orizu 0.3.0 → 0.3.2

package/dist/index.js

@@ -1485,8 +1485,11 @@ function removeFlagWithValue(args, flag) {
     return filtered;
 }
 function bundledOrizuGepaPythonPath() {
-    const candidate = fileURLToPath(new URL('../../orizu-gepa-python/src', import.meta.url));
-    return existsSync(candidate) ? candidate : null;
+    const candidates = [
+        fileURLToPath(new URL('../vendor/orizu-gepa-python/src', import.meta.url)),
+        fileURLToPath(new URL('../../orizu-gepa-python/src', import.meta.url)),
+    ];
+    return candidates.find(candidate => existsSync(candidate)) ?? null;
 }
 async function runGepaOptimization() {
     const project = getArg('--project') || await resolveProjectSlug(null);
@@ -2664,6 +2667,47 @@ function readRunnerManifest(runnerDir) {
         supports_body_kind: supportedBodyKinds,
     };
 }
+const RUNNER_TIMEOUT_MS = 120_000;
+const RUNNER_OUTPUT_MAX_BYTES = 2 * 1024 * 1024;
+const RUNNER_ARTIFACT_MAX_BYTES = 25 * 1024 * 1024;
+const RUNNER_ENV_ALLOWLIST = new Set([
+    'PATH',
+    'SystemRoot',
+    'WINDIR',
+    'HOME',
+    'TMPDIR',
+    'TEMP',
+    'TMP',
+    'LANG',
+    'LC_ALL',
+    'PYTHONPATH',
+    'NODE_PATH',
+    'ANTHROPIC_API_KEY',
+    'OPENAI_API_KEY',
+    'GEMINI_API_KEY',
+    'GOOGLE_API_KEY',
+]);
+function runnerSubprocessEnv(inputPath, outputPath) {
+    const env = {};
+    for (const key of RUNNER_ENV_ALLOWLIST) {
+        const value = process.env[key];
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+    env.ORIZU_RUNNER_INPUT_PATH = inputPath;
+    env.ORIZU_RUNNER_OUTPUT_PATH = outputPath;
+    return env;
+}
+function boundedRunnerOutput(value) {
+    if (!value)
+        return '';
+    const buffer = Buffer.isBuffer(value) ? value : Buffer.from(value);
+    if (buffer.byteLength <= RUNNER_OUTPUT_MAX_BYTES) {
+        return buffer.toString('utf8');
+    }
+    return `${buffer.subarray(0, RUNNER_OUTPUT_MAX_BYTES).toString('utf8')}\n[truncated]`;
+}
 async function materializeRunnerVersion(runnerVersionId) {
     const response = await authedFetch(`/api/cli/runner-versions/${encodeURIComponent(runnerVersionId)}/download`);
     if (!response.ok) {
@@ -2672,7 +2716,12 @@ async function materializeRunnerVersion(runnerVersionId) {
     const tempDir = mkdtempSync(join(tmpdir(), 'orizu-runner-version-'));
     const zipPath = join(tempDir, 'runner.zip');
     const runnerDir = join(tempDir, 'runner');
-    writeFileSync(zipPath, new Uint8Array(await response.arrayBuffer()));
+    const zipBytes = new Uint8Array(await response.arrayBuffer());
+    if (zipBytes.byteLength > RUNNER_ARTIFACT_MAX_BYTES) {
+        rmSync(tempDir, { recursive: true, force: true });
+        throw new Error(`Runner artifact exceeds ${RUNNER_ARTIFACT_MAX_BYTES} bytes`);
+    }
+    writeFileSync(zipPath, zipBytes);
     const result = spawnSync('unzip', ['-q', zipPath, '-d', runnerDir], {
         encoding: 'utf8',
     });
@@ -2778,18 +2827,16 @@ async function runnersExec() {
                 }));
                 const result = spawnSync(manifest.command[0], manifest.command.slice(1), {
                     cwd: runnerDir,
-                    env: {
-                        ...process.env,
-                        ORIZU_RUNNER_INPUT_PATH: inputPath,
-                        ORIZU_RUNNER_OUTPUT_PATH: outputPath,
-                    },
+                    env: runnerSubprocessEnv(inputPath, outputPath),
                     encoding: 'utf8',
+                    maxBuffer: RUNNER_OUTPUT_MAX_BYTES,
+                    timeout: RUNNER_TIMEOUT_MS,
                 });
                 if (result.error) {
                     throw result.error;
                 }
                 if (result.status !== 0) {
-                    throw new Error(`Runner failed for row ${row.id} with exit code ${result.status}: ${sanitizeTerminalText(result.stderr || result.stdout || '')}`);
+                    throw new Error(`Runner failed for row ${row.id} with exit code ${result.status}: ${sanitizeTerminalText(boundedRunnerOutput(result.stderr || result.stdout))}`);
                 }
                 const runnerOutput = JSON.parse(readFileSync(outputPath, 'utf8'));
                 resultLines.push(JSON.stringify({

package/package.json

@@ -1,12 +1,22 @@
 {
   "name": "orizu",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "private": false,
   "type": "module",
   "bin": {
     "orizu": "dist/index.js"
   },
+  "files": [
+    "README.md",
+    "dist",
+    "scripts",
+    "src",
+    "tsconfig.json",
+    "vendor"
+  ],
   "scripts": {
-    "build": "tsc -p tsconfig.json"
+    "build": "tsc -p tsconfig.json",
+    "prepack": "node scripts/vendor-gepa-python.mjs",
+    "postpack": "node scripts/vendor-gepa-python.mjs --clean"
   }
 }

package/scripts/vendor-gepa-python.mjs

@@ -0,0 +1,54 @@
+import { cpSync, existsSync, mkdirSync, rmSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const scriptDir = dirname(fileURLToPath(import.meta.url))
+const cliRoot = resolve(scriptDir, '..')
+const repoRoot = resolve(cliRoot, '..', '..')
+const sourceRoot = resolve(repoRoot, 'packages', 'orizu-gepa-python')
+const vendorRoot = resolve(cliRoot, 'vendor', 'orizu-gepa-python')
+const shouldClean = process.argv.includes('--clean')
+const sourceSrc = resolve(sourceRoot, 'src')
+const sourcePyproject = resolve(sourceRoot, 'pyproject.toml')
+const sourceManifest = resolve(sourceRoot, 'manifest.json')
+const vendoredSrc = resolve(vendorRoot, 'src')
+const vendoredPyproject = resolve(vendorRoot, 'pyproject.toml')
+const vendoredManifest = resolve(vendorRoot, 'manifest.json')
+const hasSourcePackage = existsSync(sourceSrc)
+  && existsSync(sourcePyproject)
+  && existsSync(sourceManifest)
+const hasVendoredPackage = existsSync(vendoredSrc)
+  && existsSync(vendoredPyproject)
+  && existsSync(vendoredManifest)
+
+if (shouldClean) {
+  if (hasSourcePackage) {
+    rmSync(vendorRoot, { recursive: true, force: true })
+  }
+  process.exit(0)
+}
+
+if (!hasSourcePackage) {
+  if (hasVendoredPackage) {
+    process.exit(0)
+  }
+  throw new Error(`Unable to vendor orizu-gepa-python: source package not found at ${sourceRoot}`)
+}
+
+rmSync(vendorRoot, { recursive: true, force: true })
+mkdirSync(vendorRoot, { recursive: true })
+cpSync(sourcePyproject, resolve(vendorRoot, 'pyproject.toml'))
+cpSync(sourceManifest, resolve(vendorRoot, 'manifest.json'))
+cpSync(sourceSrc, resolve(vendorRoot, 'src'), {
+  recursive: true,
+  filter: sourcePath => {
+    const normalizedPath = sourcePath.replace(/\\/g, '/')
+    return !normalizedPath.endsWith('/__pycache__')
+      && !normalizedPath.includes('/__pycache__/')
+      && !normalizedPath.endsWith('.pyc')
+      && !normalizedPath.endsWith('.pyo')
+      && !normalizedPath.endsWith('/.pytest_cache')
+      && !normalizedPath.includes('/.pytest_cache/')
+      && !normalizedPath.endsWith('/.DS_Store')
+  },
+})

package/src/index.ts

@@ -2083,8 +2083,12 @@ function removeFlagWithValue(args: string[], flag: string): string[] {
 }
 
 function bundledOrizuGepaPythonPath(): string | null {
-  const candidate = fileURLToPath(new URL('../../orizu-gepa-python/src', import.meta.url))
-  return existsSync(candidate) ? candidate : null
+  const candidates = [
+    fileURLToPath(new URL('../vendor/orizu-gepa-python/src', import.meta.url)),
+    fileURLToPath(new URL('../../orizu-gepa-python/src', import.meta.url)),
+  ]
+
+  return candidates.find(candidate => existsSync(candidate)) ?? null
 }
 
 async function runGepaOptimization() {

package/vendor/orizu-gepa-python/manifest.json

@@ -0,0 +1,9 @@
+{
+  "schema_version": "orizu.optimizer.v1",
+  "name": "orizu-gepa-text",
+  "description": "Orizu-owned text candidate optimizer with GEPA-style reflection and mandatory live event logging.",
+  "language": "python",
+  "command": ["python3", "-m", "orizu_gepa.cli"],
+  "optimizer_family": "gepa",
+  "candidate_kind": "text"
+}

package/vendor/orizu-gepa-python/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "orizu-gepa"
+version = "0.1.0"
+description = "Orizu-owned text prompt optimizer with GEPA-style reflection and mandatory live logging."
+requires-python = ">=3.10"
+dependencies = []
+
+[project.scripts]
+orizu-gepa = "orizu_gepa.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

package/vendor/orizu-gepa-python/src/orizu_gepa/__init__.py

@@ -0,0 +1,19 @@
+from .optimizer import (
+    Budget,
+    DatasetRow,
+    PromptContext,
+    RowEvaluation,
+    TextGepaConfig,
+    TextGepaResult,
+    optimize_text_candidate,
+)
+
+__all__ = [
+    "Budget",
+    "DatasetRow",
+    "PromptContext",
+    "RowEvaluation",
+    "TextGepaConfig",
+    "TextGepaResult",
+    "optimize_text_candidate",
+]

package/vendor/orizu-gepa-python/src/orizu_gepa/cli.py

@@ -0,0 +1,173 @@
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+from typing import Any
+
+from .client import OrizuClient, OrizuEventSink
+from .optimizer import TextGepaConfig, optimize_loaded_text_candidate
+from .reflection import reflect_with_provider
+from .runner import make_candidate_runner, make_scorer_runner
+
+
+def positive_int(value: str) -> int:
+    parsed = int(value)
+    if parsed <= 0:
+        raise argparse.ArgumentTypeError("must be positive")
+    return parsed
+
+
+def read_text_arg(value: str | None) -> str | None:
+    if value is None:
+        return None
+    if value.startswith("@"):
+        return Path(value[1:]).read_text()
+    path = Path(value)
+    if path.exists():
+        return path.read_text()
+    return value
+
+
+def read_json_object_arg(value: str | None, flag_name: str) -> dict[str, Any] | None:
+    text = read_text_arg(value)
+    if text is None:
+        return None
+    parsed = json.loads(text)
+    if not isinstance(parsed, dict):
+        raise RuntimeError(f"{flag_name} must be a JSON object")
+    return parsed
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(prog="orizu-gepa")
+    parser.add_argument("--project", required=True)
+    parser.add_argument("--optimizer-version-id", required=True)
+    parser.add_argument("--candidate-version-id", required=True)
+    parser.add_argument("--runner-version-id", required=True)
+    parser.add_argument("--candidate-runner-dir", required=True)
+    parser.add_argument("--scorer-version-id", required=True)
+    parser.add_argument("--scorer-runner-version-id", required=True)
+    parser.add_argument("--scorer-runner-dir", required=True)
+    parser.add_argument("--dataset-version-id", required=True)
+    parser.add_argument("--split-set-id", required=True)
+    parser.add_argument("--train-split", default="train")
+    parser.add_argument("--val-split", default="validation")
+    parser.add_argument("--budget", default="light", choices=["auto", "light", "medium", "high"])
+    parser.add_argument("--max-iterations", type=positive_int, default=3)
+    parser.add_argument("--minibatch-size", type=positive_int, default=3)
+    parser.add_argument(
+        "--candidate-selection-strategy",
+        default=TextGepaConfig.candidate_selection_strategy,
+        choices=["pareto", "current_best", "epsilon_greedy"],
+    )
+    parser.add_argument("--epsilon", type=float, default=TextGepaConfig.epsilon)
+    parser.add_argument("--disable-evaluation-cache", action="store_true")
+    parser.add_argument("--max-metric-calls", type=positive_int)
+    parser.add_argument("--max-full-evals", type=positive_int)
+    parser.add_argument("--reflection-model", default=TextGepaConfig.reflection_model)
+    parser.add_argument("--reflection-temperature", type=float)
+    parser.add_argument("--reflection-prompt-template")
+    parser.add_argument("--reflection-provider-settings")
+    parser.add_argument("--objective", default=TextGepaConfig.objective)
+    parser.add_argument("--seed", type=int, default=0)
+    parser.add_argument("--auto-promote", action="store_true")
+    parser.add_argument("--promotion-label")
+    parser.add_argument("--log-row-snapshots", action="store_true")
+    parser.add_argument("--metadata", default="{}")
+    args = parser.parse_args()
+
+    metadata = json.loads(args.metadata)
+    if not isinstance(metadata, dict):
+        raise RuntimeError("--metadata must be a JSON object")
+
+    config = TextGepaConfig(
+        budget=args.budget,
+        max_iterations=args.max_iterations,
+        minibatch_size=args.minibatch_size,
+        candidate_selection_strategy=args.candidate_selection_strategy,
+        epsilon=args.epsilon,
+        max_metric_calls=args.max_metric_calls,
+        max_full_evals=args.max_full_evals,
+        reflection_model=args.reflection_model,
+        reflection_temperature=args.reflection_temperature,
+        reflection_prompt_template=read_text_arg(args.reflection_prompt_template),
+        reflection_provider_settings=read_json_object_arg(args.reflection_provider_settings, "--reflection-provider-settings") or {},
+        objective=args.objective,
+        seed=args.seed,
+        auto_promote=args.auto_promote,
+        promotion_label=args.promotion_label,
+        cache_evaluations=not args.disable_evaluation_cache,
+        log_row_snapshots=args.log_row_snapshots,
+    )
+    client = OrizuClient.from_env()
+    prompt_context, trainset = client.fetch_exec_context(
+        prompt_version_id=args.candidate_version_id,
+        runner_version_id=args.runner_version_id,
+        dataset_version_id=args.dataset_version_id,
+        split_set_id=args.split_set_id,
+        split=args.train_split,
+    )
+    _, valset = client.fetch_exec_context(
+        prompt_version_id=args.candidate_version_id,
+        runner_version_id=args.runner_version_id,
+        dataset_version_id=args.dataset_version_id,
+        split_set_id=args.split_set_id,
+        split=args.val_split,
+    )
+    scorer_context, _ = client.fetch_scorer_exec_context(
+        scorer_version_id=args.scorer_version_id,
+        runner_version_id=args.scorer_runner_version_id,
+        dataset_version_id=args.dataset_version_id,
+        split_set_id=args.split_set_id,
+        split=args.val_split,
+    )
+
+    run_id = client.start_run(
+        project=args.project,
+        optimizer_version_id=args.optimizer_version_id,
+        prompt_version_id=args.candidate_version_id,
+        scorer_version_id=args.scorer_version_id,
+        dataset_version_id=args.dataset_version_id,
+        split_set_id=args.split_set_id,
+        train_split=args.train_split,
+        validation_split=args.val_split,
+        metadata={
+            **metadata,
+            "optimizer_package": "orizu-gepa-python",
+            "optimizer_family": "gepa",
+            "mode": "text-candidate",
+            "inference_lm": prompt_context.provider_settings.get("model"),
+            "reflection_lm": config.reflection_model,
+            "scorer_lm": scorer_context.provider_settings.get("model"),
+            "dataset_size": len(trainset) + len(valset),
+            "train_count": len(trainset),
+            "validation_count": len(valset),
+        },
+    )
+    print(f"[orizu-gepa] started optimization run {run_id}", flush=True)
+
+    result = optimize_loaded_text_candidate(
+        run_id=run_id,
+        prompt_context=prompt_context,
+        scorer_context=scorer_context,
+        trainset=trainset,
+        valset=valset,
+        candidate_runner=make_candidate_runner(Path(args.candidate_runner_dir), run_id),
+        scorer_runner=make_scorer_runner(Path(args.scorer_runner_dir), run_id),
+        reflector=reflect_with_provider,
+        event_sink=OrizuEventSink(client, run_id, fail_on_log_error=config.fail_on_log_error),
+        config=config,
+    )
+    print(json.dumps({
+        "optimization_run_id": result.run_id,
+        "best_candidate_id": result.best_candidate_id,
+        "best_score": result.best_score,
+        "seed_score": result.seed_score,
+        "promoted_prompt_version_id": result.promoted_prompt_version_id,
+        "budget": result.budget.to_payload(),
+    }))
+
+
+if __name__ == "__main__":
+    main()