orizu 0.5.41 → 0.5.42

package/dist/hosted-boot.js

@@ -30,7 +30,8 @@
  * non-secret ANTHROPIC_API_KEY dummy placeholder (firewall brokers the real key).
  */
 import { spawnSync } from 'child_process';
-import { closeSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeSync } from 'fs';
+import { randomUUID } from 'crypto';
+import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeSync } from 'fs';
 import { isValidCloudflareArtifactsGitRemote } from './cloudflare-artifacts-git-remote.js';
 import { seedSessionCopy } from './hosted-session-seed.js';
 import { AGENT_GIT_IDENTITY, BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, REPO_CRED_CACHE_BASENAME, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
@@ -39,6 +40,7 @@ import { DEFAULT_EGRESS_CANARY_HOST, DEFAULT_HOSTED_MODEL } from './hosted-loop-
 import { composeHostedAnswerPrompt } from './hosted-question.js';
 import { resumeRunEventSink } from './hosted-run-event-sink.js';
 import { stageOrizuSkill } from './hosted-skill-staging.js';
+import { openHostedLiveChannel } from './hosted-live-channel.js';
 /** Non-secret placeholder model key (firewall brokers the real org key on
  *  egress). Byte-for-byte the operator path's constant
  *  (packages/cli/src/hosted-session-cli.ts `ANTHROPIC_DUMMY_KEY` and the
@@ -314,7 +316,7 @@ function asPositiveNumber(value) {
 /** GET the session (agent-capable, RLS-scoped) to learn its workspace, branch,
  *  task, and any existing run — the DO start body carries none of these. */
 export async function resolveSession(opts) {
-    const body = await bearerJson(opts.fetchImpl, `${opts.baseUrl}/api/cli/sessions/${encodeURIComponent(opts.sessionId)}`, opts.bearer, opts.signal ? { signal: opts.signal } : {});
+    const body = await bearerJson(opts.fetchImpl, `${opts.baseUrl}/api/cli/sessions/${encodeURIComponent(opts.sessionId)}`, opts.bearer, { headers: { 'X-Orizu-Session-Seed-Protocol': '1' }, ...(opts.signal ? { signal: opts.signal } : {}) });
     const session = (body.session ?? {});
     const workspaceId = asString(session.workspaceId);
     if (!workspaceId)
@@ -322,6 +324,8 @@ export async function resolveSession(opts) {
     const repoBranch = asString(session.repoBranch);
     if (!repoBranch)
         throw new Error('session response carried no repoBranch (branch not provisioned)');
+    if (session.seedOrigin !== undefined && session.seedOrigin !== 'team' && session.seedOrigin !== 'session')
+        throw new Error('session response carried invalid seedOrigin');
     const clientInfo = (session.clientInfo ?? {});
     const initialTask = asString(clientInfo.task);
     if (!initialTask)
@@ -374,6 +378,8 @@ export async function resolveSession(opts) {
         pendingTurn: unfinishedRun ? pendingTurn : null,
         interruptRequestedRunId: asString(session.interruptRequestedRunId),
         agentSessionId: asString(session.agentSessionId),
+        // A server with copying switched off omits seedOrigin; no source is bound.
+        seedOrigin: session.seedOrigin === 'session' ? 'session' : 'team',
         projectId: asString(session.projectId),
     };
 }
@@ -383,6 +389,44 @@ export const HOSTED_SESSION_DEFAULT_POLL_MS = 5_000;
 export async function waitForNextHostedSessionRead(sleep, pollMs = HOSTED_SESSION_DEFAULT_POLL_MS) {
     await sleep(pollMs);
 }
+function sleepUntil(signal) {
+    return (ms) => new Promise(resolve => {
+        if (signal.aborted) {
+            resolve();
+            return;
+        }
+        const timer = setTimeout(finish, ms);
+        const handleAbort = () => finish();
+        function finish() {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', handleAbort);
+            resolve();
+        }
+        signal.addEventListener('abort', handleAbort, { once: true });
+    });
+}
+/** ORI-2200: wait for the next session read, or less when the coordinator says
+ *  "check now". The read still decides what happens; a check alone does nothing. */
+async function waitForReadOrCheck(opts) {
+    if (!opts.live) {
+        await waitForNextHostedSessionRead(opts.sleep ?? sleepUntil(opts.signal), opts.pollMs);
+        return;
+    }
+    const woken = new AbortController();
+    const wait = AbortSignal.any([opts.signal, woken.signal]);
+    await Promise.race([
+        waitForNextHostedSessionRead(opts.sleep ?? sleepUntil(wait), opts.pollMs),
+        opts.live.nextCheck(wait),
+    ]);
+    woken.abort();
+}
+/** The sandbox's live-socket pass route sits beside its agent-token route. */
+export function deriveLiveSandboxPassUrl(agentTokenUrl) {
+    if (/\/agent-token\/?$/.test(agentTokenUrl)) {
+        return agentTokenUrl.replace(/\/agent-token\/?$/, '/live/sandbox-pass');
+    }
+    return `${agentTokenUrl.replace(/\/+$/, '')}/live/sandbox-pass`;
+}
 /** Ride the ALI-1757 session/pending-turn poll while one prompt is active.
  *  This uses the same additive session GET contract, but deliberately shares
  *  none of the between-turn credential cleanup or mint-on-401 behavior: the
@@ -396,20 +440,6 @@ export async function pollHostedSessionDuringTurn(opts) {
     };
     const readFile = opts.readFile ?? ((path) => readFileSync(path, 'utf8'));
     const pollMs = opts.pollMs ?? HOSTED_SESSION_DEFAULT_POLL_MS;
-    const sleep = opts.sleep ?? ((ms) => new Promise(resolve => {
-        if (opts.signal.aborted) {
-            resolve();
-            return;
-        }
-        const timer = setTimeout(finish, ms);
-        const handleAbort = () => finish();
-        function finish() {
-            clearTimeout(timer);
-            opts.signal.removeEventListener('abort', handleAbort);
-            resolve();
-        }
-        opts.signal.addEventListener('abort', handleAbort, { once: true });
-    }));
     while (!opts.signal.aborted) {
         try {
             const latest = await resolveSession({
@@ -444,8 +474,9 @@ export async function pollHostedSessionDuringTurn(opts) {
             // enter logs. A transient read failure cannot fail the running turn.
             diagnose('hosted interrupt poll failed; retrying');
         }
-        if (!opts.signal.aborted)
-            await waitForNextHostedSessionRead(sleep, pollMs);
+        if (!opts.signal.aborted) {
+            await waitForReadOrCheck({ signal: opts.signal, pollMs, sleep: opts.sleep, live: opts.live });
+        }
     }
 }
 /** Reuse an existing run or start one with the AGENT bearer (actor_type='agent'),
@@ -498,7 +529,7 @@ export async function resolveTeamRemote(opts) {
     const url = `${opts.baseUrl}/api/cli/workspaces/${encodeURIComponent(opts.workspaceId)}/repo-token`;
     const minted = await bearerJson(opts.fetchImpl, url, opts.bearer, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', 'X-Orizu-Session-Seed-Protocol': '1' },
         body: JSON.stringify({ purpose: 'team_read', sessionId: opts.sessionId }),
     });
     const remote = asString(minted.remote);
@@ -552,6 +583,30 @@ const defaultExec = (cmd, args, opts) => {
     const res = spawnSync(cmd, args, { cwd: opts?.cwd, encoding: 'utf8' });
     return { status: res.status ?? 1, stdout: res.stdout ?? '', stderr: res.stderr ?? '' };
 };
+/** ORI-2520: the repo on a woken disk must be this session's: a repository
+ *  at the folder's top with the session's remote and a commit checked out
+ *  (detached is fine). Which branch is checked out is not checked: each
+ *  turn's save pushes the current commit to the session branch whatever is
+ *  checked out, so an agent may have left another branch (or none) checked
+ *  out. Returns that branch for the log. */
+function assertWokenRepo(exec, workspaceDir, remote) {
+    const read = (...args) => {
+        const result = exec('git', ['-C', workspaceDir, ...args]);
+        return result.status === 0 ? result.stdout.trim() : null;
+    };
+    if (read('rev-parse', '--git-dir') !== '.git') {
+        throw new Error('woken disk: the repo folder holds no repository of its own');
+    }
+    // The configured value, not `remote get-url`, which applies url rewrites.
+    if (read('config', '--get', 'remote.origin.url') !== remote) {
+        throw new Error("woken disk: the repo's remote is not this session's");
+    }
+    // A clone cut off before any commit was checked out has no saved work.
+    if (read('rev-parse', '--verify', '--quiet', 'HEAD^{commit}') === null) {
+        throw new Error('woken disk: the repo has no commit checked out');
+    }
+    return read('rev-parse', '--abbrev-ref', 'HEAD') ?? 'no branch';
+}
 /** Values interpolated into git's credential.helper string / clone args must be
  *  benign. We pass everything via execFile-style arg arrays (no shell), but
  *  still reject anything with newlines/control chars as defense in depth. */
@@ -588,6 +643,20 @@ class HostedTurnFailure extends Error {
  * provider fed by the same pull-mode source. Returns the loop's terminal status.
  */
 export async function runHostedBoot(opts) {
+    // ORI-2200: the sandbox's live socket, opened once the boot first waits for
+    // work and closed however the boot ends.
+    const liveChannels = [];
+    const idleWait = new AbortController();
+    try {
+        return await runHostedBootWithLive(opts, liveChannels, idleWait.signal);
+    }
+    finally {
+        idleWait.abort();
+        for (const channel of liveChannels)
+            channel.close();
+    }
+}
+async function runHostedBootWithLive(opts, liveChannels, idleWaitSignal) {
     const env = opts.env;
     const processEnv = opts.processEnv ?? process.env;
     const root = opts.root ?? process.cwd();
@@ -668,6 +737,22 @@ export async function runHostedBoot(opts) {
             attemptTimeoutMs: turnStatusAttemptTimeoutMs,
         });
     }
+    // The coordinator says "check now" over this socket when someone presses
+    // Stop or sends a message, so the waits below need not run their full
+    // interval. Best effort: without it the regular reads still run.
+    let liveChannel = null;
+    const openLive = () => {
+        if (!liveChannel) {
+            liveChannel = openHostedLiveChannel({
+                sandboxPassUrl: deriveLiveSandboxPassUrl(env.agentTokenUrl),
+                bootSecret: env.bootSecret,
+                fetchImpl,
+                log,
+            });
+            liveChannels.push(liveChannel);
+        }
+        return liveChannel;
+    };
     let consecutiveIdleSessionReadFailures = 0;
     const recordIdleSessionReadFailure = (detail) => {
         consecutiveIdleSessionReadFailures += 1;
@@ -677,7 +762,12 @@ export async function runHostedBoot(opts) {
         log(`idle session resolution failed; retrying (${detail})`);
     };
     while (!opts.runLoop && !currentNonTerminalRunId) {
-        await sleep(Math.min(idlePollMs * 2 ** consecutiveIdleSessionReadFailures, idleReadBackoffCapMs));
+        await waitForReadOrCheck({
+            signal: idleWaitSignal,
+            pollMs: Math.min(idlePollMs * 2 ** consecutiveIdleSessionReadFailures, idleReadBackoffCapMs),
+            sleep: opts.sleep,
+            live: openLive(),
+        });
         try {
             if (bearer.expiresAtMs !== null && bearer.expiresAtMs <= now() + 60_000) {
                 bearer = await pullAgentBearer({
@@ -786,54 +876,149 @@ export async function runHostedBoot(opts) {
     writeFile(bootContextAbs, serializeBootContext(bootContext));
     const helperValue = `!node ${helperScriptAbs} ${bootContextAbs}`;
     // 4b — ORI-2118: a hosted session's Artifacts copy is created empty (forks
-    // of a busy team copy cannot be cloned), so fill it from the team copy
-    // before the first clone. A copy that already has `main` is left alone.
+    // of a busy team copy cannot be cloned). Fill it from the server-selected
+    // origin before cloning. Selected saved history is checked on retries too.
+    if (session.seedOrigin === 'session' && !isValidCloudflareArtifactsGitRemote(repo.cloneUrl)) {
+        throw new Error('selected session source requires an admitted Artifacts destination');
+    }
     if (isValidCloudflareArtifactsGitRemote(repo.cloneUrl)) {
         const credentialConfig = (helper) => [`credential.helper=${helper}`, 'credential.useHttpPath=true'];
-        await seedSessionCopy({
-            exec,
-            sessionRemote: repo.cloneUrl,
-            sessionGitConfig: credentialConfig(helperValue),
-            scratchDir: `${sessionDirAbs}/seed.git`,
-            resolveTeam: async () => {
-                const teamRemote = await resolveTeamRemote({ baseUrl: env.baseUrl, workspaceId, sessionId: env.sessionId, bearer: bearer.token, fetchImpl });
-                assertSafeGitValue('teamRemote', teamRemote);
-                const teamContextAbs = `${sessionDirAbs}/${TEAM_BOOT_CONTEXT_BASENAME}`;
-                writeFile(teamContextAbs, serializeBootContext({
-                    ...bootContext,
-                    repoFullName: teamRemote,
-                    host: new URL(teamRemote).host.toLowerCase(),
-                    tokenPurposes: { primary: 'team_read', fallback: 'team_read' },
-                }));
-                return { remote: teamRemote, gitConfig: credentialConfig(`!node ${helperScriptAbs} ${teamContextAbs}`) };
-            },
-        });
+        const sourceRequestId = session.seedOrigin === 'session' ? randomUUID() : null;
+        const sourceCredentialFile = `${sessionDirAbs}/seed-source-credential`;
+        const sourceHelperFile = `${sessionDirAbs}/seed-source-helper.js`;
+        let seedFailed = false;
+        let seedError = null;
+        try {
+            await seedSessionCopy({
+                seedOrigin: session.seedOrigin,
+                exec,
+                sessionRemote: repo.cloneUrl,
+                sessionGitConfig: credentialConfig(helperValue),
+                scratchDir: `${sessionDirAbs}/seed.git`,
+                resolveTeam: async () => {
+                    if (sourceRequestId) {
+                        const url = `${env.baseUrl}/api/cli/workspaces/${encodeURIComponent(workspaceId)}/repo-token`;
+                        const credential = await bearerJson(fetchImpl, url, bearer.token, {
+                            method: 'POST', headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ purpose: 'source_read', sessionId: env.sessionId, requestId: sourceRequestId }),
+                        });
+                        const remote = asString(credential.remote);
+                        const token = asString(credential.token);
+                        const username = asString(credential.username);
+                        if (credential.provider !== 'cloudflare_artifacts' || !remote || !isValidCloudflareArtifactsGitRemote(remote) || !token || !username || credential.requestId !== sourceRequestId) {
+                            throw new Error('source_read response carried no valid admitted source credential');
+                        }
+                        assertSafeGitValue('sourceRemote', remote);
+                        writeSecretFile(sourceCredentialFile, JSON.stringify({ remote, username, token }), writeFile);
+                        writeFile(sourceHelperFile, String.raw `const fs = require('fs');
+const c = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+  let input = '';
+  process.stdin.on('data', d => input += d);
+  process.stdin.on('end', () => {
+    const fields = Object.fromEntries(input.trim().split('\n').map(line => {
+      const i = line.indexOf('='); return [line.slice(0, i), line.slice(i + 1)];
+    }));
+    const u = new URL(c.remote);
+    if (process.argv[3] === 'get' && fields.protocol === 'https' && fields.host === u.host && fields.path === u.pathname.slice(1)) {
+      process.stdout.write('username=' + c.username + '\npassword=' + c.token + '\n\n');
+    }
+  });`);
+                        return { remote, gitConfig: ['credential.helper=', `credential.helper=!node ${sourceHelperFile} ${sourceCredentialFile}`, 'credential.useHttpPath=true'] };
+                    }
+                    const teamRemote = await resolveTeamRemote({ baseUrl: env.baseUrl, workspaceId, sessionId: env.sessionId, bearer: bearer.token, fetchImpl });
+                    assertSafeGitValue('teamRemote', teamRemote);
+                    const teamContextAbs = `${sessionDirAbs}/${TEAM_BOOT_CONTEXT_BASENAME}`;
+                    writeFile(teamContextAbs, serializeBootContext({
+                        ...bootContext,
+                        repoFullName: teamRemote,
+                        host: new URL(teamRemote).host.toLowerCase(),
+                        tokenPurposes: { primary: 'team_read', fallback: 'team_read' },
+                    }));
+                    return { remote: teamRemote, gitConfig: credentialConfig(`!node ${helperScriptAbs} ${teamContextAbs}`) };
+                },
+            });
+        }
+        catch (error) {
+            seedFailed = true;
+            seedError = error;
+        }
+        // Always request cleanup, including lost mint replies. The server tracks
+        // the request before issuance and refuses uncertain cleanup.
+        let cleanupFailed = false;
+        let cleanupError = null;
+        try {
+            try {
+                if (sourceRequestId) {
+                    const cleanup = await bearerJson(fetchImpl, `${env.baseUrl}/api/cli/workspaces/${encodeURIComponent(workspaceId)}/repo-token`, bearer.token, {
+                        method: 'DELETE', headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ purpose: 'source_read', sessionId: env.sessionId, requestId: sourceRequestId }),
+                    });
+                    if (cleanup.settled !== true || cleanup.outcome !== 'revoked') {
+                        throw new Error('temporary source credential revocation could not be proved');
+                    }
+                }
+            }
+            finally {
+                if (sourceRequestId) {
+                    const removed = exec('rm', ['-f', '--', sourceCredentialFile, sourceHelperFile]);
+                    if (removed.status !== 0)
+                        throw new Error('temporary source credential cleanup failed');
+                }
+            }
+        }
+        catch (error) {
+            cleanupFailed = true;
+            cleanupError = error;
+        }
+        // A failed copy keeps its own reason; a cleanup failure is added, never
+        // substituted, so the person sees why the copy stopped.
+        if (seedFailed && cleanupFailed) {
+            const reason = (error) => error instanceof Error ? error.message : String(error);
+            throw new Error(`${reason(seedError)}; temporary source credential cleanup also failed: ${reason(cleanupError)}`);
+        }
+        if (seedFailed)
+            throw seedError;
+        if (cleanupFailed)
+            throw cleanupError;
     }
     // 5 — Clone the session branch VIA the pull-mode credential helper (same
     // invocation the operator path makes; no token in the URL/config).
-    const clone = exec('git', [
-        'clone',
-        '--depth',
-        '1',
-        '--branch',
-        session.repoBranch,
-        '-c',
-        `credential.helper=${helperValue}`,
-        '-c',
-        'credential.useHttpPath=true',
-        repo.cloneUrl,
-        workspaceDir,
-    ]);
-    if (clone.status !== 0) {
-        const detail = (clone.stderr || clone.stdout || `exit ${clone.status}`).trim();
-        throw new Error(`git clone failed: ${detail}`);
+    // ORI-2520: a woken sandbox boots on the disk it slept with, so this
+    // session's repo is already here with any work since the last push. It is
+    // reused; anything else in that folder is refused, never overwritten. An
+    // empty folder is a fresh disk (the runtime image ships one) and is cloned
+    // into.
+    const wokenDisk = existsSync(workspaceDir) && readdirSync(workspaceDir).length > 0;
+    if (wokenDisk) {
+        const checkedOut = assertWokenRepo(exec, workspaceDir, repo.cloneUrl);
+        log(`woken disk: reusing the repo (checked out: ${checkedOut})`);
+    }
+    else {
+        const clone = exec('git', [
+            'clone',
+            '--depth',
+            '1',
+            '--branch',
+            session.repoBranch,
+            '-c',
+            `credential.helper=${helperValue}`,
+            '-c',
+            'credential.useHttpPath=true',
+            repo.cloneUrl,
+            workspaceDir,
+        ]);
+        if (clone.status !== 0) {
+            const detail = (clone.stderr || clone.stdout || `exit ${clone.status}`).trim();
+            throw new Error(`git clone failed: ${detail}`);
+        }
     }
     // Persist the helper + agent identity repo-LOCAL for subsequent fetch/push.
     exec('git', ['-C', workspaceDir, 'config', 'credential.helper', helperValue]);
     exec('git', ['-C', workspaceDir, 'config', 'credential.useHttpPath', 'true']);
     exec('git', ['-C', workspaceDir, 'config', 'user.name', AGENT_GIT_IDENTITY.name]);
     exec('git', ['-C', workspaceDir, 'config', 'user.email', AGENT_GIT_IDENTITY.email]);
-    log(`cloned ${session.repoBranch}`);
+    if (!wokenDisk)
+        log(`cloned ${session.repoBranch}`);
     // 5b — Stage the orizu skill into the cloned repo so the agent discovers the
     // Orizu workflows (ALI-1059). SHARED with the operator path via `stageOrizuSkill`
     // (one resolution chain + the harvest-safe .git/info/exclude append). Non-fatal:
@@ -953,6 +1138,7 @@ export async function runHostedBoot(opts) {
     let currentBearer = bearer;
     let lastResult = { status: 'succeeded', agentSessionId: session.agentSessionId, installOk: true, error: null };
     let hostedTurnFailure = null;
+    const live = openLive();
     try {
         for (;;) {
             assertSafeRunId(current.runId);
@@ -996,6 +1182,7 @@ export async function runHostedBoot(opts) {
                 onDiagnostic: log,
                 readFile,
                 pollMs: idlePollMs,
+                live,
             });
             try {
                 lastResult = await runHostedLoopTurn(hostedLoopSession, {
@@ -1054,8 +1241,14 @@ export async function runHostedBoot(opts) {
             // budget. Refresh proactively near expiry and once on a 401. Exhausting
             // the bounded agent-token pull is fatal and reported for the current run;
             // other transient status-read failures retain the session and back off.
+            // ORI-2517: the first read after a turn runs at once. A message the
+            // person sent during the turn or its save, or a check that came in
+            // meanwhile, is already waiting.
+            let isFirstIdleRead = true;
             for (;;) {
-                await waitForNextHostedSessionRead(sleep, idlePollMs);
+                if (!isFirstIdleRead)
+                    await waitForReadOrCheck({ signal: idleWaitSignal, pollMs: idlePollMs, sleep: opts.sleep, live });
+                isFirstIdleRead = false;
                 let pendingTurn = null;
                 try {
                     if (currentBearer.expiresAtMs !== null && currentBearer.expiresAtMs <= now() + 60_000) {

package/dist/hosted-harness.d.ts

@@ -73,6 +73,7 @@ export declare const HARNESS_EVENT_KINDS: {
     readonly session_title: "session_title";
     readonly egress_blocked: "egress_blocked";
     readonly egress_allowed: "egress_allowed";
+    readonly work_saving: "work_saving";
     readonly work_persisted: "work_persisted";
     readonly work_none: "work_none";
     readonly work_not_inspected: "work_not_inspected";

package/dist/hosted-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-harness.d.ts","sourceRoot":"","sources":["../src/hosted-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;8DAC8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACvC,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;CA+BtB,CAAA;AAEV,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,mBAAmB,CAAA;AAE/D;iDACiD;AACjD,eAAO,MAAM,sBAAsB;;;CAGzB,CAAA;AAEV,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAErE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAA;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,iFAAiF;AACjF,eAAO,MAAM,aAAa;;;CAGhB,CAAA;AAEV,KAAK,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAErE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO,CAAC,EAAE,WAAW,CAAA;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,KAAK,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrE;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IAClF,2EAA2E;IAC3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,gEAAgE;IAChE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B"}
+{"version":3,"file":"hosted-harness.d.ts","sourceRoot":"","sources":["../src/hosted-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;8DAC8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACvC,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;CAiCtB,CAAA;AAEV,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,mBAAmB,CAAA;AAE/D;iDACiD;AACjD,eAAO,MAAM,sBAAsB;;;CAGzB,CAAA;AAEV,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAErE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAA;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,iFAAiF;AACjF,eAAO,MAAM,aAAa;;;CAGhB,CAAA;AAEV,KAAK,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAErE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO,CAAC,EAAE,WAAW,CAAA;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,KAAK,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrE;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IAClF,2EAA2E;IAC3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,gEAAgE;IAChE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B"}

package/dist/hosted-harness.js

@@ -51,6 +51,8 @@ export const HARNESS_EVENT_KINDS = {
     // the end-of-run auto-harvest result (persisted/none/not-inspected/failed)
     // and the headless question auto-handling record (question_auto_answered). They
     // are ordinary structural events (never terminal), appended like any other.
+    // work_saving (ORI-2517) marks the model done and the save starting.
+    work_saving: 'work_saving',
     work_persisted: 'work_persisted',
     work_none: 'work_none',
     work_not_inspected: 'work_not_inspected',

package/dist/hosted-harvest.d.ts

@@ -8,7 +8,8 @@
  *   1. `git status --porcelain` (plumbing) decides if the clone is dirty. Ignored
  *      files never appear in porcelain output, so a checkpoint is skipped when the
  *      only changes are ignored files.
- *   2. If dirty: `git add -A` then `git commit` attributed to the agent identity
+ *   2. If dirty: `git add -A`, unstage the staged Orizu skill links
+ *      (orizu-skill-links.ts), and if anything is still staged, `git commit` attributed to the agent identity
  *      (AGENT_GIT_IDENTITY) with message `checkpoint: run <runId> auto-harvest`.
  *   3. If there is anything unpushed (a fresh checkpoint OR pre-existing local
  *      commits the agent made but did not push), push the exact HEAD SHA to the

package/dist/hosted-harvest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-harvest.d.ts","sourceRoot":"","sources":["../src/hosted-harvest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAaH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,iBAAiB,CAAA;AAExE,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAA;IACxB,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,0EAA0E;IAC1E,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,qEAAqE;IACrE,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD,eAAO,MAAM,mCAAmC,0GAItC,CAAA;AAEV,eAAO,MAAM,iCAAiC,+EAGpC,CAAA;AAEV,eAAO,MAAM,+BAA+B;;;;CAgBlC,CAAA;AAUV,wBAAgB,4BAA4B,CAC1C,UAAU,GAAE,SAAS,MAAM,EAAwC,GAClE,MAAM,GAAG,IAAI,CAEf;AA6GD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAmKrE"}
+{"version":3,"file":"hosted-harvest.d.ts","sourceRoot":"","sources":["../src/hosted-harvest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAcH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,iBAAiB,CAAA;AAExE,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAA;IACxB,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,0EAA0E;IAC1E,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,qEAAqE;IACrE,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD,eAAO,MAAM,mCAAmC,0GAItC,CAAA;AAEV,eAAO,MAAM,iCAAiC,+EAGpC,CAAA;AAEV,eAAO,MAAM,+BAA+B;;;;CAgBlC,CAAA;AAUV,wBAAgB,4BAA4B,CAC1C,UAAU,GAAE,SAAS,MAAM,EAAwC,GAClE,MAAM,GAAG,IAAI,CAEf;AA6GD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA8KrE"}

package/dist/hosted-harvest.js

@@ -8,7 +8,8 @@
  *   1. `git status --porcelain` (plumbing) decides if the clone is dirty. Ignored
  *      files never appear in porcelain output, so a checkpoint is skipped when the
  *      only changes are ignored files.
- *   2. If dirty: `git add -A` then `git commit` attributed to the agent identity
+ *   2. If dirty: `git add -A`, unstage the staged Orizu skill links
+ *      (orizu-skill-links.ts), and if anything is still staged, `git commit` attributed to the agent identity
  *      (AGENT_GIT_IDENTITY) with message `checkpoint: run <runId> auto-harvest`.
  *   3. If there is anything unpushed (a fresh checkpoint OR pre-existing local
  *      commits the agent made but did not push), push the exact HEAD SHA to the
@@ -30,6 +31,7 @@ import { mkdtempSync, readdirSync, rmSync, statSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
 import { isValidCloudflareArtifactsGitRemote, parseCanonicalCredentialFreeHttpsUrl, } from './cloudflare-artifacts-git-remote.js';
+import { hasStagedChanges, NOTHING_STAGED_ERROR, unstageOrizuSkillLinks } from './orizu-skill-links.js';
 export const HOSTED_HARVEST_CA_BUNDLE_CANDIDATES = [
     '/etc/pki/tls/certs/ca-bundle.crt',
     '/etc/ssl/certs/ca-certificates.crt',
@@ -224,31 +226,41 @@ export function harvestWorkspace(opts) {
                 return { kind: 'work_persist_failed', error: 'hosted_harvest_ca_path_policy_ineffective' };
             }
         }
-        // Never harvest bootstrap-injected runtime scaffolding (ALI-1051): the
-        // .claude/skills symlink is a sandbox-local pointer, not the agent's work.
-        // Bootstrap also excludes it via .git/info/exclude; this pathspec is the
-        // belt-and-braces for any sandbox where that didn't run.
-        const excludeScaffold = [':(exclude).claude/skills/**', ':(exclude).claude/skills'];
-        const status = exec(['status', '--porcelain', '--', '.', ...excludeScaffold]);
+        // `git status` is only the cheap first look; whether there is anything to
+        // save is decided from the index after the staged skill links are taken
+        // back out (ALI-1051, ORI-2442). A sandbox where the ignore lines did not
+        // run shows the links here and still saves nothing.
+        const status = exec(['status', '--porcelain']);
         if (status.exitCode !== 0) {
             return { kind: 'work_persist_failed', error: `git status failed: ${detail(status)}` };
         }
-        const dirty = status.stdout.trim().length > 0;
+        let dirty = status.stdout.trim().length > 0;
         if (dirty) {
-            // Add everything, then unstage the staged skill link. An exclude
-            // pathspec on add makes git exit 1 once bootstrap has ignored
-            // .claude/skills ("paths are ignored"), which is every hosted session
-            // (ORI-2441, git 2.49 in the sandbox). Only the link's own path is reset,
-            // so an agent's edits to a team's tracked skills next to it are saved;
-            // reset, unlike rm --cached, never deletes a tracked file.
+            // Add everything, then unstage the staged skill links. An exclude
+            // pathspec on add makes git exit 1 for ignored paths (ORI-2441, git 2.49
+            // in the sandbox). Only the links themselves are reset, so an agent's
+            // edits to a team's own skills next to them are saved; reset, unlike
+            // rm --cached, never deletes a tracked file.
             const add = exec(['add', '-A', '--', '.']);
             if (add.exitCode !== 0) {
                 return { kind: 'work_persist_failed', error: `git add failed: ${detail(add)}` };
             }
-            const unstage = exec(['reset', '-q', '--', '.claude/skills/orizu']);
-            if (unstage.exitCode !== 0) {
-                return { kind: 'work_persist_failed', error: `git reset of .claude/skills/orizu failed: ${detail(unstage)}` };
+            const unstage = unstageOrizuSkillLinks(exec);
+            if (!unstage.ok) {
+                return { kind: 'work_persist_failed', error: unstage.error };
             }
+            const staged = hasStagedChanges(exec);
+            if (typeof staged !== 'boolean') {
+                return { kind: 'work_persist_failed', error: staged.error };
+            }
+            // Dirty with nothing staged and no link taken out means the work cannot
+            // be committed here; say so rather than report nothing to save.
+            if (!staged && unstage.unstaged.length === 0) {
+                return { kind: 'work_persist_failed', error: NOTHING_STAGED_ERROR };
+            }
+            dirty = staged;
+        }
+        if (dirty) {
             const commit = exec([
                 '-c',
                 `user.name=${opts.author.name}`,

package/dist/hosted-live-channel.d.ts

@@ -0,0 +1,25 @@
+/**
+ * ORI-2200 slice 2 (ADR-040): the sandbox's socket to its session coordinator.
+ * The coordinator sends "check now" when someone presses Stop; the sandbox
+ * then reads its session at once instead of waiting for the next regular read.
+ * The message carries no instruction of its own: the session record decides
+ * whether this run was interrupted, so a forged or stray check costs one read.
+ *
+ * Best effort. If the socket cannot open (an older coordinator, a network
+ * rule), the regular read every few seconds still catches the Stop.
+ */
+export interface HostedLiveChannel {
+    /** Resolves on the next "check now" (or at once if one arrived since the last call), or when `signal` aborts. */
+    nextCheck(signal: AbortSignal): Promise<void>;
+    /** How many checks have arrived so far, read or not. */
+    checkCount(): number;
+    close(): void;
+}
+export declare function openHostedLiveChannel(opts: {
+    /** `<coordinator>/sessions/<id>/live/sandbox-pass`. */
+    sandboxPassUrl: string;
+    bootSecret: string;
+    fetchImpl?: (url: string, init?: RequestInit) => Promise<Response>;
+    log?: (line: string) => void;
+}): HostedLiveChannel;
+//# sourceMappingURL=hosted-live-channel.d.ts.map

package/dist/hosted-live-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-live-channel.d.ts","sourceRoot":"","sources":["../src/hosted-live-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,WAAW,iBAAiB;IAChC,iHAAiH;IACjH,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,wDAAwD;IACxD,UAAU,IAAI,MAAM,CAAA;IACpB,KAAK,IAAI,IAAI,CAAA;CACd;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAClE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC7B,GAAG,iBAAiB,CAwGpB"}