orizu 0.5.9 → 0.5.10

package/dist/daytona-slice.js

@@ -23,6 +23,7 @@
  *      branch → approve → apply via the API, then destroy the sandbox.
  */
 import { WORKSPACE_SCHEMA_VERSION } from './workspace.js';
+import { sweepForTokenResidue } from './sandbox-hygiene.js';
 const REPO_DIR = 'repo';
 const DEFAULT_GENERATED_FILE = 'orizu-slice-note.md';
 const STEP_PLAN = [
@@ -118,57 +119,6 @@ async function mintRepoToken(fetcher, workspaceId, purpose, sessionId) {
         expiresAt: typeof body.expiresAt === 'string' ? body.expiresAt : null,
     };
 }
-/**
- * The list of places a short-lived git token can leak inside a sandbox after a
- * transient clone+push. List-driven so it is trivial to extend. `${repo}` is
- * substituted with the repo path. Ordered from the repo-local stores outward to
- * global config, the credential cache, the reflog, shell history, and the live
- * process listing / argv — the exact surfaces the Daytona-support question names.
- */
-export function tokenLeakProbes(repoPath) {
-    const R = repoPath;
-    return [
-        { location: `${R}/.git/config`, command: `cat ${R}/.git/config 2>/dev/null || true` },
-        { location: `${R}/.git/logs (reflog)`, command: `find ${R}/.git/logs -type f -exec cat {} + 2>/dev/null || true` },
-        { location: '~/.git-credentials', command: 'cat "$HOME/.git-credentials" 2>/dev/null || true' },
-        { location: '~/.gitconfig (global)', command: 'cat "$HOME/.gitconfig" 2>/dev/null || true' },
-        { location: 'git credential cache/store', command: 'cat "$HOME/.cache/git/credential/"* "${XDG_CACHE_HOME:-$HOME/.cache}/git/credential/"* 2>/dev/null || true' },
-        { location: 'shell history', command: 'cat "$HOME/.bash_history" "$HOME/.zsh_history" 2>/dev/null || true' },
-        { location: 'process listing / argv', command: 'ps -eo args 2>/dev/null || ps aux 2>/dev/null || true' },
-        { location: 'process env', command: 'env' },
-    ];
-}
-/**
- * Grep the sandbox filesystem + process table for token values and the
- * `x-access-token` marker across every known leak surface (see `tokenLeakProbes`).
- * Returns every finding; an empty array means the transient operations left no
- * residue. This is the load-bearing check the whole slice exists to make.
- *
- * NOTE (local-sim): the reflog/config/credential-store/history probes run
- * meaningfully in local-sim, but `ps`/argv coverage is only decisive on the live
- * Daytona run (local-sim runs the git clone via a child process on the host, not
- * inside an isolated PID namespace). The WS-F memo marks that probe live-only.
- */
-export async function sweepForTokenResidue(session, opts) {
-    const markers = opts.markers ?? ['x-access-token'];
-    const tokens = opts.tokens.filter(token => token.length > 0);
-    const probes = opts.probes ?? tokenLeakProbes(opts.repoPath);
-    const findings = [];
-    for (const probe of probes) {
-        const { stdout } = await session.exec(probe.command);
-        for (const token of tokens) {
-            if (stdout.includes(token)) {
-                findings.push({ location: probe.location, marker: 'token-value' });
-            }
-        }
-        for (const marker of markers) {
-            if (stdout.includes(marker)) {
-                findings.push({ location: probe.location, marker });
-            }
-        }
-    }
-    return findings;
-}
 // -- The workflow ------------------------------------------------------------
 /**
  * Run a command in the sandbox and throw on a non-zero (or missing) exit code,

package/dist/hosted-boot.js

@@ -0,0 +1,536 @@
+/**
+ * `orizu internal hosted-boot` — the in-sandbox BOOT ENTRYPOINT for the DO-path
+ * hosted agent (ALI-1057). The session coordinator's Durable Object launches
+ * this DETACHED (`ORIZU_SANDBOX_ENTRYPOINT`, via nohup) once it has verified the
+ * pre-baked runtime marker; from here the sandbox bootstraps itself under the
+ * PULL model (ALI-1055): no operator writes its credentials, and no bearer or
+ * connector secret ever rests in Cloudflare.
+ *
+ * WHAT DIFFERS FROM THE OPERATOR PATH (packages/cli/src/hosted-session-cli.ts +
+ * hosted-bootstrap.ts) — and ONLY this:
+ *   (a) credentials are PULLED over HTTP at boot instead of the operator writing
+ *       a 0600 bearer file: the boot secret is exchanged for a fresh Orizu agent
+ *       bearer at ORIZU_AGENT_TOKEN_URL, and the connector env comes from
+ *       ORIZU_ENV_BUNDLE_URL (the 5A contract — connectors only, NO model key);
+ *   (b) the git credential helper runs in PULL MODE (hosted-runtime-assets.ts):
+ *       it GETs a fresh bearer per git op from the agent-token URL (boot-secret
+ *       auth) rather than reading a host-rotated 0600 file.
+ * Everything else — the clone via the credential helper, the loop, the event
+ * sink, redaction — is REUSED, not reimplemented.
+ *
+ * FROZEN ENV CONTRACT (workers/session-coordinator/src/bootstrap.ts
+ * `planSandboxEnv`). Required (fail-fast if any is missing):
+ *   ORIZU_BOOT_SECRET      the per-sandbox durable bootstrap secret;
+ *   ORIZU_AGENT_TOKEN_URL  {coordinator}/sessions/:id/agent-token (bearer pull);
+ *   ORIZU_ENV_BUNDLE_URL   {orizu}/api/coordinator/sessions/:id/env-bundle;
+ *   ORIZU_BASE_URL         the Orizu control-plane origin;
+ *   ORIZU_SESSION_ID       this session id.
+ * Present-but-optional in the contract, resolved from the control plane when
+ * absent: ORIZU_RUN_ID, ORIZU_WORKSPACE_ID (read back from the session), and the
+ * non-secret ANTHROPIC_API_KEY dummy placeholder (firewall brokers the real key).
+ */
+import { spawnSync } from 'child_process';
+import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeSync } from 'fs';
+import { AGENT_GIT_IDENTITY, BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, REPO_CRED_CACHE_BASENAME, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
+import { INJECTED_ENV_VARS_ENV, runHostedLoop, } from './hosted-loop.js';
+import { DEFAULT_EGRESS_CANARY_HOST } from './hosted-loop-lifecycle.js';
+/** Non-secret placeholder model key (firewall brokers the real org key on
+ *  egress). Byte-for-byte the operator path's constant
+ *  (packages/cli/src/hosted-session-cli.ts `ANTHROPIC_DUMMY_KEY` and the
+ *  DO-path `workers/session-coordinator/src/bootstrap.ts`); kept in sync by
+ *  grep. Inlined (not imported) to avoid a hosted-session-cli import cycle. */
+const ANTHROPIC_DUMMY_KEY = 'sk-ant-orizu-proxy-broker-placeholder';
+/** Default hosted model — mirrors hosted-session-cli.ts `DEFAULT_HOSTED_MODEL`. */
+const DEFAULT_HOSTED_MODEL = 'anthropic/claude-opus-4-8';
+// -- Frozen env contract ------------------------------------------------------
+export const REQUIRED_BOOT_ENV_VARS = [
+    'ORIZU_BOOT_SECRET',
+    'ORIZU_AGENT_TOKEN_URL',
+    'ORIZU_ENV_BUNDLE_URL',
+    'ORIZU_BASE_URL',
+    'ORIZU_SESSION_ID',
+];
+/** Validate the frozen env contract. A list of missing REQUIRED names means the
+ *  boot must FAIL FAST with a clear error (the DO records the non-zero exit). */
+export function resolveHostedBootEnv(env) {
+    const missing = [];
+    const req = (name) => {
+        const value = env[name]?.trim();
+        if (!value)
+            missing.push(name);
+        return value ?? '';
+    };
+    const bootSecret = req('ORIZU_BOOT_SECRET');
+    const agentTokenUrl = req('ORIZU_AGENT_TOKEN_URL');
+    const envBundleUrl = req('ORIZU_ENV_BUNDLE_URL');
+    const baseUrl = req('ORIZU_BASE_URL');
+    const sessionId = req('ORIZU_SESSION_ID');
+    if (missing.length > 0)
+        return { ok: false, missing };
+    return {
+        ok: true,
+        value: {
+            bootSecret,
+            agentTokenUrl,
+            envBundleUrl,
+            baseUrl: baseUrl.replace(/\/+$/, ''),
+            sessionId,
+            runId: env.ORIZU_RUN_ID?.trim() || null,
+            workspaceId: env.ORIZU_WORKSPACE_ID?.trim() || null,
+            anthropicDummyKey: env.ANTHROPIC_API_KEY?.trim() || null,
+        },
+    };
+}
+/**
+ * Exchange the boot secret for a fresh Orizu agent bearer at the coordinator's
+ * agent-token route (`GET`, `Authorization: Bearer <boot secret>` → 200
+ * `{token, tokenId, expiresAt}`). Retries with exponential backoff: the DO
+ * persists the boot-secret digest and serves this route DURING bootstrap, but a
+ * transient mint failure (control-plane blip) should not abort the whole boot.
+ * The secret is NEVER logged.
+ */
+export async function pullAgentBearer(opts) {
+    const attempts = Math.max(1, opts.attempts ?? 5);
+    const baseBackoff = opts.backoffMs ?? 500;
+    const sleep = opts.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    let lastDetail = 'no attempt made';
+    for (let attempt = 0; attempt < attempts; attempt++) {
+        try {
+            const res = await opts.fetchImpl(opts.agentTokenUrl, {
+                method: 'GET',
+                headers: { Authorization: `Bearer ${opts.bootSecret}` },
+            });
+            if (res.ok) {
+                const data = (await res.json().catch(() => null));
+                const token = data && typeof data.token === 'string' ? data.token : '';
+                if (token) {
+                    const expiry = data && typeof data.expiresAt === 'string' ? Date.parse(data.expiresAt) : NaN;
+                    return { token, expiresAtMs: Number.isFinite(expiry) ? expiry : null };
+                }
+                lastDetail = 'agent-token response carried no token';
+            }
+            else {
+                lastDetail = `agent-token pull returned ${res.status}`;
+            }
+        }
+        catch (error) {
+            lastDetail = error instanceof Error ? error.message : String(error);
+        }
+        if (attempt < attempts - 1) {
+            const delay = baseBackoff * 2 ** attempt;
+            opts.log?.(`agent-token pull attempt ${attempt + 1}/${attempts} failed (${lastDetail}); retrying in ${delay}ms`);
+            await sleep(delay);
+        }
+    }
+    throw new Error(`agent-token pull failed after ${attempts} attempts: ${lastDetail}`);
+}
+/**
+ * Pull the connector env bundle (5A contract): `GET` with the agent bearer → 200
+ * `{sessionId, connectors:[{ref,envVar,value}], redactEnvVars:[...]}`. The model
+ * key is DELIBERATELY absent (brokered at the firewall). Never logs a value.
+ */
+export async function fetchEnvBundle(opts) {
+    const res = await opts.fetchImpl(opts.envBundleUrl, {
+        method: 'GET',
+        headers: { Authorization: `Bearer ${opts.bearer}` },
+    });
+    if (!res.ok)
+        throw new Error(`env-bundle pull returned ${res.status}`);
+    const data = (await res.json().catch(() => null));
+    if (!data || typeof data !== 'object')
+        throw new Error('env-bundle response was not a JSON object');
+    const connectors = Array.isArray(data.connectors)
+        ? data.connectors.filter((c) => !!c && typeof c === 'object' && typeof c.envVar === 'string' && typeof c.value === 'string')
+        : [];
+    const redactEnvVars = Array.isArray(data.redactEnvVars)
+        ? data.redactEnvVars.filter((v) => typeof v === 'string')
+        : connectors.map(c => c.envVar);
+    return {
+        sessionId: typeof data.sessionId === 'string' ? data.sessionId : null,
+        connectors,
+        redactEnvVars,
+    };
+}
+/**
+ * Export each connector `{envVar: value}` into the environment the loop/agent
+ * inherits, and REGISTER every redacted var on `ORIZU_INJECTED_ENV_VARS` — the
+ * exact hook the in-sandbox loop reads (`redactionListFromEnv`) to scrub these
+ * values from run events. Returns the merged redaction-var list.
+ */
+export function applyEnvBundle(bundle, env) {
+    for (const connector of bundle.connectors) {
+        env[connector.envVar] = connector.value;
+    }
+    const existing = (env[INJECTED_ENV_VARS_ENV] ?? '')
+        .split(',')
+        .map(name => name.trim())
+        .filter(name => name.length > 0);
+    // Redact EVERY exported connector var, not only the server's redactEnvVars
+    // list (review F4 defense-in-depth): if a compromised/misbehaving bundle
+    // returned connectors with a partial/empty redactEnvVars, their values would
+    // otherwise reach run events unscrubbed. We export the value, so we redact it.
+    const connectorVars = bundle.connectors.map(c => c.envVar);
+    const merged = Array.from(new Set([...existing, ...bundle.redactEnvVars, ...connectorVars]));
+    env[INJECTED_ENV_VARS_ENV] = merged.join(',');
+    return merged;
+}
+async function bearerJson(fetchImpl, url, bearer, init = {}) {
+    const res = await fetchImpl(url, {
+        ...init,
+        headers: { ...(init.headers || {}), Authorization: `Bearer ${bearer}` },
+    });
+    if (!res.ok) {
+        throw new Error(`${init.method ?? 'GET'} ${new URL(url).pathname} failed (${res.status})`);
+    }
+    return (await res.json().catch(() => ({})));
+}
+function asString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+/** GET the session (agent-capable, RLS-scoped) to learn its workspace, branch,
+ *  task, and any existing run — the DO start body carries none of these. */
+export async function resolveSession(opts) {
+    const body = await bearerJson(opts.fetchImpl, `${opts.baseUrl}/api/cli/sessions/${encodeURIComponent(opts.sessionId)}`, opts.bearer);
+    const session = (body.session ?? {});
+    const workspaceId = asString(session.workspaceId);
+    if (!workspaceId)
+        throw new Error('session response carried no workspaceId');
+    const repoBranch = asString(session.repoBranch);
+    if (!repoBranch)
+        throw new Error('session response carried no repoBranch (branch not provisioned)');
+    const clientInfo = (session.clientInfo ?? {});
+    const task = asString(clientInfo.task);
+    if (!task)
+        throw new Error('session client_info carried no task prompt');
+    const runs = Array.isArray(session.runs) ? session.runs : [];
+    const runId = runs.length > 0 ? asString(runs[0].id) : null;
+    return {
+        workspaceId,
+        repoBranch,
+        task,
+        model: asString(clientInfo.model),
+        reasoningEffort: asString(clientInfo.reasoningEffort),
+        runId,
+    };
+}
+/** Reuse an existing run or start one with the AGENT bearer (actor_type='agent'),
+ *  exactly like the operator path's run-start step. */
+export async function ensureRun(opts) {
+    if (opts.existingRunId)
+        return opts.existingRunId;
+    const body = await bearerJson(opts.fetchImpl, `${opts.baseUrl}/api/cli/workbench-runs`, opts.bearer, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            workspaceSessionId: opts.sessionId,
+            title: opts.title ?? `Hosted session ${opts.sessionId}`,
+        }),
+    });
+    const run = (body.run ?? {});
+    const runId = asString(run.id);
+    if (!runId)
+        throw new Error('workbench-run start returned no run id');
+    return runId;
+}
+/** Mint a session_read repo token to learn the repo full name, then build the
+ *  GitHub clone URL (mirrors the operator path's `defaultResolveRepo`). The
+ *  minted token is best-effort revoked — the credential helper mints its own. */
+export async function resolveRepo(opts) {
+    const url = `${opts.baseUrl}/api/cli/workspaces/${encodeURIComponent(opts.workspaceId)}/repo-token`;
+    const minted = await bearerJson(opts.fetchImpl, url, opts.bearer, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ purpose: 'session_read', sessionId: opts.sessionId }),
+    });
+    const repoFullName = asString(minted.repo);
+    if (!repoFullName)
+        throw new Error('repo-token response carried no repo');
+    const token = asString(minted.token);
+    const mintId = asString(minted.mintId);
+    if (token && mintId) {
+        try {
+            await opts.fetchImpl(url, {
+                method: 'DELETE',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${opts.bearer}` },
+                body: JSON.stringify({ mintId, token }),
+            });
+        }
+        catch {
+            // best-effort revoke — the short TTL is the backstop.
+        }
+    }
+    return { repoFullName, cloneUrl: `https://github.com/${repoFullName}.git` };
+}
+const defaultExec = (cmd, args, opts) => {
+    const res = spawnSync(cmd, args, { cwd: opts?.cwd, encoding: 'utf8' });
+    return { status: res.status ?? 1, stdout: res.stdout ?? '', stderr: res.stderr ?? '' };
+};
+/** Values interpolated into git's credential.helper string / clone args must be
+ *  benign. We pass everything via execFile-style arg arrays (no shell), but
+ *  still reject anything with newlines/control chars as defense in depth. */
+const SAFE_GIT_VALUE = /^[A-Za-z0-9._/:@+ -]+$/;
+function assertSafeGitValue(name, value) {
+    if (!SAFE_GIT_VALUE.test(value)) {
+        throw new Error(`unsafe characters in ${name}; refusing to pass to git`);
+    }
+}
+function writeSecretFile(path, contents, write) {
+    write(path, contents.endsWith('\n') ? contents : `${contents}\n`);
+}
+/**
+ * The full in-sandbox boot: validate → pull bearer → pull+apply env bundle →
+ * resolve session/run/repo → write the pull-mode credential assets → clone the
+ * session branch → launch the hosted loop (reused, in-process) with a bearer
+ * provider fed by the same pull-mode source. Returns the loop's terminal status.
+ */
+export async function runHostedBoot(opts) {
+    const env = opts.env;
+    const processEnv = opts.processEnv ?? process.env;
+    const root = opts.root ?? process.cwd();
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const exec = opts.exec ?? defaultExec;
+    const mkdirp = opts.mkdirp ?? ((path) => void mkdirSync(path, { recursive: true }));
+    const writeFile = opts.writeFile ??
+        ((path, contents) => {
+            // Atomic write (review F2): write a 0600 temp then rename, so a reader
+            // (the loop reading the bearer file per request, or the credential
+            // helper) never observes a truncated file mid-rotation. Single writer
+            // per path (the rotation timer), so a fixed .tmp suffix is safe.
+            const tmp = `${path}.tmp`;
+            const fd = openSync(tmp, 'w', 0o600);
+            try {
+                writeSync(fd, contents);
+            }
+            finally {
+                closeSync(fd);
+            }
+            renameSync(tmp, path);
+        });
+    const readFile = opts.readFile ?? ((path) => readFileSync(path, 'utf8'));
+    const log = opts.log ?? (() => { });
+    const now = opts.now ?? (() => Date.now());
+    // 1 — Pull the agent bearer (retry/backoff — the DO may still be arming).
+    const bearer = await pullAgentBearer({
+        agentTokenUrl: env.agentTokenUrl,
+        bootSecret: env.bootSecret,
+        fetchImpl,
+        attempts: opts.bearerAttempts,
+        backoffMs: opts.bearerBackoffMs,
+        sleep: opts.sleep,
+        log,
+    });
+    log('agent bearer pulled');
+    // 2 — Pull the connector env bundle and export it (+ register redaction).
+    const bundle = await fetchEnvBundle({ envBundleUrl: env.envBundleUrl, bearer: bearer.token, fetchImpl });
+    const redacted = applyEnvBundle(bundle, processEnv);
+    log(`env bundle applied (${bundle.connectors.length} connectors, ${redacted.length} redacted vars)`);
+    // 3 — Resolve the session (workspace/branch/task) + run + repo from the plane.
+    const session = await resolveSession({ baseUrl: env.baseUrl, sessionId: env.sessionId, bearer: bearer.token, fetchImpl });
+    const workspaceId = env.workspaceId ?? session.workspaceId;
+    const runId = await ensureRun({
+        baseUrl: env.baseUrl,
+        sessionId: env.sessionId,
+        bearer: bearer.token,
+        fetchImpl,
+        existingRunId: env.runId ?? session.runId,
+    });
+    const repo = await resolveRepo({ baseUrl: env.baseUrl, workspaceId, sessionId: env.sessionId, bearer: bearer.token, fetchImpl });
+    log(`resolved run ${runId} on ${repo.repoFullName}@${session.repoBranch}`);
+    // 4 — Write the run-scoped assets: boot secret + initial bearer (0600), the
+    // PULL-MODE credential helper + its boot context. The bearer file feeds the
+    // loop's event sink; the boot secret feeds the credential helper's per-op pull.
+    const runDirRel = `.orizu-run/${runId}`;
+    const runDirAbs = `${root}/${runDirRel}`;
+    const workspaceDir = `${root}/repo`;
+    assertSafeGitValue('sessionBranch', session.repoBranch);
+    assertSafeGitValue('cloneUrl', repo.cloneUrl);
+    mkdirp(runDirAbs);
+    const bootSecretFileAbs = `${runDirAbs}/boot-secret`;
+    const bearerFileAbs = `${runDirAbs}/${BEARER_BASENAME}`;
+    const helperScriptAbs = `${runDirAbs}/${HELPER_SCRIPT_BASENAME}`;
+    const bootContextAbs = `${runDirAbs}/${BOOT_CONTEXT_BASENAME}`;
+    const cacheFileAbs = `${runDirAbs}/${REPO_CRED_CACHE_BASENAME}`;
+    const taskFileAbs = `${runDirAbs}/task.txt`;
+    writeSecretFile(bootSecretFileAbs, env.bootSecret, writeFile);
+    writeSecretFile(bearerFileAbs, bearer.token, writeFile);
+    writeFile(taskFileAbs, session.task);
+    writeFile(helperScriptAbs, renderCredentialHelperScript());
+    const bootContext = {
+        apiBaseUrl: env.baseUrl,
+        workspaceId,
+        sessionId: env.sessionId,
+        runId,
+        sessionBranch: session.repoBranch,
+        repoFullName: repo.repoFullName,
+        host: 'github.com',
+        bearerFile: bearerFileAbs,
+        cacheFile: cacheFileAbs,
+        // PULL MODE: source the bearer over HTTP from the coordinator per git op.
+        agentTokenUrl: env.agentTokenUrl,
+        bootSecretFile: bootSecretFileAbs,
+        tokenPurposes: { primary: 'session_write', fallback: 'session_read' },
+        cacheBufferMs: DEFAULT_CACHE_REFRESH_BUFFER_MS,
+    };
+    writeFile(bootContextAbs, serializeBootContext(bootContext));
+    // 5 — Clone the session branch VIA the pull-mode credential helper (same
+    // invocation the operator path makes; no token in the URL/config).
+    const helperValue = `!node ${helperScriptAbs} ${bootContextAbs}`;
+    const clone = exec('git', [
+        'clone',
+        '--depth',
+        '1',
+        '--branch',
+        session.repoBranch,
+        '-c',
+        `credential.helper=${helperValue}`,
+        '-c',
+        'credential.useHttpPath=true',
+        repo.cloneUrl,
+        workspaceDir,
+    ]);
+    if (clone.status !== 0) {
+        const detail = (clone.stderr || clone.stdout || `exit ${clone.status}`).trim();
+        throw new Error(`git clone failed: ${detail}`);
+    }
+    // Persist the helper + agent identity repo-LOCAL for subsequent fetch/push.
+    exec('git', ['-C', workspaceDir, 'config', 'credential.helper', helperValue]);
+    exec('git', ['-C', workspaceDir, 'config', 'credential.useHttpPath', 'true']);
+    exec('git', ['-C', workspaceDir, 'config', 'user.name', AGENT_GIT_IDENTITY.name]);
+    exec('git', ['-C', workspaceDir, 'config', 'user.email', AGENT_GIT_IDENTITY.email]);
+    log(`cloned ${session.repoBranch}`);
+    // 6 — Launch the hosted loop, reused in-process. The bearer PROVIDER keeps the
+    // event sink's bearer fresh from the same pull-mode source; the DO-provisioned
+    // sandbox always runs the pre-baked image under an enforced egress policy, so
+    // the loop's startup egress canary + deferred setup hook are both armed.
+    const model = session.model ?? DEFAULT_HOSTED_MODEL;
+    const loopContext = {
+        apiBaseUrl: env.baseUrl,
+        runId,
+        bearerFile: bearerFileAbs,
+        taskFile: taskFileAbs,
+        workspaceDir,
+        model,
+        reasoningEffort: session.reasoningEffort ?? undefined,
+        messageId: `${runId}:task`,
+        author: AGENT_GIT_IDENTITY,
+        anthropicDummyKey: env.anthropicDummyKey ?? ANTHROPIC_DUMMY_KEY,
+        prebaked: true,
+        egressCanaryHost: DEFAULT_EGRESS_CANARY_HOST,
+        runSetupHook: true,
+    };
+    const rotation = startBearerRotation({
+        agentTokenUrl: env.agentTokenUrl,
+        bootSecret: env.bootSecret,
+        bearerFileAbs,
+        fetchImpl,
+        writeFile,
+        initialExpiresAtMs: bearer.expiresAtMs,
+        now,
+        log,
+    });
+    try {
+        const runLoop = opts.runLoop ??
+            ((input) => runHostedLoop({ context: input.context, taskPrompt: input.taskPrompt, bearerProvider: input.bearerProvider }));
+        const result = await runLoop({
+            context: loopContext,
+            taskPrompt: session.task,
+            // Read the bearer FILE fresh per request (review F1): `startBearerRotation`
+            // rewrites `bearerFileAbs` before the current bearer expires, so a run
+            // exceeding the ~60-min TTL (DO cap is 24h) keeps a valid bearer. A frozen
+            // closure over the boot-time token would silently stop recording events at
+            // ~TTL. The initial token was written to this file at boot (writeSecretFile
+            // above); the write is atomic (F2), so this never reads a torn file.
+            bearerProvider: () => readFile(bearerFileAbs).trim(),
+        });
+        log(`hosted-loop finished: ${result.status}`);
+        return { ok: !result.error, runId, loopStatus: result.status, error: result.error };
+    }
+    finally {
+        rotation.stop();
+    }
+}
+/**
+ * Background refresher: before the current bearer expires, pull a fresh one from
+ * the coordinator (boot-secret auth) and atomically rewrite the 0600 bearer file
+ * the loop reads per request. This is the DO-path analogue of the operator's
+ * host-side rotation loop — moved in-sandbox because no operator is attached.
+ * Best-effort: a failed refresh is logged and retried. The loop's bearerProvider
+ * reads this file fresh per request (see runHostedBoot), so a rewritten file is
+ * picked up on the next event/request. No-ops when there is no expiry signal.
+ */
+function startBearerRotation(opts) {
+    // Refresh ~5 min before expiry; if the server gives no expiry, fall back to a
+    // conservative fixed cadence just under a typical 60-min TTL.
+    const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+    const FALLBACK_INTERVAL_MS = 50 * 60 * 1000;
+    // Cap the delay well under setTimeout's 32-bit ms limit: a far-future (or
+    // implausible) expiry just means we re-verify the bearer every few hours.
+    const MAX_SCHEDULE_MS = 6 * 60 * 60 * 1000;
+    let stopped = false;
+    let timer = null;
+    const scheduleFrom = (expiresAtMs) => {
+        if (stopped)
+            return;
+        const raw = expiresAtMs ? expiresAtMs - opts.now() - REFRESH_BUFFER_MS : FALLBACK_INTERVAL_MS;
+        const delay = Math.min(MAX_SCHEDULE_MS, Math.max(30_000, raw));
+        timer = setTimeout(refresh, delay);
+        if (typeof timer.unref === 'function')
+            timer.unref();
+    };
+    const refresh = async () => {
+        if (stopped)
+            return;
+        try {
+            const fresh = await pullAgentBearer({
+                agentTokenUrl: opts.agentTokenUrl,
+                bootSecret: opts.bootSecret,
+                fetchImpl: opts.fetchImpl,
+                attempts: 3,
+            });
+            const contents = fresh.token.endsWith('\n') ? fresh.token : `${fresh.token}\n`;
+            opts.writeFile(opts.bearerFileAbs, contents);
+            opts.log('rotated agent bearer (0600 file rewritten)');
+            scheduleFrom(fresh.expiresAtMs);
+        }
+        catch (error) {
+            opts.log(`agent bearer rotation failed: ${error instanceof Error ? error.message : String(error)}`);
+            scheduleFrom(opts.now() + REFRESH_BUFFER_MS); // retry soon
+        }
+    };
+    scheduleFrom(opts.initialExpiresAtMs);
+    return {
+        stop: () => {
+            stopped = true;
+            if (timer)
+                clearTimeout(timer);
+        },
+    };
+}
+/**
+ * Read the frozen env contract from the process env and run the boot. Fails fast
+ * (exit 1) with a clear message naming every missing required var. The DO records
+ * the exit code; run failures beyond the boot itself are recorded server-side.
+ */
+export async function hostedBootCommand(io) {
+    const resolved = resolveHostedBootEnv(process.env);
+    if (!resolved.ok) {
+        io.printErr?.(`hosted-boot: missing required env: ${resolved.missing.join(', ')} ` +
+            '(the DO sandbox env contract — see planSandboxEnv)');
+        return 1;
+    }
+    try {
+        const result = await runHostedBoot({
+            env: resolved.value,
+            log: line => io.printErr?.(`[hosted-boot] ${line}`),
+        });
+        io.print(io.json
+            ? JSON.stringify({ ok: result.ok, runId: result.runId, status: result.loopStatus, error: result.error })
+            : `hosted-boot finished: ${result.loopStatus ?? 'unknown'}${result.error ? ` (${result.error})` : ''}`);
+        return result.ok ? 0 : 1;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        io.printErr?.(`hosted-boot failed: ${message}`);
+        return 1;
+    }
+}

package/dist/hosted-bootstrap.js

@@ -22,7 +22,7 @@
  * build ON TOP of this — `bootstrapHostedSandbox` is the single writer for the
  * run at this stage and returns the run cursor so a follow-on can continue it.
  */
-import { sweepForTokenResidue } from './daytona-slice.js';
+import { sweepForTokenResidue } from './sandbox-hygiene.js';
 import { redactSecrets } from './secret-redaction.js';
 import { AGENT_GIT_IDENTITY, BEARER_BASENAME, BOOT_CONTEXT_BASENAME, DEFAULT_CACHE_REFRESH_BUFFER_MS, HELPER_SCRIPT_BASENAME, PREBAKED_MARKER_PATH, REPO_CRED_CACHE_BASENAME, SETUP_HOOK_RELATIVE_PATH, parsePrebakedMarker, renderCredentialHelperScript, serializeBootContext, } from './hosted-runtime-assets.js';
 function newEventId() {