orizu 0.5.3 → 0.5.5

package/dist/artifact-pull.js

@@ -1,10 +1,11 @@
 /**
- * Runner/optimizer artifact pull (symmetric with `runners push` /
- * `optimizers push`): resolve the artifact by id or name, download the
- * content-addressed zip from storage, and extract it into --out. Version
- * metadata is written to .orizu/pull.json — .orizu/ is excluded from artifact
- * zips (see artifact-archive.ts), so a pulled directory re-pushes with an
- * identical content hash.
+ * Runner/optimizer artifact commands: list (discover names, version ids, and
+ * labels) and pull (symmetric with `runners push` / `optimizers push` —
+ * resolve by id or name, download the content-addressed zip from storage,
+ * and extract it into --out). Pull writes version metadata to
+ * .orizu/pull.json — .orizu/ is excluded from artifact zips (see
+ * artifact-archive.ts), so a pulled directory re-pushes with an identical
+ * content hash.
  *
  * Lives outside index.ts per the CLI index line ratchet (ALI-976): this module
  * owns its own argument parsing and printing via injected io.
@@ -49,7 +50,50 @@ async function parseJsonPayload(response, context) {
             `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
     }
 }
-export async function pullArtifactCommand(args, io) {
+export async function runnerOptimizerCommand(args, io) {
+    if (args[1] === 'list') {
+        await listArtifactsCommand(args, io);
+        return;
+    }
+    await pullArtifactCommand(args, io);
+}
+async function listArtifactsCommand(args, io) {
+    const kind = args[0] === 'runners' ? 'runner' : 'optimizer';
+    const plural = kind === 'runner' ? 'runners' : 'optimizers';
+    const fetcher = io.fetcher || authedFetch;
+    const project = argValue(args, '--project') || await io.resolveProjectSlug(null);
+    const response = await fetcher(`/api/cli/${plural}?project=${encodeURIComponent(project)}`);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch ${plural}: ${await response.text()}`);
+    }
+    const data = await parseJsonPayload(response, `${plural} list`);
+    if (io.json) {
+        io.print(JSON.stringify(data));
+        return;
+    }
+    const items = data[plural] || [];
+    if (items.length === 0) {
+        io.print(`No ${plural} found.`);
+        return;
+    }
+    const rows = items.map(item => ({
+        id: sanitizeTerminalText(item.id),
+        name: sanitizeTerminalText(item.name),
+        versions: String(item.versionCount ?? 0),
+        latest: sanitizeTerminalText(item.latestVersionId || '-'),
+        labels: sanitizeTerminalText((item.labels || []).map(entry => entry.label).join(', ') || '-'),
+    }));
+    const idWidth = Math.max('ID'.length, ...rows.map(row => row.id.length));
+    const nameWidth = Math.max('NAME'.length, ...rows.map(row => row.name.length));
+    const versionsWidth = Math.max('VERSIONS'.length, ...rows.map(row => row.versions.length));
+    const latestWidth = Math.max('LATEST VERSION'.length, ...rows.map(row => row.latest.length));
+    io.print(`${'ID'.padEnd(idWidth)}  ${'NAME'.padEnd(nameWidth)}  ${'VERSIONS'.padEnd(versionsWidth)}  ${'LATEST VERSION'.padEnd(latestWidth)}  LABELS`);
+    io.print(`${'-'.repeat(idWidth)}  ${'-'.repeat(nameWidth)}  ${'-'.repeat(versionsWidth)}  ${'-'.repeat(latestWidth)}  ${'-'.repeat('LABELS'.length)}`);
+    rows.forEach(row => {
+        io.print(`${row.id.padEnd(idWidth)}  ${row.name.padEnd(nameWidth)}  ${row.versions.padEnd(versionsWidth)}  ${row.latest.padEnd(latestWidth)}  ${row.labels}`);
+    });
+}
+async function pullArtifactCommand(args, io) {
     const kind = args[0] === 'runners' ? 'runner' : 'optimizer';
     const fetcher = io.fetcher || authedFetch;
     const positionalRef = args[2];

package/dist/help.js

@@ -344,6 +344,12 @@ export const COMMAND_DOCS = [
         summary: 'Push a local runner artifact directory.',
         group: 'Scorers and runners',
     },
+    {
+        path: ['runners', 'list'],
+        usage: 'orizu runners list [--project <team/project>] [--json]',
+        summary: 'List runner artifacts with version counts, latest version ids, and labels.',
+        group: 'Scorers and runners',
+    },
     {
         path: ['runners', 'pull'],
         usage: 'orizu runners pull <runner-id-or-name> --project <team/project> --out <dir> [--label <label> | --version <version-id>] [--json]',
@@ -362,6 +368,12 @@ export const COMMAND_DOCS = [
         summary: 'Push a local optimizer artifact directory.',
         group: 'Optimizations',
     },
+    {
+        path: ['optimizers', 'list'],
+        usage: 'orizu optimizers list [--project <team/project>] [--json]',
+        summary: 'List optimizer artifacts with version counts, latest version ids, and labels.',
+        group: 'Optimizations',
+    },
     {
         path: ['optimizers', 'pull'],
         usage: 'orizu optimizers pull <optimizer-id-or-name> --project <team/project> --out <dir> [--label <label> | --version <version-id>] [--json]',

package/dist/hosted-harness-opencode.js

@@ -48,6 +48,7 @@
  *     `OPENCODE_PINNED_VERSION`; a bump that switches OpenCode to CRLF framing
  *     would break both ports and must be re-verified.
  */
+import { readFileSync } from 'fs';
 // OpenCode is HARD-PINNED to this version everywhere it is installed/launched.
 // AUDIT RISK #1 (SSE fragility): the entire event model rides OpenCode's
 // undocumented `/event` SSE part schema (`message.part.updated`, `session.idle`,
@@ -696,15 +697,34 @@ export function buildOpenCodeConfigContent(opts) {
         permission: opts.permission ?? { '*': { '*': 'allow' } },
     });
 }
+const OPENCODE_READY_TIMEOUT_MS = 180_000;
+const OPENCODE_READY_POLL_MS = 500;
+const OPENCODE_READY_PROBE_TIMEOUT_MS = 2_000;
+const OPENCODE_LOG_TAIL_BYTES = 2_000;
+function readLogTail(logPath) {
+    if (!logPath)
+        return null;
+    try {
+        const content = readFileSync(logPath, 'utf8');
+        if (!content.trim())
+            return null;
+        return content.slice(-OPENCODE_LOG_TAIL_BYTES).trim();
+    }
+    catch {
+        return null;
+    }
+}
 /**
- * Launch `opencode serve` locally. Process supervision is intentionally minimal
- * for this slice — P3.5 runs this INSIDE the Daytona sandbox via the CLI. The
- * pinned version (`OPENCODE_PINNED_VERSION`) is the one the sandbox image must
- * install (see the SSE-fragility note on that constant). Returns the localhost
- * base URL the driver connects to; callers still `start()`/`runPrompt()` the
- * harness against it.
+ * Launch `opencode serve` locally and WAIT until it answers HTTP. OpenCode's
+ * first boot performs a one-time sqlite migration before it listens; returning
+ * the baseUrl without waiting raced the harness's first `POST /session` into a
+ * connection-refused "fetch failed" (ALI-1034, found live in QA-3). Any HTTP
+ * status counts as ready — we only need the socket to be accepting. Process
+ * supervision is otherwise intentionally minimal for this slice; the pinned
+ * version (`OPENCODE_PINNED_VERSION`) is the one the sandbox image must install
+ * (see the SSE-fragility note on that constant).
  */
-export function spawnOpenCode(opts) {
+export async function spawnOpenCode(opts) {
     const port = opts.port ?? DEFAULT_OPENCODE_PORT;
     const env = {
         OPENCODE_CONFIG_CONTENT: buildOpenCodeConfigContent(opts),
@@ -724,6 +744,45 @@ export function spawnOpenCode(opts) {
                 stderr: 'ignore',
             });
         });
-    const child = spawnImpl(cmd, { cwd: opts.cwd, env });
-    return { baseUrl: `http://localhost:${port}`, port, stop: () => child.kill() };
+    const child = spawnImpl(cmd, { cwd: opts.cwd, env, logPath: opts.logPath });
+    const baseUrl = `http://localhost:${port}`;
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.readyTimeoutMs ?? OPENCODE_READY_TIMEOUT_MS;
+    const pollMs = opts.readyPollMs ?? OPENCODE_READY_POLL_MS;
+    const startedAt = Date.now();
+    for (;;) {
+        if (opts.signal?.aborted) {
+            child.kill();
+            throw new Error('opencode serve readiness wait aborted');
+        }
+        try {
+            const probe = new AbortController();
+            const timer = setTimeout(() => probe.abort(), OPENCODE_READY_PROBE_TIMEOUT_MS);
+            // Link the run signal so an abort tears down an in-flight probe
+            // immediately instead of waiting out the per-probe timeout.
+            const probeSignal = opts.signal ? AbortSignal.any([opts.signal, probe.signal]) : probe.signal;
+            try {
+                // Any HTTP response (even 404) proves the server is accepting.
+                const res = await fetchImpl(`${baseUrl}/session`, { signal: probeSignal });
+                await cancelBody(res.body);
+                break;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        catch {
+            // not listening yet — fall through to the timeout check + sleep
+        }
+        // Soft budget: checked between probes, so the total wait can overrun by up
+        // to one probe timeout + poll interval. Negligible against the default.
+        if (Date.now() - startedAt >= timeoutMs) {
+            child.kill();
+            const tail = readLogTail(opts.logPath);
+            throw new Error(`opencode serve did not become ready on ${baseUrl} within ${timeoutMs}ms` +
+                (tail ? ` — log tail: ${tail}` : ' (no log output captured)'));
+        }
+        await new Promise(resolve => setTimeout(resolve, pollMs));
+    }
+    return { baseUrl, port, stop: () => child.kill(), readyAfterMs: Date.now() - startedAt };
 }

package/dist/hosted-loop.js

@@ -33,7 +33,8 @@
  * against a fake broker + fake OpenCode server with no real binary.
  */
 import { spawnSync, spawn as nodeSpawn } from 'child_process';
-import { existsSync, readFileSync } from 'fs';
+import { closeSync, existsSync, openSync, readFileSync } from 'fs';
+import { tmpdir } from 'os';
 import { join } from 'path';
 import { PREBAKED_MARKER_PATH, SETUP_HOOK_RELATIVE_PATH, parsePrebakedMarker, } from './hosted-runtime-assets.js';
 import { OPENCODE_PINNED_VERSION, createOpenCodeHarness, spawnOpenCode, } from './hosted-harness-opencode.js';
@@ -218,13 +219,35 @@ function installOpenCodePinned(version) {
 }
 /** Node child_process spawner for `opencode serve` (the sandbox runtime is
  *  node24 — Bun.spawn is not guaranteed present, so spawnOpenCode is given this
- *  runtime-agnostic spawner). */
+ *  runtime-agnostic spawner). When a logPath is provided, opencode's
+ *  stdout/stderr land there so a readiness timeout can surface the real boot
+ *  failure instead of a bare "fetch failed" (ALI-1034). */
 function nodeChildSpawner(cmd, opts) {
+    let stdio = 'ignore';
+    let fd = null;
+    if (opts.logPath) {
+        try {
+            fd = openSync(opts.logPath, 'a');
+            stdio = ['ignore', fd, fd];
+        }
+        catch {
+            // log capture is best-effort — never block the spawn on it
+        }
+    }
     const child = nodeSpawn(cmd[0], cmd.slice(1), {
         cwd: opts.cwd,
         env: { ...process.env, ...opts.env },
-        stdio: 'ignore',
+        stdio,
     });
+    if (fd !== null) {
+        // The child holds its own copy of the descriptor.
+        try {
+            closeSync(fd);
+        }
+        catch {
+            // already closed
+        }
+    }
     return { kill: () => child.kill() };
 }
 export async function runHostedLoop(opts) {
@@ -386,13 +409,25 @@ export async function runHostedLoop(opts) {
                 });
             }
             const spawnImpl = opts.spawnOpenCode ?? spawnOpenCode;
-            spawned = spawnImpl({
+            // The default spawnOpenCode WAITS for the server to answer HTTP before
+            // returning — OpenCode's first boot runs a one-time sqlite migration, and
+            // starting the harness before the server listens raced straight into a
+            // connection-refused "fetch failed" (ALI-1034).
+            spawned = await spawnImpl({
                 model: context.model,
                 cwd: context.workspaceDir,
                 port: context.opencodePort,
                 env: context.anthropicDummyKey ? { ANTHROPIC_API_KEY: context.anthropicDummyKey } : undefined,
                 spawn: nodeChildSpawner,
+                logPath: join(tmpdir(), `opencode-serve-${context.runId}.log`),
+                signal,
             });
+            if (typeof spawned.readyAfterMs === 'number') {
+                await sink.append({
+                    kind: 'artifact',
+                    payload: { step: 'opencode_ready', ok: true, waitedMs: spawned.readyAfterMs },
+                });
+            }
             harness = (opts.createHarness ?? ((baseUrl) => createOpenCodeHarness({ baseUrl })))(spawned.baseUrl);
         }
         const started = await harness.start({

package/dist/index.js

@@ -27,7 +27,7 @@ import { formatTaskCreateError } from './task-create-error.js';
 import { renderAgentSetupPrompt } from './setup-prompt.js';
 import { getWorkspaceRoot, initOrizuWorkspace, workspaceExists, } from './workspace.js';
 import { connectorsCommand } from './connectors-cli.js';
-import { ARTIFACT_MAX_BYTES, pullArtifactCommand } from './artifact-pull.js';
+import { ARTIFACT_MAX_BYTES, runnerOptimizerCommand } from './artifact-pull.js';
 import { killSwitchCommand } from './kill-switch-cli.js';
 import { egressAllowlistCommand } from './egress-allowlist-cli.js';
 import { manifestsCommand } from './manifests-cli.js';
@@ -5001,8 +5001,8 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await pushRunnerArtifact(command === 'runners' ? 'runner' : 'optimizer');
         return;
     }
-    if ((command === 'runners' || command === 'optimizers') && subcommand === 'pull') {
-        await pullArtifactCommand(cliArgs, { json: hasJsonFlag(), print: printLine, resolveProjectSlug });
+    if ((command === 'runners' || command === 'optimizers') && (subcommand === 'pull' || subcommand === 'list')) {
+        await runnerOptimizerCommand(cliArgs, { json: hasJsonFlag(), print: printLine, resolveProjectSlug });
         return;
     }
     if (command === 'runners' && subcommand === 'exec') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "private": false,
   "type": "module",
   "bin": {

package/src/artifact-pull.ts

@@ -1,10 +1,11 @@
 /**
- * Runner/optimizer artifact pull (symmetric with `runners push` /
- * `optimizers push`): resolve the artifact by id or name, download the
- * content-addressed zip from storage, and extract it into --out. Version
- * metadata is written to .orizu/pull.json — .orizu/ is excluded from artifact
- * zips (see artifact-archive.ts), so a pulled directory re-pushes with an
- * identical content hash.
+ * Runner/optimizer artifact commands: list (discover names, version ids, and
+ * labels) and pull (symmetric with `runners push` / `optimizers push` —
+ * resolve by id or name, download the content-addressed zip from storage,
+ * and extract it into --out). Pull writes version metadata to
+ * .orizu/pull.json — .orizu/ is excluded from artifact zips (see
+ * artifact-archive.ts), so a pulled directory re-pushes with an identical
+ * content hash.
  *
  * Lives outside index.ts per the CLI index line ratchet (ALI-976): this module
  * owns its own argument parsing and printing via injected io.
@@ -84,7 +85,67 @@ interface PullArtifactResponse {
   labels?: Array<{ label: string; runnerVersionId?: string; optimizerVersionId?: string }>
 }
 
-export async function pullArtifactCommand(args: string[], io: PullArtifactIo) {
+interface ArtifactListEntry {
+  id: string
+  name: string
+  description?: string | null
+  optimizerFamily?: string | null
+  latestVersionId?: string | null
+  versionCount?: number
+  labels?: Array<{ label: string; runnerVersionId?: string; optimizerVersionId?: string }>
+}
+
+export async function runnerOptimizerCommand(args: string[], io: PullArtifactIo) {
+  if (args[1] === 'list') {
+    await listArtifactsCommand(args, io)
+    return
+  }
+  await pullArtifactCommand(args, io)
+}
+
+async function listArtifactsCommand(args: string[], io: PullArtifactIo) {
+  const kind: PullableArtifactKind = args[0] === 'runners' ? 'runner' : 'optimizer'
+  const plural = kind === 'runner' ? 'runners' : 'optimizers'
+  const fetcher = io.fetcher || authedFetch
+  const project = argValue(args, '--project') || await io.resolveProjectSlug(null)
+
+  const response = await fetcher(`/api/cli/${plural}?project=${encodeURIComponent(project)}`)
+  if (!response.ok) {
+    throw new Error(`Failed to fetch ${plural}: ${await response.text()}`)
+  }
+
+  const data = await parseJsonPayload<Record<string, ArtifactListEntry[]>>(response, `${plural} list`)
+  if (io.json) {
+    io.print(JSON.stringify(data))
+    return
+  }
+
+  const items = data[plural] || []
+  if (items.length === 0) {
+    io.print(`No ${plural} found.`)
+    return
+  }
+
+  const rows = items.map(item => ({
+    id: sanitizeTerminalText(item.id),
+    name: sanitizeTerminalText(item.name),
+    versions: String(item.versionCount ?? 0),
+    latest: sanitizeTerminalText(item.latestVersionId || '-'),
+    labels: sanitizeTerminalText((item.labels || []).map(entry => entry.label).join(', ') || '-'),
+  }))
+  const idWidth = Math.max('ID'.length, ...rows.map(row => row.id.length))
+  const nameWidth = Math.max('NAME'.length, ...rows.map(row => row.name.length))
+  const versionsWidth = Math.max('VERSIONS'.length, ...rows.map(row => row.versions.length))
+  const latestWidth = Math.max('LATEST VERSION'.length, ...rows.map(row => row.latest.length))
+
+  io.print(`${'ID'.padEnd(idWidth)}  ${'NAME'.padEnd(nameWidth)}  ${'VERSIONS'.padEnd(versionsWidth)}  ${'LATEST VERSION'.padEnd(latestWidth)}  LABELS`)
+  io.print(`${'-'.repeat(idWidth)}  ${'-'.repeat(nameWidth)}  ${'-'.repeat(versionsWidth)}  ${'-'.repeat(latestWidth)}  ${'-'.repeat('LABELS'.length)}`)
+  rows.forEach(row => {
+    io.print(`${row.id.padEnd(idWidth)}  ${row.name.padEnd(nameWidth)}  ${row.versions.padEnd(versionsWidth)}  ${row.latest.padEnd(latestWidth)}  ${row.labels}`)
+  })
+}
+
+async function pullArtifactCommand(args: string[], io: PullArtifactIo) {
   const kind: PullableArtifactKind = args[0] === 'runners' ? 'runner' : 'optimizer'
   const fetcher = io.fetcher || authedFetch
   const positionalRef = args[2]

package/src/help.ts

@@ -369,6 +369,12 @@ export const COMMAND_DOCS: CliCommandDoc[] = [
     summary: 'Push a local runner artifact directory.',
     group: 'Scorers and runners',
   },
+  {
+    path: ['runners', 'list'],
+    usage: 'orizu runners list [--project <team/project>] [--json]',
+    summary: 'List runner artifacts with version counts, latest version ids, and labels.',
+    group: 'Scorers and runners',
+  },
   {
     path: ['runners', 'pull'],
     usage: 'orizu runners pull <runner-id-or-name> --project <team/project> --out <dir> [--label <label> | --version <version-id>] [--json]',
@@ -387,6 +393,12 @@ export const COMMAND_DOCS: CliCommandDoc[] = [
     summary: 'Push a local optimizer artifact directory.',
     group: 'Optimizations',
   },
+  {
+    path: ['optimizers', 'list'],
+    usage: 'orizu optimizers list [--project <team/project>] [--json]',
+    summary: 'List optimizer artifacts with version counts, latest version ids, and labels.',
+    group: 'Optimizations',
+  },
   {
     path: ['optimizers', 'pull'],
     usage: 'orizu optimizers pull <optimizer-id-or-name> --project <team/project> --out <dir> [--label <label> | --version <version-id>] [--json]',

package/src/hosted-harness-opencode.ts

@@ -49,6 +49,8 @@
  *     would break both ports and must be re-verified.
  */
 
+import { readFileSync } from 'fs'
+
 import type {
   AgentHarness,
   HarnessEvent,
@@ -781,24 +783,62 @@ export interface SpawnOpenCodeOptions extends OpenCodeConfigOptions {
   /** Extra env merged over the config-content injection. */
   env?: Record<string, string>
   /** Injectable spawner (defaults to Bun.spawn) so this stays unit-testable. */
-  spawn?: (cmd: string[], opts: { cwd?: string; env: Record<string, string> }) => { kill: () => void }
+  spawn?: (
+    cmd: string[],
+    opts: { cwd?: string; env: Record<string, string>; logPath?: string }
+  ) => { kill: () => void }
+  /** File the spawner should append opencode's stdout/stderr to. On readiness
+   *  timeout its tail is included in the thrown error — the bare "fetch failed"
+   *  this replaces was undiagnosable (ALI-1034). */
+  logPath?: string
+  /** Overall readiness budget. OpenCode's FIRST boot runs a one-time sqlite
+   *  migration ("may take a few minutes") before it listens, so this must
+   *  comfortably cover a cold snapshot. */
+  readyTimeoutMs?: number
+  /** Poll interval while waiting for the server to answer. */
+  readyPollMs?: number
+  /** Abort (e.g. run cancelled) while still waiting for readiness. */
+  signal?: AbortSignal
+  /** Injectable readiness probe (defaults to global fetch) for tests. */
+  fetchImpl?: typeof fetch
 }
 
 export interface SpawnedOpenCode {
   baseUrl: string
   port: number
   stop: () => void
+  /** How long the server took to answer its first request (set by the real
+   *  spawnOpenCode; injected test spawners may omit it). */
+  readyAfterMs?: number
+}
+
+const OPENCODE_READY_TIMEOUT_MS = 180_000
+const OPENCODE_READY_POLL_MS = 500
+const OPENCODE_READY_PROBE_TIMEOUT_MS = 2_000
+const OPENCODE_LOG_TAIL_BYTES = 2_000
+
+function readLogTail(logPath: string | undefined): string | null {
+  if (!logPath) return null
+  try {
+    const content = readFileSync(logPath, 'utf8')
+    if (!content.trim()) return null
+    return content.slice(-OPENCODE_LOG_TAIL_BYTES).trim()
+  } catch {
+    return null
+  }
 }
 
 /**
- * Launch `opencode serve` locally. Process supervision is intentionally minimal
- * for this slice — P3.5 runs this INSIDE the Daytona sandbox via the CLI. The
- * pinned version (`OPENCODE_PINNED_VERSION`) is the one the sandbox image must
- * install (see the SSE-fragility note on that constant). Returns the localhost
- * base URL the driver connects to; callers still `start()`/`runPrompt()` the
- * harness against it.
+ * Launch `opencode serve` locally and WAIT until it answers HTTP. OpenCode's
+ * first boot performs a one-time sqlite migration before it listens; returning
+ * the baseUrl without waiting raced the harness's first `POST /session` into a
+ * connection-refused "fetch failed" (ALI-1034, found live in QA-3). Any HTTP
+ * status counts as ready — we only need the socket to be accepting. Process
+ * supervision is otherwise intentionally minimal for this slice; the pinned
+ * version (`OPENCODE_PINNED_VERSION`) is the one the sandbox image must install
+ * (see the SSE-fragility note on that constant).
  */
-export function spawnOpenCode(opts: SpawnOpenCodeOptions): SpawnedOpenCode {
+export async function spawnOpenCode(opts: SpawnOpenCodeOptions): Promise<SpawnedOpenCode> {
   const port = opts.port ?? DEFAULT_OPENCODE_PORT
   const env: Record<string, string> = {
     OPENCODE_CONFIG_CONTENT: buildOpenCodeConfigContent(opts),
@@ -818,6 +858,47 @@ export function spawnOpenCode(opts: SpawnOpenCodeOptions): SpawnedOpenCode {
         stderr: 'ignore',
       })
     })
-  const child = spawnImpl(cmd, { cwd: opts.cwd, env })
-  return { baseUrl: `http://localhost:${port}`, port, stop: () => child.kill() }
+  const child = spawnImpl(cmd, { cwd: opts.cwd, env, logPath: opts.logPath })
+  const baseUrl = `http://localhost:${port}`
+
+  const fetchImpl = opts.fetchImpl ?? (globalThis.fetch as typeof fetch)
+  const timeoutMs = opts.readyTimeoutMs ?? OPENCODE_READY_TIMEOUT_MS
+  const pollMs = opts.readyPollMs ?? OPENCODE_READY_POLL_MS
+  const startedAt = Date.now()
+  for (;;) {
+    if (opts.signal?.aborted) {
+      child.kill()
+      throw new Error('opencode serve readiness wait aborted')
+    }
+    try {
+      const probe = new AbortController()
+      const timer = setTimeout(() => probe.abort(), OPENCODE_READY_PROBE_TIMEOUT_MS)
+      // Link the run signal so an abort tears down an in-flight probe
+      // immediately instead of waiting out the per-probe timeout.
+      const probeSignal = opts.signal ? AbortSignal.any([opts.signal, probe.signal]) : probe.signal
+      try {
+        // Any HTTP response (even 404) proves the server is accepting.
+        const res = await fetchImpl(`${baseUrl}/session`, { signal: probeSignal })
+        await cancelBody(res.body)
+        break
+      } finally {
+        clearTimeout(timer)
+      }
+    } catch {
+      // not listening yet — fall through to the timeout check + sleep
+    }
+    // Soft budget: checked between probes, so the total wait can overrun by up
+    // to one probe timeout + poll interval. Negligible against the default.
+    if (Date.now() - startedAt >= timeoutMs) {
+      child.kill()
+      const tail = readLogTail(opts.logPath)
+      throw new Error(
+        `opencode serve did not become ready on ${baseUrl} within ${timeoutMs}ms` +
+          (tail ? ` — log tail: ${tail}` : ' (no log output captured)')
+      )
+    }
+    await new Promise(resolve => setTimeout(resolve, pollMs))
+  }
+
+  return { baseUrl, port, stop: () => child.kill(), readyAfterMs: Date.now() - startedAt }
 }

package/src/hosted-loop.ts

@@ -34,7 +34,8 @@
  */
 
 import { spawnSync, spawn as nodeSpawn } from 'child_process'
-import { existsSync, readFileSync } from 'fs'
+import { closeSync, existsSync, openSync, readFileSync } from 'fs'
+import { tmpdir } from 'os'
 import { join } from 'path'
 
 import type { AgentHarness, HarnessEvent, HarnessPrompt } from './hosted-harness.js'
@@ -156,7 +157,7 @@ export interface RunHostedLoopOptions {
   /** Build the in-process Claude-Agent-SDK harness (default: real SDK loader).
    *  Injectable so the swap test drives a fake `query()` with no real SDK. */
   createClaudeHarness?: () => AgentHarness
-  spawnOpenCode?: (opts: SpawnOpenCodeOptions) => SpawnedOpenCode
+  spawnOpenCode?: (opts: SpawnOpenCodeOptions) => SpawnedOpenCode | Promise<SpawnedOpenCode>
   installOpenCode?: () => Promise<InstallResult>
   now?: () => number
   signal?: AbortSignal
@@ -402,16 +403,36 @@ function installOpenCodePinned(version: string): InstallResult {
 
 /** Node child_process spawner for `opencode serve` (the sandbox runtime is
  *  node24 — Bun.spawn is not guaranteed present, so spawnOpenCode is given this
- *  runtime-agnostic spawner). */
+ *  runtime-agnostic spawner). When a logPath is provided, opencode's
+ *  stdout/stderr land there so a readiness timeout can surface the real boot
+ *  failure instead of a bare "fetch failed" (ALI-1034). */
 function nodeChildSpawner(
   cmd: string[],
-  opts: { cwd?: string; env: Record<string, string> }
+  opts: { cwd?: string; env: Record<string, string>; logPath?: string }
 ): { kill: () => void } {
+  let stdio: 'ignore' | Array<'ignore' | number> = 'ignore'
+  let fd: number | null = null
+  if (opts.logPath) {
+    try {
+      fd = openSync(opts.logPath, 'a')
+      stdio = ['ignore', fd, fd]
+    } catch {
+      // log capture is best-effort — never block the spawn on it
+    }
+  }
   const child = nodeSpawn(cmd[0], cmd.slice(1), {
     cwd: opts.cwd,
     env: { ...process.env, ...opts.env },
-    stdio: 'ignore',
+    stdio,
   })
+  if (fd !== null) {
+    // The child holds its own copy of the descriptor.
+    try {
+      closeSync(fd)
+    } catch {
+      // already closed
+    }
+  }
   return { kill: () => child.kill() }
 }
 
@@ -575,13 +596,25 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
       }
 
       const spawnImpl = opts.spawnOpenCode ?? spawnOpenCode
-      spawned = spawnImpl({
+      // The default spawnOpenCode WAITS for the server to answer HTTP before
+      // returning — OpenCode's first boot runs a one-time sqlite migration, and
+      // starting the harness before the server listens raced straight into a
+      // connection-refused "fetch failed" (ALI-1034).
+      spawned = await spawnImpl({
         model: context.model,
         cwd: context.workspaceDir,
         port: context.opencodePort,
         env: context.anthropicDummyKey ? { ANTHROPIC_API_KEY: context.anthropicDummyKey } : undefined,
         spawn: nodeChildSpawner,
+        logPath: join(tmpdir(), `opencode-serve-${context.runId}.log`),
+        signal,
       })
+      if (typeof spawned.readyAfterMs === 'number') {
+        await sink.append({
+          kind: 'artifact',
+          payload: { step: 'opencode_ready', ok: true, waitedMs: spawned.readyAfterMs },
+        })
+      }
 
       harness = (opts.createHarness ?? ((baseUrl: string) => createOpenCodeHarness({ baseUrl })))(
         spawned.baseUrl

package/src/index.ts

@@ -59,7 +59,7 @@ import {
   workspaceExists,
 } from './workspace.js'
 import { connectorsCommand } from './connectors-cli.js'
-import { ARTIFACT_MAX_BYTES, pullArtifactCommand } from './artifact-pull.js'
+import { ARTIFACT_MAX_BYTES, runnerOptimizerCommand } from './artifact-pull.js'
 import { killSwitchCommand } from './kill-switch-cli.js'
 import { egressAllowlistCommand } from './egress-allowlist-cli.js'
 import { manifestsCommand } from './manifests-cli.js'
@@ -6467,8 +6467,8 @@ export async function main(rawArgs = process.argv.slice(2)) {
     return
   }
 
-  if ((command === 'runners' || command === 'optimizers') && subcommand === 'pull') {
-    await pullArtifactCommand(cliArgs, { json: hasJsonFlag(), print: printLine, resolveProjectSlug }); return
+  if ((command === 'runners' || command === 'optimizers') && (subcommand === 'pull' || subcommand === 'list')) {
+    await runnerOptimizerCommand(cliArgs, { json: hasJsonFlag(), print: printLine, resolveProjectSlug }); return
   }
 
   if (command === 'runners' && subcommand === 'exec') {