orizu 0.4.1 → 0.5.0

package/dist/index.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { createHash, randomBytes, randomUUID } from 'crypto';
-import { basename, delimiter, dirname, extname, isAbsolute, join, normalize } from 'path';
+import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve } from 'path';
 import { fileURLToPath } from 'url';
 import { createServer } from 'http';
 import { gunzipSync, gzipSync } from 'zlib';
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from 'fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from 'fs';
 import { spawn, spawnSync } from 'child_process';
-import { tmpdir } from 'os';
+import { homedir, tmpdir } from 'os';
 import { createInterface } from 'readline/promises';
+import { emitKeypressEvents } from 'readline';
 import { stdin as input, stdout as output } from 'process';
 import { clearServerCredentials, getServerCredentials, saveServerCredentials } from './credentials.js';
 import { parseDatasetFile } from './file-parser.js';
@@ -16,15 +17,45 @@ import { parseDatasetReference } from './dataset-download.js';
 import { extractErrorMessage } from './error-response.js';
 import { parseGlobalFlags } from './global-flags.js';
 import { getCapabilities, renderHelpForArgs, renderRootHelp } from './help.js';
+import { zipDirectoryToBase64 } from './artifact-archive.js';
 import { runLocalAppPreview } from './preview-runtime.js';
-import { parseAssignmentManifestJsonl } from './task-assignment-manifest.js';
-import { assertSecureTokenTransport, authedFetch, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags, } from './http.js';
+import { readAssignmentManifestJsonlFile } from './task-assignment-manifest.js';
+import { assertSecureTokenTransport, authedFetch, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags } from './http.js';
 import { computeSkillContentHash, getSkillInstallPath, getSkillTargetStatus, getTargetForAgent, installSkillTarget, isSkillInstallAgent, isSkillInstallTarget, resolveSkillSource, SKILL_INSTALL_AGENTS, SKILL_INSTALL_TARGETS, targetNeedsOverwrite, } from './skill-installer.js';
 import { renderBanner } from './banner.js';
 import { formatTaskCreateError } from './task-create-error.js';
 import { renderAgentSetupPrompt } from './setup-prompt.js';
-import { getWorkspaceRoot, initOrizuWorkspace, WORKSPACE_DIR_NAME, workspaceExists, } from './workspace.js';
+import { getWorkspaceRoot, initOrizuWorkspace, workspaceExists, } from './workspace.js';
+import { connectorsCommand } from './connectors-cli.js';
+import { killSwitchCommand } from './kill-switch-cli.js';
+import { egressAllowlistCommand } from './egress-allowlist-cli.js';
+import { manifestsCommand } from './manifests-cli.js';
+import { workbenchCommand } from './workbench-cli.js';
+import { hostedCommand } from './hosted-session-cli.js';
+import { workspaceSyncCommand } from './workspace-sync.js';
+import { runGitCredential } from './git-credential.js';
+import { runGithubLink, runInteractiveHostedSetup } from './github-setup.js';
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isNodeError(error) {
+    return error instanceof Error;
+}
 const MAX_README_LENGTH = 200_000;
+const TASK_STATUS_ACTION_LABELS = {
+    paused: {
+        verb: 'pause',
+        pastTense: 'Paused',
+    },
+    active: {
+        verb: 'unpause',
+        pastTense: 'Unpaused',
+    },
+    completed: {
+        verb: 'complete',
+        pastTense: 'Completed',
+    },
+};
 function getCliVersion() {
     const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
     if (typeof packageJson.version !== 'string' || packageJson.version.length === 0) {
@@ -49,12 +80,6 @@ function printUsage() {
     printBannerIfInteractive();
     printLine(renderRootHelp());
 }
-function printPreviewUsage() {
-    printLine(`\nLocal app preview:\n\n  orizu apps preview --file <path> --input-schema <json-path> --output-schema <json-path> --sample-row <json-path> [--screenshot <png-path>] [--headed] [--keep-open] [--component <name>]`);
-}
-function printOptimizationUsage() {
-    printLine(`\nOptimization lifecycle commands:\n\n  orizu optimizations start --project <team/project> --optimizer-version <id> --prompt-version <id[,id]> --selection-scorer <id> [--reflection-scorer <id>] [--pareto-scorer <id>] [--best-scorer <id>] --dataset-version <id> --split-set <id> [--train-split <name>] [--validation-split <name>] [--metadata <json|@file>] [--json]\n  orizu optimizations run-gepa --project <team/project> --optimizer-version-id <id> --candidate-version-id <id> --runner-version-id <id> --candidate-runner-dir <dir> --scorer-version-id <id> --scorer-runner-version-id <id> --scorer-runner-dir <dir> --dataset-version-id <id> --split-set-id <id> [--train-split train] [--val-split validation] [--budget auto|light|medium|heavy | --max-metric-calls <n> | --max-full-evals <n> | --max-iterations <n>] [--num-threads auto|N] [--reflection-retry-attempts N] [--reflection-http-timeout-seconds N] [--log-dir logs] [--no-skip-perfect-parent-reflection]\n  orizu optimizations export <run-id> [--out <path>] [--json]\n  orizu optimizations pause <run-id> [--reason <text>] [--json]\n  orizu optimizations resume <run-id> [--json]\n  orizu optimizations finish <run-id> [--best-score <n>] [--best-candidate <id>] [--result-prompt-version <id>] [--report <markdown|@file> | --report-file <path>] [--metadata <json|@file>] [--json]\n  orizu optimizations fail <run-id> [--reason <text>] [--report <markdown|@file> | --report-file <path>] [--metadata <json|@file>] [--json]\n  orizu optimizations cancel <run-id> [--reason <text>] [--report <markdown|@file> | --report-file <path>] [--json]`);
-}
 let cliArgs = process.argv.slice(2);
 let cliJsonOutput = false;
 function getArg(name) {
@@ -79,6 +104,17 @@ function getArgs(name) {
     }
     return values;
 }
+function getOptionalArgValue(name) {
+    const index = cliArgs.indexOf(name);
+    if (index === -1 || index + 1 >= cliArgs.length) {
+        return null;
+    }
+    const value = cliArgs[index + 1];
+    if (!value || value.startsWith('-')) {
+        return null;
+    }
+    return value;
+}
 function rejectDashPrefixedOptionValue(name, value) {
     if (value && value.startsWith('-')) {
         throw new Error(`Invalid value for ${name}: option values cannot start with a dash`);
@@ -123,6 +159,9 @@ export function createCodeChallenge(verifier) {
 export function sanitizeTerminalText(value) {
     return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
 }
+function printError(message) {
+    console.error(sanitizeTerminalText(message));
+}
 export function validateBrowserUrl(url, expectedOrigin) {
     let parsed;
     try {
@@ -266,7 +305,7 @@ function readJsonObjectArg(valueArg, label) {
         return parsed;
     }
     catch (error) {
-        throw new Error(`Invalid ${label} '${valueArg}': ${error?.message || String(error)}`);
+        throw new Error(`Invalid ${label} '${valueArg}': ${getErrorMessage(error)}`);
     }
 }
 function readJsonPayloadArg(pathArg) {
@@ -352,6 +391,38 @@ async function fetchTeamMembers(teamSlug) {
     const data = await parseJsonResponse(response, 'Team members list');
     return data.members;
 }
+async function createTeamOnServer(name) {
+    const response = await authedFetch('/api/cli/teams', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name }),
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to create team: ${await response.text()}`);
+    }
+    const data = await parseJsonResponse(response, 'Team create');
+    return data.team;
+}
+async function createProjectOnServer(teamSlug, name) {
+    const response = await authedFetch('/api/cli/projects', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ teamSlug, name }),
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to create project: ${await response.text()}`);
+    }
+    const data = await parseJsonResponse(response, 'Project create');
+    return {
+        id: data.project.id,
+        name: data.project.name,
+        slug: data.project.slug,
+        teamId: data.project.teamId || '',
+        teamName: data.project.teamName || data.project.teamSlug,
+        teamSlug: data.project.teamSlug,
+        role: data.project.role || 'admin',
+    };
+}
 async function resolveProjectSelection(projectArg) {
     projectArg = projectArg || process.env.ORIZU_PROJECT || null;
     const teams = await fetchTeams();
@@ -371,7 +442,7 @@ async function resolveProjectSelection(projectArg) {
     const [teamSlug, projectSlug] = segments.map(normalizeSlugInput);
     const matchedTeam = teams.find(team => team.slug === teamSlug);
     if (!matchedTeam) {
-        console.error(`Team '${sanitizeTerminalText(teamSlug)}' not found in your accessible teams.`);
+        printError(`Team '${teamSlug}' not found in your accessible teams.`);
         const selectedTeam = await promptSelect('Select a team', teams, team => `${team.name} (${team.slug})`);
         const projects = await fetchProjects(selectedTeam.slug);
         const selectedProject = await promptSelect(`Select a project in ${selectedTeam.slug}`, projects, project => `${project.name} (${project.teamSlug}/${project.slug})`);
@@ -380,7 +451,7 @@ async function resolveProjectSelection(projectArg) {
     const projects = await fetchProjects(matchedTeam.slug);
     const matchedProject = projects.find(project => project.slug === projectSlug);
     if (!matchedProject) {
-        console.error(`Project '${sanitizeTerminalText(projectSlug)}' not found in team '${sanitizeTerminalText(matchedTeam.slug)}'.`);
+        printError(`Project '${projectSlug}' not found in team '${matchedTeam.slug}'.`);
         const selectedProject = await promptSelect(`Select a project in ${matchedTeam.slug}`, projects, project => `${project.name} (${project.teamSlug}/${project.slug})`);
         return selectedProject;
     }
@@ -1989,20 +2060,12 @@ async function createTeam() {
     if (!name) {
         throw new Error('Usage: orizu teams create --name <name>');
     }
-    const response = await authedFetch('/api/cli/teams', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to create team: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Team create');
+    const team = await createTeamOnServer(name);
     if (hasJsonFlag()) {
-        printJson({ team: data.team });
+        printJson({ team });
         return;
     }
-    printLine(`Created team: ${sanitizeTerminalText(data.team.name)} (${sanitizeTerminalText(data.team.slug)})`);
+    printLine(`Created team: ${sanitizeTerminalText(team.name)} (${sanitizeTerminalText(team.slug)})`);
 }
 async function listProjects() {
     const teamSlugArg = getArg('--team');
@@ -2025,20 +2088,12 @@ async function createProject() {
         const team = await promptSelect('Select a team', await fetchTeams(), item => `${item.name} (${item.slug})`, { forcePrompt: true });
         teamSlug = team.slug;
     }
-    const response = await authedFetch('/api/cli/projects', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ teamSlug, name }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to create project: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Project create');
+    const project = await createProjectOnServer(teamSlug, name);
     if (hasJsonFlag()) {
-        printJson({ project: data.project });
+        printJson({ project });
         return;
     }
-    printLine(`Created project ${sanitizeTerminalText(`${data.project.teamSlug}/${data.project.slug}`)}`);
+    printLine(`Created project ${sanitizeTerminalText(`${project.teamSlug}/${project.slug}`)}`);
 }
 async function listTasks() {
     const project = getArg('--project');
@@ -2064,10 +2119,10 @@ function readSourceFile(pathArg) {
         return readFileSync(expandedPath, 'utf-8');
     }
     catch (error) {
-        if (error?.code === 'ENOENT') {
+        if (isNodeError(error) && error.code === 'ENOENT') {
             throw new Error(`File not found: ${expandedPath}`);
         }
-        throw new Error(`Failed to read file '${expandedPath}': ${error?.message || String(error)}`);
+        throw new Error(`Failed to read file '${expandedPath}': ${getErrorMessage(error)}`);
     }
 }
 function readSourceBytes(pathArg) {
@@ -2076,10 +2131,10 @@ function readSourceBytes(pathArg) {
         return readFileSync(expandedPath);
     }
     catch (error) {
-        if (error?.code === 'ENOENT') {
+        if (isNodeError(error) && error.code === 'ENOENT') {
             throw new Error(`File not found: ${expandedPath}`);
         }
-        throw new Error(`Failed to read file '${expandedPath}': ${error?.message || String(error)}`);
+        throw new Error(`Failed to read file '${expandedPath}': ${getErrorMessage(error)}`);
     }
 }
 function hasJsonFlag() {
@@ -2116,12 +2171,261 @@ async function askYesNo(question, defaultYes) {
         rl.close();
     }
 }
+async function askText(question, defaultValue) {
+    const rl = createInterface({ input, output });
+    try {
+        const suffix = defaultValue ? ` [${defaultValue}]` : '';
+        const answer = (await rl.question(`${question}${suffix} `)).trim();
+        return answer || defaultValue;
+    }
+    finally {
+        rl.close();
+    }
+}
+async function waitForAnyKeyOrEscape(message) {
+    if (!isInteractiveTerminal()) {
+        throw new Error('Interactive terminal required.');
+    }
+    printLine(message);
+    const rawInput = input;
+    const wasRaw = Boolean(rawInput.isRaw);
+    emitKeypressEvents(input);
+    return new Promise((resolvePromise, rejectPromise) => {
+        function cleanup() {
+            input.off('keypress', onKeypress);
+            if (rawInput.setRawMode && !wasRaw) {
+                rawInput.setRawMode(false);
+            }
+            input.pause();
+            printLine('');
+        }
+        function onKeypress(_chunk, key) {
+            cleanup();
+            if (key.ctrl && key.name === 'c') {
+                rejectPromise(new Error('Setup cancelled.'));
+                return;
+            }
+            resolvePromise(key.name !== 'escape');
+        }
+        input.on('keypress', onKeypress);
+        input.resume();
+        rawInput.setRawMode?.(true);
+    });
+}
+async function promptKeyboardSelect(title, items, label) {
+    if (items.length === 0) {
+        throw new Error(`No options available for ${title.toLowerCase()}`);
+    }
+    if (!isInteractiveTerminal()) {
+        throw new Error(`${title} selection requires interactive terminal. Provide flags explicitly instead.`);
+    }
+    printLine(`\n${sanitizeTerminalText(title)}`);
+    printLine('Use ↑/↓ to choose, Enter to confirm, or Esc to cancel.');
+    let selected = 0;
+    let rendered = false;
+    const rawInput = input;
+    const wasRaw = Boolean(rawInput.isRaw);
+    emitKeypressEvents(input);
+    function render() {
+        if (rendered) {
+            output.write(`\x1b[${items.length}A`);
+        }
+        items.forEach((item, index) => {
+            output.write('\x1b[2K');
+            const marker = index === selected ? '●' : '○';
+            output.write(`  ${marker} ${sanitizeTerminalText(label(item, index))}\n`);
+        });
+        rendered = true;
+    }
+    render();
+    output.write('\x1b[?25l');
+    return new Promise((resolvePromise, rejectPromise) => {
+        function cleanup() {
+            input.off('keypress', onKeypress);
+            if (rawInput.setRawMode && !wasRaw) {
+                rawInput.setRawMode(false);
+            }
+            input.pause();
+            output.write('\x1b[?25h');
+            printLine('');
+        }
+        function onKeypress(_chunk, key) {
+            if (key.ctrl && key.name === 'c') {
+                cleanup();
+                rejectPromise(new Error('Setup cancelled.'));
+                return;
+            }
+            if (key.name === 'escape') {
+                cleanup();
+                rejectPromise(new Error('Setup cancelled.'));
+                return;
+            }
+            if (key.name === 'up') {
+                selected = (selected - 1 + items.length) % items.length;
+                render();
+                return;
+            }
+            if (key.name === 'down') {
+                selected = (selected + 1) % items.length;
+                render();
+                return;
+            }
+            if (key.name === 'return' || key.name === 'enter') {
+                const item = items[selected];
+                cleanup();
+                resolvePromise(item);
+            }
+        }
+        input.on('keypress', onKeypress);
+        input.resume();
+        rawInput.setRawMode?.(true);
+    });
+}
+async function promptKeyboardMultiSelect(title, items, label, defaultSelected) {
+    if (items.length === 0) {
+        return [];
+    }
+    if (!isInteractiveTerminal()) {
+        throw new Error(`${title} selection requires interactive terminal. Provide flags explicitly instead.`);
+    }
+    printLine(`\n${sanitizeTerminalText(title)}`);
+    printLine('Use ↑/↓ to move, Space to toggle, Enter to confirm, or Esc to skip.');
+    let selected = 0;
+    let rendered = false;
+    const checked = new Set();
+    items.forEach((item, index) => {
+        if (defaultSelected(item, index)) {
+            checked.add(index);
+        }
+    });
+    const rawInput = input;
+    const wasRaw = Boolean(rawInput.isRaw);
+    emitKeypressEvents(input);
+    function render() {
+        if (rendered) {
+            output.write(`\x1b[${items.length}A`);
+        }
+        items.forEach((item, index) => {
+            output.write('\x1b[2K');
+            const cursor = index === selected ? '›' : ' ';
+            const marker = checked.has(index) ? '◉' : '○';
+            output.write(`${cursor} ${marker} ${sanitizeTerminalText(label(item, index))}\n`);
+        });
+        rendered = true;
+    }
+    render();
+    output.write('\x1b[?25l');
+    return new Promise((resolvePromise, rejectPromise) => {
+        function cleanup() {
+            input.off('keypress', onKeypress);
+            if (rawInput.setRawMode && !wasRaw) {
+                rawInput.setRawMode(false);
+            }
+            input.pause();
+            output.write('\x1b[?25h');
+            printLine('');
+        }
+        function onKeypress(_chunk, key) {
+            if (key.ctrl && key.name === 'c') {
+                cleanup();
+                rejectPromise(new Error('Setup cancelled.'));
+                return;
+            }
+            if (key.name === 'escape') {
+                cleanup();
+                resolvePromise([]);
+                return;
+            }
+            if (key.name === 'up') {
+                selected = (selected - 1 + items.length) % items.length;
+                render();
+                return;
+            }
+            if (key.name === 'down') {
+                selected = (selected + 1) % items.length;
+                render();
+                return;
+            }
+            if (key.name === 'space') {
+                if (checked.has(selected)) {
+                    checked.delete(selected);
+                }
+                else {
+                    checked.add(selected);
+                }
+                render();
+                return;
+            }
+            if (key.name === 'return' || key.name === 'enter') {
+                const selectedItems = items.filter((_item, index) => checked.has(index));
+                cleanup();
+                resolvePromise(selectedItems);
+            }
+        }
+        input.on('keypress', onKeypress);
+        input.resume();
+        rawInput.setRawMode?.(true);
+    });
+}
+function formatFindingCount(count, label) {
+    return `${count} ${label}${count === 1 ? '' : 's'}`;
+}
+function validationSummary(findings, logPath) {
+    if (findings.length === 0) {
+        return 'passed';
+    }
+    const errors = findings.filter(finding => finding.severity === 'error').length;
+    const warnings = findings.filter(finding => finding.severity === 'warning').length;
+    const infos = findings.filter(finding => finding.severity === 'info').length;
+    const parts = [
+        errors > 0 ? formatFindingCount(errors, 'error') : null,
+        warnings > 0 ? formatFindingCount(warnings, 'warning') : null,
+        infos > 0 ? formatFindingCount(infos, 'info') : null,
+    ].filter(Boolean);
+    const location = logPath ? ` (printed to ${logPath})` : '';
+    return `${parts.join(', ')}${location}`;
+}
+function writeWorkspaceValidationLog(workspaceRoot, findings, dryRun) {
+    if (findings.length === 0 || dryRun) {
+        return null;
+    }
+    const logsDir = join(workspaceRoot, '.logs');
+    mkdirSync(logsDir, { recursive: true });
+    const logPath = join(logsDir, `${randomBytes(6).toString('hex')}.log`);
+    const lines = [
+        'Orizu workspace validation',
+        `Generated at: ${new Date().toISOString()}`,
+        `Workspace: ${workspaceRoot}`,
+        `Summary: ${validationSummary(findings, null)}`,
+        '',
+        ...findings.map(finding => {
+            const path = finding.path ? ` ${finding.path}` : '';
+            return `${finding.severity.toUpperCase()} ${finding.code}:${path} ${finding.message}`;
+        }),
+        '',
+    ];
+    writeFileSync(logPath, lines.join('\n'), 'utf8');
+    return relative(workspaceRoot, logPath);
+}
+function printWorkspaceFindings(findings) {
+    if (findings.length === 0) {
+        printLine('   Validation passed.');
+        return;
+    }
+    printLine('   Validation findings:');
+    for (const finding of findings) {
+        const path = finding.path ? ` ${finding.path}` : '';
+        printLine(`   - ${finding.severity.toUpperCase()} ${finding.code}:${path} ${finding.message}`);
+    }
+}
 const SKILL_INSTALL_USAGE = `Usage: orizu install-skill [--agent <${SKILL_INSTALL_AGENTS.join('|')}>]... [--scope global|project] [--mode auto|link|copy] [--target <${SKILL_INSTALL_TARGETS.join('|')}>]... [--yes] [--dry-run]`;
 function describeSkillTarget(target) {
     if (target === 'claude-user')
         return 'Claude Code, for you across all projects';
     if (target === 'claude-project')
         return 'Claude Code, only for this project';
+    if (target === 'codex-user')
+        return 'Codex, for you across all projects';
     if (target === 'agent-user')
         return 'Codex / Open Agent Skills, for you across all projects';
     if (target === 'agents-project')
@@ -2223,8 +2527,16 @@ function describePlannedWrite(target, action, mode, path) {
 async function applySkillInstallTargets(targets, options) {
     const cliVersion = getCliVersion();
     const jsonMode = hasJsonFlag();
-    const planned = targets.map(target => installSkillTarget(target, { dryRun: true, mode: options.mode, cliVersion }));
-    if (!jsonMode) {
+    const planned = targets.map(target => installSkillTarget(target, {
+        cwd: options.cwd,
+        homeDir: options.homeDir,
+        dryRun: true,
+        mode: options.mode,
+        cliVersion,
+    }));
+    const showPlan = options.showPlan ?? true;
+    const printResults = options.printResults ?? true;
+    if (showPlan && !jsonMode) {
         printLine('Planned writes:');
         for (const plan of planned) {
             printLine(describePlannedWrite(plan.target, plan.action, plan.mode, plan.path));
@@ -2232,7 +2544,7 @@ async function applySkillInstallTargets(targets, options) {
         printLine('');
     }
     if (options.dryRun) {
-        if (!jsonMode) {
+        if (printResults && !jsonMode) {
             printLine('Dry run: no files were changed.');
         }
         return planned.map(plan => ({
@@ -2245,8 +2557,8 @@ async function applySkillInstallTargets(targets, options) {
     const outcomes = [];
     for (const target of targets) {
         let overwrite = options.skipConfirm;
-        const installPath = getSkillInstallPath(target);
-        if (!overwrite && targetNeedsOverwrite(target)) {
+        const installPath = getSkillInstallPath(target, { cwd: options.cwd, homeDir: options.homeDir });
+        if (!overwrite && targetNeedsOverwrite(target, { cwd: options.cwd, homeDir: options.homeDir })) {
             if (!isInteractiveTerminal()) {
                 throw new Error(`${installPath} already exists. Pass --yes to replace it.`);
             }
@@ -2261,11 +2573,13 @@ async function applySkillInstallTargets(targets, options) {
         }
         try {
             const result = installSkillTarget(target, {
+                cwd: options.cwd,
+                homeDir: options.homeDir,
                 overwrite,
                 mode: options.mode,
                 cliVersion,
             });
-            if (!jsonMode) {
+            if (printResults && !jsonMode) {
                 const suffix = result.mode === 'link' ? ' (symlink)' : '';
                 printLine(`${formatSkillInstallAction(result.action)} ${result.path}${suffix}`);
             }
@@ -2277,8 +2591,8 @@ async function applySkillInstallTargets(targets, options) {
             });
         }
         catch (error) {
-            const message = error?.message || String(error);
-            if (!jsonMode) {
+            const message = getErrorMessage(error);
+            if (printResults && !jsonMode) {
                 printLine(`Failed ${installPath}: ${message}`);
             }
             outcomes.push({ target, path: installPath, action: 'failed', mode: null, error: message });
@@ -2440,15 +2754,124 @@ function describeSetupAuthState() {
         baseUrl,
     };
 }
+async function resolveSetupTeam(teamSlugArg, noInput, dryRun) {
+    const teams = await fetchTeams();
+    const normalizedTeamSlug = teamSlugArg ? normalizeSlugInput(teamSlugArg) : null;
+    if (normalizedTeamSlug) {
+        const team = teams.find(candidate => candidate.slug === normalizedTeamSlug);
+        if (!team) {
+            throw new Error(`Team '${normalizedTeamSlug}' was not found in your accessible teams.`);
+        }
+        return team;
+    }
+    if (noInput || dryRun) {
+        throw new Error('Authenticated setup requires --team <slug> when running non-interactively.');
+    }
+    const choices = [
+        ...teams.map(team => ({ kind: 'team', team })),
+        { kind: 'create' },
+    ];
+    const choice = await promptKeyboardSelect('Choose the team to set up in this directory', choices, item => item.kind === 'create'
+        ? 'Create a new team'
+        : `${item.team.name} (${item.team.slug})`);
+    if (choice.kind === 'team') {
+        return choice.team;
+    }
+    const name = await askText('   Team name?', '');
+    if (!name) {
+        throw new Error('Team name is required to create a team.');
+    }
+    return createTeamOnServer(name);
+}
+async function resolveSetupProjects(team) {
+    const projects = await fetchProjects(team.slug);
+    if (projects.length === 0) {
+        throw new Error(`Team '${team.slug}' has no projects. Create a project before running setup.`);
+    }
+    return projects;
+}
+function projectSeedsFromProjects(projects) {
+    return projects.map(project => ({
+        slug: project.slug,
+        id: project.id,
+        name: project.name,
+    }));
+}
+function formatProjectSetupProgress(count) {
+    return `${count} project${count === 1 ? '' : 's'} being set up in workspace...`;
+}
+function setupTargetForAgent(agent) {
+    return agent === 'codex' ? 'codex-user' : 'claude-user';
+}
+function resolveSetupSkillHome() {
+    return resolve(process.env.HOME || homedir());
+}
+function detectedSetupSkillChoices(homeDir) {
+    const choices = [];
+    if (existsSync(join(homeDir, '.codex'))) {
+        choices.push({
+            agent: 'codex',
+            label: 'Codex',
+            target: 'codex-user',
+        });
+    }
+    if (existsSync(join(homeDir, '.claude'))) {
+        choices.push({
+            agent: 'claude',
+            label: 'Claude Code',
+            target: 'claude-user',
+        });
+    }
+    return choices;
+}
+function setupSkillTargetsFromArgs() {
+    const targets = [];
+    for (const agent of getArgs('--agent')) {
+        if (!isSkillInstallAgent(agent)) {
+            throw new Error(`Unknown agent '${agent}'. Available agents: ${SKILL_INSTALL_AGENTS.join(', ')}`);
+        }
+        const target = setupTargetForAgent(agent);
+        if (!targets.includes(target)) {
+            targets.push(target);
+        }
+    }
+    for (const target of getArgs('--target')) {
+        if (!isSkillInstallTarget(target)) {
+            throw new Error(`Unknown skill install target '${target}'. Available targets: ${SKILL_INSTALL_TARGETS.join(', ')}`);
+        }
+        if (!targets.includes(target)) {
+            targets.push(target);
+        }
+    }
+    return targets;
+}
+function setupSkillLabel(target) {
+    if (target === 'codex-user' || target === 'codex-project' || target === 'agent-user' || target === 'agents-project') {
+        return 'Codex skill';
+    }
+    if (target === 'claude-user' || target === 'claude-project')
+        return 'Claude Code skill';
+    return 'Orizu skill';
+}
 async function setupCommand() {
     const dryRun = hasArg('--dry-run');
+    const validateOnly = hasArg('--validate') && !hasArg('--fix');
+    const fix = hasArg('--fix');
+    const verbose = hasArg('--verbose');
+    const handoffRequested = hasArg('--handoff') || Boolean(getArg('--launch'));
     const skipConfirm = hasArg('--yes');
-    const noInput = hasArg('--no-input') || !isInteractiveTerminal();
+    const noInput = hasArg('--no-input') || hasArg('--non-interactive') || !isInteractiveTerminal();
+    const workspaceArg = getOptionalArgValue('--workspace');
+    const workspaceRoot = workspaceArg ? resolve(expandHomePath(workspaceArg)) : process.cwd();
+    const teamArg = getOptionalArgValue('--team');
+    const projectArg = getOptionalArgValue('--project');
+    const setupSkillHome = resolveSetupSkillHome();
+    const installMode = getArg('--mode') ? parseSkillInstallMode() : 'link';
     printBannerIfInteractive();
     printLine('Orizu setup');
     printLine('');
-    // Phase 1: login
-    printLine('1. Authentication');
+    // Step 1: login
+    printLine('Step 1: Login');
     let auth = describeSetupAuthState();
     if (hasArg('--skip-login')) {
         printLine('   Skipped (--skip-login).');
@@ -2459,72 +2882,177 @@ async function setupCommand() {
     else if (noInput || dryRun) {
         printLine('   Not signed in. Run `orizu login` to authenticate.');
     }
-    else if (await askYesNo('   Sign in to Orizu now?', true)) {
+    else if (await waitForAnyKeyOrEscape('   Press any key to open a browser and connect to your account, or Esc to cancel.')) {
         await login();
         auth = describeSetupAuthState();
     }
     else {
-        printLine('   Skipped. Run `orizu login` when ready.');
+        throw new Error('Setup cancelled.');
     }
     printLine('');
-    // Phase 2: agent integration
-    printLine('2. Agent integration');
-    const scope = parseSkillInstallScope();
-    const mode = parseSkillInstallMode();
-    let targets = hasArg('--no-install') ? [] : parseSkillInstallTargets(scope);
-    if (targets.length === 0 && !hasArg('--no-install')) {
-        if (noInput) {
-            printLine('   No agents selected. Pass --agent claude and/or --agent codex, or rerun interactively.');
+    // Step 2: local workspace
+    printLine('Step 2: Setup your workspace');
+    let workspaceState = 'skipped';
+    let workspaceResult = null;
+    let validationLogPath = null;
+    let hostedAttached = false;
+    if (hasArg('--no-workspace') && !validateOnly && !fix) {
+        printLine('   Skipped (--no-workspace).');
+    }
+    else {
+        const wantsWorkspace = validateOnly
+            || fix
+            || hasArg('--workspace')
+            || Boolean(teamArg || projectArg)
+            || workspaceExists(workspaceRoot)
+            || !noInput;
+        if (wantsWorkspace) {
+            let teamSlug = teamArg;
+            const projectSlug = projectArg;
+            let teamId = null;
+            let projects;
+            if (auth.state === 'signed-in' && !validateOnly) {
+                const team = await resolveSetupTeam(teamSlug, noInput, dryRun);
+                const serverProjects = await resolveSetupProjects(team);
+                teamSlug = team.slug;
+                teamId = team.id;
+                projects = projectSeedsFromProjects(serverProjects);
+                printLine(`   ${formatProjectSetupProgress(projects.length)}`);
+                if (!hasArg('--local') && !noInput && !dryRun) {
+                    let link = null;
+                    try {
+                        link = await runGithubLink(team.slug, { print: printLine, fetcher: authedFetch, openUrl: openInBrowser, confirm: (org) => askYesNo(`   Connect this team to GitHub org '${org}'?`, true) });
+                    }
+                    catch (error) {
+                        printLine(`   GitHub link skipped: ${getErrorMessage(error)} Run \`orizu github link --team ${team.slug}\` to finish.`);
+                    }
+                    if (link) {
+                        try {
+                            hostedAttached = (await runInteractiveHostedSetup({ teamSlug: team.slug, targetDir: workspaceRoot, local: hasArg('--local'), activeInstallation: link.status === 'active' }, { print: printLine, fetcher: authedFetch })).attached;
+                        }
+                        catch (error) {
+                            throw new Error(`Hosted setup failed: ${getErrorMessage(error)} Remove any partial clone in ${workspaceRoot} if one exists, then re-run \`orizu setup\` (or pass --local to scaffold a local-only workspace).`);
+                        }
+                    }
+                }
+            }
+            else if (!teamSlug && !noInput && !validateOnly) {
+                teamSlug = await askText('   Team slug?', 'local-team');
+            }
+            if (auth.state !== 'signed-in' && (!teamSlug || !projectSlug) && noInput && hasArg('--workspace')) {
+                printLine('   Using starter local-only team/project. Pass --team with authentication to materialize server projects.');
+            }
+            if (projectSlug && auth.state !== 'signed-in') {
+                projects = [{ slug: projectSlug }];
+            }
+            if (auth.state !== 'signed-in' && !validateOnly) {
+                const localProjectCount = projects?.length || 1;
+                printLine(`   ${formatProjectSetupProgress(localProjectCount)}`);
+            }
+            if (hostedAttached) {
+                workspaceState = 'exists';
+            }
+            else {
+                const result = initOrizuWorkspace({
+                    workspaceRoot,
+                    teamSlug,
+                    teamId,
+                    projectSlug: auth.state === 'signed-in' ? null : projectSlug,
+                    projects,
+                    baseUrl: auth.baseUrl,
+                    serviceOrigin: getOptionalArgValue('--service-origin') || auth.baseUrl,
+                    attachWorkspaceId: getOptionalArgValue('--attach-workspace'),
+                    cliVersion: getCliVersion(),
+                    dryRun,
+                    validateOnly,
+                    fix,
+                    noSymlinks: hasArg('--no-symlinks'),
+                });
+                workspaceResult = result;
+                workspaceState = result.state;
+                if (dryRun || verbose) {
+                    for (const action of result.actions) {
+                        printLine(`   ${dryRun ? 'Would ' : 'Did '}${action}`);
+                    }
+                }
+                else if (result.actions.length > 0) {
+                    printLine(validateOnly ? '   Workspace validation complete' : '   Workspace setup complete');
+                }
+                else if (!validateOnly) {
+                    printLine('   Workspace setup complete');
+                }
+                validationLogPath = writeWorkspaceValidationLog(result.root, result.findings, dryRun);
+                if (verbose) {
+                    printWorkspaceFindings(result.findings);
+                }
+                if ((validateOnly || fix) && result.findings.some(finding => finding.severity === 'error')) {
+                    process.exitCode = 1;
+                }
+            }
         }
         else {
-            targets = await promptSkillInstallTargets(scope);
+            printLine(`   Skipped. Rerun with --workspace to initialize the workspace contract.`);
         }
     }
-    let installOutcomes = [];
-    if (targets.length > 0) {
-        installOutcomes = await applySkillInstallTargets(targets, { mode, skipConfirm, dryRun });
-    }
-    else if (hasArg('--no-install')) {
-        printLine('   Skipped (--no-install).');
-    }
     printLine('');
-    // Phase 3: local workspace
-    printLine('3. Local workspace');
-    let workspaceState = 'skipped';
-    if (hasArg('--no-workspace')) {
-        printLine('   Skipped (--no-workspace).');
-    }
-    else if (workspaceExists()) {
-        workspaceState = 'exists';
-        printLine(`   ${WORKSPACE_DIR_NAME}/ already initialized.`);
+    // Step 3: global coding-agent skills
+    let installOutcomes = [];
+    printLine('Step 3: Install coding agent skills');
+    if (hasArg('--no-install') || validateOnly || fix) {
+        printLine(hasArg('--no-install') ? '   Skipped (--no-install).' : '   Skipped for validation/repair.');
     }
     else {
-        const wantsWorkspace = hasArg('--workspace') ||
-            (!noInput && await askYesNo(`   Create a gitignored ${WORKSPACE_DIR_NAME}/ workspace for local Orizu artifacts?`, true));
-        if (wantsWorkspace) {
-            const result = initOrizuWorkspace({
-                baseUrl: auth.baseUrl,
-                cliVersion: getCliVersion(),
-                dryRun,
-            });
-            workspaceState = result.state === 'would-create' ? 'would-create' : result.state;
-            for (const action of result.actions) {
-                printLine(`   ${dryRun ? 'Would ' : 'Did '}${action}`);
+        let targets = setupSkillTargetsFromArgs();
+        if (targets.length === 0 && !noInput && !dryRun) {
+            const choices = detectedSetupSkillChoices(setupSkillHome);
+            if (choices.length > 0) {
+                const selectedChoices = await promptKeyboardMultiSelect('Choose the coding agents that should learn how to use Orizu', choices, choice => choice.label, () => true);
+                targets = selectedChoices.map(choice => choice.target);
+            }
+            else {
+                printLine('   No Codex or Claude Code agent folders were detected.');
             }
         }
+        if (targets.length === 0) {
+            printLine('   Skipped skill install.');
+        }
         else {
-            printLine(`   Skipped. Rerun with --workspace to create ${WORKSPACE_DIR_NAME}/.`);
+            printLine('   Installing skills...');
+            installOutcomes = await applySkillInstallTargets(targets, {
+                mode: installMode,
+                skipConfirm,
+                dryRun,
+                cwd: workspaceRoot,
+                homeDir: setupSkillHome,
+                showPlan: false,
+                printResults: false,
+            });
+            if (dryRun) {
+                printLine('   Dry run: no skill files were changed.');
+            }
+            for (const outcome of installOutcomes) {
+                const label = setupSkillLabel(outcome.target);
+                if (outcome.action === 'failed') {
+                    printLine(`   ${label} failed: ${outcome.error}`);
+                }
+                else if (outcome.action === 'skipped') {
+                    printLine(`   ${label} skipped`);
+                }
+                else {
+                    printLine(`   ${label} installed`);
+                }
+            }
         }
     }
     printLine('');
     // Phase 4: coding-agent handoff
     const handoffPrompt = renderAgentSetupPrompt({
-        workspacePath: workspaceState === 'created' || workspaceState === 'exists'
-            ? getWorkspaceRoot()
+        workspacePath: workspaceResult && workspaceState !== 'invalid'
+            ? getWorkspaceRoot(workspaceRoot)
             : null,
     });
-    if (!hasArg('--no-handoff')) {
-        printLine('4. Coding-agent handoff');
+    if (handoffRequested && !hasArg('--no-handoff')) {
+        printLine('Step 4: Coding-agent handoff');
         printLine('   Give your coding agent this prompt to plan repo-specific Orizu adoption:');
         printLine('');
         printLine('--- prompt start ---');
@@ -2564,7 +3092,7 @@ async function setupCommand() {
     const summaryTargets = installOutcomes.length > 0
         ? installOutcomes
             .filter(outcome => outcome.action !== 'failed')
-            .map(outcome => ({ outcome, status: getSkillTargetStatus(outcome.target) }))
+            .map(outcome => ({ outcome, status: getSkillTargetStatus(outcome.target, { cwd: workspaceRoot, homeDir: setupSkillHome }) }))
         : [];
     const source = resolveSkillSource();
     if (hasJsonFlag()) {
@@ -2583,29 +3111,45 @@ async function setupCommand() {
                 cliVersion: getCliVersion(),
                 skillHash: computeSkillContentHash(source.root),
             },
-            workspace: { state: workspaceState, path: getWorkspaceRoot() },
+            workspace: {
+                state: workspaceState,
+                path: getWorkspaceRoot(workspaceRoot),
+                validationLogPath,
+                operations: workspaceResult?.operations.map(op => ({
+                    action: op.action,
+                    path: op.path,
+                    safe: op.safe,
+                    reason: op.reason,
+                    entries: op.entries,
+                    sourcePath: op.sourcePath,
+                    target: op.target,
+                })) || [],
+                findings: workspaceResult?.findings || [],
+            },
         });
         return;
     }
     printLine('Setup summary');
     printLine(`  Auth:         ${auth.state === 'signed-in' ? `signed in (${sanitizeTerminalText(auth.baseUrl)})` : 'not signed in — run `orizu login`'}`);
     if (summaryTargets.length > 0) {
-        printLine('  Integrations:');
+        printLine('  Skills:');
         for (const { outcome, status } of summaryTargets) {
             const modeLabel = status.mode ? `, ${status.mode}` : '';
             printLine(`    ${outcome.target.padEnd(16)} ${status.state}${modeLabel}  ${outcome.path}`);
         }
     }
     else {
-        printLine('  Integrations: none installed this run — `orizu install-skill` sets them up.');
+        printLine('  Skills:       none installed this run');
     }
     const failed = installOutcomes.filter(outcome => outcome.action === 'failed');
     for (const failure of failed) {
         printLine(`    ${failure.target.padEnd(16)} failed: ${failure.error}`);
     }
-    printLine(`  Skill source: ${source.root} (${source.source})`);
-    printLine(`  Workspace:    ${workspaceState === 'skipped' ? 'skipped' : `${getWorkspaceRoot()} (${workspaceState})`}`);
-    printLine('  Next:         hand the prompt above to your coding agent to plan repo-specific Orizu adoption.');
+    printLine(`  Workspace:    ${workspaceState === 'skipped' ? 'skipped' : getWorkspaceRoot(workspaceRoot)}`);
+    if (workspaceResult) {
+        printLine(`  Validation:   ${validationSummary(workspaceResult.findings, validationLogPath)}`);
+    }
+    printLine('  Next:         run `orizu setup prompt` if you want a coding-agent handoff prompt.');
 }
 function setupPromptCommand() {
     const prompt = renderAgentSetupPrompt({
@@ -2627,7 +3171,7 @@ function readJsonFile(pathArg) {
         return parsed;
     }
     catch (error) {
-        throw new Error(`Invalid JSON file '${pathArg}': ${error?.message || String(error)}`);
+        throw new Error(`Invalid JSON file '${pathArg}': ${getErrorMessage(error)}`);
     }
 }
 function isRecord(value) {
@@ -2691,126 +3235,6 @@ function writeTextFileEnsuringDir(pathArg, content) {
     mkdirSync(dirname(pathArg), { recursive: true });
     writeFileSync(pathArg, content);
 }
-function shouldExcludeArtifactPath(relativePath) {
-    const parts = relativePath.split('/');
-    return parts.some(part => part === '.git' ||
-        part === '.DS_Store' ||
-        part === '__pycache__' ||
-        part === '.pytest_cache');
-}
-function collectArtifactFiles(sourceDir, relativeDir = '') {
-    const absoluteDir = relativeDir ? join(sourceDir, relativeDir) : sourceDir;
-    return readdirSync(absoluteDir, { withFileTypes: true })
-        .flatMap(entry => {
-        const relativePath = relativeDir ? `${relativeDir}/${entry.name}` : entry.name;
-        if (shouldExcludeArtifactPath(relativePath)) {
-            return [];
-        }
-        if (entry.isDirectory()) {
-            return collectArtifactFiles(sourceDir, relativePath);
-        }
-        return entry.isFile() ? [relativePath] : [];
-    })
-        .sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
-}
-const ZIP_GENERAL_PURPOSE_UTF8 = 0x0800;
-const ZIP_DOS_TIME_2000_01_01 = 0;
-const ZIP_DOS_DATE_2000_01_01 = ((2000 - 1980) << 9) | (1 << 5) | 1;
-const CRC32_TABLE = Array.from({ length: 256 }, (_, index) => {
-    let value = index;
-    for (let bit = 0; bit < 8; bit++) {
-        value = (value & 1) ? (0xedb88320 ^ (value >>> 1)) : (value >>> 1);
-    }
-    return value >>> 0;
-});
-function crc32(bytes) {
-    let crc = 0xffffffff;
-    for (const byte of bytes) {
-        crc = CRC32_TABLE[(crc ^ byte) & 0xff] ^ (crc >>> 8);
-    }
-    return (crc ^ 0xffffffff) >>> 0;
-}
-function createStoredZip(entries) {
-    const localParts = [];
-    const centralParts = [];
-    let offset = 0;
-    for (const entry of entries) {
-        const name = Buffer.from(entry.path, 'utf8');
-        const crc = crc32(entry.data);
-        const localHeader = Buffer.alloc(30);
-        localHeader.writeUInt32LE(0x04034b50, 0);
-        localHeader.writeUInt16LE(10, 4);
-        localHeader.writeUInt16LE(ZIP_GENERAL_PURPOSE_UTF8, 6);
-        localHeader.writeUInt16LE(0, 8);
-        localHeader.writeUInt16LE(ZIP_DOS_TIME_2000_01_01, 10);
-        localHeader.writeUInt16LE(ZIP_DOS_DATE_2000_01_01, 12);
-        localHeader.writeUInt32LE(crc, 14);
-        localHeader.writeUInt32LE(entry.data.length, 18);
-        localHeader.writeUInt32LE(entry.data.length, 22);
-        localHeader.writeUInt16LE(name.length, 26);
-        localHeader.writeUInt16LE(0, 28);
-        localParts.push(localHeader, name, entry.data);
-        const centralHeader = Buffer.alloc(46);
-        centralHeader.writeUInt32LE(0x02014b50, 0);
-        centralHeader.writeUInt16LE(20, 4);
-        centralHeader.writeUInt16LE(10, 6);
-        centralHeader.writeUInt16LE(ZIP_GENERAL_PURPOSE_UTF8, 8);
-        centralHeader.writeUInt16LE(0, 10);
-        centralHeader.writeUInt16LE(ZIP_DOS_TIME_2000_01_01, 12);
-        centralHeader.writeUInt16LE(ZIP_DOS_DATE_2000_01_01, 14);
-        centralHeader.writeUInt32LE(crc, 16);
-        centralHeader.writeUInt32LE(entry.data.length, 20);
-        centralHeader.writeUInt32LE(entry.data.length, 24);
-        centralHeader.writeUInt16LE(name.length, 28);
-        centralHeader.writeUInt16LE(0, 30);
-        centralHeader.writeUInt16LE(0, 32);
-        centralHeader.writeUInt16LE(0, 34);
-        centralHeader.writeUInt16LE(0, 36);
-        centralHeader.writeUInt32LE(0, 38);
-        centralHeader.writeUInt32LE(offset, 42);
-        centralParts.push(centralHeader, name);
-        offset += localHeader.length + name.length + entry.data.length;
-    }
-    const centralDirectoryOffset = offset;
-    const centralDirectory = Buffer.concat(centralParts);
-    const endOfCentralDirectory = Buffer.alloc(22);
-    endOfCentralDirectory.writeUInt32LE(0x06054b50, 0);
-    endOfCentralDirectory.writeUInt16LE(0, 4);
-    endOfCentralDirectory.writeUInt16LE(0, 6);
-    endOfCentralDirectory.writeUInt16LE(entries.length, 8);
-    endOfCentralDirectory.writeUInt16LE(entries.length, 10);
-    endOfCentralDirectory.writeUInt32LE(centralDirectory.length, 12);
-    endOfCentralDirectory.writeUInt32LE(centralDirectoryOffset, 16);
-    endOfCentralDirectory.writeUInt16LE(0, 20);
-    return Buffer.concat([...localParts, centralDirectory, endOfCentralDirectory]);
-}
-function zipDirectoryToBase64(dirArg) {
-    const sourceDir = expandHomePath(dirArg);
-    try {
-        const stats = statSync(sourceDir);
-        if (!stats.isDirectory()) {
-            throw new Error(`${sourceDir} is not a directory`);
-        }
-    }
-    catch (error) {
-        if (error?.code === 'ENOENT') {
-            throw new Error(`Directory not found: ${sourceDir}`);
-        }
-        throw error;
-    }
-    const files = collectArtifactFiles(sourceDir);
-    if (files.length === 0) {
-        throw new Error(`Directory contains no artifact files: ${sourceDir}`);
-    }
-    const bytes = createStoredZip(files.map(relativePath => ({
-        path: relativePath,
-        data: readFileSync(join(sourceDir, relativePath)),
-    })));
-    return {
-        zipBase64: bytes.toString('base64'),
-        contentSha256: createHash('sha256').update(bytes).digest('hex'),
-    };
-}
 function readManifestFile(dirArg) {
     return readJsonFile(join(expandHomePath(dirArg), 'manifest.json'));
 }
@@ -2991,8 +3415,32 @@ function readAssignmentManifest(path) {
     if (!path) {
         return null;
     }
-    const content = readFileSync(expandHomePath(path), 'utf8');
-    return parseAssignmentManifestJsonl(content);
+    return readAssignmentManifestJsonlFile(expandHomePath(path));
+}
+function readOptionalTaskTextArg(valueFlag, fileFlag) {
+    const value = getArg(valueFlag);
+    const file = getArg(fileFlag);
+    rejectDashPrefixedOptionValue(valueFlag, value);
+    rejectDashPrefixedOptionValue(fileFlag, file);
+    if (value !== null && file !== null) {
+        throw new Error(`Use either ${valueFlag} or ${fileFlag}, not both.`);
+    }
+    if (file !== null) {
+        return readSourceFile(file);
+    }
+    return value ?? undefined;
+}
+function readPositiveIntegerFlag(name) {
+    const value = getArg(name);
+    rejectDashPrefixedOptionValue(name, value);
+    if (value === null) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+        throw new Error(`${name} must be a positive integer`);
+    }
+    return parsed;
 }
 async function createTask() {
     const projectSlug = getArg('--project');
@@ -3103,6 +3551,127 @@ async function createTask() {
                 : `orizu tasks publish --task ${sanitizeTerminalText(data.task.id)} --assignees <userId1,userId2>`}`
             : ''));
 }
+async function updateTask() {
+    const taskId = getArg('--task');
+    rejectDashPrefixedOptionValue('--task', taskId);
+    if (!taskId) {
+        throw new Error('Usage: orizu tasks update --task <taskId> [--title <text>] [--description <text>|--description-file <path>] [--instructions <text>|--instructions-file <path>] [--dataset <datasetId>] [--app <appId> [--version <n>]] [--labels-per-item <n>] [--assignees <userIdOrEmail1,userIdOrEmail2> | --assignment-file <path>] [--json]');
+    }
+    const title = getArg('--title');
+    const description = readOptionalTaskTextArg('--description', '--description-file');
+    const instructions = readOptionalTaskTextArg('--instructions', '--instructions-file');
+    const datasetId = getArg('--dataset');
+    const appId = getArg('--app');
+    const versionNum = readPositiveIntegerFlag('--version');
+    const requiredAssignmentsPerRow = readPositiveIntegerFlag('--labels-per-item');
+    const assignees = parseCommaSeparated(getArg('--assignees'));
+    const assignmentFile = getArg('--assignment-file');
+    rejectDashPrefixedOptionValue('--title', title);
+    rejectDashPrefixedOptionValue('--dataset', datasetId);
+    rejectDashPrefixedOptionValue('--app', appId);
+    rejectDashPrefixedOptionValue('--assignment-file', assignmentFile);
+    if (title !== null && title.trim().length === 0) {
+        throw new Error('--title must be a non-empty string');
+    }
+    if (assignmentFile && assignees.length > 0) {
+        throw new Error('Use either --assignment-file or --assignees, not both.');
+    }
+    if (hasArg('--assignees') && assignees.length === 0) {
+        throw new Error('--assignees requires at least one user ID or email');
+    }
+    if (versionNum !== undefined && !appId) {
+        throw new Error('--version requires --app');
+    }
+    const explicitAssignments = readAssignmentManifest(assignmentFile);
+    const requestBody = {};
+    if (title !== null)
+        requestBody.title = title.trim();
+    if (description !== undefined)
+        requestBody.description = description;
+    if (instructions !== undefined)
+        requestBody.instructions = instructions;
+    if (datasetId !== null)
+        requestBody.datasetId = datasetId;
+    if (appId !== null)
+        requestBody.appId = appId;
+    if (versionNum !== undefined)
+        requestBody.versionNum = versionNum;
+    if (requiredAssignmentsPerRow !== undefined) {
+        requestBody.requiredAssignmentsPerRow = requiredAssignmentsPerRow;
+    }
+    if (explicitAssignments) {
+        requestBody.explicitAssignments = explicitAssignments;
+    }
+    else if (hasArg('--assignees')) {
+        requestBody.memberIds = assignees;
+    }
+    if (Object.keys(requestBody).length === 0) {
+        throw new Error('Usage: orizu tasks update --task <taskId> [--title <text>] [--description <text>|--description-file <path>] [--instructions <text>|--instructions-file <path>] [--dataset <datasetId>] [--app <appId> [--version <n>]] [--labels-per-item <n>] [--assignees <userIdOrEmail1,userIdOrEmail2> | --assignment-file <path>] [--json]');
+    }
+    const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(requestBody),
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to update task: ${await extractErrorMessage(response)}`);
+    }
+    const data = await parseJsonResponse(response, 'Task update');
+    if (hasJsonFlag()) {
+        printJson({
+            taskId: data.task.id,
+            title: data.task.title ?? null,
+            status: data.task.status ?? null,
+            datasetId: data.task.dataset_id ?? null,
+            appId: data.task.app_id ?? null,
+            versionId: data.task.version_id ?? null,
+            requiredAssignmentsPerRow: data.task.required_assignments_per_row ?? null,
+            ...(data.assignmentMode ? { assignmentMode: data.assignmentMode } : {}),
+            ...(data.assignmentsCreated !== undefined
+                ? { assignmentsCreated: data.assignmentsCreated }
+                : {}),
+        });
+        return;
+    }
+    printLine(`Updated draft task ${sanitizeTerminalText(data.task.title || data.task.id)} (${sanitizeTerminalText(data.task.id)})` +
+        (data.task.status ? ` [${sanitizeTerminalText(data.task.status)}]` : '') +
+        (data.task.dataset_id ? `\n  Dataset ID: ${sanitizeTerminalText(data.task.dataset_id)}` : '') +
+        (data.task.version_id ? `\n  Version ID: ${sanitizeTerminalText(data.task.version_id)}` : '') +
+        (data.task.required_assignments_per_row
+            ? `\n  Labels/row: ${data.task.required_assignments_per_row}`
+            : '') +
+        (data.assignmentMode ? `\n  Mode:       ${sanitizeTerminalText(data.assignmentMode === 'custom' ? 'custom row map' : 'auto distribute')}` : '') +
+        (data.assignmentsCreated !== undefined ? `\n  Assignments: ${data.assignmentsCreated}` : ''));
+}
+async function discardTask() {
+    const taskId = getArg('--task');
+    rejectDashPrefixedOptionValue('--task', taskId);
+    if (!taskId) {
+        throw new Error('Usage: orizu tasks discard --task <taskId> [--yes] [--json]');
+    }
+    if (!hasArg('--yes')) {
+        if (!isInteractiveTerminal()) {
+            throw new Error('Refusing to discard a draft in non-interactive mode without --yes');
+        }
+        const confirmed = await askYesNo(`Discard draft task ${taskId}? This cannot be undone.`, false);
+        if (!confirmed) {
+            printLine('Discard cancelled.');
+            return;
+        }
+    }
+    const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}`, {
+        method: 'DELETE',
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to discard draft task: ${await extractErrorMessage(response)}`);
+    }
+    const data = await parseJsonResponse(response, 'Task discard');
+    if (hasJsonFlag()) {
+        printJson({ taskId, discarded: data.success });
+        return;
+    }
+    printLine(`Discarded draft task ${sanitizeTerminalText(taskId)}.`);
+}
 async function publishTask() {
     const taskId = getArg('--task');
     const assignees = parseCommaSeparated(getArg('--assignees'));
@@ -3241,9 +3810,9 @@ async function taskStatus() {
 }
 async function updateTaskStatus(targetStatus) {
     const taskId = getArg('--task');
+    const labels = TASK_STATUS_ACTION_LABELS[targetStatus];
     if (!taskId) {
-        const verb = targetStatus === 'paused' ? 'pause' : 'unpause';
-        throw new Error(`Usage: orizu tasks ${verb} --task <taskId>`);
+        throw new Error(`Usage: orizu tasks ${labels.verb} --task <taskId>`);
     }
     const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}/status`, {
         method: 'PATCH',
@@ -3251,16 +3820,14 @@ async function updateTaskStatus(targetStatus) {
         body: JSON.stringify({ status: targetStatus }),
     });
     if (!response.ok) {
-        const verb = targetStatus === 'paused' ? 'pause' : 'unpause';
-        throw new Error(`Failed to ${verb} task: ${await response.text()}`);
+        throw new Error(`Failed to ${labels.verb} task: ${await response.text()}`);
     }
     const data = await parseJsonResponse(response, 'Task status update');
     if (hasJsonFlag()) {
         printJson({ task: data.task });
         return;
     }
-    const action = targetStatus === 'paused' ? 'Paused' : 'Unpaused';
-    printLine(`${action} task ${sanitizeTerminalText(data.task.id)} [${sanitizeTerminalText(data.task.status)}]`);
+    printLine(`${labels.pastTense} task ${sanitizeTerminalText(data.task.id)} [${sanitizeTerminalText(data.task.status)}]`);
 }
 async function setTaskReport() {
     const taskId = getArg('--task');
@@ -3436,10 +4003,10 @@ async function changeTeamMemberRole() {
     const email = getArg('--email');
     const role = getArg('--role');
     if (!teamSlug || !email || !role) {
-        throw new Error('Usage: orizu teams members role --team <teamSlug> --email <email> --role <admin|member>');
+        throw new Error('Usage: orizu teams members role --team <teamSlug> --email <email> --role <admin|curator|judge>');
     }
-    if (!['admin', 'member'].includes(role)) {
-        throw new Error('role must be one of: admin, member');
+    if (!['admin', 'curator', 'judge'].includes(role)) {
+        throw new Error('role must be one of: admin, curator, judge');
     }
     const members = await fetchTeamMembers(teamSlug);
     const member = members.find(item => item.email.toLowerCase() === email.toLowerCase());
@@ -4198,12 +4765,16 @@ async function runnersExec() {
                     throw new Error(`Runner failed for row ${row.id} with exit code ${result.status}: ${sanitizeTerminalText(boundedRunnerOutput(result.stderr || result.stdout))}`);
                 }
                 const runnerOutput = JSON.parse(readFileSync(outputPath, 'utf8'));
+                // Spread runner output first: the scorer/prompt context identity fields
+                // (row_id, version ids, metric_key) are authoritative, never runner-overridable.
                 resultLines.push(JSON.stringify({
+                    ...runnerOutput,
                     row_id: row.id,
                     prompt_version_id: context.prompt.promptVersionId,
                     runner_version_id: context.prompt.runnerVersionId,
-                    ...(scorerVersion ? { scorer_version_id: context.scorer?.versionId || scorerVersion } : {}),
-                    ...runnerOutput,
+                    ...(scorerVersion
+                        ? { scorer_version_id: context.scorer?.versionId || scorerVersion, metric_key: context.scorer?.metricKey || 'score' }
+                        : {}),
                 }));
             }
             finally {
@@ -4503,6 +5074,14 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await createTask();
         return;
     }
+    if (command === 'tasks' && subcommand === 'update') {
+        await updateTask();
+        return;
+    }
+    if (command === 'tasks' && subcommand === 'discard') {
+        await discardTask();
+        return;
+    }
     if (command === 'tasks' && subcommand === 'publish') {
         await publishTask();
         return;
@@ -4529,6 +5108,10 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await updateTaskStatus('active');
         return;
     }
+    if (command === 'tasks' && subcommand === 'complete') {
+        await updateTaskStatus('completed');
+        return;
+    }
     if (command === 'datasets' && subcommand === 'upload') {
         await uploadDataset();
         return;
@@ -4582,6 +5165,41 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await downloadAnnotations();
         return;
     }
+    if (command === 'internal' || (command === 'session' && subcommand === 'start' && hasArg('--hosted'))) {
+        process.exitCode = await hostedCommand(cliArgs, { json: hasJsonFlag(), print: printLine, printErr: printError });
+        return;
+    }
+    if (command === 'session' || command === 'run') {
+        process.exitCode = await workbenchCommand(cliArgs, { json: hasJsonFlag(), print: printLine });
+        return;
+    }
+    if (command === 'workspace') {
+        process.exitCode = await workspaceSyncCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine });
+        return;
+    }
+    if (command === 'git-credential') {
+        process.exitCode = await runGitCredential(subcommand ?? 'get', { stdin: readFileSync(0, 'utf8'), cwd: process.cwd(), print: printLine, printErr: printError });
+        return;
+    }
+    if (command === 'github' && subcommand === 'link') {
+        const noInput = hasArg('--no-input') || hasArg('--non-interactive') || !isInteractiveTerminal();
+        const team = getOptionalArgValue('--team') || (await resolveSetupTeam(null, noInput, false)).slug;
+        await runGithubLink(team, { print: printLine, fetcher: authedFetch, openUrl: openInBrowser, confirm: (org) => askYesNo(`Connect this team to GitHub org '${org}'?`, true) });
+        return;
+    }
+    if (command === 'connectors' || command === 'manifests') {
+        const moduleCommand = command === 'connectors' ? connectorsCommand : manifestsCommand;
+        process.exitCode = await moduleCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine, resolveProjectSlug });
+        return;
+    }
+    if (command === 'team' && (subcommand === 'kill-agents' || subcommand === 'release-agents')) {
+        process.exitCode = await killSwitchCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine, printErr: printError });
+        return;
+    }
+    if (command === 'team' && subcommand === 'egress-allowlist') {
+        process.exitCode = await egressAllowlistCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine, printErr: printError });
+        return;
+    }
     printUsage();
     process.exit(1);
 }
@@ -4599,7 +5217,7 @@ function isCliEntrypoint() {
 }
 if (isCliEntrypoint()) {
     main().catch(error => {
-        console.error(sanitizeTerminalText(error instanceof Error ? error.message : 'Unknown error'));
+        printError(error instanceof Error ? error.message : 'Unknown error');
         process.exit(1);
     });
 }