orizu 0.5.17 → 0.5.18

package/README.md

@@ -173,6 +173,14 @@ orizu logout
     <td>Archive or restore a prompt</td>
     <td><code>orizu prompts archive &lt;promptIdOrName&gt; --project ops-eval/support-qa</code><br><code>orizu prompts restore &lt;promptIdOrName&gt; --project ops-eval/support-qa</code></td>
   </tr>
+  <tr>
+    <td>Push a prompt with a report</td>
+    <td><code>orizu prompts push ./prompts/support --project ops-eval/support-qa --report-file ./prompt-report.md</code></td>
+  </tr>
+  <tr>
+    <td>Upload a report for an existing prompt version</td>
+    <td><code>orizu prompts report set --prompt &lt;promptIdOrName&gt; --project ops-eval/support-qa --version 3 --report-file ./prompt-report.md</code><br><code>prompts report upload</code> is an exact alias; select exactly one of <code>--version</code> or <code>--version-id</code>.</td>
+  </tr>
   <tr>
     <td colspan="2"><strong>Report comments</strong></td>
   </tr>
@@ -184,6 +192,13 @@ orizu logout
     <td>Add or update comments</td>
     <td><code>orizu comments add --run &lt;runId&gt; --body @comment.md --anchor "Summary" --lines 4:6</code><br><code>orizu comments reply &lt;commentId&gt; --body "Fixed"</code><br><code>orizu comments resolve &lt;commentId&gt;</code></td>
   </tr>
+  <tr>
+    <td colspan="2"><strong>Diff comments</strong></td>
+  </tr>
+  <tr>
+    <td>Export diff comments</td>
+    <td><code>orizu comments diff --run &lt;optimizationRunId&gt; [--from &lt;candidateId&gt; --to &lt;candidateId&gt;] [--detail hunk|diff|full] [--json]</code><br><code>orizu comments diff --prompt &lt;promptId&gt; [--from &lt;version&gt; --to &lt;version&gt;] [--detail hunk|diff|full] [--json]</code></td>
+  </tr>
   <tr>
     <td colspan="2"><strong>Datasets</strong></td>
   </tr>

package/dist/archive-artifacts-cli.js

@@ -7,6 +7,7 @@
  */
 import { authedFetch } from './http.js';
 import { extractErrorMessage } from './error-response.js';
+import { sanitizeTerminalText } from './json-response.js';
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const ARTIFACT_TYPES = {
     app: 'app',
@@ -31,9 +32,6 @@ function argValue(args, flag) {
     }
     return args[index + 1];
 }
-function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 function columnWidths(headers, rows) {
     return headers.map((header, index) => Math.max(header.length, ...rows.map(row => row[index]?.length || 0)));
 }

package/dist/artifact-pull.js

@@ -16,11 +16,9 @@ import { mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';
 import { authedFetch } from './http.js';
+import { sanitizeTerminalText } from './json-response.js';
 // Shared with the runners exec download path in index.ts.
 export const ARTIFACT_MAX_BYTES = 25 * 1024 * 1024;
-function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 function expandHomePath(path) {
     if (path.startsWith('~/')) {
         const home = process.env.HOME || '';

package/dist/diff-comments-cli.js

@@ -1,4 +1,7 @@
+import { extractErrorMessage, isJsonErrorResponsePayload, } from './error-response.js';
+import { sanitizeHumanInlineText } from './json-response.js';
 const DETAIL_LEVELS = ['hunk', 'diff', 'full'];
+const CONTEXT_UNAVAILABLE_WITHOUT_REASON = '    Context unavailable (no reason supplied)';
 function isCandidatePair(pair) {
     return 'candidateId' in pair.from;
 }
@@ -8,11 +11,41 @@ function usage() {
 function sanitizeHumanText(ctx, value) {
     return ctx.sanitizeTerminalText(value).replaceAll('\r', '');
 }
-function sanitizeHumanInlineText(ctx, value) {
-    return sanitizeHumanText(ctx, value).replaceAll('\n', '\\n');
+// Quote untrusted multiline blocks so none of their rows can impersonate a
+// genuine hunk row, whose marker begins immediately after the four-space indent.
+function printHumanTextBlock(ctx, value) {
+    for (const line of sanitizeHumanText(ctx, value).split('\n')) {
+        ctx.printLine(`    │ ${line}`);
+    }
+}
+function hasExplicitlyEmptyJsonError(response, rawBody) {
+    try {
+        const payload = JSON.parse(rawBody);
+        return isJsonErrorResponsePayload(response, payload) && payload.error.length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function extractDiffCommentsErrorMessage(response) {
+    const statusFallback = `HTTP ${response.status}`;
+    try {
+        const rawBody = await response.text();
+        if (hasExplicitlyEmptyJsonError(response, rawBody)) {
+            return statusFallback;
+        }
+        const copiedResponse = new Response(rawBody, { headers: response.headers });
+        const extractedMessage = await extractErrorMessage(copiedResponse);
+        return extractedMessage.trim() ? extractedMessage : statusFallback;
+    }
+    catch {
+        return statusFallback;
+    }
 }
 function humanLineNumber(ctx, line) {
-    return line === null ? '-' : sanitizeHumanText(ctx, String(line + 1));
+    return line === null
+        ? '-'
+        : sanitizeHumanInlineText(ctx.sanitizeTerminalText, String(line + 1));
 }
 function buildParams(ctx) {
     const runId = ctx.getArg('--run');
@@ -29,9 +62,15 @@ function buildParams(ctx) {
     ]) {
         ctx.rejectDashPrefixedOptionValue(name, value);
     }
+    if (runId === '' || promptId === '') {
+        throw new Error(usage());
+    }
     if (Number(Boolean(runId)) + Number(Boolean(promptId)) !== 1) {
         throw new Error(usage());
     }
+    if (from === '' || to === '') {
+        throw new Error('--from and --to must not be empty');
+    }
     if (Boolean(from) !== Boolean(to)) {
         throw new Error('--from and --to must be provided together');
     }
@@ -65,15 +104,14 @@ function printDiffComments(ctx, payload) {
         const to = hasCandidateIds ? pair.to.candidateId : String(pair.to.version);
         ctx.printLine('');
         ctx.printLine(`${hasCandidateIds ? 'Candidates' : 'Versions'} ` +
-            `${sanitizeHumanInlineText(ctx, from)} → ${sanitizeHumanInlineText(ctx, to)}`);
+            `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, from)} → ` +
+            `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, to)}`);
         if (pair.degraded) {
-            ctx.printLine(`  Context unavailable: ${sanitizeHumanText(ctx, pair.degraded.reason)}`);
+            ctx.printLine(`  Context unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, pair.degraded.reason)}`);
         }
         if (pair.diff !== null) {
             ctx.printLine('  Diff:');
-            for (const line of sanitizeHumanText(ctx, pair.diff).split('\n')) {
-                ctx.printLine(`    ${line}`);
-            }
+            printHumanTextBlock(ctx, pair.diff);
         }
         if (pair.bodies !== null) {
             for (const [label, body] of [
@@ -81,24 +119,31 @@ function printDiffComments(ctx, payload) {
                 ['To body', pair.bodies.to],
             ]) {
                 ctx.printLine(`  ${label}:`);
-                for (const line of sanitizeHumanText(ctx, body).split('\n')) {
-                    ctx.printLine(`    ${line}`);
-                }
+                printHumanTextBlock(ctx, body);
             }
         }
         for (const comment of pair.comments) {
             const authorName = comment.author?.person?.name || comment.author?.name || 'Unknown';
-            ctx.printLine(`  ${sanitizeHumanInlineText(ctx, comment.id)} · ` +
-                `${sanitizeHumanInlineText(ctx, authorName)} · ` +
-                `${sanitizeHumanInlineText(ctx, comment.createdAt)} · ` +
-                `${sanitizeHumanInlineText(ctx, comment.anchor.side)} line ` +
-                `${sanitizeHumanInlineText(ctx, String(comment.anchor.line + 1))}`);
-            for (const line of sanitizeHumanText(ctx, comment.body).split('\n')) {
-                ctx.printLine(`    ${line}`);
+            ctx.printLine(`  ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.id)} · ` +
+                `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, authorName)} · ` +
+                `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.createdAt)} · ` +
+                `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.anchor.side)} line ` +
+                `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, String(comment.anchor.line + 1))}`);
+            printHumanTextBlock(ctx, comment.body);
+            if (comment.contextUnavailableReason) {
+                ctx.printLine(`    Context unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.contextUnavailableReason)}`);
+                if (comment.context) {
+                    ctx.printLine(`    Anchored line: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.context.lineText)}`);
+                }
+                continue;
             }
             if (!comment.context) {
-                ctx.printLine(`    Context unavailable: ` +
-                    `${sanitizeHumanText(ctx, comment.contextUnavailableReason ?? 'body_unresolvable')}`);
+                ctx.printLine(CONTEXT_UNAVAILABLE_WITHOUT_REASON);
+                continue;
+            }
+            if (!comment.context.hunk) {
+                ctx.printLine(CONTEXT_UNAVAILABLE_WITHOUT_REASON);
+                ctx.printLine(`    Anchored line: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.context.lineText)}`);
                 continue;
             }
             for (const line of comment.context.hunk.lines) {
@@ -109,7 +154,7 @@ function printDiffComments(ctx, payload) {
                 const marker = isAnchored ? '>' : ' ';
                 ctx.printLine(`    ${marker} old:${humanLineNumber(ctx, line.oldLine)} ` +
                     `new:${humanLineNumber(ctx, line.newLine)} | ` +
-                    `${prefix}${sanitizeHumanText(ctx, line.text)}`);
+                    `${prefix}${sanitizeHumanInlineText(ctx.sanitizeTerminalText, line.text)}`);
             }
         }
     }
@@ -118,17 +163,8 @@ export async function diffCommentsCommand(ctx) {
     const params = buildParams(ctx);
     const response = await ctx.authedFetch(`/api/cli/diff-comments?${params.toString()}`);
     if (!response.ok) {
-        let message = `HTTP ${response.status}`;
-        try {
-            const payload = await response.clone().json();
-            if (typeof payload.error === 'string' && payload.error.trim()) {
-                message = sanitizeHumanInlineText(ctx, payload.error);
-            }
-        }
-        catch {
-            // Keep the status-only error for non-JSON responses.
-        }
-        throw new Error(`Failed to fetch diff comments: ${message}`);
+        const message = await extractDiffCommentsErrorMessage(response);
+        throw new Error(`Failed to fetch diff comments: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, message)}`);
     }
     const payload = await ctx.parseJsonResponse(response, 'Diff comments');
     if (ctx.hasJsonFlag()) {

package/dist/error-response.js

@@ -1,26 +1,26 @@
+import { sanitizeTerminalText } from './json-response.js';
 const ERROR_BODY_PREVIEW_LIMIT = 180;
+export function isJsonErrorResponsePayload(response, payload) {
+    const contentType = response.headers.get('content-type') || '';
+    return (contentType.includes('application/json') &&
+        payload !== null &&
+        typeof payload === 'object' &&
+        !Array.isArray(payload) &&
+        typeof payload.error === 'string');
+}
 function boundedTerminalPreview(value) {
-    return String(value)
-        .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '')
-        .slice(0, ERROR_BODY_PREVIEW_LIMIT);
+    return sanitizeTerminalText(value).slice(0, ERROR_BODY_PREVIEW_LIMIT);
 }
 export async function extractErrorMessage(response) {
-    const contentType = response.headers.get('content-type') || '';
     const rawBody = await response.text();
-    if (contentType.includes('application/json')) {
-        try {
-            const payload = JSON.parse(rawBody);
-            if (payload &&
-                typeof payload === 'object' &&
-                !Array.isArray(payload) &&
-                typeof payload.error === 'string' &&
-                payload.error.length > 0) {
-                return boundedTerminalPreview(payload.error);
-            }
-        }
-        catch {
-            // Fall through to raw body
+    try {
+        const payload = JSON.parse(rawBody);
+        if (isJsonErrorResponsePayload(response, payload) && payload.error.length > 0) {
+            return boundedTerminalPreview(payload.error);
         }
     }
+    catch {
+        // Fall through to raw body
+    }
     return boundedTerminalPreview(rawBody);
 }

package/dist/github-setup.js

@@ -17,16 +17,8 @@ import { spawnSync } from 'child_process';
 import { existsSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { authedFetch } from './http.js';
+import { sanitizeTerminalText } from './json-response.js';
 import { assertWorkspaceDirUsable, workspaceExists } from './workspace.js';
-/**
- * Strip terminal control characters from server-supplied strings before they
- * are printed (mirrors index.ts `sanitizeTerminalText`), so a hostile or
- * mangled provisioning `warnings[]`/`defaultBranch` value can't inject escape
- * sequences into the user's terminal.
- */
-function sanitizeServerText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 const DEFAULT_POLL_INTERVAL_MS = 2000;
 // ALI-1141: long enough for a slow org-picker + repo-selection walk, but the
 // wait MUST be finite — when the App is already installed in the target org,
@@ -231,10 +223,10 @@ export async function runHostedAttach(options, io) {
         repoFullName = data.repo;
         provisioned = true;
         if (data.rulesetApplied === true) {
-            io.print(`   Default-branch protection applied (ruleset "orizu-default-branch-protection"${data.defaultBranch ? ` on ${sanitizeServerText(data.defaultBranch)}` : ''}).`);
+            io.print(`   Default-branch protection applied (ruleset "orizu-default-branch-protection"${data.defaultBranch ? ` on ${sanitizeTerminalText(data.defaultBranch)}` : ''}).`);
         }
         for (const warning of data.warnings ?? []) {
-            io.print(`   ⚠ ${sanitizeServerText(warning)}`);
+            io.print(`   ⚠ ${sanitizeTerminalText(warning)}`);
         }
     }
     const cleanUrl = `https://github.com/${repoFullName}.git`;

package/dist/help.js

@@ -337,10 +337,30 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['prompts', 'push'],
-        usage: 'orizu prompts push <dir> [--runner-version <id>] [--project <team/project>] [--parent <version-id>] [--session <session-id>] [--json]',
+        usage: 'orizu prompts push <dir> [--runner-version <id>] [--project <team/project>] [--parent <version-id>] [--session <session-id>] [--report-file <path>] [--json]',
         summary: 'Push a local prompt artifact directory as a new version (with --session: a commit-first git draft).',
         group: 'Prompts and judges',
     },
+    {
+        path: ['prompts', 'report', 'set'],
+        usage: 'orizu prompts report set --prompt <id-or-name> --project <team/project> (--version <n> | --version-id <id>) (--report <markdown|@file> | --report-file <path>) [--json]',
+        summary: 'Upload or replace the Markdown report for one explicit prompt version.',
+        group: 'Prompts and judges',
+        aliases: [['prompts', 'report', 'upload']],
+        options: [
+            { name: '--prompt <id-or-name>', help: 'Prompt ID or name.', required: true },
+            { name: '--project <team/project>', help: 'Project slug containing the prompt.', required: true },
+            { name: '--version <n>', help: 'Positive prompt version number.' },
+            { name: '--version-id <id>', help: 'Explicit prompt version ID.' },
+            { name: '--report <markdown|@file>', help: 'Inline Markdown or an @file reference.' },
+            { name: '--report-file <path>', help: 'Markdown file to upload.' },
+            { name: '--json', help: 'Emit the updated prompt report payload.' },
+        ],
+        examples: [
+            'orizu prompts report set --prompt Generator --project core/evals --version 3 --report-file ./report.md',
+            'orizu prompts report upload --prompt Generator --project core/evals --version-id <id> --report @./report.md',
+        ],
+    },
     {
         path: ['prompts', 'labels', 'set'],
         usage: 'orizu prompts labels set <prompt-name> <label> --version <version-id> [--project <team/project>] [--json]',
@@ -373,7 +393,7 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['judges', 'push'],
-        usage: 'orizu judges push <dir> [--runner-version <id>] [--project <team/project>] [--parent <version-id>] [--session <session-id>] [--json]',
+        usage: 'orizu judges push <dir> [--runner-version <id>] [--project <team/project>] [--parent <version-id>] [--session <session-id>] [--report-file <path>] [--json]',
         summary: 'Push a local judge artifact directory as a new version (with --session: a commit-first git draft).',
         group: 'Prompts and judges',
     },

package/dist/index.js

@@ -41,12 +41,17 @@ import { hostedCommand } from './hosted-session-cli.js';
 import { workspaceSyncCommand } from './workspace-sync.js';
 import { runGitCredentialInvocation } from './git-credential.js';
 import { pushPromptDraft } from './prompt-draft-push.js';
+import { readMarkdownReportInput } from './markdown-report-input.js';
+import { promptPushErrorMessage, promptReportCommand } from './prompt-report-cli.js';
 import { assertSnapshotManifestConfined, verifyGepaRunnerDirsFromArgs, verifyRunnerDirRegistered } from './runner-dir-verify.js';
 import { runScorersRegister } from './scorer-draft-push.js';
 import { runZipArtifactPush } from './zip-draft-push.js';
 import { runGithubLink, runInteractiveHostedSetup } from './github-setup.js';
+import { parseJsonResponse, sanitizeTerminalText } from './json-response.js';
 import { reportCommentsCommand, throwDeprecatedPromptCommentsCommand, } from './report-comments-cli.js';
 import { diffCommentsCommand } from './diff-comments-cli.js';
+import { exportOptimizationRunCommand } from './optimization-export-cli.js';
+export { parseJsonResponse, sanitizeTerminalText } from './json-response.js';
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -176,9 +181,6 @@ function createCodeVerifier() {
 export function createCodeChallenge(verifier) {
     return createHash('sha256').update(verifier).digest('base64url');
 }
-export function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 function printError(message) {
     console.error(sanitizeTerminalText(message));
 }
@@ -241,21 +243,6 @@ export function formatTerminalLink(url) {
     }
     return `\u001B]8;;${safeUrl}\u0007${safeUrl}\u001B]8;;\u0007`;
 }
-export async function parseJsonResponse(response, context) {
-    const contentType = response.headers.get('content-type') || '';
-    const rawBody = await response.text();
-    if (!contentType.includes('application/json')) {
-        throw new Error(`${context} returned non-JSON response (status ${response.status}). ` +
-            `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
-    }
-    try {
-        return JSON.parse(rawBody);
-    }
-    catch {
-        throw new Error(`${context} returned invalid JSON (status ${response.status}). ` +
-            `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
-    }
-}
 function shellQuote(value) {
     return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }
@@ -1014,14 +1001,17 @@ async function pushRunnerArtifact(kind) {
 }
 async function pushPromptArtifact(kind) {
     const promptDir = getPositionalArg(2);
-    const project = getArg('--project') || await resolveProjectSlug(null);
+    const projectArg = getArg('--project');
     const runnerVersionArg = getArg('--runner-version');
     const parentVersionId = getArg('--parent') || undefined;
     const sessionId = getArg('--session') || undefined;
-    const usage = `Usage: orizu ${kind === 'judge' ? 'judges' : 'prompts'} push <dir> --project <team/project> [--runner-version <id>] [--parent <version-id>] [--session <session-id>] [--json]`;
-    if (!promptDir) {
+    const usage = `Usage: orizu ${kind === 'judge' ? 'judges' : 'prompts'} push <dir> --project <team/project> [--runner-version <id>] [--parent <version-id>] [--session <session-id>] [--report-file <path>] [--json]`;
+    if (!promptDir)
         throw new Error(usage);
-    }
+    if (cliArgs.some(arg => arg === '--report' || arg.startsWith('--report=')))
+        throw new Error(`${kind === 'judge' ? 'judges' : 'prompts'} push accepts report input only through --report-file`);
+    const report = readMarkdownReportInput(cliArgs, 'Prompt');
+    const project = projectArg || await resolveProjectSlug(null);
     const promptRoot = expandHomePath(promptDir);
     const manifest = readJsonFile(join(promptRoot, 'orizu.prompt.json'));
     const primaryText = readPromptPrimaryText(manifest, promptRoot);
@@ -1040,6 +1030,7 @@ async function pushPromptArtifact(kind) {
             kind, project, sessionId, manifest, sidecars, runnerVersionId, parentVersionId,
             displayName: String(manifest.name || promptDir),
             bodyKind: primaryText.bodyKind, primaryBody: primaryText.body,
+            report,
         });
         if (hasJsonFlag())
             printJson(data);
@@ -1074,10 +1065,16 @@ async function pushPromptArtifact(kind) {
             parentVersionId,
             versionLabel: manifest.version_label,
             createdBy: manifest.provenance || { kind: 'human-edit' },
+            ...(report
+                ? {
+                    reportMarkdown: report.markdown,
+                    reportSourceName: report.sourceName,
+                }
+                : {}),
         }),
     });
     if (!response.ok) {
-        throw new Error(`Failed to push ${kind}: ${await response.text()}`);
+        throw new Error(await promptPushErrorMessage(response, kind, Boolean(report)));
     }
     const data = await parseJsonResponse(response, `${kind} push`);
     if (hasJsonFlag()) {
@@ -1658,7 +1655,6 @@ async function execScorer() {
         printLine(`Wrote scorer result to ${sanitizeTerminalText(outPath)}`);
     }
 }
-const MARKDOWN_REPORT_MAX_BYTES = 2 * 1024 * 1024;
 function parseOptionalNumberFlag(name) {
     const value = getArg(name);
     if (!value) {
@@ -1673,47 +1669,11 @@ function parseOptionalNumberFlag(name) {
 function hasObjectKeys(value) {
     return Object.keys(value).length > 0;
 }
-function readMarkdownReportInput(reportLabel) {
-    const report = getArg('--report');
-    const reportFile = getArg('--report-file');
-    rejectDashPrefixedOptionValue('--report', report);
-    rejectDashPrefixedOptionValue('--report-file', reportFile);
-    if (report && reportFile) {
-        throw new Error('Use either --report or --report-file, not both');
-    }
-    if (!report && !reportFile) {
-        return null;
-    }
-    let markdown;
-    let sourceName;
-    if (reportFile) {
-        const expandedPath = expandHomePath(reportFile);
-        markdown = readSourceFile(reportFile);
-        sourceName = basename(expandedPath);
-    }
-    else if (report?.startsWith('@')) {
-        const path = report.slice(1);
-        const expandedPath = expandHomePath(path);
-        markdown = readSourceFile(path);
-        sourceName = basename(expandedPath);
-    }
-    else {
-        markdown = report || '';
-        sourceName = 'inline';
-    }
-    if (!markdown.trim()) {
-        throw new Error(`${reportLabel} report markdown must not be blank`);
-    }
-    if (Buffer.byteLength(markdown, 'utf8') > MARKDOWN_REPORT_MAX_BYTES) {
-        throw new Error(`${reportLabel} report exceeds ${MARKDOWN_REPORT_MAX_BYTES} bytes`);
-    }
-    return { markdown, sourceName };
-}
 function readOptimizationReportInput() {
-    return readMarkdownReportInput('Optimization');
+    return readMarkdownReportInput(cliArgs, 'Optimization');
 }
 function readTaskReportInput() {
-    return readMarkdownReportInput('Task');
+    return readMarkdownReportInput(cliArgs, 'Task');
 }
 async function startOptimizationRun() {
     const project = getArg('--project') || await resolveProjectSlug(null);
@@ -1853,27 +1813,6 @@ async function updateOptimizationRunLifecycle(action) {
         printLine(`Cancelled optimization run ${id}`);
     }
 }
-async function exportOptimizationRun() {
-    const runId = getPositionalArg(2) || getArg('--run-id');
-    const outPathArg = getArg('--out');
-    if (!runId) {
-        throw new Error('Usage: orizu optimizations export <run-id> [--out <path>] [--json]');
-    }
-    const response = await authedFetch(`/api/cli/optimization-runs/${encodeURIComponent(runId)}/export`);
-    if (!response.ok) {
-        throw new Error(`Failed to export optimization run: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization export');
-    if (hasJsonFlag() && !outPathArg) {
-        printJson(data);
-        return;
-    }
-    const filename = outPathArg
-        ? expandHomePath(outPathArg)
-        : `${runId}.optimization.json`;
-    writeTextFileEnsuringDir(filename, `${JSON.stringify(data, null, 2)}\n`);
-    printLine(`Saved optimization export to ${sanitizeTerminalText(filename)}`);
-}
 // ALI-1073 list moved to optimizations-list-cli.ts (line ratchet, ALI-976);
 // ALI-1175 labels its best scores as agent-reported evidence there.
 function removeFlagWithValue(args, flag) {
@@ -4929,6 +4868,13 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await pushPromptArtifact('prompt');
         return;
     }
+    if (command === 'prompts' && subcommand === 'report' &&
+        (cliArgs[2] === 'set' || cliArgs[2] === 'upload')) {
+        await promptReportCommand(cliArgs, {
+            resolveProjectSlug, json: hasJsonFlag(), printJson, printLine,
+        });
+        return;
+    }
     if (command === 'prompts' && subcommand === 'archive') {
         await setPromptArchivedState(true);
         return;
@@ -5032,7 +4978,17 @@ export async function main(rawArgs = process.argv.slice(2)) {
         return;
     }
     if (command === 'optimizations' && subcommand === 'export') {
-        await exportOptimizationRun();
+        await exportOptimizationRunCommand({
+            getArg,
+            getPositionalArg,
+            authedFetch,
+            hasJsonFlag,
+            printJson,
+            printLine,
+            expandHomePath,
+            writeTextFileEnsuringDir,
+            sanitizeTerminalText,
+        });
         return;
     }
     if (command === 'optimizations' && subcommand === 'list') {

package/dist/json-response.js

@@ -0,0 +1,21 @@
+export function sanitizeTerminalText(value) {
+    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
+}
+export function sanitizeHumanInlineText(sanitizer, value) {
+    return sanitizer(value).replaceAll('\r', '').replaceAll('\n', '\\n');
+}
+export async function parseJsonResponse(response, context) {
+    const contentType = response.headers.get('content-type') || '';
+    const rawBody = await response.text();
+    if (!contentType.includes('application/json')) {
+        throw new Error(`${context} returned non-JSON response (status ${response.status}). ` +
+            `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
+    }
+    try {
+        return JSON.parse(rawBody);
+    }
+    catch {
+        throw new Error(`${context} returned invalid JSON (status ${response.status}). ` +
+            `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
+    }
+}

package/dist/markdown-report-input.js

@@ -0,0 +1,67 @@
+import { readFileSync } from 'fs';
+import { basename } from 'path';
+export const MARKDOWN_REPORT_MAX_BYTES = 2 * 1024 * 1024;
+function getArg(args, name) {
+    const index = args.indexOf(name);
+    if (index === -1 || index + 1 >= args.length)
+        return null;
+    return args[index + 1];
+}
+function expandHomePath(path) {
+    if (!path.startsWith('~/'))
+        return path;
+    return `${process.env.HOME || ''}/${path.slice(2)}`;
+}
+function rejectDashPrefixedOptionValue(name, value) {
+    if (value?.startsWith('-')) {
+        throw new Error(`Invalid value for ${name}: option values cannot start with a dash`);
+    }
+}
+function readSourceFile(pathArg) {
+    const expandedPath = expandHomePath(pathArg);
+    try {
+        return readFileSync(expandedPath, 'utf8');
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            throw new Error(`File not found: ${expandedPath}`);
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to read file '${expandedPath}': ${message}`);
+    }
+}
+export function readMarkdownReportInput(args, reportLabel) {
+    const report = getArg(args, '--report');
+    const reportFile = getArg(args, '--report-file');
+    rejectDashPrefixedOptionValue('--report', report);
+    rejectDashPrefixedOptionValue('--report-file', reportFile);
+    if (report && reportFile) {
+        throw new Error('Use either --report or --report-file, not both');
+    }
+    if (!report && !reportFile)
+        return null;
+    let markdown;
+    let sourceName;
+    if (reportFile) {
+        const expandedPath = expandHomePath(reportFile);
+        markdown = readSourceFile(reportFile);
+        sourceName = basename(expandedPath);
+    }
+    else if (report?.startsWith('@')) {
+        const path = report.slice(1);
+        const expandedPath = expandHomePath(path);
+        markdown = readSourceFile(path);
+        sourceName = basename(expandedPath);
+    }
+    else {
+        markdown = report || '';
+        sourceName = 'inline';
+    }
+    if (!markdown.trim()) {
+        throw new Error(`${reportLabel} report markdown must not be blank`);
+    }
+    if (Buffer.byteLength(markdown, 'utf8') > MARKDOWN_REPORT_MAX_BYTES) {
+        throw new Error(`${reportLabel} report exceeds ${MARKDOWN_REPORT_MAX_BYTES} bytes`);
+    }
+    return { markdown, sourceName };
+}