orizu 0.5.16 → 0.5.18

package/README.md

@@ -173,6 +173,14 @@ orizu logout
     <td>Archive or restore a prompt</td>
     <td><code>orizu prompts archive &lt;promptIdOrName&gt; --project ops-eval/support-qa</code><br><code>orizu prompts restore &lt;promptIdOrName&gt; --project ops-eval/support-qa</code></td>
   </tr>
+  <tr>
+    <td>Push a prompt with a report</td>
+    <td><code>orizu prompts push ./prompts/support --project ops-eval/support-qa --report-file ./prompt-report.md</code></td>
+  </tr>
+  <tr>
+    <td>Upload a report for an existing prompt version</td>
+    <td><code>orizu prompts report set --prompt &lt;promptIdOrName&gt; --project ops-eval/support-qa --version 3 --report-file ./prompt-report.md</code><br><code>prompts report upload</code> is an exact alias; select exactly one of <code>--version</code> or <code>--version-id</code>.</td>
+  </tr>
   <tr>
     <td colspan="2"><strong>Report comments</strong></td>
   </tr>
@@ -184,6 +192,13 @@ orizu logout
     <td>Add or update comments</td>
     <td><code>orizu comments add --run &lt;runId&gt; --body @comment.md --anchor "Summary" --lines 4:6</code><br><code>orizu comments reply &lt;commentId&gt; --body "Fixed"</code><br><code>orizu comments resolve &lt;commentId&gt;</code></td>
   </tr>
+  <tr>
+    <td colspan="2"><strong>Diff comments</strong></td>
+  </tr>
+  <tr>
+    <td>Export diff comments</td>
+    <td><code>orizu comments diff --run &lt;optimizationRunId&gt; [--from &lt;candidateId&gt; --to &lt;candidateId&gt;] [--detail hunk|diff|full] [--json]</code><br><code>orizu comments diff --prompt &lt;promptId&gt; [--from &lt;version&gt; --to &lt;version&gt;] [--detail hunk|diff|full] [--json]</code></td>
+  </tr>
   <tr>
     <td colspan="2"><strong>Datasets</strong></td>
   </tr>

package/dist/archive-artifacts-cli.js

@@ -0,0 +1,213 @@
+/**
+ * ALI-1199 archive/restore commands and assignment inventory.
+ *
+ * Kept outside index.ts per the CLI line ratchet. The server owns
+ * authorization and idempotency; this module validates the CLI grammar and
+ * renders the canonical response without inventing client-side state.
+ */
+import { authedFetch } from './http.js';
+import { extractErrorMessage } from './error-response.js';
+import { sanitizeTerminalText } from './json-response.js';
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const ARTIFACT_TYPES = {
+    app: 'app',
+    apps: 'app',
+    dataset: 'dataset',
+    datasets: 'dataset',
+    task: 'task',
+    tasks: 'task',
+    assignment: 'assignment',
+    assignments: 'assignment',
+    scorer: 'scorer',
+    scorers: 'scorer',
+    optimization: 'optimization',
+    optimizations: 'optimization',
+};
+function argValue(args, flag) {
+    const index = args.indexOf(flag);
+    if (index === -1 ||
+        index + 1 >= args.length ||
+        args[index + 1].startsWith('--')) {
+        return null;
+    }
+    return args[index + 1];
+}
+function columnWidths(headers, rows) {
+    return headers.map((header, index) => Math.max(header.length, ...rows.map(row => row[index]?.length || 0)));
+}
+function printTable(headers, rows, print) {
+    const widths = columnWidths(headers, rows);
+    print(headers.map((header, index) => header.padEnd(widths[index])).join('  '));
+    print(widths.map(width => '-'.repeat(width)).join('  '));
+    rows.forEach(row => {
+        print(row.map((cell, index) => cell.padEnd(widths[index])).join('  '));
+    });
+}
+export function printTaskSummaries(items, print) {
+    if (items.length === 0)
+        return print('No tasks found.');
+    printTable(['TASK ID', 'TASK NAME', 'STATUS', 'ARCHIVE', 'TEAM/PROJECT'], items.map(item => [
+        sanitizeTerminalText(item.id),
+        sanitizeTerminalText(item.title || '-'),
+        sanitizeTerminalText(item.status || '-'),
+        sanitizeTerminalText(item.archiveStatus || 'active'),
+        item.teamSlug && item.projectSlug
+            ? sanitizeTerminalText(`${item.teamSlug}/${item.projectSlug}`)
+            : 'unknown-project',
+    ]), print);
+}
+export function printAppSummaries(items, print) {
+    if (items.length === 0)
+        return print('No apps found.');
+    printTable(['APP ID', 'APP NAME', 'VERSION', 'ARCHIVE'], items.map(item => [
+        sanitizeTerminalText(item.id),
+        sanitizeTerminalText(item.name || '-'),
+        `v${item.currentVersionNum || 1}`,
+        sanitizeTerminalText(item.status || 'active'),
+    ]), print);
+}
+export function printDatasetSummaries(items, print) {
+    if (items.length === 0)
+        return print('No datasets found.');
+    printTable(['DATASET ID', 'DATASET', 'ROWS', 'ARCHIVE'], items.map(item => [
+        sanitizeTerminalText(item.id),
+        sanitizeTerminalText(item.name || '-'),
+        sanitizeTerminalText(item.rowCount),
+        sanitizeTerminalText(item.status || 'active'),
+    ]), print);
+}
+export function printScorerSummaries(items, print) {
+    if (items.length === 0)
+        return print('No scorers found.');
+    printTable(['ID', 'NAME', 'MODE', 'METRIC', 'ARCHIVE', 'IMPLEMENTATION'], items.map(item => [
+        sanitizeTerminalText(item.id),
+        sanitizeTerminalText(item.name),
+        sanitizeTerminalText(item.mode),
+        sanitizeTerminalText(item.metricLabel),
+        sanitizeTerminalText(item.status || 'active'),
+        sanitizeTerminalText(item.implementationKind),
+    ]), print);
+}
+async function parseJsonPayload(response, context) {
+    const contentType = response.headers.get('content-type') || '';
+    const rawBody = await response.text();
+    if (!contentType.includes('application/json')) {
+        throw new Error(`${context} returned non-JSON response (status ${response.status}). ` +
+            `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
+    }
+    try {
+        return JSON.parse(rawBody);
+    }
+    catch {
+        throw new Error(`${context} returned invalid JSON (status ${response.status}). ` +
+            `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
+    }
+}
+function parseStatus(args) {
+    const value = argValue(args, '--status') || 'active';
+    if (value !== 'active' && value !== 'archived' && value !== 'all') {
+        throw new Error('--status must be active, archived, or all');
+    }
+    return value;
+}
+function artifactUsage() {
+    return ('Usage: orizu <apps|datasets|tasks|assignments|scorers|optimizations> ' +
+        '<archive|restore> <id> [--project <team/project>] ' +
+        '[--assignee <user-id>] [--json]');
+}
+export async function archiveArtifactCommand(args, io) {
+    const artifactType = ARTIFACT_TYPES[args[0] || ''];
+    const action = args[1];
+    const artifactId = args[2];
+    if (!artifactType ||
+        (action !== 'archive' && action !== 'restore') ||
+        !artifactId ||
+        !UUID_PATTERN.test(artifactId)) {
+        throw new Error(artifactUsage());
+    }
+    const assigneeId = argValue(args, '--assignee');
+    if (assigneeId && !UUID_PATTERN.test(assigneeId)) {
+        throw new Error('--assignee must be a UUID');
+    }
+    if (artifactType !== 'assignment' && assigneeId) {
+        throw new Error('--assignee is only valid for assignment archive commands');
+    }
+    const projectArg = argValue(args, '--project');
+    const project = projectArg || await io.resolveProjectSlug(null);
+    const params = new URLSearchParams({ project });
+    const body = {
+        archived: action === 'archive',
+        ...(assigneeId ? { assigneeId } : {}),
+    };
+    const fetcher = io.fetcher || authedFetch;
+    const response = await fetcher(`/api/cli/archive-artifacts/${artifactType}/${encodeURIComponent(artifactId)}` +
+        `?${params.toString()}`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to ${action} ${artifactType}: ` +
+            await extractErrorMessage(response));
+    }
+    const data = await parseJsonPayload(response, `${action === 'archive' ? 'Archive' : 'Restore'} ${artifactType}`);
+    if (io.json) {
+        io.print(JSON.stringify(data));
+        return;
+    }
+    const verb = action === 'archive' ? 'Archived' : 'Restored';
+    const assigneeSuffix = data.artifact.assigneeId
+        ? ` for ${sanitizeTerminalText(data.artifact.assigneeId)}`
+        : '';
+    io.print(`${verb} ${sanitizeTerminalText(data.artifact.type)} ` +
+        `${sanitizeTerminalText(data.artifact.id)}${assigneeSuffix}.`);
+}
+export async function listAssignmentsCommand(args, io) {
+    const status = parseStatus(args);
+    const assigneeId = argValue(args, '--assignee');
+    if (assigneeId && !UUID_PATTERN.test(assigneeId)) {
+        throw new Error('--assignee must be a UUID');
+    }
+    const projectArg = argValue(args, '--project');
+    const project = projectArg || await io.resolveProjectSlug(null);
+    const params = new URLSearchParams({ project, status });
+    if (assigneeId)
+        params.set('assignee', assigneeId);
+    const fetcher = io.fetcher || authedFetch;
+    const response = await fetcher(`/api/cli/assignments?${params.toString()}`);
+    if (!response.ok) {
+        throw new Error(`Failed to list assignments: ${await extractErrorMessage(response)}`);
+    }
+    const data = await parseJsonPayload(response, 'Assignments list');
+    if (io.json) {
+        io.print(JSON.stringify(data));
+        return;
+    }
+    const rows = data.assignments || [];
+    if (rows.length === 0) {
+        io.print('No assignment task-groups found.');
+        return;
+    }
+    const printable = rows.map(row => ({
+        id: sanitizeTerminalText(row.taskId),
+        title: sanitizeTerminalText(row.taskTitle || '-'),
+        lifecycle: sanitizeTerminalText(row.taskStatus || '-'),
+        archive: sanitizeTerminalText(row.status || 'active'),
+        progress: `${row.completedAssignments}/${row.totalAssignments}`,
+    }));
+    const idWidth = Math.max('TASK ID'.length, ...printable.map(row => row.id.length));
+    const titleWidth = Math.max('TASK'.length, ...printable.map(row => row.title.length));
+    const lifecycleWidth = Math.max('LIFECYCLE'.length, ...printable.map(row => row.lifecycle.length));
+    const archiveWidth = Math.max('ARCHIVE'.length, ...printable.map(row => row.archive.length));
+    io.print(`${'TASK ID'.padEnd(idWidth)}  ${'TASK'.padEnd(titleWidth)}  ` +
+        `${'LIFECYCLE'.padEnd(lifecycleWidth)}  ` +
+        `${'ARCHIVE'.padEnd(archiveWidth)}  PROGRESS`);
+    io.print(`${'-'.repeat(idWidth)}  ${'-'.repeat(titleWidth)}  ` +
+        `${'-'.repeat(lifecycleWidth)}  ${'-'.repeat(archiveWidth)}  ` +
+        `${'-'.repeat('PROGRESS'.length)}`);
+    printable.forEach(row => {
+        io.print(`${row.id.padEnd(idWidth)}  ${row.title.padEnd(titleWidth)}  ` +
+            `${row.lifecycle.padEnd(lifecycleWidth)}  ` +
+            `${row.archive.padEnd(archiveWidth)}  ${row.progress}`);
+    });
+}

package/dist/artifact-pull.js

@@ -16,11 +16,9 @@ import { mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';
 import { authedFetch } from './http.js';
+import { sanitizeTerminalText } from './json-response.js';
 // Shared with the runners exec download path in index.ts.
 export const ARTIFACT_MAX_BYTES = 25 * 1024 * 1024;
-function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 function expandHomePath(path) {
     if (path.startsWith('~/')) {
         const home = process.env.HOME || '';

package/dist/dataset-edit-rows.js

@@ -0,0 +1,90 @@
+import { extractErrorMessage } from './error-response.js';
+import { parseDatasetFile } from './file-parser.js';
+import { authedFetch } from './http.js';
+const MAX_REQUEST_BYTES = 3 * 1024 * 1024;
+const MAX_CHUNK_ROWS = 10;
+const EMPTY_REQUEST_BYTES = Buffer.byteLength('{"rows":[]}', 'utf8');
+function normalizeRows(rows) {
+    if (rows.length === 0) {
+        throw new Error('Dataset edit file must contain at least one row');
+    }
+    const seenRowIds = new Set();
+    return rows.map((row, index) => {
+        const rowId = typeof row.id === 'string' ? row.id.trim() : '';
+        if (!rowId) {
+            throw new Error(`Dataset edit file rows[${index}] must include a non-empty string id`);
+        }
+        if (seenRowIds.has(rowId)) {
+            throw new Error(`Dataset edit file rows[${index}].id duplicates a previous row id`);
+        }
+        seenRowIds.add(rowId);
+        return { ...row, id: rowId };
+    });
+}
+function chunkRows(rows, sanitize) {
+    const chunks = [];
+    let currentChunk = [];
+    let currentBytes = EMPTY_REQUEST_BYTES;
+    for (const row of rows) {
+        const rowBytes = Buffer.byteLength(JSON.stringify(row), 'utf8');
+        const framedRowBytes = rowBytes + (currentChunk.length > 0 ? 1 : 0);
+        if (currentChunk.length > 0 &&
+            (currentChunk.length >= MAX_CHUNK_ROWS || currentBytes + framedRowBytes > MAX_REQUEST_BYTES)) {
+            chunks.push(currentChunk);
+            currentChunk = [];
+            currentBytes = EMPTY_REQUEST_BYTES;
+        }
+        const singleRowRequestBytes = EMPTY_REQUEST_BYTES + rowBytes;
+        if (singleRowRequestBytes > MAX_REQUEST_BYTES) {
+            throw new Error(`Dataset edit row ${sanitize(row.id)} is ${singleRowRequestBytes} bytes, ` +
+                `which exceeds the ${MAX_REQUEST_BYTES}-byte edit request limit`);
+        }
+        currentChunk.push(row);
+        currentBytes += rowBytes + (currentChunk.length > 1 ? 1 : 0);
+    }
+    if (currentChunk.length > 0)
+        chunks.push(currentChunk);
+    return chunks;
+}
+export async function editDatasetRows(options) {
+    const { rows } = parseDatasetFile(options.file);
+    const chunks = chunkRows(normalizeRows(rows), options.sanitize);
+    let totalUpdated = 0;
+    let lastResult = null;
+    for (let index = 0; index < chunks.length; index += 1) {
+        const chunk = chunks[index];
+        if (!options.json && chunks.length > 1) {
+            options.printLine(`Updating chunk ${index + 1}/${chunks.length} (${chunk.length} rows)...`);
+        }
+        try {
+            const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(options.datasetId)}/rows`, {
+                method: 'PATCH',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ rows: chunk }),
+            });
+            if (!response.ok) {
+                throw new Error(`HTTP ${response.status}: ${await extractErrorMessage(response)}`);
+            }
+            const data = await response.json();
+            if (!Number.isInteger(data.updatedCount) || data.updatedCount !== chunk.length) {
+                throw new Error(`Server reported ${String(data.updatedCount)} updated rows for a ${chunk.length}-row chunk`);
+            }
+            totalUpdated += data.updatedCount;
+            lastResult = data;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`Chunk ${index + 1}/${chunks.length} failed: ${message}\n` +
+                `${totalUpdated} rows from ${index} chunk(s) were already updated. ` +
+                'Retry with a file containing only the remaining row edits.');
+        }
+    }
+    if (!lastResult)
+        throw new Error('Dataset edit file must contain at least one row');
+    if (options.json) {
+        options.printJson({ dataset: lastResult.dataset, updatedCount: totalUpdated });
+        return;
+    }
+    options.printLine(`Updated ${totalUpdated} rows in dataset ${options.sanitize(lastResult.dataset.name)} ` +
+        `(${options.sanitize(lastResult.dataset.id)}). Current row count: ${lastResult.dataset.rowCount}`);
+}

package/dist/dataset-upload-snapshot.js

@@ -0,0 +1,22 @@
+export async function ensureDatasetUploadSnapshot(dataset, jsonOutput, createSnapshot) {
+    try {
+        return await createSnapshot(dataset.id);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        const retryCommand = `orizu datasets versions create --dataset ${dataset.id}`;
+        if (jsonOutput) {
+            throw new Error(JSON.stringify({
+                error: 'Dataset upload completed but dataset version creation failed',
+                detail,
+                upload_completed: true,
+                dataset_id: dataset.id,
+                dataset_version_id: null,
+                retry_command: retryCommand,
+            }));
+        }
+        throw new Error(`Dataset upload completed but dataset version creation failed: ${detail}\n` +
+            `Dataset ${dataset.name} (${dataset.id}) was created with ${dataset.rowCount} rows. ` +
+            `Retry only the snapshot step with: ${retryCommand}`);
+    }
+}

package/dist/diff-comments-cli.js

@@ -0,0 +1,175 @@
+import { extractErrorMessage, isJsonErrorResponsePayload, } from './error-response.js';
+import { sanitizeHumanInlineText } from './json-response.js';
+const DETAIL_LEVELS = ['hunk', 'diff', 'full'];
+const CONTEXT_UNAVAILABLE_WITHOUT_REASON = '    Context unavailable (no reason supplied)';
+function isCandidatePair(pair) {
+    return 'candidateId' in pair.from;
+}
+function usage() {
+    return 'Usage: orizu comments diff (--run <run-id> | --prompt <prompt-id>) [--from <revision> --to <revision>] [--detail hunk|diff|full] [--json]';
+}
+function sanitizeHumanText(ctx, value) {
+    return ctx.sanitizeTerminalText(value).replaceAll('\r', '');
+}
+// Quote untrusted multiline blocks so none of their rows can impersonate a
+// genuine hunk row, whose marker begins immediately after the four-space indent.
+function printHumanTextBlock(ctx, value) {
+    for (const line of sanitizeHumanText(ctx, value).split('\n')) {
+        ctx.printLine(`    │ ${line}`);
+    }
+}
+function hasExplicitlyEmptyJsonError(response, rawBody) {
+    try {
+        const payload = JSON.parse(rawBody);
+        return isJsonErrorResponsePayload(response, payload) && payload.error.length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function extractDiffCommentsErrorMessage(response) {
+    const statusFallback = `HTTP ${response.status}`;
+    try {
+        const rawBody = await response.text();
+        if (hasExplicitlyEmptyJsonError(response, rawBody)) {
+            return statusFallback;
+        }
+        const copiedResponse = new Response(rawBody, { headers: response.headers });
+        const extractedMessage = await extractErrorMessage(copiedResponse);
+        return extractedMessage.trim() ? extractedMessage : statusFallback;
+    }
+    catch {
+        return statusFallback;
+    }
+}
+function humanLineNumber(ctx, line) {
+    return line === null
+        ? '-'
+        : sanitizeHumanInlineText(ctx.sanitizeTerminalText, String(line + 1));
+}
+function buildParams(ctx) {
+    const runId = ctx.getArg('--run');
+    const promptId = ctx.getArg('--prompt');
+    const from = ctx.getArg('--from');
+    const to = ctx.getArg('--to');
+    const detail = ctx.getArg('--detail') ?? 'diff';
+    for (const [name, value] of [
+        ['--run', runId],
+        ['--prompt', promptId],
+        ['--from', from],
+        ['--to', to],
+        ['--detail', detail],
+    ]) {
+        ctx.rejectDashPrefixedOptionValue(name, value);
+    }
+    if (runId === '' || promptId === '') {
+        throw new Error(usage());
+    }
+    if (Number(Boolean(runId)) + Number(Boolean(promptId)) !== 1) {
+        throw new Error(usage());
+    }
+    if (from === '' || to === '') {
+        throw new Error('--from and --to must not be empty');
+    }
+    if (Boolean(from) !== Boolean(to)) {
+        throw new Error('--from and --to must be provided together');
+    }
+    if (!DETAIL_LEVELS.includes(detail)) {
+        throw new Error('--detail must be hunk, diff, or full');
+    }
+    if (promptId && from && to) {
+        if (!Number.isInteger(Number(from)) || !Number.isInteger(Number(to))) {
+            throw new Error('--from and --to must be integer prompt versions');
+        }
+    }
+    const params = new URLSearchParams();
+    params.set(runId ? 'run' : 'prompt', (runId ?? promptId));
+    if (from && to) {
+        params.set('from', from);
+        params.set('to', to);
+    }
+    params.set('detail', detail);
+    return params;
+}
+function printDiffComments(ctx, payload) {
+    ctx.printLine(`Diff comments: ${payload.pairs.length} pair${payload.pairs.length === 1 ? '' : 's'}`);
+    if (payload.pairs.length === 0) {
+        ctx.printLine('');
+        ctx.printLine('No diff comments found.');
+        return;
+    }
+    for (const pair of payload.pairs) {
+        const hasCandidateIds = isCandidatePair(pair);
+        const from = hasCandidateIds ? pair.from.candidateId : String(pair.from.version);
+        const to = hasCandidateIds ? pair.to.candidateId : String(pair.to.version);
+        ctx.printLine('');
+        ctx.printLine(`${hasCandidateIds ? 'Candidates' : 'Versions'} ` +
+            `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, from)} → ` +
+            `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, to)}`);
+        if (pair.degraded) {
+            ctx.printLine(`  Context unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, pair.degraded.reason)}`);
+        }
+        if (pair.diff !== null) {
+            ctx.printLine('  Diff:');
+            printHumanTextBlock(ctx, pair.diff);
+        }
+        if (pair.bodies !== null) {
+            for (const [label, body] of [
+                ['From body', pair.bodies.from],
+                ['To body', pair.bodies.to],
+            ]) {
+                ctx.printLine(`  ${label}:`);
+                printHumanTextBlock(ctx, body);
+            }
+        }
+        for (const comment of pair.comments) {
+            const authorName = comment.author?.person?.name || comment.author?.name || 'Unknown';
+            ctx.printLine(`  ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.id)} · ` +
+                `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, authorName)} · ` +
+                `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.createdAt)} · ` +
+                `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.anchor.side)} line ` +
+                `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, String(comment.anchor.line + 1))}`);
+            printHumanTextBlock(ctx, comment.body);
+            if (comment.contextUnavailableReason) {
+                ctx.printLine(`    Context unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.contextUnavailableReason)}`);
+                if (comment.context) {
+                    ctx.printLine(`    Anchored line: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.context.lineText)}`);
+                }
+                continue;
+            }
+            if (!comment.context) {
+                ctx.printLine(CONTEXT_UNAVAILABLE_WITHOUT_REASON);
+                continue;
+            }
+            if (!comment.context.hunk) {
+                ctx.printLine(CONTEXT_UNAVAILABLE_WITHOUT_REASON);
+                ctx.printLine(`    Anchored line: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.context.lineText)}`);
+                continue;
+            }
+            for (const line of comment.context.hunk.lines) {
+                const prefix = line.op === 'add' ? '+' : line.op === 'del' ? '-' : ' ';
+                const isAnchored = comment.anchor.side === 'old'
+                    ? line.oldLine === comment.anchor.line
+                    : line.newLine === comment.anchor.line;
+                const marker = isAnchored ? '>' : ' ';
+                ctx.printLine(`    ${marker} old:${humanLineNumber(ctx, line.oldLine)} ` +
+                    `new:${humanLineNumber(ctx, line.newLine)} | ` +
+                    `${prefix}${sanitizeHumanInlineText(ctx.sanitizeTerminalText, line.text)}`);
+            }
+        }
+    }
+}
+export async function diffCommentsCommand(ctx) {
+    const params = buildParams(ctx);
+    const response = await ctx.authedFetch(`/api/cli/diff-comments?${params.toString()}`);
+    if (!response.ok) {
+        const message = await extractDiffCommentsErrorMessage(response);
+        throw new Error(`Failed to fetch diff comments: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, message)}`);
+    }
+    const payload = await ctx.parseJsonResponse(response, 'Diff comments');
+    if (ctx.hasJsonFlag()) {
+        ctx.printJson(payload);
+        return;
+    }
+    printDiffComments(ctx, payload);
+}

package/dist/egress-policy.js

@@ -117,6 +117,17 @@ export function baseEgressDomains(opts = {}) {
     }
     for (const d of GIT_HOST_DOMAINS)
         domains.add(d);
+    for (const d of opts.repositoryHosts ?? []) {
+        const normalized = normalizeEgressDomain(d);
+        // Repository hosts come from a validated remote and must remain exact:
+        // no URL normalization, leading wildcard, path, port, or case drift is
+        // accepted at this final firewall seam.
+        if (normalized &&
+            !normalized.startsWith('*.') &&
+            normalized === d.trim().toLowerCase()) {
+            domains.add(normalized);
+        }
+    }
     return [...domains];
 }
 /**
@@ -136,6 +147,7 @@ export function buildEgressPolicy(opts = {}) {
         orizuBaseUrl: opts.orizuBaseUrl,
         modelHost: brokerHost,
         modelHosts: opts.modelHosts,
+        repositoryHosts: opts.repositoryHosts,
     });
     const allow = {};
     for (const domain of base)

package/dist/error-response.js

@@ -1,20 +1,26 @@
-export async function extractErrorMessage(response) {
+import { sanitizeTerminalText } from './json-response.js';
+const ERROR_BODY_PREVIEW_LIMIT = 180;
+export function isJsonErrorResponsePayload(response, payload) {
     const contentType = response.headers.get('content-type') || '';
+    return (contentType.includes('application/json') &&
+        payload !== null &&
+        typeof payload === 'object' &&
+        !Array.isArray(payload) &&
+        typeof payload.error === 'string');
+}
+function boundedTerminalPreview(value) {
+    return sanitizeTerminalText(value).slice(0, ERROR_BODY_PREVIEW_LIMIT);
+}
+export async function extractErrorMessage(response) {
     const rawBody = await response.text();
-    if (contentType.includes('application/json')) {
-        try {
-            const payload = JSON.parse(rawBody);
-            if (payload &&
-                typeof payload === 'object' &&
-                !Array.isArray(payload) &&
-                typeof payload.error === 'string' &&
-                payload.error.length > 0) {
-                return payload.error;
-            }
-        }
-        catch {
-            // Fall through to raw body
+    try {
+        const payload = JSON.parse(rawBody);
+        if (isJsonErrorResponsePayload(response, payload) && payload.error.length > 0) {
+            return boundedTerminalPreview(payload.error);
         }
     }
-    return rawBody;
+    catch {
+        // Fall through to raw body
+    }
+    return boundedTerminalPreview(rawBody);
 }