orizu 0.5.11 → 0.5.13

package/dist/credentials.js

@@ -206,6 +206,43 @@ export function resolveEnvBearerToken() {
     }
     return null;
 }
+/**
+ * THE uniform bearer resolution for every CLI command (ALI-1090). Exactly the
+ * order `authedFetch` uses: `ORIZU_TOKEN` env → `ORIZU_TOKEN_FILE` (both via
+ * resolveEnvBearerToken, read FRESH per call — never cached, so hosted token
+ * rotations are picked up) → stored credentials.json. Commands that need a raw
+ * bearer (`orizu env`, the run-gepa wrapper) MUST use this instead of reading
+ * credentials.json directly, or they break in hosted sandboxes that are
+ * pre-authenticated via ORIZU_TOKEN_FILE and never ran `orizu login`.
+ */
+export function resolveAuthTokenForBaseUrl(baseUrl) {
+    const envBearer = resolveEnvBearerToken();
+    if (envBearer) {
+        return envBearer;
+    }
+    const credentials = getServerCredentials(baseUrl);
+    if (!credentials) {
+        throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
+    }
+    return 'accessToken' in credentials ? credentials.accessToken : credentials.apiKey;
+}
+/**
+ * Non-throwing "is any auth available?" check (login --no-prompt-if-logged-in,
+ * setup status). Mirrors resolveAuthTokenForBaseUrl's order so an env bearer
+ * counts as signed in. A misconfigured ORIZU_TOKEN_FILE reports false here —
+ * actual requests still fail loudly via resolveEnvBearerToken.
+ */
+export function hasResolvableAuth(baseUrl) {
+    try {
+        if (resolveEnvBearerToken()) {
+            return true;
+        }
+    }
+    catch {
+        // fall through to stored credentials
+    }
+    return getServerCredentials(baseUrl) !== null;
+}
 export function setActiveBaseUrl(baseUrl) {
     const config = loadCredentialsConfigForWrite();
     config.activeBaseUrl = baseUrl;

package/dist/deploy-key-merge-core.js

@@ -0,0 +1,258 @@
+/**
+ * Transport-agnostic deploy-key merge core (ALI-1084, merge-sandbox-job
+ * Phase 0). Extracted VERBATIM from `lib/git-ssh-merge.ts` so both the server
+ * (`lib/`) and the published CLI (`orizu internal merge-job`, Phase 2) run the
+ * EXACT SAME merge logic — no forked implementations, one place where the
+ * ADR-007 §4 `--no-ff` invariant is asserted on the exact argv.
+ *
+ * DELIBERATELY NO `import 'server-only'`: this module runs inside the one-shot
+ * merge sandbox (a plain Node process) as well as on the server. It must not
+ * import anything outside the CLI package root (bun-bundled) — node builtins
+ * only. `lib/git-ssh-merge.ts` re-exports everything here so every existing
+ * server import path and test keeps working unchanged.
+ *
+ * SECURITY PROPERTIES (unchanged from the lib original):
+ *   - throwaway temp worktree + isolated SSH identity (key file mode 0600);
+ *   - pinned GitHub host keys (StrictHostKeyChecking=yes, own known_hosts);
+ *   - expected-head verification: the merge targets the REVIEWED SHA, never a
+ *     branch name;
+ *   - `merge-base --is-ancestor` alreadyMerged idempotency check;
+ *   - argv-asserted commit-preserving `--no-ff` merge (ADR-007 §4).
+ */
+import { spawn } from 'node:child_process';
+import { chmod, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * ADR-007 §4 merge-strategy invariant: the seal merge must stay a COMMIT-
+ * PRESERVING merge. `--no-ff` keeps the session-branch head as a parent of the
+ * merge commit, so every create-time `commit_sha` pinned by a draft version
+ * row stays reachable on the default branch forever. A squash or rebase would
+ * rewrite/discard those commits and orphan the pins — "what the label says is
+ * live" could then dangle. These flags must never appear in the seal merge.
+ */
+const FORBIDDEN_SEAL_MERGE_FLAGS = ['--squash', '--ff-only', '--ff', 'rebase'];
+const REQUIRED_SEAL_MERGE_FLAG = '--no-ff';
+/**
+ * Assert a git invocation is the commit-preserving seal merge ADR-007 §4
+ * requires. Called on the exact argv the merge runs with, so the invariant is
+ * enforced where the merge happens rather than by reviewer vigilance.
+ */
+export function assertCommitPreservingMergeArgs(args) {
+    if (!args.includes('merge')) {
+        throw new Error('seal merge invariant: expected a git merge invocation');
+    }
+    if (!args.includes(REQUIRED_SEAL_MERGE_FLAG)) {
+        throw new Error(`seal merge invariant violated: ${REQUIRED_SEAL_MERGE_FLAG} is required (ADR-007 §4 — the merge must keep the session head as a parent)`);
+    }
+    for (const flag of FORBIDDEN_SEAL_MERGE_FLAGS) {
+        if (args.includes(flag)) {
+            throw new Error(`seal merge invariant violated: ${flag} would rewrite or drop session commits and orphan draft version pins (ADR-007 §4)`);
+        }
+    }
+}
+const LOCAL_BASE_REF = 'refs/heads/__orizu_merge_base';
+const LOCAL_SOURCE_REF = 'refs/remotes/origin/__orizu_merge_source';
+// GitHub's published SSH host keys (PINNED — never ssh-keyscan'd at runtime):
+// https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
+// (canonically republished at https://api.github.com/meta `ssh_keys`).
+const GITHUB_HOST_KEYS = [
+    'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl',
+    'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=',
+    'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=',
+];
+// Both SSH endpoints GitHub serves git over: the standard port AND the
+// SSH-over-the-HTTPS-port endpoint (docs.github.com "Using SSH over the
+// HTTPS port") the merge sandbox uses — its egress firewall enforces at
+// SNI/CIDR level and raw SSH on :22 was reset in the first live run
+// (ALI-1084 live-fire, 2026-07-15). GitHub publishes ONE key set for both
+// hosts; OpenSSH matches a non-22 port with the `[host]:port` known_hosts
+// form, so the 443 endpoint needs its own lines. Pinning discipline is
+// unchanged: same keys, one more host alias.
+const GITHUB_KNOWN_HOSTS = GITHUB_HOST_KEYS.flatMap(key => [`github.com ${key}`, `[ssh.github.com]:443 ${key}`]).join('\n') + '\n';
+/**
+ * Strip git's repo-context env vars from a child git's environment. Git
+ * EXPORTS these into hook subprocesses (from a linked worktree, GIT_DIR is an
+ * ABSOLUTE path into the shared .git), so any descendant git command that
+ * inherits the parent env operates on THAT repo instead of its own cwd —
+ * `git config` writes land in the shared .git/config and `git init` flips it
+ * to core.bare=true (both observed when the pre-push hook ran the test suite
+ * from a worktree). Every real-git spawn must build its env through this.
+ */
+export function scrubGitRepoContextEnv(env = process.env) {
+    const scrubbed = { ...env };
+    delete scrubbed.GIT_DIR;
+    delete scrubbed.GIT_WORK_TREE;
+    delete scrubbed.GIT_INDEX_FILE;
+    delete scrubbed.GIT_OBJECT_DIRECTORY;
+    delete scrubbed.GIT_COMMON_DIR;
+    delete scrubbed.GIT_NAMESPACE;
+    return scrubbed;
+}
+// Exported: the ADR-007 P3 read path (lib/artifact-git-read.ts) runs its
+// verified reads through the same spawn.
+export function defaultRunGit(args, options) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('git', args, {
+            cwd: options.cwd,
+            env: options.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', chunk => { stdout += chunk; });
+        child.stderr.on('data', chunk => { stderr += chunk; });
+        child.on('error', reject);
+        child.on('close', code => resolve({ exitCode: code ?? 1, stdout, stderr }));
+    });
+}
+export function sshRemote(repoFullName) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repoFullName)) {
+        throw new Error(`Invalid repo full name: ${repoFullName}`);
+    }
+    return `git@github.com:${repoFullName}.git`;
+}
+/**
+ * The SSH-over-the-HTTPS-port remote (GitHub-supported: `ssh.github.com:443`
+ * speaks the same SSH protocol, same auth, same host-key set). The MERGE core
+ * uses this endpoint because the merge sandbox's egress firewall enforces at
+ * the SNI/CIDR layer and reset raw SSH on :22 in the first live run
+ * (ALI-1084); :443 within GitHub's published git CIDRs is the compatible
+ * path. Equivalent from dev machines, so local/sandbox parity holds (D6).
+ * The push/read paths (D9/Phase 6) keep `sshRemote` untouched.
+ */
+export function sshRemoteOverHttpsPort(repoFullName) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repoFullName)) {
+        throw new Error(`Invalid repo full name: ${repoFullName}`);
+    }
+    return `ssh://git@ssh.github.com:443/${repoFullName}.git`;
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/** Exported for `lib/git-ssh-merge.ts` (pushFilesWithDeployKey keeps living
+ *  there — D9 scopes the push path as a follow-on, not part of the core). */
+export function assertGitOk(result, operation) {
+    if (result.exitCode === 0)
+        return;
+    const detail = (result.stderr || result.stdout).trim();
+    throw new Error(detail ? `${operation} failed: ${detail}` : `${operation} failed`);
+}
+function looksLikeMergeConflict(result) {
+    const output = `${result.stdout}\n${result.stderr}`;
+    return /CONFLICT|Automatic merge failed|Merge conflict/i.test(output);
+}
+/**
+ * Run a callback inside a throwaway git worktree wired to the repo's merge
+ * deploy key (isolated SSH identity + pinned GitHub host keys). Exported for
+ * the ADR-007 read path (lib/artifact-git-read.ts), which reuses the same
+ * clone/pack infrastructure for bulk artifact reads.
+ */
+export async function withDeployKeyGit(privateKeyPem, runGit, tempPrefix, callback) {
+    const tempRoot = await mkdtemp(join(tmpdir(), tempPrefix));
+    const dir = join(tempRoot, 'worktree');
+    const sshDir = join(tempRoot, 'ssh');
+    await mkdir(dir);
+    await mkdir(sshDir);
+    const keyPath = join(sshDir, 'merge_deploy_key');
+    const knownHostsPath = join(sshDir, 'known_hosts');
+    const env = {
+        // Scrubbed: a leaked GIT_DIR (git exports it into hooks) must never
+        // redirect this temp-worktree clone/merge onto another repo.
+        ...scrubGitRepoContextEnv(process.env),
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_SSH_COMMAND: [
+            'ssh',
+            '-i',
+            shellQuote(keyPath),
+            '-o',
+            'IdentitiesOnly=yes',
+            '-o',
+            'StrictHostKeyChecking=yes',
+            '-o',
+            shellQuote(`UserKnownHostsFile=${knownHostsPath}`),
+        ].join(' '),
+    };
+    const git = (args) => runGit(args, { cwd: dir, env });
+    const gitOk = async (args, operation) => {
+        const result = await git(args);
+        assertGitOk(result, operation);
+        return result;
+    };
+    try {
+        await writeFile(keyPath, privateKeyPem, { mode: 0o600 });
+        await chmod(keyPath, 0o600);
+        await writeFile(knownHostsPath, GITHUB_KNOWN_HOSTS, { mode: 0o600 });
+        return await callback({ dir, git, gitOk });
+    }
+    finally {
+        await rm(tempRoot, { recursive: true, force: true });
+    }
+}
+/**
+ * Merge a reviewed session/revert branch head into the default branch using the
+ * server-only merge deploy key. The source branch is fetched only so GitHub can
+ * prove the reviewed SHA is still the branch tip; the merge itself targets the
+ * expected SHA, preserving the manifest CAS guarantee.
+ */
+export async function mergeBranchWithDeployKey(repoFullName, input, deps = {}) {
+    const runGit = deps.runGit ?? defaultRunGit;
+    return withDeployKeyGit(input.privateKeyPem, runGit, 'orizu-merge-', async ({ git, gitOk }) => {
+        await gitOk(['init'], 'git init');
+        // SSH over the HTTPS port (ALI-1084 live-fire fix): the merge sandbox's
+        // egress firewall reset raw SSH on github.com:22; ssh.github.com:443 is
+        // the GitHub-supported equivalent (same protocol, same pinned host keys).
+        await gitOk(['remote', 'add', 'origin', sshRemoteOverHttpsPort(repoFullName)], 'git remote add');
+        await gitOk(['fetch', '--no-tags', 'origin', `refs/heads/${input.base}:${LOCAL_BASE_REF}`], 'git fetch default branch');
+        await gitOk(['checkout', '-B', '__orizu_merge_base', LOCAL_BASE_REF], 'git checkout default branch');
+        await gitOk(['fetch', '--no-tags', 'origin', `refs/heads/${input.sourceBranch}:${LOCAL_SOURCE_REF}`], 'git fetch reviewed source branch');
+        const sourceHead = (await gitOk(['rev-parse', LOCAL_SOURCE_REF], 'git rev-parse source')).stdout.trim();
+        if (sourceHead !== input.expectedHeadSha) {
+            throw new Error('branch moved since manifest creation; re-finish the session');
+        }
+        const ancestor = await git(['merge-base', '--is-ancestor', input.expectedHeadSha, 'HEAD']);
+        if (ancestor.exitCode === 0) {
+            const head = (await gitOk(['rev-parse', 'HEAD'], 'git rev-parse default')).stdout.trim();
+            return { merged: false, sha: head, alreadyMerged: true, conflict: false, status: 204 };
+        }
+        if (ancestor.exitCode !== 1) {
+            assertGitOk(ancestor, 'git merge-base');
+        }
+        // ADR-007 §4: the seal is a commit-preserving --no-ff merge — never squash,
+        // never rebase — so every draft version's create-time commit_sha stays
+        // reachable once the branch reaches the default branch.
+        const mergeArgs = [
+            '-c',
+            'user.name=Orizu',
+            '-c',
+            'user.email=bot@orizu.ai',
+            'merge',
+            '--no-ff',
+            '-m',
+            input.commitMessage,
+            input.expectedHeadSha,
+        ];
+        assertCommitPreservingMergeArgs(mergeArgs);
+        const merge = await git(mergeArgs);
+        if (merge.exitCode !== 0) {
+            if (looksLikeMergeConflict(merge)) {
+                return { merged: false, sha: null, alreadyMerged: false, conflict: true, status: 409 };
+            }
+            assertGitOk(merge, 'git merge');
+        }
+        const mergeSha = (await gitOk(['rev-parse', 'HEAD'], 'git rev-parse merge')).stdout.trim();
+        // D8 pre-push gate: the LAST check before anything reaches the default
+        // branch. A refused gate aborts with superseded — no push, no side effect
+        // (the temp worktree dies with this callback).
+        if (deps.prePushGate) {
+            const proceed = await deps.prePushGate();
+            if (!proceed) {
+                return { merged: false, sha: null, alreadyMerged: false, conflict: false, superseded: true, status: 409 };
+            }
+        }
+        await gitOk(['push', 'origin', `HEAD:refs/heads/${input.base}`], 'git push default branch');
+        return { merged: true, sha: mergeSha, alreadyMerged: false, conflict: false, status: 201 };
+    });
+}

package/dist/hosted-boot.js

@@ -546,6 +546,25 @@ export async function runHostedBoot(opts) {
             bearerProvider: () => readFile(bearerFileAbs).trim(),
         });
         log(`hosted-loop finished: ${result.status}`);
+        // ALI-1064: the loop is TERMINAL — the auto-harvest (ALI-1036) and the
+        // run's terminal seal already ran INSIDE runHostedLoop, so it is safe to
+        // hand the session back. Report `complete` so the DO ends the workspace
+        // session server-side and stops/destroys the sandbox NOW instead of
+        // extending it until the 24h cap (live 2026-07-15: zombie boxes burned
+        // 2×CPU/4GiB for hours after their loops finished). This fires for a
+        // failed loop too — the run is terminal either way, and the loop already
+        // owns its own run-level terminal state (never a `failed` boot-status
+        // here; that would misreport a run failure as a bootstrap failure).
+        // Best-effort: the DO's duration/24h caps are the backstop.
+        await postBootStatus({
+            bootStatusUrl: env.bootStatusUrl,
+            bootSecret: env.bootSecret,
+            status: 'complete',
+            runId,
+            reason: result.error ? redactBootReason(result.error, env.bootSecret) : null,
+            fetchImpl,
+            log,
+        });
         return { ok: !result.error, runId, loopStatus: result.status, error: result.error };
     }
     finally {

package/dist/hosted-session-cli.js

@@ -42,6 +42,7 @@ import { createVercelProvider } from './vercel-sandbox-provider.js';
 import { buildEgressPolicy, DEFAULT_EGRESS_CANARY_HOST } from './egress-policy.js';
 import { hostedLoopCommand } from './hosted-loop.js';
 import { hostedBootCommand } from './hosted-boot.js';
+import { mergeJobCommand } from './merge-job.js';
 import { authedFetch } from './http.js';
 import { resolveBaseUrl } from './http.js';
 import { getWorkspaceRoot } from './workspace.js';
@@ -699,7 +700,11 @@ export async function hostedCommand(args, io, deps = {}) {
         if (positional[1] === 'hosted-boot') {
             return hostedBootCommand(io);
         }
-        io.printErr?.('Usage: orizu internal <hosted-loop --context <path> | hosted-boot>');
+        // ALI-1084: the one-shot merge sandbox entrypoint (MergeJobCoordinator DO).
+        if (positional[1] === 'merge-job') {
+            return mergeJobCommand(io);
+        }
+        io.printErr?.('Usage: orizu internal <hosted-loop --context <path> | hosted-boot | merge-job>');
         return 1;
     }
     const task = argVal(args, '--task');

package/dist/index.js

@@ -10,7 +10,7 @@ import { homedir, tmpdir } from 'os';
 import { createInterface } from 'readline/promises';
 import { emitKeypressEvents } from 'readline';
 import { stdin as input, stdout as output } from 'process';
-import { clearServerCredentials, getServerCredentials, saveServerCredentials } from './credentials.js';
+import { clearServerCredentials, getServerCredentials, hasResolvableAuth, resolveAuthTokenForBaseUrl, saveServerCredentials, } from './credentials.js';
 import { parseDatasetFile } from './file-parser.js';
 import { streamJsonlRowChunks } from './jsonl-stream.js';
 import { parseDatasetReference } from './dataset-download.js';
@@ -244,13 +244,6 @@ export async function parseJsonResponse(response, context) {
 function shellQuote(value) {
     return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }
-function getStoredAuthTokenForBaseUrl(baseUrl) {
-    const credentials = getServerCredentials(baseUrl);
-    if (!credentials) {
-        throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
-    }
-    return 'accessToken' in credentials ? credentials.accessToken : credentials.apiKey;
-}
 function printPromptSummaries(items, emptyMessage) {
     if (items.length === 0) {
         printLine(emptyMessage);
@@ -735,7 +728,10 @@ function renderCliAuthBrowserPage(status) {
 async function login() {
     const baseUrl = hasArg('--no-prompt-if-logged-in') ? getBaseUrl() : resolveLoginBaseUrl();
     assertSecureTokenTransport(baseUrl);
-    if (hasArg('--no-prompt-if-logged-in') && getServerCredentials(baseUrl)) {
+    // hasResolvableAuth (ALI-1090): an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE)
+    // counts as logged in — a pre-authenticated hosted sandbox must not fall into
+    // the interactive browser flow.
+    if (hasArg('--no-prompt-if-logged-in') && hasResolvableAuth(baseUrl)) {
         if (hasJsonFlag()) {
             printJson({ status: 'already-logged-in', server: baseUrl });
             return;
@@ -884,7 +880,10 @@ async function logout() {
 }
 async function printEnv() {
     const baseUrl = getBaseUrl();
-    const token = getStoredAuthTokenForBaseUrl(baseUrl);
+    // Uniform resolution (ALI-1090): env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE)
+    // wins over credentials.json, so `orizu env` works in hosted sandboxes that
+    // never ran `orizu login`.
+    const token = resolveAuthTokenForBaseUrl(baseUrl);
     const projectArg = getArg('--project');
     const project = projectArg ? await resolveProjectSelection(projectArg) : null;
     const projectId = project?.id || getArg('--project-id') || process.env.ORIZU_PROJECT_ID || '';
@@ -1916,7 +1915,10 @@ function bundledOrizuGepaPythonPath() {
 async function runGepaOptimization() {
     const project = getArg('--project') || await resolveProjectSlug(null);
     const baseUrl = getBaseUrl();
-    const token = getStoredAuthTokenForBaseUrl(baseUrl);
+    // Uniform resolution (ALI-1090): honors ORIZU_TOKEN / ORIZU_TOKEN_FILE before
+    // credentials.json so hosted sandboxes can run optimizations. Read at spawn
+    // time — the child gets the freshest bearer available at launch.
+    const token = resolveAuthTokenForBaseUrl(baseUrl);
     const python = getArg('--python') || process.env.PYTHON || 'python3';
     const bundledPythonPath = bundledOrizuGepaPythonPath();
     let forwardedArgs = removeFlagWithValue(cliArgs.slice(2), '--python');
@@ -2682,7 +2684,8 @@ function findExecutable(name) {
 function describeSetupAuthState() {
     const baseUrl = getBaseUrl();
     return {
-        state: getServerCredentials(baseUrl) ? 'signed-in' : 'signed-out',
+        // ALI-1090: an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE) is signed-in too.
+        state: hasResolvableAuth(baseUrl) ? 'signed-in' : 'signed-out',
         baseUrl,
     };
 }

package/dist/manifests-cli.js

@@ -3,9 +3,28 @@
  * Pure command logic with an injected fetcher and project resolver; the entry
  * point owns argument parsing and human/JSON output. apply is idempotent on the
  * server — re-applying returns the stored outcome.
+ *
+ * Every id-taking subcommand accepts a short-id PREFIX (ALI-1038/ALI-1092): a
+ * leading hex slice of the manifest UUID is resolved CLI-side against the
+ * project's manifest list — unique match wins, none/ambiguous is a clear error,
+ * never a server 500.
  */
 import { authedFetch } from './http.js';
 const MANIFEST_ACTIONS = new Set(['approve', 'reject', 'apply', 'revert']);
+// -- Apply auto-retry (ALI-1084 D5) -------------------------------------------
+// A repo_merge apply now runs a one-shot merge sandbox server-side; past the
+// route's bounded wait it answers a RETRYABLE 409 "merge job in progress;
+// re-run apply" — the re-apply ATTACHES to the running job (never restarts
+// it), so retrying is free and idempotent. The CLI absorbs that contract with
+// a bounded auto-retry loop (~2 min total) and clear progress output.
+const APPLY_RETRY_BUDGET_MS = 120_000;
+const APPLY_RETRY_INTERVAL_MS = 5_000;
+const MERGE_IN_PROGRESS_MARKER = 'merge job in progress';
+async function isMergeJobInProgress(response) {
+    if (response.status !== 409)
+        return false;
+    return (await responseMessage(response)).toLowerCase().includes(MERGE_IN_PROGRESS_MARKER);
+}
 async function responseMessage(response) {
     try {
         const data = (await response.clone().json());
@@ -58,6 +77,39 @@ async function requireProjectSlug(io, args) {
     }
     return io.resolveProjectSlug(argValue(args, '--project'));
 }
+// -- short-id prefix resolution (ALI-1092; `show` parity with approve/reject) --
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+// A candidate short id: a leading hex slice of a UUID (dashes allowed), shorter
+// than the full 36 chars. Anything else (full UUIDs, non-hex ids in tests/fixtures)
+// is passed to the server untouched.
+const UUID_PREFIX_RE = /^[0-9a-f][0-9a-f-]{0,34}$/i;
+/**
+ * Resolve a manifest id argument shared by show/approve/reject/apply/revert.
+ * Full UUIDs (and non-prefix-shaped ids) pass through. A short-id prefix is
+ * matched against the project's manifest list: exactly one hit resolves; zero
+ * or multiple hits throw a clean, actionable error instead of letting a
+ * non-UUID id reach the server and 500.
+ */
+async function resolveManifestId(io, args, id) {
+    if (UUID_RE.test(id) || !UUID_PREFIX_RE.test(id)) {
+        return id;
+    }
+    const projectSlug = await requireProjectSlug(io, args);
+    const response = await fetcherFrom(io)(`/api/cli/promotion-manifests?project=${encodeURIComponent(projectSlug)}`);
+    const data = await requireOk(response, 'Manifest lookup');
+    const manifests = Array.isArray(data.manifests) ? data.manifests : [];
+    const needle = id.toLowerCase();
+    const matches = manifests
+        .map(manifest => (typeof manifest.id === 'string' ? manifest.id : ''))
+        .filter(candidate => candidate.toLowerCase().startsWith(needle));
+    if (matches.length === 1) {
+        return matches[0];
+    }
+    if (matches.length === 0) {
+        throw new Error(`No manifest matching '${id}' found in ${projectSlug}. Run \`orizu manifests list\` to see ids.`);
+    }
+    throw new Error(`Manifest id '${id}' is ambiguous — it matches ${matches.length} manifests (${matches.join(', ')}). Use a longer prefix.`);
+}
 function emit(io, payload, human) {
     io.print(io.json ? JSON.stringify(payload) : human);
 }
@@ -192,10 +244,11 @@ export async function manifestsCommand(args, io) {
         return 0;
     }
     if (subcommand === 'show') {
-        const id = positional[1];
-        if (!id) {
+        const idArg = positional[1];
+        if (!idArg) {
             throw new Error('Usage: orizu manifests show <id> [--json]');
         }
+        const id = await resolveManifestId(io, args, idArg);
         const response = await fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`);
         const data = await requireOk(response, 'Manifest show');
         const manifest = (data.manifest ?? {});
@@ -206,15 +259,34 @@ export async function manifestsCommand(args, io) {
         return 0;
     }
     if (subcommand && MANIFEST_ACTIONS.has(subcommand)) {
-        const id = positional[1];
-        if (!id) {
+        const idArg = positional[1];
+        if (!idArg) {
             throw new Error(`Usage: orizu manifests ${subcommand} <id> [--json]`);
         }
-        const response = await fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`, {
+        const id = await resolveManifestId(io, args, idArg);
+        const postAction = () => fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ action: subcommand }),
         });
+        let response = await postAction();
+        if (subcommand === 'apply') {
+            // Bounded auto-retry for the in-flight merge job (ALI-1084 D5): apply
+            // is idempotent and a re-apply attaches to the SAME job, so retrying
+            // the documented "merge job in progress" 409 is always safe.
+            const sleep = io.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+            const startedAt = Date.now();
+            let attempt = 1;
+            while ((await isMergeJobInProgress(response)) &&
+                Date.now() - startedAt + APPLY_RETRY_INTERVAL_MS <= APPLY_RETRY_BUDGET_MS) {
+                if (!io.json) {
+                    io.print(`merge job in progress (attempt ${attempt}); retrying apply in ${APPLY_RETRY_INTERVAL_MS / 1000}s…`);
+                }
+                await sleep(APPLY_RETRY_INTERVAL_MS);
+                attempt += 1;
+                response = await postAction();
+            }
+        }
         const data = await requireOk(response, `Manifest ${subcommand}`);
         const manifest = (data.manifest ?? {});
         const lines = [manifestLine(manifest)];