orizu 0.5.6 → 0.5.8

package/src/hosted-loop.ts

@@ -40,10 +40,14 @@ import { join } from 'path'
 
 import type { AgentHarness, HarnessEvent, HarnessPrompt } from './hosted-harness.js'
 import {
+  HOSTED_TASK_PREAMBLE,
   PREBAKED_MARKER_PATH,
   SETUP_HOOK_RELATIVE_PATH,
+  composeHostedTaskPrompt,
   parsePrebakedMarker,
 } from './hosted-runtime-assets.js'
+import { harvestWorkspace, type HarvestExec, type HarvestOutcome } from './hosted-harvest.js'
+import { annotateHeadlessQuestions, withIdleWatchdog } from './hosted-headless.js'
 import {
   OPENCODE_PINNED_VERSION,
   createOpenCodeHarness,
@@ -132,6 +136,28 @@ export interface HostedLoopContext {
   runSetupHook?: boolean
 }
 
+/**
+ * Environment injected into the spawned OpenCode server so the AGENT's bash sees a
+ * PRE-AUTHENTICATED `orizu` CLI (ALI-1044). ORIZU_TOKEN_FILE points at the 0600
+ * rotated bearer file and ORIZU_BASE_URL at the Orizu API — the exact vars the
+ * CLI's auth resolution reads (resolveEnvBearerToken + resolveBaseUrl). The dummy
+ * ANTHROPIC key (model-key brokering, G3) is preserved. No real secret is carried
+ * here: the bearer stays on disk and is read fresh per request from the file.
+ */
+export function buildOpenCodeSpawnEnv(context: HostedLoopContext): Record<string, string> | undefined {
+  const env: Record<string, string> = {}
+  if (context.anthropicDummyKey) {
+    env.ANTHROPIC_API_KEY = context.anthropicDummyKey
+  }
+  if (context.bearerFile) {
+    env.ORIZU_TOKEN_FILE = context.bearerFile
+  }
+  if (context.apiBaseUrl) {
+    env.ORIZU_BASE_URL = context.apiBaseUrl
+  }
+  return Object.keys(env).length > 0 ? env : undefined
+}
+
 export interface InstallResult {
   ok: boolean
   detail: string
@@ -171,6 +197,24 @@ export interface RunHostedLoopOptions {
    *  workspace, non-fatal). Injectable so tests exercise the deferred-hook path
    *  with no real filesystem or child process. */
   runSetupHook?: (input: { workspaceDir: string }) => Promise<SetupHookOutcome> | SetupHookOutcome
+  /**
+   * Standing preamble wrapped around the user task (ALI-1036). Defaults to
+   * `HOSTED_TASK_PREAMBLE`; pass an override to customize it, or an empty string
+   * to send the task verbatim (tests). The user task is always kept verbatim
+   * beneath a delimiter (see `composeHostedTaskPrompt`).
+   */
+  taskPreamble?: string
+  /**
+   * Injectable git runner for the end-of-run auto-harvest (ALI-1036). Default:
+   * real `git` via child_process in `context.workspaceDir`.
+   */
+  harvestExec?: HarvestExec
+  /**
+   * Idle watchdog window (ALI-1037): abort the prompt + fail the run
+   * `agent_stalled` if NO harness event arrives for this many ms. Default: env
+   * `ORIZU_AGENT_IDLE_TIMEOUT_MS` or 10 minutes. <= 0 disables the watchdog.
+   */
+  idleTimeoutMs?: number
 }
 
 export interface HostedLoopResult {
@@ -363,6 +407,25 @@ function defaultRunSetupHook({ workspaceDir }: { workspaceDir: string }): SetupH
   return { ran: true, ok, detail: ok ? 'setup.sh ok' : `setup.sh exit ${res.status ?? 'unknown'}` }
 }
 
+/** Default idle-watchdog window (ALI-1037): abort a prompt that makes no progress
+ *  for this long. The timer resets on every harness EVENT, and a legitimate long
+ *  single tool call (a big `npm install`, a build, an optimization step) emits no
+ *  intermediate events — so this must comfortably exceed the longest expected
+ *  quiet tool call (review finding #2). Overridable per-run via `idleTimeoutMs` or
+ *  the `ORIZU_AGENT_IDLE_TIMEOUT_MS` env var. */
+export const DEFAULT_AGENT_IDLE_TIMEOUT_MS = 25 * 60 * 1000
+
+/** Resolve the idle window: explicit option wins, then env, then the default. */
+function resolveIdleTimeoutMs(override: number | undefined): number {
+  if (typeof override === 'number' && Number.isFinite(override)) return override
+  const raw = process.env.ORIZU_AGENT_IDLE_TIMEOUT_MS
+  if (raw) {
+    const parsed = Number.parseInt(raw, 10)
+    if (Number.isFinite(parsed)) return parsed
+  }
+  return DEFAULT_AGENT_IDLE_TIMEOUT_MS
+}
+
 /** Model-key env vars whose value must be scrubbed from every run event. */
 const MODEL_KEY_ENV_VARS = ['ANTHROPIC_API_KEY', 'OPENAI_API_KEY']
 
@@ -552,6 +615,44 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
     }
   }
 
+  // End-of-run auto-harvest (ALI-1036): commit + push anything the agent left
+  // uncommitted/unpushed so a run NEVER loses work — on BOTH the success and
+  // failure paths. Runs at most once (guarded), records exactly one of
+  // work_persisted / work_none / work_persist_failed, and NEVER throws or changes
+  // the run's terminal status: a harvest failure is recorded and the run proceeds.
+  let harvested = false
+  const runAutoHarvest = async (): Promise<void> => {
+    if (harvested) return
+    harvested = true
+    let outcome: HarvestOutcome
+    try {
+      outcome = harvestWorkspace({
+        workspaceDir: context.workspaceDir,
+        runId: context.runId,
+        author: context.author,
+        exec: opts.harvestExec,
+        // Real harvest only inside a genuine hosted sandbox (prebaked marker
+        // present) — never on a host/test working tree (review finding #1).
+        enabled: existsSync(PREBAKED_MARKER_PATH),
+      })
+    } catch (error) {
+      outcome = { kind: 'work_persist_failed', error: error instanceof Error ? error.message : String(error) }
+    }
+    if (sink.sealed) return
+    try {
+      if (outcome.kind === 'work_persisted') {
+        await sink.append({ kind: 'work_persisted', payload: { sha: outcome.sha, files: outcome.files } })
+      } else if (outcome.kind === 'work_none') {
+        await sink.append({ kind: 'work_none', payload: {} })
+      } else {
+        await sink.append({ kind: 'work_persist_failed', payload: { error: outcome.error } })
+      }
+    } catch {
+      // Recording harvest is best-effort — never fail the run because the harvest
+      // event append failed.
+    }
+  }
+
   let spawned: SpawnedOpenCode | null = null
   let agentSessionId: string | null = null
   let installOk = false
@@ -604,7 +705,7 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
         model: context.model,
         cwd: context.workspaceDir,
         port: context.opencodePort,
-        env: context.anthropicDummyKey ? { ANTHROPIC_API_KEY: context.anthropicDummyKey } : undefined,
+        env: buildOpenCodeSpawnEnv(context),
         spawn: nodeChildSpawner,
         logPath: join(tmpdir(), `opencode-serve-${context.runId}.log`),
         signal,
@@ -629,21 +730,49 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
     })
     agentSessionId = started.agentSessionId
 
+    // Prompt scaffolding (ALI-1036): wrap the user task with the standing
+    // headless preamble, keeping the task verbatim beneath a delimiter.
     const prompt: HarnessPrompt = {
       runId: context.runId,
       messageId: context.messageId,
-      content: taskPrompt,
+      content: composeHostedTaskPrompt(taskPrompt, opts.taskPreamble ?? HOSTED_TASK_PREAMBLE),
       author: context.author,
     }
-    const status = await drainHarnessToSink(harness.runPrompt(prompt, signal), sink, {
+    // Drive the prompt through (a) question auto-handling annotation and (b) the
+    // idle watchdog (ALI-1037): no harness event for `idleTimeoutMs` aborts the
+    // prompt and throws `AgentStalledError` → the catch below harvests, then
+    // finishes the run `failed`. The prompt runs under a CHILD AbortController
+    // linked to the loop signal so the watchdog can abort the in-flight prompt
+    // (unblocking a signal-respecting harness the same way a cancel would), then
+    // best-effort `harness.stop()` the driver.
+    const idleTimeoutMs = resolveIdleTimeoutMs(opts.idleTimeoutMs)
+    const promptController = new AbortController()
+    if (signal.aborted) promptController.abort()
+    else signal.addEventListener('abort', () => promptController.abort(), { once: true })
+    const annotated = annotateHeadlessQuestions(harness.runPrompt(prompt, promptController.signal))
+    const drivenStream =
+      idleTimeoutMs > 0
+        ? withIdleWatchdog(annotated, {
+            timeoutMs: idleTimeoutMs,
+            onTimeout: async () => {
+              promptController.abort()
+              await harness.stop()
+            },
+          })
+        : annotated
+    const status = await drainHarnessToSink(drivenStream, sink, {
       summary: { agentSessionId },
+      // Auto-harvest runs on EVERY terminal path, before the sink seals.
+      beforeFinish: runAutoHarvest,
     })
     await harness.shutdown()
     return { status, agentSessionId, installOk, error: null }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error)
     // Fail closed: never leave the run non-terminal. finish() is idempotent and
-    // no-ops when the drain already sealed the sink.
+    // no-ops when the drain already sealed the sink. Harvest FIRST (partial work
+    // is valuable, incl. an idle-watchdog abort) — before the terminal seals.
+    await runAutoHarvest()
     if (!sink.sealed) {
       try {
         await sink.finish('failed', { summary: { error: message } })

package/src/hosted-run-event-sink.ts

@@ -77,6 +77,13 @@ const EVENT_TYPE_BY_KIND: Partial<Record<HarnessEventKind, string>> = {
   // through this SAME sink (single writer). See EGRESS_*_EVENT_TYPE below.
   egress_blocked: EGRESS_BLOCKED_EVENT_TYPE,
   egress_allowed: EGRESS_ALLOWED_EVENT_TYPE,
+  // Durability + headless (ALI-1036 / ALI-1037), emitted by the in-sandbox loop
+  // through this SAME sink (single writer): auto-harvest results + headless
+  // question auto-handling record.
+  work_persisted: 'work_persisted',
+  work_none: 'work_none',
+  work_persist_failed: 'work_persist_failed',
+  question_auto_answered: 'agent_question_auto_answered',
 }
 
 /** The RunAPI event type a harness kind maps to, or null if it is not appendable
@@ -576,6 +583,15 @@ export interface DrainOptions {
   transcript?: string
   summary?: Record<string, unknown>
   evidence?: Record<string, unknown>
+  /**
+   * Hook invoked AFTER the stream yields its terminal event but BEFORE `finish()`
+   * seals the sink, on EVERY terminal path (success, failure, abnormal end). Used
+   * by the loop's end-of-run auto-harvest (ALI-1036) so `work_persisted` /
+   * `work_none` / `work_persist_failed` can still be appended while the sink is
+   * writable. Its own failure must never change the run's terminal status — the
+   * hook itself is responsible for swallowing errors.
+   */
+  beforeFinish?: () => Promise<void>
 }
 
 /**
@@ -590,6 +606,14 @@ export async function drainHarnessToSink(
   sink: RunEventSink,
   opts: DrainOptions = {}
 ): Promise<TerminalStatus> {
+  // Run the pre-terminal hook (auto-harvest) at most once, right before the first
+  // finish() on any terminal path — while the sink is still writable.
+  let beforeFinishRan = false
+  const runBeforeFinish = async (): Promise<void> => {
+    if (beforeFinishRan) return
+    beforeFinishRan = true
+    if (opts.beforeFinish) await opts.beforeFinish()
+  }
   for await (const event of events) {
     if (event.kind === 'execution_complete') {
       // A prompt the caller/agent stopped is a cancellation, not a failure: the
@@ -597,6 +621,7 @@ export async function drainHarnessToSink(
       // and stop()-initiated paths. A genuine failure (success:false, no abort
       // flag) still lands 'failed'.
       if (event.payload.aborted === true) {
+        await runBeforeFinish()
         await sink.finish('cancelled', {
           summary: opts.summary,
           evidence: opts.evidence,
@@ -609,10 +634,12 @@ export async function drainHarnessToSink(
       const summary = success
         ? opts.summary
         : { ...(opts.summary ?? {}), error: event.payload.error ?? 'execution failed' }
+      await runBeforeFinish()
       await sink.finish(status, { summary, evidence: opts.evidence, transcript: opts.transcript })
       return status
     }
     if (event.kind === 'error') {
+      await runBeforeFinish()
       await sink.finish('failed', {
         summary: { ...(opts.summary ?? {}), error: event.payload.error ?? 'agent error' },
         evidence: opts.evidence,
@@ -624,6 +651,7 @@ export async function drainHarnessToSink(
   }
   // The harness contract guarantees a terminal event; reaching here means the
   // stream ended abnormally. Fail closed so the run never dangles non-terminal.
+  await runBeforeFinish()
   await sink.finish('failed', {
     summary: { ...(opts.summary ?? {}), error: 'harness stream ended without a terminal event' },
     transcript: opts.transcript,

package/src/hosted-runtime-assets.ts

@@ -44,6 +44,37 @@ export const SETUP_HOOK_RELATIVE_PATH = '.orizu/setup.sh'
  */
 export const AGENT_GIT_IDENTITY = { name: 'Orizu Agent', email: 'agent@orizu.ai' } as const
 
+// -- Hosted task prompt scaffolding (ALI-1036) -------------------------------
+
+/**
+ * Standing preamble wrapped around every hosted task prompt so a NATURAL task
+ * ("review X and update the readme") runs unattended with zero magic words. The
+ * agent is told to work autonomously (never block on the human), commit as it
+ * goes, and treat Orizu — not the repo — as the home for production pointers and
+ * run metadata. An end-of-run auto-harvest (ALI-1036, `harvestWorkspace`) is the
+ * safety net for anything left uncommitted; the preamble names it so the agent
+ * knows partial work is preserved.
+ */
+export const HOSTED_TASK_PREAMBLE =
+  'You are running unattended in a hosted sandbox. Work autonomously: never ask the user ' +
+  'questions — when uncertain, choose the most reasonable/reversible option and note the ' +
+  'decision. Commit your work to the current branch in logical units as you go (an automatic ' +
+  'checkpoint will also save anything uncommitted at the end). Never switch branches. ' +
+  'Production/default pointers and run metadata live in Orizu, not this repo.'
+
+/** Delimiter separating the standing preamble from the verbatim user task. */
+export const HOSTED_TASK_DELIMITER = '--- YOUR TASK ---'
+
+/**
+ * Compose the full hosted prompt: the standing preamble, a clear delimiter, then
+ * the user's task VERBATIM beneath it. Passing an empty preamble yields the task
+ * unchanged (an explicit opt-out for tests / callers that scaffold elsewhere).
+ */
+export function composeHostedTaskPrompt(task: string, preamble: string = HOSTED_TASK_PREAMBLE): string {
+  if (!preamble) return task
+  return `${preamble}\n\n${HOSTED_TASK_DELIMITER}\n${task}`
+}
+
 // -- Pre-baked runtime marker (ALI-1017) -------------------------------------
 
 /**

package/src/hosted-session-cli.ts

@@ -359,6 +359,12 @@ async function defaultResolveRepo(
 export async function startHostedSession(
   opts: StartHostedSessionOptions
 ): Promise<StartHostedSessionResult> {
+  // ALI-1035 fail-fast: a hosted run cannot reach the model provider without a key
+  // (the firewall brokers the real key onto egress). Refuse BEFORE creating any
+  // session, run row, or sandbox — no orphaned rows, no paid box, instant error.
+  if (!opts.modelApiKey) {
+    throw new Error('hosted session needs a model API key: set ANTHROPIC_API_KEY (or pass --model-key)')
+  }
   const rawFetch = opts.rawFetch ?? (globalThis.fetch as HostedFetch)
   const log = opts.logLine ?? ((): void => {})
   const model = opts.model ?? DEFAULT_HOSTED_MODEL
@@ -602,6 +608,32 @@ export async function startHostedSession(
   let sandboxBudgetMs = durationMs
   let tokenExpiresAtMs = now() + ttlMinutes * 60 * 1000
   let stopped = false
+
+  // ALI-1037 host-side idle gate: only KEEP a sandbox alive while its run is
+  // making progress. Before each keepalive extension we cheaply check whether any
+  // new run event landed since the last check; a run with NO new events since the
+  // previous rotation cycle is not extended (the in-sandbox watchdog is the
+  // primary stall killer — this stops the HOST from paying to keep a dead box
+  // alive). "Can't tell" (non-2xx / transport error) never starves a healthy run.
+  let lastEventCursor = 0
+  const hasEventProgress = async (): Promise<boolean> => {
+    try {
+      const res = await opts.fetcher(
+        `/api/cli/workbench-runs/${encodeURIComponent(runId)}/events?after=${lastEventCursor}&limit=500`
+      )
+      if (!res.ok) return true
+      const body = (await res.json().catch(() => ({}))) as { events?: unknown }
+      const events = Array.isArray(body.events) ? (body.events as Record<string, unknown>[]) : []
+      if (events.length === 0) return false
+      lastEventCursor = events.reduce((max, event) => {
+        const seq = typeof event.sequence === 'number' ? event.sequence : 0
+        return seq > max ? seq : max
+      }, lastEventCursor)
+      return true
+    } catch {
+      return true
+    }
+  }
   let cancelSleep: (() => void) | null = null
   const stop = (): void => {
     stopped = true
@@ -674,14 +706,21 @@ export async function startHostedSession(
         log('rotated agent bearer (file overwritten)')
         // Keepalive: extend the sandbox by one rotation interval each rotation
         // while attached (SDK supports extendTimeout(ms)), bounded by the 24h cap
-        // so a long attached session outlives the initial --duration window.
+        // so a long attached session outlives the initial --duration window — BUT
+        // only while the run is making progress (ALI-1037). A run with no new
+        // events since the last rotation is not extended: the box is left to wind
+        // down to its current budget instead of the host paying for a stalled run.
         if (sandbox.extendTimeout && sandboxBudgetMs + rotationIntervalMs <= sandboxCapMs) {
-          try {
-            await sandbox.extendTimeout(rotationIntervalMs)
-            sandboxBudgetMs += rotationIntervalMs
-            log(`extended sandbox timeout (+${Math.round(rotationIntervalMs / 1000)}s, budget ${Math.round(sandboxBudgetMs / 60000)}m)`)
-          } catch (error) {
-            log(`sandbox extendTimeout failed: ${error instanceof Error ? error.message : String(error)}`)
+          if (!(await hasEventProgress())) {
+            log('sandbox timeout NOT extended: no run events since the last rotation (agent stalled) — letting the box wind down')
+          } else {
+            try {
+              await sandbox.extendTimeout(rotationIntervalMs)
+              sandboxBudgetMs += rotationIntervalMs
+              log(`extended sandbox timeout (+${Math.round(rotationIntervalMs / 1000)}s, budget ${Math.round(sandboxBudgetMs / 60000)}m)`)
+            } catch (error) {
+              log(`sandbox extendTimeout failed: ${error instanceof Error ? error.message : String(error)}`)
+            }
           }
         }
       } catch (error) {
@@ -762,7 +801,7 @@ const HOSTED_USAGE =
   '[--model <provider/model>] [--project <team/project>] [--provider vercel|local-sim] ' +
   '[--image <orizu-hosted-runtime:tag> (pre-baked VCR image; default env ORIZU_HOSTED_IMAGE)] ' +
   '[--snapshot <snapshot-id> (pre-baked Vercel snapshot, zero-Docker; default env ORIZU_HOSTED_SNAPSHOT; ' +
-  'mutually exclusive with --image)] [--tail]\n' +
+  'mutually exclusive with --image)] [--model-key <key> (else ANTHROPIC_API_KEY; required)] [--tail]\n' +
   'Note (v0): if you disconnect, the agent token expires within its TTL (<=60m) and the run finishes ' +
   'cleanly; reconnect with `orizu run tail --run <id>`. The sandbox timeout is independent (up to 24h).'
 
@@ -821,7 +860,9 @@ export async function hostedCommand(args: string[], io: HostedCommandIo): Promis
     hostedImage: argVal(args, '--image') ?? process.env.ORIZU_HOSTED_IMAGE ?? undefined,
     hostedSnapshot: argVal(args, '--snapshot') ?? process.env.ORIZU_HOSTED_SNAPSHOT ?? undefined,
     tail,
-    modelApiKey: process.env.ANTHROPIC_API_KEY || undefined,
+    // Model key: explicit --model-key wins, else ANTHROPIC_API_KEY. Falsy → the
+    // fail-fast in startHostedSession throws before any session/sandbox is made.
+    modelApiKey: argVal(args, '--model-key') ?? (process.env.ANTHROPIC_API_KEY || undefined),
     logLine: line => io.print(line),
     onTailEvent: event =>
       io.print(io.json ? JSON.stringify(event) : `#${String(event.sequence ?? '?')} ${String(event.eventType ?? '')}`),

package/src/http.ts

@@ -1,4 +1,9 @@
-import { getActiveBaseUrl, getServerCredentials, updateServerCredentials } from './credentials.js'
+import {
+  getActiveBaseUrl,
+  getServerCredentials,
+  resolveEnvBearerToken,
+  updateServerCredentials,
+} from './credentials.js'
 import { getFlagBaseUrl, GlobalFlags, normalizeBaseUrl } from './global-flags.js'
 import { LoginResponse, ServerCredentials, SessionServerCredentials } from './types.js'
 
@@ -122,6 +127,23 @@ async function refreshCredentials(baseUrl: string, credentials: ServerCredential
 export async function authedFetch(path: string, init: RequestInit = {}) {
   const baseUrl = resolveBaseUrl()
   assertSecureTokenTransport(baseUrl)
+
+  // In-sandbox pre-auth (ALI-1044): a bearer supplied via ORIZU_TOKEN /
+  // ORIZU_TOKEN_FILE takes precedence over credentials.json. It is externally
+  // managed (the hosted loop rotates the token file), so it is read FRESH here on
+  // every request and NEVER refreshed by this client — on a 401 the loop rotates
+  // the file and the next request naturally picks up the new bearer.
+  const envBearer = resolveEnvBearerToken()
+  if (envBearer) {
+    return await fetch(`${baseUrl}${path}`, {
+      ...init,
+      headers: {
+        ...(init.headers || {}),
+        Authorization: `Bearer ${envBearer}`,
+      },
+    })
+  }
+
   const credentials = getServerCredentials(baseUrl)
   if (!credentials) {
     throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`)