orizu 0.5.14 → 0.5.16

package/dist/artifact-archive.js

@@ -11,7 +11,9 @@ const ARTIFACT_EXCLUDED_PATH_NAMES = new Set([
 function isNodeError(error) {
     return error instanceof Error;
 }
-function expandHomePath(path) {
+/** Exported for runner-dir-verify (ALI-1159): the pre-exec scan must resolve
+ * the same directory this module hashes and the runner later executes. */
+export function expandHomePath(path) {
     if (path.startsWith('~/')) {
         const home = process.env.HOME || '';
         return `${home}/${path.slice(2)}`;
@@ -123,7 +125,13 @@ export function createStoredZip(entries) {
     endOfCentralDirectory.writeUInt16LE(0, 20);
     return Buffer.concat([...localParts, centralDirectory, endOfCentralDirectory]);
 }
-export function zipDirectoryToBase64(dirArg) {
+/**
+ * Read the exact entry set the deterministic archive covers (sorted relative
+ * paths + bytes). Exported for runner-dir-verify (ALI-1159): the verified
+ * snapshot must be materialized from the SAME in-memory bytes that were
+ * hashed, so a post-hash mutation of the directory cannot change what runs.
+ */
+export function readArtifactEntries(dirArg) {
     const sourceDir = expandHomePath(dirArg);
     try {
         const stats = statSync(sourceDir);
@@ -141,12 +149,20 @@ export function zipDirectoryToBase64(dirArg) {
     if (files.length === 0) {
         throw new Error(`Directory contains no artifact files: ${sourceDir}`);
     }
-    const bytes = createStoredZip(files.map(relativePath => ({
+    return files.map(relativePath => ({
         path: relativePath,
         data: readFileSync(join(sourceDir, relativePath)),
-    })));
+        mode: statSync(join(sourceDir, relativePath)).mode,
+    }));
+}
+/** Deterministic archive of an already-read entry set. */
+export function archiveArtifactEntries(entries) {
+    const bytes = createStoredZip(entries);
     return {
         zipBase64: bytes.toString('base64'),
         contentSha256: createHash('sha256').update(bytes).digest('hex'),
     };
 }
+export function zipDirectoryToBase64(dirArg) {
+    return archiveArtifactEntries(readArtifactEntries(dirArg));
+}

package/dist/egress-allowlist-cli.js

@@ -13,6 +13,12 @@
  * with an injected fetcher.
  */
 import { authedFetch } from './http.js';
+/** Mirrors MAX_TEAM_EGRESS_DOMAINS in the shared read-side validator
+ *  (workers/session-coordinator/src/egress-domains.ts). The coordinator only
+ *  applies the first this-many UNIQUE valid domains at policy compose; the
+ *  CLI is a standalone package and cannot import the worker module, so the
+ *  cap constant is duplicated here (kept in sync via that file's tests). */
+const MAX_ADDITIVE_EGRESS_DOMAINS = 100;
 function fetcherFrom(io) {
     return io.fetcher ?? authedFetch;
 }
@@ -55,22 +61,72 @@ function splitDomains(value) {
         .map(d => d.trim())
         .filter(d => d.length > 0);
 }
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((d) => typeof d === 'string') : [];
+}
+/**
+ * Re-derive the "beyond the 100-domain cap" entries from a stored set the
+ * SAME way the GET route does (positional over UNIQUE VALID domains): the
+ * coordinator applies only the first MAX_ADDITIVE_EGRESS_DOMAINS valid
+ * domains, so every valid entry past that index is configured-but-inert.
+ * Stored entries are already canonical + deduped by the write RPC, and the
+ * invalid (grandfathered) ones — flagged by the server — are not "valid"
+ * and so never consume a cap slot. Used for the PUT response, where a
+ * shrink-by-one on an oversized legacy row leaves the returned set still
+ * over-cap and the server does not send cappedDomains back.
+ */
+function deriveCapped(stored, invalid) {
+    const invalidSet = new Set(invalid);
+    const capped = [];
+    let validCount = 0;
+    for (const d of stored) {
+        if (invalidSet.has(d))
+            continue;
+        validCount += 1;
+        if (validCount > MAX_ADDITIVE_EGRESS_DOMAINS)
+            capped.push(d);
+    }
+    return capped;
+}
 async function fetchCurrent(fetcher, path) {
     const response = await fetcher(path, { method: 'GET' });
     if (!response.ok) {
         throw new Error(`show failed (${response.status}): ${await responseMessage(response)}`);
     }
     const data = (await response.json());
-    return Array.isArray(data.extraDomains) ? data.extraDomains.filter((d) => typeof d === 'string') : [];
+    return {
+        domains: stringArray(data.extraDomains),
+        invalid: stringArray(data.invalidDomains),
+        capped: stringArray(data.cappedDomains),
+    };
 }
-function emit(io, teamSlug, domains) {
+function emit(io, teamSlug, current) {
     if (io.json) {
-        io.print(JSON.stringify({ teamSlug, extraDomains: domains }));
+        io.print(JSON.stringify({
+            teamSlug,
+            extraDomains: current.domains,
+            invalidDomains: current.invalid,
+            cappedDomains: current.capped,
+        }));
         return;
     }
-    io.print(domains.length === 0
+    const invalid = new Set(current.invalid);
+    const capped = new Set(current.capped);
+    const lines = current.domains.map((d) => {
+        // Round 4 (P3): re-adding a non-grandfathered invalid entry is
+        // guaranteed to fail the write RPC's tightened validator (grandfathering
+        // is retention-only — see set_team_egress_allowlist), so "remove and
+        // re-add" was actively misleading. The only viable remediation is
+        // removal.
+        if (invalid.has(d))
+            return `${d} (invalid — will not take effect; remove it (this value is no longer valid and cannot be re-added))`;
+        if (capped.has(d))
+            return `${d} (beyond the 100-domain cap — will not take effect)`;
+        return d;
+    });
+    io.print(lines.length === 0
         ? `${teamSlug}: no additive egress domains (base allowlist only)`
-        : `${teamSlug} additive egress domains:\n  ${domains.join('\n  ')}`);
+        : `${teamSlug} additive egress domains:\n  ${lines.join('\n  ')}`);
 }
 export async function egressAllowlistCommand(args, io) {
     const teamSlug = firstPositional(args);
@@ -100,7 +156,7 @@ export async function egressAllowlistCommand(args, io) {
         }
         else {
             const current = await fetchCurrent(fetcher, path);
-            const set = new Set(current);
+            const set = new Set(current.domains);
             if (addValue)
                 for (const d of splitDomains(addValue))
                     set.add(d);
@@ -119,10 +175,16 @@ export async function egressAllowlistCommand(args, io) {
             return 1;
         }
         const data = (await response.json());
-        const stored = Array.isArray(data.extraDomains)
-            ? data.extraDomains.filter((d) => typeof d === 'string')
-            : next;
-        emit(io, teamSlug, stored);
+        const stored = Array.isArray(data.extraDomains) ? stringArray(data.extraDomains) : next;
+        const invalid = stringArray(data.invalidDomains);
+        // Grandfathered retention: a successful PUT may still STORE legacy
+        // invalid entries the admin retained — the server flags them and we show
+        // it. Round 5 (P2): a >100-entry legacy row can only shrink one entry per
+        // PUT (the write RPC's GREATEST(100, stored-1) bound), so the returned
+        // set can still be OVER the cap. Re-derive the cap annotations from the
+        // returned set — same positional logic GET uses — instead of assuming
+        // the RPC left it at/under 100.
+        emit(io, teamSlug, { domains: stored, invalid, capped: deriveCapped(stored, invalid) });
         return 0;
     }
     catch (error) {

package/dist/github-setup.js

@@ -17,7 +17,7 @@ import { spawnSync } from 'child_process';
 import { existsSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { authedFetch } from './http.js';
-import { assertWorkspaceDirUsable } from './workspace.js';
+import { assertWorkspaceDirUsable, workspaceExists } from './workspace.js';
 /**
  * Strip terminal control characters from server-supplied strings before they
  * are printed (mirrors index.ts `sanitizeTerminalText`), so a hostile or
@@ -28,7 +28,36 @@ function sanitizeServerText(value) {
     return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
 }
 const DEFAULT_POLL_INTERVAL_MS = 2000;
-const DEFAULT_POLL_TIMEOUT_MS = 180000;
+// ALI-1141: long enough for a slow org-picker + repo-selection walk, but the
+// wait MUST be finite — when the App is already installed in the target org,
+// GitHub only offers "Configure" and never redirects to our setup callback, so
+// an unbounded poll would spin forever. (Still under the server's 15-minute
+// nonce TTL, so the poll times out before the server would report `expired`.)
+const DEFAULT_POLL_TIMEOUT_MS = 600000;
+// ALI-1141: after this long with no callback, the likeliest cause is the
+// already-installed org above — surface it instead of heartbeating silently.
+const ALREADY_INSTALLED_HINT_MS = 90000;
+/**
+ * Why the poll can never succeed when the App is already installed in the org
+ * (ALI-1141): GitHub's `installations/new?state=` page then only offers
+ * "Configure", and completing configuration does NOT redirect to the App's
+ * Setup URL with our state nonce — the callback that flips the row out of
+ * `pending` never fires. Printed as a mid-poll hint and folded into the
+ * timeout error so the user is never left with an unexplained hang.
+ */
+function alreadyInstalledHintLines(teamSlug) {
+    return [
+        '   ⚠ GitHub has not called back yet. The most likely cause: the Orizu GitHub',
+        '     App is ALREADY INSTALLED in that org — GitHub then only offers',
+        '     "Configure", and finishing configuration never notifies Orizu, so this',
+        '     wait cannot succeed. Remedies:',
+        '     • Install the App into a DIFFERENT GitHub org for this team (each org',
+        '       installation can be linked to exactly one Orizu team).',
+        '     • If the org is not linked to any Orizu team, uninstall the Orizu App',
+        '       from the org (GitHub → org Settings → GitHub Apps) and re-run',
+        `       \`orizu github link --team ${teamSlug}\` to do a fresh install.`,
+    ];
+}
 function defaultSleep(ms) {
     return new Promise(resolve => setTimeout(resolve, ms));
 }
@@ -83,10 +112,12 @@ export async function runGithubLink(teamSlug, io) {
     const sleep = io.sleep ?? defaultSleep;
     const interval = io.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     const timeout = io.pollTimeoutMs ?? DEFAULT_POLL_TIMEOUT_MS;
-    const deadline = now() + timeout;
+    const started = now();
+    const deadline = started + timeout;
     // Periodic heartbeat so a long install does not look hung; never echoes state.
     const HEARTBEAT_MS = 15000;
-    let lastHeartbeat = now();
+    let lastHeartbeat = started;
+    let printedAlreadyInstalledHint = false;
     for (;;) {
         const poll = await fetcher(`/api/cli/github/link?state=${encodeURIComponent(state)}`);
         if (poll.ok) {
@@ -107,9 +138,20 @@ export async function runGithubLink(teamSlug, io) {
             // status 'pending' → keep waiting.
         }
         if (now() >= deadline) {
-            throw new Error('Timed out waiting for the GitHub App install to complete. ' +
+            // Same actionable message as the mid-poll hint: an already-installed org
+            // is the one known way to reach this timeout with nothing else wrong.
+            throw new Error(`Timed out waiting for the GitHub App install to complete after ${Math.round(timeout / 60000)} minutes. ` +
+                'If the Orizu GitHub App is already installed in that org, GitHub never notifies Orizu when you finish the "Configure" flow — ' +
+                'install the App into a DIFFERENT GitHub org for this team (or uninstall it from the org first if no other Orizu team uses it). ' +
                 `Resume with \`orizu github link --team ${teamSlug}\` after finishing the install.`);
         }
+        if (!printedAlreadyInstalledHint && now() - started >= ALREADY_INSTALLED_HINT_MS) {
+            for (const line of alreadyInstalledHintLines(teamSlug))
+                io.print(line);
+            io.print(`   Still waiting (Ctrl+C to abort; resume later with \`orizu github link --team ${teamSlug}\`)…`);
+            printedAlreadyInstalledHint = true;
+            lastHeartbeat = now();
+        }
         if (now() - lastHeartbeat >= HEARTBEAT_MS) {
             io.print('   …still waiting for the GitHub install to complete.');
             lastHeartbeat = now();
@@ -216,7 +258,7 @@ export async function runHostedAttach(options, io) {
     io.print(`   Cloning ${repoFullName}...`);
     // Clone with the helper inline + the workspace id in the env so the token is
     // brokered on demand and never materializes in the URL or on disk.
-    gitOrThrow(io.git, [
+    const clone = io.git([
         '-c',
         `credential.helper=${CREDENTIAL_HELPER}`,
         '-c',
@@ -225,6 +267,18 @@ export async function runHostedAttach(options, io) {
         cleanUrl,
         options.targetDir,
     ], { env: { ORIZU_WORKSPACE_ID: options.workspaceId } });
+    if (clone.status !== 0) {
+        const detail = clone.stderr || `exit ${clone.status}`;
+        // A local-only workspace (`orizu setup --local`) has orizu.team.json but no
+        // `.git`, so it passes `assertWorkspaceDirUsable` yet fails the clone —
+        // `git clone` refuses the non-empty dir up front and writes nothing, so
+        // every byte in there is the user's workspace, not an incomplete clone.
+        // Never advise deleting it.
+        if (workspaceExists(options.targetDir)) {
+            throw new Error(`git clone failed: ${detail} ${options.targetDir} already holds a local Orizu workspace (orizu.team.json) without a hosted clone, so the workbench repo can't be cloned into it. Don't delete it — move it aside or re-run \`orizu setup\` with \`--workspace <empty-path>\` (or keep it local with \`--local\`).`);
+        }
+        throw new Error(`git clone failed: ${detail} Remove or empty the incomplete clone directory ${options.targetDir}, then re-run \`orizu setup\`.`);
+    }
     // Persist the helper repo-locally for future pull/push (cwd-resolved).
     gitOrThrow(io.git, ['config', 'credential.helper', CREDENTIAL_HELPER], { cwd: options.targetDir });
     gitOrThrow(io.git, ['config', 'credential.useHttpPath', 'true'], { cwd: options.targetDir });

package/dist/help.js

@@ -394,6 +394,12 @@ export const COMMAND_DOCS = [
         summary: 'Submit score results for a scorer against a prompt version or optimization candidate.',
         group: 'Scorers and runners',
     },
+    {
+        path: ['scores', 'accept'],
+        usage: 'orizu scores accept <score-run-id> [--project <team/project>] [--json]',
+        summary: 'Record a human curator acceptance of an agent-reported score as trusted evidence (human-only).',
+        group: 'Scorers and runners',
+    },
     {
         path: ['runners', 'push'],
         usage: 'orizu runners push <dir> [--project <team/project>] [--name <name>] [--label <label>] [--json]',
@@ -415,7 +421,7 @@ export const COMMAND_DOCS = [
     {
         path: ['runners', 'exec'],
         usage: 'orizu runners exec (--prompt <prompt-version-id> | --prompt-version <id> --runner-version <id> | --scorer-version <id>) --dataset-version <id> --split-set <id-or-name> --split <name> [--runner-dir <dir>] --out <results.jsonl|results.jsonl.gz>',
-        summary: 'Execute a runner locally against a dataset split and write row results.',
+        summary: 'Execute a runner locally against a dataset split and write row results. --runner-dir bytes must match the registered runner version (ADR-007) — register with `orizu runners push` first.',
         group: 'Scorers and runners',
     },
     {
@@ -450,8 +456,8 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['optimizations', 'run-gepa'],
-        usage: 'orizu optimizations run-gepa --project <team/project> --optimizer-version-id <id> --candidate-version-id <id> --runner-version-id <id> --candidate-runner-dir <dir> --scorer-version-id <id> --scorer-runner-version-id <id> --scorer-runner-dir <dir> --dataset-version-id <id> --split-set-id <id> [--train-split train] [--val-split validation] [--budget auto|light|medium|heavy | --max-metric-calls <n> | --max-full-evals <n> | --max-iterations <n>] [--num-threads auto|N] [--reflection-retry-attempts N] [--reflection-http-timeout-seconds N] [--log-dir logs]',
-        summary: 'Run the bundled GEPA-style optimizer locally and stream events.',
+        usage: 'orizu optimizations run-gepa --project <team/project> --optimizer-version-id <id> --candidate-version-id <id> --runner-version-id <id> --candidate-runner-dir <dir> --scorer-version-id <id> --scorer-runner-version-id <id> --scorer-runner-dir <dir> [--scorer-input-contract gepa|flat_row] [--scorer-candidate-field <row-field>] [--allow-degenerate-seed] --dataset-version-id <id> --split-set-id <id> [--train-split train] [--val-split validation] [--budget auto|light|medium|heavy | --max-metric-calls <n> | --max-full-evals <n> | --max-iterations <n>] [--num-threads auto|N] [--reflection-retry-attempts N] [--reflection-http-timeout-seconds N] [--log-dir logs]',
+        summary: 'Run the bundled GEPA-style optimizer locally and stream events. Validates the scorer contract on the seed before iterating; judge runners built for flat-row score runs need --scorer-input-contract flat_row (ALI-1158).',
         group: 'Optimizations',
     },
     {
@@ -747,15 +753,28 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['session', 'start'],
-        usage: 'orizu session start [--project <team/project>] [--workspace <dir>] [--json]',
-        summary: 'Start a durable workspace session and print the session id. When run inside the workbench clone (or with --workspace), the remote session branch is fetched and checked out locally, and the exact next git commands are printed.',
+        usage: 'orizu session start [--project <team/project>] [--workspace <dir>] [--json] | orizu session start --hosted (--task <prompt> | --task-file <path>) [--duration <min>] [--project <team/project>] [--tail [--quiet]]',
+        summary: 'Start a durable workspace session, or add --hosted with a task prompt to start a coordinator-managed hosted agent. Plain sessions check out their remote session branch locally when run inside the workbench clone (or with --workspace).',
         group: 'Sessions',
         options: [
             { name: '--project <team/project>', help: 'Optionally scope the session to a project in the attached workspace.' },
             { name: '--workspace <dir>', help: 'Workbench clone directory when not running from inside it.' },
+            { name: '--hosted', help: 'Start a coordinator-managed hosted agent session instead of a plain durable session.' },
+            { name: '--task <prompt>', help: 'Hosted agent task prompt. Mutually exclusive with --task-file.' },
+            { name: '--task-file <path>', help: 'Read the hosted agent task prompt from a UTF-8 file. Mutually exclusive with --task.' },
+            { name: '--duration <min>', help: 'Hosted sandbox duration in minutes (default 60, maximum 1440).' },
+            { name: '--model <provider/model>', help: 'Optional hosted model override.' },
+            { name: '--reasoning-effort <level>', help: 'Optional hosted model reasoning-effort override.' },
+            { name: '--title <title>', help: 'Optional hosted run title.' },
+            { name: '--tail', help: 'Follow the hosted run until it reaches a terminal state, streaming compact per-event digests (agent text, tool calls with args, results).' },
+            { name: '--quiet', help: 'With --tail: stream event types only (the pre-digest output).' },
             { name: '--json', help: 'Emit the machine-readable session payload.' },
         ],
-        examples: ['orizu session start', 'orizu session start --project highlight/hip --json'],
+        examples: [
+            'orizu session start',
+            'orizu session start --project highlight/hip --json',
+            'orizu session start --hosted --task-file ./task.md --project highlight/hip --duration 90',
+        ],
     },
     {
         path: ['session', 'status'],
@@ -823,7 +842,7 @@ export const COMMAND_DOCS = [
     {
         path: ['run', 'tail'],
         usage: 'orizu run tail --run <id> [--after <seq>] [--interval <seconds>] [--once] [--json]',
-        summary: 'Cursor-poll a workbench run event log; JSON mode emits one event object per line.',
+        summary: 'Cursor-poll a workbench run event log as compact per-event digest lines; JSON mode emits one full event object per line.',
         group: 'Workbench runs',
         options: [
             { name: '--run <id>', help: 'Workbench run id.', required: true },

package/dist/hosted-runtime-assets.js

@@ -101,7 +101,14 @@ export function parsePrebakedMarker(raw) {
         typeof claudeSdkVersion !== 'string') {
         return null;
     }
-    return { cliVersion, opencodeVersion, claudeSdkVersion, builtFor: 'vercel-sandbox' };
+    const marker = { cliVersion, opencodeVersion, claudeSdkVersion, builtFor: 'vercel-sandbox' };
+    // Optional Braintrust pins (ALI-1048): carried through when present as strings;
+    // absent/odd-typed values are simply omitted (never invalidate the marker).
+    if (typeof rec.braintrustPyVersion === 'string')
+        marker.braintrustPyVersion = rec.braintrustPyVersion;
+    if (typeof rec.braintrustNpmVersion === 'string')
+        marker.braintrustNpmVersion = rec.braintrustNpmVersion;
+    return marker;
 }
 export function serializeBootContext(ctx) {
     return `${JSON.stringify(ctx, null, 2)}\n`;