 10m), rounded to one decimal so sub-minute test
+ *  unit; default window is 25m), rounded to one decimal so sub-minute test
  *  windows still read sensibly. */
 export function formatIdleWindow(ms) {
     const minutes = Math.round((ms / 60000) * 10) / 10;
@@ -34,19 +34,26 @@ export function formatIdleWindow(ms) {
 }
 const IDLE_SENTINEL = Symbol('idle');
 /**
- * Wrap `source` so that if no value arrives within `timeoutMs`, `onTimeout` runs
- * and `AgentStalledError` is thrown. The idle timer resets on EVERY value, so it
- * measures gaps between events (progress), not total duration. The still-pending
- * `next()` is not left as an unhandled rejection, and the underlying iterator is
+ * Wrap `source` so that if no PROGRESS arrives within `timeoutMs`, `onTimeout`
+ * runs and `AgentStalledError` is thrown. The idle deadline advances only on
+ * values `opts.isProgress` accepts (default: all), so it measures gaps between
+ * real progress events, not total duration — a stream of non-progress values
+ * (e.g. `question_auto_answered` deny-path events) passes through WITHOUT
+ * resetting the timer, so a stuck loop still stalls. The still-pending `next()`
+ * is not left as an unhandled rejection, and the underlying iterator is
  * returned/closed on any early exit.
  */
 export async function* withIdleWatchdog(source, opts) {
     const iterator = source[Symbol.asyncIterator]();
+    const isProgress = opts.isProgress ?? (() => true);
+    // Absolute deadline so a non-progress value can be yielded WITHOUT extending
+    // the window (each iteration arms the timer for whatever remains).
+    let deadline = Date.now() + opts.timeoutMs;
     try {
         for (;;) {
             let timer;
             const idle = new Promise(resolve => {
-                timer = setTimeout(() => resolve(IDLE_SENTINEL), opts.timeoutMs);
+                timer = setTimeout(() => resolve(IDLE_SENTINEL), Math.max(0, deadline - Date.now()));
             });
             const nextResult = iterator.next();
             let raced;
@@ -66,6 +73,10 @@ export async function* withIdleWatchdog(source, opts) {
             }
             if (raced.done)
                 return;
+            // Only genuine progress pushes the deadline out; non-progress values are
+            // relayed but leave the existing deadline intact.
+            if (isProgress(raced.value))
+                deadline = Date.now() + opts.timeoutMs;
             yield raced.value;
         }
     }