orizu 0.5.26 → 0.5.28

package/dist/hosted-bootstrap.d.ts

@@ -132,6 +132,8 @@ export interface HostedBootstrapResult {
     steps: HostedBootstrapStep[];
     events: readonly AppendedRunEvent[];
     paths: HostedRuntimePaths;
+    /** Bootstrap-selected helper, carried out-of-repo to checkpoint transport. */
+    credentialHelper: string;
     /** Set on the failure path: the residue sweep result after teardown. */
     sweep: {
         clean: boolean;

package/dist/hosted-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-bootstrap.d.ts","sourceRoot":"","sources":["../src/hosted-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAiBhF,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAIhF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACvF,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAQD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,yBAAyB,GAAG,qBAAqB,CA4CrG;AAID,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB;gFAC4E;IAC5E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IACrD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,mFAAmF;IACnF,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5B,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,KAAK,EAAE,kBAAkB,CAAA;IACzB,wEAAwE;IACxE,KAAK,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAChD;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB;AA6ED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAazG;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8LzG;AAsBD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,EAAE,kBAAkB,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iFAAiF;IACjF,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC,CAezD;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,kBAAkB,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,EAAE,CAAC,CA0B3B"}
+{"version":3,"file":"hosted-bootstrap.d.ts","sourceRoot":"","sources":["../src/hosted-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAiBhF,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAIhF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACvF,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAQD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,yBAAyB,GAAG,qBAAqB,CA4CrG;AAID,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB;gFAC4E;IAC5E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IACrD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,mFAAmF;IACnF,IAAI,CAAC,EAAE,qBAAqB,CAAA;IAC5B,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAA;IACX,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5B,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACnC,KAAK,EAAE,kBAAkB,CAAA;IACzB,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,wEAAwE;IACxE,KAAK,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAChD;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB;AA6ED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAazG;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuMzG;AAsBD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,EAAE,kBAAkB,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iFAAiF;IACjF,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC,CAezD;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,kBAAkB,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,cAAc,EAAE,CAAC,CA0B3B"}

package/dist/hosted-bootstrap.js

@@ -297,7 +297,10 @@ export async function bootstrapHostedSandbox(opts) {
         if (opts.deferSetupHook) {
             record('setup_hook_deferred', true, 'deferred to loop (runs after egress canary)');
             await sink.append('setup_hook_deferred', { reason: 'egress canary must pass before customer setup.sh runs' });
-            return { ok: true, steps, events: sink.recorded, paths, sweep: null, failure: null };
+            return {
+                ok: true, steps, events: sink.recorded, paths,
+                credentialHelper: helperValue, sweep: null, failure: null,
+            };
         }
         const hookRel = `${workspaceDir}/${SETUP_HOOK_RELATIVE_PATH}`;
         if (await session.fileExists(hookRel)) {
@@ -314,7 +317,10 @@ export async function bootstrapHostedSandbox(opts) {
             record('setup_hook_skipped', true, 'no .orizu/setup.sh');
             await sink.append('setup_hook_skipped', { reason: 'no .orizu/setup.sh' });
         }
-        return { ok: true, steps, events: sink.recorded, paths, sweep: null, failure: null };
+        return {
+            ok: true, steps, events: sink.recorded, paths,
+            credentialHelper: helperValue, sweep: null, failure: null,
+        };
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -322,7 +328,10 @@ export async function bootstrapHostedSandbox(opts) {
         // Record the failure (redacted), then tear down + prove no residue remains.
         await safeAppend(sink, 'bootstrap_failed', { step: currentStep, error: message });
         const sweep = await teardownHostedSandbox({ session, paths, bearer: opts.bearer, workspaceDir });
-        return { ok: false, steps, events: sink.recorded, paths, sweep, failure: { step: currentStep, error: message } };
+        return {
+            ok: false, steps, events: sink.recorded, paths, credentialHelper: helperValue,
+            sweep, failure: { step: currentStep, error: message },
+        };
     }
 }
 /** Never let a failure-path event append mask the original error. */

package/dist/hosted-harness-opencode.d.ts

@@ -156,20 +156,19 @@ export interface OpenCodeConfigOptions {
     permission?: Record<string, unknown>;
 }
 /**
- * Tools DENIED in a hosted headless run (ALI-1037). OpenCode exposes a `question`
- * permission key (docs/permissions) that gates the interactive "ask the user a
- * question" tool. In an unattended sandbox there is no human to answer it, and
- * OpenCode's only external reply endpoint — `POST /session/{id}/permissions/{permID}`
- * — takes a BOOLEAN allow/deny, so it cannot select one of the tool's multiple
- * options anyway. Denying the tool makes the model's ask fail fast (surfaced back
- * to it as a tool error) so it proceeds autonomously per the standing preamble
- * (HOSTED_TASK_PREAMBLE), instead of blocking the run forever. This is the
- * documented fallback path in ALI-1037 (answer-externally is not cleanly possible).
+ * Tools denied for CLI-origin headless runs (ALI-1037). OpenCode 1.14.41 removes
+ * a tool from the model toolset when its permission rule is `deny` on `*`; it does
+ * not expose the tool and report a denial result. Hosted-web therefore overrides
+ * `question` to `allow`, intercepts its measured running part, and quiesces the
+ * turn while waiting for the human. CLI-origin runs retain this deny list because
+ * no human reply flow exists there.
  */
 export declare const HEADLESS_DENIED_TOOLS: readonly ["question"];
 /** The default headless permission map: allow everything, deny the interactive
  *  question tool (see HEADLESS_DENIED_TOOLS). */
 export declare function defaultHeadlessPermission(): Record<string, unknown>;
+/** Select the OpenCode permission map for the session's human-input surface. */
+export declare function permissionForOrigin(origin?: 'hosted-web' | 'cli'): Record<string, unknown>;
 /**
  * Build the `OPENCODE_CONFIG_CONTENT` payload OpenCode reads at boot (mirrors
  * OpenInspect's `start_opencode`). Kept pure so the launch command and the

package/dist/hosted-harness-opencode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-harness-opencode.d.ts","sourceRoot":"","sources":["../src/hosted-harness-opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,KAAK,EACV,YAAY,EAIb,MAAM,qBAAqB,CAAA;AAS5B,eAAO,MAAM,uBAAuB,YAAY,CAAA;AAUhD,eAAO,MAAM,8BAA8B,UAAY,CAAA;AAQvD,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjF,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;wEACwE;AACxE,eAAO,MAAM,yBAAyB,iCAAiC,CAAA;AAuDvE;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAGzF;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,iBAAiB,EAAE,MAAM,EACzB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCzB;AA2GD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY,CA2bnF;AA8BD,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;AAIzE;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,YAA+C,EAC1D,SAAS,GAAE,MAAyC,GACnD,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuBtC;AASD;;;oEAGoE;AACpE,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,KAAK,SAAI,GACR,MAAM,EAAE,CAOV;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxC;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,gEAAgE;IAChE,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;CACjB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvC,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAKD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,sBAAsB,CAAC,CAqDjC;AAID,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;IACb;qEACiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,uBAAwB,CAAA;AAE1D;iDACiD;AACjD,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAInE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAK9E;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8EAA8E;IAC9E,KAAK,CAAC,EAAE,CACN,GAAG,EAAE,MAAM,EAAE,EACb,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAClE;QAAE,IAAI,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;IACzB;;sDAEkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;6CAEyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB;8DAC0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAkBD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+DxF"}
+{"version":3,"file":"hosted-harness-opencode.d.ts","sourceRoot":"","sources":["../src/hosted-harness-opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,KAAK,EACV,YAAY,EAIb,MAAM,qBAAqB,CAAA;AAS5B,eAAO,MAAM,uBAAuB,YAAY,CAAA;AAUhD,eAAO,MAAM,8BAA8B,UAAY,CAAA;AAQvD,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjF,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;wEACwE;AACxE,eAAO,MAAM,yBAAyB,iCAAiC,CAAA;AAuDvE;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAGzF;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,iBAAiB,EAAE,MAAM,EACzB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCzB;AA2GD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY,CA8hBnF;AA8BD,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;AAIzE;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,YAA+C,EAC1D,SAAS,GAAE,MAAyC,GACnD,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuBtC;AASD;;;oEAGoE;AACpE,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,KAAK,SAAI,GACR,MAAM,EAAE,CAOV;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxC;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,gEAAgE;IAChE,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;CACjB,GACD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvC,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAKD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,sBAAsB,CAAC,CAqDjC;AAID,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;IACb;qEACiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,uBAAwB,CAAA;AAE1D;iDACiD;AACjD,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAInE;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG1F;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAK9E;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8EAA8E;IAC9E,KAAK,CAAC,EAAE,CACN,GAAG,EAAE,MAAM,EAAE,EACb,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAClE;QAAE,IAAI,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;IACzB;;sDAEkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;6CAEyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB;8DAC0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAkBD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+DxF"}

package/dist/hosted-harness-opencode.js

@@ -281,6 +281,12 @@ export function createOpenCodeHarness(options) {
     // Set true by the public stop(); makes the next idle terminal resolve as a
     // cancellation rather than a success (P2-2).
     let stopRequested = false;
+    let stopRequest = null;
+    let promptSubmissionPending = false;
+    let promptSubmissionSettled = null;
+    let resolvePromptSubmission = null;
+    let postAcceptanceAbortGeneration = -1;
+    let promptGeneration = 0;
     // Last title actually forwarded, deduped across the whole harness lifetime so
     // a repeated identical title is emitted once (P3-6).
     let lastForwardedTitle = null;
@@ -331,16 +337,52 @@ export function createOpenCodeHarness(options) {
             return false;
         }
     }
-    async function requestStop() {
+    async function requestStop(options = {}) {
         if (!opencodeSessionId)
             return;
+        if (promptSubmissionPending &&
+            promptSubmissionSettled &&
+            postAcceptanceAbortGeneration !== promptGeneration) {
+            const racedGeneration = promptGeneration;
+            const settlement = promptSubmissionSettled;
+            postAcceptanceAbortGeneration = racedGeneration;
+            // The stream consumer may close this generator as soon as its signal
+            // aborts. Keep the post-acceptance abort independent of generator
+            // continuation so an accepted prompt cannot escape cancellation.
+            void settlement.then(() => requestStop({ force: true }));
+        }
+        // Prompt signal + the hosted-loop stop() belt normally share one successful
+        // request. A failed request is never memoized, and prompt acknowledgement
+        // can force a post-acceptance abort when an earlier abort raced ahead of it.
+        if (stopRequest && !options.force) {
+            const inFlight = stopRequest;
+            try {
+                await inFlight;
+                return;
+            }
+            catch {
+                if (stopRequest === inFlight)
+                    stopRequest = null;
+                // The owner of the failed request handles its own best-effort result.
+                // This overlapping caller owns the one follow-up acknowledgement try;
+                // it must never inherit the rejected memo as a fatal prompt error.
+                return requestStop(options);
+            }
+        }
+        const request = (async () => {
+            const response = await timedFetch(`${base}/session/${encodeURIComponent(opencodeSessionId)}/abort`, { method: 'POST' });
+            if (!response.ok)
+                throw new Error(`OpenCode abort failed (${response.status})`);
+        })();
+        stopRequest = request;
         try {
-            await timedFetch(`${base}/session/${encodeURIComponent(opencodeSessionId)}/abort`, {
-                method: 'POST',
-            });
+            await request;
         }
         catch {
-            // best-effort: the stream teardown is the real cancellation
+            if (stopRequest === request)
+                stopRequest = null;
+            // best-effort: stream teardown still settles this attempt, while a later
+            // stop can retry because the failed request no longer owns the memo.
         }
     }
     async function* fetchFinalState(sessionId, userMessageIds, allowedAssistantMsgIds, messageText, compactionOccurred) {
@@ -404,8 +446,13 @@ export function createOpenCodeHarness(options) {
             if (!opencodeSessionId)
                 opencodeSessionId = await createSession();
             const sessionId = opencodeSessionId;
-            // Per-prompt state: a fresh stop intent and compaction flag each run.
-            stopRequested = false;
+            promptGeneration += 1;
+            // Per-prompt state: a fresh stop generation unless a human interrupt was
+            // already delivered before this generator began iterating.
+            if (!signal.aborted) {
+                stopRequested = false;
+                stopRequest = null;
+            }
             let compactionOccurred = false;
             const promptStart = now();
             if (!readyEmitted) {
@@ -416,6 +463,19 @@ export function createOpenCodeHarness(options) {
                     payload: { agentSessionId: sessionId },
                 };
             }
+            // A durable interrupt can predate generator iteration. Do not submit a
+            // prompt merely to abort it; report the prompt-scoped cancellation after
+            // the stop belt has had a chance to settle.
+            if (signal.aborted) {
+                await requestStop();
+                yield {
+                    kind: 'execution_complete',
+                    messageId: prompt.messageId,
+                    critical: true,
+                    payload: { success: false, aborted: true },
+                };
+                return;
+            }
             const opencodeMessageId = ascendingId('msg');
             const requestBody = buildPromptRequestBody(prompt.content, startModel, opencodeMessageId, startReasoningEffort);
             // Per-part cumulative text, ordered per assistant message so a coalesced
@@ -485,6 +545,19 @@ export function createOpenCodeHarness(options) {
                 }
                 return events;
             };
+            // The vulnerable submission window begins before /event is opened and
+            // ends only when prompt_async settles. A stop anywhere in this window
+            // schedules an independent post-acceptance abort.
+            promptSubmissionPending = true;
+            promptSubmissionSettled = new Promise(resolve => {
+                resolvePromptSubmission = resolve;
+            });
+            const settlePromptSubmission = () => {
+                promptSubmissionPending = false;
+                resolvePromptSubmission?.();
+                resolvePromptSubmission = null;
+                promptSubmissionSettled = null;
+            };
             let sseResponse;
             try {
                 sseResponse = await fetchImpl(`${base}/event`, {
@@ -493,10 +566,23 @@ export function createOpenCodeHarness(options) {
                 });
             }
             catch (error) {
-                yield errorEvent(prompt.messageId, error);
+                settlePromptSubmission();
+                if (signal.aborted) {
+                    await requestStop();
+                    yield {
+                        kind: 'execution_complete',
+                        messageId: prompt.messageId,
+                        critical: true,
+                        payload: { success: false, aborted: true },
+                    };
+                }
+                else {
+                    yield errorEvent(prompt.messageId, error);
+                }
                 return;
             }
             if (!sseResponse.ok || !sseResponse.body) {
+                settlePromptSubmission();
                 // Cancel the body on the failure path too — a non-2xx response can still
                 // carry an (unconsumed) body that would otherwise leak (P3-7).
                 await cancelBody(sseResponse.body);
@@ -508,11 +594,17 @@ export function createOpenCodeHarness(options) {
             let errorText = null;
             let terminalYielded = false;
             try {
-                const promptRes = await timedFetch(`${base}/session/${encodeURIComponent(sessionId)}/prompt_async`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify(requestBody),
-                });
+                let promptRes;
+                try {
+                    promptRes = await timedFetch(`${base}/session/${encodeURIComponent(sessionId)}/prompt_async`, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify(requestBody),
+                    });
+                }
+                finally {
+                    settlePromptSubmission();
+                }
                 if (promptRes.status !== 200 && promptRes.status !== 204) {
                     throw new Error(`Async prompt failed (${promptRes.status})`);
                 }
@@ -679,15 +771,22 @@ export function createOpenCodeHarness(options) {
             }
         },
         async stop() {
-            // Mark intent so the resulting idle terminal is reported as cancelled, not
-            // succeeded (P2-2), then best-effort ask OpenCode to abort.
+            // Mark intent so the resulting idle terminal is reported as cancelled,
+            // not succeeded (P2-2), then best-effort ask OpenCode to abort.
             stopRequested = true;
             await requestStop();
         },
         async shutdown() {
+            if (process.env.NODE_ENV === 'test' &&
+                process.env.ORIZU_HOSTED_TEST_HARNESS_SHUTDOWN_THROWS === '1') {
+                throw new Error('fixture harness shutdown failed');
+            }
             opencodeSessionId = null;
             readyEmitted = false;
             stopRequested = false;
+            stopRequest = null;
+            promptGeneration = 0;
+            postAcceptanceAbortGeneration = -1;
         },
     };
 }
@@ -832,15 +931,12 @@ export async function awaitOpenCodeModelResolvable(opts) {
     };
 }
 /**
- * Tools DENIED in a hosted headless run (ALI-1037). OpenCode exposes a `question`
- * permission key (docs/permissions) that gates the interactive "ask the user a
- * question" tool. In an unattended sandbox there is no human to answer it, and
- * OpenCode's only external reply endpoint — `POST /session/{id}/permissions/{permID}`
- * — takes a BOOLEAN allow/deny, so it cannot select one of the tool's multiple
- * options anyway. Denying the tool makes the model's ask fail fast (surfaced back
- * to it as a tool error) so it proceeds autonomously per the standing preamble
- * (HOSTED_TASK_PREAMBLE), instead of blocking the run forever. This is the
- * documented fallback path in ALI-1037 (answer-externally is not cleanly possible).
+ * Tools denied for CLI-origin headless runs (ALI-1037). OpenCode 1.14.41 removes
+ * a tool from the model toolset when its permission rule is `deny` on `*`; it does
+ * not expose the tool and report a denial result. Hosted-web therefore overrides
+ * `question` to `allow`, intercepts its measured running part, and quiesces the
+ * turn while waiting for the human. CLI-origin runs retain this deny list because
+ * no human reply flow exists there.
  */
 export const HEADLESS_DENIED_TOOLS = ['question'];
 /** The default headless permission map: allow everything, deny the interactive
@@ -851,6 +947,12 @@ export function defaultHeadlessPermission() {
         permission[tool] = 'deny';
     return permission;
 }
+/** Select the OpenCode permission map for the session's human-input surface. */
+export function permissionForOrigin(origin) {
+    if (origin === 'hosted-web')
+        return { ...defaultHeadlessPermission(), question: 'allow' };
+    return defaultHeadlessPermission();
+}
 /**
  * Build the `OPENCODE_CONFIG_CONTENT` payload OpenCode reads at boot (mirrors
  * OpenInspect's `start_opencode`). Kept pure so the launch command and the

package/dist/hosted-harness.d.ts

@@ -75,8 +75,11 @@ export declare const HARNESS_EVENT_KINDS: {
     readonly egress_allowed: "egress_allowed";
     readonly work_persisted: "work_persisted";
     readonly work_none: "work_none";
+    readonly work_not_inspected: "work_not_inspected";
     readonly work_persist_failed: "work_persist_failed";
     readonly question_auto_answered: "question_auto_answered";
+    readonly question_pending: "question_pending";
+    readonly question_invalid: "question_invalid";
     readonly error: "error";
     readonly execution_complete: "execution_complete";
 };

package/dist/hosted-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-harness.d.ts","sourceRoot":"","sources":["../src/hosted-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;8DAC8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACvC,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;CA4BtB,CAAA;AAEV,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,mBAAmB,CAAA;AAE/D;iDACiD;AACjD,eAAO,MAAM,sBAAsB;;;CAGzB,CAAA;AAEV,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAErE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAA;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,KAAK,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrE;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IAClF,2EAA2E;IAC3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,gEAAgE;IAChE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B"}
+{"version":3,"file":"hosted-harness.d.ts","sourceRoot":"","sources":["../src/hosted-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;8DAC8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACvC,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;CA+BtB,CAAA;AAEV,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,mBAAmB,CAAA;AAE/D;iDACiD;AACjD,eAAO,MAAM,sBAAsB;;;CAGzB,CAAA;AAEV,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAErE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAA;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,KAAK,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrE;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IAClF,2EAA2E;IAC3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,gEAAgE;IAChE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B"}

package/dist/hosted-harness.js

@@ -48,13 +48,16 @@ export const HARNESS_EVENT_KINDS = {
     egress_allowed: 'egress_allowed',
     // Durability + headless (ALI-1036 / ALI-1037). NOT produced by a harness — the
     // in-sandbox loop emits these through the SAME single-writer run-event sink:
-    // the end-of-run auto-harvest result (work_persisted/work_none/work_persist_failed)
+    // the end-of-run auto-harvest result (persisted/none/not-inspected/failed)
     // and the headless question auto-handling record (question_auto_answered). They
     // are ordinary structural events (never terminal), appended like any other.
     work_persisted: 'work_persisted',
     work_none: 'work_none',
+    work_not_inspected: 'work_not_inspected',
     work_persist_failed: 'work_persist_failed',
     question_auto_answered: 'question_auto_answered',
+    question_pending: 'question_pending',
+    question_invalid: 'question_invalid',
     error: 'error',
     execution_complete: 'execution_complete',
 };

package/dist/hosted-harvest.d.ts

@@ -11,16 +11,18 @@
  *   2. If dirty: `git add -A` then `git commit` attributed to the agent identity
  *      (AGENT_GIT_IDENTITY) with message `checkpoint: run <runId> auto-harvest`.
  *   3. If there is anything unpushed (a fresh checkpoint OR pre-existing local
- *      commits the agent made but did not push), `git push` to the session branch
- *      (the repo-local credential helper configured by bootstrap authorizes it).
+ *      commits the agent made but did not push), push the exact HEAD SHA to the
+ *      session branch at bootstrap's independently validated repository locator.
  *   4. Return a typed outcome the loop records as a run event: `work_persisted`
- *      (sha + files), `work_none` (clean, nothing to push), or `work_persist_failed`
- *      (error). Harvest NEVER throws — a harvest failure must not change the run's
- *      terminal status; it is recorded and the run proceeds to terminal.
+ *      (sha + files), `work_none` (clean, nothing to push), `work_not_inspected`
+ *      (safety-gated), or `work_persist_failed` (error). Harvest NEVER throws —
+ *      a harvest failure must not change the run's terminal status; it is recorded
+ *      and the run proceeds to terminal.
  *
  * The loop runs IN the sandbox, so git is driven with `child_process` (matching
  * `defaultRunSetupHook` / `installOpenCodePinned` in `hosted-loop.ts`). `exec` is
- * injectable so the whole thing is unit-testable with no real git.
+ * injectable so the whole thing is unit-testable with no real git; the HTTPS
+ * smart-Git boundary tests independently prove the production transport.
  */
 export interface HarvestExecResult {
     exitCode: number;
@@ -33,19 +35,28 @@ export interface HarvestOptions {
     /** Directory of the cloned session-branch workspace (the loop's cwd for git). */
     workspaceDir: string;
     runId: string;
+    /** Validated session branch that receives the exact checkpoint commit. */
+    sessionBranch: string;
+    /** Credential-free, bootstrap-validated repository locator. */
+    repositoryRemote: string;
+    /** Bootstrap-owned credential helper; never read back from mutable repo config. */
+    credentialHelper?: string;
     /** Commit attribution (AGENT_GIT_IDENTITY from hosted-runtime-assets). */
     author: {
         name: string;
         email: string;
     };
+    /** Trusted test seams; production resolves from the measured image/host lists. */
+    caBundleCandidates?: readonly string[];
+    caPathCandidates?: readonly string[];
     /** Injectable git runner (default: real `git` via child_process). */
     exec?: HarvestExec;
     /**
      * Safety gate (review finding #1): the default exec runs REAL `git add/commit/
      * push` in `workspaceDir`. Real harvest must be affirmatively enabled — the loop
      * only enables it inside a genuine hosted sandbox (prebaked marker present). When
-     * false AND no `exec` is injected, harvest is a no-op (`work_none`) so an errant
-     * workspaceDir (a test, a dev run) can never commit/push a host repo. An injected
+     * false AND no `exec` is injected, harvest is a no-op (`work_not_inspected`) so
+     * an errant workspaceDir (a test, a dev run) can never commit/push a host repo. An injected
      * `exec` always wins (tests that DO drive harvest).
      */
     enabled?: boolean;
@@ -53,13 +64,23 @@ export interface HarvestOptions {
 export type HarvestOutcome = {
     kind: 'work_persisted';
     sha: string;
-    files: string[];
+    files: string[] | null;
 } | {
     kind: 'work_none';
+} | {
+    kind: 'work_not_inspected';
 } | {
     kind: 'work_persist_failed';
     error: string;
 };
+export declare const HOSTED_HARVEST_CA_BUNDLE_CANDIDATES: readonly ["/etc/pki/tls/certs/ca-bundle.crt", "/etc/ssl/certs/ca-certificates.crt", "/etc/ssl/cert.pem"];
+export declare const HOSTED_HARVEST_CA_PATH_CANDIDATES: readonly ["/etc/pki/ca-trust/extracted/pem/directory-hash", "/etc/ssl/certs"];
+export declare const HOSTED_HARVEST_TRANSPORT_POLICY: {
+    readonly environmentDenylist: readonly ["HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy", "GIT_SSL_NO_VERIFY", "GIT_PROXY_COMMAND", "GIT_SSL_CAINFO", "GIT_SSL_CAPATH", "CURL_CA_BUNDLE", "SSL_CERT_FILE", "SSL_CERT_DIR", "GIT_SSL_CERT", "GIT_SSL_KEY", "GIT_ASKPASS", "GIT_ASKPASS_REQUIRE", "SSH_ASKPASS", "SSH_ASKPASS_REQUIRE", "GIT_TERMINAL_PROMPT"];
+    readonly exactUrlHttpConfig: readonly [readonly ["proxy", ""], readonly ["sslVerify", "true"], readonly ["curloptResolve", ""], readonly ["followRedirects", "false"]];
+    readonly rejectedLocalHttpKeys: readonly ["sslcert", "sslkey", "sslcertpasswordprotected", "sslbackend", "pinnedpubkey", "sslversion", "sslcipherlist"];
+};
+export declare function resolveHostedHarvestCaBundle(candidates?: readonly string[]): string | null;
 /**
  * Persist any uncommitted or unpushed work in the workspace. Deterministic and
  * total: every path returns a `HarvestOutcome`, never throws.

package/dist/hosted-harvest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-harvest.d.ts","sourceRoot":"","sources":["../src/hosted-harvest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,iBAAiB,CAAA;AAExE,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC,qEAAqE;IACrE,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAoClD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAiErE"}
+{"version":3,"file":"hosted-harvest.d.ts","sourceRoot":"","sources":["../src/hosted-harvest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAaH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,iBAAiB,CAAA;AAExE,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAA;IACxB,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,0EAA0E;IAC1E,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,qEAAqE;IACrE,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD,eAAO,MAAM,mCAAmC,0GAItC,CAAA;AAEV,eAAO,MAAM,iCAAiC,+EAGpC,CAAA;AAEV,eAAO,MAAM,+BAA+B;;;;CAgBlC,CAAA;AAUV,wBAAgB,4BAA4B,CAC1C,UAAU,GAAE,SAAS,MAAM,EAAwC,GAClE,MAAM,GAAG,IAAI,CAEf;AA6GD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAyJrE"}