orizu 0.5.20 → 0.5.21

package/dist/hosted-headless.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Headless-run helpers (ALI-1037) for the in-sandbox loop.
+ *
+ *   - `withIdleWatchdog`: wraps a harness event stream and aborts a prompt that
+ *     makes NO progress (no harness event) for a bounded window, so a stalled
+ *     agent can never hang a hosted run forever. On idle it invokes `onTimeout`
+ *     (the loop aborts the harness) then throws `AgentStalledError`, which the
+ *     loop turns into a `failed` terminal — AFTER running the end-of-run harvest.
+ *
+ *   - `annotateHeadlessQuestions`: observability for the question-tool deny path.
+ *     The interactive `question` tool is DENIED via OpenCode's permission map
+ *     (see HEADLESS_DENIED_TOOLS in hosted-harness-opencode.ts), so a headless
+ *     run never blocks on it. When the agent nonetheless attempts a `question`
+ *     tool call, this wrapper emits a `question_auto_answered` event recording the
+ *     question and the option that WOULD be recommended, so the run timeline shows
+ *     the auto-handling. It touches only the normalized event stream — never the
+ *     fragile OpenCode SSE transform.
+ */
+import type { HarnessEvent } from './hosted-harness.js';
+/** Thrown by `withIdleWatchdog` when the stream is idle past its timeout. */
+export declare class AgentStalledError extends Error {
+    readonly idleMs: number;
+    constructor(idleMs: number);
+}
+/** Render the idle window for the error message. Minutes (the operator-facing
+ *  unit; default window is 25m), rounded to one decimal so sub-minute test
+ *  windows still read sensibly. */
+export declare function formatIdleWindow(ms: number): string;
+export interface IdleWatchdogOptions<T> {
+    /** No harness event within this many ms aborts the prompt. <= 0 disables. */
+    timeoutMs: number;
+    /** Invoked once on idle (the loop aborts the harness) before the throw. */
+    onTimeout: () => Promise<void> | void;
+    /**
+     * Whether a value counts as PROGRESS (resets the idle timer). Values passed
+     * through as non-progress are still yielded downstream but do NOT extend the
+     * idle deadline. Defaults to treating every value as progress. Used to exclude
+     * synthetic deny-path events (e.g. `question_auto_answered`) so a model stuck
+     * in a denied-question retry loop still trips `agent_stalled` (ALI-1069).
+     */
+    isProgress?: (value: T) => boolean;
+}
+/**
+ * Wrap `source` so that if no PROGRESS arrives within `timeoutMs`, `onTimeout`
+ * runs and `AgentStalledError` is thrown. The idle deadline advances only on
+ * values `opts.isProgress` accepts (default: all), so it measures gaps between
+ * real progress events, not total duration — a stream of non-progress values
+ * (e.g. `question_auto_answered` deny-path events) passes through WITHOUT
+ * resetting the timer, so a stuck loop still stalls. The still-pending `next()`
+ * is not left as an unhandled rejection, and the underlying iterator is
+ * returned/closed on any early exit.
+ */
+export declare function withIdleWatchdog<T>(source: AsyncIterable<T>, opts: IdleWatchdogOptions<T>): AsyncGenerator<T>;
+export interface ParsedHeadlessQuestion {
+    question: string;
+    chosenOption: string;
+}
+/**
+ * Parse the OpenCode `question` tool args into the question text and the option
+ * we would pick headless: the one labeled "(Recommended)" if present, else the
+ * first. Defensive against the tool's shape drifting (options as strings or
+ * objects; the question under any of several keys).
+ */
+export declare function parseHeadlessQuestion(args: unknown): ParsedHeadlessQuestion;
+/**
+ * Pass every harness event through unchanged; when a `question` tool call/result
+ * is seen, additionally emit a `question_auto_answered` event (deduped per
+ * callId+message) recording the auto-handling. The tool is denied at the
+ * permission layer, so this is a record — not an interactive reply.
+ */
+export declare function annotateHeadlessQuestions(source: AsyncIterable<HarnessEvent>): AsyncGenerator<HarnessEvent>;
+//# sourceMappingURL=hosted-headless.d.ts.map

package/dist/hosted-headless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-headless.d.ts","sourceRoot":"","sources":["../src/hosted-headless.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBACX,MAAM,EAAE,MAAM;CAK3B;AAED;;mCAEmC;AACnC,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAA;IACjB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACrC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAA;CACnC;AAID;;;;;;;;;GASG;AACH,wBAAuB,gBAAgB,CAAC,CAAC,EACvC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC3B,cAAc,CAAC,CAAC,CAAC,CAyCnB;AAeD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,sBAAsB,CA0B3E;AAED;;;;;GAKG;AACH,wBAAuB,yBAAyB,CAC9C,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,GAClC,cAAc,CAAC,YAAY,CAAC,CAuB9B"}

package/dist/hosted-loop-lifecycle.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Hosted-loop LIFECYCLE seam (ALI-1015 Phase 1, per ADR-005 Resolution).
+ *
+ * The orchestration-facing parts of the hosted loop, extracted VERBATIM from
+ * `hosted-loop.ts` so they can be re-exported through the shared
+ * `lib/hosted-runtime/` surface and driven by a server-side coordinator (the
+ * per-session Durable Object) as well as the CLI. This module deliberately
+ * carries NO harness/runtime machinery: its only import is the TYPE-ONLY
+ * `HarnessEvent` (erased at compile time), so a Worker bundle that pulls the
+ * lifecycle seam never drags in the OpenCode/Claude-SDK drivers or any Node
+ * child-process code.
+ *
+ * Contents (moved, not rewritten — behavior identical):
+ *   - `HostedLoopContext` — the run-scoped boot context the host orchestrator
+ *     writes for the in-sandbox loop;
+ *   - `buildOpenCodeSpawnEnv` — the pre-authenticated agent env (ALI-1044);
+ *   - the G5 egress canary: `runEgressCanary`, `egressCanaryAllowedHost`,
+ *     `defaultProbeEgress`, and their types/constants;
+ *   - `SetupHookOutcome` — the deferred customer-setup-hook contract.
+ *
+ * `hosted-loop.ts` re-exports everything here, so the CLI's import surface
+ * (`@/packages/cli/src/hosted-loop`) is unchanged.
+ */
+import type { HarnessEvent } from './hosted-harness.js';
+/**
+ * Default provider-qualified hosted model — the SINGLE source of truth
+ * (ALI-1086). Imported by both the operator-path session CLI
+ * (`hosted-session-cli.ts`) and the DO-path boot (`hosted-boot.ts`); never
+ * re-inline it.
+ *
+ * PIN CONSTRAINT: the hosted OpenCode runtime is HARD-PINNED to
+ * `opencode-ai@1.14.41` (`OPENCODE_PINNED_VERSION`, SSE-fragile — do not bump)
+ * whose BUNDLED model catalog predates this model (newest bundled anthropic
+ * opus: claude-opus-4-7). Verified empirically on ALI-1086: 1.14.41 DOES fetch
+ * `https://models.dev/api.json` at boot when reachable (cached to
+ * `~/.cache/opencode/models.json`, refreshed when stale, disabled only by
+ * `OPENCODE_DISABLE_MODELS_FETCH`), so with models.dev on the sandbox egress
+ * allowlist (#1392, `ORIZU_HOSTED_EGRESS_ALLOWLIST`) this id resolves in new
+ * sandboxes. If the catalog fetch is blocked/stale anyway, the loop's
+ * pre-prompt validation (`awaitOpenCodeModelResolvable`) fails the run fast,
+ * naming the resolvable alternatives. The durable fix for the stale bundled
+ * catalog is the ALI-929 harness swap.
+ */
+export declare const DEFAULT_HOSTED_MODEL = "anthropic/claude-opus-4-8";
+/**
+ * The run-scoped context the host orchestrator writes for the loop. Paths are
+ * ABSOLUTE (or sandbox-root-relative) so the loop resolves them regardless of
+ * cwd. NO secret lives here — the bearer is read from `bearerFile` (0600).
+ */
+export interface HostedLoopContext {
+    apiBaseUrl: string;
+    runId: string;
+    /** 0600 file holding the agent bearer (never inlined into this context). */
+    bearerFile: string;
+    /** File holding the single task prompt (v0: one prompt, no queue). */
+    taskFile: string;
+    /** Directory the agent operates in (the cloned session-branch workspace). */
+    workspaceDir: string;
+    /** Provider-qualified model, e.g. "anthropic/claude-opus-4-8". */
+    model: string;
+    reasoningEffort?: string;
+    /** Idempotency / correlation key for the prompt. */
+    messageId: string;
+    /** Git identity for commit attribution during the prompt. */
+    author: {
+        name: string;
+        email: string;
+    };
+    /**
+     * Which `AgentHarness` drives the loop (ALI-929 swappability seam). Default
+     * 'opencode'. 'claude-agent-sdk' selects the in-process Claude-Agent-SDK driver
+     * — no `opencode` install/spawn happens on that path.
+     */
+    harness?: 'opencode' | 'claude-agent-sdk';
+    /**
+     * Total sandbox lifetime budget in ms (derived from the session `--duration`).
+     * The loop derives the per-prompt max-duration cap from this (budget minus a
+     * harvest margin, floored at the harness default) so a long `--duration` run is
+     * NOT killed at the hard-coded 90-min prompt cap while its sandbox still lives
+     * (ALI-1061). Unset for undated runs → the harness default (5400s) floor holds.
+     */
+    sandboxBudgetMs?: number;
+    opencodePort?: number;
+    opencodePinnedVersion?: string;
+    /**
+     * Pre-baked runtime (ALI-1017): the image already ships the pinned `opencode`
+     * on PATH, so the loop SKIPS the `opencode-ai` install (npm is blocked under G5
+     * default-deny egress) and spawns `opencode` directly, recording an
+     * `opencode_prebaked` artifact instead of `opencode_install`. The host sets this
+     * together with the sandbox `image` so the two never disagree. When unset, the
+     * loop ALSO belt-checks the `/opt/orizu/prebaked.json` marker; either signal
+     * skips the install. Ignored on the claude-agent-sdk path (no server to install).
+     */
+    prebaked?: boolean;
+    /**
+     * Non-secret placeholder key OpenCode is given so it FORMS model requests; the
+     * sandbox firewall's request transform overrides the real auth header at the
+     * proxy (model-key brokering, G3). Never a real key.
+     */
+    anthropicDummyKey?: string;
+    /** OpenCode session id to resume on reconnect. */
+    resumeAgentSessionId?: string;
+    /**
+     * Startup egress-canary probe host (G5 / ALI-1006). When SET, the loop runs a
+     * POSITIVE-CONTROL canary before any agent work, probing BOTH this known
+     * NON-allowlisted (denied) host AND a known-allowed host (the Orizu API base,
+     * derived from `apiBaseUrl`). The run proceeds ONLY IF the allowed host is
+     * reachable AND the denied host is blocked (`egress_blocked` proof). Any other
+     * outcome FAILS the run closed (`egress_allowed`): the denied host reachable
+     * means the firewall did not take; the allowed host ALSO unreachable means the
+     * network is broken and we cannot distinguish policy-enforcement from a total
+     * outage — either way we must not proceed to real customer data. The host sets
+     * this only for providers that actually enforce egress (Vercel); it is UNSET
+     * for local-sim / no-policy runs, so the canary is skipped there. Default
+     * denied probe target: `example.com`.
+     */
+    egressCanaryHost?: string;
+    /**
+     * When true, run the customer `.orizu/setup.sh` hook HERE (in the loop), AFTER
+     * the egress canary has proven the firewall is live and BEFORE harness work.
+     * The host sets this for enforced-egress providers so bootstrap DEFERS the hook
+     * (which would otherwise get network access before the canary could detect a
+     * silent firewall failure). UNSET for local-sim / no-policy runs, where
+     * bootstrap runs the hook inline as before. See docs sandbox-egress-policy §4.
+     */
+    runSetupHook?: boolean;
+}
+/**
+ * Environment injected into the spawned OpenCode server so the AGENT's bash sees a
+ * PRE-AUTHENTICATED `orizu` CLI (ALI-1044). ORIZU_TOKEN_FILE points at the 0600
+ * rotated bearer file and ORIZU_BASE_URL at the Orizu API — the exact vars the
+ * CLI's auth resolution reads (resolveEnvBearerToken + resolveBaseUrl). The dummy
+ * ANTHROPIC key (model-key brokering, G3) is preserved. No real secret is carried
+ * here: the bearer stays on disk and is read fresh per request from the file.
+ */
+export declare function buildOpenCodeSpawnEnv(context: HostedLoopContext): Record<string, string> | undefined;
+/** Default egress-canary probe host (a known non-allowlisted destination). */
+export declare const DEFAULT_EGRESS_CANARY_HOST = "example.com";
+export interface EgressProbeResult {
+    /** True when the denied host was reachable (policy did NOT take → fail closed). */
+    reachable: boolean;
+    /** Short human/audit detail (HTTP status on reach, error class on block). */
+    detail: string;
+}
+/**
+ * Default probe: attempt a bounded HTTPS GET to `host`. A live default-deny
+ * firewall makes this THROW for a DENIED host (connection reset / timeout / DNS
+ * failure) → `reachable: false`. Any response at all — even an error status —
+ * proves the host was reachable → `reachable: true`. Used for BOTH the allowed
+ * (positive-control) and denied probes.
+ */
+export declare function defaultProbeEgress(host: string): Promise<EgressProbeResult>;
+/** The two hosts the positive-control canary probes. */
+export interface EgressCanaryTargets {
+    /** A known-ALLOWED host (the Orizu API base) that MUST be reachable — the
+     *  positive control that distinguishes "policy blocking" from "network dead". */
+    allowedHost: string;
+    /** A known-DENIED, non-allowlisted host that MUST be blocked (`example.com`). */
+    deniedHost: string;
+}
+export interface EgressCanaryDecision {
+    proceed: boolean;
+    /** Null on proceed; a human/audit reason for the fail-closed decision. */
+    reason: string | null;
+    allowed: EgressProbeResult;
+    denied: EgressProbeResult;
+}
+/**
+ * Run the startup egress canary as a POSITIVE CONTROL and emit the proof event
+ * through the (single-writer) sink. Probes BOTH a known-allowed host and the
+ * known-denied host, then decides:
+ *
+ *   - allowed REACHABLE and denied BLOCKED → the firewall is live AND the network
+ *     works → emit `egress_blocked` and PROCEED (the ONLY healthy outcome);
+ *   - denied REACHABLE → egress is NOT enforced → emit `egress_allowed`, FAIL
+ *     CLOSED;
+ *   - allowed ALSO UNREACHABLE (denied blocked but the positive control failed) →
+ *     we cannot tell policy-blocking from a total network outage → emit
+ *     `egress_allowed`, FAIL CLOSED.
+ *
+ * The `egress_blocked` kind therefore means EXACTLY "proceeded, positive control
+ * passed"; `egress_allowed` means "failed closed" (the payload `result` field
+ * distinguishes an unexpectedly-reachable denied host from an unreachable
+ * positive control). Old behavior — treating ANY denied-host throw (incl. a
+ * timeout under a total outage) as "blocked → proceed" — failed OPEN; this now
+ * fails closed on that ambiguity.
+ */
+export declare function runEgressCanary(targets: EgressCanaryTargets, sink: {
+    append: (event: HarnessEvent) => Promise<void>;
+}, probe: (host: string) => Promise<EgressProbeResult>, now?: () => number): Promise<EgressCanaryDecision>;
+/**
+ * Derive the known-ALLOWED positive-control host from the run's Orizu API base —
+ * always allowlisted (it is the agent's control-plane path) and ours, so it is
+ * the safest "must be reachable" signal. Falls back to a lenient host parse if
+ * the base is not a well-formed URL.
+ */
+export declare function egressCanaryAllowedHost(apiBaseUrl: string): string;
+/** Outcome of the deferred customer setup hook run inside the loop. */
+export interface SetupHookOutcome {
+    /** True when a `.orizu/setup.sh` existed and was executed. */
+    ran: boolean;
+    /** True when the hook was absent OR exited 0 (non-fatal either way). */
+    ok: boolean;
+    detail: string;
+}
+//# sourceMappingURL=hosted-loop-lifecycle.d.ts.map

package/dist/hosted-loop-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-loop-lifecycle.d.ts","sourceRoot":"","sources":["../src/hosted-loop-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAA;AAE/D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAA;IACzC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAYpG;AAED,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,gBAAgB,CAAA;AAKvD,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAA;IAClB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAejF;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC;qFACiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE;IAAE,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,EACxD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,EACnD,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAkE/B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMlE;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,GAAG,EAAE,OAAO,CAAA;IACZ,wEAAwE;IACxE,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf"}

package/dist/hosted-loop.d.ts

@@ -0,0 +1,170 @@
+/**
+ * In-sandbox hosted agent loop (ALI-928 / P3.5, per ADR-005).
+ *
+ * Runs INSIDE the sandbox (installed by the bootstrap CLI step, launched
+ * DETACHED by `orizu session start --hosted`). It composes the ALI-926 pieces:
+ *
+ *   1. resolve the loop boot context (a run-scoped JSON file written by the host
+ *      orchestrator) + read the agent bearer from its 0600 file (G3);
+ *   2. install `opencode` pinned to OPENCODE_PINNED_VERSION (non-fatal-RECORDED;
+ *      if it is unavailable the spawn/connect below fails and the run finishes
+ *      'failed' cleanly — the run never dangles);
+ *   3. build a RESUME-AWARE RunEventSink (continues the server's sequence after
+ *      the run-start + bootstrap events — so a reconnect loses nothing);
+ *   4. provision the `AgentHarness` SELECTED by `context.harness` (default
+ *      'opencode': install+spawn `opencode serve` then connect the OpenCode
+ *      driver; 'claude-agent-sdk': construct the in-process Claude-Agent-SDK
+ *      driver — no server to install or spawn), then drive the SINGLE task prompt
+ *      (v0: no queue) through `drainHarnessToSink`;
+ *   5. the terminal event decides the run's final status via the sink's PATCH.
+ *
+ * SWAPPABILITY (ALI-929 / P3.6): harness SELECTION is the ONLY thing that differs
+ * between the two drivers — `start()` → `runPrompt()` → `drainHarnessToSink()` →
+ * `shutdown()` is byte-identical for both, and the sink, event vocabulary, and
+ * terminal-PATCH flow are unchanged. That is the proof: a second harness drops in
+ * behind the seam with no change to any consumer beyond the selector.
+ *
+ * The redaction list carries the agent bearer (added automatically by the sink)
+ * plus any model key present in the process env (defense in depth for the G3
+ * per-exec fallback — with firewall brokering the real key never reaches here).
+ *
+ * TESTABILITY: `runHostedLoop` takes injected `fetchImpl`, `spawnOpenCode`,
+ * `installOpenCode`, and `createHarness`, so the whole loop runs in-process
+ * against a fake broker + fake OpenCode server with no real binary.
+ */
+import type { AgentHarness } from './hosted-harness.js';
+import { type HarvestExec } from './hosted-harvest.js';
+import { type ModelValidationOutcome, type SpawnOpenCodeOptions, type SpawnedOpenCode } from './hosted-harness-opencode.js';
+import { type HostedFetch, type TerminalStatus } from './hosted-run-event-sink.js';
+import { type EgressProbeResult, type HostedLoopContext, type SetupHookOutcome } from './hosted-loop-lifecycle.js';
+export { DEFAULT_EGRESS_CANARY_HOST, DEFAULT_HOSTED_MODEL, buildOpenCodeSpawnEnv, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
+export type { EgressCanaryDecision, EgressCanaryTargets, EgressProbeResult, HostedLoopContext, SetupHookOutcome, } from './hosted-loop-lifecycle.js';
+export declare const PROMPT_HARVEST_MARGIN_MS: number;
+/**
+ * Derive the per-prompt max-duration cap from the sandbox lifetime budget: the
+ * budget minus a harvest margin, FLOORED at the harness default so a short or
+ * undated run is never shortened below the historical 5400s cap (ALI-1061).
+ * Undated runs (`sandboxBudgetMs` unset / non-positive) get exactly the default.
+ */
+export declare function derivePromptMaxDurationMs(sandboxBudgetMs: number | undefined): number;
+export interface InstallResult {
+    ok: boolean;
+    detail: string;
+}
+export interface RunHostedLoopOptions {
+    context: HostedLoopContext;
+    /**
+     * Agent bearer, as a FIXED string (tests / in-process launcher) OR omitted in
+     * favor of `bearerProvider`. In production the loop reads the rotated 0600
+     * bearer file per request via a provider (see `bearerProvider`), so a
+     * host-side rotation is picked up without restarting the loop.
+     */
+    bearer?: string;
+    /** Per-request bearer resolver (default: read `context.bearerFile`, trimmed).
+     *  Passing a provider is what lets rotation reach the event sink. */
+    bearerProvider?: () => string;
+    /** The single task prompt (already read from the task file by the caller). */
+    taskPrompt: string;
+    fetchImpl?: HostedFetch;
+    /** Build the harness for a spawned OpenCode base URL (default: OpenCode driver).
+     *  `options.promptMaxDurationMs` is the duration-derived per-prompt cap (ALI-1061). */
+    createHarness?: (baseUrl: string, options?: {
+        promptMaxDurationMs?: number;
+    }) => AgentHarness;
+    /** Build the in-process Claude-Agent-SDK harness (default: real SDK loader).
+     *  Injectable so the swap test drives a fake `query()` with no real SDK. */
+    createClaudeHarness?: () => AgentHarness;
+    spawnOpenCode?: (opts: SpawnOpenCodeOptions) => SpawnedOpenCode | Promise<SpawnedOpenCode>;
+    installOpenCode?: () => Promise<InstallResult>;
+    /**
+     * Pre-prompt model validation against the RUNNING opencode's resolvable
+     * catalog (ALI-1086). Default: `awaitOpenCodeModelResolvable`, which polls
+     * `GET /config/providers` briefly so the boot-time models.dev refresh can
+     * land. An `unresolvable` outcome fails the run BEFORE the first prompt with
+     * an error naming the requested id and the resolvable alternatives; a
+     * `skipped` outcome (catalog endpoint unreachable) proceeds — opencode's own
+     * `session.error` remains the backstop. Injectable for tests.
+     */
+    validateModel?: (input: {
+        baseUrl: string;
+        model: string;
+    }) => Promise<ModelValidationOutcome>;
+    now?: () => number;
+    signal?: AbortSignal;
+    /** Extra verbatim secrets to redact (the bearer is added by the sink itself). */
+    redactSecretsList?: readonly string[];
+    /** Egress-canary probe (default: a bounded `fetch` to https://<host>/).
+     *  Injectable so tests exercise both the blocked and reachable branches with
+     *  no real network. Called once per host (allowed + denied) by the canary. */
+    probeEgress?: (host: string) => Promise<EgressProbeResult>;
+    /** Run the deferred customer setup hook (default: `bash .orizu/setup.sh` in the
+     *  workspace, non-fatal). Injectable so tests exercise the deferred-hook path
+     *  with no real filesystem or child process. */
+    runSetupHook?: (input: {
+        workspaceDir: string;
+    }) => Promise<SetupHookOutcome> | SetupHookOutcome;
+    /**
+     * Standing preamble wrapped around the user task (ALI-1036). Defaults to
+     * `HOSTED_TASK_PREAMBLE`; pass an override to customize it, or an empty string
+     * to send the task verbatim (tests). The user task is always kept verbatim
+     * beneath a delimiter (see `composeHostedTaskPrompt`).
+     */
+    taskPreamble?: string;
+    /**
+     * Injectable git runner for the end-of-run auto-harvest (ALI-1036). Default:
+     * real `git` via child_process in `context.workspaceDir`.
+     */
+    harvestExec?: HarvestExec;
+    /**
+     * Idle watchdog window (ALI-1037): abort the prompt + fail the run
+     * `agent_stalled` if NO progress event arrives for this many ms. Default: env
+     * `ORIZU_AGENT_IDLE_TIMEOUT_MS` or 25 minutes. <= 0 disables the watchdog.
+     */
+    idleTimeoutMs?: number;
+    /** Injectable sleep for the terminal-delivery retry backoff (ALI-1065
+     *  finding 2). Tests pass a no-op to avoid real delays. */
+    sleepImpl?: (ms: number) => Promise<void>;
+}
+export interface HostedLoopResult {
+    status: TerminalStatus;
+    agentSessionId: string | null;
+    installOk: boolean;
+    error: string | null;
+}
+/** Default idle-watchdog window (ALI-1037): abort a prompt that makes no progress
+ *  for this long. The timer resets on every harness EVENT, and a legitimate long
+ *  single tool call (a big `npm install`, a build, an optimization step) emits no
+ *  intermediate events — so this must comfortably exceed the longest expected
+ *  quiet tool call (review finding #2). Overridable per-run via `idleTimeoutMs` or
+ *  the `ORIZU_AGENT_IDLE_TIMEOUT_MS` env var. */
+export declare const DEFAULT_AGENT_IDLE_TIMEOUT_MS: number;
+/**
+ * Loop-level retry schedule for an undeliverable TERMINAL transition (ALI-1065
+ * finding 2). Each entry is a pause before one more full sink delivery cycle
+ * (which itself retries ~4 times over ~350ms), so a transport blip of a few
+ * seconds recovers with the ORIGINAL status instead of being re-recorded as
+ * 'failed'. Bounded: a persistently unreachable control plane fails the
+ * DELIVERY visibly (result.error) without recording a wrong outcome.
+ */
+export declare const TERMINAL_DELIVERY_RETRY_DELAYS_MS: readonly number[];
+/**
+ * Env var naming OTHER env vars whose values were injected as secrets — the
+ * server env-bundle pull (ALI-1055: `GET /api/coordinator/sessions/:id/
+ * env-bundle` returns `redactEnvVars`) writes it as a comma-separated list of
+ * names (e.g. `ANTHROPIC_API_KEY,BRAINTRUST_API_KEY`) so every pulled secret
+ * (model key + connector credentials) lands on the run-event redaction list.
+ */
+export declare const INJECTED_ENV_VARS_ENV = "ORIZU_INJECTED_ENV_VARS";
+export declare function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedLoopResult>;
+export interface HostedLoopCommandIo {
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    json?: boolean;
+}
+/**
+ * Read the loop context + bearer + task from disk and run the loop. Invoked
+ * in-sandbox as a hidden command; the run's terminal status is recorded
+ * server-side regardless of this process's exit code.
+ */
+export declare function hostedLoopCommand(args: readonly string[], io: HostedLoopCommandIo): Promise<number>;
+//# sourceMappingURL=hosted-loop.d.ts.map

package/dist/hosted-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-loop.d.ts","sourceRoot":"","sources":["../src/hosted-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,qBAAqB,CAAA;AAQtE,OAAO,EAAoB,KAAK,WAAW,EAAuB,MAAM,qBAAqB,CAAA;AAE7F,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAA;AAKnC,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,GAChB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,4BAA4B,CAAA;AAOnC,eAAO,MAAM,wBAAwB,QAAgB,CAAA;AAErD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKrF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,iBAAiB,CAAA;IAC1B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;yEACqE;IACrE,cAAc,CAAC,EAAE,MAAM,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB;2FACuF;IACvF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,YAAY,CAAA;IAC7F;gFAC4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,YAAY,CAAA;IACxC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1F,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9C;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC9F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC;;kFAE8E;IAC9E,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1D;;oDAEgD;IAChD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAChG;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;+DAC2D;IAC3D,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAeD;;;;;iDAKiD;AACjD,eAAO,MAAM,6BAA6B,QAAiB,CAAA;AAa3D;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAmB,CAAA;AAKlF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAA;AA4E9D,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgZzF;AAID,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AASD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,mBAAmB,GACtB,OAAO,CAAC,MAAM,CAAC,CAwBjB"}