orizu 0.5.10 → 0.5.12

package/dist/hosted-boot.js

@@ -34,6 +34,8 @@ import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeSync } f
 import { AGENT_GIT_IDENTITY, BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, REPO_CRED_CACHE_BASENAME, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
 import { INJECTED_ENV_VARS_ENV, runHostedLoop, } from './hosted-loop.js';
 import { DEFAULT_EGRESS_CANARY_HOST } from './hosted-loop-lifecycle.js';
+import { resumeRunEventSink } from './hosted-run-event-sink.js';
+import { stageOrizuSkill } from './hosted-skill-staging.js';
 /** Non-secret placeholder model key (firewall brokers the real org key on
  *  egress). Byte-for-byte the operator path's constant
  *  (packages/cli/src/hosted-session-cli.ts `ANTHROPIC_DUMMY_KEY` and the
@@ -72,6 +74,10 @@ export function resolveHostedBootEnv(env) {
         value: {
             bootSecret,
             agentTokenUrl,
+            // The boot-status route is the agent-token route's sibling on the same
+            // coordinator, same boot-secret auth (ALI-1060). Deriving it here means no
+            // new env var in the frozen contract / planSandboxEnv.
+            bootStatusUrl: deriveBootStatusUrl(agentTokenUrl),
             envBundleUrl,
             baseUrl: baseUrl.replace(/\/+$/, ''),
             sessionId,
@@ -81,6 +87,51 @@ export function resolveHostedBootEnv(env) {
         },
     };
 }
+/** The boot-status route is the agent-token route's sibling; swap the trailing
+ *  path segment. Falls back to appending when the shape is unexpected. */
+export function deriveBootStatusUrl(agentTokenUrl) {
+    if (/\/agent-token\/?$/.test(agentTokenUrl)) {
+        return agentTokenUrl.replace(/\/agent-token\/?$/, '/boot-status');
+    }
+    return `${agentTokenUrl.replace(/\/+$/, '')}/boot-status`;
+}
+// -- Boot-status callback (ALI-1060) ------------------------------------------
+/** Max chars of the failure reason reported to the coordinator. A boot reason
+ *  is never a place for a secret; this bounds it anyway, and we scrub the boot
+ *  secret defensively before sending. */
+const MAX_BOOT_REASON_CHARS = 800;
+/** Best-effort scrub + truncate for a reported failure reason: never leak the
+ *  boot secret (the one credential the boot always holds), and keep it short. */
+export function redactBootReason(reason, bootSecret) {
+    let out = reason;
+    if (bootSecret && out.includes(bootSecret)) {
+        out = out.split(bootSecret).join('[redacted]');
+    }
+    return out.slice(0, MAX_BOOT_REASON_CHARS);
+}
+/**
+ * Report the boot outcome to the coordinator's boot-status route (ALI-1060),
+ * authed with the boot secret (same as the agent-token pull). Best-effort: the
+ * DO's own readiness-timeout is the backstop if this never lands, so a failed
+ * report must never mask the boot result. NEVER logs the secret.
+ */
+export async function postBootStatus(opts) {
+    try {
+        const res = await opts.fetchImpl(opts.bootStatusUrl, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${opts.bootSecret}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                status: opts.status,
+                ...(opts.runId ? { runId: opts.runId } : {}),
+                ...(opts.reason ? { reason: opts.reason } : {}),
+            }),
+        });
+        opts.log?.(`boot-status ${opts.status} reported (${res.status})`);
+    }
+    catch (error) {
+        opts.log?.(`boot-status ${opts.status} report failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 /**
  * Exchange the boot secret for a fresh Orizu agent bearer at the coordinator's
  * agent-token route (`GET`, `Authorization: Bearer <boot secret>` → 200
@@ -187,6 +238,9 @@ async function bearerJson(fetchImpl, url, bearer, init = {}) {
 function asString(value) {
     return typeof value === 'string' && value.length > 0 ? value : null;
 }
+function asPositiveNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null;
+}
 /** GET the session (agent-capable, RLS-scoped) to learn its workspace, branch,
  *  task, and any existing run — the DO start body carries none of these. */
 export async function resolveSession(opts) {
@@ -210,6 +264,7 @@ export async function resolveSession(opts) {
         task,
         model: asString(clientInfo.model),
         reasoningEffort: asString(clientInfo.reasoningEffort),
+        durationMinutes: asPositiveNumber(clientInfo.durationMinutes),
         runId,
     };
 }
@@ -233,8 +288,7 @@ export async function ensureRun(opts) {
     return runId;
 }
 /** Mint a session_read repo token to learn the repo full name, then build the
- *  GitHub clone URL (mirrors the operator path's `defaultResolveRepo`). The
- *  minted token is best-effort revoked — the credential helper mints its own. */
+ *  GitHub clone URL (mirrors the operator path's `defaultResolveRepo`). */
 export async function resolveRepo(opts) {
     const url = `${opts.baseUrl}/api/cli/workspaces/${encodeURIComponent(opts.workspaceId)}/repo-token`;
     const minted = await bearerJson(opts.fetchImpl, url, opts.bearer, {
@@ -245,20 +299,13 @@ export async function resolveRepo(opts) {
     const repoFullName = asString(minted.repo);
     if (!repoFullName)
         throw new Error('repo-token response carried no repo');
-    const token = asString(minted.token);
-    const mintId = asString(minted.mintId);
-    if (token && mintId) {
-        try {
-            await opts.fetchImpl(url, {
-                method: 'DELETE',
-                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${opts.bearer}` },
-                body: JSON.stringify({ mintId, token }),
-            });
-        }
-        catch {
-            // best-effort revoke — the short TTL is the backstop.
-        }
-    }
+    // We deliberately do NOT early-revoke this probe token (ALI-1069): the
+    // repo-token DELETE route is HUMAN-ONLY (`requireCliSupabase` default-denies
+    // agent bearers), so an agent-bearer revoke would always 401 — a guaranteed
+    // failed request per boot, not a real revoke. Let the short (~60-min)
+    // session_read TTL expire on its own; the credential helper mints its own
+    // per-op tokens for the actual clone/fetch/push, so this probe token is never
+    // reused after we read `repo` from it.
     return { repoFullName, cloneUrl: `https://github.com/${repoFullName}.git` };
 }
 const defaultExec = (cmd, args, opts) => {
@@ -274,6 +321,21 @@ function assertSafeGitValue(name, value) {
         throw new Error(`unsafe characters in ${name}; refusing to pass to git`);
     }
 }
+/**
+ * Path-safety for the run id BEFORE it is interpolated into `.orizu-run/${runId}`
+ * (ALI-1060). ORIZU_RUN_ID can be CALLER-SUPPLIED (resume flows), and unlike the
+ * boot-created uuid it is untrusted — a `../` value would escape the run dir and
+ * let boot assets (0600 bearer/boot-secret files) land outside it. A run id is a
+ * single opaque segment: allow only `[A-Za-z0-9._-]` and reject any `..`, so no
+ * separators or traversal survive. Stricter than the operator path's shared
+ * shell-value assertion (which allows `/`), applied to the same value.
+ */
+const SAFE_RUN_ID = /^[A-Za-z0-9._-]+$/;
+export function assertSafeRunId(runId) {
+    if (!SAFE_RUN_ID.test(runId) || runId.includes('..')) {
+        throw new Error('unsafe run id; refusing to build run-dir paths');
+    }
+}
 function writeSecretFile(path, contents, write) {
     write(path, contents.endsWith('\n') ? contents : `${contents}\n`);
 }
@@ -334,6 +396,12 @@ export async function runHostedBoot(opts) {
         fetchImpl,
         existingRunId: env.runId ?? session.runId,
     });
+    // Path-safety BEFORE the run id reaches any `.orizu-run/${runId}` path
+    // (ALI-1060): a caller-supplied ORIZU_RUN_ID must not escape the run dir.
+    assertSafeRunId(runId);
+    // Hand the run id + bearer to the caller so a throw AFTER this point can mark
+    // the run failed + report the boot failure (the DO is the backstop otherwise).
+    opts.onBootContext?.({ runId, bearer: bearer.token });
     const repo = await resolveRepo({ baseUrl: env.baseUrl, workspaceId, sessionId: env.sessionId, bearer: bearer.token, fetchImpl });
     log(`resolved run ${runId} on ${repo.repoFullName}@${session.repoBranch}`);
     // 4 — Write the run-scoped assets: boot secret + initial bearer (0600), the
@@ -398,6 +466,37 @@ export async function runHostedBoot(opts) {
     exec('git', ['-C', workspaceDir, 'config', 'user.name', AGENT_GIT_IDENTITY.name]);
     exec('git', ['-C', workspaceDir, 'config', 'user.email', AGENT_GIT_IDENTITY.email]);
     log(`cloned ${session.repoBranch}`);
+    // 5b — Stage the orizu-cli skill into the cloned repo so the agent discovers the
+    // Orizu workflows (ALI-1059). SHARED with the operator path via `stageOrizuSkill`
+    // (one resolution chain + the harvest-safe .git/info/exclude append). Non-fatal:
+    // a staging failure is logged, never aborts the boot. The DO `BootExec` is
+    // shell-less, so the staging script runs under `sh -c`.
+    try {
+        const skillStage = await stageOrizuSkill({
+            workspaceDir,
+            exec: async (command) => {
+                const res = exec('sh', ['-c', command]);
+                return { exitCode: res.status, stdout: res.stdout, stderr: res.stderr ?? '' };
+            },
+        });
+        log(`orizu-cli skill staged: ${skillStage.ok ? skillStage.method : 'unresolved'}`);
+    }
+    catch (error) {
+        log(`orizu-cli skill staging failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    // ALI-1060: the agent is now genuinely LIVE — bearer minted, connectors
+    // applied, session/run resolved, repo cloned, skill staged. Signal the
+    // coordinator's readiness gate BEFORE the loop so the DO stops waiting (and
+    // never tears down a healthy box on timeout). Best-effort; the DO's timeout is
+    // the backstop.
+    await postBootStatus({
+        bootStatusUrl: env.bootStatusUrl,
+        bootSecret: env.bootSecret,
+        status: 'ready',
+        runId,
+        fetchImpl,
+        log,
+    });
     // 6 — Launch the hosted loop, reused in-process. The bearer PROVIDER keeps the
     // event sink's bearer fresh from the same pull-mode source; the DO-provisioned
     // sandbox always runs the pre-baked image under an enforced egress policy, so
@@ -414,6 +513,10 @@ export async function runHostedBoot(opts) {
         messageId: `${runId}:task`,
         author: AGENT_GIT_IDENTITY,
         anthropicDummyKey: env.anthropicDummyKey ?? ANTHROPIC_DUMMY_KEY,
+        // Derive the per-prompt max-duration cap from the session duration so a long
+        // run is not killed at the hard-coded 90-min prompt cap (ALI-1061). Unset →
+        // the harness default (5400s) floor holds.
+        sandboxBudgetMs: session.durationMinutes != null ? session.durationMinutes * 60 * 1000 : undefined,
         prebaked: true,
         egressCanaryHost: DEFAULT_EGRESS_CANARY_HOST,
         runSetupHook: true,
@@ -443,6 +546,25 @@ export async function runHostedBoot(opts) {
             bearerProvider: () => readFile(bearerFileAbs).trim(),
         });
         log(`hosted-loop finished: ${result.status}`);
+        // ALI-1064: the loop is TERMINAL — the auto-harvest (ALI-1036) and the
+        // run's terminal seal already ran INSIDE runHostedLoop, so it is safe to
+        // hand the session back. Report `complete` so the DO ends the workspace
+        // session server-side and stops/destroys the sandbox NOW instead of
+        // extending it until the 24h cap (live 2026-07-15: zombie boxes burned
+        // 2×CPU/4GiB for hours after their loops finished). This fires for a
+        // failed loop too — the run is terminal either way, and the loop already
+        // owns its own run-level terminal state (never a `failed` boot-status
+        // here; that would misreport a run failure as a bootstrap failure).
+        // Best-effort: the DO's duration/24h caps are the backstop.
+        await postBootStatus({
+            bootStatusUrl: env.bootStatusUrl,
+            bootSecret: env.bootSecret,
+            status: 'complete',
+            runId,
+            reason: result.error ? redactBootReason(result.error, env.bootSecret) : null,
+            fetchImpl,
+            log,
+        });
         return { ok: !result.error, runId, loopStatus: result.status, error: result.error };
     }
     finally {
@@ -518,10 +640,18 @@ export async function hostedBootCommand(io) {
             '(the DO sandbox env contract — see planSandboxEnv)');
         return 1;
     }
+    const env = resolved.value;
+    const log = (line) => io.printErr?.(`[hosted-boot] ${line}`);
+    // Captured once the run id + bearer are known, so a LATER throw can mark the
+    // run failed with an authenticated bearer (ALI-1060).
+    let bootCtx = null;
     try {
         const result = await runHostedBoot({
-            env: resolved.value,
-            log: line => io.printErr?.(`[hosted-boot] ${line}`),
+            env,
+            log,
+            onBootContext: ctx => {
+                bootCtx = ctx;
+            },
         });
         io.print(io.json
             ? JSON.stringify({ ok: result.ok, runId: result.runId, status: result.loopStatus, error: result.error })
@@ -531,6 +661,72 @@ export async function hostedBootCommand(io) {
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         io.printErr?.(`hosted-boot failed: ${message}`);
+        // A boot THROW (before/around ensureRun) means the agent never came alive.
+        // Report it so the DO stops + destroys the sandbox NOW instead of waiting
+        // for the readiness timeout, and mark the run failed so it never stays
+        // 'running' forever (the DO also marks it — both are idempotent).
+        await reportBootFailure({ env, ctx: bootCtx, reason: message, log });
         return 1;
     }
 }
+/**
+ * Failure fan-out on a boot throw (ALI-1060): mark the run terminally `failed`
+ * (the operator path's agent-bearer terminal PATCH) and always signal the
+ * coordinator's boot-status route so the DO tears the sandbox down promptly.
+ * Best-effort throughout — the boot secret is scrubbed from the reported reason.
+ *
+ * PRE-BEARER failures (a throw before `onBootContext` — `pullAgentBearer` /
+ * `fetchEnvBundle` blew up, so `ctx` is null) still have a run id: the server
+ * PRE-CREATES it and injects ORIZU_RUN_ID. We attempt a SHORT bearer pull here
+ * so we can self-mark that run failed rather than leaving it `running` until the
+ * DO's readiness timeout. If even that pull fails, the DO backstop (boot-status
+ * failure now, readiness timeout otherwise) is the last line.
+ */
+export async function reportBootFailure(opts) {
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const reason = redactBootReason(opts.reason, opts.env.bootSecret);
+    // The run id is known from the boot context, or (pre-created / resume flows)
+    // straight from the env contract.
+    const runId = opts.ctx?.runId ?? opts.env.runId;
+    // Prefer the bearer we already hold; otherwise pull a fresh one (bounded — the
+    // DO is the backstop) so a pre-bearer failure can still self-mark the run.
+    let bearer = opts.ctx?.bearer ?? null;
+    if (!bearer && runId) {
+        try {
+            bearer = (await pullAgentBearer({
+                agentTokenUrl: opts.env.agentTokenUrl,
+                bootSecret: opts.env.bootSecret,
+                fetchImpl,
+                attempts: 2,
+                log: opts.log,
+            })).token;
+        }
+        catch (error) {
+            opts.log(`failure-path bearer pull failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (bearer && runId) {
+        try {
+            const sink = await resumeRunEventSink({
+                apiBaseUrl: opts.env.baseUrl,
+                runId,
+                bearer,
+                fetchImpl,
+            });
+            await sink.finish('failed', { summary: { error: reason } });
+            opts.log('marked run failed');
+        }
+        catch (error) {
+            opts.log(`run-failed mark failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    await postBootStatus({
+        bootStatusUrl: opts.env.bootStatusUrl,
+        bootSecret: opts.env.bootSecret,
+        status: 'failed',
+        runId,
+        reason,
+        fetchImpl,
+        log: opts.log,
+    });
+}

package/dist/hosted-bootstrap.js

@@ -22,6 +22,7 @@
  * build ON TOP of this — `bootstrapHostedSandbox` is the single writer for the
  * run at this stage and returns the run cursor so a follow-on can continue it.
  */
+import { stageOrizuSkill } from './hosted-skill-staging.js';
 import { sweepForTokenResidue } from './sandbox-hygiene.js';
 import { redactSecrets } from './secret-redaction.js';
 import { AGENT_GIT_IDENTITY, BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, PREBAKED_MARKER_PATH, REPO_CRED_CACHE_BASENAME, SETUP_HOOK_RELATIVE_PATH, parsePrebakedMarker, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
@@ -266,48 +267,25 @@ export async function bootstrapHostedSandbox(opts) {
             });
         }
         // 4b — Stage the orizu-cli skill into the workspace so the agent discovers it
-        // (ALI-1044). Resolve the CLI's OWN vendored skill dir in-sandbox, preferring:
-        //   (1) $ORIZU_SKILL_SOURCE_DIR  — explicit override (also honored by the CLI's
-        //       skill-installer; the local-sim rehearsal sets it),
-        //   (2) `orizu skills path`      — the packaged vendor/skills/orizu-cli of the
-        //       globally-installed CLI (the production path),
-        //   (3) `$(npm root -g)/orizu/vendor/skills/orizu-cli` — belt fallback.
-        // Then SYMLINK it under <workspaceDir>/.claude/skills/orizu-cli, falling back
-        // to a copy if the symlink cannot be created. Non-fatal + recorded, exactly
-        // like the CLI install. Resolved paths stay in shell vars (never interpolated),
-        // so they cannot inject into the command.
+        // (ALI-1044). SHARED with the DO path (ALI-1059): the resolution chain + the
+        // .git/info/exclude append live in `stageOrizuSkill`; here we only adapt the
+        // sandbox exec seam and record the outcome. Non-fatal + recorded, exactly like
+        // the CLI install.
         currentStep = 'skill_staged';
-        const skillSkillsDirRel = `${workspaceDir}/.claude/skills`;
-        const stage = await session.exec([
-            `mkdir -p ${skillSkillsDirRel}`,
-            // The staged skill is bootstrap-injected RUNTIME scaffolding (a symlink to
-            // the sandbox-local CLI vendor dir), NOT the agent's work. Exclude it
-            // repo-LOCALLY (.git/info/exclude — invisible to the diff, never committed)
-            // so auto-harvest's `git add -A` can't sweep it into the session branch and
-            // (ALI-1051) auto-apply a broken symlink to the customer's main.
-            `if [ -d ${workspaceDir}/.git ]; then printf '%s\\n' '/.claude/skills/' >> ${workspaceDir}/.git/info/exclude; fi`,
-            `src="${'${ORIZU_SKILL_SOURCE_DIR:-}'}"`,
-            `if [ -z "$src" ] || [ ! -d "$src" ]; then src="$(orizu skills path 2>/dev/null || true)"; fi`,
-            `if [ -z "$src" ] || [ ! -d "$src" ]; then r="$(npm root -g 2>/dev/null || true)"; if [ -n "$r" ] && [ -d "$r/orizu/vendor/skills/orizu-cli" ]; then src="$r/orizu/vendor/skills/orizu-cli"; fi; fi`,
-            `if [ -z "$src" ] || [ ! -d "$src" ]; then echo "NO_SOURCE"; exit 0; fi`,
-            `dest="${skillSkillsDirRel}/orizu-cli"`,
-            `rm -rf "$dest"`,
-            `if ln -s "$src" "$dest" 2>/dev/null; then echo "SYMLINK $src"; else cp -R "$src" "$dest" && echo "COPY $src"; fi`,
-        ].join('\n'));
-        const stageOut = stage.stdout.trim();
-        const stagedMethod = stageOut.startsWith('SYMLINK')
-            ? 'symlink'
-            : stageOut.startsWith('COPY')
-                ? 'copy'
-                : null;
-        const stagedOk = stage.exitCode === 0 && stagedMethod !== null;
-        record('skill_staged', stagedOk, stagedOk
-            ? `orizu-cli skill staged (${stagedMethod})`
-            : `skill staging unresolved: ${stageOut || `exit ${stage.exitCode}`}`);
+        const stage = await stageOrizuSkill({
+            workspaceDir,
+            exec: async (command) => {
+                const res = await session.exec(command);
+                return { exitCode: res.exitCode, stdout: res.stdout, stderr: res.stderr ?? '' };
+            },
+        });
+        record('skill_staged', stage.ok, stage.ok
+            ? `orizu-cli skill staged (${stage.method})`
+            : `skill staging unresolved: ${stage.stdout.trim() || `exit ${stage.exitCode}`}`);
         await sink.append('skill_staged', {
-            ok: stagedOk,
-            method: stagedMethod,
-            dest: `${skillSkillsDirRel}/orizu-cli`,
+            ok: stage.ok,
+            method: stage.method,
+            dest: stage.dest,
             outputTail: tail(stage.stdout, stage.stderr),
         });
         // 5 — Customer setup hook (fresh-boot only, non-fatal, output captured).

package/dist/hosted-harness-opencode.js

@@ -62,8 +62,10 @@ const DEFAULT_SSE_INACTIVITY_MS = 120_000;
 const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
 // Wall-clock ceiling on a single prompt (port of bridge.py PROMPT_MAX_DURATION,
 // 5400s). Runs alongside the inactivity deadline: inactivity catches a stalled
-// stream, this catches a stream that stays busy forever.
-const DEFAULT_PROMPT_MAX_DURATION_MS = 5_400_000;
+// stream, this catches a stream that stays busy forever. Exported so the hosted
+// loop can use it as the FLOOR when deriving a duration-aware cap (ALI-1061):
+// the cap is never shortened below this default for short/undated runs.
+export const DEFAULT_PROMPT_MAX_DURATION_MS = 5_400_000;
 // Placeholder titles OpenCode auto-assigns ("New session - <ISO8601>Z" /
 // "Child session - <ISO8601>Z"); noise, never forwarded (port of bridge.py
 // OPENCODE_DEFAULT_TITLE_RE).

package/dist/hosted-headless.js

@@ -26,7 +26,7 @@ export class AgentStalledError extends Error {
     }
 }
 /** Render the idle window for the error message. Minutes (the operator-facing
- *  unit; default window is 10m), rounded to one decimal so sub-minute test
+ *  unit; default window is 25m), rounded to one decimal so sub-minute test
  *  windows still read sensibly. */
 export function formatIdleWindow(ms) {
     const minutes = Math.round((ms / 60000) * 10) / 10;
@@ -34,19 +34,26 @@ export function formatIdleWindow(ms) {
 }
 const IDLE_SENTINEL = Symbol('idle');
 /**
- * Wrap `source` so that if no value arrives within `timeoutMs`, `onTimeout` runs
- * and `AgentStalledError` is thrown. The idle timer resets on EVERY value, so it
- * measures gaps between events (progress), not total duration. The still-pending
- * `next()` is not left as an unhandled rejection, and the underlying iterator is
+ * Wrap `source` so that if no PROGRESS arrives within `timeoutMs`, `onTimeout`
+ * runs and `AgentStalledError` is thrown. The idle deadline advances only on
+ * values `opts.isProgress` accepts (default: all), so it measures gaps between
+ * real progress events, not total duration — a stream of non-progress values
+ * (e.g. `question_auto_answered` deny-path events) passes through WITHOUT
+ * resetting the timer, so a stuck loop still stalls. The still-pending `next()`
+ * is not left as an unhandled rejection, and the underlying iterator is
  * returned/closed on any early exit.
  */
 export async function* withIdleWatchdog(source, opts) {
     const iterator = source[Symbol.asyncIterator]();
+    const isProgress = opts.isProgress ?? (() => true);
+    // Absolute deadline so a non-progress value can be yielded WITHOUT extending
+    // the window (each iteration arms the timer for whatever remains).
+    let deadline = Date.now() + opts.timeoutMs;
     try {
         for (;;) {
             let timer;
             const idle = new Promise(resolve => {
-                timer = setTimeout(() => resolve(IDLE_SENTINEL), opts.timeoutMs);
+                timer = setTimeout(() => resolve(IDLE_SENTINEL), Math.max(0, deadline - Date.now()));
             });
             const nextResult = iterator.next();
             let raced;
@@ -66,6 +73,10 @@ export async function* withIdleWatchdog(source, opts) {
             }
             if (raced.done)
                 return;
+            // Only genuine progress pushes the deadline out; non-progress values are
+            // relayed but leave the existing deadline intact.
+            if (isProgress(raced.value))
+                deadline = Date.now() + opts.timeoutMs;
             yield raced.value;
         }
     }

package/dist/hosted-loop.js

@@ -39,7 +39,7 @@ import { join } from 'path';
 import { HOSTED_TASK_PREAMBLE, PREBAKED_MARKER_PATH, SETUP_HOOK_RELATIVE_PATH, composeHostedTaskPrompt, parsePrebakedMarker, } from './hosted-runtime-assets.js';
 import { harvestWorkspace } from './hosted-harvest.js';
 import { annotateHeadlessQuestions, withIdleWatchdog } from './hosted-headless.js';
-import { OPENCODE_PINNED_VERSION, createOpenCodeHarness, spawnOpenCode, } from './hosted-harness-opencode.js';
+import { DEFAULT_PROMPT_MAX_DURATION_MS, OPENCODE_PINNED_VERSION, createOpenCodeHarness, spawnOpenCode, } from './hosted-harness-opencode.js';
 import { createClaudeAgentHarness } from './hosted-harness-claude.js';
 import { drainHarnessToSink, resumeRunEventSink, } from './hosted-run-event-sink.js';
 import { buildOpenCodeSpawnEnv, defaultProbeEgress, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
@@ -47,6 +47,24 @@ import { buildOpenCodeSpawnEnv, defaultProbeEgress, egressCanaryAllowedHost, run
 // (ALI-1015 Phase 1) so `lib/hosted-runtime/` can share it with a server-side
 // coordinator. Re-exported here so this module's public surface is unchanged.
 export { DEFAULT_EGRESS_CANARY_HOST, buildOpenCodeSpawnEnv, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
+// Time reserved BEFORE the sandbox self-terminates so a duration-capped prompt
+// abort still has room to harvest partial work (commit/push) + write the terminal
+// event: `promptMaxDurationMs = sandboxBudgetMs − this` (ALI-1061). 5 min is
+// comfortably above the observed harvest+flush cost while costing little of a
+// multi-hour budget.
+export const PROMPT_HARVEST_MARGIN_MS = 5 * 60 * 1000;
+/**
+ * Derive the per-prompt max-duration cap from the sandbox lifetime budget: the
+ * budget minus a harvest margin, FLOORED at the harness default so a short or
+ * undated run is never shortened below the historical 5400s cap (ALI-1061).
+ * Undated runs (`sandboxBudgetMs` unset / non-positive) get exactly the default.
+ */
+export function derivePromptMaxDurationMs(sandboxBudgetMs) {
+    if (typeof sandboxBudgetMs !== 'number' || !Number.isFinite(sandboxBudgetMs) || sandboxBudgetMs <= 0) {
+        return DEFAULT_PROMPT_MAX_DURATION_MS;
+    }
+    return Math.max(DEFAULT_PROMPT_MAX_DURATION_MS, sandboxBudgetMs - PROMPT_HARVEST_MARGIN_MS);
+}
 /**
  * Default deferred-setup-hook runner (in-sandbox): run `bash .orizu/setup.sh` in
  * the workspace if present. Non-fatal — a missing hook or a non-zero exit is
@@ -381,7 +399,13 @@ export async function runHostedLoop(opts) {
                     payload: { step: 'opencode_ready', ok: true, waitedMs: spawned.readyAfterMs },
                 });
             }
-            harness = (opts.createHarness ?? ((baseUrl) => createOpenCodeHarness({ baseUrl })))(spawned.baseUrl);
+            // Derive the per-prompt max-duration cap from the sandbox budget so a long
+            // `--duration` run is not killed at the hard-coded 90-min cap while its
+            // sandbox is still alive; floored at the harness default for short/undated
+            // runs (ALI-1061).
+            const promptMaxDurationMs = derivePromptMaxDurationMs(context.sandboxBudgetMs);
+            harness = (opts.createHarness ??
+                ((baseUrl, options) => createOpenCodeHarness({ baseUrl, promptMaxDurationMs: options?.promptMaxDurationMs })))(spawned.baseUrl, { promptMaxDurationMs });
         }
         const started = await harness.start({
             workspaceDir: context.workspaceDir,
@@ -412,6 +436,18 @@ export async function runHostedLoop(opts) {
         else
             signal.addEventListener('abort', () => promptController.abort(), { once: true });
         const annotated = annotateHeadlessQuestions(harness.runPrompt(prompt, promptController.signal));
+        if (idleTimeoutMs <= 0) {
+            // <= 0 explicitly DISABLES the watchdog (e.g. ORIZU_AGENT_IDLE_TIMEOUT_MS=0):
+            // a stalled prompt will hang until the sandbox/prompt hard cap. Record it so
+            // a run that never progresses isn't a silent mystery in the timeline (ALI-1069).
+            await sink.append({
+                kind: 'artifact',
+                payload: {
+                    step: 'idle_watchdog_disabled',
+                    detail: 'idle watchdog disabled (idle timeout <= 0); a stalled prompt will not auto-fail agent_stalled',
+                },
+            });
+        }
         const drivenStream = idleTimeoutMs > 0
             ? withIdleWatchdog(annotated, {
                 timeoutMs: idleTimeoutMs,
@@ -419,6 +455,11 @@ export async function runHostedLoop(opts) {
                     promptController.abort();
                     await harness.stop();
                 },
+                // The `question` tool is DENIED headless, so a model stuck retrying it
+                // emits a stream of synthetic `question_auto_answered` events. Those are
+                // NOT progress — excluding them lets a deny/retry loop trip agent_stalled
+                // instead of resetting the idle timer forever (ALI-1069).
+                isProgress: event => event.kind !== 'question_auto_answered',
             })
             : annotated;
         const status = await drainHarnessToSink(drivenStream, sink, {