orizu 0.4.1 → 0.5.0

package/src/index.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createHash, randomBytes, randomUUID } from 'crypto'
-import { basename, delimiter, dirname, extname, isAbsolute, join, normalize } from 'path'
+import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve } from 'path'
 import { fileURLToPath } from 'url'
 import { createServer } from 'http'
 import { gunzipSync, gzipSync } from 'zlib'
@@ -8,7 +8,6 @@ import {
   existsSync,
   mkdirSync,
   mkdtempSync,
-  readdirSync,
   readFileSync,
   realpathSync,
   rmSync,
@@ -16,8 +15,9 @@ import {
   writeFileSync,
 } from 'fs'
 import { spawn, spawnSync } from 'child_process'
-import { tmpdir } from 'os'
+import { homedir, tmpdir } from 'os'
 import { createInterface } from 'readline/promises'
+import { emitKeypressEvents } from 'readline'
 import { stdin as input, stdout as output } from 'process'
 import { clearServerCredentials, getServerCredentials, saveServerCredentials } from './credentials.js'
 import { parseDatasetFile } from './file-parser.js'
@@ -26,15 +26,10 @@ import { parseDatasetReference } from './dataset-download.js'
 import { extractErrorMessage } from './error-response.js'
 import { parseGlobalFlags } from './global-flags.js'
 import { getCapabilities, renderHelpForArgs, renderRootHelp } from './help.js'
+import { zipDirectoryToBase64 } from './artifact-archive.js'
 import { runLocalAppPreview } from './preview-runtime.js'
-import { parseAssignmentManifestJsonl } from './task-assignment-manifest.js'
-import {
-  assertSecureTokenTransport,
-  authedFetch,
-  getBaseUrl,
-  resolveLoginBaseUrl,
-  setGlobalFlags,
-} from './http.js'
+import { readAssignmentManifestJsonlFile } from './task-assignment-manifest.js'
+import { assertSecureTokenTransport, authedFetch, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags } from './http.js'
 import {
   computeSkillContentHash,
   getSkillInstallPath,
@@ -46,6 +41,7 @@ import {
   resolveSkillSource,
   SKILL_INSTALL_AGENTS,
   SKILL_INSTALL_TARGETS,
+  SkillInstallAgent,
   SkillInstallMode,
   SkillInstallScope,
   SkillInstallTarget,
@@ -59,9 +55,26 @@ import { LoginResponse } from './types.js'
 import {
   getWorkspaceRoot,
   initOrizuWorkspace,
-  WORKSPACE_DIR_NAME,
+  type WorkspaceProjectSeed,
   workspaceExists,
 } from './workspace.js'
+import { connectorsCommand } from './connectors-cli.js'
+import { killSwitchCommand } from './kill-switch-cli.js'
+import { egressAllowlistCommand } from './egress-allowlist-cli.js'
+import { manifestsCommand } from './manifests-cli.js'
+import { workbenchCommand } from './workbench-cli.js'
+import { hostedCommand } from './hosted-session-cli.js'
+import { workspaceSyncCommand } from './workspace-sync.js'
+import { runGitCredential } from './git-credential.js'
+import { type GithubLinkResult, runGithubLink, runInteractiveHostedSetup } from './github-setup.js'
+
+function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+function isNodeError(error: unknown): error is NodeJS.ErrnoException {
+  return error instanceof Error
+}
 
 interface Team {
   id: string
@@ -279,6 +292,21 @@ interface TaskStatusPayload {
   }
 }
 
+const TASK_STATUS_ACTION_LABELS = {
+  paused: {
+    verb: 'pause',
+    pastTense: 'Paused',
+  },
+  active: {
+    verb: 'unpause',
+    pastTense: 'Unpaused',
+  },
+  completed: {
+    verb: 'complete',
+    pastTense: 'Completed',
+  },
+} as const
+
 function getCliVersion(): string {
   const packageJson = JSON.parse(
     readFileSync(new URL('../package.json', import.meta.url), 'utf8')
@@ -312,14 +340,6 @@ function printUsage() {
   printLine(renderRootHelp())
 }
 
-function printPreviewUsage() {
-  printLine(`\nLocal app preview:\n\n  orizu apps preview --file <path> --input-schema <json-path> --output-schema <json-path> --sample-row <json-path> [--screenshot <png-path>] [--headed] [--keep-open] [--component <name>]`)
-}
-
-function printOptimizationUsage() {
-  printLine(`\nOptimization lifecycle commands:\n\n  orizu optimizations start --project <team/project> --optimizer-version <id> --prompt-version <id[,id]> --selection-scorer <id> [--reflection-scorer <id>] [--pareto-scorer <id>] [--best-scorer <id>] --dataset-version <id> --split-set <id> [--train-split <name>] [--validation-split <name>] [--metadata <json|@file>] [--json]\n  orizu optimizations run-gepa --project <team/project> --optimizer-version-id <id> --candidate-version-id <id> --runner-version-id <id> --candidate-runner-dir <dir> --scorer-version-id <id> --scorer-runner-version-id <id> --scorer-runner-dir <dir> --dataset-version-id <id> --split-set-id <id> [--train-split train] [--val-split validation] [--budget auto|light|medium|heavy | --max-metric-calls <n> | --max-full-evals <n> | --max-iterations <n>] [--num-threads auto|N] [--reflection-retry-attempts N] [--reflection-http-timeout-seconds N] [--log-dir logs] [--no-skip-perfect-parent-reflection]\n  orizu optimizations export <run-id> [--out <path>] [--json]\n  orizu optimizations pause <run-id> [--reason <text>] [--json]\n  orizu optimizations resume <run-id> [--json]\n  orizu optimizations finish <run-id> [--best-score <n>] [--best-candidate <id>] [--result-prompt-version <id>] [--report <markdown|@file> | --report-file <path>] [--metadata <json|@file>] [--json]\n  orizu optimizations fail <run-id> [--reason <text>] [--report <markdown|@file> | --report-file <path>] [--metadata <json|@file>] [--json]\n  orizu optimizations cancel <run-id> [--reason <text>] [--report <markdown|@file> | --report-file <path>] [--json]`)
-}
-
 let cliArgs = process.argv.slice(2)
 let cliJsonOutput = false
 
@@ -351,6 +371,20 @@ function getArgs(name: string): string[] {
   return values
 }
 
+function getOptionalArgValue(name: string): string | null {
+  const index = cliArgs.indexOf(name)
+  if (index === -1 || index + 1 >= cliArgs.length) {
+    return null
+  }
+
+  const value = cliArgs[index + 1]
+  if (!value || value.startsWith('-')) {
+    return null
+  }
+
+  return value
+}
+
 function rejectDashPrefixedOptionValue(name: string, value: string | null) {
   if (value && value.startsWith('-')) {
     throw new Error(`Invalid value for ${name}: option values cannot start with a dash`)
@@ -409,6 +443,10 @@ export function sanitizeTerminalText(value: unknown): string {
   return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '')
 }
 
+function printError(message: string): void {
+  console.error(sanitizeTerminalText(message))
+}
+
 export function validateBrowserUrl(url: string, expectedOrigin?: string): URL {
   let parsed: URL
   try {
@@ -576,8 +614,8 @@ function readJsonObjectArg(valueArg: string | null, label: string): Record<strin
       throw new Error('JSON root must be an object')
     }
     return parsed as Record<string, unknown>
-  } catch (error: any) {
-    throw new Error(`Invalid ${label} '${valueArg}': ${error?.message || String(error)}`)
+  } catch (error: unknown) {
+    throw new Error(`Invalid ${label} '${valueArg}': ${getErrorMessage(error)}`)
   }
 }
 
@@ -689,6 +727,55 @@ async function fetchTeamMembers(teamSlug: string): Promise<TeamMember[]> {
   return data.members
 }
 
+async function createTeamOnServer(name: string): Promise<Team> {
+  const response = await authedFetch('/api/cli/teams', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ name }),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Failed to create team: ${await response.text()}`)
+  }
+
+  const data = await parseJsonResponse<{ team: Team }>(response, 'Team create')
+  return data.team
+}
+
+async function createProjectOnServer(teamSlug: string, name: string): Promise<Project> {
+  const response = await authedFetch('/api/cli/projects', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ teamSlug, name }),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Failed to create project: ${await response.text()}`)
+  }
+
+  const data = await parseJsonResponse<{
+    project: {
+      id: string
+      name: string
+      slug: string
+      teamId?: string
+      teamName?: string
+      teamSlug: string
+      role?: string
+    }
+  }>(response, 'Project create')
+
+  return {
+    id: data.project.id,
+    name: data.project.name,
+    slug: data.project.slug,
+    teamId: data.project.teamId || '',
+    teamName: data.project.teamName || data.project.teamSlug,
+    teamSlug: data.project.teamSlug,
+    role: data.project.role || 'admin',
+  }
+}
+
 async function resolveProjectSelection(projectArg: string | null): Promise<Project> {
   projectArg = projectArg || process.env.ORIZU_PROJECT || null
   const teams = await fetchTeams()
@@ -724,7 +811,7 @@ async function resolveProjectSelection(projectArg: string | null): Promise<Proje
 
   const matchedTeam = teams.find(team => team.slug === teamSlug)
   if (!matchedTeam) {
-    console.error(`Team '${sanitizeTerminalText(teamSlug)}' not found in your accessible teams.`)
+    printError(`Team '${teamSlug}' not found in your accessible teams.`)
     const selectedTeam = await promptSelect(
       'Select a team',
       teams,
@@ -745,7 +832,7 @@ async function resolveProjectSelection(projectArg: string | null): Promise<Proje
   const matchedProject = projects.find(project => project.slug === projectSlug)
 
   if (!matchedProject) {
-    console.error(`Project '${sanitizeTerminalText(projectSlug)}' not found in team '${sanitizeTerminalText(matchedTeam.slug)}'.`)
+    printError(`Project '${projectSlug}' not found in team '${matchedTeam.slug}'.`)
     const selectedProject = await promptSelect(
       `Select a project in ${matchedTeam.slug}`,
       projects,
@@ -2771,22 +2858,12 @@ async function createTeam() {
     throw new Error('Usage: orizu teams create --name <name>')
   }
 
-  const response = await authedFetch('/api/cli/teams', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ name }),
-  })
-
-  if (!response.ok) {
-    throw new Error(`Failed to create team: ${await response.text()}`)
-  }
-
-  const data = await parseJsonResponse<{ team: Team }>(response, 'Team create')
+  const team = await createTeamOnServer(name)
   if (hasJsonFlag()) {
-    printJson({ team: data.team })
+    printJson({ team })
     return
   }
-  printLine(`Created team: ${sanitizeTerminalText(data.team.name)} (${sanitizeTerminalText(data.team.slug)})`)
+  printLine(`Created team: ${sanitizeTerminalText(team.name)} (${sanitizeTerminalText(team.slug)})`)
 }
 
 async function listProjects() {
@@ -2819,24 +2896,12 @@ async function createProject() {
     teamSlug = team.slug
   }
 
-  const response = await authedFetch('/api/cli/projects', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ teamSlug, name }),
-  })
-
-  if (!response.ok) {
-    throw new Error(`Failed to create project: ${await response.text()}`)
-  }
-
-  const data = await parseJsonResponse<{
-    project: { id: string; name: string; slug: string; teamSlug: string }
-  }>(response, 'Project create')
+  const project = await createProjectOnServer(teamSlug, name)
   if (hasJsonFlag()) {
-    printJson({ project: data.project })
+    printJson({ project })
     return
   }
-  printLine(`Created project ${sanitizeTerminalText(`${data.project.teamSlug}/${data.project.slug}`)}`)
+  printLine(`Created project ${sanitizeTerminalText(`${project.teamSlug}/${project.slug}`)}`)
 }
 
 async function listTasks() {
@@ -2863,11 +2928,11 @@ function readSourceFile(pathArg: string): string {
   const expandedPath = expandHomePath(pathArg)
   try {
     return readFileSync(expandedPath, 'utf-8')
-  } catch (error: any) {
-    if (error?.code === 'ENOENT') {
+  } catch (error: unknown) {
+    if (isNodeError(error) && error.code === 'ENOENT') {
       throw new Error(`File not found: ${expandedPath}`)
     }
-    throw new Error(`Failed to read file '${expandedPath}': ${error?.message || String(error)}`)
+    throw new Error(`Failed to read file '${expandedPath}': ${getErrorMessage(error)}`)
   }
 }
 
@@ -2875,11 +2940,11 @@ function readSourceBytes(pathArg: string): Buffer {
   const expandedPath = expandHomePath(pathArg)
   try {
     return readFileSync(expandedPath)
-  } catch (error: any) {
-    if (error?.code === 'ENOENT') {
+  } catch (error: unknown) {
+    if (isNodeError(error) && error.code === 'ENOENT') {
       throw new Error(`File not found: ${expandedPath}`)
     }
-    throw new Error(`Failed to read file '${expandedPath}': ${error?.message || String(error)}`)
+    throw new Error(`Failed to read file '${expandedPath}': ${getErrorMessage(error)}`)
   }
 }
 
@@ -2921,6 +2986,304 @@ async function askYesNo(question: string, defaultYes: boolean): Promise<boolean>
   }
 }
 
+async function askText(question: string, defaultValue: string): Promise<string> {
+  const rl = createInterface({ input, output })
+  try {
+    const suffix = defaultValue ? ` [${defaultValue}]` : ''
+    const answer = (await rl.question(`${question}${suffix} `)).trim()
+    return answer || defaultValue
+  } finally {
+    rl.close()
+  }
+}
+
+type KeypressInfo = {
+  name?: string
+  sequence?: string
+  ctrl?: boolean
+}
+
+type RawInput = typeof input & {
+  setRawMode?: (mode: boolean) => void
+  isRaw?: boolean
+}
+
+async function waitForAnyKeyOrEscape(message: string): Promise<boolean> {
+  if (!isInteractiveTerminal()) {
+    throw new Error('Interactive terminal required.')
+  }
+
+  printLine(message)
+  const rawInput = input as RawInput
+  const wasRaw = Boolean(rawInput.isRaw)
+  emitKeypressEvents(input)
+
+  return new Promise((resolvePromise, rejectPromise) => {
+    function cleanup() {
+      input.off('keypress', onKeypress)
+      if (rawInput.setRawMode && !wasRaw) {
+        rawInput.setRawMode(false)
+      }
+      input.pause()
+      printLine('')
+    }
+
+    function onKeypress(_chunk: string, key: KeypressInfo) {
+      cleanup()
+      if (key.ctrl && key.name === 'c') {
+        rejectPromise(new Error('Setup cancelled.'))
+        return
+      }
+      resolvePromise(key.name !== 'escape')
+    }
+
+    input.on('keypress', onKeypress)
+    input.resume()
+    rawInput.setRawMode?.(true)
+  })
+}
+
+async function promptKeyboardSelect<T>(
+  title: string,
+  items: T[],
+  label: (item: T, index: number) => string
+): Promise<T> {
+  if (items.length === 0) {
+    throw new Error(`No options available for ${title.toLowerCase()}`)
+  }
+  if (!isInteractiveTerminal()) {
+    throw new Error(`${title} selection requires interactive terminal. Provide flags explicitly instead.`)
+  }
+
+  printLine(`\n${sanitizeTerminalText(title)}`)
+  printLine('Use ↑/↓ to choose, Enter to confirm, or Esc to cancel.')
+
+  let selected = 0
+  let rendered = false
+  const rawInput = input as RawInput
+  const wasRaw = Boolean(rawInput.isRaw)
+  emitKeypressEvents(input)
+
+  function render() {
+    if (rendered) {
+      output.write(`\x1b[${items.length}A`)
+    }
+    items.forEach((item, index) => {
+      output.write('\x1b[2K')
+      const marker = index === selected ? '●' : '○'
+      output.write(`  ${marker} ${sanitizeTerminalText(label(item, index))}\n`)
+    })
+    rendered = true
+  }
+
+  render()
+  output.write('\x1b[?25l')
+
+  return new Promise((resolvePromise, rejectPromise) => {
+    function cleanup() {
+      input.off('keypress', onKeypress)
+      if (rawInput.setRawMode && !wasRaw) {
+        rawInput.setRawMode(false)
+      }
+      input.pause()
+      output.write('\x1b[?25h')
+      printLine('')
+    }
+
+    function onKeypress(_chunk: string, key: KeypressInfo) {
+      if (key.ctrl && key.name === 'c') {
+        cleanup()
+        rejectPromise(new Error('Setup cancelled.'))
+        return
+      }
+      if (key.name === 'escape') {
+        cleanup()
+        rejectPromise(new Error('Setup cancelled.'))
+        return
+      }
+      if (key.name === 'up') {
+        selected = (selected - 1 + items.length) % items.length
+        render()
+        return
+      }
+      if (key.name === 'down') {
+        selected = (selected + 1) % items.length
+        render()
+        return
+      }
+      if (key.name === 'return' || key.name === 'enter') {
+        const item = items[selected]
+        cleanup()
+        resolvePromise(item)
+      }
+    }
+
+    input.on('keypress', onKeypress)
+    input.resume()
+    rawInput.setRawMode?.(true)
+  })
+}
+
+async function promptKeyboardMultiSelect<T>(
+  title: string,
+  items: T[],
+  label: (item: T, index: number) => string,
+  defaultSelected: (item: T, index: number) => boolean
+): Promise<T[]> {
+  if (items.length === 0) {
+    return []
+  }
+  if (!isInteractiveTerminal()) {
+    throw new Error(`${title} selection requires interactive terminal. Provide flags explicitly instead.`)
+  }
+
+  printLine(`\n${sanitizeTerminalText(title)}`)
+  printLine('Use ↑/↓ to move, Space to toggle, Enter to confirm, or Esc to skip.')
+
+  let selected = 0
+  let rendered = false
+  const checked = new Set<number>()
+  items.forEach((item, index) => {
+    if (defaultSelected(item, index)) {
+      checked.add(index)
+    }
+  })
+  const rawInput = input as RawInput
+  const wasRaw = Boolean(rawInput.isRaw)
+  emitKeypressEvents(input)
+
+  function render() {
+    if (rendered) {
+      output.write(`\x1b[${items.length}A`)
+    }
+    items.forEach((item, index) => {
+      output.write('\x1b[2K')
+      const cursor = index === selected ? '›' : ' '
+      const marker = checked.has(index) ? '◉' : '○'
+      output.write(`${cursor} ${marker} ${sanitizeTerminalText(label(item, index))}\n`)
+    })
+    rendered = true
+  }
+
+  render()
+  output.write('\x1b[?25l')
+
+  return new Promise((resolvePromise, rejectPromise) => {
+    function cleanup() {
+      input.off('keypress', onKeypress)
+      if (rawInput.setRawMode && !wasRaw) {
+        rawInput.setRawMode(false)
+      }
+      input.pause()
+      output.write('\x1b[?25h')
+      printLine('')
+    }
+
+    function onKeypress(_chunk: string, key: KeypressInfo) {
+      if (key.ctrl && key.name === 'c') {
+        cleanup()
+        rejectPromise(new Error('Setup cancelled.'))
+        return
+      }
+      if (key.name === 'escape') {
+        cleanup()
+        resolvePromise([])
+        return
+      }
+      if (key.name === 'up') {
+        selected = (selected - 1 + items.length) % items.length
+        render()
+        return
+      }
+      if (key.name === 'down') {
+        selected = (selected + 1) % items.length
+        render()
+        return
+      }
+      if (key.name === 'space') {
+        if (checked.has(selected)) {
+          checked.delete(selected)
+        } else {
+          checked.add(selected)
+        }
+        render()
+        return
+      }
+      if (key.name === 'return' || key.name === 'enter') {
+        const selectedItems = items.filter((_item, index) => checked.has(index))
+        cleanup()
+        resolvePromise(selectedItems)
+      }
+    }
+
+    input.on('keypress', onKeypress)
+    input.resume()
+    rawInput.setRawMode?.(true)
+  })
+}
+
+function formatFindingCount(count: number, label: string): string {
+  return `${count} ${label}${count === 1 ? '' : 's'}`
+}
+
+function validationSummary(findings: { severity: string }[], logPath: string | null): string {
+  if (findings.length === 0) {
+    return 'passed'
+  }
+
+  const errors = findings.filter(finding => finding.severity === 'error').length
+  const warnings = findings.filter(finding => finding.severity === 'warning').length
+  const infos = findings.filter(finding => finding.severity === 'info').length
+  const parts = [
+    errors > 0 ? formatFindingCount(errors, 'error') : null,
+    warnings > 0 ? formatFindingCount(warnings, 'warning') : null,
+    infos > 0 ? formatFindingCount(infos, 'info') : null,
+  ].filter(Boolean)
+  const location = logPath ? ` (printed to ${logPath})` : ''
+  return `${parts.join(', ')}${location}`
+}
+
+function writeWorkspaceValidationLog(
+  workspaceRoot: string,
+  findings: { severity: string, code: string, path?: string, message: string }[],
+  dryRun: boolean
+): string | null {
+  if (findings.length === 0 || dryRun) {
+    return null
+  }
+
+  const logsDir = join(workspaceRoot, '.logs')
+  mkdirSync(logsDir, { recursive: true })
+  const logPath = join(logsDir, `${randomBytes(6).toString('hex')}.log`)
+  const lines = [
+    'Orizu workspace validation',
+    `Generated at: ${new Date().toISOString()}`,
+    `Workspace: ${workspaceRoot}`,
+    `Summary: ${validationSummary(findings, null)}`,
+    '',
+    ...findings.map(finding => {
+      const path = finding.path ? ` ${finding.path}` : ''
+      return `${finding.severity.toUpperCase()} ${finding.code}:${path} ${finding.message}`
+    }),
+    '',
+  ]
+  writeFileSync(logPath, lines.join('\n'), 'utf8')
+  return relative(workspaceRoot, logPath)
+}
+
+function printWorkspaceFindings(findings: { severity: string, code: string, path?: string, message: string }[]) {
+  if (findings.length === 0) {
+    printLine('   Validation passed.')
+    return
+  }
+
+  printLine('   Validation findings:')
+  for (const finding of findings) {
+    const path = finding.path ? ` ${finding.path}` : ''
+    printLine(`   - ${finding.severity.toUpperCase()} ${finding.code}:${path} ${finding.message}`)
+  }
+}
+
 const SKILL_INSTALL_USAGE =
   `Usage: orizu install-skill [--agent <${SKILL_INSTALL_AGENTS.join('|')}>]... [--scope global|project] [--mode auto|link|copy] [--target <${SKILL_INSTALL_TARGETS.join('|')}>]... [--yes] [--dry-run]`
 
@@ -2933,6 +3296,7 @@ interface SkillInstallChoice {
 function describeSkillTarget(target: SkillInstallTarget): string {
   if (target === 'claude-user') return 'Claude Code, for you across all projects'
   if (target === 'claude-project') return 'Claude Code, only for this project'
+  if (target === 'codex-user') return 'Codex, for you across all projects'
   if (target === 'agent-user') return 'Codex / Open Agent Skills, for you across all projects'
   if (target === 'agents-project') return 'Codex / Open Agent Skills, only for this project'
   if (target === 'codex-project') return 'Codex legacy project folder (.codex/skills)'
@@ -3053,15 +3417,31 @@ interface SkillInstallOutcome {
 
 async function applySkillInstallTargets(
   targets: SkillInstallTarget[],
-  options: { mode: SkillInstallMode, skipConfirm: boolean, dryRun: boolean }
+  options: {
+    mode: SkillInstallMode
+    skipConfirm: boolean
+    dryRun: boolean
+    cwd?: string
+    homeDir?: string
+    showPlan?: boolean
+    printResults?: boolean
+  }
 ): Promise<SkillInstallOutcome[]> {
   const cliVersion = getCliVersion()
   const jsonMode = hasJsonFlag()
   const planned = targets.map(target =>
-    installSkillTarget(target, { dryRun: true, mode: options.mode, cliVersion })
+    installSkillTarget(target, {
+      cwd: options.cwd,
+      homeDir: options.homeDir,
+      dryRun: true,
+      mode: options.mode,
+      cliVersion,
+    })
   )
+  const showPlan = options.showPlan ?? true
+  const printResults = options.printResults ?? true
 
-  if (!jsonMode) {
+  if (showPlan && !jsonMode) {
     printLine('Planned writes:')
     for (const plan of planned) {
       printLine(describePlannedWrite(plan.target, plan.action, plan.mode, plan.path))
@@ -3070,7 +3450,7 @@ async function applySkillInstallTargets(
   }
 
   if (options.dryRun) {
-    if (!jsonMode) {
+    if (printResults && !jsonMode) {
       printLine('Dry run: no files were changed.')
     }
     return planned.map(plan => ({
@@ -3084,8 +3464,8 @@ async function applySkillInstallTargets(
   const outcomes: SkillInstallOutcome[] = []
   for (const target of targets) {
     let overwrite = options.skipConfirm
-    const installPath = getSkillInstallPath(target)
-    if (!overwrite && targetNeedsOverwrite(target)) {
+    const installPath = getSkillInstallPath(target, { cwd: options.cwd, homeDir: options.homeDir })
+    if (!overwrite && targetNeedsOverwrite(target, { cwd: options.cwd, homeDir: options.homeDir })) {
       if (!isInteractiveTerminal()) {
         throw new Error(`${installPath} already exists. Pass --yes to replace it.`)
       }
@@ -3101,11 +3481,13 @@ async function applySkillInstallTargets(
 
     try {
       const result = installSkillTarget(target, {
+        cwd: options.cwd,
+        homeDir: options.homeDir,
         overwrite,
         mode: options.mode,
         cliVersion,
       })
-      if (!jsonMode) {
+      if (printResults && !jsonMode) {
         const suffix = result.mode === 'link' ? ' (symlink)' : ''
         printLine(`${formatSkillInstallAction(result.action)} ${result.path}${suffix}`)
       }
@@ -3115,9 +3497,9 @@ async function applySkillInstallTargets(
         action: result.action as 'created' | 'updated',
         mode: result.mode,
       })
-    } catch (error: any) {
-      const message = error?.message || String(error)
-      if (!jsonMode) {
+    } catch (error: unknown) {
+      const message = getErrorMessage(error)
+      if (printResults && !jsonMode) {
         printLine(`Failed ${installPath}: ${message}`)
       }
       outcomes.push({ target, path: installPath, action: 'failed', mode: null, error: message })
@@ -3295,17 +3677,161 @@ function describeSetupAuthState(): { state: 'signed-in' | 'signed-out', baseUrl:
   }
 }
 
+type SetupTeamChoice =
+  | { kind: 'team', team: Team }
+  | { kind: 'create' }
+
+async function resolveSetupTeam(teamSlugArg: string | null, noInput: boolean, dryRun: boolean): Promise<Team> {
+  const teams = await fetchTeams()
+  const normalizedTeamSlug = teamSlugArg ? normalizeSlugInput(teamSlugArg) : null
+
+  if (normalizedTeamSlug) {
+    const team = teams.find(candidate => candidate.slug === normalizedTeamSlug)
+    if (!team) {
+      throw new Error(`Team '${normalizedTeamSlug}' was not found in your accessible teams.`)
+    }
+    return team
+  }
+
+  if (noInput || dryRun) {
+    throw new Error('Authenticated setup requires --team <slug> when running non-interactively.')
+  }
+
+  const choices: SetupTeamChoice[] = [
+    ...teams.map(team => ({ kind: 'team' as const, team })),
+    { kind: 'create' },
+  ]
+  const choice = await promptKeyboardSelect(
+    'Choose the team to set up in this directory',
+    choices,
+    item => item.kind === 'create'
+      ? 'Create a new team'
+      : `${item.team.name} (${item.team.slug})`
+  )
+
+  if (choice.kind === 'team') {
+    return choice.team
+  }
+
+  const name = await askText('   Team name?', '')
+  if (!name) {
+    throw new Error('Team name is required to create a team.')
+  }
+  return createTeamOnServer(name)
+}
+
+async function resolveSetupProjects(team: Team): Promise<Project[]> {
+  const projects = await fetchProjects(team.slug)
+
+  if (projects.length === 0) {
+    throw new Error(`Team '${team.slug}' has no projects. Create a project before running setup.`)
+  }
+
+  return projects
+}
+
+function projectSeedsFromProjects(projects: Project[]): WorkspaceProjectSeed[] {
+  return projects.map(project => ({
+    slug: project.slug,
+    id: project.id,
+    name: project.name,
+  }))
+}
+
+function formatProjectSetupProgress(count: number): string {
+  return `${count} project${count === 1 ? '' : 's'} being set up in workspace...`
+}
+
+interface SetupSkillChoice {
+  agent: SkillInstallAgent
+  label: string
+  target: SkillInstallTarget
+}
+
+function setupTargetForAgent(agent: SkillInstallAgent): SkillInstallTarget {
+  return agent === 'codex' ? 'codex-user' : 'claude-user'
+}
+
+function resolveSetupSkillHome(): string {
+  return resolve(process.env.HOME || homedir())
+}
+
+function detectedSetupSkillChoices(homeDir: string): SetupSkillChoice[] {
+  const choices: SetupSkillChoice[] = []
+  if (existsSync(join(homeDir, '.codex'))) {
+    choices.push({
+      agent: 'codex',
+      label: 'Codex',
+      target: 'codex-user',
+    })
+  }
+
+  if (existsSync(join(homeDir, '.claude'))) {
+    choices.push({
+      agent: 'claude',
+      label: 'Claude Code',
+      target: 'claude-user',
+    })
+  }
+
+  return choices
+}
+
+function setupSkillTargetsFromArgs(): SkillInstallTarget[] {
+  const targets: SkillInstallTarget[] = []
+  for (const agent of getArgs('--agent')) {
+    if (!isSkillInstallAgent(agent)) {
+      throw new Error(
+        `Unknown agent '${agent}'. Available agents: ${SKILL_INSTALL_AGENTS.join(', ')}`
+      )
+    }
+    const target = setupTargetForAgent(agent)
+    if (!targets.includes(target)) {
+      targets.push(target)
+    }
+  }
+  for (const target of getArgs('--target')) {
+    if (!isSkillInstallTarget(target)) {
+      throw new Error(
+        `Unknown skill install target '${target}'. Available targets: ${SKILL_INSTALL_TARGETS.join(', ')}`
+      )
+    }
+    if (!targets.includes(target)) {
+      targets.push(target)
+    }
+  }
+  return targets
+}
+
+function setupSkillLabel(target: SkillInstallTarget): string {
+  if (target === 'codex-user' || target === 'codex-project' || target === 'agent-user' || target === 'agents-project') {
+    return 'Codex skill'
+  }
+  if (target === 'claude-user' || target === 'claude-project') return 'Claude Code skill'
+  return 'Orizu skill'
+}
+
 async function setupCommand() {
   const dryRun = hasArg('--dry-run')
+  const validateOnly = hasArg('--validate') && !hasArg('--fix')
+  const fix = hasArg('--fix')
+  const verbose = hasArg('--verbose')
+  const handoffRequested = hasArg('--handoff') || Boolean(getArg('--launch'))
   const skipConfirm = hasArg('--yes')
-  const noInput = hasArg('--no-input') || !isInteractiveTerminal()
+  const noInput = hasArg('--no-input') || hasArg('--non-interactive') || !isInteractiveTerminal()
+  const workspaceArg = getOptionalArgValue('--workspace')
+  const workspaceRoot = workspaceArg ? resolve(expandHomePath(workspaceArg)) : process.cwd()
+  const teamArg = getOptionalArgValue('--team')
+  const projectArg = getOptionalArgValue('--project')
+  const setupSkillHome = resolveSetupSkillHome()
+  const installMode: SkillInstallMode = getArg('--mode') ? parseSkillInstallMode() : 'link'
 
   printBannerIfInteractive()
   printLine('Orizu setup')
   printLine('')
 
-  // Phase 1: login
-  printLine('1. Authentication')
+  // Step 1: login
+  printLine('Step 1: Login')
   let auth = describeSetupAuthState()
   if (hasArg('--skip-login')) {
     printLine('   Skipped (--skip-login).')
@@ -3313,70 +3839,159 @@ async function setupCommand() {
     printLine(`   Already authenticated with ${sanitizeTerminalText(auth.baseUrl)}.`)
   } else if (noInput || dryRun) {
     printLine('   Not signed in. Run `orizu login` to authenticate.')
-  } else if (await askYesNo('   Sign in to Orizu now?', true)) {
+  } else if (await waitForAnyKeyOrEscape('   Press any key to open a browser and connect to your account, or Esc to cancel.')) {
     await login()
     auth = describeSetupAuthState()
   } else {
-    printLine('   Skipped. Run `orizu login` when ready.')
-  }
-  printLine('')
-
-  // Phase 2: agent integration
-  printLine('2. Agent integration')
-  const scope = parseSkillInstallScope()
-  const mode = parseSkillInstallMode()
-  let targets = hasArg('--no-install') ? [] : parseSkillInstallTargets(scope)
-  if (targets.length === 0 && !hasArg('--no-install')) {
-    if (noInput) {
-      printLine('   No agents selected. Pass --agent claude and/or --agent codex, or rerun interactively.')
-    } else {
-      targets = await promptSkillInstallTargets(scope)
-    }
-  }
-
-  let installOutcomes: SkillInstallOutcome[] = []
-  if (targets.length > 0) {
-    installOutcomes = await applySkillInstallTargets(targets, { mode, skipConfirm, dryRun })
-  } else if (hasArg('--no-install')) {
-    printLine('   Skipped (--no-install).')
+    throw new Error('Setup cancelled.')
   }
   printLine('')
 
-  // Phase 3: local workspace
-  printLine('3. Local workspace')
-  let workspaceState: 'created' | 'exists' | 'skipped' | 'would-create' = 'skipped'
-  if (hasArg('--no-workspace')) {
+  // Step 2: local workspace
+  printLine('Step 2: Setup your workspace')
+  let workspaceState: 'created' | 'exists' | 'skipped' | 'would-create' | 'validated' | 'invalid' | 'repaired' = 'skipped'
+  let workspaceResult: ReturnType<typeof initOrizuWorkspace> | null = null
+  let validationLogPath: string | null = null
+  let hostedAttached = false
+  if (hasArg('--no-workspace') && !validateOnly && !fix) {
     printLine('   Skipped (--no-workspace).')
-  } else if (workspaceExists()) {
-    workspaceState = 'exists'
-    printLine(`   ${WORKSPACE_DIR_NAME}/ already initialized.`)
   } else {
-    const wantsWorkspace = hasArg('--workspace') ||
-      (!noInput && await askYesNo(`   Create a gitignored ${WORKSPACE_DIR_NAME}/ workspace for local Orizu artifacts?`, true))
+    const wantsWorkspace = validateOnly
+      || fix
+      || hasArg('--workspace')
+      || Boolean(teamArg || projectArg)
+      || workspaceExists(workspaceRoot)
+      || !noInput
     if (wantsWorkspace) {
+      let teamSlug = teamArg
+      const projectSlug = projectArg
+      let teamId: string | null = null
+      let projects: WorkspaceProjectSeed[] | undefined
+
+      if (auth.state === 'signed-in' && !validateOnly) {
+        const team = await resolveSetupTeam(teamSlug, noInput, dryRun)
+        const serverProjects = await resolveSetupProjects(team)
+        teamSlug = team.slug
+        teamId = team.id
+        projects = projectSeedsFromProjects(serverProjects)
+        printLine(`   ${formatProjectSetupProgress(projects.length)}`)
+        if (!hasArg('--local') && !noInput && !dryRun) { let link: GithubLinkResult | null = null; try { link = await runGithubLink(team.slug, { print: printLine, fetcher: authedFetch, openUrl: openInBrowser, confirm: (org) => askYesNo(`   Connect this team to GitHub org '${org}'?`, true) }) } catch (error) { printLine(`   GitHub link skipped: ${getErrorMessage(error)} Run \`orizu github link --team ${team.slug}\` to finish.`) }
+        if (link) { try { hostedAttached = (await runInteractiveHostedSetup({ teamSlug: team.slug, targetDir: workspaceRoot, local: hasArg('--local'), activeInstallation: link.status === 'active' }, { print: printLine, fetcher: authedFetch })).attached } catch (error) { throw new Error(`Hosted setup failed: ${getErrorMessage(error)} Remove any partial clone in ${workspaceRoot} if one exists, then re-run \`orizu setup\` (or pass --local to scaffold a local-only workspace).`) } } }
+      } else if (!teamSlug && !noInput && !validateOnly) {
+        teamSlug = await askText('   Team slug?', 'local-team')
+      }
+      if (auth.state !== 'signed-in' && (!teamSlug || !projectSlug) && noInput && hasArg('--workspace')) {
+        printLine('   Using starter local-only team/project. Pass --team with authentication to materialize server projects.')
+      }
+      if (projectSlug && auth.state !== 'signed-in') {
+        projects = [{ slug: projectSlug }]
+      }
+      if (auth.state !== 'signed-in' && !validateOnly) {
+        const localProjectCount = projects?.length || 1
+        printLine(`   ${formatProjectSetupProgress(localProjectCount)}`)
+      }
+
+      if (hostedAttached) { workspaceState = 'exists' } else {
       const result = initOrizuWorkspace({
+        workspaceRoot,
+        teamSlug,
+        teamId,
+        projectSlug: auth.state === 'signed-in' ? null : projectSlug,
+        projects,
         baseUrl: auth.baseUrl,
+        serviceOrigin: getOptionalArgValue('--service-origin') || auth.baseUrl,
+        attachWorkspaceId: getOptionalArgValue('--attach-workspace'),
         cliVersion: getCliVersion(),
         dryRun,
+        validateOnly,
+        fix,
+        noSymlinks: hasArg('--no-symlinks'),
       })
-      workspaceState = result.state === 'would-create' ? 'would-create' : result.state
-      for (const action of result.actions) {
-        printLine(`   ${dryRun ? 'Would ' : 'Did '}${action}`)
+      workspaceResult = result
+      workspaceState = result.state
+      if (dryRun || verbose) {
+        for (const action of result.actions) {
+          printLine(`   ${dryRun ? 'Would ' : 'Did '}${action}`)
+        }
+      } else if (result.actions.length > 0) {
+        printLine(validateOnly ? '   Workspace validation complete' : '   Workspace setup complete')
+      } else if (!validateOnly) {
+        printLine('   Workspace setup complete')
       }
+      validationLogPath = writeWorkspaceValidationLog(result.root, result.findings, dryRun)
+      if (verbose) {
+        printWorkspaceFindings(result.findings)
+      }
+      if ((validateOnly || fix) && result.findings.some(finding => finding.severity === 'error')) {
+        process.exitCode = 1
+      }
+      }
+    } else {
+      printLine(`   Skipped. Rerun with --workspace to initialize the workspace contract.`)
+    }
+  }
+  printLine('')
+
+  // Step 3: global coding-agent skills
+  let installOutcomes: SkillInstallOutcome[] = []
+  printLine('Step 3: Install coding agent skills')
+  if (hasArg('--no-install') || validateOnly || fix) {
+    printLine(hasArg('--no-install') ? '   Skipped (--no-install).' : '   Skipped for validation/repair.')
+  } else {
+    let targets = setupSkillTargetsFromArgs()
+    if (targets.length === 0 && !noInput && !dryRun) {
+      const choices = detectedSetupSkillChoices(setupSkillHome)
+      if (choices.length > 0) {
+        const selectedChoices = await promptKeyboardMultiSelect(
+          'Choose the coding agents that should learn how to use Orizu',
+          choices,
+          choice => choice.label,
+          () => true
+        )
+        targets = selectedChoices.map(choice => choice.target)
+      } else {
+        printLine('   No Codex or Claude Code agent folders were detected.')
+      }
+    }
+
+    if (targets.length === 0) {
+      printLine('   Skipped skill install.')
     } else {
-      printLine(`   Skipped. Rerun with --workspace to create ${WORKSPACE_DIR_NAME}/.`)
+      printLine('   Installing skills...')
+      installOutcomes = await applySkillInstallTargets(targets, {
+        mode: installMode,
+        skipConfirm,
+        dryRun,
+        cwd: workspaceRoot,
+        homeDir: setupSkillHome,
+        showPlan: false,
+        printResults: false,
+      })
+      if (dryRun) {
+        printLine('   Dry run: no skill files were changed.')
+      }
+      for (const outcome of installOutcomes) {
+        const label = setupSkillLabel(outcome.target)
+        if (outcome.action === 'failed') {
+          printLine(`   ${label} failed: ${outcome.error}`)
+        } else if (outcome.action === 'skipped') {
+          printLine(`   ${label} skipped`)
+        } else {
+          printLine(`   ${label} installed`)
+        }
+      }
     }
   }
   printLine('')
 
   // Phase 4: coding-agent handoff
   const handoffPrompt = renderAgentSetupPrompt({
-    workspacePath: workspaceState === 'created' || workspaceState === 'exists'
-      ? getWorkspaceRoot()
+    workspacePath: workspaceResult && workspaceState !== 'invalid'
+      ? getWorkspaceRoot(workspaceRoot)
       : null,
   })
-  if (!hasArg('--no-handoff')) {
-    printLine('4. Coding-agent handoff')
+  if (handoffRequested && !hasArg('--no-handoff')) {
+    printLine('Step 4: Coding-agent handoff')
     printLine('   Give your coding agent this prompt to plan repo-specific Orizu adoption:')
     printLine('')
     printLine('--- prompt start ---')
@@ -3416,7 +4031,7 @@ async function setupCommand() {
   const summaryTargets = installOutcomes.length > 0
     ? installOutcomes
       .filter(outcome => outcome.action !== 'failed')
-      .map(outcome => ({ outcome, status: getSkillTargetStatus(outcome.target) }))
+      .map(outcome => ({ outcome, status: getSkillTargetStatus(outcome.target, { cwd: workspaceRoot, homeDir: setupSkillHome }) }))
     : []
   const source = resolveSkillSource()
 
@@ -3436,7 +4051,21 @@ async function setupCommand() {
         cliVersion: getCliVersion(),
         skillHash: computeSkillContentHash(source.root),
       },
-      workspace: { state: workspaceState, path: getWorkspaceRoot() },
+      workspace: {
+        state: workspaceState,
+        path: getWorkspaceRoot(workspaceRoot),
+        validationLogPath,
+        operations: workspaceResult?.operations.map(op => ({
+          action: op.action,
+          path: op.path,
+          safe: op.safe,
+          reason: op.reason,
+          entries: op.entries,
+          sourcePath: op.sourcePath,
+          target: op.target,
+        })) || [],
+        findings: workspaceResult?.findings || [],
+      },
     })
     return
   }
@@ -3444,21 +4073,23 @@ async function setupCommand() {
   printLine('Setup summary')
   printLine(`  Auth:         ${auth.state === 'signed-in' ? `signed in (${sanitizeTerminalText(auth.baseUrl)})` : 'not signed in — run `orizu login`'}`)
   if (summaryTargets.length > 0) {
-    printLine('  Integrations:')
+    printLine('  Skills:')
     for (const { outcome, status } of summaryTargets) {
       const modeLabel = status.mode ? `, ${status.mode}` : ''
       printLine(`    ${outcome.target.padEnd(16)} ${status.state}${modeLabel}  ${outcome.path}`)
     }
   } else {
-    printLine('  Integrations: none installed this run — `orizu install-skill` sets them up.')
+    printLine('  Skills:       none installed this run')
   }
   const failed = installOutcomes.filter(outcome => outcome.action === 'failed')
   for (const failure of failed) {
     printLine(`    ${failure.target.padEnd(16)} failed: ${failure.error}`)
   }
-  printLine(`  Skill source: ${source.root} (${source.source})`)
-  printLine(`  Workspace:    ${workspaceState === 'skipped' ? 'skipped' : `${getWorkspaceRoot()} (${workspaceState})`}`)
-  printLine('  Next:         hand the prompt above to your coding agent to plan repo-specific Orizu adoption.')
+  printLine(`  Workspace:    ${workspaceState === 'skipped' ? 'skipped' : getWorkspaceRoot(workspaceRoot)}`)
+  if (workspaceResult) {
+    printLine(`  Validation:   ${validationSummary(workspaceResult.findings, validationLogPath)}`)
+  }
+  printLine('  Next:         run `orizu setup prompt` if you want a coding-agent handoff prompt.')
 }
 
 function setupPromptCommand() {
@@ -3481,8 +4112,8 @@ function readJsonFile(pathArg: string): Record<string, unknown> {
     }
 
     return parsed as Record<string, unknown>
-  } catch (error: any) {
-    throw new Error(`Invalid JSON file '${pathArg}': ${error?.message || String(error)}`)
+  } catch (error: unknown) {
+    throw new Error(`Invalid JSON file '${pathArg}': ${getErrorMessage(error)}`)
   }
 }
 
@@ -3559,141 +4190,6 @@ function writeTextFileEnsuringDir(pathArg: string, content: string) {
   writeFileSync(pathArg, content)
 }
 
-function shouldExcludeArtifactPath(relativePath: string): boolean {
-  const parts = relativePath.split('/')
-  return parts.some(part =>
-    part === '.git' ||
-    part === '.DS_Store' ||
-    part === '__pycache__' ||
-    part === '.pytest_cache'
-  )
-}
-
-function collectArtifactFiles(sourceDir: string, relativeDir = ''): string[] {
-  const absoluteDir = relativeDir ? join(sourceDir, relativeDir) : sourceDir
-  return readdirSync(absoluteDir, { withFileTypes: true })
-    .flatMap(entry => {
-      const relativePath = relativeDir ? `${relativeDir}/${entry.name}` : entry.name
-      if (shouldExcludeArtifactPath(relativePath)) {
-        return []
-      }
-      if (entry.isDirectory()) {
-        return collectArtifactFiles(sourceDir, relativePath)
-      }
-      return entry.isFile() ? [relativePath] : []
-    })
-    .sort((left, right) => left < right ? -1 : left > right ? 1 : 0)
-}
-
-const ZIP_GENERAL_PURPOSE_UTF8 = 0x0800
-const ZIP_DOS_TIME_2000_01_01 = 0
-const ZIP_DOS_DATE_2000_01_01 = ((2000 - 1980) << 9) | (1 << 5) | 1
-const CRC32_TABLE = Array.from({ length: 256 }, (_, index) => {
-  let value = index
-  for (let bit = 0; bit < 8; bit++) {
-    value = (value & 1) ? (0xedb88320 ^ (value >>> 1)) : (value >>> 1)
-  }
-  return value >>> 0
-})
-
-function crc32(bytes: Buffer): number {
-  let crc = 0xffffffff
-  for (const byte of bytes) {
-    crc = CRC32_TABLE[(crc ^ byte) & 0xff] ^ (crc >>> 8)
-  }
-  return (crc ^ 0xffffffff) >>> 0
-}
-
-function createStoredZip(entries: Array<{ path: string; data: Buffer }>): Buffer {
-  const localParts: Buffer[] = []
-  const centralParts: Buffer[] = []
-  let offset = 0
-
-  for (const entry of entries) {
-    const name = Buffer.from(entry.path, 'utf8')
-    const crc = crc32(entry.data)
-    const localHeader = Buffer.alloc(30)
-    localHeader.writeUInt32LE(0x04034b50, 0)
-    localHeader.writeUInt16LE(10, 4)
-    localHeader.writeUInt16LE(ZIP_GENERAL_PURPOSE_UTF8, 6)
-    localHeader.writeUInt16LE(0, 8)
-    localHeader.writeUInt16LE(ZIP_DOS_TIME_2000_01_01, 10)
-    localHeader.writeUInt16LE(ZIP_DOS_DATE_2000_01_01, 12)
-    localHeader.writeUInt32LE(crc, 14)
-    localHeader.writeUInt32LE(entry.data.length, 18)
-    localHeader.writeUInt32LE(entry.data.length, 22)
-    localHeader.writeUInt16LE(name.length, 26)
-    localHeader.writeUInt16LE(0, 28)
-
-    localParts.push(localHeader, name, entry.data)
-
-    const centralHeader = Buffer.alloc(46)
-    centralHeader.writeUInt32LE(0x02014b50, 0)
-    centralHeader.writeUInt16LE(20, 4)
-    centralHeader.writeUInt16LE(10, 6)
-    centralHeader.writeUInt16LE(ZIP_GENERAL_PURPOSE_UTF8, 8)
-    centralHeader.writeUInt16LE(0, 10)
-    centralHeader.writeUInt16LE(ZIP_DOS_TIME_2000_01_01, 12)
-    centralHeader.writeUInt16LE(ZIP_DOS_DATE_2000_01_01, 14)
-    centralHeader.writeUInt32LE(crc, 16)
-    centralHeader.writeUInt32LE(entry.data.length, 20)
-    centralHeader.writeUInt32LE(entry.data.length, 24)
-    centralHeader.writeUInt16LE(name.length, 28)
-    centralHeader.writeUInt16LE(0, 30)
-    centralHeader.writeUInt16LE(0, 32)
-    centralHeader.writeUInt16LE(0, 34)
-    centralHeader.writeUInt16LE(0, 36)
-    centralHeader.writeUInt32LE(0, 38)
-    centralHeader.writeUInt32LE(offset, 42)
-    centralParts.push(centralHeader, name)
-
-    offset += localHeader.length + name.length + entry.data.length
-  }
-
-  const centralDirectoryOffset = offset
-  const centralDirectory = Buffer.concat(centralParts)
-  const endOfCentralDirectory = Buffer.alloc(22)
-  endOfCentralDirectory.writeUInt32LE(0x06054b50, 0)
-  endOfCentralDirectory.writeUInt16LE(0, 4)
-  endOfCentralDirectory.writeUInt16LE(0, 6)
-  endOfCentralDirectory.writeUInt16LE(entries.length, 8)
-  endOfCentralDirectory.writeUInt16LE(entries.length, 10)
-  endOfCentralDirectory.writeUInt32LE(centralDirectory.length, 12)
-  endOfCentralDirectory.writeUInt32LE(centralDirectoryOffset, 16)
-  endOfCentralDirectory.writeUInt16LE(0, 20)
-
-  return Buffer.concat([...localParts, centralDirectory, endOfCentralDirectory])
-}
-
-function zipDirectoryToBase64(dirArg: string): { zipBase64: string; contentSha256: string } {
-  const sourceDir = expandHomePath(dirArg)
-  try {
-    const stats = statSync(sourceDir)
-    if (!stats.isDirectory()) {
-      throw new Error(`${sourceDir} is not a directory`)
-    }
-  } catch (error: any) {
-    if (error?.code === 'ENOENT') {
-      throw new Error(`Directory not found: ${sourceDir}`)
-    }
-    throw error
-  }
-
-  const files = collectArtifactFiles(sourceDir)
-  if (files.length === 0) {
-    throw new Error(`Directory contains no artifact files: ${sourceDir}`)
-  }
-
-  const bytes = createStoredZip(files.map(relativePath => ({
-    path: relativePath,
-    data: readFileSync(join(sourceDir, relativePath)),
-  })))
-  return {
-    zipBase64: bytes.toString('base64'),
-    contentSha256: createHash('sha256').update(bytes).digest('hex'),
-  }
-}
-
 function readManifestFile(dirArg: string): Record<string, unknown> {
   return readJsonFile(join(expandHomePath(dirArg), 'manifest.json'))
 }
@@ -3909,13 +4405,47 @@ function parseCommaSeparated(value: string | null): string[] {
     .filter(Boolean)
 }
 
-function readAssignmentManifest(path: string | null): ReturnType<typeof parseAssignmentManifestJsonl> | null {
+function readAssignmentManifest(path: string | null): ReturnType<typeof readAssignmentManifestJsonlFile> | null {
   if (!path) {
     return null
   }
 
-  const content = readFileSync(expandHomePath(path), 'utf8')
-  return parseAssignmentManifestJsonl(content)
+  return readAssignmentManifestJsonlFile(expandHomePath(path))
+}
+
+function readOptionalTaskTextArg(
+  valueFlag: string,
+  fileFlag: string
+): string | undefined {
+  const value = getArg(valueFlag)
+  const file = getArg(fileFlag)
+  rejectDashPrefixedOptionValue(valueFlag, value)
+  rejectDashPrefixedOptionValue(fileFlag, file)
+
+  if (value !== null && file !== null) {
+    throw new Error(`Use either ${valueFlag} or ${fileFlag}, not both.`)
+  }
+
+  if (file !== null) {
+    return readSourceFile(file)
+  }
+
+  return value ?? undefined
+}
+
+function readPositiveIntegerFlag(name: string): number | undefined {
+  const value = getArg(name)
+  rejectDashPrefixedOptionValue(name, value)
+  if (value === null) {
+    return undefined
+  }
+
+  const parsed = Number(value)
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw new Error(`${name} must be a positive integer`)
+  }
+
+  return parsed
 }
 
 async function createTask() {
@@ -4058,6 +4588,155 @@ async function createTask() {
   )
 }
 
+async function updateTask() {
+  const taskId = getArg('--task')
+  rejectDashPrefixedOptionValue('--task', taskId)
+  if (!taskId) {
+    throw new Error('Usage: orizu tasks update --task <taskId> [--title <text>] [--description <text>|--description-file <path>] [--instructions <text>|--instructions-file <path>] [--dataset <datasetId>] [--app <appId> [--version <n>]] [--labels-per-item <n>] [--assignees <userIdOrEmail1,userIdOrEmail2> | --assignment-file <path>] [--json]')
+  }
+
+  const title = getArg('--title')
+  const description = readOptionalTaskTextArg('--description', '--description-file')
+  const instructions = readOptionalTaskTextArg('--instructions', '--instructions-file')
+  const datasetId = getArg('--dataset')
+  const appId = getArg('--app')
+  const versionNum = readPositiveIntegerFlag('--version')
+  const requiredAssignmentsPerRow = readPositiveIntegerFlag('--labels-per-item')
+  const assignees = parseCommaSeparated(getArg('--assignees'))
+  const assignmentFile = getArg('--assignment-file')
+
+  rejectDashPrefixedOptionValue('--title', title)
+  rejectDashPrefixedOptionValue('--dataset', datasetId)
+  rejectDashPrefixedOptionValue('--app', appId)
+  rejectDashPrefixedOptionValue('--assignment-file', assignmentFile)
+
+  if (title !== null && title.trim().length === 0) {
+    throw new Error('--title must be a non-empty string')
+  }
+
+  if (assignmentFile && assignees.length > 0) {
+    throw new Error('Use either --assignment-file or --assignees, not both.')
+  }
+
+  if (hasArg('--assignees') && assignees.length === 0) {
+    throw new Error('--assignees requires at least one user ID or email')
+  }
+
+  if (versionNum !== undefined && !appId) {
+    throw new Error('--version requires --app')
+  }
+
+  const explicitAssignments = readAssignmentManifest(assignmentFile)
+  const requestBody: Record<string, unknown> = {}
+  if (title !== null) requestBody.title = title.trim()
+  if (description !== undefined) requestBody.description = description
+  if (instructions !== undefined) requestBody.instructions = instructions
+  if (datasetId !== null) requestBody.datasetId = datasetId
+  if (appId !== null) requestBody.appId = appId
+  if (versionNum !== undefined) requestBody.versionNum = versionNum
+  if (requiredAssignmentsPerRow !== undefined) {
+    requestBody.requiredAssignmentsPerRow = requiredAssignmentsPerRow
+  }
+  if (explicitAssignments) {
+    requestBody.explicitAssignments = explicitAssignments
+  } else if (hasArg('--assignees')) {
+    requestBody.memberIds = assignees
+  }
+
+  if (Object.keys(requestBody).length === 0) {
+    throw new Error('Usage: orizu tasks update --task <taskId> [--title <text>] [--description <text>|--description-file <path>] [--instructions <text>|--instructions-file <path>] [--dataset <datasetId>] [--app <appId> [--version <n>]] [--labels-per-item <n>] [--assignees <userIdOrEmail1,userIdOrEmail2> | --assignment-file <path>] [--json]')
+  }
+
+  const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(requestBody),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Failed to update task: ${await extractErrorMessage(response)}`)
+  }
+
+  const data = await parseJsonResponse<{
+    task: {
+      id: string
+      title?: string | null
+      status?: string | null
+      dataset_id?: string | null
+      app_id?: string | null
+      version_id?: string | null
+      required_assignments_per_row?: number | null
+    }
+    assignmentMode?: string
+    assignmentsCreated?: number
+  }>(response, 'Task update')
+
+  if (hasJsonFlag()) {
+    printJson({
+      taskId: data.task.id,
+      title: data.task.title ?? null,
+      status: data.task.status ?? null,
+      datasetId: data.task.dataset_id ?? null,
+      appId: data.task.app_id ?? null,
+      versionId: data.task.version_id ?? null,
+      requiredAssignmentsPerRow: data.task.required_assignments_per_row ?? null,
+      ...(data.assignmentMode ? { assignmentMode: data.assignmentMode } : {}),
+      ...(data.assignmentsCreated !== undefined
+        ? { assignmentsCreated: data.assignmentsCreated }
+        : {}),
+    })
+    return
+  }
+
+  printLine(
+    `Updated draft task ${sanitizeTerminalText(data.task.title || data.task.id)} (${sanitizeTerminalText(data.task.id)})` +
+    (data.task.status ? ` [${sanitizeTerminalText(data.task.status)}]` : '') +
+    (data.task.dataset_id ? `\n  Dataset ID: ${sanitizeTerminalText(data.task.dataset_id)}` : '') +
+    (data.task.version_id ? `\n  Version ID: ${sanitizeTerminalText(data.task.version_id)}` : '') +
+    (data.task.required_assignments_per_row
+      ? `\n  Labels/row: ${data.task.required_assignments_per_row}`
+      : '') +
+    (data.assignmentMode ? `\n  Mode:       ${sanitizeTerminalText(data.assignmentMode === 'custom' ? 'custom row map' : 'auto distribute')}` : '') +
+    (data.assignmentsCreated !== undefined ? `\n  Assignments: ${data.assignmentsCreated}` : '')
+  )
+}
+
+async function discardTask() {
+  const taskId = getArg('--task')
+  rejectDashPrefixedOptionValue('--task', taskId)
+  if (!taskId) {
+    throw new Error('Usage: orizu tasks discard --task <taskId> [--yes] [--json]')
+  }
+
+  if (!hasArg('--yes')) {
+    if (!isInteractiveTerminal()) {
+      throw new Error('Refusing to discard a draft in non-interactive mode without --yes')
+    }
+
+    const confirmed = await askYesNo(`Discard draft task ${taskId}? This cannot be undone.`, false)
+    if (!confirmed) {
+      printLine('Discard cancelled.')
+      return
+    }
+  }
+
+  const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}`, {
+    method: 'DELETE',
+  })
+
+  if (!response.ok) {
+    throw new Error(`Failed to discard draft task: ${await extractErrorMessage(response)}`)
+  }
+
+  const data = await parseJsonResponse<{ success: boolean }>(response, 'Task discard')
+  if (hasJsonFlag()) {
+    printJson({ taskId, discarded: data.success })
+    return
+  }
+
+  printLine(`Discarded draft task ${sanitizeTerminalText(taskId)}.`)
+}
+
 async function publishTask() {
   const taskId = getArg('--task')
   const assignees = parseCommaSeparated(getArg('--assignees'))
@@ -4236,11 +4915,12 @@ async function taskStatus() {
   printTaskStatusSummary(data)
 }
 
-async function updateTaskStatus(targetStatus: 'paused' | 'active') {
+async function updateTaskStatus(targetStatus: 'paused' | 'active' | 'completed') {
   const taskId = getArg('--task')
+  const labels = TASK_STATUS_ACTION_LABELS[targetStatus]
+
   if (!taskId) {
-    const verb = targetStatus === 'paused' ? 'pause' : 'unpause'
-    throw new Error(`Usage: orizu tasks ${verb} --task <taskId>`)
+    throw new Error(`Usage: orizu tasks ${labels.verb} --task <taskId>`)
   }
 
   const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}/status`, {
@@ -4250,8 +4930,7 @@ async function updateTaskStatus(targetStatus: 'paused' | 'active') {
   })
 
   if (!response.ok) {
-    const verb = targetStatus === 'paused' ? 'pause' : 'unpause'
-    throw new Error(`Failed to ${verb} task: ${await response.text()}`)
+    throw new Error(`Failed to ${labels.verb} task: ${await response.text()}`)
   }
 
   const data = await parseJsonResponse<{ task: { id: string; status: string } }>(response, 'Task status update')
@@ -4259,8 +4938,7 @@ async function updateTaskStatus(targetStatus: 'paused' | 'active') {
     printJson({ task: data.task })
     return
   }
-  const action = targetStatus === 'paused' ? 'Paused' : 'Unpaused'
-  printLine(`${action} task ${sanitizeTerminalText(data.task.id)} [${sanitizeTerminalText(data.task.status)}]`)
+  printLine(`${labels.pastTense} task ${sanitizeTerminalText(data.task.id)} [${sanitizeTerminalText(data.task.status)}]`)
 }
 
 async function setTaskReport() {
@@ -4523,10 +5201,10 @@ async function changeTeamMemberRole() {
   const email = getArg('--email')
   const role = getArg('--role')
   if (!teamSlug || !email || !role) {
-    throw new Error('Usage: orizu teams members role --team <teamSlug> --email <email> --role <admin|member>')
+    throw new Error('Usage: orizu teams members role --team <teamSlug> --email <email> --role <admin|curator|judge>')
   }
-  if (!['admin', 'member'].includes(role)) {
-    throw new Error('role must be one of: admin, member')
+  if (!['admin', 'curator', 'judge'].includes(role)) {
+    throw new Error('role must be one of: admin, curator, judge')
   }
 
   const members = await fetchTeamMembers(teamSlug)
@@ -5508,12 +6186,16 @@ async function runnersExec() {
         }
 
         const runnerOutput = JSON.parse(readFileSync(outputPath, 'utf8')) as Record<string, unknown>
+        // Spread runner output first: the scorer/prompt context identity fields
+        // (row_id, version ids, metric_key) are authoritative, never runner-overridable.
         resultLines.push(JSON.stringify({
+          ...runnerOutput,
           row_id: row.id,
           prompt_version_id: context.prompt.promptVersionId,
           runner_version_id: context.prompt.runnerVersionId,
-          ...(scorerVersion ? { scorer_version_id: context.scorer?.versionId || scorerVersion } : {}),
-          ...runnerOutput,
+          ...(scorerVersion
+            ? { scorer_version_id: context.scorer?.versionId || scorerVersion, metric_key: context.scorer?.metricKey || 'score' }
+            : {}),
         }))
       } finally {
         rmSync(tempDir, { recursive: true, force: true })
@@ -5879,6 +6561,16 @@ export async function main(rawArgs = process.argv.slice(2)) {
     return
   }
 
+  if (command === 'tasks' && subcommand === 'update') {
+    await updateTask()
+    return
+  }
+
+  if (command === 'tasks' && subcommand === 'discard') {
+    await discardTask()
+    return
+  }
+
   if (command === 'tasks' && subcommand === 'publish') {
     await publishTask()
     return
@@ -5903,15 +6595,9 @@ export async function main(rawArgs = process.argv.slice(2)) {
     return
   }
 
-  if (command === 'tasks' && subcommand === 'pause') {
-    await updateTaskStatus('paused')
-    return
-  }
-
-  if (command === 'tasks' && subcommand === 'unpause') {
-    await updateTaskStatus('active')
-    return
-  }
+  if (command === 'tasks' && subcommand === 'pause') { await updateTaskStatus('paused'); return }
+  if (command === 'tasks' && subcommand === 'unpause') { await updateTaskStatus('active'); return }
+  if (command === 'tasks' && subcommand === 'complete') { await updateTaskStatus('completed'); return }
 
   if (command === 'datasets' && subcommand === 'upload') {
     await uploadDataset()
@@ -5927,55 +6613,60 @@ export async function main(rawArgs = process.argv.slice(2)) {
     await downloadDataset()
     return
   }
-
   if (command === 'datasets' && subcommand === 'append') {
     await appendDatasetRows()
     return
   }
-
   const datasetsAction = cliArgs[2]
   if (command === 'datasets' && subcommand === 'readme' && datasetsAction === 'set') {
     await setDatasetReadme()
     return
   }
-
   if (command === 'datasets' && subcommand === 'versions' && datasetsAction === 'create') {
     await createDatasetVersion()
     return
   }
-
   if (command === 'datasets' && subcommand === 'splits' && datasetsAction === 'create') {
     await createDatasetSplitSet()
     return
   }
-
   if (command === 'datasets' && subcommand === 'edit-rows') {
     await editDatasetRows()
     return
   }
-
   if (command === 'datasets' && subcommand === 'delete-rows') {
     await deleteDatasetRows()
     return
   }
-
   if (command === 'datasets' && subcommand === 'delete') {
     await deleteDataset()
     return
   }
-
-  if (command === 'datasets' && subcommand === 'lock') {
-    await lockDataset()
+  if (command === 'datasets' && subcommand === 'lock') { await lockDataset(); return }
+  if (command === 'datasets' && subcommand === 'clone') { await cloneDataset(); return }
+  if (command === 'tasks' && subcommand === 'export') { await downloadAnnotations(); return }
+  if (command === 'internal' || (command === 'session' && subcommand === 'start' && hasArg('--hosted'))) { process.exitCode = await hostedCommand(cliArgs, { json: hasJsonFlag(), print: printLine, printErr: printError }); return }
+  if (command === 'session' || command === 'run') {
+    process.exitCode = await workbenchCommand(cliArgs, { json: hasJsonFlag(), print: printLine })
     return
   }
-
-  if (command === 'datasets' && subcommand === 'clone') {
-    await cloneDataset()
+  if (command === 'workspace') {
+    process.exitCode = await workspaceSyncCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine })
     return
   }
-
-  if (command === 'tasks' && subcommand === 'export') {
-    await downloadAnnotations()
+  if (command === 'git-credential') { process.exitCode = await runGitCredential(subcommand ?? 'get', { stdin: readFileSync(0, 'utf8'), cwd: process.cwd(), print: printLine, printErr: printError }); return }
+  if (command === 'github' && subcommand === 'link') { const noInput = hasArg('--no-input') || hasArg('--non-interactive') || !isInteractiveTerminal(); const team = getOptionalArgValue('--team') || (await resolveSetupTeam(null, noInput, false)).slug; await runGithubLink(team, { print: printLine, fetcher: authedFetch, openUrl: openInBrowser, confirm: (org) => askYesNo(`Connect this team to GitHub org '${org}'?`, true) }); return }
+  if (command === 'connectors' || command === 'manifests') {
+    const moduleCommand = command === 'connectors' ? connectorsCommand : manifestsCommand
+    process.exitCode = await moduleCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine, resolveProjectSlug })
+    return
+  }
+  if (command === 'team' && (subcommand === 'kill-agents' || subcommand === 'release-agents')) {
+    process.exitCode = await killSwitchCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine, printErr: printError })
+    return
+  }
+  if (command === 'team' && subcommand === 'egress-allowlist') {
+    process.exitCode = await egressAllowlistCommand(cliArgs.slice(1), { json: hasJsonFlag(), print: printLine, printErr: printError })
     return
   }
 
@@ -5998,7 +6689,7 @@ function isCliEntrypoint(): boolean {
 
 if (isCliEntrypoint()) {
   main().catch(error => {
-    console.error(sanitizeTerminalText(error instanceof Error ? error.message : 'Unknown error'))
+    printError(error instanceof Error ? error.message : 'Unknown error')
     process.exit(1)
   })
 }