orizu 0.5.11 → 0.5.13

package/dist/merge-job.js

@@ -0,0 +1,325 @@
+/**
+ * `orizu internal merge-job` — the one-shot merge sandbox ENTRYPOINT
+ * (ALI-1084, merge-sandbox-job Phase 2). The MergeJobCoordinator DO launches
+ * this inside a minimal, AGENT-FREE sandbox booted from the hosted snapshot;
+ * from here the sandbox pulls its own credentials under the established
+ * boot-secret PULL model and runs the SHARED merge core
+ * (deploy-key-merge-core.ts — the exact code the server path runs; no forked
+ * merge logic).
+ *
+ * FLOW (plan §2.2 step 4):
+ *   a. exchange ORIZU_BOOT_SECRET at the DO for a single-use JOB TOKEN
+ *      (`GET {coordinator}/merge-jobs/:jobKey/job-token`) — the token transits
+ *      Cloudflare; the DEPLOY KEY never does;
+ *   b. pull `{spec, privateKeyPem}` DIRECTLY from the control plane
+ *      (`GET {orizu}/api/coordinator/merge-jobs/:jobId/payload`, job-token
+ *      auth) — single-use, audited server-side before the key is returned;
+ *   c. run the shared merge core (tmp worktree, 0600 key file, pinned GitHub
+ *      host keys, expected-head verification, argv-asserted --no-ff merge)
+ *      with the D8 PRE-PUSH GATE wired in: immediately before `git push` the
+ *      core calls `GET .../gate`; `proceed: false` aborts WITHOUT pushing
+ *      (terminal `superseded`). An UNREACHABLE gate also refuses the push
+ *      (fail closed) but reports `failed` (retryable) — "unknown" is not
+ *      "rejected";
+ *   d. POST the terminal result to the DO (boot-secret auth). Reporting the
+ *      terminal state — not the merge outcome — is this command's success:
+ *      exit 0 on ANY reported terminal (conflict/superseded included), exit 1
+ *      only when the env is invalid or the report itself failed.
+ *
+ * FROZEN ENV CONTRACT (the DO's merge-job sandbox env plan):
+ *   ORIZU_BOOT_SECRET       per-sandbox durable bootstrap secret;
+ *   ORIZU_MERGE_JOB_ID      the job's DO addressing key
+ *                           (`merge:<manifestId>:<expectedHeadSha>` — the
+ *                           control-plane job uuid rides the token response);
+ *   ORIZU_COORDINATOR_URL   the coordinator Worker origin;
+ *   ORIZU_BASE_URL          the Orizu control-plane origin.
+ *
+ * REDACTION: every reported detail passes through `redactSecrets` with the
+ * boot secret, the job token, and the private key PEM on the exact-match list
+ * (plus the shape-pattern net). Nothing here ever logs a secret.
+ */
+import { mergeBranchWithDeployKey, } from './deploy-key-merge-core.js';
+import { redactSecrets } from './secret-redaction.js';
+// -- Frozen env contract --------------------------------------------------------
+export const REQUIRED_MERGE_JOB_ENV_VARS = [
+    'ORIZU_BOOT_SECRET',
+    'ORIZU_MERGE_JOB_ID',
+    'ORIZU_COORDINATOR_URL',
+    'ORIZU_BASE_URL',
+];
+export function resolveMergeJobEnv(env) {
+    const missing = [];
+    const req = (name) => {
+        const value = env[name]?.trim();
+        if (!value)
+            missing.push(name);
+        return value ?? '';
+    };
+    const bootSecret = req('ORIZU_BOOT_SECRET');
+    const jobKey = req('ORIZU_MERGE_JOB_ID');
+    const coordinatorUrl = req('ORIZU_COORDINATOR_URL');
+    const baseUrl = req('ORIZU_BASE_URL');
+    if (missing.length > 0)
+        return { ok: false, missing };
+    return {
+        ok: true,
+        value: {
+            bootSecret,
+            jobKey,
+            coordinatorUrl: coordinatorUrl.replace(/\/+$/, ''),
+            baseUrl: baseUrl.replace(/\/+$/, ''),
+        },
+    };
+}
+/** Map the shared core's outcome to the job's terminal status. */
+export function terminalFromMergeResult(result) {
+    if (result.superseded) {
+        return {
+            status: 'superseded',
+            result: null,
+            errorDetail: 'pre-push gate refused: manifest no longer appliable',
+        };
+    }
+    if (result.conflict) {
+        return {
+            status: 'conflict',
+            result: { merged: false, sha: null, alreadyMerged: false, conflict: true },
+            errorDetail: null,
+        };
+    }
+    return {
+        status: 'succeeded',
+        result: {
+            merged: result.merged,
+            sha: result.sha,
+            alreadyMerged: result.alreadyMerged,
+            conflict: false,
+        },
+        errorDetail: null,
+    };
+}
+export async function exchangeJobToken(opts) {
+    const attempts = Math.max(1, opts.attempts ?? 5);
+    const baseBackoff = opts.backoffMs ?? 500;
+    const sleep = opts.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const url = `${opts.coordinatorUrl}/merge-jobs/${encodeURIComponent(opts.jobKey)}/job-token`;
+    let lastDetail = 'no attempt made';
+    for (let attempt = 0; attempt < attempts; attempt++) {
+        try {
+            const res = await opts.fetchImpl(url, {
+                method: 'GET',
+                headers: { Authorization: `Bearer ${opts.bootSecret}` },
+            });
+            if (res.ok) {
+                const data = (await res.json().catch(() => null));
+                const token = data && typeof data.token === 'string' ? data.token : '';
+                const jobId = data && typeof data.jobId === 'string' ? data.jobId : '';
+                if (token && jobId) {
+                    return { token, jobId };
+                }
+                lastDetail = 'job-token response carried no token/jobId';
+            }
+            else {
+                lastDetail = `job-token exchange returned ${res.status}`;
+            }
+        }
+        catch (error) {
+            lastDetail = error instanceof Error ? error.message : String(error);
+        }
+        if (attempt < attempts - 1) {
+            const delay = baseBackoff * 2 ** attempt;
+            opts.log?.(`job-token exchange attempt ${attempt + 1}/${attempts} failed (${lastDetail}); retrying in ${delay}ms`);
+            await sleep(delay);
+        }
+    }
+    throw new Error(`job-token exchange failed after ${attempts} attempts: ${lastDetail}`);
+}
+export async function fetchMergeJobPayload(opts) {
+    const url = `${opts.baseUrl}/api/coordinator/merge-jobs/${encodeURIComponent(opts.jobId)}/payload`;
+    const res = await opts.fetchImpl(url, {
+        method: 'GET',
+        headers: { Authorization: `Bearer ${opts.token}` },
+    });
+    if (!res.ok) {
+        throw new Error(`payload pull returned ${res.status}`);
+    }
+    const data = (await res.json().catch(() => null));
+    const spec = data?.spec;
+    const privateKeyPem = typeof data?.privateKeyPem === 'string' ? data.privateKeyPem : '';
+    if (!spec || typeof spec !== 'object' || !privateKeyPem) {
+        throw new Error('payload response was missing spec/privateKeyPem');
+    }
+    if (spec.op !== 'merge') {
+        // D9 op discriminator: this entrypoint implements ONLY the merge op.
+        throw new Error(`unsupported job op: ${String(spec.op)}`);
+    }
+    for (const field of ['repoFullName', 'base', 'sourceBranch', 'expectedHeadSha', 'commitMessage']) {
+        if (typeof spec[field] !== 'string' || spec[field].length === 0) {
+            throw new Error(`payload spec is missing ${field}`);
+        }
+    }
+    return { spec: spec, privateKeyPem };
+}
+export async function checkPrePushGate(opts) {
+    const url = `${opts.baseUrl}/api/coordinator/merge-jobs/${encodeURIComponent(opts.jobId)}/gate`;
+    try {
+        const res = await opts.fetchImpl(url, {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${opts.token}` },
+        });
+        if (!res.ok) {
+            return 'unavailable';
+        }
+        const data = (await res.json().catch(() => null));
+        if (data && data.proceed === true)
+            return 'proceed';
+        if (data && data.proceed === false)
+            return 'superseded';
+        return 'unavailable';
+    }
+    catch {
+        return 'unavailable';
+    }
+}
+// -- Step d: report the terminal state to the DO (boot-secret auth) --------------
+export async function postMergeJobResult(opts) {
+    const attempts = Math.max(1, opts.attempts ?? 3);
+    const sleep = opts.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const url = `${opts.coordinatorUrl}/merge-jobs/${encodeURIComponent(opts.jobKey)}/result`;
+    for (let attempt = 0; attempt < attempts; attempt++) {
+        try {
+            const res = await opts.fetchImpl(url, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${opts.bootSecret}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    status: opts.report.status,
+                    ...(opts.report.result ? { result: opts.report.result } : {}),
+                    ...(opts.report.errorDetail ? { errorDetail: opts.report.errorDetail } : {}),
+                }),
+            });
+            if (res.ok) {
+                return true;
+            }
+            opts.log?.(`result report attempt ${attempt + 1}/${attempts} returned ${res.status}`);
+        }
+        catch (error) {
+            opts.log?.(`result report attempt ${attempt + 1}/${attempts} failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (attempt < attempts - 1) {
+            await sleep(500 * 2 ** attempt);
+        }
+    }
+    return false;
+}
+// -- Orchestration ----------------------------------------------------------------
+const MAX_DETAIL_LENGTH = 1500;
+export async function runMergeJob(opts) {
+    const env = opts.env;
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const log = opts.log ?? (() => { });
+    const secrets = [env.bootSecret];
+    const redact = (value) => redactSecrets(value, { secrets }).slice(0, MAX_DETAIL_LENGTH);
+    let report;
+    try {
+        // a. boot secret → single-use job token (+ the control-plane job id).
+        const exchanged = await exchangeJobToken({
+            coordinatorUrl: env.coordinatorUrl,
+            jobKey: env.jobKey,
+            bootSecret: env.bootSecret,
+            fetchImpl,
+            attempts: opts.tokenAttempts,
+            backoffMs: opts.tokenBackoffMs,
+            sleep: opts.sleep,
+            log,
+        });
+        secrets.push(exchanged.token);
+        log(`job token exchanged (job ${exchanged.jobId})`);
+        // b. pull spec + key directly from the control plane (single-use release).
+        const payload = await fetchMergeJobPayload({
+            baseUrl: env.baseUrl,
+            jobId: exchanged.jobId,
+            token: exchanged.token,
+            fetchImpl,
+        });
+        secrets.push(payload.privateKeyPem);
+        log(`payload pulled for ${payload.spec.repoFullName} (${payload.spec.sourceBranch} → ${payload.spec.base})`);
+        // c. the SHARED merge core with the D8 gate immediately pre-push.
+        // Object wrapper: TS cannot track closure writes to a let across the
+        // await below and would narrow the literal type at the read site.
+        const gate = { outcome: 'proceed' };
+        const result = await mergeBranchWithDeployKey(payload.spec.repoFullName, {
+            base: payload.spec.base,
+            sourceBranch: payload.spec.sourceBranch,
+            expectedHeadSha: payload.spec.expectedHeadSha,
+            commitMessage: payload.spec.commitMessage,
+            privateKeyPem: payload.privateKeyPem,
+        }, {
+            runGit: opts.runGit,
+            prePushGate: async () => {
+                gate.outcome = await checkPrePushGate({
+                    baseUrl: env.baseUrl,
+                    jobId: exchanged.jobId,
+                    token: exchanged.token,
+                    fetchImpl,
+                });
+                log(`pre-push gate: ${gate.outcome}`);
+                // FAIL CLOSED on the push for both 'superseded' and 'unavailable'.
+                return gate.outcome === 'proceed';
+            },
+        });
+        if (result.superseded && gate.outcome === 'unavailable') {
+            // The gate could not answer — "unknown" is not "rejected". No push
+            // happened (fail closed); report a retryable failure, not superseded.
+            report = {
+                status: 'failed',
+                result: null,
+                errorDetail: 'pre-push gate unreachable; aborted without pushing',
+            };
+        }
+        else {
+            report = terminalFromMergeResult(result);
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        report = { status: 'failed', result: null, errorDetail: redact(message) };
+    }
+    if (report.errorDetail) {
+        report = { ...report, errorDetail: redact(report.errorDetail) };
+    }
+    const reported = await postMergeJobResult({
+        coordinatorUrl: env.coordinatorUrl,
+        jobKey: env.jobKey,
+        bootSecret: env.bootSecret,
+        report,
+        fetchImpl,
+        sleep: opts.sleep,
+        log,
+    });
+    log(`terminal ${report.status} ${reported ? 'reported' : 'REPORT FAILED'}`);
+    return { reported, status: report.status, detail: report.errorDetail };
+}
+/**
+ * Read the frozen env contract and run the job. Exit 0 on ANY reported
+ * terminal outcome (the REPORT, not the merge, is the command's success —
+ * a conflict is a correctly-completed job); exit 1 when the env is invalid
+ * or the terminal report never reached the DO (the DO's job wall is the
+ * backstop then).
+ */
+export async function mergeJobCommand(io) {
+    const resolved = resolveMergeJobEnv(process.env);
+    if (!resolved.ok) {
+        io.printErr?.(`merge-job: missing required env: ${resolved.missing.join(', ')} ` +
+            '(the MergeJobCoordinator sandbox env contract)');
+        return 1;
+    }
+    const log = (line) => io.printErr?.(`[merge-job] ${line}`);
+    const outcome = await runMergeJob({ env: resolved.value, log });
+    io.print(io.json
+        ? JSON.stringify({ ok: outcome.reported, status: outcome.status, detail: outcome.detail })
+        : `merge-job finished: ${outcome.status}${outcome.detail ? ` (${outcome.detail})` : ''}${outcome.reported ? '' : ' [terminal report failed]'}`);
+    return outcome.reported ? 0 : 1;
+}

package/dist/vercel-sandbox-provider.js

@@ -54,10 +54,10 @@ export const VERCEL_IMAGE_NOT_READY_BACKOFF_MS = 5000;
 // constant-fold `import(specifier)` into a static dependency on the SDK — the
 // same discipline as the ALI-1031 server provider.
 const VERCEL_SDK_SPECIFIER = ['@vercel', 'sandbox'].join('/');
-async function loadVercelModule() {
+export async function loadVercelModule(importModule = specifier => import(specifier)) {
     try {
         const specifier = VERCEL_SDK_SPECIFIER;
-        const mod = (await import(specifier));
+        const mod = (await importModule(specifier));
         if (!mod || typeof mod.Sandbox?.create !== 'function') {
             throw new Error('module did not export a Sandbox class with create()');
         }

package/dist/workbench-cli.js

@@ -528,9 +528,82 @@ function formatSessionStart(result) {
     }
     return lines.join('\n');
 }
+// -- Cost/duration rendering (ALI-1089) ---------------------------------------
+function finiteOrNull(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+function formatUsd(value) {
+    return `$${value.toFixed(4)}`;
+}
+/** `tokens: in 2, out 181, cache-read 126968, ...` — only the reported fields. */
+function formatTokenBreakdown(costs) {
+    const parts = [];
+    const push = (label, value) => {
+        const parsed = finiteOrNull(value);
+        if (parsed !== null) {
+            parts.push(`${label} ${parsed}`);
+        }
+    };
+    push('in', costs.tokensInput);
+    push('out', costs.tokensOutput);
+    push('cache-read', costs.tokensCacheRead);
+    push('cache-write', costs.tokensCacheWrite);
+    push('reasoning', costs.tokensReasoning);
+    return parts.length > 0 ? `tokens: ${parts.join(', ')}` : null;
+}
+/** `cost $0.0697  tokens: ...` or null when nothing was reported. */
+function formatCostSummary(costs) {
+    const cost = finiteOrNull(costs.modelCostUsd);
+    const tokens = formatTokenBreakdown(costs);
+    if (cost === null && tokens === null) {
+        return null;
+    }
+    const parts = [];
+    if (cost !== null) {
+        parts.push(`cost ${formatUsd(cost)}`);
+    }
+    if (tokens) {
+        parts.push(tokens);
+    }
+    return parts.join('  ');
+}
+function formatDurationMs(ms) {
+    const totalSeconds = Math.max(0, Math.floor(ms / 1000));
+    const hours = Math.floor(totalSeconds / 3600);
+    const minutes = Math.floor((totalSeconds % 3600) / 60);
+    const seconds = totalSeconds % 60;
+    if (hours > 0)
+        return `${hours}h ${minutes}m ${seconds}s`;
+    if (minutes > 0)
+        return `${minutes}m ${seconds}s`;
+    return `${seconds}s`;
+}
+/**
+ * Session wall-clock from the existing startedAt/endedAt columns — no cost
+ * math, just duration (infra $ estimation is a later phase). Active sessions
+ * measure up to `now` and say so.
+ */
+function formatSessionDuration(session, now = Date.now()) {
+    const startedAt = typeof session.startedAt === 'string' ? Date.parse(session.startedAt) : Number.NaN;
+    if (!Number.isFinite(startedAt)) {
+        return null;
+    }
+    const endedAt = typeof session.endedAt === 'string' ? Date.parse(session.endedAt) : Number.NaN;
+    return Number.isFinite(endedAt)
+        ? `duration ${formatDurationMs(endedAt - startedAt)}`
+        : `duration ${formatDurationMs(now - startedAt)} (so far)`;
+}
 function formatSessionStatus(result) {
     if (result.session) {
         const lines = [`session ${result.session.id}  ${result.session.status}`];
+        const duration = formatSessionDuration(result.session);
+        if (duration) {
+            lines.push(`  ${duration}`);
+        }
+        const rollup = result.session.costs ? formatCostSummary(result.session.costs) : null;
+        if (rollup) {
+            lines.push(`  ${rollup}`);
+        }
         const sync = result.branchSync;
         if (sync) {
             lines.push(sync.ahead !== null && sync.behind !== null
@@ -538,7 +611,9 @@ function formatSessionStatus(result) {
                 : `  branch ${sync.branch}`);
         }
         for (const run of result.session.runs ?? []) {
-            lines.push(`  run ${run.id}  ${run.status}`);
+            const cost = finiteOrNull(run.modelCostUsd);
+            const suffix = cost !== null ? `  ${formatUsd(cost)}` : '';
+            lines.push(`  run ${run.id}  ${run.status}${suffix}`);
         }
         return lines.join('\n');
     }
@@ -575,7 +650,8 @@ function formatSessionFinishOutcome(result) {
 }
 function formatRunStatus(run) {
     const sequence = typeof run.latestSequence === 'number' ? `  latestSequence=${run.latestSequence}` : '';
-    return `run ${run.id}  ${run.status}${sequence}`;
+    const costLine = formatCostSummary(run);
+    return `run ${run.id}  ${run.status}${sequence}${costLine ? `\n  ${costLine}` : ''}`;
 }
 function formatEventLine(event) {
     const payload = event.payload && Object.keys(event.payload).length > 0 ? ` ${JSON.stringify(event.payload)}` : '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "private": false,
   "type": "module",
   "bin": {

package/src/credentials.ts

@@ -256,6 +256,46 @@ export function resolveEnvBearerToken(): string | null {
   return null
 }
 
+/**
+ * THE uniform bearer resolution for every CLI command (ALI-1090). Exactly the
+ * order `authedFetch` uses: `ORIZU_TOKEN` env → `ORIZU_TOKEN_FILE` (both via
+ * resolveEnvBearerToken, read FRESH per call — never cached, so hosted token
+ * rotations are picked up) → stored credentials.json. Commands that need a raw
+ * bearer (`orizu env`, the run-gepa wrapper) MUST use this instead of reading
+ * credentials.json directly, or they break in hosted sandboxes that are
+ * pre-authenticated via ORIZU_TOKEN_FILE and never ran `orizu login`.
+ */
+export function resolveAuthTokenForBaseUrl(baseUrl: string): string {
+  const envBearer = resolveEnvBearerToken()
+  if (envBearer) {
+    return envBearer
+  }
+
+  const credentials = getServerCredentials(baseUrl)
+  if (!credentials) {
+    throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`)
+  }
+
+  return 'accessToken' in credentials ? credentials.accessToken : credentials.apiKey
+}
+
+/**
+ * Non-throwing "is any auth available?" check (login --no-prompt-if-logged-in,
+ * setup status). Mirrors resolveAuthTokenForBaseUrl's order so an env bearer
+ * counts as signed in. A misconfigured ORIZU_TOKEN_FILE reports false here —
+ * actual requests still fail loudly via resolveEnvBearerToken.
+ */
+export function hasResolvableAuth(baseUrl: string): boolean {
+  try {
+    if (resolveEnvBearerToken()) {
+      return true
+    }
+  } catch {
+    // fall through to stored credentials
+  }
+  return getServerCredentials(baseUrl) !== null
+}
+
 export function setActiveBaseUrl(baseUrl: string | null) {
   const config = loadCredentialsConfigForWrite()
   config.activeBaseUrl = baseUrl