orizu 0.5.11 → 0.5.13

package/src/deploy-key-merge-core.ts

@@ -0,0 +1,359 @@
+/**
+ * Transport-agnostic deploy-key merge core (ALI-1084, merge-sandbox-job
+ * Phase 0). Extracted VERBATIM from `lib/git-ssh-merge.ts` so both the server
+ * (`lib/`) and the published CLI (`orizu internal merge-job`, Phase 2) run the
+ * EXACT SAME merge logic — no forked implementations, one place where the
+ * ADR-007 §4 `--no-ff` invariant is asserted on the exact argv.
+ *
+ * DELIBERATELY NO `import 'server-only'`: this module runs inside the one-shot
+ * merge sandbox (a plain Node process) as well as on the server. It must not
+ * import anything outside the CLI package root (bun-bundled) — node builtins
+ * only. `lib/git-ssh-merge.ts` re-exports everything here so every existing
+ * server import path and test keeps working unchanged.
+ *
+ * SECURITY PROPERTIES (unchanged from the lib original):
+ *   - throwaway temp worktree + isolated SSH identity (key file mode 0600);
+ *   - pinned GitHub host keys (StrictHostKeyChecking=yes, own known_hosts);
+ *   - expected-head verification: the merge targets the REVIEWED SHA, never a
+ *     branch name;
+ *   - `merge-base --is-ancestor` alreadyMerged idempotency check;
+ *   - argv-asserted commit-preserving `--no-ff` merge (ADR-007 §4).
+ */
+
+import { spawn } from 'node:child_process'
+import { chmod, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+export interface MergeBranchWithDeployKeyInput {
+  base: string
+  sourceBranch: string
+  expectedHeadSha: string
+  commitMessage: string
+  privateKeyPem: string
+}
+
+export interface GitCommandResult {
+  exitCode: number
+  stdout: string
+  stderr: string
+}
+
+export type GitCommandRunner = (
+  args: string[],
+  options: { cwd: string; env: NodeJS.ProcessEnv }
+) => Promise<GitCommandResult>
+
+export interface MergeBranchWithDeployKeyDeps {
+  runGit?: GitCommandRunner
+  /**
+   * D8 pre-push gate (merge-sandbox-job Phase 2): called IMMEDIATELY before
+   * `git push`, after the merge commit exists locally. Returning `false`
+   * aborts WITHOUT pushing (`superseded: true` in the result) — a manifest
+   * rejected while the job was in flight must never reach `main`. Absent
+   * (the local/server executor), the merge pushes unconditionally as before.
+   */
+  prePushGate?: () => Promise<boolean>
+}
+
+/**
+ * The merge outcome contract. Structurally identical to `MergeResult` in
+ * `lib/github-repo-ops.ts` (which cannot be imported from the CLI package —
+ * it is server-only); TypeScript's structural typing keeps the two
+ * assignable, and `lib/git-ssh-merge.ts` continues to expose the lib-side
+ * type to server callers.
+ */
+export interface DeployKeyMergeResult {
+  merged: boolean
+  sha: string | null
+  /** true when the base already contained head (GitHub 204 equivalent). */
+  alreadyMerged: boolean
+  /** true when git reported a merge conflict (409 equivalent). */
+  conflict: boolean
+  /** true when the D8 pre-push gate refused the push (manifest no longer
+   *  appliable) — the merge commit was built but NEVER pushed. */
+  superseded?: boolean
+  status: number
+}
+
+/**
+ * ADR-007 §4 merge-strategy invariant: the seal merge must stay a COMMIT-
+ * PRESERVING merge. `--no-ff` keeps the session-branch head as a parent of the
+ * merge commit, so every create-time `commit_sha` pinned by a draft version
+ * row stays reachable on the default branch forever. A squash or rebase would
+ * rewrite/discard those commits and orphan the pins — "what the label says is
+ * live" could then dangle. These flags must never appear in the seal merge.
+ */
+const FORBIDDEN_SEAL_MERGE_FLAGS = ['--squash', '--ff-only', '--ff', 'rebase'] as const
+const REQUIRED_SEAL_MERGE_FLAG = '--no-ff'
+
+/**
+ * Assert a git invocation is the commit-preserving seal merge ADR-007 §4
+ * requires. Called on the exact argv the merge runs with, so the invariant is
+ * enforced where the merge happens rather than by reviewer vigilance.
+ */
+export function assertCommitPreservingMergeArgs(args: readonly string[]): void {
+  if (!args.includes('merge')) {
+    throw new Error('seal merge invariant: expected a git merge invocation')
+  }
+  if (!args.includes(REQUIRED_SEAL_MERGE_FLAG)) {
+    throw new Error(
+      `seal merge invariant violated: ${REQUIRED_SEAL_MERGE_FLAG} is required (ADR-007 §4 — the merge must keep the session head as a parent)`
+    )
+  }
+  for (const flag of FORBIDDEN_SEAL_MERGE_FLAGS) {
+    if (args.includes(flag)) {
+      throw new Error(
+        `seal merge invariant violated: ${flag} would rewrite or drop session commits and orphan draft version pins (ADR-007 §4)`
+      )
+    }
+  }
+}
+
+const LOCAL_BASE_REF = 'refs/heads/__orizu_merge_base'
+const LOCAL_SOURCE_REF = 'refs/remotes/origin/__orizu_merge_source'
+// GitHub's published SSH host keys (PINNED — never ssh-keyscan'd at runtime):
+// https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
+// (canonically republished at https://api.github.com/meta `ssh_keys`).
+const GITHUB_HOST_KEYS = [
+  'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl',
+  'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=',
+  'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=',
+] as const
+
+// Both SSH endpoints GitHub serves git over: the standard port AND the
+// SSH-over-the-HTTPS-port endpoint (docs.github.com "Using SSH over the
+// HTTPS port") the merge sandbox uses — its egress firewall enforces at
+// SNI/CIDR level and raw SSH on :22 was reset in the first live run
+// (ALI-1084 live-fire, 2026-07-15). GitHub publishes ONE key set for both
+// hosts; OpenSSH matches a non-22 port with the `[host]:port` known_hosts
+// form, so the 443 endpoint needs its own lines. Pinning discipline is
+// unchanged: same keys, one more host alias.
+const GITHUB_KNOWN_HOSTS =
+  GITHUB_HOST_KEYS.flatMap(key => [`github.com ${key}`, `[ssh.github.com]:443 ${key}`]).join(
+    '\n'
+  ) + '\n'
+
+/**
+ * Strip git's repo-context env vars from a child git's environment. Git
+ * EXPORTS these into hook subprocesses (from a linked worktree, GIT_DIR is an
+ * ABSOLUTE path into the shared .git), so any descendant git command that
+ * inherits the parent env operates on THAT repo instead of its own cwd —
+ * `git config` writes land in the shared .git/config and `git init` flips it
+ * to core.bare=true (both observed when the pre-push hook ran the test suite
+ * from a worktree). Every real-git spawn must build its env through this.
+ */
+export function scrubGitRepoContextEnv(env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const scrubbed = { ...env }
+  delete scrubbed.GIT_DIR
+  delete scrubbed.GIT_WORK_TREE
+  delete scrubbed.GIT_INDEX_FILE
+  delete scrubbed.GIT_OBJECT_DIRECTORY
+  delete scrubbed.GIT_COMMON_DIR
+  delete scrubbed.GIT_NAMESPACE
+  return scrubbed
+}
+
+// Exported: the ADR-007 P3 read path (lib/artifact-git-read.ts) runs its
+// verified reads through the same spawn.
+export function defaultRunGit(
+  args: string[],
+  options: { cwd: string; env: NodeJS.ProcessEnv }
+): Promise<GitCommandResult> {
+  return new Promise((resolve, reject) => {
+    const child = spawn('git', args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    let stdout = ''
+    let stderr = ''
+    child.stdout.setEncoding('utf8')
+    child.stderr.setEncoding('utf8')
+    child.stdout.on('data', chunk => { stdout += chunk })
+    child.stderr.on('data', chunk => { stderr += chunk })
+    child.on('error', reject)
+    child.on('close', code => resolve({ exitCode: code ?? 1, stdout, stderr }))
+  })
+}
+
+export function sshRemote(repoFullName: string): string {
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repoFullName)) {
+    throw new Error(`Invalid repo full name: ${repoFullName}`)
+  }
+  return `git@github.com:${repoFullName}.git`
+}
+
+/**
+ * The SSH-over-the-HTTPS-port remote (GitHub-supported: `ssh.github.com:443`
+ * speaks the same SSH protocol, same auth, same host-key set). The MERGE core
+ * uses this endpoint because the merge sandbox's egress firewall enforces at
+ * the SNI/CIDR layer and reset raw SSH on :22 in the first live run
+ * (ALI-1084); :443 within GitHub's published git CIDRs is the compatible
+ * path. Equivalent from dev machines, so local/sandbox parity holds (D6).
+ * The push/read paths (D9/Phase 6) keep `sshRemote` untouched.
+ */
+export function sshRemoteOverHttpsPort(repoFullName: string): string {
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repoFullName)) {
+    throw new Error(`Invalid repo full name: ${repoFullName}`)
+  }
+  return `ssh://git@ssh.github.com:443/${repoFullName}.git`
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, "'\\''")}'`
+}
+
+/** Exported for `lib/git-ssh-merge.ts` (pushFilesWithDeployKey keeps living
+ *  there — D9 scopes the push path as a follow-on, not part of the core). */
+export function assertGitOk(result: GitCommandResult, operation: string): void {
+  if (result.exitCode === 0) return
+  const detail = (result.stderr || result.stdout).trim()
+  throw new Error(detail ? `${operation} failed: ${detail}` : `${operation} failed`)
+}
+
+function looksLikeMergeConflict(result: GitCommandResult): boolean {
+  const output = `${result.stdout}\n${result.stderr}`
+  return /CONFLICT|Automatic merge failed|Merge conflict/i.test(output)
+}
+
+export interface DeployKeyGitContext {
+  dir: string
+  git: (args: string[]) => Promise<GitCommandResult>
+  gitOk: (args: string[], operation: string) => Promise<GitCommandResult>
+}
+
+/**
+ * Run a callback inside a throwaway git worktree wired to the repo's merge
+ * deploy key (isolated SSH identity + pinned GitHub host keys). Exported for
+ * the ADR-007 read path (lib/artifact-git-read.ts), which reuses the same
+ * clone/pack infrastructure for bulk artifact reads.
+ */
+export async function withDeployKeyGit<T>(
+  privateKeyPem: string,
+  runGit: GitCommandRunner,
+  tempPrefix: string,
+  callback: (context: DeployKeyGitContext) => Promise<T>
+): Promise<T> {
+  const tempRoot = await mkdtemp(join(tmpdir(), tempPrefix))
+  const dir = join(tempRoot, 'worktree')
+  const sshDir = join(tempRoot, 'ssh')
+  await mkdir(dir)
+  await mkdir(sshDir)
+  const keyPath = join(sshDir, 'merge_deploy_key')
+  const knownHostsPath = join(sshDir, 'known_hosts')
+  const env = {
+    // Scrubbed: a leaked GIT_DIR (git exports it into hooks) must never
+    // redirect this temp-worktree clone/merge onto another repo.
+    ...scrubGitRepoContextEnv(process.env),
+    GIT_TERMINAL_PROMPT: '0',
+    GIT_SSH_COMMAND: [
+      'ssh',
+      '-i',
+      shellQuote(keyPath),
+      '-o',
+      'IdentitiesOnly=yes',
+      '-o',
+      'StrictHostKeyChecking=yes',
+      '-o',
+      shellQuote(`UserKnownHostsFile=${knownHostsPath}`),
+    ].join(' '),
+  }
+  const git = (args: string[]) => runGit(args, { cwd: dir, env })
+  const gitOk = async (args: string[], operation: string) => {
+    const result = await git(args)
+    assertGitOk(result, operation)
+    return result
+  }
+
+  try {
+    await writeFile(keyPath, privateKeyPem, { mode: 0o600 })
+    await chmod(keyPath, 0o600)
+    await writeFile(knownHostsPath, GITHUB_KNOWN_HOSTS, { mode: 0o600 })
+    return await callback({ dir, git, gitOk })
+  } finally {
+    await rm(tempRoot, { recursive: true, force: true })
+  }
+}
+
+/**
+ * Merge a reviewed session/revert branch head into the default branch using the
+ * server-only merge deploy key. The source branch is fetched only so GitHub can
+ * prove the reviewed SHA is still the branch tip; the merge itself targets the
+ * expected SHA, preserving the manifest CAS guarantee.
+ */
+export async function mergeBranchWithDeployKey(
+  repoFullName: string,
+  input: MergeBranchWithDeployKeyInput,
+  deps: MergeBranchWithDeployKeyDeps = {}
+): Promise<DeployKeyMergeResult> {
+  const runGit = deps.runGit ?? defaultRunGit
+  return withDeployKeyGit(input.privateKeyPem, runGit, 'orizu-merge-', async ({ git, gitOk }) => {
+    await gitOk(['init'], 'git init')
+    // SSH over the HTTPS port (ALI-1084 live-fire fix): the merge sandbox's
+    // egress firewall reset raw SSH on github.com:22; ssh.github.com:443 is
+    // the GitHub-supported equivalent (same protocol, same pinned host keys).
+    await gitOk(['remote', 'add', 'origin', sshRemoteOverHttpsPort(repoFullName)], 'git remote add')
+    await gitOk(
+      ['fetch', '--no-tags', 'origin', `refs/heads/${input.base}:${LOCAL_BASE_REF}`],
+      'git fetch default branch'
+    )
+    await gitOk(['checkout', '-B', '__orizu_merge_base', LOCAL_BASE_REF], 'git checkout default branch')
+    await gitOk(
+      ['fetch', '--no-tags', 'origin', `refs/heads/${input.sourceBranch}:${LOCAL_SOURCE_REF}`],
+      'git fetch reviewed source branch'
+    )
+
+    const sourceHead = (await gitOk(['rev-parse', LOCAL_SOURCE_REF], 'git rev-parse source')).stdout.trim()
+    if (sourceHead !== input.expectedHeadSha) {
+      throw new Error('branch moved since manifest creation; re-finish the session')
+    }
+
+    const ancestor = await git(['merge-base', '--is-ancestor', input.expectedHeadSha, 'HEAD'])
+    if (ancestor.exitCode === 0) {
+      const head = (await gitOk(['rev-parse', 'HEAD'], 'git rev-parse default')).stdout.trim()
+      return { merged: false, sha: head, alreadyMerged: true, conflict: false, status: 204 }
+    }
+    if (ancestor.exitCode !== 1) {
+      assertGitOk(ancestor, 'git merge-base')
+    }
+
+    // ADR-007 §4: the seal is a commit-preserving --no-ff merge — never squash,
+    // never rebase — so every draft version's create-time commit_sha stays
+    // reachable once the branch reaches the default branch.
+    const mergeArgs = [
+      '-c',
+      'user.name=Orizu',
+      '-c',
+      'user.email=bot@orizu.ai',
+      'merge',
+      '--no-ff',
+      '-m',
+      input.commitMessage,
+      input.expectedHeadSha,
+    ]
+    assertCommitPreservingMergeArgs(mergeArgs)
+    const merge = await git(mergeArgs)
+    if (merge.exitCode !== 0) {
+      if (looksLikeMergeConflict(merge)) {
+        return { merged: false, sha: null, alreadyMerged: false, conflict: true, status: 409 }
+      }
+      assertGitOk(merge, 'git merge')
+    }
+
+    const mergeSha = (await gitOk(['rev-parse', 'HEAD'], 'git rev-parse merge')).stdout.trim()
+
+    // D8 pre-push gate: the LAST check before anything reaches the default
+    // branch. A refused gate aborts with superseded — no push, no side effect
+    // (the temp worktree dies with this callback).
+    if (deps.prePushGate) {
+      const proceed = await deps.prePushGate()
+      if (!proceed) {
+        return { merged: false, sha: null, alreadyMerged: false, conflict: false, superseded: true, status: 409 }
+      }
+    }
+
+    await gitOk(['push', 'origin', `HEAD:refs/heads/${input.base}`], 'git push default branch')
+    return { merged: true, sha: mergeSha, alreadyMerged: false, conflict: false, status: 201 }
+  })
+}

package/src/hosted-boot.ts

@@ -164,7 +164,10 @@ export function redactBootReason(reason: string, bootSecret: string): string {
 export async function postBootStatus(opts: {
   bootStatusUrl: string
   bootSecret: string
-  status: 'ready' | 'failed'
+  /** 'ready' | 'failed' are the ALI-1060 liveness signals; 'complete' is the
+   *  ALI-1064 terminal signal — the loop finished (after auto-harvest), so the
+   *  DO ends the workspace session and stops instead of extending to 24h. */
+  status: 'ready' | 'failed' | 'complete'
   runId: string | null
   reason?: string | null
   fetchImpl: BootFetch
@@ -748,6 +751,25 @@ export async function runHostedBoot(opts: RunHostedBootOptions): Promise<HostedB
       bearerProvider: () => readFile(bearerFileAbs).trim(),
     })
     log(`hosted-loop finished: ${result.status}`)
+    // ALI-1064: the loop is TERMINAL — the auto-harvest (ALI-1036) and the
+    // run's terminal seal already ran INSIDE runHostedLoop, so it is safe to
+    // hand the session back. Report `complete` so the DO ends the workspace
+    // session server-side and stops/destroys the sandbox NOW instead of
+    // extending it until the 24h cap (live 2026-07-15: zombie boxes burned
+    // 2×CPU/4GiB for hours after their loops finished). This fires for a
+    // failed loop too — the run is terminal either way, and the loop already
+    // owns its own run-level terminal state (never a `failed` boot-status
+    // here; that would misreport a run failure as a bootstrap failure).
+    // Best-effort: the DO's duration/24h caps are the backstop.
+    await postBootStatus({
+      bootStatusUrl: env.bootStatusUrl,
+      bootSecret: env.bootSecret,
+      status: 'complete',
+      runId,
+      reason: result.error ? redactBootReason(result.error, env.bootSecret) : null,
+      fetchImpl,
+      log,
+    })
     return { ok: !result.error, runId, loopStatus: result.status, error: result.error }
   } finally {
     rotation.stop()

package/src/hosted-session-cli.ts

@@ -54,6 +54,7 @@ import { createVercelProvider } from './vercel-sandbox-provider.js'
 import { buildEgressPolicy, DEFAULT_EGRESS_CANARY_HOST } from './egress-policy.js'
 import { hostedLoopCommand, type HostedLoopContext } from './hosted-loop.js'
 import { hostedBootCommand } from './hosted-boot.js'
+import { mergeJobCommand } from './merge-job.js'
 import { authedFetch } from './http.js'
 import { resolveBaseUrl } from './http.js'
 import { getWorkspaceRoot } from './workspace.js'
@@ -926,7 +927,11 @@ export async function hostedCommand(
     if (positional[1] === 'hosted-boot') {
       return hostedBootCommand(io)
     }
-    io.printErr?.('Usage: orizu internal <hosted-loop --context <path> | hosted-boot>')
+    // ALI-1084: the one-shot merge sandbox entrypoint (MergeJobCoordinator DO).
+    if (positional[1] === 'merge-job') {
+      return mergeJobCommand(io)
+    }
+    io.printErr?.('Usage: orizu internal <hosted-loop --context <path> | hosted-boot | merge-job>')
     return 1
   }
 

package/src/index.ts

@@ -19,7 +19,13 @@ import { homedir, tmpdir } from 'os'
 import { createInterface } from 'readline/promises'
 import { emitKeypressEvents } from 'readline'
 import { stdin as input, stdout as output } from 'process'
-import { clearServerCredentials, getServerCredentials, saveServerCredentials } from './credentials.js'
+import {
+  clearServerCredentials,
+  getServerCredentials,
+  hasResolvableAuth,
+  resolveAuthTokenForBaseUrl,
+  saveServerCredentials,
+} from './credentials.js'
 import { parseDatasetFile } from './file-parser.js'
 import { streamJsonlRowChunks } from './jsonl-stream.js'
 import { parseDatasetReference } from './dataset-download.js'
@@ -507,15 +513,6 @@ function shellQuote(value: string): string {
   return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
 }
 
-function getStoredAuthTokenForBaseUrl(baseUrl: string): string {
-  const credentials = getServerCredentials(baseUrl)
-  if (!credentials) {
-    throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`)
-  }
-
-  return 'accessToken' in credentials ? credentials.accessToken : credentials.apiKey
-}
-
 function printPromptSummaries(items: PromptSummary[], emptyMessage: string) {
   if (items.length === 0) {
     printLine(emptyMessage)
@@ -1180,7 +1177,10 @@ async function login() {
   const baseUrl = hasArg('--no-prompt-if-logged-in') ? getBaseUrl() : resolveLoginBaseUrl()
   assertSecureTokenTransport(baseUrl)
 
-  if (hasArg('--no-prompt-if-logged-in') && getServerCredentials(baseUrl)) {
+  // hasResolvableAuth (ALI-1090): an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE)
+  // counts as logged in — a pre-authenticated hosted sandbox must not fall into
+  // the interactive browser flow.
+  if (hasArg('--no-prompt-if-logged-in') && hasResolvableAuth(baseUrl)) {
     if (hasJsonFlag()) {
       printJson({ status: 'already-logged-in', server: baseUrl })
       return
@@ -1351,7 +1351,10 @@ async function logout() {
 
 async function printEnv() {
   const baseUrl = getBaseUrl()
-  const token = getStoredAuthTokenForBaseUrl(baseUrl)
+  // Uniform resolution (ALI-1090): env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE)
+  // wins over credentials.json, so `orizu env` works in hosted sandboxes that
+  // never ran `orizu login`.
+  const token = resolveAuthTokenForBaseUrl(baseUrl)
   const projectArg = getArg('--project')
   const project = projectArg ? await resolveProjectSelection(projectArg) : null
   const projectId = project?.id || getArg('--project-id') || process.env.ORIZU_PROJECT_ID || ''
@@ -2643,7 +2646,10 @@ function bundledOrizuGepaPythonPath(): string | null {
 async function runGepaOptimization() {
   const project = getArg('--project') || await resolveProjectSlug(null)
   const baseUrl = getBaseUrl()
-  const token = getStoredAuthTokenForBaseUrl(baseUrl)
+  // Uniform resolution (ALI-1090): honors ORIZU_TOKEN / ORIZU_TOKEN_FILE before
+  // credentials.json so hosted sandboxes can run optimizations. Read at spawn
+  // time — the child gets the freshest bearer available at launch.
+  const token = resolveAuthTokenForBaseUrl(baseUrl)
   const python = getArg('--python') || process.env.PYTHON || 'python3'
   const bundledPythonPath = bundledOrizuGepaPythonPath()
   let forwardedArgs = removeFlagWithValue(cliArgs.slice(2), '--python')
@@ -3552,7 +3558,8 @@ function findExecutable(name: string): string | null {
 function describeSetupAuthState(): { state: 'signed-in' | 'signed-out', baseUrl: string } {
   const baseUrl = getBaseUrl()
   return {
-    state: getServerCredentials(baseUrl) ? 'signed-in' : 'signed-out',
+    // ALI-1090: an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE) is signed-in too.
+    state: hasResolvableAuth(baseUrl) ? 'signed-in' : 'signed-out',
     baseUrl,
   }
 }

package/src/manifests-cli.ts

@@ -3,6 +3,11 @@
  * Pure command logic with an injected fetcher and project resolver; the entry
  * point owns argument parsing and human/JSON output. apply is idempotent on the
  * server — re-applying returns the stored outcome.
+ *
+ * Every id-taking subcommand accepts a short-id PREFIX (ALI-1038/ALI-1092): a
+ * leading hex slice of the manifest UUID is resolved CLI-side against the
+ * project's manifest list — unique match wins, none/ambiguous is a clear error,
+ * never a server 500.
  */
 
 import { authedFetch } from './http.js'
@@ -14,10 +19,28 @@ export interface ManifestsCommandIo {
   print: (line: string) => void
   fetcher?: CliFetcher
   resolveProjectSlug?: (arg: string | null) => Promise<string>
+  /** Injectable sleeper for the apply auto-retry loop (tests). */
+  sleep?: (ms: number) => Promise<void>
 }
 
 const MANIFEST_ACTIONS = new Set(['approve', 'reject', 'apply', 'revert'])
 
+// -- Apply auto-retry (ALI-1084 D5) -------------------------------------------
+// A repo_merge apply now runs a one-shot merge sandbox server-side; past the
+// route's bounded wait it answers a RETRYABLE 409 "merge job in progress;
+// re-run apply" — the re-apply ATTACHES to the running job (never restarts
+// it), so retrying is free and idempotent. The CLI absorbs that contract with
+// a bounded auto-retry loop (~2 min total) and clear progress output.
+
+const APPLY_RETRY_BUDGET_MS = 120_000
+const APPLY_RETRY_INTERVAL_MS = 5_000
+const MERGE_IN_PROGRESS_MARKER = 'merge job in progress'
+
+async function isMergeJobInProgress(response: Response): Promise<boolean> {
+  if (response.status !== 409) return false
+  return (await responseMessage(response)).toLowerCase().includes(MERGE_IN_PROGRESS_MARKER)
+}
+
 async function responseMessage(response: Response): Promise<string> {
   try {
     const data = (await response.clone().json()) as Record<string, unknown>
@@ -74,6 +97,50 @@ async function requireProjectSlug(io: ManifestsCommandIo, args: string[]): Promi
   return io.resolveProjectSlug(argValue(args, '--project'))
 }
 
+// -- short-id prefix resolution (ALI-1092; `show` parity with approve/reject) --
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+// A candidate short id: a leading hex slice of a UUID (dashes allowed), shorter
+// than the full 36 chars. Anything else (full UUIDs, non-hex ids in tests/fixtures)
+// is passed to the server untouched.
+const UUID_PREFIX_RE = /^[0-9a-f][0-9a-f-]{0,34}$/i
+
+/**
+ * Resolve a manifest id argument shared by show/approve/reject/apply/revert.
+ * Full UUIDs (and non-prefix-shaped ids) pass through. A short-id prefix is
+ * matched against the project's manifest list: exactly one hit resolves; zero
+ * or multiple hits throw a clean, actionable error instead of letting a
+ * non-UUID id reach the server and 500.
+ */
+async function resolveManifestId(io: ManifestsCommandIo, args: string[], id: string): Promise<string> {
+  if (UUID_RE.test(id) || !UUID_PREFIX_RE.test(id)) {
+    return id
+  }
+
+  const projectSlug = await requireProjectSlug(io, args)
+  const response = await fetcherFrom(io)(
+    `/api/cli/promotion-manifests?project=${encodeURIComponent(projectSlug)}`
+  )
+  const data = await requireOk(response, 'Manifest lookup')
+  const manifests = Array.isArray(data.manifests) ? (data.manifests as Record<string, unknown>[]) : []
+  const needle = id.toLowerCase()
+  const matches = manifests
+    .map(manifest => (typeof manifest.id === 'string' ? manifest.id : ''))
+    .filter(candidate => candidate.toLowerCase().startsWith(needle))
+
+  if (matches.length === 1) {
+    return matches[0]
+  }
+  if (matches.length === 0) {
+    throw new Error(
+      `No manifest matching '${id}' found in ${projectSlug}. Run \`orizu manifests list\` to see ids.`
+    )
+  }
+  throw new Error(
+    `Manifest id '${id}' is ambiguous — it matches ${matches.length} manifests (${matches.join(', ')}). Use a longer prefix.`
+  )
+}
+
 function emit(io: ManifestsCommandIo, payload: Record<string, unknown>, human: string) {
   io.print(io.json ? JSON.stringify(payload) : human)
 }
@@ -222,10 +289,11 @@ export async function manifestsCommand(args: string[], io: ManifestsCommandIo):
   }
 
   if (subcommand === 'show') {
-    const id = positional[1]
-    if (!id) {
+    const idArg = positional[1]
+    if (!idArg) {
       throw new Error('Usage: orizu manifests show <id> [--json]')
     }
+    const id = await resolveManifestId(io, args, idArg)
     const response = await fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`)
     const data = await requireOk(response, 'Manifest show')
     const manifest = (data.manifest ?? {}) as Record<string, unknown>
@@ -237,15 +305,40 @@ export async function manifestsCommand(args: string[], io: ManifestsCommandIo):
   }
 
   if (subcommand && MANIFEST_ACTIONS.has(subcommand)) {
-    const id = positional[1]
-    if (!id) {
+    const idArg = positional[1]
+    if (!idArg) {
       throw new Error(`Usage: orizu manifests ${subcommand} <id> [--json]`)
     }
-    const response = await fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ action: subcommand }),
-    })
+    const id = await resolveManifestId(io, args, idArg)
+    const postAction = () =>
+      fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ action: subcommand }),
+      })
+    let response = await postAction()
+    if (subcommand === 'apply') {
+      // Bounded auto-retry for the in-flight merge job (ALI-1084 D5): apply
+      // is idempotent and a re-apply attaches to the SAME job, so retrying
+      // the documented "merge job in progress" 409 is always safe.
+      const sleep =
+        io.sleep ?? ((ms: number): Promise<void> => new Promise(resolve => setTimeout(resolve, ms)))
+      const startedAt = Date.now()
+      let attempt = 1
+      while (
+        (await isMergeJobInProgress(response)) &&
+        Date.now() - startedAt + APPLY_RETRY_INTERVAL_MS <= APPLY_RETRY_BUDGET_MS
+      ) {
+        if (!io.json) {
+          io.print(
+            `merge job in progress (attempt ${attempt}); retrying apply in ${APPLY_RETRY_INTERVAL_MS / 1000}s…`
+          )
+        }
+        await sleep(APPLY_RETRY_INTERVAL_MS)
+        attempt += 1
+        response = await postAction()
+      }
+    }
     const data = await requireOk(response, `Manifest ${subcommand}`)
     const manifest = (data.manifest ?? {}) as Record<string, unknown>
     const lines = [manifestLine(manifest)]