orizu 0.5.40 → 0.5.41

package/src/dataset-commands.ts

@@ -22,7 +22,6 @@ import {
 } from './account-directory.js'
 import { sanitizeTerminalText, parseJsonResponse } from './json-response.js'
 import { authedFetch } from './http.js'
-import { extractErrorMessage } from './error-response.js'
 import { printJson, printLine } from './cli-console-output.js'
 import { readJsonFile } from './app-commands.js'
 import { printDatasetSummaries } from './archive-artifacts-cli.js'
@@ -36,15 +35,6 @@ import type { DatasetSelection } from './account-directory.js'
 
 const MAX_README_LENGTH = 200_000
 
-interface DatasetVersionResponse {
-  datasetVersion: {
-    id: string
-    rowCount: number
-    artifactFormat?: string
-    artifactStoragePath?: string
-  }
-}
-
 function readReadmeFile(readmeFile: string): string {
   try {
     return readFileSync(expandHomePath(readmeFile), 'utf8')
@@ -127,28 +117,6 @@ async function resolveDatasetIdForProject(datasetRef: string, projectArg: string
   return matches[0].id
 }
 
-async function requestDatasetVersionSnapshot(
-  datasetId: string,
-  options: { versionLabel?: string | null; readmeMarkdown?: string | null } = {}
-): Promise<DatasetVersionResponse> {
-  const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/versions`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      ...(options.versionLabel ? { versionLabel: options.versionLabel } : {}),
-      ...(options.readmeMarkdown !== undefined && options.readmeMarkdown !== null
-        ? { readmeMarkdown: options.readmeMarkdown }
-        : {}),
-    }),
-  })
-
-  if (!response.ok) {
-    throw new Error(`Failed to create dataset version: ${await extractErrorMessage(response)}`)
-  }
-
-  return parseJsonResponse<DatasetVersionResponse>(response, 'Dataset version create')
-}
-
 async function createDatasetVersion() {
   const datasetId = getPositionalArg(3) || getArg('--dataset')
   const versionLabel = getArg('--label') || getArg('--version-label') || null
@@ -161,7 +129,8 @@ async function createDatasetVersion() {
 
   const readmeMarkdown = readReadmeMarkdownFromArgs(usage)
   const resolvedDatasetId = await resolveDatasetIdForProject(datasetId, project)
-  const data = await requestDatasetVersionSnapshot(resolvedDatasetId, {
+  const { createDatasetVersionSnapshot } = await import('./dataset-version-workflow.js')
+  const data = await createDatasetVersionSnapshot(resolvedDatasetId, {
     versionLabel,
     readmeMarkdown,
   })
@@ -627,31 +596,15 @@ async function cloneDataset() {
     datasetId = selected.datasetId
   }
 
-  const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/clone`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(name ? { name } : {}),
-  })
-
-  if (!response.ok) {
-    throw new Error(`Clone failed: ${await response.text()}`)
-  }
-
-  const data = await parseJsonResponse<{
-    dataset: {
-      id: string
-      name: string
-      rowCount: number
-      parentDatasetId: string
-    }
-  }>(response, 'Dataset clone')
+  const { cloneDataset: requestClone } = await import('./dataset-clone-workflow.js')
+  const dataset = await requestClone(datasetId, name ?? null)
 
   if (hasJsonFlag()) {
-    printJson({ dataset: data.dataset })
+    printJson({ dataset })
     return
   }
   printLine(
-    `Cloned dataset ${sanitizeTerminalText(data.dataset.parentDatasetId)} -> ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}). Row count: ${data.dataset.rowCount}`
+    `Cloned dataset ${sanitizeTerminalText(dataset.parentDatasetId)} -> ${sanitizeTerminalText(dataset.name)} (${sanitizeTerminalText(dataset.id)}). Row count: ${dataset.rowCount}`
   )
 }
 

package/src/dataset-transfer-upload.ts

@@ -2,6 +2,7 @@ import { Context, Effect, Layer, Result } from 'effect'
 
 import { ensureDatasetUploadSnapshot } from './dataset-upload-snapshot.js'
 import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js'
+import { datasetVersionSnapshot, type DatasetVersionFailure, type DatasetVersionResponse } from './dataset-version-workflow.js'
 import { extractErrorMessage } from './error-response.js'
 import { authedFetch } from './http.js'
 import { parseJsonResponse, sanitizeTerminalText } from './json-response.js'
@@ -12,7 +13,6 @@ export interface DatasetUploadResponse {
   readmeVersion?: { id: string; version_num: number; created_at: string } | null
 }
 
-interface DatasetSnapshot { datasetVersion: { id: string } }
 interface DatasetAppendResponse { dataset: { id: string; name: string; rowCount: number }; appendedCount: number }
 type UploadRows = Array<Record<string, unknown>>
 type UploadSource = { kind: 'jsonl'; file: string } | { kind: 'rows'; rows: UploadRows; sourceType: 'csv' | 'json' | 'jsonl' }
@@ -41,10 +41,17 @@ class DatasetInputFailure extends Error {
 interface DatasetUploadApi {
   create: (rows: UploadRows, sourceType: string) => Effect.Effect<DatasetUploadResponse, DatasetWriteFailure>
   append: (id: string, rows: UploadRows) => Effect.Effect<DatasetAppendResponse, DatasetWriteFailure>
-  snapshot: (id: string) => Effect.Effect<DatasetSnapshot, DatasetWriteFailure>
+  snapshot: (id: string) => Effect.Effect<DatasetVersionResponse, DatasetVersionFailure>
 }
 const DatasetUploadApi = Context.Service<DatasetUploadApi>('orizu/DatasetUploadApi')
 
+// authedFetch raises this code only when it sent nothing, or after the server
+// answered 401 (it writes nothing) and the stored credentials changed, so it
+// refused to replay. Either way nothing was written (ORI-2431).
+function isAuthContextChange(cause: unknown) {
+  return cause instanceof Error && cause.message.startsWith('ORIZU_AUTH_CONTEXT_CHANGED:')
+}
+
 // Only the existing authentication client's rejected-token refresh may replay a
 // request. No transient/transport retries belong around these non-idempotent writes.
 function post<T>(path: string, body: unknown, context: string, prefix: string, timeoutMs: number): Effect.Effect<T, DatasetWriteFailure> {
@@ -62,7 +69,7 @@ function post<T>(path: string, body: unknown, context: string, prefix: string, t
         return await parseJsonResponse<T>(response, context)
       },
       catch: cause => cause instanceof DatasetWriteFailure ? cause : new DatasetWriteFailure(
-        cause instanceof Error ? cause.message : String(cause), requestStarted ? 'unknown' : 'rejected', { cause },
+        cause instanceof Error ? cause.message : String(cause), requestStarted && !isAuthContextChange(cause) ? 'unknown' : 'rejected', { cause },
       ),
     }).pipe(Effect.timeoutOrElse({
       duration: timeoutMs,
@@ -79,7 +86,7 @@ function liveUploadApi(options: DatasetUploadOptions) {
       ...(options.readmeMarkdown !== null ? { readmeMarkdown: options.readmeMarkdown } : {}),
     }, 'Dataset upload', 'Upload failed', timeoutMs),
     append: (id, rows) => post<DatasetAppendResponse>(`/api/cli/datasets/${encodeURIComponent(id)}/rows`, { rows }, 'Dataset append', 'Append failed', timeoutMs),
-    snapshot: id => post<DatasetSnapshot>(`/api/cli/datasets/${encodeURIComponent(id)}/versions`, {}, 'Dataset version create', 'Failed to create dataset version', timeoutMs),
+    snapshot: id => datasetVersionSnapshot(id, {}, timeoutMs),
   })
 }
 
@@ -140,6 +147,6 @@ function uploadProgram(options: DatasetUploadOptions) {
   })
 }
 
-export function transferDatasetUpload(options: DatasetUploadOptions): Promise<{ data: DatasetUploadResponse; version: DatasetSnapshot }> {
+export function transferDatasetUpload(options: DatasetUploadOptions): Promise<{ data: DatasetUploadResponse; version: DatasetVersionResponse }> {
   return expectedPromise(uploadProgram(options).pipe(Effect.scoped, Effect.provide(liveUploadApi(options))))
 }

package/src/dataset-upload-snapshot.ts

@@ -1,3 +1,5 @@
+import { DatasetVersionFailure, VERSION_MAY_BE_CREATED } from './dataset-version-workflow.js'
+
 interface UploadedDatasetIdentity {
   id: string
   name: string
@@ -20,6 +22,8 @@ export async function ensureDatasetUploadSnapshot<T extends DatasetVersionSnapsh
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error)
     const retryCommand = `orizu datasets versions create --dataset ${dataset.id}`
+    // After an unclear outcome the version may exist; check before retrying.
+    const mayBeCreated = error instanceof DatasetVersionFailure && error.mayBeCreated
 
     if (jsonOutput) {
       throw new Error(JSON.stringify({
@@ -29,13 +33,16 @@ export async function ensureDatasetUploadSnapshot<T extends DatasetVersionSnapsh
         dataset_id: dataset.id,
         dataset_version_id: null,
         retry_command: retryCommand,
+        ...(mayBeCreated ? { may_be_created: true } : {}),
       }))
     }
 
     throw new Error(
       `Dataset upload completed but dataset version creation failed: ${detail}\n` +
       `Dataset ${dataset.name} (${dataset.id}) was created with ${dataset.rowCount} rows. ` +
-      `Retry only the snapshot step with: ${retryCommand}`
+      (mayBeCreated
+        ? `${VERSION_MAY_BE_CREATED} If it is not there, create it with: ${retryCommand}`
+        : `Retry only the snapshot step with: ${retryCommand}`)
     )
   }
 }

package/src/dataset-version-workflow.ts

@@ -0,0 +1,105 @@
+import { Cause, Effect, Exit, Result, Schema } from 'effect'
+
+import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js'
+import { extractErrorMessage, isJsonErrorResponsePayload } from './error-response.js'
+import { authedFetch } from './http.js'
+import { parseJsonResponse } from './json-response.js'
+
+// Loaded only through `await import(...)`, like the README and delete workflows.
+
+export const VERSION_MAY_BE_CREATED = "The version may already be created: check the dataset's versions in the web app before creating it again."
+// What the server says when it cannot tell whether the version was saved.
+const SERVER_MAY_BE_CREATED = 'Dataset version may already be created'
+
+const CreateReply = Schema.Struct({
+  datasetVersion: Schema.Struct({
+    id: Schema.NonEmptyString,
+    rowCount: Schema.Number,
+    artifactFormat: Schema.optional(Schema.String),
+    artifactStoragePath: Schema.optional(Schema.String),
+  }),
+})
+
+export type DatasetVersionResponse = typeof CreateReply.Type
+
+export interface DatasetVersionRequest {
+  versionLabel?: string | null
+  readmeMarkdown?: string | null
+}
+
+// The version may exist when the server says so, when the reply was lost or
+// unreadable after the request was sent, or when a 5xx did not come from the
+// app (a gateway giving up while the app kept working). Any other error reply
+// is a clear refusal.
+export class DatasetVersionFailure extends Error {
+  readonly _tag = 'DatasetVersionFailure'
+  constructor(message: string, readonly mayBeCreated: boolean) { super(message) }
+}
+
+async function appErrorOf(response: Response): Promise<string | null> {
+  try {
+    const payload: unknown = await response.json()
+    return isJsonErrorResponsePayload(response, payload) ? payload.error : null
+  } catch {
+    return null
+  }
+}
+
+// One request, never retried: a retry after an unknown outcome could add a
+// second version.
+export function datasetVersionSnapshot(datasetId: string, options: DatasetVersionRequest, timeoutMs: number): Effect.Effect<DatasetVersionResponse, DatasetVersionFailure> {
+  return Effect.suspend(() => {
+    let sent = false
+    let timedOut = false
+    return Effect.tryPromise({
+      try: async signal => {
+        const request = new AbortController()
+        const abort = () => request.abort()
+        const timer = setTimeout(() => { timedOut = true; request.abort() }, timeoutMs)
+        if (signal.aborted) abort()
+        else signal.addEventListener('abort', abort, { once: true })
+        try {
+          const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/versions`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              ...(options.versionLabel ? { versionLabel: options.versionLabel } : {}),
+              ...(options.readmeMarkdown !== undefined && options.readmeMarkdown !== null
+                ? { readmeMarkdown: options.readmeMarkdown }
+                : {}),
+            }),
+            signal: request.signal,
+          }, () => { sent = true })
+          if (!response.ok) {
+            const serverError = await appErrorOf(response.clone())
+            const message = `Failed to create dataset version: ${await extractErrorMessage(response)}`
+            throw new DatasetVersionFailure(message, response.status < 400 || serverError === SERVER_MAY_BE_CREATED || (response.status >= 500 && serverError === null))
+          }
+          const data = await parseJsonResponse<unknown>(response, 'Dataset version create')
+          const decoded = Schema.decodeUnknownResult(CreateReply)(data)
+          if (Result.isFailure(decoded)) {
+            throw new DatasetVersionFailure(`Dataset version create returned an unexpected response (status ${response.status}).`, true)
+          }
+          return decoded.success
+        } finally {
+          clearTimeout(timer)
+          signal.removeEventListener('abort', abort)
+          request.abort()
+        }
+      },
+      catch: cause => {
+        if (timedOut) return new DatasetVersionFailure('DATASET_TRANSFER_TIMEOUT: Dataset version create exceeded its deadline', sent)
+        if (cause instanceof DatasetVersionFailure) return cause
+        return new DatasetVersionFailure(cause instanceof Error ? cause.message : String(cause), sent)
+      },
+    })
+  })
+}
+
+export async function createDatasetVersionSnapshot(datasetId: string, options: DatasetVersionRequest): Promise<DatasetVersionResponse> {
+  const exit = await Effect.runPromiseExit(datasetVersionSnapshot(datasetId, options, datasetTransferTimeoutMs()).pipe(
+    Effect.mapError(failure => new Error(failure.mayBeCreated ? `${failure.message}\n${VERSION_MAY_BE_CREATED}` : failure.message)),
+  ))
+  if (Exit.isSuccess(exit)) return exit.value
+  throw Cause.squash(exit.cause)
+}

package/src/feedback-cli.ts

@@ -419,15 +419,15 @@ function resolveProjectContext(
   return { teamSlug: workspaceTeam, projectSlug: null }
 }
 
-function lastErrorForContext(
+async function lastErrorForContext(
   configDirectory: string,
   serverBaseUrl: string,
   teamSlug: string | null,
   now: number,
   printErr: (message: string) => void,
   scrubNotice: (message: string) => string
-): LastErrorRecord | null {
-  const record = readLastErrorRecord(configDirectory)
+): Promise<LastErrorRecord | null> {
+  const record = await readLastErrorRecord(configDirectory)
   if (!record || !isLastErrorRecordShape(record)) return null
   if (teamSlug === null) {
     printErr('last error not attached: no team context')
@@ -633,7 +633,7 @@ export async function feedbackCommand(args: string[], io: FeedbackCliIo): Promis
     const values = { ...fromFile, ...parsed.values }
     const lastError = parsed.suppressLastError
       ? null
-      : lastErrorForContext(
+      : await lastErrorForContext(
         configDirectory,
         baseUrl,
         projectContext.teamSlug,

package/src/hosted-harness-opencode.ts

@@ -66,13 +66,13 @@ import type {
 } from './hosted-harness.js'
 
 // OpenCode is HARD-PINNED to this version everywhere it is installed/launched.
-// AUDIT RISK #1 (SSE fragility): the entire event model rides OpenCode's
-// undocumented `/event` SSE part schema (`message.part.updated`, `session.idle`,
-// `session.error`, `session.updated`, ...). Versions newer than 1.14.41 broke
-// that stream upstream, so the pin is load-bearing and must be re-verified
-// before any bump. The AgentHarness seam is the mitigation of last resort: swap
-// to a Claude-Agent-SDK loop (ALI-929) rather than chase OpenCode's SSE.
-export const OPENCODE_PINNED_VERSION = '1.14.41'
+// The event model rides OpenCode's undocumented `/event` SSE part schema
+// (`message.part.updated`, `session.idle`, `session.error`, `session.updated`,
+// ...), so every bump must pass test/cli/hosted-opencode-contract-real.test.ts
+// against the real binary (the path-gated `opencode-real` CI job runs it when
+// this pin changes). 1.14.41 → 1.18.35 was measured and checked that way
+// (ORI-2523). The AgentHarness seam remains the mitigation of last resort.
+export const OPENCODE_PINNED_VERSION = '1.18.35'
 
 const DEFAULT_OPENCODE_PORT = 4096
 const DEFAULT_SSE_INACTIVITY_MS = 120_000

package/src/hosted-loop-lifecycle.ts

@@ -32,8 +32,9 @@ import type { HostedSessionOrigin } from './hosted-runtime-assets.js'
  * re-inline it.
  *
  * PIN CONSTRAINT: the hosted OpenCode runtime is HARD-PINNED to
- * `opencode-ai@1.14.41` (`OPENCODE_PINNED_VERSION`, SSE-fragile — do not bump)
- * whose bundled catalog predates this model. Images bake a validated models.dev
+ * `OPENCODE_PINNED_VERSION` (opencode-ai@1.18.35, whose bundled catalog
+ * includes this model; bumps are checked by the real-binary contract test,
+ * ORI-2523). Images also bake a validated models.dev
  * list into the runtime user's cache. Orizu refreshes that cache before spawning
  * OpenCode, preserving baked models on failure; the native unchecked writer is
  * disabled (ORI-2513). Pre-prompt validation still checks the running server.

package/src/hosted-loop.ts

@@ -328,14 +328,22 @@ function detectLoopPrebaked(flag: boolean | undefined, markerPath: string): bool
 }
 
 /** Best-effort global install of the pinned opencode. Non-fatal: a failure is
- *  recorded and the run finishes cleanly when the subsequent connect fails. */
-function installOpenCodePinned(version: string): InstallResult {
+ *  recorded and the run finishes cleanly when the subsequent connect fails.
+ *  From 1.18 opencode's postinstall script writes the `opencode` command, and
+ *  npm 12 blocks it unless allowed, leaving a placeholder that exits 1; so npm
+ *  allows that one script and the result must print the pinned version
+ *  (ORI-2523). `env` exists for tests. */
+export function installOpenCodePinned(version: string, env?: NodeJS.ProcessEnv): InstallResult {
   const command =
-    `bun add -g opencode-ai@${version} >/dev/null 2>&1 || ` +
-    `npm install -g opencode-ai@${version} >/dev/null 2>&1`
-  const res = spawnSync('bash', ['-c', command], { encoding: 'utf8' })
+    `{ bun add -g opencode-ai@${version} >/dev/null 2>&1 || ` +
+    `npm install -g --allow-scripts=opencode-ai opencode-ai@${version} >/dev/null 2>&1; } && ` +
+    `v="$(opencode --version 2>/dev/null)" && [ "$v" = '${version}' ]`
+  const res = spawnSync('bash', ['-c', command], { encoding: 'utf8', ...(env ? { env } : {}) })
   const ok = (res.status ?? 1) === 0
-  return { ok, detail: ok ? `installed opencode-ai@${version}` : `install exit ${res.status ?? 'unknown'}` }
+  return {
+    ok,
+    detail: ok ? `installed opencode-ai@${version}` : `install exit ${res.status ?? 'unknown'}, or opencode --version is not ${version}`,
+  }
 }
 
 /** Node child_process spawner for `opencode serve` (the sandbox runtime is

package/src/index.ts

@@ -2262,10 +2262,10 @@ function isCliEntrypoint(): boolean {
 if (isCliEntrypoint()) {
   const rawArgs = process.argv.slice(2)
   withPassiveUpdateNotice(rawArgs, getCliVersion, printError, args =>
-    main(args).catch(error => {
+    main(args).catch(async error => {
       const message = error instanceof Error ? error.message : 'Unknown error'
       // The reporter email is unknown on the failure path, so the record masks every address.
-      writeLastErrorRecord({
+      await writeLastErrorRecord({
         argv: args,
         message,
         code: extractLastErrorCode(error),

package/src/last-error-record.ts

@@ -1,16 +1,3 @@
-import { randomBytes } from 'crypto'
-import {
-  chmodSync,
-  closeSync,
-  fsyncSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  statSync,
-  writeFileSync,
-} from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
 
@@ -235,7 +222,7 @@ function resolveHomeDir(): string | null {
   }
 }
 
-function isStringWithinCap(
+export function isStringWithinCap(
   value: unknown,
   maximumCharacters: number,
   wasTruncated: boolean
@@ -247,45 +234,12 @@ function isStringWithinCap(
     && value.endsWith(LAST_ERROR_TRUNCATION_MARKER)
 }
 
-function boundedServerBaseUrl(value: string | null | undefined): string | null {
+export function boundedServerBaseUrl(value: string | null | undefined): string | null {
   return value && Buffer.byteLength(value, 'utf8') <= LAST_ERROR_SERVER_BASE_URL_MAX_BYTES
     ? value
     : null
 }
 
-function isLastErrorRecord(value: unknown): value is LastErrorRecord {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
-  const record = value as Partial<LastErrorRecord>
-  if (record.version !== LAST_ERROR_RECORD_VERSION) return false
-  if (typeof record.recordedAt !== 'string' || !Number.isFinite(Date.parse(record.recordedAt))) return false
-  if (typeof record.cliVersion !== 'string' && record.cliVersion !== null) return false
-  if (record.code !== undefined && record.code !== null && (
-    typeof record.code !== 'string'
-    || Array.from(record.code).length > LAST_ERROR_CODE_MAX_CHARS
-  )) return false
-  if (record.serverBaseUrl !== undefined && typeof record.serverBaseUrl !== 'string' && record.serverBaseUrl !== null) return false
-  if (record.teamSlug !== undefined && typeof record.teamSlug !== 'string' && record.teamSlug !== null) return false
-  if (typeof record.argvTruncated !== 'boolean') return false
-  const argvTruncated = record.argvTruncated
-  if (record.command !== null && !isStringWithinCap(
-    record.command,
-    LAST_ERROR_ARG_MAX_CHARS,
-    argvTruncated
-  )) return false
-  if (!Array.isArray(record.argv) || record.argv.length > LAST_ERROR_MAX_ARGS) return false
-  if (!record.argv.every(argument => isStringWithinCap(
-    argument,
-    LAST_ERROR_ARG_MAX_CHARS,
-    argvTruncated
-  ))) return false
-  if (typeof record.messageTruncated !== 'boolean') return false
-  return isStringWithinCap(
-    record.message,
-    LAST_ERROR_MESSAGE_MAX_CHARS,
-    record.messageTruncated
-  )
-}
-
 export function buildLastErrorRecord(input: LastErrorRecordInput): LastErrorRecord {
   const context: ScrubContext = {
     homeDir: input.homeDir ?? null,
@@ -350,15 +304,12 @@ export function getLastErrorRecordPath(configDir?: string): string {
   return join(configDir ?? getConfigDir(), LAST_ERROR_FILENAME)
 }
 
-export function writeLastErrorRecord(
+export async function writeLastErrorRecord(
   input: LastErrorRecordInput,
   options: WriteLastErrorRecordOptions = {}
-): void {
+): Promise<void> {
   try {
     const configDirectory = options.configDir ?? getConfigDir()
-    mkdirSync(configDirectory, { recursive: true, mode: 0o700 })
-    chmodSync(configDirectory, 0o700)
-
     const record = buildLastErrorRecord({
       ...input,
       homeDir: input.homeDir === undefined ? resolveHomeDir() : input.homeDir,
@@ -371,44 +322,19 @@ export function writeLastErrorRecord(
     const serialized = serializeRecord(record)
     if (Buffer.byteLength(serialized, 'utf8') > LAST_ERROR_FILE_MAX_BYTES) return
 
-    const path = getLastErrorRecordPath(configDirectory)
-    const temporaryPath = join(
-      configDirectory,
-      `.${LAST_ERROR_FILENAME}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`
-    )
-
-    try {
-      const fileDescriptor = openSync(temporaryPath, 'wx', 0o600)
-      try {
-        writeFileSync(fileDescriptor, serialized, 'utf8')
-        fsyncSync(fileDescriptor)
-      } finally {
-        closeSync(fileDescriptor)
-      }
-      chmodSync(temporaryPath, 0o600)
-      renameSync(temporaryPath, path)
-      chmodSync(path, 0o600)
-    } finally {
-      rmSync(temporaryPath, { force: true })
-    }
+    const { publishLastErrorRecord } = await import('./last-error-workflow.js')
+    await publishLastErrorRecord(configDirectory, serialized)
   } catch {
-    // A diagnostic record is best effort and must never replace the original CLI failure.
+    // A diagnostic record is best effort and must never replace the original CLI failure,
+    // including when Effect cannot load (a packed CLI without its dependencies).
   }
 }
 
-export function readLastErrorRecord(configDir?: string): LastErrorRecord | null {
+export async function readLastErrorRecord(configDir?: string): Promise<LastErrorRecord | null> {
   try {
     const path = getLastErrorRecordPath(configDir)
-    if (statSync(path).size > LAST_ERROR_FILE_MAX_BYTES) return null
-    const record = JSON.parse(readFileSync(path, 'utf8')) as unknown
-    return isLastErrorRecord(record)
-      ? {
-          ...record,
-          code: record.code ?? null,
-          serverBaseUrl: boundedServerBaseUrl(record.serverBaseUrl),
-          teamSlug: record.teamSlug ?? null,
-        }
-      : null
+    const { loadLastErrorRecord } = await import('./last-error-workflow.js')
+    return await loadLastErrorRecord(path)
   } catch {
     return null
   }