orizu 0.5.27 → 0.5.28

package/dist/index.js

@@ -16,7 +16,6 @@ import { parseDatasetFile } from './file-parser.js';
 import { streamJsonlRowChunks } from './jsonl-stream.js';
 import { parseDatasetReference } from './dataset-download.js';
 import { editDatasetRows as runEditDatasetRows } from './dataset-edit-rows.js';
-import { ensureDatasetUploadSnapshot } from './dataset-upload-snapshot.js';
 import { extractErrorMessage } from './error-response.js';
 import { describeLogoutHttpFailure, describeLogoutTransportFailure, } from './logout-diagnostic.js';
 import { parseGlobalFlags } from './global-flags.js';
@@ -3931,88 +3930,22 @@ async function changeTeamMemberRole() {
     }
     printLine(`Updated ${sanitizeTerminalText(member.email)} role to ${sanitizeTerminalText(role)}`);
 }
-async function createDatasetFromRows(project, name, sourceType, rows, readmeMarkdown = null) {
-    const response = await authedFetch('/api/cli/datasets/upload', {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({
-            projectSlug: project,
-            name,
-            rows,
-            sourceType,
-            ...(readmeMarkdown !== null ? { readmeMarkdown } : {}),
-        }),
-    });
-    if (!response.ok) {
-        const body = await parseJsonResponse(response, 'Dataset upload');
-        throw new Error(`Upload failed: ${body.error}`);
-    }
-    return parseJsonResponse(response, 'Dataset upload');
-}
 async function uploadJsonlDatasetInChunks(file, project, datasetName, readmeMarkdown = null) {
-    let dataset = null;
-    let totalUploaded = 0;
-    let chunkIndex = 0;
-    const chunks = streamJsonlRowChunks(file)[Symbol.asyncIterator]();
-    while (true) {
-        let nextChunk;
-        try {
-            nextChunk = await chunks.next();
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (!dataset) {
-                throw new Error(message);
-            }
-            throw new Error(`Upload stopped while reading the next JSONL chunk: ${message}\n` +
-                `Dataset ${sanitizeTerminalText(dataset.name)} (${sanitizeTerminalText(dataset.id)}) was created and ${totalUploaded} rows were uploaded. ` +
-                `Fix the file, remove the first ${totalUploaded} rows, and run ` +
-                `orizu datasets append --dataset ${dataset.id} --file <remaining-file>.`);
-        }
-        if (nextChunk.done) {
-            break;
-        }
-        const chunk = nextChunk.value;
-        chunkIndex += 1;
-        printLine(`Uploading chunk ${chunkIndex} (${chunk.length} rows)...`);
-        try {
-            if (!dataset) {
-                const data = await createDatasetFromRows(project, datasetName, 'jsonl', chunk, readmeMarkdown);
-                dataset = data.dataset;
-                totalUploaded = data.dataset.rowCount;
-                continue;
-            }
-            const data = await appendChunk(dataset.id, chunk);
-            totalUploaded += data.appendedCount;
-            dataset = {
-                ...dataset,
-                rowCount: data.dataset.rowCount,
-            };
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (!dataset) {
-                throw new Error(message);
-            }
-            throw new Error(`Chunk ${chunkIndex} failed: ${message}\n` +
-                `Dataset ${dataset.name} (${dataset.id}) was created and ${totalUploaded} rows were uploaded. ` +
-                `To retry, remove the first ${totalUploaded} rows from your file and run ` +
-                `orizu datasets append --dataset ${dataset.id} --file <remaining-file>.`);
-        }
-    }
-    if (!dataset) {
-        throw new Error('Dataset file contains no rows');
-    }
-    const version = await ensureDatasetUploadSnapshot(dataset, hasJsonFlag(), requestDatasetVersionSnapshot);
+    const { transferDatasetUpload } = await import('./dataset-transfer-upload.js');
+    const { data, version } = await transferDatasetUpload({
+        project, name: datasetName, source: { kind: 'jsonl', file }, readmeMarkdown,
+        json: hasJsonFlag(),
+        // JSON mode reserves stderr for structured recovery failures as well.
+        onChunk: (index, count) => { if (!hasJsonFlag())
+            printLine(`Uploading chunk ${index} (${count} rows)...`); },
+    });
+    const dataset = data.dataset;
     if (hasJsonFlag())
         return printJson({ dataset_id: dataset.id, dataset, dataset_version_id: version.datasetVersion.id });
     printLine(`Uploaded dataset ${sanitizeTerminalText(dataset.name)} (${sanitizeTerminalText(dataset.id)}) with ${dataset.rowCount} rows.`);
     printLine(`Created dataset version ${sanitizeTerminalText(version.datasetVersion.id)}.`);
-    if (dataset.url) {
+    if (dataset.url)
         printLine(`View dataset: ${formatTerminalLink(dataset.url)}`);
-    }
 }
 async function uploadDataset() {
     const projectArg = getArg('--project');
@@ -4031,8 +3964,11 @@ async function uploadDataset() {
         return;
     }
     const { rows, sourceType } = parseDatasetFile(file);
-    const data = await createDatasetFromRows(project, datasetName, sourceType, rows, readmeMarkdown);
-    const version = await ensureDatasetUploadSnapshot(data.dataset, hasJsonFlag(), requestDatasetVersionSnapshot);
+    const { transferDatasetUpload } = await import('./dataset-transfer-upload.js');
+    const { data, version } = await transferDatasetUpload({
+        project, name: datasetName, source: { kind: 'rows', rows, sourceType }, readmeMarkdown,
+        json: hasJsonFlag(), onChunk: () => { },
+    });
     if (hasJsonFlag())
         return printJson({ dataset_id: data.dataset.id, dataset: data.dataset, dataset_version_id: version.datasetVersion.id });
     printLine(`Uploaded dataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}) with ${data.dataset.rowCount} rows.`);
@@ -4054,8 +3990,11 @@ async function pushDataset() {
     const project = await resolveProjectSlug(projectArg);
     const datasetName = name || basename(file);
     const { rows, sourceType } = parseDatasetFile(file);
-    const data = await createDatasetFromRows(project, datasetName, sourceType, rows, readmeMarkdown);
-    const version = await ensureDatasetUploadSnapshot(data.dataset, hasJsonFlag(), requestDatasetVersionSnapshot);
+    const { transferDatasetUpload } = await import('./dataset-transfer-upload.js');
+    const { data, version } = await transferDatasetUpload({
+        project, name: datasetName, source: { kind: 'rows', rows, sourceType }, readmeMarkdown,
+        json: hasJsonFlag(), onChunk: () => { },
+    });
     if (hasJsonFlag()) {
         const payload = {
             dataset_id: data.dataset.id,
@@ -4134,15 +4073,11 @@ async function downloadDataset() {
         const selected = await selectDatasetInteractively(projectArg);
         datasetId = selected.datasetId;
     }
-    const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/download?format=${encodeURIComponent(format)}`);
-    if (!response.ok) {
-        throw new Error(`Download failed: ${await response.text()}`);
-    }
     const filename = outPathArg
         ? expandHomePath(outPathArg)
         : `${datasetId}.${format}`;
-    const bytes = new Uint8Array(await response.arrayBuffer());
-    writeFileSync(filename, bytes);
+    const { transferDatasetDownload } = await import('./dataset-transfer-download.js');
+    await transferDatasetDownload(datasetId, format, filename);
     if (hasJsonFlag()) {
         printJson({ datasetId, format, savedTo: filename });
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.27",
+  "version": "0.5.28",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -35,6 +35,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.201",
     "@vercel/sandbox": "1.10.2",
+    "effect": "3.22.1",
     "esbuild": "^0.25.8"
   },
   "devDependencies": {

package/src/dataset-transfer-download.ts

@@ -0,0 +1,61 @@
+import { Effect, Either, Schedule } from 'effect'
+import { writeFileSync } from 'node:fs'
+import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js'
+import { authedFetch } from './http.js'
+
+class DownloadHttpError extends Error {
+  readonly _tag = 'DownloadHttpError'
+  constructor(readonly status: number, detail: string) {
+    super(`Download failed (HTTP ${status}): ${detail}`)
+  }
+}
+
+class DownloadTransportError extends Error {
+  readonly _tag = 'DownloadTransportError'
+  constructor(cause: unknown) {
+    super('Dataset download transport failed', { cause })
+  }
+}
+
+export async function transferDatasetDownload(datasetId: string, format: string, filename: string): Promise<void> {
+  const timeoutMs = datasetTransferTimeoutMs()
+  const download = Effect.tryPromise({
+    try: async signal => {
+      const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/download?format=${encodeURIComponent(format)}`, { signal })
+      if (!response.ok) throw new DownloadHttpError(response.status, await response.text())
+      return new Uint8Array(await response.arrayBuffer())
+    },
+    catch: cause => {
+      if (cause instanceof TypeError) return new DownloadTransportError(cause)
+      return cause instanceof Error ? cause : new Error('Dataset download request failed', { cause })
+    },
+  }).pipe(Effect.timeoutFail({
+    duration: timeoutMs,
+    onTimeout: () => new Error('DATASET_TRANSFER_TIMEOUT: Dataset download exceeded its deadline'),
+  }), Effect.retry({
+    times: 2,
+    schedule: Schedule.spaced(100),
+    while: error => error instanceof DownloadTransportError || (error instanceof DownloadHttpError && [429, 502, 503, 504].includes(error.status)),
+  }))
+  const fileError = (cause: unknown) => new Error(`DATASET_DOWNLOAD_FILE: Could not save dataset to ${filename}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause })
+  const write = (bytes: Uint8Array) => Effect.try({
+    // Wait for the complete response, then retain the CLI's existing in-place
+    // write semantics, including inode metadata, hardlinks and symlink targets.
+    try: () => writeFileSync(filename, bytes, { mode: 0o600 }),
+    catch: fileError,
+  })
+  const controller = new AbortController()
+  const handleInterrupt = () => controller.abort()
+  process.once('SIGINT', handleInterrupt)
+  process.once('SIGTERM', handleInterrupt)
+  try {
+    const result = await Effect.runPromise(Effect.either(Effect.flatMap(download, write)), { signal: controller.signal })
+    if (Either.isLeft(result)) throw result.left
+  } catch (error) {
+    if (controller.signal.aborted) throw new Error('DATASET_TRANSFER_INTERRUPTED: Dataset download cancelled')
+    throw error
+  } finally {
+    process.removeListener('SIGINT', handleInterrupt)
+    process.removeListener('SIGTERM', handleInterrupt)
+  }
+}

package/src/dataset-transfer-policy.ts

@@ -0,0 +1,8 @@
+export function datasetTransferTimeoutMs(): number {
+  const configured = process.env.ORIZU_DATASET_TRANSFER_TIMEOUT_MS
+  const timeoutMs = configured === undefined ? 120_000 : Number(configured)
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 300_000) {
+    throw new Error('DATASET_TRANSFER_CONFIG: ORIZU_DATASET_TRANSFER_TIMEOUT_MS must be an integer from 1 to 300000')
+  }
+  return timeoutMs
+}

package/src/dataset-transfer-upload.ts

@@ -0,0 +1,145 @@
+import { Context, Effect, Either, Layer } from 'effect'
+
+import { ensureDatasetUploadSnapshot } from './dataset-upload-snapshot.js'
+import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js'
+import { extractErrorMessage } from './error-response.js'
+import { authedFetch } from './http.js'
+import { parseJsonResponse, sanitizeTerminalText } from './json-response.js'
+import { streamJsonlRowChunks } from './jsonl-stream.js'
+
+export interface DatasetUploadResponse {
+  dataset: { id: string; name: string; rowCount: number; sourceType: string; url?: string }
+  readmeVersion?: { id: string; version_num: number; created_at: string } | null
+}
+
+interface DatasetSnapshot { datasetVersion: { id: string } }
+interface DatasetAppendResponse { dataset: { id: string; name: string; rowCount: number }; appendedCount: number }
+type UploadRows = Array<Record<string, unknown>>
+type UploadSource = { kind: 'jsonl'; file: string } | { kind: 'rows'; rows: UploadRows; sourceType: 'csv' | 'json' | 'jsonl' }
+
+export interface DatasetUploadOptions {
+  project: string
+  name: string
+  source: UploadSource
+  readmeMarkdown: string | null
+  json: boolean
+  onChunk: (index: number, rowCount: number) => void
+}
+
+class DatasetWriteFailure extends Error {
+  readonly _tag = 'DatasetWriteFailure'
+  constructor(message: string, readonly outcome: 'rejected' | 'unknown', options?: ErrorOptions) {
+    super(message, options)
+  }
+}
+
+class DatasetInputFailure extends Error {
+  readonly _tag = 'DatasetInputFailure'
+  constructor(cause: unknown) { super(cause instanceof Error ? cause.message : String(cause), { cause }) }
+}
+
+interface DatasetUploadApi {
+  create: (rows: UploadRows, sourceType: string) => Effect.Effect<DatasetUploadResponse, DatasetWriteFailure>
+  append: (id: string, rows: UploadRows) => Effect.Effect<DatasetAppendResponse, DatasetWriteFailure>
+  snapshot: (id: string) => Effect.Effect<DatasetSnapshot, DatasetWriteFailure>
+}
+const DatasetUploadApi = Context.GenericTag<DatasetUploadApi>('orizu/DatasetUploadApi')
+
+// Only the existing authentication client's rejected-token refresh may replay a
+// request. No transient/transport retries belong around these non-idempotent writes.
+function post<T>(path: string, body: unknown, context: string, prefix: string, timeoutMs: number): Effect.Effect<T, DatasetWriteFailure> {
+  return Effect.suspend(() => {
+    let requestStarted = false
+    return Effect.tryPromise({
+      try: async signal => {
+        const response = await authedFetch(path, {
+          method: 'POST', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(body), signal,
+        }, () => { requestStarted = true })
+        if (!response.ok) {
+          throw new DatasetWriteFailure(`${prefix}: ${await extractErrorMessage(response)}`, response.status >= 500 ? 'unknown' : 'rejected')
+        }
+        return await parseJsonResponse<T>(response, context)
+      },
+      catch: cause => cause instanceof DatasetWriteFailure ? cause : new DatasetWriteFailure(
+        cause instanceof Error ? cause.message : String(cause), requestStarted ? 'unknown' : 'rejected', { cause },
+      ),
+    }).pipe(Effect.timeoutFail({
+      duration: timeoutMs,
+      onTimeout: () => new DatasetWriteFailure(`DATASET_TRANSFER_TIMEOUT: ${context} exceeded its deadline`, requestStarted ? 'unknown' : 'rejected'),
+    }))
+  })
+}
+
+function liveUploadApi(options: DatasetUploadOptions) {
+  const timeoutMs = datasetTransferTimeoutMs()
+  return Layer.succeed(DatasetUploadApi, {
+    create: (rows, sourceType) => post<DatasetUploadResponse>('/api/cli/datasets/upload', {
+      projectSlug: options.project, name: options.name, rows, sourceType,
+      ...(options.readmeMarkdown !== null ? { readmeMarkdown: options.readmeMarkdown } : {}),
+    }, 'Dataset upload', 'Upload failed', timeoutMs),
+    append: (id, rows) => post<DatasetAppendResponse>(`/api/cli/datasets/${encodeURIComponent(id)}/rows`, { rows }, 'Dataset append', 'Append failed', timeoutMs),
+    snapshot: id => post<DatasetSnapshot>(`/api/cli/datasets/${encodeURIComponent(id)}/versions`, {}, 'Dataset version create', 'Failed to create dataset version', timeoutMs),
+  })
+}
+
+async function expectedPromise<A, E>(program: Effect.Effect<A, E>): Promise<A> {
+  const result = await Effect.runPromise(Effect.either(program))
+  if (Either.isLeft(result)) throw result.left
+  return result.right
+}
+
+function uploadProgram(options: DatasetUploadOptions) {
+  return Effect.gen(function* () {
+    const api = yield* DatasetUploadApi
+    const chunks = yield* Effect.acquireRelease(
+      Effect.sync(() => options.source.kind === 'jsonl'
+        ? streamJsonlRowChunks(options.source.file)
+        : (async function* () { if (options.source.kind === 'rows') yield options.source.rows })()),
+      iterator => Effect.promise(async () => { await iterator.return(undefined) }),
+    )
+    let data: DatasetUploadResponse | undefined
+    let confirmedRows = 0
+    let chunkIndex = 0
+    while (true) {
+      const next = yield* Effect.tryPromise({ try: () => chunks.next(), catch: cause => new DatasetInputFailure(cause) }).pipe(
+        Effect.mapError(error => new Error(data
+          ? `Upload stopped while reading the next JSONL chunk: ${error.message}\nDataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}) was created and ${confirmedRows} rows were uploaded. Fix the file, remove the first ${confirmedRows} rows, and run orizu datasets append --dataset ${data.dataset.id} --file <remaining-file>.`
+          : error.message)),
+      )
+      if (next.done) break
+      chunkIndex++
+      if (options.source.kind === 'jsonl') yield* Effect.sync(() => options.onChunk(chunkIndex, next.value.length))
+      const write = data
+        ? api.append(data.dataset.id, next.value).pipe(Effect.map(result => ({
+          data: { ...data!, dataset: { ...data!.dataset, rowCount: result.dataset.rowCount } },
+          added: result.appendedCount,
+        })))
+        : api.create(next.value, options.source.kind === 'jsonl' ? 'jsonl' : options.source.sourceType).pipe(
+          Effect.map(result => ({ data: result, added: result.dataset.rowCount })),
+        )
+      const result = yield* write.pipe(Effect.mapError(error => {
+        if (error.outcome === 'unknown') {
+          return new Error(`DATASET_UPLOAD_UNCERTAIN: Chunk ${chunkIndex} may have committed, but its outcome could not be confirmed: ${error.message}\n` +
+            (data ? `Dataset ${sanitizeTerminalText(data.dataset.id)} has ${confirmedRows} confirmed uploaded rows. ` : 'Dataset creation could not be confirmed. ') +
+            'Inspect the dataset and reconcile row IDs before retrying; do not replay this chunk blindly.')
+        }
+        return new Error(data
+          ? `Chunk ${chunkIndex} failed: ${error.message}\nDataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}) was created and ${confirmedRows} rows were uploaded. To retry, remove the first ${confirmedRows} rows from your file and run orizu datasets append --dataset ${data.dataset.id} --file <remaining-file>.`
+          : error.message)
+      }))
+      data = result.data
+      confirmedRows += result.added
+    }
+    if (!data) return yield* Effect.fail(new Error('Dataset file contains no rows'))
+    const version = yield* Effect.tryPromise({
+      try: () => ensureDatasetUploadSnapshot(data!.dataset, options.json, id => expectedPromise(api.snapshot(id))),
+      catch: cause => cause instanceof Error ? cause : new Error(String(cause)),
+    })
+    return { data, version }
+  })
+}
+
+export function transferDatasetUpload(options: DatasetUploadOptions): Promise<{ data: DatasetUploadResponse; version: DatasetSnapshot }> {
+  return expectedPromise(uploadProgram(options).pipe(Effect.scoped, Effect.provide(liveUploadApi(options))))
+}

package/src/hosted-harness-opencode.ts

@@ -1070,15 +1070,12 @@ export interface OpenCodeConfigOptions {
 }
 
 /**
- * Tools DENIED in a hosted headless run (ALI-1037). OpenCode exposes a `question`
- * permission key (docs/permissions) that gates the interactive "ask the user a
- * question" tool. In an unattended sandbox there is no human to answer it, and
- * OpenCode's only external reply endpoint — `POST /session/{id}/permissions/{permID}`
- * — takes a BOOLEAN allow/deny, so it cannot select one of the tool's multiple
- * options anyway. Denying the tool makes the model's ask fail fast (surfaced back
- * to it as a tool error) so it proceeds autonomously per the standing preamble
- * (HOSTED_TASK_PREAMBLE), instead of blocking the run forever. This is the
- * documented fallback path in ALI-1037 (answer-externally is not cleanly possible).
+ * Tools denied for CLI-origin headless runs (ALI-1037). OpenCode 1.14.41 removes
+ * a tool from the model toolset when its permission rule is `deny` on `*`; it does
+ * not expose the tool and report a denial result. Hosted-web therefore overrides
+ * `question` to `allow`, intercepts its measured running part, and quiesces the
+ * turn while waiting for the human. CLI-origin runs retain this deny list because
+ * no human reply flow exists there.
  */
 export const HEADLESS_DENIED_TOOLS = ['question'] as const
 
@@ -1090,6 +1087,12 @@ export function defaultHeadlessPermission(): Record<string, unknown> {
   return permission
 }
 
+/** Select the OpenCode permission map for the session's human-input surface. */
+export function permissionForOrigin(origin?: 'hosted-web' | 'cli'): Record<string, unknown> {
+  if (origin === 'hosted-web') return { ...defaultHeadlessPermission(), question: 'allow' }
+  return defaultHeadlessPermission()
+}
+
 /**
  * Build the `OPENCODE_CONFIG_CONTENT` payload OpenCode reads at boot (mirrors
  * OpenInspect's `start_opencode`). Kept pure so the launch command and the

package/src/hosted-loop.ts

@@ -55,6 +55,7 @@ import {
   OPENCODE_PINNED_VERSION,
   awaitOpenCodeModelResolvable,
   createOpenCodeHarness,
+  permissionForOrigin,
   spawnOpenCode,
   type ModelValidationOutcome,
   type SpawnOpenCodeOptions,
@@ -612,6 +613,7 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
       // connection-refused "fetch failed" (ALI-1034).
       spawned = await spawnImpl({
         model: context.model,
+        permission: permissionForOrigin(context.sessionOrigin),
         cwd: context.workspaceDir,
         port: context.opencodePort,
         env: buildOpenCodeSpawnEnv(context),
@@ -699,8 +701,9 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
       content: composeHostedTaskPrompt(taskPrompt, opts.taskPreamble ?? resolveHostedTaskPreamble(context.sessionOrigin)),
       author: context.author,
     }
-    // Drive the prompt through (a) question auto-handling annotation and (b) the
-    // idle watchdog (ALI-1037): no harness event for `idleTimeoutMs` aborts the
+    // Drive the prompt through question-deny annotation unless hosted-web
+    // OpenCode interception owns the outcome, then through the idle watchdog
+    // (ALI-1037): no harness event for `idleTimeoutMs` aborts the
     // prompt and throws `AgentStalledError` → the catch below harvests, then
     // finishes the run `failed`. The prompt runs under a CHILD AbortController
     // linked to the loop signal so the watchdog can abort the in-flight prompt
@@ -742,9 +745,10 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
 
     const terminalSummary: Record<string, unknown> = { agentSessionId }
     let hasQuestionOutcome = false
-    const annotated = annotateHeadlessQuestions(harness.runPrompt(prompt, promptController.signal))
-    const questionAware = harnessKind === 'opencode' && context.sessionOrigin === 'hosted-web'
-      ? interceptHostedQuestions(annotated, {
+    const promptEvents = harness.runPrompt(prompt, promptController.signal)
+    const hasHostedQuestionInterception = harnessKind === 'opencode' && context.sessionOrigin === 'hosted-web'
+    const intercepted = hasHostedQuestionInterception
+      ? interceptHostedQuestions(promptEvents, {
           onDetected: question => {
             hasQuestionOutcome = true
             terminalSummary.outcome = 'question_pending'
@@ -760,7 +764,10 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
           onPersisted: beginQuiescence,
           onInvalidPersisted: beginQuiescence,
         })
-      : annotated
+      : promptEvents
+    const questionAware = hasHostedQuestionInterception
+      ? intercepted
+      : annotateHeadlessQuestions(intercepted)
     const interruptAware = (async function* (): AsyncGenerator<HarnessEvent> {
       for await (const event of questionAware) {
         if (isHarnessTerminalKind(event.kind)) {
@@ -811,8 +818,8 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
               promptController.abort()
               await harness.stop()
             },
-            // The `question` tool is DENIED headless, so a model stuck retrying it
-            // emits a stream of synthetic `question_auto_answered` events. Those are
+            // Without hosted-web OpenCode interception, a model stuck retrying a
+            // denied question emits synthetic `question_auto_answered` events. Those are
             // NOT progress — excluding them lets a deny/retry loop trip agent_stalled
             // instead of resetting the idle timer forever (ALI-1069).
             isProgress: event => event.kind !== 'question_auto_answered',

package/src/http.ts

@@ -422,7 +422,13 @@ export function captureAuthenticatedRequestContext(
   }
 }
 
-export async function authedFetch(path: string, init: RequestInit = {}) {
+// The optional observer runs immediately before a resource fetch, after auth
+// preflight. Authentication refresh requests do not mark the resource as sent.
+export async function authedFetch(path: string, init: RequestInit = {}, onRequestStart?: () => void) {
+  const fetchResource = (url: string, requestInit: RequestInit) => {
+    onRequestStart?.()
+    return fetch(url, requestInit)
+  }
   const baseUrl = resolveBaseUrl()
   assertSecureTokenTransport(baseUrl)
 
@@ -433,7 +439,7 @@ export async function authedFetch(path: string, init: RequestInit = {}) {
   // the file and the next request naturally picks up the new bearer.
   const envBearer = resolveEnvBearerToken()
   if (envBearer) {
-    return await fetch(`${baseUrl}${path}`, {
+    return await fetchResource(`${baseUrl}${path}`, {
       ...init,
       headers: {
         ...(init.headers || {}),
@@ -451,7 +457,7 @@ export async function authedFetch(path: string, init: RequestInit = {}) {
   const resolved = await refreshExpiredStoredCredentials(baseUrl, credentials, init.signal)
   let activeCredentials = resolved.credentials
 
-  let response = await fetch(`${baseUrl}${path}`, {
+  let response = await fetchResource(`${baseUrl}${path}`, {
     ...init,
     headers: {
       ...(init.headers || {}),
@@ -476,7 +482,7 @@ export async function authedFetch(path: string, init: RequestInit = {}) {
       )
     }
     activeCredentials = requireCurrentCredentials(baseUrl, refreshResult.credentials)
-    response = await fetch(`${baseUrl}${path}`, {
+    response = await fetchResource(`${baseUrl}${path}`, {
       ...init,
       headers: {
         ...(init.headers || {}),