orizu 0.5.14 → 0.5.16

package/dist/hosted-session-cli.js

@@ -34,6 +34,7 @@
  * is injectable, so the whole flow runs in-process against fakes in the
  * local-sim end-to-end test.
  */
+import { readFileSync } from 'fs';
 import { createLocalSimProvider, } from './sandbox-provider.js';
 import { bootstrapHostedSandbox, createBootstrapRunEventSink, } from './hosted-bootstrap.js';
 import { resumeRunEventSink } from './hosted-run-event-sink.js';
@@ -45,9 +46,11 @@ import { hostedBootCommand } from './hosted-boot.js';
 import { mergeJobCommand } from './merge-job.js';
 import { authedFetch } from './http.js';
 import { resolveBaseUrl } from './http.js';
+import { findUnknownOption } from './option-validation.js';
 import { getWorkspaceRoot } from './workspace.js';
 import { attachedWorkspaceId } from './workspace-sync.js';
 import { tailWorkbenchRun } from './workbench-cli.js';
+import { formatRunEventDigest, formatRunEventTypeLine } from './run-event-digest.js';
 // Default hosted model — SINGLE source of truth in hosted-loop-lifecycle.ts
 // (ALI-1086); re-exported here so existing importers keep working.
 export { DEFAULT_HOSTED_MODEL };
@@ -62,6 +65,13 @@ export const DEFAULT_AGENT_TOKEN_TTL_MINUTES = 60;
  *  before declaring the detached launch a failure. */
 export const DEFAULT_READINESS_TIMEOUT_MS = 30 * 1000;
 export const DEFAULT_READINESS_POLL_MS = 500;
+/** Must match the coordinator Worker's session-start request ceiling. */
+export const MAX_HOSTED_START_BODY_BYTES = 128 * 1024;
+/** `workspace_sessions.id` and `workbench_runs.id` are PostgreSQL UUIDs. The
+ *  server creates both before its coordinator poke, and the Worker injects the
+ *  session id into the final DO body. A representative UUID makes the local
+ *  projection byte-exact without creating either server-side row. */
+const GENERATED_HOSTED_UUID_PLACEHOLDER = '00000000-0000-4000-8000-000000000000';
 /** Non-secret placeholder OpenCode uses to form requests; the firewall proxy
  *  overrides the real Anthropic header (model-key brokering). NEVER a real key. */
 export const ANTHROPIC_DUMMY_KEY = 'sk-ant-orizu-proxy-broker-placeholder';
@@ -590,6 +600,10 @@ export async function startHostedSession(opts) {
     return base;
 }
 function argVal(args, flag) {
+    const inlinePrefix = `${flag}=`;
+    const inlineArg = args.find(arg => arg.startsWith(inlinePrefix));
+    if (inlineArg)
+        return inlineArg.slice(inlinePrefix.length);
     const index = args.indexOf(flag);
     if (index === -1 || index + 1 >= args.length)
         return null;
@@ -597,7 +611,7 @@ function argVal(args, flag) {
     return value.startsWith('--') ? null : value;
 }
 function hasFlag(args, flag) {
-    return args.includes(flag);
+    return args.some(arg => arg === flag || arg.startsWith(`${flag}=`));
 }
 function numFlag(args, flag) {
     const raw = argVal(args, flag);
@@ -606,9 +620,11 @@ function numFlag(args, flag) {
     const parsed = Number(raw);
     return Number.isFinite(parsed) ? parsed : undefined;
 }
-const HOSTED_USAGE = 'Usage: orizu session start --hosted --task "<prompt>" [--duration <min> (default 60, max 1440)] ' +
+const HOSTED_USAGE = 'Usage: orizu session start --hosted (--task "<prompt>" | --task-file <path>) [--duration <min> (default 60, max 1440)] ' +
     '[--model <provider/model>] [--reasoning-effort <level>] [--project <team/project>] ' +
-    '[--title <title>] [--tail]\n' +
+    '[--title <title>] [--tail [--quiet]]\n' +
+    '--tail streams compact per-event digests (agent text, tool calls + args, results); ' +
+    '--quiet restores the types-only stream; --json keeps full event payloads.\n' +
     'Default: the Orizu server provisions the sandbox (no VERCEL_* or model key needed on your machine); ' +
     'the session coordinator owns its lifetime (ALI-1055).\n' +
     'DEPRECATED escape hatch: --operator provisions from THIS machine (requires VERCEL_* + ANTHROPIC_API_KEY ' +
@@ -616,6 +632,41 @@ const HOSTED_USAGE = 'Usage: orizu session start --hosted --task "<prompt>" [--d
     'Removal is planned after DO-coordinator validation (ALI-1055).\n' +
     'Note (v0, --operator only): if you disconnect, the agent token expires within its TTL (<=60m) and the run ' +
     'finishes cleanly; reconnect with `orizu run tail --run <id>`. The sandbox timeout is independent (up to 24h).';
+const HOSTED_START_OPTIONS = new Set([
+    '--hosted',
+    '--task',
+    '--task-file',
+    '--workspace',
+    '--duration',
+    '--model',
+    '--reasoning-effort',
+    '--project',
+    '--title',
+    '--tail',
+    '--quiet',
+    '--operator',
+    '--provider',
+    '--runtime',
+    '--image',
+    '--snapshot',
+    '--model-key',
+    '--json',
+]);
+const HOSTED_START_VALUE_OPTIONS = new Set([
+    '--task',
+    '--task-file',
+    '--workspace',
+    '--duration',
+    '--model',
+    '--reasoning-effort',
+    '--project',
+    '--title',
+    '--provider',
+    '--runtime',
+    '--image',
+    '--snapshot',
+    '--model-key',
+]);
 /** Printed on EVERY `--operator` use (founder-locked: deprecate NOW, remove
  *  after Phase 6 validation). Loud on purpose. */
 export const OPERATOR_DEPRECATION_WARNING = '! DEPRECATED: --operator (operator-provisioned hosted sessions) is deprecated; ' +
@@ -626,29 +677,110 @@ export const OPERATOR_DEPRECATION_WARNING = '! DEPRECATED: --operator (operator-
  * route and let the Durable Object coordinator own the sandbox lifetime. The
  * CLI never reads VERCEL_* or a model key on this path — the server holds them.
  */
-export async function startHostedViaServer(args, workspaceId, task, tail, io, fetcher = (path, init) => authedFetch(path, init)) {
+/** Bounded reconcile of a start that the coordinator reported still-in-flight
+ *  (R7 P4). Each retry re-pokes the SAME session by its returned sessionId, so
+ *  a race that momentarily answers start_pending never spawns a duplicate.
+ *
+ *  R8 P2 — the retry budget must OUTLIVE a stale start lease. If a start-lease
+ *  owner crashed WITHOUT running its release, the lease lingers until its TTL
+ *  (the coordinator's START_LEASE_TTL_MS = 3 × CALLBACK_TIMEOUT_MS = 30s), and
+ *  every duplicate poke sees it and answers start_pending. So the CLI's OWN
+ *  cumulative backoff (independent of server-side watch time) must exceed that
+ *  TTL plus margin, so the CLI keeps polling until the lease expires and a
+ *  retry then wins — rather than giving up while the crashed owner's lease
+ *  still lingers. COORDINATOR_START_LEASE_TTL_MS mirrors the worker constant
+ *  and is pinned to it by a contract test in the CLI suite. */
+export const COORDINATOR_START_LEASE_TTL_MS = 30_000;
+export const HOSTED_START_PENDING_RETRY_MS = 2_000;
+const HOSTED_START_PENDING_TTL_MARGIN_MS = 6_000;
+export const HOSTED_START_PENDING_MAX_RETRIES = Math.ceil((COORDINATOR_START_LEASE_TTL_MS + HOSTED_START_PENDING_TTL_MARGIN_MS) / HOSTED_START_PENDING_RETRY_MS);
+export async function startHostedViaServer(args, workspaceId, task, tail, io, fetcher = (path, init) => authedFetch(path, init), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))) {
+    const durationMinutes = numFlag(args, '--duration');
+    const model = argVal(args, '--model') ?? undefined;
+    const reasoningEffort = argVal(args, '--reasoning-effort') ?? undefined;
+    const projectSlug = argVal(args, '--project') ?? undefined;
+    const title = argVal(args, '--title') ?? undefined;
     const payload = {
         workspaceId,
         task,
-        durationMinutes: numFlag(args, '--duration'),
-        model: argVal(args, '--model') ?? undefined,
-        reasoningEffort: argVal(args, '--reasoning-effort') ?? undefined,
-        projectSlug: argVal(args, '--project') ?? undefined,
-        title: argVal(args, '--title') ?? undefined,
+        durationMinutes,
+        model,
+        reasoningEffort,
+        projectSlug,
+        title,
     };
-    let response;
-    try {
-        response = await fetcher('/api/cli/hosted-sessions', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(payload),
-        });
+    const serializedPayload = JSON.stringify(payload);
+    const payloadBytes = new TextEncoder().encode(serializedPayload).byteLength;
+    if (payloadBytes > MAX_HOSTED_START_BODY_BYTES) {
+        const message = `Hosted task prompt is too large: request body is ${payloadBytes} bytes; ` +
+            `maximum is ${MAX_HOSTED_START_BODY_BYTES} bytes (128 KiB).`;
+        if (io.json)
+            io.print(JSON.stringify({ ok: false, error: message }));
+        else
+            io.printErr?.(message);
+        return 1;
     }
-    catch (error) {
-        io.printErr?.(`hosted session request failed: ${error instanceof Error ? error.message : String(error)}`);
+    // Mirror the exact JSON shape that reaches the session Durable Object after
+    // the API creates its UUID run/session rows, normalizes optional strings, and
+    // the Worker injects sessionId. This second guard keeps near-boundary prompts
+    // from triggering server-side state that would only be compensated after a
+    // coordinator 413. Keep this field list in sync with pokeCoordinatorStart in
+    // app/api/cli/hosted-sessions/route.ts.
+    const normalizedModel = model?.trim() || undefined;
+    const normalizedReasoningEffort = reasoningEffort?.trim() || undefined;
+    const coordinatorPayload = JSON.stringify({
+        runId: GENERATED_HOSTED_UUID_PLACEHOLDER,
+        task,
+        durationMinutes: durationMinutes !== undefined && durationMinutes > 0
+            ? durationMinutes
+            : undefined,
+        model: normalizedModel,
+        reasoningEffort: normalizedReasoningEffort,
+        sessionId: GENERATED_HOSTED_UUID_PLACEHOLDER,
+    });
+    const coordinatorPayloadBytes = new TextEncoder().encode(coordinatorPayload).byteLength;
+    if (coordinatorPayloadBytes > MAX_HOSTED_START_BODY_BYTES) {
+        const message = `Hosted task prompt is too large: coordinator request body would be ${coordinatorPayloadBytes} bytes ` +
+            `after generated run/session IDs; maximum is ${MAX_HOSTED_START_BODY_BYTES} bytes (128 KiB).`;
+        if (io.json)
+            io.print(JSON.stringify({ ok: false, error: message }));
+        else
+            io.printErr?.(message);
         return 1;
     }
-    const body = (await response.json().catch(() => ({})));
+    // R7 P4: the coordinator may momentarily answer start_pending (a start for
+    // this session is racing). It returns the sessionId so we RECONCILE the SAME
+    // session — re-poking by that id rather than blindly re-initing a duplicate.
+    let response;
+    let body = {};
+    let reconcileSessionId;
+    for (let attempt = 0;; attempt++) {
+        const attemptBody = reconcileSessionId
+            ? JSON.stringify({ ...payload, sessionId: reconcileSessionId })
+            : serializedPayload;
+        try {
+            response = await fetcher('/api/cli/hosted-sessions', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: attemptBody,
+            });
+        }
+        catch (error) {
+            io.printErr?.(`hosted session request failed: ${error instanceof Error ? error.message : String(error)}`);
+            return 1;
+        }
+        body = (await response.json().catch(() => ({})));
+        const stillPending = response.status === 409 &&
+            body.coordinator === 'start_pending' &&
+            typeof body.sessionId === 'string' &&
+            body.sessionId.length > 0;
+        if (stillPending && attempt < HOSTED_START_PENDING_MAX_RETRIES) {
+            reconcileSessionId = body.sessionId;
+            await sleep(HOSTED_START_PENDING_RETRY_MS);
+            continue;
+        }
+        break;
+    }
     const errorMessage = typeof body.error === 'string' ? body.error : `${response.status}`;
     if (response.status === 503) {
         io.printErr?.(errorMessage);
@@ -673,12 +805,20 @@ export async function startHostedViaServer(args, workspaceId, task, tail, io, fe
             io.print(`stream it: orizu run tail --run ${runId}`);
     }
     if (tail && runId) {
+        // ALI-1045: the attached tail renders the SAME compact per-event digests
+        // `run tail` uses (agent text, tool + args, result + first output line) so
+        // the operator watching live sees what is happening without a second
+        // terminal. `--quiet` keeps the old types-only stream; `--json` keeps full
+        // fidelity.
+        const quiet = hasFlag(args, '--quiet');
         await tailWorkbenchRun({
             fetcher,
             runId,
             onEvent: event => io.print(io.json
                 ? JSON.stringify(event)
-                : `#${String(event.sequence ?? '?')} ${String(event.eventType ?? '')}`),
+                : quiet
+                    ? formatRunEventTypeLine(event)
+                    : formatRunEventDigest(event)),
         });
     }
     return 0;
@@ -709,7 +849,36 @@ export async function hostedCommand(args, io, deps = {}) {
         io.printErr?.('Usage: orizu internal <hosted-loop --context <path> | hosted-boot | merge-job>');
         return 1;
     }
-    const task = argVal(args, '--task');
+    const unknownOption = findUnknownOption(args, HOSTED_START_OPTIONS, HOSTED_START_VALUE_OPTIONS);
+    if (unknownOption) {
+        const followsTaskFlag = args.some((arg, index) => arg === '--task' &&
+            (args[index + 1] === unknownOption || args[index + 1]?.startsWith(`${unknownOption}=`)));
+        const taskValueHint = followsTaskFlag
+            ? '\nTask text beginning with a dash must use --task=<prompt> or --task-file <path>.'
+            : '';
+        io.printErr?.(`unknown option ${unknownOption}${taskValueHint}\n${HOSTED_USAGE}`);
+        return 1;
+    }
+    const inlineTask = argVal(args, '--task');
+    const taskFile = argVal(args, '--task-file');
+    if (hasFlag(args, '--task') && hasFlag(args, '--task-file')) {
+        io.printErr?.(`Use either --task or --task-file, not both.\n${HOSTED_USAGE}`);
+        return 1;
+    }
+    let task = inlineTask;
+    if (taskFile) {
+        try {
+            task = readFileSync(taskFile, 'utf8');
+        }
+        catch (error) {
+            io.printErr?.(`Could not read task file '${taskFile}': ${error instanceof Error ? error.message : String(error)}`);
+            return 1;
+        }
+        if (task.trim().length === 0) {
+            io.printErr?.(`Task file '${taskFile}' is empty or contains only whitespace. Add a task prompt and try again.`);
+            return 1;
+        }
+    }
     if (!task) {
         io.printErr?.(HOSTED_USAGE);
         return 1;
@@ -762,7 +931,13 @@ export async function hostedCommand(args, io, deps = {}) {
         // fail-fast in startHostedSession throws before any session/sandbox is made.
         modelApiKey: argVal(args, '--model-key') ?? (process.env.ANTHROPIC_API_KEY || undefined),
         logLine: line => io.print(line),
-        onTailEvent: event => io.print(io.json ? JSON.stringify(event) : `#${String(event.sequence ?? '?')} ${String(event.eventType ?? '')}`),
+        // ALI-1045: compact per-event digests (shared with `run tail`); `--quiet`
+        // keeps the old types-only stream, `--json` keeps full fidelity.
+        onTailEvent: event => io.print(io.json
+            ? JSON.stringify(event)
+            : hasFlag(args, '--quiet')
+                ? formatRunEventTypeLine(event)
+                : formatRunEventDigest(event)),
         tailImpl: tail
             ? async ({ fetcher, runId, onEvent }) => {
                 await tailWorkbenchRun({ fetcher, runId, onEvent: event => onEvent?.(event) });

package/dist/index.js

@@ -29,6 +29,8 @@ import { connectorsCommand } from './connectors-cli.js';
 import { ARTIFACT_MAX_BYTES, runnerOptimizerCommand } from './artifact-pull.js';
 import { killSwitchCommand } from './kill-switch-cli.js';
 import { egressAllowlistCommand } from './egress-allowlist-cli.js';
+import { acceptScoreRunCommand } from './scores-accept-cli.js';
+import { listOptimizationRunsCommand } from './optimizations-list-cli.js';
 import { teamConnectorsCommand } from './team-connectors-cli.js';
 import { manifestsCommand } from './manifests-cli.js';
 import { workbenchCommand } from './workbench-cli.js';
@@ -36,6 +38,7 @@ import { hostedCommand } from './hosted-session-cli.js';
 import { workspaceSyncCommand } from './workspace-sync.js';
 import { runGitCredential } from './git-credential.js';
 import { pushPromptDraft } from './prompt-draft-push.js';
+import { assertSnapshotManifestConfined, verifyGepaRunnerDirsFromArgs, verifyRunnerDirRegistered } from './runner-dir-verify.js';
 import { runScorersRegister } from './scorer-draft-push.js';
 import { runZipArtifactPush } from './zip-draft-push.js';
 import { runGithubLink, runInteractiveHostedSetup } from './github-setup.js';
@@ -1504,8 +1507,10 @@ async function submitScoreResults() {
         printJson(data);
         return;
     }
+    // ALI-1175: label the stored provenance — a submitted score is a client-reported claim.
     printLine(`Submitted score ${sanitizeTerminalText(data.scoreRun.id)} ` +
-        `(${formatPercent(data.scoreRun.scoreValue)})`);
+        `(${formatPercent(data.scoreRun.scoreValue)})` +
+        (data.scoreRun.provenance ? ` [${sanitizeTerminalText(String(data.scoreRun.provenance).replace(/_/g, '-'))}]` : ''));
 }
 function looksLikeAggregateScoreObject(value) {
     return (value.scoreValue !== undefined ||
@@ -1640,11 +1645,23 @@ async function execScorer() {
         : scoreResult
             ? scoreResult.scoreValue
             : null;
+    // ALI-1175 (round 5 thread 6 + round 6 thread 2): a scorers-exec score is an
+    // agent-reported claim whether or not it was submitted — label both the
+    // submitted (scoreRun.provenance) and the --no-submit (top-level provenance)
+    // outputs, so a displayed value is never presented as unlabeled evidence.
+    const execProvenance = scoreRun && typeof scoreRun.provenance === 'string'
+        ? scoreRun.provenance
+        : typeof data.provenance === 'string'
+            ? data.provenance
+            : null;
+    const provenanceSuffix = execProvenance
+        ? ` [${sanitizeTerminalText(execProvenance.replace(/_/g, '-'))}]`
+        : '';
     if (scoreRun && typeof scoreRun.id === 'string') {
-        printLine(`Executed scorer ${sanitizeTerminalText(scorerVersionId)} -> score ${sanitizeTerminalText(scoreRun.id)} (${formatPercent(numberFromUnknown(scoreValue))})`);
+        printLine(`Executed scorer ${sanitizeTerminalText(scorerVersionId)} -> score ${sanitizeTerminalText(scoreRun.id)} (${formatPercent(numberFromUnknown(scoreValue))})${provenanceSuffix}`);
     }
     else {
-        printLine(`Executed scorer ${sanitizeTerminalText(scorerVersionId)} (${formatPercent(numberFromUnknown(scoreValue))})`);
+        printLine(`Executed scorer ${sanitizeTerminalText(scorerVersionId)} (${formatPercent(numberFromUnknown(scoreValue))})${provenanceSuffix}`);
     }
     if (outPath) {
         printLine(`Wrote scorer result to ${sanitizeTerminalText(outPath)}`);
@@ -1866,34 +1883,8 @@ async function exportOptimizationRun() {
     writeTextFileEnsuringDir(filename, `${JSON.stringify(data, null, 2)}\n`);
     printLine(`Saved optimization export to ${sanitizeTerminalText(filename)}`);
 }
-// ALI-1073: enumerate the project's optimization runs (id, status, refs, and the
-// promoted-version link if any) so an agent/human can discover a prior run.
-async function listOptimizationRuns() {
-    const project = getArg('--project') || await resolveProjectSlug(null);
-    const response = await authedFetch(`/api/cli/optimization-runs?project=${encodeURIComponent(project)}`);
-    if (!response.ok) {
-        throw new Error(`Failed to list optimization runs: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization runs list');
-    if (hasJsonFlag()) {
-        printJson(data);
-        return;
-    }
-    const rows = data.optimizationRuns || [];
-    if (rows.length === 0) {
-        printLine('No optimization runs found for this project.');
-        return;
-    }
-    const idWidth = Math.max(2, ...rows.map(row => String(row.id).length));
-    const statusWidth = Math.max(6, ...rows.map(row => String(row.status).length));
-    printLine(`${'ID'.padEnd(idWidth)}  ${'STATUS'.padEnd(statusWidth)}  BEST   PROMOTED_VERSION`);
-    printLine(`${'-'.repeat(idWidth)}  ${'-'.repeat(statusWidth)}  ${'-'.repeat(5)}  ${'-'.repeat('PROMOTED_VERSION'.length)}`);
-    for (const row of rows) {
-        const best = row.bestScore === null || row.bestScore === undefined ? '-' : String(row.bestScore);
-        const promoted = row.resultPromptVersionId || '-';
-        printLine(`${String(row.id).padEnd(idWidth)}  ${String(row.status).padEnd(statusWidth)}  ${best.padEnd(5)}  ${promoted}`);
-    }
-}
+// ALI-1073 list moved to optimizations-list-cli.ts (line ratchet, ALI-976);
+// ALI-1175 labels its best scores as agent-reported evidence there.
 function removeFlagWithValue(args, flag) {
     const filtered = [];
     for (let index = 0; index < args.length; index += 1) {
@@ -1915,31 +1906,50 @@ function bundledOrizuGepaPythonPath() {
 async function runGepaOptimization() {
     const project = getArg('--project') || await resolveProjectSlug(null);
     const baseUrl = getBaseUrl();
-    // Uniform resolution (ALI-1090): honors ORIZU_TOKEN / ORIZU_TOKEN_FILE before
-    // credentials.json so hosted sandboxes can run optimizations. Read at spawn
-    // time — the child gets the freshest bearer available at launch.
-    const token = resolveAuthTokenForBaseUrl(baseUrl);
     const python = getArg('--python') || process.env.PYTHON || 'python3';
     const bundledPythonPath = bundledOrizuGepaPythonPath();
     let forwardedArgs = removeFlagWithValue(cliArgs.slice(2), '--python');
-    if (!forwardedArgs.includes('--project')) {
-        forwardedArgs = ['--project', project, ...forwardedArgs];
-    }
-    const pythonPathEntries = [
-        bundledPythonPath,
-        process.env.PYTHONPATH,
-    ].filter((entry) => Boolean(entry));
-    const result = spawnSync(python, ['-m', 'orizu_gepa.cli', ...forwardedArgs], {
-        stdio: 'inherit',
-        env: {
-            ...process.env,
-            ORIZU_API_URL: baseUrl,
-            ORIZU_TOKEN: token,
-            ORIZU_PROJECT: project,
-            PYTHONPATH: pythonPathEntries.join(delimiter),
-            PYTHONUNBUFFERED: process.env.PYTHONUNBUFFERED || '1',
-        },
-    });
+    // ALI-1159 (ADR-007): GEPA executes ad-hoc local runner dirs while
+    // attributing records to registered runner version ids — verify the bytes
+    // ARE those versions before the optimizer spawns. Scans the forwarded argv
+    // itself (both argparse flag forms), fail-closed on half-populated pairs,
+    // and REWRITES the dir flags to verified snapshots (the exact hashed bytes)
+    // so a post-hash mutation of the original dirs cannot change what runs.
+    const verified = await verifyGepaRunnerDirsFromArgs(forwardedArgs);
+    forwardedArgs = verified.args;
+    let result;
+    try {
+        // Uniform resolution (ALI-1090): honors ORIZU_TOKEN / ORIZU_TOKEN_FILE before
+        // credentials.json so hosted sandboxes can run optimizations. Read at spawn
+        // time — AFTER the verification awaits above, so a hosted token-file
+        // rotation crossing the hash + lookup round-trips cannot hand the child a
+        // stale bearer.
+        const token = resolveAuthTokenForBaseUrl(baseUrl);
+        if (!forwardedArgs.includes('--project')) {
+            forwardedArgs = ['--project', project, ...forwardedArgs];
+        }
+        const pythonPathEntries = [
+            bundledPythonPath,
+            process.env.PYTHONPATH,
+        ].filter((entry) => Boolean(entry));
+        result = spawnSync(python, ['-m', 'orizu_gepa.cli', ...forwardedArgs], {
+            stdio: 'inherit',
+            env: {
+                ...process.env,
+                ORIZU_API_URL: baseUrl,
+                ORIZU_TOKEN: token,
+                ORIZU_PROJECT: project,
+                // Integrity handshake (ALI-1159): the Python entrypoint refuses
+                // runner dirs that are not in this wrapper-verified list.
+                ORIZU_VERIFIED_RUNNER_DIRS: JSON.stringify(verified.verifiedDirs),
+                PYTHONPATH: pythonPathEntries.join(delimiter),
+                PYTHONUNBUFFERED: process.env.PYTHONUNBUFFERED || '1',
+            },
+        });
+    }
+    finally {
+        verified.cleanup();
+    }
     if (result.error) {
         throw result.error;
     }
@@ -2718,12 +2728,25 @@ async function resolveSetupTeam(teamSlugArg, noInput, dryRun) {
     }
     return createTeamOnServer(name);
 }
-async function resolveSetupProjects(team) {
+async function resolveSetupProjects(team, noInput, dryRun) {
     const projects = await fetchProjects(team.slug);
-    if (projects.length === 0) {
-        throw new Error(`Team '${team.slug}' has no projects. Create a project before running setup.`);
+    if (projects.length > 0) {
+        return projects;
+    }
+    // ALI-1140: a just-created team (or a pre-existing empty one) has no projects
+    // by definition — continue the wizard into creating the first project instead
+    // of dead-ending on the path setup itself offered.
+    if (noInput || dryRun) {
+        throw new Error(`Team '${team.slug}' has no projects. Create one with \`orizu projects create --name <name> --team ${team.slug}\`, then re-run setup.`);
     }
-    return projects;
+    printLine(`   Team '${sanitizeTerminalText(team.slug)}' has no projects yet. Let's create the first one.`);
+    const name = await askText('   Project name?', '');
+    if (!name) {
+        throw new Error('Project name is required to create a project.');
+    }
+    const project = await createProjectOnServer(team.slug, name);
+    printLine(`   Created project ${sanitizeTerminalText(`${project.teamSlug}/${project.slug}`)}`);
+    return [project];
 }
 function projectSeedsFromProjects(projects) {
     return projects.map(project => ({
@@ -2848,7 +2871,7 @@ async function setupCommand() {
             let projects;
             if (auth.state === 'signed-in' && !validateOnly) {
                 const team = await resolveSetupTeam(teamSlug, noInput, dryRun);
-                const serverProjects = await resolveSetupProjects(team);
+                const serverProjects = await resolveSetupProjects(team, noInput, dryRun);
                 teamSlug = team.slug;
                 teamId = team.id;
                 projects = projectSeedsFromProjects(serverProjects);
@@ -2866,10 +2889,10 @@ async function setupCommand() {
                             hostedAttached = (await runInteractiveHostedSetup({ teamSlug: team.slug, targetDir: workspaceRoot, local: hasArg('--local'), activeInstallation: link.status === 'active' }, { print: printLine, fetcher: authedFetch })).attached;
                         }
                         catch (error) {
-                            throw new Error(`Hosted setup failed: ${getErrorMessage(error)} Remove any partial clone in ${workspaceRoot} if one exists, then re-run \`orizu setup\` (or pass --local to scaffold a local-only workspace).`);
+                            throw new Error(`Hosted setup failed: ${getErrorMessage(error)} Re-running \`orizu setup\` is safe — provisioning adopts the existing workbench repo and resumes where it left off (or pass --local to scaffold a local-only workspace).`);
                         }
                     }
-                }
+                } // hint must not blame local state (ALI-1143): provisioning failures are server-side, and both provisioning (adopt) and the clone step (skip-if-cloned, ALI-1069) are idempotent on re-run
             }
             else if (!teamSlug && !noInput && !validateOnly) {
                 teamSlug = await askText('   Team slug?', 'local-team');
@@ -4622,10 +4645,7 @@ async function materializeRunnerVersion(runnerVersionId) {
         rmSync(tempDir, { recursive: true, force: true });
         throw new Error(`unzip failed: ${sanitizeTerminalText(result.stderr || result.stdout || '')}`);
     }
-    return {
-        runnerDir,
-        cleanup: () => rmSync(tempDir, { recursive: true, force: true }),
-    };
+    return { runnerDir, cleanup: () => rmSync(tempDir, { recursive: true, force: true }) };
 }
 async function runnersExec() {
     const prompt = getArg('--prompt');
@@ -4667,12 +4687,28 @@ async function runnersExec() {
         throw new Error(`Failed to fetch runner execution context: ${await contextResponse.text()}`);
     }
     const context = await parseJsonResponse(contextResponse, 'Runner exec context');
+    const resolvedRunnerVersionId = runnerVersion || context.prompt.runnerVersionId;
+    if (!resolvedRunnerVersionId) {
+        throw new Error('Runner exec context did not resolve a runner version id; pass --runner-version explicitly');
+    }
+    // ALI-1159 (ADR-007): results stamp the registered runner_version_id, so
+    // ad-hoc --runner-dir bytes must BE that registered version — and execution
+    // runs the verified SNAPSHOT (exact hashed bytes), never the mutable dir.
     const materializedRunner = runnerDirArg
-        ? { runnerDir: expandHomePath(runnerDirArg), cleanup: () => { } }
-        : await materializeRunnerVersion(runnerVersion || context.prompt.runnerVersionId);
+        ? await (async () => {
+            const verified = await verifyRunnerDirRegistered({
+                runnerVersionId: resolvedRunnerVersionId,
+                dir: runnerDirArg,
+                flag: '--runner-dir',
+            });
+            return { runnerDir: verified.snapshotDir, cleanup: verified.cleanup };
+        })()
+        : await materializeRunnerVersion(resolvedRunnerVersionId);
     const runnerDir = materializedRunner.runnerDir;
-    const manifest = readRunnerManifest(runnerDir);
     try {
+        assertSnapshotManifestConfined(runnerDir, runnerDirArg ? '--runner-dir' : '--runner-version');
+        // Inside the try (codex round-6 P3): a bad manifest must not leak the dir.
+        const manifest = readRunnerManifest(runnerDir);
         if (manifest.supports_body_kind && !manifest.supports_body_kind.includes(context.prompt.bodyKind)) {
             throw new Error(`Runner does not support prompt body kind '${context.prompt.bodyKind}'. Supported kinds: ${manifest.supports_body_kind.join(', ')}`);
         }
@@ -4983,6 +5019,10 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await submitScoreResults();
         return;
     }
+    if (command === 'scores' && subcommand === 'accept') {
+        await acceptScoreRunCommand(cliArgs.slice(2), { json: hasJsonFlag(), print: printLine, resolveProjectSlug });
+        return;
+    }
     if (command === 'optimizations' && subcommand === 'start') {
         await startOptimizationRun();
         return;
@@ -4996,7 +5036,7 @@ export async function main(rawArgs = process.argv.slice(2)) {
         return;
     }
     if (command === 'optimizations' && subcommand === 'list') {
-        await listOptimizationRuns();
+        await listOptimizationRunsCommand(cliArgs.slice(2), { json: hasJsonFlag(), print: printLine, resolveProjectSlug });
         return;
     }
     if (command === 'optimizations' &&

package/dist/kill-switch-cli.js

@@ -8,6 +8,16 @@
  * (killed sessions stay ended). Human ADMIN only: the server rejects agent
  * bearers and non-admins. Pure command logic with an injected fetcher so the
  * entry point owns argument parsing and human/JSON output.
+ *
+ * Containment (ALI-1166): the guarantee is session-end + per-request
+ * verification + token-row revocation at engage — a bearer bound to an ended
+ * session can never verify again, and ended sessions are terminal
+ * (DB-enforced; no post-kill resurrection).
+ * `tokensRevoked` in the summary counts the persisted agent token rows the
+ * engage revoked (trigger cascade + belt, one transaction); it may include
+ * expired or already-ended-session stragglers that were never live bearers at
+ * kill time. `--json` output is the server's summary passed through, including
+ * `containment: "session-end"`.
  */
 import { authedFetch } from './http.js';
 async function responseMessage(response) {

package/dist/merge-job.js

@@ -39,6 +39,7 @@
  * (plus the shape-pattern net). Nothing here ever logs a secret.
  */
 import { mergeBranchWithDeployKey, } from './deploy-key-merge-core.js';
+import { assertSecureTokenTransport } from './http.js';
 import { redactSecrets } from './secret-redaction.js';
 // -- Frozen env contract --------------------------------------------------------
 export const REQUIRED_MERGE_JOB_ENV_VARS = [
@@ -60,7 +61,27 @@ export function resolveMergeJobEnv(env) {
     const coordinatorUrl = req('ORIZU_COORDINATOR_URL');
     const baseUrl = req('ORIZU_BASE_URL');
     if (missing.length > 0)
-        return { ok: false, missing };
+        return { ok: false, missing, invalid: [] };
+    const origins = [
+        ['ORIZU_COORDINATOR_URL', coordinatorUrl],
+        ['ORIZU_BASE_URL', baseUrl],
+    ];
+    const invalid = origins.flatMap(([name, value]) => {
+        try {
+            const parsed = new URL(value);
+            // Userinfo is never accepted, including on loopback: rejecting it at the
+            // env boundary keeps configured credentials out of every retry/error path.
+            if (parsed.username || parsed.password)
+                return [name];
+            assertSecureTokenTransport(value);
+            return [];
+        }
+        catch {
+            return [name];
+        }
+    });
+    if (invalid.length > 0)
+        return { ok: false, missing: [], invalid };
     return {
         ok: true,
         value: {
@@ -312,8 +333,10 @@ export async function runMergeJob(opts) {
 export async function mergeJobCommand(io) {
     const resolved = resolveMergeJobEnv(process.env);
     if (!resolved.ok) {
-        io.printErr?.(`merge-job: missing required env: ${resolved.missing.join(', ')} ` +
-            '(the MergeJobCoordinator sandbox env contract)');
+        const detail = resolved.missing.length > 0
+            ? `missing required env: ${resolved.missing.join(', ')}`
+            : `invalid or insecure origin env: ${resolved.invalid.join(', ')}`;
+        io.printErr?.(`merge-job: ${detail} (the MergeJobCoordinator sandbox env contract)`);
         return 1;
     }
     const log = (line) => io.printErr?.(`[merge-job] ${line}`);