orizu 0.5.8 → 0.5.10

package/dist/hosted-loop-lifecycle.js

@@ -0,0 +1,172 @@
+/**
+ * Hosted-loop LIFECYCLE seam (ALI-1015 Phase 1, per ADR-005 Resolution).
+ *
+ * The orchestration-facing parts of the hosted loop, extracted VERBATIM from
+ * `hosted-loop.ts` so they can be re-exported through the shared
+ * `lib/hosted-runtime/` surface and driven by a server-side coordinator (the
+ * per-session Durable Object) as well as the CLI. This module deliberately
+ * carries NO harness/runtime machinery: its only import is the TYPE-ONLY
+ * `HarnessEvent` (erased at compile time), so a Worker bundle that pulls the
+ * lifecycle seam never drags in the OpenCode/Claude-SDK drivers or any Node
+ * child-process code.
+ *
+ * Contents (moved, not rewritten — behavior identical):
+ *   - `HostedLoopContext` — the run-scoped boot context the host orchestrator
+ *     writes for the in-sandbox loop;
+ *   - `buildOpenCodeSpawnEnv` — the pre-authenticated agent env (ALI-1044);
+ *   - the G5 egress canary: `runEgressCanary`, `egressCanaryAllowedHost`,
+ *     `defaultProbeEgress`, and their types/constants;
+ *   - `SetupHookOutcome` — the deferred customer-setup-hook contract.
+ *
+ * `hosted-loop.ts` re-exports everything here, so the CLI's import surface
+ * (`@/packages/cli/src/hosted-loop`) is unchanged.
+ */
+/**
+ * Environment injected into the spawned OpenCode server so the AGENT's bash sees a
+ * PRE-AUTHENTICATED `orizu` CLI (ALI-1044). ORIZU_TOKEN_FILE points at the 0600
+ * rotated bearer file and ORIZU_BASE_URL at the Orizu API — the exact vars the
+ * CLI's auth resolution reads (resolveEnvBearerToken + resolveBaseUrl). The dummy
+ * ANTHROPIC key (model-key brokering, G3) is preserved. No real secret is carried
+ * here: the bearer stays on disk and is read fresh per request from the file.
+ */
+export function buildOpenCodeSpawnEnv(context) {
+    const env = {};
+    if (context.anthropicDummyKey) {
+        env.ANTHROPIC_API_KEY = context.anthropicDummyKey;
+    }
+    if (context.bearerFile) {
+        env.ORIZU_TOKEN_FILE = context.bearerFile;
+    }
+    if (context.apiBaseUrl) {
+        env.ORIZU_BASE_URL = context.apiBaseUrl;
+    }
+    return Object.keys(env).length > 0 ? env : undefined;
+}
+/** Default egress-canary probe host (a known non-allowlisted destination). */
+export const DEFAULT_EGRESS_CANARY_HOST = 'example.com';
+/** Bound (ms) on the canary probe — a live firewall resets/times out fast; a
+ *  reachable host answers well within this. */
+const EGRESS_CANARY_TIMEOUT_MS = 5000;
+/**
+ * Default probe: attempt a bounded HTTPS GET to `host`. A live default-deny
+ * firewall makes this THROW for a DENIED host (connection reset / timeout / DNS
+ * failure) → `reachable: false`. Any response at all — even an error status —
+ * proves the host was reachable → `reachable: true`. Used for BOTH the allowed
+ * (positive-control) and denied probes.
+ */
+export async function defaultProbeEgress(host) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), EGRESS_CANARY_TIMEOUT_MS);
+    try {
+        const response = await fetch(`https://${host}/`, {
+            method: 'GET',
+            redirect: 'manual',
+            signal: controller.signal,
+        });
+        return { reachable: true, detail: `reachable (HTTP ${response.status})` };
+    }
+    catch (error) {
+        return { reachable: false, detail: `blocked (${error instanceof Error ? error.name : 'error'})` };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Run the startup egress canary as a POSITIVE CONTROL and emit the proof event
+ * through the (single-writer) sink. Probes BOTH a known-allowed host and the
+ * known-denied host, then decides:
+ *
+ *   - allowed REACHABLE and denied BLOCKED → the firewall is live AND the network
+ *     works → emit `egress_blocked` and PROCEED (the ONLY healthy outcome);
+ *   - denied REACHABLE → egress is NOT enforced → emit `egress_allowed`, FAIL
+ *     CLOSED;
+ *   - allowed ALSO UNREACHABLE (denied blocked but the positive control failed) →
+ *     we cannot tell policy-blocking from a total network outage → emit
+ *     `egress_allowed`, FAIL CLOSED.
+ *
+ * The `egress_blocked` kind therefore means EXACTLY "proceeded, positive control
+ * passed"; `egress_allowed` means "failed closed" (the payload `result` field
+ * distinguishes an unexpectedly-reachable denied host from an unreachable
+ * positive control). Old behavior — treating ANY denied-host throw (incl. a
+ * timeout under a total outage) as "blocked → proceed" — failed OPEN; this now
+ * fails closed on that ambiguity.
+ */
+export async function runEgressCanary(targets, sink, probe, now = () => Date.now()) {
+    const [allowed, denied] = await Promise.all([probe(targets.allowedHost), probe(targets.deniedHost)]);
+    const checkedAt = new Date(now()).toISOString();
+    const positiveControl = {
+        host: targets.allowedHost,
+        reachable: allowed.reachable,
+        detail: allowed.detail,
+    };
+    // FAIL CLOSED: a denied host answered — the policy is not enforcing egress.
+    if (denied.reachable) {
+        await sink.append({
+            kind: 'egress_allowed',
+            critical: true,
+            payload: {
+                host: targets.deniedHost,
+                result: 'unexpectedly_reachable',
+                detail: denied.detail,
+                positiveControl,
+                checkedAt,
+            },
+        });
+        return {
+            proceed: false,
+            reason: `denied host ${targets.deniedHost} was reachable (${denied.detail}) — egress is not enforced`,
+            allowed,
+            denied,
+        };
+    }
+    // FAIL CLOSED: the denied host was blocked, but the positive control ALSO did
+    // not answer — the environment/network is broken and we cannot distinguish a
+    // policy block from a total outage. This is the case the old code got wrong.
+    if (!allowed.reachable) {
+        await sink.append({
+            kind: 'egress_allowed',
+            critical: true,
+            payload: {
+                host: targets.deniedHost,
+                result: 'positive_control_unreachable',
+                detail: denied.detail,
+                positiveControl,
+                checkedAt,
+            },
+        });
+        return {
+            proceed: false,
+            reason: `positive control ${targets.allowedHost} was unreachable (${allowed.detail}) — cannot distinguish egress enforcement from a network outage`,
+            allowed,
+            denied,
+        };
+    }
+    // HEALTHY: allowed reachable AND denied blocked → the firewall is live.
+    await sink.append({
+        kind: 'egress_blocked',
+        critical: true,
+        payload: {
+            host: targets.deniedHost,
+            result: 'blocked',
+            detail: denied.detail,
+            positiveControl,
+            checkedAt,
+        },
+    });
+    return { proceed: true, reason: null, allowed, denied };
+}
+/**
+ * Derive the known-ALLOWED positive-control host from the run's Orizu API base —
+ * always allowlisted (it is the agent's control-plane path) and ours, so it is
+ * the safest "must be reachable" signal. Falls back to a lenient host parse if
+ * the base is not a well-formed URL.
+ */
+export function egressCanaryAllowedHost(apiBaseUrl) {
+    try {
+        return new URL(apiBaseUrl).hostname;
+    }
+    catch {
+        return apiBaseUrl.replace(/^[a-z]+:\/\//i, '').split('/')[0].split(':')[0];
+    }
+}

package/dist/hosted-loop.js

@@ -42,155 +42,11 @@ import { annotateHeadlessQuestions, withIdleWatchdog } from './hosted-headless.j
 import { OPENCODE_PINNED_VERSION, createOpenCodeHarness, spawnOpenCode, } from './hosted-harness-opencode.js';
 import { createClaudeAgentHarness } from './hosted-harness-claude.js';
 import { drainHarnessToSink, resumeRunEventSink, } from './hosted-run-event-sink.js';
-/**
- * Environment injected into the spawned OpenCode server so the AGENT's bash sees a
- * PRE-AUTHENTICATED `orizu` CLI (ALI-1044). ORIZU_TOKEN_FILE points at the 0600
- * rotated bearer file and ORIZU_BASE_URL at the Orizu API — the exact vars the
- * CLI's auth resolution reads (resolveEnvBearerToken + resolveBaseUrl). The dummy
- * ANTHROPIC key (model-key brokering, G3) is preserved. No real secret is carried
- * here: the bearer stays on disk and is read fresh per request from the file.
- */
-export function buildOpenCodeSpawnEnv(context) {
-    const env = {};
-    if (context.anthropicDummyKey) {
-        env.ANTHROPIC_API_KEY = context.anthropicDummyKey;
-    }
-    if (context.bearerFile) {
-        env.ORIZU_TOKEN_FILE = context.bearerFile;
-    }
-    if (context.apiBaseUrl) {
-        env.ORIZU_BASE_URL = context.apiBaseUrl;
-    }
-    return Object.keys(env).length > 0 ? env : undefined;
-}
-/** Default egress-canary probe host (a known non-allowlisted destination). */
-export const DEFAULT_EGRESS_CANARY_HOST = 'example.com';
-/** Bound (ms) on the canary probe — a live firewall resets/times out fast; a
- *  reachable host answers well within this. */
-const EGRESS_CANARY_TIMEOUT_MS = 5000;
-/**
- * Default probe: attempt a bounded HTTPS GET to `host`. A live default-deny
- * firewall makes this THROW for a DENIED host (connection reset / timeout / DNS
- * failure) → `reachable: false`. Any response at all — even an error status —
- * proves the host was reachable → `reachable: true`. Used for BOTH the allowed
- * (positive-control) and denied probes.
- */
-async function defaultProbeEgress(host) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), EGRESS_CANARY_TIMEOUT_MS);
-    try {
-        const response = await fetch(`https://${host}/`, {
-            method: 'GET',
-            redirect: 'manual',
-            signal: controller.signal,
-        });
-        return { reachable: true, detail: `reachable (HTTP ${response.status})` };
-    }
-    catch (error) {
-        return { reachable: false, detail: `blocked (${error instanceof Error ? error.name : 'error'})` };
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-/**
- * Run the startup egress canary as a POSITIVE CONTROL and emit the proof event
- * through the (single-writer) sink. Probes BOTH a known-allowed host and the
- * known-denied host, then decides:
- *
- *   - allowed REACHABLE and denied BLOCKED → the firewall is live AND the network
- *     works → emit `egress_blocked` and PROCEED (the ONLY healthy outcome);
- *   - denied REACHABLE → egress is NOT enforced → emit `egress_allowed`, FAIL
- *     CLOSED;
- *   - allowed ALSO UNREACHABLE (denied blocked but the positive control failed) →
- *     we cannot tell policy-blocking from a total network outage → emit
- *     `egress_allowed`, FAIL CLOSED.
- *
- * The `egress_blocked` kind therefore means EXACTLY "proceeded, positive control
- * passed"; `egress_allowed` means "failed closed" (the payload `result` field
- * distinguishes an unexpectedly-reachable denied host from an unreachable
- * positive control). Old behavior — treating ANY denied-host throw (incl. a
- * timeout under a total outage) as "blocked → proceed" — failed OPEN; this now
- * fails closed on that ambiguity.
- */
-export async function runEgressCanary(targets, sink, probe, now = () => Date.now()) {
-    const [allowed, denied] = await Promise.all([probe(targets.allowedHost), probe(targets.deniedHost)]);
-    const checkedAt = new Date(now()).toISOString();
-    const positiveControl = {
-        host: targets.allowedHost,
-        reachable: allowed.reachable,
-        detail: allowed.detail,
-    };
-    // FAIL CLOSED: a denied host answered — the policy is not enforcing egress.
-    if (denied.reachable) {
-        await sink.append({
-            kind: 'egress_allowed',
-            critical: true,
-            payload: {
-                host: targets.deniedHost,
-                result: 'unexpectedly_reachable',
-                detail: denied.detail,
-                positiveControl,
-                checkedAt,
-            },
-        });
-        return {
-            proceed: false,
-            reason: `denied host ${targets.deniedHost} was reachable (${denied.detail}) — egress is not enforced`,
-            allowed,
-            denied,
-        };
-    }
-    // FAIL CLOSED: the denied host was blocked, but the positive control ALSO did
-    // not answer — the environment/network is broken and we cannot distinguish a
-    // policy block from a total outage. This is the case the old code got wrong.
-    if (!allowed.reachable) {
-        await sink.append({
-            kind: 'egress_allowed',
-            critical: true,
-            payload: {
-                host: targets.deniedHost,
-                result: 'positive_control_unreachable',
-                detail: denied.detail,
-                positiveControl,
-                checkedAt,
-            },
-        });
-        return {
-            proceed: false,
-            reason: `positive control ${targets.allowedHost} was unreachable (${allowed.detail}) — cannot distinguish egress enforcement from a network outage`,
-            allowed,
-            denied,
-        };
-    }
-    // HEALTHY: allowed reachable AND denied blocked → the firewall is live.
-    await sink.append({
-        kind: 'egress_blocked',
-        critical: true,
-        payload: {
-            host: targets.deniedHost,
-            result: 'blocked',
-            detail: denied.detail,
-            positiveControl,
-            checkedAt,
-        },
-    });
-    return { proceed: true, reason: null, allowed, denied };
-}
-/**
- * Derive the known-ALLOWED positive-control host from the run's Orizu API base —
- * always allowlisted (it is the agent's control-plane path) and ours, so it is
- * the safest "must be reachable" signal. Falls back to a lenient host parse if
- * the base is not a well-formed URL.
- */
-export function egressCanaryAllowedHost(apiBaseUrl) {
-    try {
-        return new URL(apiBaseUrl).hostname;
-    }
-    catch {
-        return apiBaseUrl.replace(/^[a-z]+:\/\//i, '').split('/')[0].split(':')[0];
-    }
-}
+import { buildOpenCodeSpawnEnv, defaultProbeEgress, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
+// The lifecycle/orchestration seam moved to `hosted-loop-lifecycle.ts`
+// (ALI-1015 Phase 1) so `lib/hosted-runtime/` can share it with a server-side
+// coordinator. Re-exported here so this module's public surface is unchanged.
+export { DEFAULT_EGRESS_CANARY_HOST, buildOpenCodeSpawnEnv, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
 /**
  * Default deferred-setup-hook runner (in-sandbox): run `bash .orizu/setup.sh` in
  * the workspace if present. Non-fatal — a missing hook or a non-zero exit is
@@ -225,9 +81,21 @@ function resolveIdleTimeoutMs(override) {
 }
 /** Model-key env vars whose value must be scrubbed from every run event. */
 const MODEL_KEY_ENV_VARS = ['ANTHROPIC_API_KEY', 'OPENAI_API_KEY'];
+/**
+ * Env var naming OTHER env vars whose values were injected as secrets — the
+ * server env-bundle pull (ALI-1055: `GET /api/coordinator/sessions/:id/
+ * env-bundle` returns `redactEnvVars`) writes it as a comma-separated list of
+ * names (e.g. `ANTHROPIC_API_KEY,BRAINTRUST_API_KEY`) so every pulled secret
+ * (model key + connector credentials) lands on the run-event redaction list.
+ */
+export const INJECTED_ENV_VARS_ENV = 'ORIZU_INJECTED_ENV_VARS';
 function redactionListFromEnv() {
     const secrets = [];
-    for (const key of MODEL_KEY_ENV_VARS) {
+    const injected = (process.env[INJECTED_ENV_VARS_ENV] ?? '')
+        .split(',')
+        .map(name => name.trim())
+        .filter(name => name.length > 0);
+    for (const key of [...MODEL_KEY_ENV_VARS, ...injected]) {
         const value = process.env[key];
         if (value)
             secrets.push(value);

package/dist/hosted-runtime-assets.js

@@ -175,9 +175,33 @@ async function requestToken(url, bearer, purpose, sessionId) {
   return { cred: null, status: res.status }
 }
 
-async function mint(ctx) {
+// Resolve the Orizu bearer used to mint a repo token. PULL MODE (ALI-1057): when
+// ctx.agentTokenUrl is set, exchange the durable BOOT SECRET (0600 file) for a
+// FRESH short-lived bearer over HTTP on every mint — the DO-path credential
+// identity is the boot secret, not a host-written 0600 bearer file. FILE MODE:
+// read the 0600 bearer file exactly as before. The rest of mint() is unchanged.
+async function resolveOrizuBearer(ctx) {
+  if (ctx.agentTokenUrl) {
+    let secret = ''
+    try { secret = fs.readFileSync(ctx.bootSecretFile, 'utf8').trim() } catch (_) { secret = '' }
+    if (!secret) throw new Error('empty boot secret file')
+    const res = await fetch(ctx.agentTokenUrl, {
+      method: 'GET',
+      headers: { Authorization: 'Bearer ' + secret },
+    })
+    if (!res.ok) throw new Error('agent-token pull failed (' + res.status + ')')
+    let data = null
+    try { data = await res.json() } catch (_) { data = null }
+    if (!data || !data.token) throw new Error('agent-token pull returned no token')
+    return String(data.token)
+  }
   const bearer = fs.readFileSync(ctx.bearerFile, 'utf8').trim()
   if (!bearer) throw new Error('empty bearer file')
+  return bearer
+}
+
+async function mint(ctx) {
+  const bearer = await resolveOrizuBearer(ctx)
   const base = String(ctx.apiBaseUrl || '').replace(/\\/$/, '')
   const url = base + '/api/cli/workspaces/' + encodeURIComponent(ctx.workspaceId) + '/repo-token'
   const purposes = ctx.tokenPurposes || {}

package/dist/hosted-session-cli.js

@@ -41,6 +41,7 @@ import { AGENT_GIT_IDENTITY, BEARER_BASENAME } from './hosted-runtime-assets.js'
 import { createVercelProvider } from './vercel-sandbox-provider.js';
 import { buildEgressPolicy, DEFAULT_EGRESS_CANARY_HOST } from './egress-policy.js';
 import { hostedLoopCommand } from './hosted-loop.js';
+import { hostedBootCommand } from './hosted-boot.js';
 import { authedFetch } from './http.js';
 import { resolveBaseUrl } from './http.js';
 import { getWorkspaceRoot } from './workspace.js';
@@ -599,24 +600,102 @@ function numFlag(args, flag) {
     return Number.isFinite(parsed) ? parsed : undefined;
 }
 const HOSTED_USAGE = 'Usage: orizu session start --hosted --task "<prompt>" [--duration <min> (default 60, max 1440)] ' +
-    '[--model <provider/model>] [--project <team/project>] [--provider vercel|local-sim] ' +
-    '[--image <orizu-hosted-runtime:tag> (pre-baked VCR image; default env ORIZU_HOSTED_IMAGE)] ' +
-    '[--snapshot <snapshot-id> (pre-baked Vercel snapshot, zero-Docker; default env ORIZU_HOSTED_SNAPSHOT; ' +
-    'mutually exclusive with --image)] [--model-key <key> (else ANTHROPIC_API_KEY; required)] [--tail]\n' +
-    'Note (v0): if you disconnect, the agent token expires within its TTL (<=60m) and the run finishes ' +
-    'cleanly; reconnect with `orizu run tail --run <id>`. The sandbox timeout is independent (up to 24h).';
+    '[--model <provider/model>] [--reasoning-effort <level>] [--project <team/project>] ' +
+    '[--title <title>] [--tail]\n' +
+    'Default: the Orizu server provisions the sandbox (no VERCEL_* or model key needed on your machine); ' +
+    'the session coordinator owns its lifetime (ALI-1055).\n' +
+    'DEPRECATED escape hatch: --operator provisions from THIS machine (requires VERCEL_* + ANTHROPIC_API_KEY ' +
+    'or --model-key; extra flags: [--provider vercel|local-sim] [--image <ref>] [--snapshot <id>]). ' +
+    'Removal is planned after DO-coordinator validation (ALI-1055).\n' +
+    'Note (v0, --operator only): if you disconnect, the agent token expires within its TTL (<=60m) and the run ' +
+    'finishes cleanly; reconnect with `orizu run tail --run <id>`. The sandbox timeout is independent (up to 24h).';
+/** Printed on EVERY `--operator` use (founder-locked: deprecate NOW, remove
+ *  after Phase 6 validation). Loud on purpose. */
+export const OPERATOR_DEPRECATION_WARNING = '! DEPRECATED: --operator (operator-provisioned hosted sessions) is deprecated; ' +
+    'removal planned after DO-coordinator validation — ALI-1055. ' +
+    'The default server path needs no VERCEL_* or model key on your machine.';
+/**
+ * Default hosted path (ALI-1055 cutover): POST the server's hosted-sessions
+ * route and let the Durable Object coordinator own the sandbox lifetime. The
+ * CLI never reads VERCEL_* or a model key on this path — the server holds them.
+ */
+export async function startHostedViaServer(args, workspaceId, task, tail, io, fetcher = (path, init) => authedFetch(path, init)) {
+    const payload = {
+        workspaceId,
+        task,
+        durationMinutes: numFlag(args, '--duration'),
+        model: argVal(args, '--model') ?? undefined,
+        reasoningEffort: argVal(args, '--reasoning-effort') ?? undefined,
+        projectSlug: argVal(args, '--project') ?? undefined,
+        title: argVal(args, '--title') ?? undefined,
+    };
+    let response;
+    try {
+        response = await fetcher('/api/cli/hosted-sessions', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(payload),
+        });
+    }
+    catch (error) {
+        io.printErr?.(`hosted session request failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+    const body = (await response.json().catch(() => ({})));
+    const errorMessage = typeof body.error === 'string' ? body.error : `${response.status}`;
+    if (response.status === 503) {
+        io.printErr?.(errorMessage);
+        io.printErr?.('Re-run with `orizu session start --hosted --operator ...` to provision from your machine ' +
+            '(deprecated escape hatch; requires the Vercel token + snapshot on your side).');
+        return 1;
+    }
+    if (!response.ok) {
+        io.print(io.json ? JSON.stringify({ ok: false, error: errorMessage }) : `hosted session failed: ${errorMessage}`);
+        return 1;
+    }
+    const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';
+    const runId = typeof body.runId === 'string' ? body.runId : '';
+    if (io.json) {
+        io.print(JSON.stringify({ ok: true, sessionId, runId: runId || null, coordinator: body.coordinator ?? null }));
+    }
+    else {
+        io.print(`hosted session started: session ${sessionId}` +
+            (runId ? `, run ${runId}` : '') +
+            ' (coordinator-managed sandbox)');
+        if (!tail && runId)
+            io.print(`stream it: orizu run tail --run ${runId}`);
+    }
+    if (tail && runId) {
+        await tailWorkbenchRun({
+            fetcher,
+            runId,
+            onEvent: event => io.print(io.json
+                ? JSON.stringify(event)
+                : `#${String(event.sequence ?? '?')} ${String(event.eventType ?? '')}`),
+        });
+    }
+    return 0;
+}
 /**
  * Dispatch `orizu internal hosted-loop` (in-sandbox) and `orizu session start
  * --hosted` (host-side). Kept out of index.ts so the CLI entrypoint stays a thin
  * dispatcher (ALI-976 ratchet).
+ *
+ * ALI-1055 cutover: the DEFAULT is the server path (POST /api/cli/hosted-sessions
+ * → DO coordinator). `--operator` keeps the old client-provisioned flow as a
+ * DEPRECATED escape hatch (loud warning on every use; removal after Phase 6).
  */
-export async function hostedCommand(args, io) {
+export async function hostedCommand(args, io, deps = {}) {
     const positional = args.filter(arg => !arg.startsWith('--'));
     if (positional[0] === 'internal') {
         if (positional[1] === 'hosted-loop') {
             return hostedLoopCommand(args, io);
         }
-        io.printErr?.('Usage: orizu internal hosted-loop --context <path>');
+        // ALI-1057: the DO-path in-sandbox boot entrypoint (ORIZU_SANDBOX_ENTRYPOINT).
+        if (positional[1] === 'hosted-boot') {
+            return hostedBootCommand(io);
+        }
+        io.printErr?.('Usage: orizu internal <hosted-loop --context <path> | hosted-boot>');
         return 1;
     }
     const task = argVal(args, '--task');
@@ -630,6 +709,16 @@ export async function hostedCommand(args, io) {
         return 1;
     }
     const tail = hasFlag(args, '--tail');
+    if (!hasFlag(args, '--operator')) {
+        // DEFAULT (ALI-1055): server-provisioned. No provider, no VERCEL_* read, no
+        // model key on the customer machine — the coordinator owns the lifetime.
+        return (deps.startViaServer ?? startHostedViaServer)(args, workspaceId, task, tail, io);
+    }
+    // DEPRECATED operator escape hatch — warn LOUDLY on every use.
+    io.printErr?.(OPERATOR_DEPRECATION_WARNING);
+    if (deps.startViaOperator) {
+        return deps.startViaOperator(args, workspaceId, task, tail, io);
+    }
     const providerKind = (argVal(args, '--provider') ?? 'vercel').toLowerCase();
     const provider = providerKind === 'local-sim' ? createLocalSimProvider() : createVercelProvider();
     const hostFetcher = (path, init) => authedFetch(path, init);

package/dist/index.js

@@ -30,6 +30,7 @@ import { connectorsCommand } from './connectors-cli.js';
 import { ARTIFACT_MAX_BYTES, runnerOptimizerCommand } from './artifact-pull.js';
 import { killSwitchCommand } from './kill-switch-cli.js';
 import { egressAllowlistCommand } from './egress-allowlist-cli.js';
+import { teamConnectorsCommand } from './team-connectors-cli.js';
 import { manifestsCommand } from './manifests-cli.js';
 import { workbenchCommand } from './workbench-cli.js';
 import { hostedCommand } from './hosted-session-cli.js';
@@ -5168,6 +5169,23 @@ export async function main(rawArgs = process.argv.slice(2)) {
         process.exitCode = await egressAllowlistCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine, printErr: printError });
         return;
     }
+    if (command === 'team' && subcommand === 'connectors') {
+        process.exitCode = await teamConnectorsCommand(cliArgs.slice(2), {
+            json: hasJsonFlag(),
+            print: printLine,
+            printErr: printError,
+            resolveTeamSlug: async () => {
+                const noInput = hasArg('--no-input') || hasArg('--non-interactive') || !isInteractiveTerminal();
+                try {
+                    return (await resolveSetupTeam(getOptionalArgValue('--team'), noInput, false)).slug;
+                }
+                catch {
+                    return null;
+                }
+            },
+        });
+        return;
+    }
     printUsage();
     process.exit(1);
 }

package/dist/sandbox-hygiene.js

@@ -0,0 +1,60 @@
+/**
+ * Provider-neutral sandbox token-hygiene sweep (ALI-973 / ALI-1050).
+ *
+ * Extracted out of `daytona-slice.ts` so the hygiene helper carries NO Daytona
+ * coupling: it works against any `SandboxProvider`/`SandboxSession` (ADR-003
+ * seam) and is imported by the shipped hosted-bootstrap path (`hosted-bootstrap
+ * .ts`) as well as the founder-only Daytona slice. Keeping it here means the
+ * shipped code never transitively reaches the optional `@daytonaio/sdk`.
+ */
+/**
+ * The list of places a short-lived git token can leak inside a sandbox after a
+ * transient clone+push. List-driven so it is trivial to extend. `${repo}` is
+ * substituted with the repo path. Ordered from the repo-local stores outward to
+ * global config, the credential cache, the reflog, shell history, and the live
+ * process listing / argv — the exact surfaces the Daytona-support question names.
+ */
+export function tokenLeakProbes(repoPath) {
+    const R = repoPath;
+    return [
+        { location: `${R}/.git/config`, command: `cat ${R}/.git/config 2>/dev/null || true` },
+        { location: `${R}/.git/logs (reflog)`, command: `find ${R}/.git/logs -type f -exec cat {} + 2>/dev/null || true` },
+        { location: '~/.git-credentials', command: 'cat "$HOME/.git-credentials" 2>/dev/null || true' },
+        { location: '~/.gitconfig (global)', command: 'cat "$HOME/.gitconfig" 2>/dev/null || true' },
+        { location: 'git credential cache/store', command: 'cat "$HOME/.cache/git/credential/"* "${XDG_CACHE_HOME:-$HOME/.cache}/git/credential/"* 2>/dev/null || true' },
+        { location: 'shell history', command: 'cat "$HOME/.bash_history" "$HOME/.zsh_history" 2>/dev/null || true' },
+        { location: 'process listing / argv', command: 'ps -eo args 2>/dev/null || ps aux 2>/dev/null || true' },
+        { location: 'process env', command: 'env' },
+    ];
+}
+/**
+ * Grep the sandbox filesystem + process table for token values and the
+ * `x-access-token` marker across every known leak surface (see `tokenLeakProbes`).
+ * Returns every finding; an empty array means the transient operations left no
+ * residue. This is the load-bearing check the whole slice exists to make.
+ *
+ * NOTE (local-sim): the reflog/config/credential-store/history probes run
+ * meaningfully in local-sim, but `ps`/argv coverage is only decisive on the live
+ * Daytona run (local-sim runs the git clone via a child process on the host, not
+ * inside an isolated PID namespace). The WS-F memo marks that probe live-only.
+ */
+export async function sweepForTokenResidue(session, opts) {
+    const markers = opts.markers ?? ['x-access-token'];
+    const tokens = opts.tokens.filter(token => token.length > 0);
+    const probes = opts.probes ?? tokenLeakProbes(opts.repoPath);
+    const findings = [];
+    for (const probe of probes) {
+        const { stdout } = await session.exec(probe.command);
+        for (const token of tokens) {
+            if (stdout.includes(token)) {
+                findings.push({ location: probe.location, marker: 'token-value' });
+            }
+        }
+        for (const marker of markers) {
+            if (stdout.includes(marker)) {
+                findings.push({ location: probe.location, marker });
+            }
+        }
+    }
+    return findings;
+}

package/dist/sandbox-provider.js

@@ -51,7 +51,13 @@ import { basename, dirname, join } from 'path';
 // cost is a one-time developer/CI tax on this package, not a runtime or
 // shipped-artifact cost. Re-evaluate if @daytonaio/sdk ever becomes a
 // dependency of a package that IS shipped to end users.
-const DAYTONA_SDK_SPECIFIER = '@daytonaio/sdk';
+//
+// The specifier is ASSEMBLED at runtime (join, not a literal) so a bundler that
+// reaches this module through the shared `lib/hosted-runtime/` surface (ALI-1015:
+// `next build` for the app, wrangler for the coordinator Worker) cannot
+// constant-fold `import(specifier)` into a static dependency on the SDK — the
+// same discipline as the ALI-1031 server provider.
+const DAYTONA_SDK_SPECIFIER = ['@daytonaio', 'sdk'].join('/');
 async function loadDaytonaModule() {
     try {
         const specifier = DAYTONA_SDK_SPECIFIER;