orizu 0.5.39 → 0.5.41

package/src/hosted-boot.ts

@@ -150,6 +150,7 @@ export function deriveBootStatusUrl(agentTokenUrl: string): string {
  *  secret defensively before sending. */
 const MAX_BOOT_REASON_CHARS = 800
 const TURN_STATUS_ATTEMPT_TIMEOUT_MS = 10_000
+export const HOSTED_TURN_PROGRESS_REPORT_MS = 5 * 60_000
 
 function resolveTestPositiveInteger(
   processEnv: Record<string, string | undefined>,
@@ -241,7 +242,7 @@ async function postRequiredIdleReady(opts: {
 async function postTurnStatus(opts: {
   bootStatusUrl: string
   bootSecret: string
-  status: 'turn_started' | 'turn_completed' | 'turn_failed'
+  status: 'turn_started' | 'turn_progress' | 'turn_completed' | 'turn_failed'
   runId: string
   reason?: string | null
   fetchImpl: BootFetch
@@ -1283,6 +1284,7 @@ export async function runHostedBoot(opts: RunHostedBootOptions): Promise<HostedB
         minimumDelayMs: bearerRotationMinimumDelayMs,
       })
       const promptInterruptController = new AbortController()
+      let nextProgressAt = now()
       const interruptPollController = new AbortController()
       const interruptPoll = pollHostedSessionDuringTurn({
         baseUrl: env.baseUrl,
@@ -1312,6 +1314,19 @@ export async function runHostedBoot(opts: RunHostedBootOptions): Promise<HostedB
             bearerProvider: () => readFile(bearerFileAbs).trim(),
             interruptSignal: promptInterruptController.signal,
             onDiagnostic: log,
+            onProgress: async () => {
+              if (now() < nextProgressAt) return
+              nextProgressAt = now() + HOSTED_TURN_PROGRESS_REPORT_MS
+              try {
+                await postTurnStatus({
+                  bootStatusUrl: env.bootStatusUrl, bootSecret: env.bootSecret,
+                  status: 'turn_progress', runId: current.runId, fetchImpl, sleep,
+                  attemptTimeoutMs: turnStatusAttemptTimeoutMs,
+                })
+              } catch {
+                log('turn progress acknowledgement unavailable')
+              }
+            },
           }
         )
       } finally {

package/src/hosted-harness-opencode.ts

@@ -51,8 +51,10 @@
 
 import { readFileSync } from 'fs'
 
+import { refreshHostedModels } from '../src/hosted-model-cache.mjs'
+
 import { HOSTED_AGENT_NAME, HOSTED_AGENT_PROMPT } from './hosted-agent-prompt.js'
-import { findProvider, parseModelIdentity } from './provider-registry.js'
+import { parseModelIdentity } from './provider-registry.js'
 
 import { HARNESS_NAMES } from './hosted-harness.js'
 import type {
@@ -64,13 +66,13 @@ import type {
 } from './hosted-harness.js'
 
 // OpenCode is HARD-PINNED to this version everywhere it is installed/launched.
-// AUDIT RISK #1 (SSE fragility): the entire event model rides OpenCode's
-// undocumented `/event` SSE part schema (`message.part.updated`, `session.idle`,
-// `session.error`, `session.updated`, ...). Versions newer than 1.14.41 broke
-// that stream upstream, so the pin is load-bearing and must be re-verified
-// before any bump. The AgentHarness seam is the mitigation of last resort: swap
-// to a Claude-Agent-SDK loop (ALI-929) rather than chase OpenCode's SSE.
-export const OPENCODE_PINNED_VERSION = '1.14.41'
+// The event model rides OpenCode's undocumented `/event` SSE part schema
+// (`message.part.updated`, `session.idle`, `session.error`, `session.updated`,
+// ...), so every bump must pass test/cli/hosted-opencode-contract-real.test.ts
+// against the real binary (the path-gated `opencode-real` CI job runs it when
+// this pin changes). 1.14.41 → 1.18.35 was measured and checked that way
+// (ORI-2523). The AgentHarness seam remains the mitigation of last resort.
+export const OPENCODE_PINNED_VERSION = '1.18.35'
 
 const DEFAULT_OPENCODE_PORT = 4096
 const DEFAULT_SSE_INACTIVITY_MS = 120_000
@@ -152,17 +154,6 @@ export function ascendingId(prefix: 'ses' | 'msg' | 'prt', nowMs: number = Date.
   return `${prefix}_${hex}${randomBase62(14)}`
 }
 
-// -- Anthropic / OpenAI reasoning-effort mapping (port of bridge.py) ---------
-const ANTHROPIC_THINKING_BUDGETS: Record<string, number> = { high: 16_000, max: 31_999 }
-const ANTHROPIC_ADAPTIVE_THINKING_MODELS = new Set([
-  'claude-fable-5',
-  'claude-opus-4-6',
-  'claude-opus-4-7',
-  'claude-opus-4-8',
-  'claude-sonnet-4-6',
-])
-const ANTHROPIC_ADAPTIVE_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max'])
-
 /**
  * Split a possibly provider-qualified model string into provider + model id,
  * through THE registry parse (`parseModelIdentity`, ORI-2031): the provider is
@@ -201,34 +192,13 @@ export function buildPromptRequestBody(
   // Shared parse (see qualifyHostedModel): keeps the prompt path and the
   // ALI-1086 pre-prompt validation in lockstep by construction.
   const { providerId, modelId } = qualifyHostedModel(model)
-  const modelSpec: Record<string, unknown> = { providerID: providerId, modelID: modelId }
-
-  // Reasoning options are a property of the WIRE PROTOCOL, not of a provider
-  // name (ORI-2031 row 7). `openai-chat` gets no options at all — identical to
-  // today's fall-through for any provider the driver does not recognise, and
-  // honest: Orizu has never measured chat-completions reasoning fields
-  // (ORI-2032). A bare model id still resolves through qualifyHostedModel's
-  // 'anthropic' default, so its options are unchanged.
-  const protocol = findProvider(providerId)?.protocol ?? null
-  if (reasoningEffort) {
-    if (protocol === 'anthropic-messages') {
-      if (ANTHROPIC_ADAPTIVE_THINKING_MODELS.has(modelId)) {
-        const options: Record<string, unknown> = { thinking: { type: 'adaptive' } }
-        if (ANTHROPIC_ADAPTIVE_EFFORTS.has(reasoningEffort)) {
-          options.outputConfig = { effort: reasoningEffort }
-        }
-        modelSpec.options = options
-      } else {
-        const budget = ANTHROPIC_THINKING_BUDGETS[reasoningEffort]
-        if (budget !== undefined) {
-          modelSpec.options = { thinking: { type: 'enabled', budgetTokens: budget } }
-        }
-      }
-    } else if (protocol === 'openai-responses') {
-      modelSpec.options = { reasoningEffort, reasoningSummary: 'auto' }
-    }
-  }
-  body.model = modelSpec
+  body.model = { providerID: providerId, modelID: modelId }
+  // Reasoning effort travels as the top-level `variant` (ORI-2526). OpenCode's
+  // prompt body accepts only providerID/modelID inside `model` and silently
+  // dropped the options we used to send there. Each model's variants map the
+  // effort onto its own request fields; an effort the model has no variant for
+  // is ignored by OpenCode, so no per-provider mapping lives here.
+  if (reasoningEffort) body.variant = reasoningEffort
   return body
 }
 
@@ -571,6 +541,8 @@ export function createOpenCodeHarness(options: OpenCodeHarnessOptions): AgentHar
       const userMessageIds = new Set<string>([opencodeMessageId])
       const pendingParts = new Map<string, Array<{ part: Record<string, unknown>; delta: unknown }>>()
       const emittedToolStates = new Set<string>()
+      const partTypes = new Map<string, string>()
+      const untypedDeltas = new Map<string, string[]>()
 
       const handlePart = (part: Record<string, unknown>, delta: unknown): HarnessEvent[] => {
         const partType = typeof part.type === 'string' ? part.type : ''
@@ -779,16 +751,50 @@ export function createOpenCodeHarness(options: OpenCodeHarnessOptions): AgentHar
                 }
               }
             }
-          } else if (eventType === 'message.part.updated') {
-            const part = asRecord(props.part)
-            const delta = props.delta
-            const ocMsgId = typeof part.messageID === 'string' ? part.messageID : ''
-            if (allowedAssistantMsgIds.has(ocMsgId)) {
-              for (const ev of handlePart(part, delta)) yield ev
-            } else if (ocMsgId) {
-              const list = pendingParts.get(ocMsgId) ?? []
-              list.push({ part, delta })
-              pendingParts.set(ocMsgId, list)
+          } else if (eventType === 'message.part.updated' || eventType === 'message.part.delta') {
+            // Word-by-word text arrives as `message.part.delta` (ORI-2525), which
+            // names the part but not its type. Reasoning parts send deltas too,
+            // so a delta streams only once its part is known to be text. A delta
+            // can overtake its part's announcement (opencode #26924); it waits
+            // here until the announcement says what the part is.
+            const updates: Array<{ part: Record<string, unknown>; delta: unknown }> = []
+            if (eventType === 'message.part.updated') {
+              const part = asRecord(props.part)
+              const partId = typeof part.id === 'string' ? part.id : ''
+              updates.push({ part, delta: props.delta })
+              if (partId && typeof part.type === 'string') partTypes.set(partId, part.type)
+              const early = untypedDeltas.get(partId)
+              if (early) {
+                untypedDeltas.delete(partId)
+                const announced = typeof part.text === 'string' ? part.text : ''
+                // Replay unless the announced text already includes them.
+                if (part.type === 'text' && !announced.startsWith(early.join(''))) {
+                  for (const delta of early) {
+                    updates.push({ part: { type: 'text', id: partId, messageID: part.messageID }, delta })
+                  }
+                }
+              }
+            } else {
+              const partId = typeof props.partID === 'string' ? props.partID : ''
+              const delta = props.delta
+              if (props.field !== 'text' || !partId || typeof delta !== 'string') continue
+              const partType = partTypes.get(partId)
+              if (partType === undefined) {
+                untypedDeltas.set(partId, [...(untypedDeltas.get(partId) ?? []), delta])
+                continue
+              }
+              if (partType !== 'text') continue
+              updates.push({ part: { type: 'text', id: partId, messageID: props.messageID }, delta })
+            }
+            for (const { part, delta } of updates) {
+              const ocMsgId = typeof part.messageID === 'string' ? part.messageID : ''
+              if (allowedAssistantMsgIds.has(ocMsgId)) {
+                for (const ev of handlePart(part, delta)) yield ev
+              } else if (ocMsgId) {
+                const list = pendingParts.get(ocMsgId) ?? []
+                list.push({ part, delta })
+                pendingParts.set(ocMsgId, list)
+              }
             }
           } else if (eventType === 'session.compacted') {
             // Compaction re-chains messages so subsequent assistant parentIDs no
@@ -910,16 +916,9 @@ function errorEvent(messageId: string, error: unknown): HarnessEvent {
 
 // -- Pre-prompt model validation (ALI-1086) -----------------------------------
 //
-// The pinned OpenCode (see OPENCODE_PINNED_VERSION) resolves model ids against
-// a catalog that is its BUNDLED snapshot merged with a runtime fetch of
-// https://models.dev/api.json (verified empirically on ALI-1086: fetched at
-// boot when reachable, cached to <cache>/opencode/models.json, refreshed when
-// stale). When models.dev is unreachable the bundled snapshot is stale
-// (predates claude-opus-4-8) and the FIRST prompt dies inside the SSE stream
-// with an opaque `run_failed: Model not found`. These helpers let the hosted
-// loop ask the RUNNING `opencode serve` — `GET /config/providers` is the
-// runtime's actual resolvable catalog — whether the requested model resolves,
-// BEFORE the prompt is posted, and fail fast naming the alternatives.
+// Images bake a validated catalog. Orizu refreshes it before OpenCode's first
+// read and disables its unchecked background writer (ORI-2513). This validation
+// asks the running server whether the selected model resolves before prompting.
 
 /** provider id → model ids the RUNNING opencode instance can resolve. */
 export type OpenCodeModelCatalog = ReadonlyMap<string, readonly string[]>
@@ -1006,10 +1005,9 @@ export interface AwaitModelResolvableOptions {
   model: string
   fetchImpl?: HarnessFetch
   /**
-   * Total budget to wait for the model to become resolvable. OpenCode's
-   * models.dev refresh runs in the BACKGROUND at boot, so the catalog can be
-   * bundled-only for the first seconds after the server answers HTTP; polling
-   * bridges that window instead of failing a run the refresh would have fixed.
+   * Budget for catalog readiness and transient server reads. Hosted startup
+   * finishes its validated refresh before spawn; this polling remains a
+   * compatibility guard for other callers and startup endpoint delays.
    */
   timeoutMs?: number
   pollMs?: number
@@ -1022,7 +1020,7 @@ const MODEL_RESOLVE_POLL_MS = 2_000
 
 /**
  * Decide whether the requested model is resolvable by the RUNNING opencode,
- * polling briefly so the boot-time models.dev refresh has time to land.
+ * polling briefly for catalog readiness or transient server failures.
  * Fail-open on validator infrastructure, with a DELIBERATE asymmetry on null
  * catalog reads:
  *   - null BEFORE any successful read → `skipped` immediately (dead/absent
@@ -1207,7 +1205,11 @@ export async function spawnOpenCode(opts: SpawnOpenCodeOptions): Promise<Spawned
   const env: Record<string, string> = {
     OPENCODE_CONFIG_CONTENT: buildOpenCodeConfigContent(opts),
     ...(opts.env ?? {}),
+    OPENCODE_DISABLE_MODELS_FETCH: '1',
   }
+  const model = qualifyHostedModel(opts.model)
+  env.OPENCODE_MODELS_PATH = await refreshHostedModels({ env: { ...process.env, ...env }, required: [`${model.providerId}/${model.modelId}`], fetchImpl: opts.fetchImpl, signal: opts.signal })
+  opts.signal?.throwIfAborted()
   const cmd = ['opencode', 'serve', '--port', String(port)]
   const spawnImpl =
     opts.spawn ??

package/src/hosted-loop-lifecycle.ts

@@ -32,17 +32,12 @@ import type { HostedSessionOrigin } from './hosted-runtime-assets.js'
  * re-inline it.
  *
  * PIN CONSTRAINT: the hosted OpenCode runtime is HARD-PINNED to
- * `opencode-ai@1.14.41` (`OPENCODE_PINNED_VERSION`, SSE-fragile — do not bump)
- * whose BUNDLED model catalog predates this model (newest bundled anthropic
- * opus: claude-opus-4-7). Verified empirically on ALI-1086: 1.14.41 DOES fetch
- * `https://models.dev/api.json` at boot when reachable (cached to
- * `~/.cache/opencode/models.json`, refreshed when stale, disabled only by
- * `OPENCODE_DISABLE_MODELS_FETCH`), so with models.dev on the sandbox egress
- * allowlist (#1392, `ORIZU_HOSTED_EGRESS_ALLOWLIST`) this id resolves in new
- * sandboxes. If the catalog fetch is blocked/stale anyway, the loop's
- * pre-prompt validation (`awaitOpenCodeModelResolvable`) fails the run fast,
- * naming the resolvable alternatives. The durable fix for the stale bundled
- * catalog is the ALI-929 harness swap.
+ * `OPENCODE_PINNED_VERSION` (opencode-ai@1.18.35, whose bundled catalog
+ * includes this model; bumps are checked by the real-binary contract test,
+ * ORI-2523). Images also bake a validated models.dev
+ * list into the runtime user's cache. Orizu refreshes that cache before spawning
+ * OpenCode, preserving baked models on failure; the native unchecked writer is
+ * disabled (ORI-2513). Pre-prompt validation still checks the running server.
  */
 export const DEFAULT_HOSTED_MODEL = 'anthropic/claude-opus-4-8'
 

package/src/hosted-loop.ts

@@ -231,6 +231,8 @@ export interface RunHostedLoopOptions {
   /** Value-free local diagnostics shared with the event sink. Production routes
    *  this through hosted-boot's stderr seam; consumer failures are ignored. */
   onDiagnostic?: (message: string) => void
+  /** Report genuine harness activity to the session's progress watchdog. */
+  onProgress?: () => Promise<void>
 }
 
 export interface HostedLoopResult {
@@ -326,14 +328,22 @@ function detectLoopPrebaked(flag: boolean | undefined, markerPath: string): bool
 }
 
 /** Best-effort global install of the pinned opencode. Non-fatal: a failure is
- *  recorded and the run finishes cleanly when the subsequent connect fails. */
-function installOpenCodePinned(version: string): InstallResult {
+ *  recorded and the run finishes cleanly when the subsequent connect fails.
+ *  From 1.18 opencode's postinstall script writes the `opencode` command, and
+ *  npm 12 blocks it unless allowed, leaving a placeholder that exits 1; so npm
+ *  allows that one script and the result must print the pinned version
+ *  (ORI-2523). `env` exists for tests. */
+export function installOpenCodePinned(version: string, env?: NodeJS.ProcessEnv): InstallResult {
   const command =
-    `bun add -g opencode-ai@${version} >/dev/null 2>&1 || ` +
-    `npm install -g opencode-ai@${version} >/dev/null 2>&1`
-  const res = spawnSync('bash', ['-c', command], { encoding: 'utf8' })
+    `{ bun add -g opencode-ai@${version} >/dev/null 2>&1 || ` +
+    `npm install -g --allow-scripts=opencode-ai opencode-ai@${version} >/dev/null 2>&1; } && ` +
+    `v="$(opencode --version 2>/dev/null)" && [ "$v" = '${version}' ]`
+  const res = spawnSync('bash', ['-c', command], { encoding: 'utf8', ...(env ? { env } : {}) })
   const ok = (res.status ?? 1) === 0
-  return { ok, detail: ok ? `installed opencode-ai@${version}` : `install exit ${res.status ?? 'unknown'}` }
+  return {
+    ok,
+    detail: ok ? `installed opencode-ai@${version}` : `install exit ${res.status ?? 'unknown'}, or opencode --version is not ${version}`,
+  }
 }
 
 /** Node child_process spawner for `opencode serve` (the sandbox runtime is
@@ -630,10 +640,9 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
 
       // Fail-fast model validation (ALI-1086): ask the RUNNING opencode whether
       // the requested model is resolvable BEFORE the first prompt. The pinned
-      // opencode's bundled catalog is stale (predates claude-opus-4-8) and only
-      // a boot-time models.dev fetch (#1392 allowlists it) refreshes it — when
-      // that fetch is blocked, the first prompt used to die inside the SSE
-      // stream with an opaque `run_failed: Model not found`. Now the run fails
+      // image catalog is baked and refreshed before spawn (ORI-2513). A model
+      // absent from that validated list still needs a clear error rather than
+      // dying inside the SSE stream with an opaque Model not found. The run fails
       // immediately with a structured artifact + an error naming the requested
       // id AND the resolvable alternatives. Fail-open on validator
       // infrastructure: an unreachable catalog endpoint (`skipped`) proceeds
@@ -784,6 +793,7 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
           }
           return
         }
+        if (event.kind !== 'question_auto_answered') await opts.onProgress?.()
         yield event
       }
       // A signal already durable before prompt startup can make a driver end

package/src/hosted-model-cache.d.mts

@@ -0,0 +1,2 @@
+export function refreshHostedModels(options?: { env?: Record<string, string | undefined>; required?: string[]; strict?: boolean; fetchImpl?: typeof fetch; signal?: AbortSignal }): Promise<string>
+export function bakeHostedModels(): Promise<string>

package/src/hosted-model-cache.mjs

@@ -0,0 +1,53 @@
+import { mkdir, rename, rm, writeFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+
+// The pinned runtime reads this file once: only replace it with a valid list containing the required models.
+export async function refreshHostedModels({ env = process.env, required = [], strict = false, fetchImpl = fetch, signal } = {}) {
+  signal?.throwIfAborted()
+  const path = env.OPENCODE_MODELS_PATH || join(env.XDG_CACHE_HOME || join(env.HOME || homedir(), '.cache'), 'opencode', 'models.json')
+  const temporary = `${path}.${process.pid}.tmp`
+  const record = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+  const strings = (value, keys) => keys.every(key => value[key] === undefined || typeof value[key] === 'string')
+  const cost = value => value === undefined || (record(value) && ['input', 'output', 'cache_read', 'cache_write'].every(key => value[key] === undefined || Number.isFinite(value[key])) && cost(value.context_over_200k))
+  const providerOptions = value => value === undefined || (record(value) && strings(value, ['api', 'npm']) &&
+    (value.body === undefined || record(value.body)) && (value.headers === undefined || (record(value.headers) && Object.values(value.headers).every(header => typeof header === 'string'))))
+  const optionalModelFields = model => {
+    if (!strings(model, ['family']) || (model.status !== undefined && !['alpha', 'beta', 'deprecated', 'active'].includes(model.status)) || !cost(model.cost) || !providerOptions(model.provider)) return false
+    if (model.limit.input !== undefined && !Number.isFinite(model.limit.input)) return false
+    if (model.interleaved !== undefined && typeof model.interleaved !== 'boolean' && (!record(model.interleaved) || !['reasoning_content', 'reasoning_details'].includes(model.interleaved.field))) return false
+    if (model.modalities !== undefined && (!record(model.modalities) || !['input', 'output'].every(key => Array.isArray(model.modalities[key]) && model.modalities[key].every(value => ['text', 'audio', 'image', 'video', 'pdf'].includes(value))))) return false
+    if (model.experimental !== undefined && (!record(model.experimental) || (model.experimental.modes !== undefined && (!record(model.experimental.modes) || Object.entries(model.experimental.modes).some(([name, mode]) => !name || !record(mode) || !cost(mode.cost) || !providerOptions(mode.provider)))))) return false
+    return true
+  }
+  const identities = text => {
+    const catalog = JSON.parse(text)
+    if (!catalog || typeof catalog !== 'object' || Array.isArray(catalog)) throw new Error('Invalid model catalog')
+    return Object.entries(catalog).flatMap(([provider, value]) => {
+      if (!value || value.id !== provider || !strings(value, ['api', 'npm']) || typeof value.name !== 'string' || !Array.isArray(value.env) || value.env.some(name => typeof name !== 'string') || typeof value.models !== 'object' || !value.models || Array.isArray(value.models)) throw new Error('Invalid model provider')
+      return Object.entries(value.models).map(([id, model]) => {
+        if (!model || model.id !== id || typeof model.name !== 'string' || typeof model.release_date !== 'string' || ['attachment', 'reasoning', 'tool_call'].some(key => typeof model[key] !== 'boolean') || (model.temperature !== undefined && typeof model.temperature !== 'boolean') || !Number.isFinite(model.limit?.context) || !Number.isFinite(model.limit?.output)) throw new Error('Invalid model entry')
+        if (!optionalModelFields(model)) throw new Error('Invalid optional model metadata')
+        return ['alpha', 'deprecated'].includes(model.status) ? null : `${provider}/${id}`
+      }).filter(Boolean)
+    })
+  }
+  try {
+    const response = await fetchImpl(`${env.OPENCODE_MODELS_URL || 'https://models.dev'}/api.json`, { signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000) })
+    if (!response.ok) throw new Error(`Model catalog download failed: ${response.status}`)
+    const text = await response.text()
+    const models = new Set(identities(text))
+    if (!models.size || required.some(id => !models.has(id))) throw new Error('Model catalog is missing required models')
+    await mkdir(dirname(path), { recursive: true })
+    await writeFile(temporary, text)
+    signal?.throwIfAborted()
+    await rename(temporary, path)
+  } catch (error) {
+    signal?.throwIfAborted()
+    if (strict) throw error
+  } finally { await rm(temporary, { force: true }) }
+  signal?.throwIfAborted()
+  return path
+}
+
+export const bakeHostedModels = () => refreshHostedModels({ strict: true, required: process.env.HOSTED_WORKSPACE_DEFAULT_MODEL ? [process.env.HOSTED_WORKSPACE_DEFAULT_MODEL] : ['openai/gpt-5.6', 'openai/gpt-6-luna', 'anthropic/claude-opus-4-8'] })

package/src/index.ts

@@ -155,6 +155,8 @@ import {
   setDatasetReadme,
   createDatasetVersion,
   createDatasetSplitSet,
+  listDatasetSplitSets,
+  showDatasetSplitSet,
   editDatasetRows,
   deleteDatasetRows,
   deleteDataset,
@@ -2139,6 +2141,14 @@ export async function main(rawArgs = process.argv.slice(2)) {
     await createDatasetVersion()
     return
   }
+  if (command === 'datasets' && subcommand === 'splits' && datasetsAction === 'list') {
+    await listDatasetSplitSets()
+    return
+  }
+  if (command === 'datasets' && subcommand === 'splits' && datasetsAction === 'show') {
+    await showDatasetSplitSet()
+    return
+  }
   if (command === 'datasets' && subcommand === 'splits' && datasetsAction === 'create') {
     await createDatasetSplitSet()
     return
@@ -2252,10 +2262,10 @@ function isCliEntrypoint(): boolean {
 if (isCliEntrypoint()) {
   const rawArgs = process.argv.slice(2)
   withPassiveUpdateNotice(rawArgs, getCliVersion, printError, args =>
-    main(args).catch(error => {
+    main(args).catch(async error => {
       const message = error instanceof Error ? error.message : 'Unknown error'
       // The reporter email is unknown on the failure path, so the record masks every address.
-      writeLastErrorRecord({
+      await writeLastErrorRecord({
         argv: args,
         message,
         code: extractLastErrorCode(error),

package/src/instruction-delivery.ts

@@ -0,0 +1,123 @@
+import { Cause, Effect, Exit } from 'effect'
+
+import { authedFetch } from './http.js'
+import { responsePayload } from './json-response.js'
+import { stageSyncPayload, startSyncLockClaim, tryClaimSyncLock, type SyncDiskOptions, type SyncDiskResult, type SyncPayload, type SyncRequestPlan } from './instruction-set-sync/index.js'
+import { applyUpdate, lockedProfileIdentity, makeUpdatePlan, readUpdateLock, type UpdatePlan, type UpdateResult } from './instruction-set-update/index.js'
+
+// Loaded only through `await import(...)` from instruction-sets-cli, so CLI
+// startup and the published loader never load Effect.
+
+export interface Interrupted { interrupted: 130 | 143 }
+
+// Existing file steps throw plain errors; keep them as the failure value so the
+// CLI prints exactly the same message.
+const attempt = <A>(operation: () => A) => Effect.try({ try: operation, catch: cause => cause })
+
+function readPayload(path: string, action: string) {
+  return Effect.tryPromise({
+    // The body stays unchecked here, as before: stageSyncPayload and makeUpdatePlan validate it.
+    // SAFETY: their existing error messages for malformed bodies are part of the CLI's output.
+    try: async signal => await responsePayload(await authedFetch(path, { method: 'GET', signal }), action) as unknown as SyncPayload,
+    catch: cause => cause,
+  })
+}
+
+// Waiting for another process's lock is the only interruptible part: nothing
+// is held yet. Publishing runs to completion once the lock is ours.
+function holdSyncLock<A>(appRoot: string, use: Effect.Effect<A, unknown>) {
+  const acquire = Effect.gen(function*() {
+    const claim = yield* attempt(() => startSyncLockClaim(appRoot))
+    while (true) {
+      const claimed = yield* attempt(() => tryClaimSyncLock(claim))
+      if (typeof claimed === 'function') return claimed
+      yield* Effect.interruptible(Effect.sleep(claimed))
+    }
+  })
+  return Effect.acquireUseRelease(acquire, () => use, release => Effect.sync(release))
+}
+
+// Stage the version, publish it under the lock, and always remove an
+// unpublished stage, including after Ctrl-C or SIGTERM.
+function deliverPayload(...args: Parameters<typeof stageSyncPayload>): Effect.Effect<SyncDiskResult, unknown> {
+  return Effect.acquireUseRelease(
+    attempt(() => stageSyncPayload(...args)),
+    staged => holdSyncLock(staged.appRoot, attempt(staged.publish)).pipe(
+      Effect.map(warnings => ({ destination: staged.destination, wasPresent: staged.wasPresent, warnings })),
+    ),
+    staged => Effect.sync(staged.discard),
+  )
+}
+
+async function runOrThrow<A>(program: Effect.Effect<A, unknown>, signal: AbortSignal): Promise<A> {
+  const exit = await Effect.runPromiseExit(program, { signal })
+  if (Exit.isSuccess(exit)) return exit.value
+  throw Cause.squash(exit.cause)
+}
+
+// `once`: a second signal falls through to Node's default kill.
+async function runDelivery<A>(program: (signal: AbortSignal) => Effect.Effect<A, unknown>): Promise<A | Interrupted> {
+  const controller = new AbortController()
+  let interrupted: Interrupted['interrupted'] | undefined
+  const handleInterrupt = () => { interrupted ??= 130; controller.abort() }
+  const handleTerminate = () => { interrupted ??= 143; controller.abort() }
+  process.once('SIGINT', handleInterrupt)
+  process.once('SIGTERM', handleTerminate)
+  try {
+    return await runOrThrow(program(controller.signal), controller.signal)
+  } catch (error) {
+    if (interrupted !== undefined) return { interrupted }
+    throw error
+  } finally {
+    process.removeListener('SIGINT', handleInterrupt)
+    process.removeListener('SIGTERM', handleTerminate)
+  }
+}
+
+export function syncInstructionSet(out: string, project: string, plan: SyncRequestPlan, options: SyncDiskOptions) {
+  return runDelivery(() => Effect.gen(function*() {
+    const payload = yield* readPayload(plan.path, 'Instruction sets sync')
+    const result = yield* deliverPayload(out, project, plan, payload, options)
+    return { payload, result }
+  }))
+}
+
+export function updateInstructionSets(
+  out: string,
+  project: string,
+  isApproved: boolean,
+  noSync: boolean,
+): Promise<{ plan: UpdatePlan; result: UpdateResult } | Interrupted> {
+  const program = (signal: AbortSignal) => Effect.gen(function*() {
+    const lock = yield* attempt(() => readUpdateLock(out, project))
+    const payloads: SyncPayload[] = []
+    for (const [setSlug, set] of Object.entries(lock.instructionSets)) {
+      const barePath = `/api/cli/instruction-sets/${encodeURIComponent(setSlug)}/sync?project=${encodeURIComponent(project)}`
+      payloads.push(yield* readPayload(barePath, 'Instruction sets update'))
+      for (const profileSlugValue of Object.keys(set.profiles)) {
+        const identity = yield* attempt(() => lockedProfileIdentity(out, setSlug, profileSlugValue))
+        const query = new URLSearchParams({ project, profile: identity })
+        const path = `/api/cli/instruction-sets/${encodeURIComponent(setSlug)}/sync?${query.toString()}`
+        payloads.push(yield* readPayload(path, 'Instruction sets update'))
+      }
+    }
+    const plan = yield* attempt(() => makeUpdatePlan(project, lock, payloads))
+    if (!isApproved) return { plan, result: { absent: [], warnings: [] } }
+    // applyUpdate's own steps are not interruptible; each version it syncs is
+    // a nested delivery that the shared signal interrupts and cleans up.
+    const result = yield* Effect.uninterruptible(Effect.tryPromise({
+      try: () => applyUpdate(out, project, plan, noSync, undefined,
+        (...args) => runOrThrow(deliverPayload(...args), signal)),
+      catch: cause => cause,
+    }))
+    return { plan, result }
+  })
+  // --no-sync stages nothing to clean up, so keep Node's default signal
+  // handling: a signal stops it at once instead of being held until the
+  // update has already landed.
+  if (noSync) {
+    const signal = new AbortController().signal
+    return runOrThrow(program(signal), signal)
+  }
+  return runDelivery(program)
+}