orizu 0.5.12 → 0.5.14

package/dist/deploy-key-merge-core.js

@@ -53,13 +53,23 @@ export function assertCommitPreservingMergeArgs(args) {
 }
 const LOCAL_BASE_REF = 'refs/heads/__orizu_merge_base';
 const LOCAL_SOURCE_REF = 'refs/remotes/origin/__orizu_merge_source';
-// GitHub's published SSH host keys:
+// GitHub's published SSH host keys (PINNED — never ssh-keyscan'd at runtime):
 // https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
-const GITHUB_KNOWN_HOSTS = [
-    'github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl',
-    'github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=',
-    'github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=',
-].join('\n') + '\n';
+// (canonically republished at https://api.github.com/meta `ssh_keys`).
+const GITHUB_HOST_KEYS = [
+    'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl',
+    'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=',
+    'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=',
+];
+// Both SSH endpoints GitHub serves git over: the standard port AND the
+// SSH-over-the-HTTPS-port endpoint (docs.github.com "Using SSH over the
+// HTTPS port") the merge sandbox uses — its egress firewall enforces at
+// SNI/CIDR level and raw SSH on :22 was reset in the first live run
+// (ALI-1084 live-fire, 2026-07-15). GitHub publishes ONE key set for both
+// hosts; OpenSSH matches a non-22 port with the `[host]:port` known_hosts
+// form, so the 443 endpoint needs its own lines. Pinning discipline is
+// unchanged: same keys, one more host alias.
+const GITHUB_KNOWN_HOSTS = GITHUB_HOST_KEYS.flatMap(key => [`github.com ${key}`, `[ssh.github.com]:443 ${key}`]).join('\n') + '\n';
 /**
  * Strip git's repo-context env vars from a child git's environment. Git
  * EXPORTS these into hook subprocesses (from a linked worktree, GIT_DIR is an
@@ -104,6 +114,21 @@ export function sshRemote(repoFullName) {
     }
     return `git@github.com:${repoFullName}.git`;
 }
+/**
+ * The SSH-over-the-HTTPS-port remote (GitHub-supported: `ssh.github.com:443`
+ * speaks the same SSH protocol, same auth, same host-key set). The MERGE core
+ * uses this endpoint because the merge sandbox's egress firewall enforces at
+ * the SNI/CIDR layer and reset raw SSH on :22 in the first live run
+ * (ALI-1084); :443 within GitHub's published git CIDRs is the compatible
+ * path. Equivalent from dev machines, so local/sandbox parity holds (D6).
+ * The push/read paths (D9/Phase 6) keep `sshRemote` untouched.
+ */
+export function sshRemoteOverHttpsPort(repoFullName) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repoFullName)) {
+        throw new Error(`Invalid repo full name: ${repoFullName}`);
+    }
+    return `ssh://git@ssh.github.com:443/${repoFullName}.git`;
+}
 function shellQuote(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -176,7 +201,10 @@ export async function mergeBranchWithDeployKey(repoFullName, input, deps = {}) {
     const runGit = deps.runGit ?? defaultRunGit;
     return withDeployKeyGit(input.privateKeyPem, runGit, 'orizu-merge-', async ({ git, gitOk }) => {
         await gitOk(['init'], 'git init');
-        await gitOk(['remote', 'add', 'origin', sshRemote(repoFullName)], 'git remote add');
+        // SSH over the HTTPS port (ALI-1084 live-fire fix): the merge sandbox's
+        // egress firewall reset raw SSH on github.com:22; ssh.github.com:443 is
+        // the GitHub-supported equivalent (same protocol, same pinned host keys).
+        await gitOk(['remote', 'add', 'origin', sshRemoteOverHttpsPort(repoFullName)], 'git remote add');
         await gitOk(['fetch', '--no-tags', 'origin', `refs/heads/${input.base}:${LOCAL_BASE_REF}`], 'git fetch default branch');
         await gitOk(['checkout', '-B', '__orizu_merge_base', LOCAL_BASE_REF], 'git checkout default branch');
         await gitOk(['fetch', '--no-tags', 'origin', `refs/heads/${input.sourceBranch}:${LOCAL_SOURCE_REF}`], 'git fetch reviewed source branch');

package/dist/hosted-boot.js

@@ -33,7 +33,7 @@ import { spawnSync } from 'child_process';
 import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeSync } from 'fs';
 import { AGENT_GIT_IDENTITY, BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, REPO_CRED_CACHE_BASENAME, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
 import { INJECTED_ENV_VARS_ENV, runHostedLoop, } from './hosted-loop.js';
-import { DEFAULT_EGRESS_CANARY_HOST } from './hosted-loop-lifecycle.js';
+import { DEFAULT_EGRESS_CANARY_HOST, DEFAULT_HOSTED_MODEL } from './hosted-loop-lifecycle.js';
 import { resumeRunEventSink } from './hosted-run-event-sink.js';
 import { stageOrizuSkill } from './hosted-skill-staging.js';
 /** Non-secret placeholder model key (firewall brokers the real org key on
@@ -42,8 +42,6 @@ import { stageOrizuSkill } from './hosted-skill-staging.js';
  *  DO-path `workers/session-coordinator/src/bootstrap.ts`); kept in sync by
  *  grep. Inlined (not imported) to avoid a hosted-session-cli import cycle. */
 const ANTHROPIC_DUMMY_KEY = 'sk-ant-orizu-proxy-broker-placeholder';
-/** Default hosted model — mirrors hosted-session-cli.ts `DEFAULT_HOSTED_MODEL`. */
-const DEFAULT_HOSTED_MODEL = 'anthropic/claude-opus-4-8';
 // -- Frozen env contract ------------------------------------------------------
 export const REQUIRED_BOOT_ENV_VARS = [
     'ORIZU_BOOT_SECRET',
@@ -371,6 +369,16 @@ export async function runHostedBoot(opts) {
     const readFile = opts.readFile ?? ((path) => readFileSync(path, 'utf8'));
     const log = opts.log ?? (() => { });
     const now = opts.now ?? (() => Date.now());
+    // 0 — ENV HYGIENE (ALI-1062): the boot secret is the DO path's only durable
+    // credential (it mints agent bearers at the internet-reachable agent-token
+    // route for up to 24h), and `env.bootSecret` is already captured — so scrub
+    // the raw value from the process env NOW, before anything downstream can
+    // inherit it: the opencode/agent process is spawned with `{...process.env}`
+    // (nodeChildSpawner) and the customer `.orizu/setup.sh` hook inherits the
+    // env too. Nothing reads it from the env after this point — the rotation /
+    // boot-status closures hold `env.bootSecret`, and the git credential helper
+    // reads the 0600 run-dir boot-secret FILE (written in step 4).
+    delete processEnv.ORIZU_BOOT_SECRET;
     // 1 — Pull the agent bearer (retry/backoff — the DO may still be arming).
     const bearer = await pullAgentBearer({
         agentTokenUrl: env.agentTokenUrl,
@@ -533,10 +541,20 @@ export async function runHostedBoot(opts) {
     });
     try {
         const runLoop = opts.runLoop ??
-            ((input) => runHostedLoop({ context: input.context, taskPrompt: input.taskPrompt, bearerProvider: input.bearerProvider }));
+            ((input) => runHostedLoop({
+                context: input.context,
+                taskPrompt: input.taskPrompt,
+                bearerProvider: input.bearerProvider,
+                redactSecretsList: input.redactSecretsList,
+            }));
         const result = await runLoop({
             context: loopContext,
             taskPrompt: session.task,
+            // ALI-1062 exact-value redaction: the boot secret is 64 bare hex chars —
+            // no TOKEN_SHAPE_PATTERNS rule can catch it, so it MUST ride the loop's
+            // verbatim redaction list or an echoed env dump would land it in
+            // workbench_run_events.
+            redactSecretsList: [env.bootSecret],
             // Read the bearer FILE fresh per request (review F1): `startBearerRotation`
             // rewrites `bearerFileAbs` before the current bearer expires, so a run
             // exceeding the ~60-min TTL (DO cap is 24h) keeps a valid bearer. A frozen

package/dist/hosted-harness-opencode.js

@@ -120,6 +120,22 @@ const ANTHROPIC_ADAPTIVE_THINKING_MODELS = new Set([
     'claude-sonnet-4-6',
 ]);
 const ANTHROPIC_ADAPTIVE_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+/**
+ * Split a possibly provider-qualified model string into provider + model id.
+ * SINGLE-SLASH ids ("anthropic/claude-opus-4-8") are the assumed form; a bare
+ * id defaults to provider "anthropic". This is THE shared parse — consumed by
+ * BOTH the prompt path (`buildPromptRequestBody`) and the pre-prompt
+ * validation (`awaitOpenCodeModelResolvable`), so the two can never drift:
+ * parity is exactly what makes the validation meaningful (ALI-1086).
+ * KNOWN LIMIT: `split('/', 2)` drops everything after the second slash, so a
+ * 3-part id ("openrouter/anthropic/claude-x") misparses to provider
+ * "openrouter" + model "anthropic" — identically in both places (today's
+ * pre-existing prompt-path behavior, now shared rather than duplicated).
+ */
+export function qualifyHostedModel(model) {
+    const [providerId, modelId] = model.includes('/') ? model.split('/', 2) : ['anthropic', model];
+    return { providerId, modelId };
+}
 export function buildPromptRequestBody(content, model, opencodeMessageId, reasoningEffort) {
     const body = {
         parts: [{ type: 'text', text: content }],
@@ -127,7 +143,9 @@ export function buildPromptRequestBody(content, model, opencodeMessageId, reason
     };
     if (!model)
         return body;
-    const [providerId, modelId] = model.includes('/') ? model.split('/', 2) : ['anthropic', model];
+    // Shared parse (see qualifyHostedModel): keeps the prompt path and the
+    // ALI-1086 pre-prompt validation in lockstep by construction.
+    const { providerId, modelId } = qualifyHostedModel(model);
     const modelSpec = { providerID: providerId, modelID: modelId };
     if (reasoningEffort) {
         if (providerId === 'anthropic') {
@@ -688,6 +706,131 @@ function errorEvent(messageId, error) {
     const message = error instanceof Error ? error.message : String(error);
     return { kind: 'error', messageId, critical: true, payload: { error: message } };
 }
+const MODEL_CATALOG_REQUEST_TIMEOUT_MS = 10_000;
+/**
+ * Read the resolvable catalog from a running `opencode serve` via
+ * `GET /config/providers` (shape: `{ providers: [{ id, models: { <id>: … } }] }`,
+ * verified against opencode-ai@1.14.41). Returns null on ANY transport/shape
+ * failure — the caller treats that as "cannot validate", never as "invalid".
+ */
+export async function fetchOpenCodeModelCatalog(baseUrl, fetchImpl = globalThis.fetch, timeoutMs = MODEL_CATALOG_REQUEST_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(`${baseUrl.replace(/\/$/, '')}/config/providers`, {
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return null;
+        const data = asRecord(await res.json());
+        if (!Array.isArray(data.providers))
+            return null;
+        const catalog = new Map();
+        for (const entry of data.providers) {
+            const provider = asRecord(entry);
+            const id = typeof provider.id === 'string' ? provider.id : null;
+            if (!id)
+                continue;
+            catalog.set(id, Object.keys(asRecord(provider.models)));
+        }
+        return catalog;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function sharedPrefixLength(a, b) {
+    const max = Math.min(a.length, b.length);
+    let i = 0;
+    while (i < max && a[i] === b[i])
+        i += 1;
+    return i;
+}
+/** Rank candidate model ids by similarity to the requested id (longest shared
+ *  prefix first, ties broken lexicographically DESCENDING so the newest of a
+ *  versioned family leads) and cap the list — the fail-fast error should lead
+ *  with the closest/newest substitutes, not a full catalog dump. */
+export function rankModelAlternatives(requested, candidates, limit = 8) {
+    return [...new Set(candidates)]
+        .sort((a, b) => {
+        const byPrefix = sharedPrefixLength(requested, b) - sharedPrefixLength(requested, a);
+        return byPrefix !== 0 ? byPrefix : b.localeCompare(a);
+    })
+        .slice(0, limit);
+}
+const MODEL_RESOLVE_TIMEOUT_MS = 30_000;
+const MODEL_RESOLVE_POLL_MS = 2_000;
+/**
+ * Decide whether the requested model is resolvable by the RUNNING opencode,
+ * polling briefly so the boot-time models.dev refresh has time to land.
+ * Fail-open on validator infrastructure, with a DELIBERATE asymmetry on null
+ * catalog reads:
+ *   - null BEFORE any successful read → `skipped` immediately (dead/absent
+ *     endpoint; opencode's own `session.error` remains the backstop, and the
+ *     early exit keeps absent-endpoint runs — and tests — cheap);
+ *   - null AFTER at least one successful read → a transient boot-window blip
+ *     (5xx/drop): sleep and keep polling within the budget; a budget that
+ *     ends in that state returns `skipped`, NEVER a false `unresolvable` off
+ *     a flaky read.
+ * Only a HEALTHY catalog that never lists the model within the budget yields
+ * `unresolvable`, with ranked, provider-qualified alternatives.
+ */
+export async function awaitOpenCodeModelResolvable(opts) {
+    const timeoutMs = opts.timeoutMs ?? MODEL_RESOLVE_TIMEOUT_MS;
+    const pollMs = opts.pollMs ?? MODEL_RESOLVE_POLL_MS;
+    const sleep = opts.sleep ?? ((ms) => new Promise(r => setTimeout(r, ms)));
+    const now = opts.now ?? (() => Date.now());
+    const { providerId, modelId } = qualifyHostedModel(opts.model);
+    const requested = `${providerId}/${modelId}`;
+    const startedAt = now();
+    let lastGoodCatalog = null;
+    let sawTransientFailure = false;
+    for (;;) {
+        const catalog = await fetchOpenCodeModelCatalog(opts.baseUrl, opts.fetchImpl);
+        if (catalog === null) {
+            if (lastGoodCatalog === null) {
+                // Never answered — the endpoint is dead/absent, not blipping. Skip
+                // immediately rather than invent a failure mode (or a slow wait) the
+                // run would not otherwise have.
+                return { kind: 'skipped', reason: 'opencode /config/providers unavailable' };
+            }
+            // Transient failure after a successful read (boot-window 5xx/drop) —
+            // keep polling within the budget.
+            sawTransientFailure = true;
+        }
+        else {
+            lastGoodCatalog = catalog;
+            sawTransientFailure = false;
+            if ((catalog.get(providerId) ?? []).includes(modelId)) {
+                return { kind: 'resolvable', waitedMs: now() - startedAt };
+            }
+            // Deliberately NOT failing fast when the provider itself is unknown:
+            // the models.dev refresh can add whole providers too, so the poll runs
+            // the full budget either way.
+        }
+        if (now() - startedAt >= timeoutMs)
+            break;
+        await sleep(pollMs);
+    }
+    if (sawTransientFailure || lastGoodCatalog === null) {
+        // The budget ended on a flaky read — never declare `unresolvable` off it.
+        return { kind: 'skipped', reason: 'opencode /config/providers became unavailable mid-poll' };
+    }
+    const providerKnown = lastGoodCatalog.has(providerId);
+    const candidates = providerKnown
+        ? (lastGoodCatalog.get(providerId) ?? []).map(id => `${providerId}/${id}`)
+        : [...lastGoodCatalog.entries()].flatMap(([pid, ids]) => ids.map(id => `${pid}/${id}`));
+    return {
+        kind: 'unresolvable',
+        requested,
+        alternatives: rankModelAlternatives(requested, candidates),
+        providerKnown,
+        waitedMs: now() - startedAt,
+    };
+}
 /**
  * Tools DENIED in a hosted headless run (ALI-1037). OpenCode exposes a `question`
  * permission key (docs/permissions) that gates the interactive "ask the user a

package/dist/hosted-loop-lifecycle.js

@@ -21,6 +21,26 @@
  * `hosted-loop.ts` re-exports everything here, so the CLI's import surface
  * (`@/packages/cli/src/hosted-loop`) is unchanged.
  */
+/**
+ * Default provider-qualified hosted model — the SINGLE source of truth
+ * (ALI-1086). Imported by both the operator-path session CLI
+ * (`hosted-session-cli.ts`) and the DO-path boot (`hosted-boot.ts`); never
+ * re-inline it.
+ *
+ * PIN CONSTRAINT: the hosted OpenCode runtime is HARD-PINNED to
+ * `opencode-ai@1.14.41` (`OPENCODE_PINNED_VERSION`, SSE-fragile — do not bump)
+ * whose BUNDLED model catalog predates this model (newest bundled anthropic
+ * opus: claude-opus-4-7). Verified empirically on ALI-1086: 1.14.41 DOES fetch
+ * `https://models.dev/api.json` at boot when reachable (cached to
+ * `~/.cache/opencode/models.json`, refreshed when stale, disabled only by
+ * `OPENCODE_DISABLE_MODELS_FETCH`), so with models.dev on the sandbox egress
+ * allowlist (#1392, `ORIZU_HOSTED_EGRESS_ALLOWLIST`) this id resolves in new
+ * sandboxes. If the catalog fetch is blocked/stale anyway, the loop's
+ * pre-prompt validation (`awaitOpenCodeModelResolvable`) fails the run fast,
+ * naming the resolvable alternatives. The durable fix for the stale bundled
+ * catalog is the ALI-929 harness swap.
+ */
+export const DEFAULT_HOSTED_MODEL = 'anthropic/claude-opus-4-8';
 /**
  * Environment injected into the spawned OpenCode server so the AGENT's bash sees a
  * PRE-AUTHENTICATED `orizu` CLI (ALI-1044). ORIZU_TOKEN_FILE points at the 0600

package/dist/hosted-loop.js

@@ -39,14 +39,14 @@ import { join } from 'path';
 import { HOSTED_TASK_PREAMBLE, PREBAKED_MARKER_PATH, SETUP_HOOK_RELATIVE_PATH, composeHostedTaskPrompt, parsePrebakedMarker, } from './hosted-runtime-assets.js';
 import { harvestWorkspace } from './hosted-harvest.js';
 import { annotateHeadlessQuestions, withIdleWatchdog } from './hosted-headless.js';
-import { DEFAULT_PROMPT_MAX_DURATION_MS, OPENCODE_PINNED_VERSION, createOpenCodeHarness, spawnOpenCode, } from './hosted-harness-opencode.js';
+import { DEFAULT_PROMPT_MAX_DURATION_MS, OPENCODE_PINNED_VERSION, awaitOpenCodeModelResolvable, createOpenCodeHarness, spawnOpenCode, } from './hosted-harness-opencode.js';
 import { createClaudeAgentHarness } from './hosted-harness-claude.js';
-import { drainHarnessToSink, resumeRunEventSink, } from './hosted-run-event-sink.js';
+import { drainHarnessToSink, resumeRunEventSink, RunTerminalError, TerminalDeliveryError, } from './hosted-run-event-sink.js';
 import { buildOpenCodeSpawnEnv, defaultProbeEgress, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
 // The lifecycle/orchestration seam moved to `hosted-loop-lifecycle.ts`
 // (ALI-1015 Phase 1) so `lib/hosted-runtime/` can share it with a server-side
 // coordinator. Re-exported here so this module's public surface is unchanged.
-export { DEFAULT_EGRESS_CANARY_HOST, buildOpenCodeSpawnEnv, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
+export { DEFAULT_EGRESS_CANARY_HOST, DEFAULT_HOSTED_MODEL, buildOpenCodeSpawnEnv, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
 // Time reserved BEFORE the sandbox self-terminates so a duration-capped prompt
 // abort still has room to harvest partial work (commit/push) + write the terminal
 // event: `promptMaxDurationMs = sandboxBudgetMs − this` (ALI-1061). 5 min is
@@ -97,6 +97,15 @@ function resolveIdleTimeoutMs(override) {
     }
     return DEFAULT_AGENT_IDLE_TIMEOUT_MS;
 }
+/**
+ * Loop-level retry schedule for an undeliverable TERMINAL transition (ALI-1065
+ * finding 2). Each entry is a pause before one more full sink delivery cycle
+ * (which itself retries ~4 times over ~350ms), so a transport blip of a few
+ * seconds recovers with the ORIGINAL status instead of being re-recorded as
+ * 'failed'. Bounded: a persistently unreachable control plane fails the
+ * DELIVERY visibly (result.error) without recording a wrong outcome.
+ */
+export const TERMINAL_DELIVERY_RETRY_DELAYS_MS = [2_000, 8_000];
 /** Model-key env vars whose value must be scrubbed from every run event. */
 const MODEL_KEY_ENV_VARS = ['ANTHROPIC_API_KEY', 'OPENAI_API_KEY'];
 /**
@@ -399,6 +408,40 @@ export async function runHostedLoop(opts) {
                     payload: { step: 'opencode_ready', ok: true, waitedMs: spawned.readyAfterMs },
                 });
             }
+            // Fail-fast model validation (ALI-1086): ask the RUNNING opencode whether
+            // the requested model is resolvable BEFORE the first prompt. The pinned
+            // opencode's bundled catalog is stale (predates claude-opus-4-8) and only
+            // a boot-time models.dev fetch (#1392 allowlists it) refreshes it — when
+            // that fetch is blocked, the first prompt used to die inside the SSE
+            // stream with an opaque `run_failed: Model not found`. Now the run fails
+            // immediately with a structured artifact + an error naming the requested
+            // id AND the resolvable alternatives. Fail-open on validator
+            // infrastructure: an unreachable catalog endpoint (`skipped`) proceeds
+            // silently — opencode's own session.error remains the backstop. Healthy
+            // and skipped runs append NO event, so the ALI-929 cross-harness
+            // stream-identity invariant is untouched (validation exists only on the
+            // opencode path; the Claude-SDK driver resolves models itself).
+            const validateModel = opts.validateModel ?? awaitOpenCodeModelResolvable;
+            const validation = await validateModel({ baseUrl: spawned.baseUrl, model: context.model });
+            if (validation.kind === 'unresolvable') {
+                await sink.append({
+                    kind: 'artifact',
+                    payload: {
+                        step: 'model_validation',
+                        ok: false,
+                        requestedModel: validation.requested,
+                        resolvableAlternatives: validation.alternatives,
+                        providerKnown: validation.providerKnown,
+                        opencodeVersion: pinnedVersion,
+                        waitedMs: validation.waitedMs,
+                    },
+                });
+                throw new Error(`requested model ${validation.requested} is not resolvable by the pinned ` +
+                    `opencode runtime (opencode-ai@${pinnedVersion}); resolvable alternatives: ` +
+                    `${validation.alternatives.join(', ') || '(none)'} — retry with --model ` +
+                    `set to one of these (stale bundled catalog + blocked models.dev refresh; ` +
+                    `see ALI-1086, durable fix ALI-929)`);
+            }
             // Derive the per-prompt max-duration cap from the sandbox budget so a long
             // `--duration` run is not killed at the hard-coded 90-min cap while its
             // sandbox is still alive; floored at the harness default for short/undated
@@ -472,10 +515,57 @@ export async function runHostedLoop(opts) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        // Fail closed: never leave the run non-terminal. finish() is idempotent and
-        // no-ops when the drain already sealed the sink. Harvest FIRST (partial work
-        // is valuable, incl. an idle-watchdog abort) — before the terminal seals.
+        // Harvest FIRST on every abnormal path (partial work is valuable, incl. an
+        // idle-watchdog abort) — before any terminal write seals the sink.
         await runAutoHarvest();
+        // ALI-1065 finding 2: an undeliverable TERMINAL transition must NEVER be
+        // re-recorded as 'failed' — the run's outcome was already decided; only its
+        // DELIVERY failed. Retry the delivery with the ORIGINAL status (spaced past
+        // the sink's own ~350ms retry window, so a ~1s transport blip recovers),
+        // and if it still cannot land, fail the DELIVERY visibly: return the
+        // intended status with a non-null error, which the boot reports via its
+        // boot-status callback, and the coordinator's session-end finalizer sweeps
+        // the still-'running' row server-side with an explicit marker.
+        if (error instanceof TerminalDeliveryError) {
+            const sleep = opts.sleepImpl ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+            for (const delayMs of TERMINAL_DELIVERY_RETRY_DELAYS_MS) {
+                if (sink.sealed)
+                    break;
+                await sleep(delayMs);
+                try {
+                    await sink.finish(error.intendedStatus, error.finishOptions);
+                    return { status: error.intendedStatus, agentSessionId, installOk, error: null };
+                }
+                catch (retryError) {
+                    // The run went terminal server-side while we were retrying: accept
+                    // the server record (Orizu records win) instead of retrying further.
+                    if (retryError instanceof RunTerminalError) {
+                        return { status: 'cancelled', agentSessionId, installOk, error: null };
+                    }
+                    // Otherwise keep retrying within the bounded schedule; never change
+                    // the status.
+                }
+            }
+            if (sink.sealed) {
+                // A concurrent/preceding delivery landed after all — the record is
+                // terminal server-side with our intended status semantics preserved.
+                return { status: error.intendedStatus, agentSessionId, installOk, error: null };
+            }
+            return {
+                status: error.intendedStatus,
+                agentSessionId,
+                installOk,
+                error: `terminal delivery failed (intended status preserved): ${message}`,
+            };
+        }
+        // The run went terminal SERVER-side (cancel/finish out from under this
+        // writer): the sink sealed itself; accept the server record (Orizu records
+        // win) instead of fabricating a local failure.
+        if (error instanceof RunTerminalError) {
+            return { status: 'cancelled', agentSessionId, installOk, error: null };
+        }
+        // Fail closed: never leave the run non-terminal. finish() is idempotent and
+        // no-ops when the drain already sealed the sink.
         if (!sink.sealed) {
             try {
                 await sink.finish('failed', { summary: { error: message } });

package/dist/hosted-run-event-sink.js

@@ -115,6 +115,26 @@ export class CriticalDeliveryError extends Error {
         this.name = 'CriticalDeliveryError';
     }
 }
+/**
+ * Raised when `finish()` itself is undeliverable (ALI-1065 finding 2): a
+ * CriticalDeliveryError thrown WHILE DELIVERING A TERMINAL TRANSITION, carrying
+ * the intended status + finish options so the caller can retry the delivery
+ * with the ORIGINAL outcome. Before this, the error surfaced as a bare
+ * CriticalDeliveryError and the loop's generic catch re-finished the run
+ * 'failed' — a ~1s transport blip on the SUCCESS terminal recorded a succeeded
+ * run as failed. Subclasses CriticalDeliveryError so existing classification
+ * (drop-vs-surface) is unchanged.
+ */
+export class TerminalDeliveryError extends CriticalDeliveryError {
+    intendedStatus;
+    finishOptions;
+    constructor(message, intendedStatus, finishOptions) {
+        super(message);
+        this.name = 'TerminalDeliveryError';
+        this.intendedStatus = intendedStatus;
+        this.finishOptions = finishOptions;
+    }
+}
 /**
  * Raised on a 403 from the RunAPI. Named for what a 403 actually is — NOT "the
  * run is terminal" (that is 404/410). A 403 means the caller may no longer write
@@ -423,13 +443,28 @@ export function createRunEventSink(options) {
             diag(`finish(${status}) called on an already-sealed sink — ignored (idempotent)`);
             return;
         }
-        // Pre-terminal appends (still writable): flush coalesced tokens, then the
-        // bounded transcript tail (the seal below refuses any later append).
-        await flushTokens();
-        if (opts?.transcript) {
-            await postEvent(AGENT_TRANSCRIPT_EVENT_TYPE, { text: tail(opts.transcript, TRANSCRIPT_TAIL_MAX_CHARS), truncated: opts.transcript.length > TRANSCRIPT_TAIL_MAX_CHARS }, true);
+        // ALI-1065 finding 2: a delivery failure ANYWHERE inside finish (the
+        // transcript tail is a critical append; the terminal PATCH is the
+        // transition itself) must carry the INTENDED status out to the caller.
+        // Without this, the loop's generic catch converted an undeliverable
+        // SUCCESS terminal into a recorded 'failed'. RunTerminalError/RunAuthError
+        // pass through unchanged — they are classifications, not delivery
+        // failures.
+        try {
+            // Pre-terminal appends (still writable): flush coalesced tokens, then the
+            // bounded transcript tail (the seal below refuses any later append).
+            await flushTokens();
+            if (opts?.transcript) {
+                await postEvent(AGENT_TRANSCRIPT_EVENT_TYPE, { text: tail(opts.transcript, TRANSCRIPT_TAIL_MAX_CHARS), truncated: opts.transcript.length > TRANSCRIPT_TAIL_MAX_CHARS }, true);
+            }
+            await patchTerminal(status, opts);
+        }
+        catch (error) {
+            if (error instanceof CriticalDeliveryError && !(error instanceof TerminalDeliveryError)) {
+                throw new TerminalDeliveryError(error.message, status, opts);
+            }
+            throw error;
         }
-        await patchTerminal(status, opts);
     }
     return {
         append,
@@ -513,6 +548,42 @@ export async function drainHarnessToSink(events, sink, opts = {}) {
         if (opts.beforeFinish)
             await opts.beforeFinish();
     };
+    // ALI-1065 finding 3: the server now rejects appends to a terminal run with
+    // 410 (the run was cancelled/finished out from under this writer). The sink
+    // seals itself and raises RunTerminalError; the drain must treat that as a
+    // clean server-side termination — stop consuming and report 'cancelled' —
+    // not crash the loop into a spurious re-finish (Orizu records win; the
+    // stored status is whatever the server committed). The hook still runs so
+    // partial work is harvested, but with a sealed sink its own appends no-op.
+    const handleServerTerminal = async () => {
+        await runBeforeFinish();
+        return 'cancelled';
+    };
+    // finish() can ALSO surface RunTerminalError (its pre-terminal token flush /
+    // transcript append hits the 410 before the PATCH ever runs) — accept the
+    // server's termination the same way instead of crashing the drain. A finish
+    // whose PATCH meets an already-terminal run does NOT throw (patchTerminal
+    // seals on a terminal 409), so this wrapper changes nothing on that path.
+    //
+    // SEALED-BEFORE-FINISH: the beforeFinish hook's own best-effort appends
+    // (auto-harvest events) swallow errors — including the RunTerminalError of a
+    // 410 that SEALED the sink. finish() on a sealed sink is an idempotent no-op,
+    // so without this check the drain would report the intended status as
+    // delivered when in fact the server terminated the run out from under us.
+    const finishAccepting = async (status, finishOpts) => {
+        await runBeforeFinish();
+        if (sink.sealed)
+            return 'cancelled';
+        try {
+            await sink.finish(status, finishOpts);
+            return status;
+        }
+        catch (error) {
+            if (error instanceof RunTerminalError)
+                return 'cancelled';
+            throw error;
+        }
+    };
     for await (const event of events) {
         if (event.kind === 'execution_complete') {
             // A prompt the caller/agent stopped is a cancellation, not a failure: the
@@ -520,40 +591,42 @@ export async function drainHarnessToSink(events, sink, opts = {}) {
             // and stop()-initiated paths. A genuine failure (success:false, no abort
             // flag) still lands 'failed'.
             if (event.payload.aborted === true) {
-                await runBeforeFinish();
-                await sink.finish('cancelled', {
+                return finishAccepting('cancelled', {
                     summary: opts.summary,
                     evidence: opts.evidence,
                     transcript: opts.transcript,
                 });
-                return 'cancelled';
             }
             const success = event.payload.success !== false;
             const status = success ? 'succeeded' : 'failed';
             const summary = success
                 ? opts.summary
                 : { ...(opts.summary ?? {}), error: event.payload.error ?? 'execution failed' };
-            await runBeforeFinish();
-            await sink.finish(status, { summary, evidence: opts.evidence, transcript: opts.transcript });
-            return status;
+            return finishAccepting(status, { summary, evidence: opts.evidence, transcript: opts.transcript });
         }
         if (event.kind === 'error') {
-            await runBeforeFinish();
-            await sink.finish('failed', {
+            return finishAccepting('failed', {
                 summary: { ...(opts.summary ?? {}), error: event.payload.error ?? 'agent error' },
                 evidence: opts.evidence,
                 transcript: opts.transcript,
             });
-            return 'failed';
         }
-        await sink.append(event);
+        try {
+            await sink.append(event);
+        }
+        catch (error) {
+            if (error instanceof RunTerminalError)
+                return handleServerTerminal();
+            throw error;
+        }
     }
     // The harness contract guarantees a terminal event; reaching here means the
     // stream ended abnormally. Fail closed so the run never dangles non-terminal.
     await runBeforeFinish();
-    await sink.finish('failed', {
+    if (sink.sealed)
+        return 'cancelled';
+    return finishAccepting('failed', {
         summary: { ...(opts.summary ?? {}), error: 'harness stream ended without a terminal event' },
         transcript: opts.transcript,
     });
-    return 'failed';
 }

package/dist/hosted-session-cli.js

@@ -40,7 +40,7 @@ import { resumeRunEventSink } from './hosted-run-event-sink.js';
 import { AGENT_GIT_IDENTITY, BEARER_BASENAME } from './hosted-runtime-assets.js';
 import { createVercelProvider } from './vercel-sandbox-provider.js';
 import { buildEgressPolicy, DEFAULT_EGRESS_CANARY_HOST } from './egress-policy.js';
-import { hostedLoopCommand } from './hosted-loop.js';
+import { DEFAULT_HOSTED_MODEL, hostedLoopCommand } from './hosted-loop.js';
 import { hostedBootCommand } from './hosted-boot.js';
 import { mergeJobCommand } from './merge-job.js';
 import { authedFetch } from './http.js';
@@ -48,7 +48,9 @@ import { resolveBaseUrl } from './http.js';
 import { getWorkspaceRoot } from './workspace.js';
 import { attachedWorkspaceId } from './workspace-sync.js';
 import { tailWorkbenchRun } from './workbench-cli.js';
-export const DEFAULT_HOSTED_MODEL = 'anthropic/claude-opus-4-8';
+// Default hosted model — SINGLE source of truth in hosted-loop-lifecycle.ts
+// (ALI-1086); re-exported here so existing importers keep working.
+export { DEFAULT_HOSTED_MODEL };
 export const DEFAULT_DURATION_MINUTES = 60;
 export const MAX_DURATION_MINUTES = 24 * 60;
 export const DEFAULT_ROTATION_INTERVAL_MS = 55 * 60 * 1000;

package/dist/vercel-sandbox-provider.js

@@ -54,10 +54,10 @@ export const VERCEL_IMAGE_NOT_READY_BACKOFF_MS = 5000;
 // constant-fold `import(specifier)` into a static dependency on the SDK — the
 // same discipline as the ALI-1031 server provider.
 const VERCEL_SDK_SPECIFIER = ['@vercel', 'sandbox'].join('/');
-async function loadVercelModule() {
+export async function loadVercelModule(importModule = specifier => import(specifier)) {
     try {
         const specifier = VERCEL_SDK_SPECIFIER;
-        const mod = (await import(specifier));
+        const mod = (await importModule(specifier));
         if (!mod || typeof mod.Sandbox?.create !== 'function') {
             throw new Error('module did not export a Sandbox class with create()');
         }