orizu 0.5.20 → 0.5.21

package/dist/hosted-boot.d.ts

@@ -0,0 +1,273 @@
+/**
+ * `orizu internal hosted-boot` — the in-sandbox BOOT ENTRYPOINT for the DO-path
+ * hosted agent (ALI-1057). The session coordinator's Durable Object launches
+ * this DETACHED (`ORIZU_SANDBOX_ENTRYPOINT`, via nohup) once it has verified the
+ * pre-baked runtime marker; from here the sandbox bootstraps itself under the
+ * PULL model (ALI-1055): no operator writes its credentials, and no bearer or
+ * connector secret ever rests in Cloudflare.
+ *
+ * WHAT DIFFERS FROM THE OPERATOR PATH (packages/cli/src/hosted-session-cli.ts +
+ * hosted-bootstrap.ts) — and ONLY this:
+ *   (a) credentials are PULLED over HTTP at boot instead of the operator writing
+ *       a 0600 bearer file: the boot secret is exchanged for a fresh Orizu agent
+ *       bearer at ORIZU_AGENT_TOKEN_URL, and the connector env comes from
+ *       ORIZU_ENV_BUNDLE_URL (the 5A contract — connectors only, NO model key);
+ *   (b) the git credential helper runs in PULL MODE (hosted-runtime-assets.ts):
+ *       it GETs a fresh bearer per git op from the agent-token URL (boot-secret
+ *       auth) rather than reading a host-rotated 0600 file.
+ * Everything else — the clone via the credential helper, the loop, the event
+ * sink, redaction — is REUSED, not reimplemented.
+ *
+ * FROZEN ENV CONTRACT (workers/session-coordinator/src/bootstrap.ts
+ * `planSandboxEnv`). Required (fail-fast if any is missing):
+ *   ORIZU_BOOT_SECRET      the per-sandbox durable bootstrap secret;
+ *   ORIZU_AGENT_TOKEN_URL  {coordinator}/sessions/:id/agent-token (bearer pull);
+ *   ORIZU_ENV_BUNDLE_URL   {orizu}/api/coordinator/sessions/:id/env-bundle;
+ *   ORIZU_BASE_URL         the Orizu control-plane origin;
+ *   ORIZU_SESSION_ID       this session id.
+ * Present-but-optional in the contract, resolved from the control plane when
+ * absent: ORIZU_RUN_ID, ORIZU_WORKSPACE_ID (read back from the session), and the
+ * non-secret ANTHROPIC_API_KEY dummy placeholder (firewall brokers the real key).
+ */
+import { type HostedLoopContext, type HostedLoopResult } from './hosted-loop.js';
+export type BootFetch = (url: string, init?: RequestInit) => Promise<Response>;
+export declare const REQUIRED_BOOT_ENV_VARS: readonly ["ORIZU_BOOT_SECRET", "ORIZU_AGENT_TOKEN_URL", "ORIZU_ENV_BUNDLE_URL", "ORIZU_BASE_URL", "ORIZU_SESSION_ID"];
+export interface HostedBootEnv {
+    bootSecret: string;
+    agentTokenUrl: string;
+    /** {coordinator}/sessions/:id/boot-status — the ALI-1060 agent-liveness
+     *  callback, derived from agentTokenUrl (same boot-secret auth). */
+    bootStatusUrl: string;
+    envBundleUrl: string;
+    baseUrl: string;
+    sessionId: string;
+    /** Present in the contract only for resume flows; else resolved server-side. */
+    runId: string | null;
+    /** Rarely set by the DO (the start body carries no workspace id); read back
+     *  from the session when absent. */
+    workspaceId: string | null;
+    /** Non-secret dummy the firewall rewrites on egress — never a real key. */
+    anthropicDummyKey: string | null;
+}
+/** Validate the frozen env contract. A list of missing REQUIRED names means the
+ *  boot must FAIL FAST with a clear error (the DO records the non-zero exit). */
+export declare function resolveHostedBootEnv(env: Record<string, string | undefined>): {
+    ok: true;
+    value: HostedBootEnv;
+} | {
+    ok: false;
+    missing: string[];
+};
+/** The boot-status route is the agent-token route's sibling; swap the trailing
+ *  path segment. Falls back to appending when the shape is unexpected. */
+export declare function deriveBootStatusUrl(agentTokenUrl: string): string;
+/** Best-effort scrub + truncate for a reported failure reason: never leak the
+ *  boot secret (the one credential the boot always holds), and keep it short. */
+export declare function redactBootReason(reason: string, bootSecret: string): string;
+/**
+ * Report the boot outcome to the coordinator's boot-status route (ALI-1060),
+ * authed with the boot secret (same as the agent-token pull). Best-effort: the
+ * DO's own readiness-timeout is the backstop if this never lands, so a failed
+ * report must never mask the boot result. NEVER logs the secret.
+ */
+export declare function postBootStatus(opts: {
+    bootStatusUrl: string;
+    bootSecret: string;
+    /** 'ready' | 'failed' are the ALI-1060 liveness signals; 'complete' is the
+     *  ALI-1064 terminal signal — the loop finished (after auto-harvest), so the
+     *  DO ends the workspace session and stops instead of extending to 24h. */
+    status: 'ready' | 'failed' | 'complete';
+    runId: string | null;
+    reason?: string | null;
+    fetchImpl: BootFetch;
+    log?: (line: string) => void;
+}): Promise<void>;
+export interface PulledBearer {
+    token: string;
+    /** Epoch ms, or null when the response omitted a parseable expiry. */
+    expiresAtMs: number | null;
+}
+export interface PullAgentBearerOptions {
+    agentTokenUrl: string;
+    bootSecret: string;
+    fetchImpl: BootFetch;
+    /** Total attempts before giving up (the DO may still be arming). Default 5. */
+    attempts?: number;
+    /** Base backoff in ms (doubles each retry). Default 500. */
+    backoffMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    log?: (line: string) => void;
+}
+/**
+ * Exchange the boot secret for a fresh Orizu agent bearer at the coordinator's
+ * agent-token route (`GET`, `Authorization: Bearer <boot secret>` → 200
+ * `{token, tokenId, expiresAt}`). Retries with exponential backoff: the DO
+ * persists the boot-secret digest and serves this route DURING bootstrap, but a
+ * transient mint failure (control-plane blip) should not abort the whole boot.
+ * The secret is NEVER logged.
+ */
+export declare function pullAgentBearer(opts: PullAgentBearerOptions): Promise<PulledBearer>;
+export interface EnvBundleConnector {
+    ref: string;
+    envVar: string;
+    value: string;
+}
+export interface EnvBundle {
+    sessionId: string | null;
+    connectors: EnvBundleConnector[];
+    redactEnvVars: string[];
+}
+/**
+ * Pull the connector env bundle (5A contract): `GET` with the agent bearer → 200
+ * `{sessionId, connectors:[{ref,envVar,value}], redactEnvVars:[...]}`. The model
+ * key is DELIBERATELY absent (brokered at the firewall). Never logs a value.
+ */
+export declare function fetchEnvBundle(opts: {
+    envBundleUrl: string;
+    bearer: string;
+    fetchImpl: BootFetch;
+}): Promise<EnvBundle>;
+/**
+ * Export each connector `{envVar: value}` into the environment the loop/agent
+ * inherits, and REGISTER every redacted var on `ORIZU_INJECTED_ENV_VARS` — the
+ * exact hook the in-sandbox loop reads (`redactionListFromEnv`) to scrub these
+ * values from run events. Returns the merged redaction-var list.
+ */
+export declare function applyEnvBundle(bundle: EnvBundle, env: Record<string, string | undefined>): string[];
+export interface ResolvedSession {
+    workspaceId: string;
+    repoBranch: string;
+    task: string;
+    model: string | null;
+    reasoningEffort: string | null;
+    /** Session lifetime in minutes (from client_info), if the coordinator recorded
+     *  it — used to derive the per-prompt max-duration cap (ALI-1061). */
+    durationMinutes: number | null;
+    /** Most recent existing run id, if any (else the boot creates one). */
+    runId: string | null;
+}
+/** GET the session (agent-capable, RLS-scoped) to learn its workspace, branch,
+ *  task, and any existing run — the DO start body carries none of these. */
+export declare function resolveSession(opts: {
+    baseUrl: string;
+    sessionId: string;
+    bearer: string;
+    fetchImpl: BootFetch;
+}): Promise<ResolvedSession>;
+/** Reuse an existing run or start one with the AGENT bearer (actor_type='agent'),
+ *  exactly like the operator path's run-start step. */
+export declare function ensureRun(opts: {
+    baseUrl: string;
+    sessionId: string;
+    bearer: string;
+    fetchImpl: BootFetch;
+    existingRunId: string | null;
+    title?: string;
+}): Promise<string>;
+/** Mint a session_read repo token to learn the repo full name, then build the
+ *  GitHub clone URL (mirrors the operator path's `defaultResolveRepo`). */
+export declare function resolveRepo(opts: {
+    baseUrl: string;
+    workspaceId: string;
+    sessionId: string;
+    bearer: string;
+    fetchImpl: BootFetch;
+}): Promise<{
+    repoFullName: string;
+    cloneUrl: string;
+}>;
+export interface BootExecResult {
+    status: number;
+    stdout: string;
+    stderr: string;
+}
+export type BootExec = (cmd: string, args: string[], opts?: {
+    cwd?: string;
+}) => BootExecResult;
+export declare function assertSafeRunId(runId: string): void;
+export interface RunHostedBootOptions {
+    env: HostedBootEnv;
+    /** Mutable env map the loop/agent inherits (default: process.env). */
+    processEnv?: Record<string, string | undefined>;
+    /** Sandbox root the run dir + repo live under (default: process.cwd()). */
+    root?: string;
+    fetchImpl?: BootFetch;
+    exec?: BootExec;
+    /** File writer (default: atomic 0600 temp+rename). Injected in tests. */
+    writeFile?: (path: string, contents: string) => void;
+    /** File reader (default: readFileSync utf8). Injected in tests so the
+     *  bearer-provider read is backed by the same store as writeFile. */
+    readFile?: (path: string) => string;
+    /** Dir maker (default: recursive mkdir). Injected in tests. */
+    mkdirp?: (path: string) => void;
+    /** Run the loop (default: `runHostedLoop`). Injected in tests. */
+    runLoop?: (input: {
+        context: HostedLoopContext;
+        taskPrompt: string;
+        bearerProvider: () => string;
+        /** Verbatim secrets the loop's event redaction must scrub (ALI-1062: the
+         *  boot secret — bare hex, so no shape pattern would ever catch it). */
+        redactSecretsList: readonly string[];
+    }) => Promise<HostedLoopResult>;
+    now?: () => number;
+    log?: (line: string) => void;
+    /** Bearer-pull tuning (passed through to `pullAgentBearer`). */
+    bearerAttempts?: number;
+    bearerBackoffMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    /** ALI-1060: invoked once the run id + agent bearer are known (after
+     *  ensureRun), so a caller can report/mark on a LATER throw. */
+    onBootContext?: (ctx: {
+        runId: string;
+        bearer: string;
+    }) => void;
+}
+export interface HostedBootResult {
+    ok: boolean;
+    runId: string | null;
+    loopStatus: string | null;
+    error: string | null;
+}
+/**
+ * The full in-sandbox boot: validate → pull bearer → pull+apply env bundle →
+ * resolve session/run/repo → write the pull-mode credential assets → clone the
+ * session branch → launch the hosted loop (reused, in-process) with a bearer
+ * provider fed by the same pull-mode source. Returns the loop's terminal status.
+ */
+export declare function runHostedBoot(opts: RunHostedBootOptions): Promise<HostedBootResult>;
+export interface HostedBootCommandIo {
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    json?: boolean;
+}
+/**
+ * Read the frozen env contract from the process env and run the boot. Fails fast
+ * (exit 1) with a clear message naming every missing required var. The DO records
+ * the exit code; run failures beyond the boot itself are recorded server-side.
+ */
+export declare function hostedBootCommand(io: HostedBootCommandIo): Promise<number>;
+/**
+ * Failure fan-out on a boot throw (ALI-1060): mark the run terminally `failed`
+ * (the operator path's agent-bearer terminal PATCH) and always signal the
+ * coordinator's boot-status route so the DO tears the sandbox down promptly.
+ * Best-effort throughout — the boot secret is scrubbed from the reported reason.
+ *
+ * PRE-BEARER failures (a throw before `onBootContext` — `pullAgentBearer` /
+ * `fetchEnvBundle` blew up, so `ctx` is null) still have a run id: the server
+ * PRE-CREATES it and injects ORIZU_RUN_ID. We attempt a SHORT bearer pull here
+ * so we can self-mark that run failed rather than leaving it `running` until the
+ * DO's readiness timeout. If even that pull fails, the DO backstop (boot-status
+ * failure now, readiness timeout otherwise) is the last line.
+ */
+export declare function reportBootFailure(opts: {
+    env: HostedBootEnv;
+    ctx: {
+        runId: string;
+        bearer: string;
+    } | null;
+    reason: string;
+    log: (line: string) => void;
+    /** Injectable transport (default: global fetch). Exposed for tests. */
+    fetchImpl?: BootFetch;
+}): Promise<void>;
+//# sourceMappingURL=hosted-boot.d.ts.map

package/dist/hosted-boot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-boot.d.ts","sourceRoot":"","sources":["../src/hosted-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAgBH,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAA;AAKzB,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAe9E,eAAO,MAAM,sBAAsB,uHAMzB,CAAA;AAEV,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB;wEACoE;IACpE,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;wCACoC;IACpC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED;iFACiF;AACjF,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BvE;AAED;0EAC0E;AAC1E,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAKjE;AASD;iFACiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAM3E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB;;+EAE2E;IAC3E,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAA;IACvC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAID,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,SAAS,CAAA;IACpB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAgCzF;AAID,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,SAAS,CAAA;CACrB,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,EAAE,CAgBnG;AAID,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B;0EACsE;IACtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AA0BD;4EAC4E;AAC5E,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,SAAS,CAAA;CACrB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyB3B;AAED;uDACuD;AACvD,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,SAAS,CAAA;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED;2EAC2E;AAC3E,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,SAAS,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0DtD;AAID,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AACD,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,cAAc,CAAA;AA2B/F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAInD;AAQD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,aAAa,CAAA;IAClB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC/C,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,yEAAyE;IACzE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAA;IACpD;yEACqE;IACrE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACnC,+DAA+D;IAC/D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,iBAAiB,CAAA;QAC1B,UAAU,EAAE,MAAM,CAAA;QAClB,cAAc,EAAE,MAAM,MAAM,CAAA;QAC5B;gFACwE;QACxE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5B,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;oEACgE;IAChE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkQzF;AAyED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsChF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,aAAa,CAAA;IAClB,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC7C,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,uEAAuE;IACvE,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+ChB"}

package/dist/hosted-bootstrap-rehearsal.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Self-contained rehearsal for the hosted bootstrap (ALI-925), extending the
+ * ALI-973 `daytona-slice-rehearsal` pattern.
+ *
+ * The whole `bootstrapHostedSandbox` flow runs against the local-sim provider
+ * with NO Daytona and NO GitHub: a REAL bare git repo backs the session branch,
+ * and a REAL HTTP broker (`hosted-broker-server.ts`) stands in for the Orizu
+ * control plane (per-repo token broker + RunAPI event ingest).
+ *
+ * The broker runs as a SEPARATE PROCESS on purpose: local-sim's `exec` blocks on
+ * `spawnSync`, and the in-sandbox credential helper it runs calls the broker over
+ * the network — an in-process server could not answer while the test thread is
+ * blocked. The broker journals events/tokens to files the rehearsal reads back.
+ */
+import { type SandboxProvider } from './sandbox-provider.js';
+import type { BrokerConfig } from './hosted-broker-server.js';
+import { type GitHttpConfig } from './hosted-git-http-server.js';
+export interface SpawnedBroker {
+    apiBaseUrl: string;
+    port: number;
+    stop: () => void;
+}
+/**
+ * Env keys the broker server reads (kept here so callers do not hand-roll them).
+ */
+export declare function brokerEnv(config: BrokerConfig): Record<string, string>;
+/**
+ * Spawn the broker server as its own process and resolve once it prints
+ * `LISTENING <port>` on stdout.
+ */
+export declare function spawnBrokerProcess(config: BrokerConfig): Promise<SpawnedBroker>;
+export interface SpawnedGitHttpServer {
+    baseUrl: string;
+    port: number;
+    stop: () => void;
+}
+/**
+ * Spawn the authenticated smart-HTTP git server as its own process (same
+ * separate-process rationale as the broker) and resolve once it prints
+ * `LISTENING <port>`. `baseUrl` is the clone URL root; append the repo segment.
+ */
+export declare function spawnGitHttpProcess(config: GitHttpConfig): Promise<SpawnedGitHttpServer>;
+export interface RecordedRehearsalEvent {
+    runId: string;
+    eventId: string;
+    sequence: number;
+    eventType: string;
+    payload: unknown;
+}
+export interface HostedBootstrapRehearsal {
+    apiBaseUrl: string;
+    bearer: string;
+    workspaceId: string;
+    sessionId: string;
+    runId: string;
+    sessionBranch: string;
+    repoFullName: string;
+    provider: SandboxProvider;
+    resolveCloneUrl: (repo: string) => string;
+    /** VCS host the helper is scoped to (the loopback git server). */
+    host: string;
+    /** Loopback hosts the helper may serve over plain HTTP (rehearsal only). */
+    insecureHttpHosts: readonly string[];
+    /** All run events the broker accepted, in arrival order. */
+    events: () => RecordedRehearsalEvent[];
+    /** Every token value the broker minted (for residue-sweep assertions). */
+    tokensIssued: () => string[];
+    /** Every Basic-auth password the git server received (proves password===token). */
+    basicAuthPasswords: () => string[];
+    cleanup: () => Promise<void>;
+}
+export interface RehearsalOptions {
+    bearer?: string;
+    keep?: boolean;
+    /** Seed `.orizu/setup.sh` onto the session branch (force-added past the
+     *  workbench `.orizu/` gitignore) so the setup-hook step has a hook to run. */
+    setupHookBody?: string;
+    /** Force the repo-token broker to a status (tests the 4xx credential path). */
+    repoTokenStatus?: number;
+    /** Force the run-events ingest to a status (tests the failure path). */
+    eventsStatus?: number;
+    /** Serve the full RunAPI + session + agent-token surface (P3.5 e2e). */
+    fullRunApi?: boolean;
+}
+export declare function createHostedBootstrapRehearsal(options?: RehearsalOptions): Promise<HostedBootstrapRehearsal>;
+//# sourceMappingURL=hosted-bootstrap-rehearsal.d.ts.map

package/dist/hosted-bootstrap-rehearsal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-bootstrap-rehearsal.d.ts","sourceRoot":"","sources":["../src/hosted-bootstrap-rehearsal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAuC5E,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,IAAI,CAAA;CACjB;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBtE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CA0BrF;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,IAAI,CAAA;CACjB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0B9F;AAID,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,eAAe,CAAA;IACzB,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAA;IACZ,4EAA4E;IAC5E,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,sBAAsB,EAAE,CAAA;IACtC,0EAA0E;IAC1E,YAAY,EAAE,MAAM,MAAM,EAAE,CAAA;IAC5B,mFAAmF;IACnF,kBAAkB,EAAE,MAAM,MAAM,EAAE,CAAA;IAClC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;mFAC+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAuBD,wBAAsB,8BAA8B,CAClD,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAqFnC"}

package/dist/hosted-bootstrap.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Host-driven hosted-sandbox bootstrap (ALI-925 / P3.3, per ADR-005 §8).
+ *
+ * Given a live `SandboxSession` (from the Orizu `SandboxProvider` seam — works
+ * with BOTH the Daytona adapter and local-sim), an Orizu API base URL, a bearer,
+ * and the workspace/session/run ids + session branch, `bootstrapHostedSandbox`
+ * performs the in-sandbox boot flow forked in DESIGN from OpenInspect's
+ * `entrypoint.py` supervisor:
+ *
+ *   1. inject boot context (env/config) as run-scoped files — the bearer only in
+ *      a 0600 file reaped at teardown, never in git config or the clone URL (G3);
+ *   2. install the git credential helper (self-contained script asset) and scope
+ *      it to the repo dir ONLY (never --global);
+ *   3. clone the session branch via the helper (no token in URL / .git/config);
+ *   4. install the Orizu CLI (non-fatal, recorded);
+ *   5. run the customer `.orizu/setup.sh` hook if present (fresh-boot, non-fatal);
+ *   6. record lifecycle events to the RunAPI with client-assigned sequences
+ *      (generic event types only — never the reserved run_* lifecycle types);
+ *   7. on failure, record `bootstrap_failed`, tear down, and sweep for residue.
+ *
+ * P3.4/P3.5 (OpenCode driver, event bridge, `orizu session start --hosted`)
+ * build ON TOP of this — `bootstrapHostedSandbox` is the single writer for the
+ * run at this stage and returns the run cursor so a follow-on can continue it.
+ */
+import type { SandboxSession } from './sandbox-provider.js';
+import { type HygieneFinding } from './sandbox-hygiene.js';
+export type HostedFetch = (url: string, init?: RequestInit) => Promise<Response>;
+export interface AppendedRunEvent {
+    eventId: string;
+    sequence: number;
+    eventType: string;
+    /** Already redacted — safe to inspect / serialize in tests. */
+    payload: Record<string, unknown>;
+}
+/**
+ * The bootstrap orchestrator is the single writer for the run at this stage, so
+ * it owns a local monotonic sequence (per §4b). Every payload is redacted with
+ * the bearer before it leaves the process — a run-event body must never carry
+ * the bearer or a minted token. Lifecycle run_* types are rejected server-side;
+ * the orchestrator only emits generic types.
+ */
+export interface BootstrapRunEventSink {
+    append(eventType: string, payload?: Record<string, unknown>): Promise<AppendedRunEvent>;
+    readonly recorded: readonly AppendedRunEvent[];
+}
+export interface CreateRunEventSinkOptions {
+    apiBaseUrl: string;
+    runId: string;
+    bearer: string;
+    fetchImpl?: HostedFetch;
+    /** Extra verbatim secrets to redact from payloads (e.g. minted tokens). */
+    redactSecretsList?: readonly string[];
+    now?: () => number;
+    /** Sequence to start at (defaults to 1). */
+    startSequence?: number;
+}
+export declare function createBootstrapRunEventSink(options: CreateRunEventSinkOptions): BootstrapRunEventSink;
+export interface HostedBootstrapOptions {
+    session: SandboxSession;
+    apiBaseUrl: string;
+    /** Opaque bearer — a PAT in rehearsal, a G2 session token in production. */
+    bearer: string;
+    workspaceId: string;
+    sessionId: string;
+    runId: string;
+    sessionBranch: string;
+    repoFullName: string;
+    /** Map the broker repo full-name → a clone URL the provider understands.
+     *  Live: `https://github.com/<repo>.git`. Local-sim: the bare repo path. */
+    resolveCloneUrl: (repo: string) => string;
+    /** Directory (relative to the sandbox root) the session branch clones into. */
+    workspaceDir?: string;
+    /** VCS host the credential helper serves (default github.com). */
+    host?: string;
+    /**
+     * Broker purpose vocabulary the helper mints with. When omitted, the default
+     * is chosen from `bearerKind` (below): a human bearer mints `write`/`read`, an
+     * agent bearer mints `session_write`/`session_read`. Injectable so a caller can
+     * override without editing the credential-helper script.
+     */
+    tokenPurposes?: {
+        primary: string;
+        fallback: string;
+    };
+    /**
+     * Kind of bearer in the 0600 file — the orchestrator KNOWS what it minted, so
+     * the default broker purposes are chosen from this EXPLICIT signal, never by
+     * sniffing the token. 'agent' → session_write/session_read; 'human' (default)
+     * → write/read. Ignored when `tokenPurposes` is passed explicitly.
+     */
+    bearerKind?: 'agent' | 'human';
+    /**
+     * Hosts the credential helper may serve over plain HTTP (loopback rehearsal
+     * only). Production omits this → the helper stays https-only.
+     */
+    insecureHttpHosts?: readonly string[];
+    /** Helper cache refresh buffer (ms) — overridable so tests can force refresh. */
+    cacheBufferMs?: number;
+    /**
+     * Defer the customer `.orizu/setup.sh` hook to the in-sandbox loop (P3-a). When
+     * true, bootstrap does NOT run the hook; it records `setup_hook_deferred` and
+     * the loop runs it AFTER its egress canary passes. The host sets this for
+     * enforced-egress providers so the hook's network access cannot precede the
+     * canary's detection of a silent firewall failure. Default false (run inline).
+     */
+    deferSetupHook?: boolean;
+    /** Published CLI version to install in-sandbox (default 'latest'). */
+    cliVersion?: string;
+    /** Override the CLI-install shell command (tests inject a deterministic one). */
+    cliInstallCommand?: string;
+    /**
+     * Pre-baked runtime (ALI-1017): the image already ships the Orizu CLI on PATH,
+     * so the CLI-install step is SKIPPED (it would fail under G5 default-deny egress
+     * anyway) and a `cli_prebaked` event is recorded instead of `cli_installed`.
+     * The host sets this together with the sandbox `image` so the two never
+     * disagree. When unset, bootstrap ALSO belt-checks the `/opt/orizu/prebaked.json`
+     * marker on the sandbox filesystem; either signal skips the install.
+     */
+    prebaked?: boolean;
+    /** Inject a RunAPI sink (tests/production); default builds one over apiBaseUrl. */
+    sink?: BootstrapRunEventSink;
+    fetchImpl?: HostedFetch;
+    now?: () => number;
+}
+export interface HostedBootstrapStep {
+    key: string;
+    ok: boolean;
+    detail: string;
+}
+export interface HostedBootstrapResult {
+    ok: boolean;
+    steps: HostedBootstrapStep[];
+    events: readonly AppendedRunEvent[];
+    paths: HostedRuntimePaths;
+    /** Set on the failure path: the residue sweep result after teardown. */
+    sweep: {
+        clean: boolean;
+        findings: HygieneFinding[];
+    } | null;
+    failure: {
+        step: string;
+        error: string;
+    } | null;
+}
+export interface HostedRuntimePaths {
+    root: string;
+    runDirRel: string;
+    runDirAbs: string;
+    repoDirRel: string;
+    helperScriptAbs: string;
+    bootContextAbs: string;
+    bearerFileAbs: string;
+    cacheFileAbs: string;
+}
+export declare function computeRuntimePaths(root: string, runId: string, workspaceDir: string): HostedRuntimePaths;
+export declare function bootstrapHostedSandbox(opts: HostedBootstrapOptions): Promise<HostedBootstrapResult>;
+export interface TeardownOptions {
+    session: SandboxSession;
+    paths: HostedRuntimePaths;
+    bearer: string;
+    workspaceDir?: string;
+    /** Extra token values to sweep for (e.g. a minted repo token a test planted). */
+    extraTokens?: readonly string[];
+}
+/**
+ * Tear the run-scoped credential material down and PROVE no token residue
+ * remains (G3, extends ALI-973's `sweepForTokenResidue`). Removes the run dir
+ * (bearer + boot context + minted-token cache), unsets the repo-local credential
+ * helper, then sweeps .git/config, the git credential cache, env, argv, and
+ * ~/.git-credentials for the bearer, any extra tokens, and the token markers.
+ */
+export declare function teardownHostedSandbox(opts: TeardownOptions): Promise<{
+    clean: boolean;
+    findings: HygieneFinding[];
+}>;
+export interface HostedSweepOptions {
+    bearer: string;
+    paths: HostedRuntimePaths;
+    workspaceDir: string;
+    extraTokens?: readonly string[];
+}
+/**
+ * Extend the ALI-973 sweep with hosted-specific probes: the run dir (bearer +
+ * cache) must be gone, and the standard leak surfaces (.git/config, ~/.git-
+ * credentials, credential cache, env, argv) must be free of the bearer.
+ */
+export declare function sweepHostedResidue(session: SandboxSession, opts: HostedSweepOptions): Promise<HygieneFinding[]>;
+//# sourceMappingURL=hosted-bootstrap.d.ts.map

package/dist/hosted-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-bootstrap.d.ts","sourceRoot":"","sources":["../src/hosted-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAiBhF,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAIhF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACvF,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAQD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,yBAAyB,GAAG,qBAAqB,CA4CrG;AAID,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB;gFAC4E;IAC5E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IACrD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,mFAAmF;IACnF,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5B,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,KAAK,EAAE,kBAAkB,CAAA;IACzB,wEAAwE;IACxE,KAAK,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAChD;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB;AA6ED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAazG;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8LzG;AAsBD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,EAAE,kBAAkB,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iFAAiF;IACjF,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC,CAezD;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,kBAAkB,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,EAAE,CAAC,CA0B3B"}

package/dist/hosted-broker-server.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Standalone fake Orizu control-plane broker for the ALI-925 rehearsal + tests.
+ *
+ * This runs as its OWN process (spawned via `bun <this file>`), NOT in-process,
+ * for a specific reason: the local-sim `SandboxSession.exec` uses a blocking
+ * `spawnSync`, and the in-sandbox credential helper it runs makes a real HTTP
+ * call back to this broker. An in-process server can't answer that call while
+ * the test thread is blocked in `spawnSync` — so the broker must be a separate
+ * process with its own event loop.
+ *
+ * It implements exactly the two contracts the bootstrap depends on:
+ *   - POST /api/cli/workspaces/:id/repo-token → {token, expiresAt, repo, mintId}
+ *   - POST /api/cli/workbench-runs/:id/events → 201 (rejects reserved run_* 400)
+ * and it journals every accepted event / issued token to newline-delimited JSON
+ * files so the parent test can read them back. Config comes from env (below).
+ *
+ * Not shipped to end users — a test/rehearsal fixture only.
+ */
+export interface BrokerConfig {
+    bearer: string;
+    repo: string;
+    /** Test-only exact Artifacts remote returned by the repo-token endpoint. */
+    artifactsRemote?: string;
+    /** Test-only expiry override for fail-closed helper rehearsals. */
+    artifactsExpiresAt?: string;
+    eventsFile?: string;
+    tokensFile?: string;
+    repoTokenStatus?: number;
+    eventsStatus?: number;
+    denyWrite?: boolean;
+    port?: number;
+    /**
+     * E2E mode: accept ANY non-empty Bearer (the full hosted flow uses a human
+     * bearer for session/agent-token mints and a DISTINCT agent bearer for
+     * run/events), and serve the full RunAPI + session + agent-token surface so
+     * `startHostedSession` can be driven end to end. Off by default so the
+     * bootstrap/credential-helper tests keep their strict single-bearer contract.
+     */
+    fullRunApi?: boolean;
+    /** E2E: the session id + branch the /sessions endpoint returns (so it matches
+     *  a pre-seeded session branch on the local bare repo). */
+    sessionId?: string;
+    sessionBranch?: string;
+}
+export declare function readBrokerConfigFromEnv(env: NodeJS.ProcessEnv): BrokerConfig;
+export declare function startBrokerServer(config: BrokerConfig): {
+    port: number;
+    stop: (force?: boolean) => void;
+};
+//# sourceMappingURL=hosted-broker-server.d.ts.map

package/dist/hosted-broker-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-broker-server.d.ts","sourceRoot":"","sources":["../src/hosted-broker-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA8BH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;+DAC2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,YAAY,CAgB5E;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,CA6LzG"}

package/dist/hosted-git-http-server.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Standalone authenticated smart-HTTP git server for the ALI-925 rehearsal.
+ *
+ * Runs as its OWN process (spawned via `bun <this file>`), for the same reason
+ * the fake broker does: the local-sim `SandboxSession.exec` blocks on a
+ * `spawnSync` git clone, and the in-sandbox credential helper that clone drives
+ * makes real HTTP calls out. A server sharing the test's event loop could not
+ * answer while that loop is blocked — so the git server must be its own process.
+ *
+ * It proves the integrated credential path end-to-end: it (a) requires HTTP Basic
+ * auth and rejects unauthenticated requests with 401 + `WWW-Authenticate`, forcing
+ * git to invoke the credential helper, and (b) on authenticated requests serves a
+ * real bare repo by shelling to `git http-backend` as CGI. Every Basic-auth
+ * password it receives is journaled to a file so the rehearsal can assert the
+ * password git presented equals the token the broker minted (git → helper →
+ * broker → token → authenticated clone).
+ *
+ * Not shipped to end users — a test/rehearsal fixture only.
+ */
+export interface GitHttpConfig {
+    /** Absolute path to the bare repo (e.g. `<root>/workbench.git`). */
+    repoDir: string;
+    /** File the server appends every received `{ user, pass }` to (NDJSON). */
+    authLogFile?: string;
+    port?: number;
+}
+export declare function readGitHttpConfigFromEnv(env: NodeJS.ProcessEnv): GitHttpConfig;
+/** The env keys the server reads (kept here so callers do not hand-roll them). */
+export declare function gitHttpEnv(config: GitHttpConfig): Record<string, string>;
+/** The clone path segment a client uses (the bare repo's basename). */
+export declare function gitHttpRepoSegment(config: GitHttpConfig): string;
+export declare function startGitHttpServer(config: GitHttpConfig): {
+    port: number;
+    stop: (force?: boolean) => void;
+};
+//# sourceMappingURL=hosted-git-http-server.d.ts.map