orizu 0.5.17 → 0.5.19

package/dist/json-response.js

@@ -0,0 +1,21 @@
+export function sanitizeTerminalText(value) {
+    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
+}
+export function sanitizeHumanInlineText(sanitizer, value) {
+    return sanitizer(value).replaceAll('\r', '').replaceAll('\n', '\\n');
+}
+export async function parseJsonResponse(response, context) {
+    const contentType = response.headers.get('content-type') || '';
+    const rawBody = await response.text();
+    if (!contentType.includes('application/json')) {
+        throw new Error(`${context} returned non-JSON response (status ${response.status}). ` +
+            `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
+    }
+    try {
+        return JSON.parse(rawBody);
+    }
+    catch {
+        throw new Error(`${context} returned invalid JSON (status ${response.status}). ` +
+            `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`);
+    }
+}

package/dist/markdown-report-input.js

@@ -0,0 +1,67 @@
+import { readFileSync } from 'fs';
+import { basename } from 'path';
+export const MARKDOWN_REPORT_MAX_BYTES = 2 * 1024 * 1024;
+function getArg(args, name) {
+    const index = args.indexOf(name);
+    if (index === -1 || index + 1 >= args.length)
+        return null;
+    return args[index + 1];
+}
+function expandHomePath(path) {
+    if (!path.startsWith('~/'))
+        return path;
+    return `${process.env.HOME || ''}/${path.slice(2)}`;
+}
+function rejectDashPrefixedOptionValue(name, value) {
+    if (value?.startsWith('-')) {
+        throw new Error(`Invalid value for ${name}: option values cannot start with a dash`);
+    }
+}
+function readSourceFile(pathArg) {
+    const expandedPath = expandHomePath(pathArg);
+    try {
+        return readFileSync(expandedPath, 'utf8');
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            throw new Error(`File not found: ${expandedPath}`);
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to read file '${expandedPath}': ${message}`);
+    }
+}
+export function readMarkdownReportInput(args, reportLabel) {
+    const report = getArg(args, '--report');
+    const reportFile = getArg(args, '--report-file');
+    rejectDashPrefixedOptionValue('--report', report);
+    rejectDashPrefixedOptionValue('--report-file', reportFile);
+    if (report && reportFile) {
+        throw new Error('Use either --report or --report-file, not both');
+    }
+    if (!report && !reportFile)
+        return null;
+    let markdown;
+    let sourceName;
+    if (reportFile) {
+        const expandedPath = expandHomePath(reportFile);
+        markdown = readSourceFile(reportFile);
+        sourceName = basename(expandedPath);
+    }
+    else if (report?.startsWith('@')) {
+        const path = report.slice(1);
+        const expandedPath = expandHomePath(path);
+        markdown = readSourceFile(path);
+        sourceName = basename(expandedPath);
+    }
+    else {
+        markdown = report || '';
+        sourceName = 'inline';
+    }
+    if (!markdown.trim()) {
+        throw new Error(`${reportLabel} report markdown must not be blank`);
+    }
+    if (Buffer.byteLength(markdown, 'utf8') > MARKDOWN_REPORT_MAX_BYTES) {
+        throw new Error(`${reportLabel} report exceeds ${MARKDOWN_REPORT_MAX_BYTES} bytes`);
+    }
+    return { markdown, sourceName };
+}

package/dist/optimization-export-cli.js

@@ -0,0 +1,30 @@
+import { parseJsonResponse, sanitizeHumanInlineText, } from './json-response.js';
+export function printDiffCommentsSuppressionMarker(ctx, data) {
+    const reason = data.diffCommentsSuppressedReason;
+    if (typeof reason !== 'string' || reason.length === 0) {
+        return;
+    }
+    ctx.printLine(`Diff comments suppressed: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, reason)}`);
+}
+export async function exportOptimizationRunCommand(ctx) {
+    const runId = ctx.getPositionalArg(2) || ctx.getArg('--run-id');
+    const outPathArg = ctx.getArg('--out');
+    if (!runId) {
+        throw new Error('Usage: orizu optimizations export <run-id> [--out <path>] [--json]');
+    }
+    const response = await ctx.authedFetch(`/api/cli/optimization-runs/${encodeURIComponent(runId)}/export`);
+    if (!response.ok) {
+        throw new Error(`Failed to export optimization run: ${await response.text()}`);
+    }
+    const data = await parseJsonResponse(response, 'Optimization export');
+    if (ctx.hasJsonFlag() && !outPathArg) {
+        ctx.printJson(data);
+        return;
+    }
+    const filename = outPathArg
+        ? ctx.expandHomePath(outPathArg)
+        : `${runId}.optimization.json`;
+    ctx.writeTextFileEnsuringDir(filename, `${JSON.stringify(data, null, 2)}\n`);
+    ctx.printLine(`Saved optimization export to ${ctx.sanitizeTerminalText(filename)}`);
+    printDiffCommentsSuppressionMarker(ctx, data);
+}

package/dist/optimizations-list-cli.js

@@ -12,6 +12,7 @@
  */
 import { authedFetch } from './http.js';
 import { extractErrorMessage } from './error-response.js';
+import { sanitizeTerminalText } from './json-response.js';
 // ALI-1175: best scores here derive from agent-reported score runs — nothing is
 // server-attested yet. Both the table footer AND the --json payload carry this
 // signal so no consumer, human or machine, mistakes the number for attested
@@ -25,9 +26,6 @@ function argValue(args, flag) {
     }
     return args[index + 1];
 }
-function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 // Shared-parser behavior (artifact-pull.ts pattern): a non-JSON or malformed
 // body becomes a bounded, sanitized error — never a raw JSON.parse throw.
 async function parseJsonPayload(response, context) {

package/dist/prompt-draft-push.js

@@ -1,4 +1,5 @@
 import { authedFetch } from './http.js';
+import { sanitizeTerminalText } from './json-response.js';
 import { appendRegistrationTagWarning } from './registration-tag-warning.js';
 /**
  * ADR-007 P4 (ALI-1074): the session-scoped, commit-first prompt push.
@@ -18,11 +19,6 @@ import { appendRegistrationTagWarning } from './registration-tag-warning.js';
  * Lives outside index.ts per the CLI line ratchet (ALI-976).
  */
 export const PROMPT_PRIMARY_GIT_FILENAME = 'prompt.md';
-// Mirrors index.ts `sanitizeTerminalText` (precedent: artifact-pull.ts keeps
-// its own copy to avoid importing the CLI entrypoint).
-function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 /**
  * Build the git file set for a prompt-version draft: the primary text at the
  * canonical prompt.md plus every sidecar at its own relative path. A sidecar
@@ -74,6 +70,12 @@ export async function pushPromptDraft(input) {
             parentVersionId: input.parentVersionId,
             createdBy: manifest.provenance || { kind: 'human-edit' },
             files,
+            ...(input.report
+                ? {
+                    reportMarkdown: input.report.markdown,
+                    reportSourceName: input.report.sourceName,
+                }
+                : {}),
         }),
     });
     if (!response.ok) {

package/dist/prompt-length-wire.js

@@ -0,0 +1,30 @@
+export const CLI_LENGTH_STATS_FIELDS = [
+    'tokens',
+    'lines',
+    'chars',
+    'words',
+];
+export const CLI_LENGTH_DELTA_SPLIT_UNAVAILABLE_REASONS = [
+    'diff_degraded_size_limit',
+    'diff_degraded_cell_limit',
+];
+export const CLI_LENGTH_MEASUREMENT_UNAVAILABLE_REASONS = [
+    'length_measurement_size_limit',
+    'length_measurement_failed',
+    'body_resolution_failed',
+    'measurement_cap_exceeded',
+    'enrichment_failed',
+    'bodies_unavailable_event_cap',
+];
+export function formatFiniteLengthCount(value, signed = false) {
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        return null;
+    const formatted = Math.abs(value).toLocaleString('en-US');
+    if (!signed)
+        return formatted;
+    if (value > 0)
+        return `+${formatted}`;
+    if (value < 0)
+        return `-${formatted}`;
+    return formatted;
+}

package/dist/prompt-report-cli.js

@@ -0,0 +1,86 @@
+import { extractErrorMessage } from './error-response.js';
+import { authedFetch } from './http.js';
+import { parseJsonResponse, sanitizeTerminalText } from './json-response.js';
+import { readMarkdownReportInput } from './markdown-report-input.js';
+const IDENTICAL_PROMPT_VERSION_ERROR = 'Prompt version is identical to the current prompt version.';
+function getArg(args, name) {
+    const index = args.indexOf(name);
+    if (index === -1 || index + 1 >= args.length)
+        return null;
+    return args[index + 1];
+}
+function rejectDashPrefixedOptionValue(name, value) {
+    if (value?.startsWith('-')) {
+        throw new Error(`Invalid value for ${name}: option values cannot start with a dash`);
+    }
+}
+export async function promptReportCommand(args, context) {
+    const prompt = getArg(args, '--prompt');
+    const projectArg = getArg(args, '--project');
+    const version = getArg(args, '--version');
+    const versionId = getArg(args, '--version-id');
+    for (const [name, value] of [
+        ['--prompt', prompt],
+        ['--project', projectArg],
+        ['--version-id', versionId],
+    ]) {
+        rejectDashPrefixedOptionValue(name, value);
+    }
+    if (!prompt) {
+        throw new Error('Usage: orizu prompts report set --prompt <id-or-name> --project <team/project> ' +
+            '(--version <n> | --version-id <id>) ' +
+            '(--report <markdown|@file> | --report-file <path>) [--json]');
+    }
+    if (Boolean(version) === Boolean(versionId)) {
+        throw new Error('Exactly one of --version or --version-id is required');
+    }
+    if (version && (!/^[1-9]\d*$/.test(version) || !Number.isSafeInteger(Number(version)))) {
+        throw new Error('--version must be a positive integer');
+    }
+    const report = readMarkdownReportInput(args, 'Prompt');
+    if (!report) {
+        throw new Error('Usage: orizu prompts report set --prompt <id-or-name> --project <team/project> ' +
+            '(--version <n> | --version-id <id>) ' +
+            '(--report <markdown|@file> | --report-file <path>) [--json]');
+    }
+    const project = projectArg || await context.resolveProjectSlug(null);
+    const query = new URLSearchParams({ project });
+    if (version)
+        query.set('version', version);
+    else
+        query.set('versionId', versionId);
+    const fetcher = context.fetcher ?? authedFetch;
+    const response = await fetcher(`/api/cli/prompts/${encodeURIComponent(prompt)}/report?${query.toString()}`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            reportMarkdown: report.markdown,
+            reportSourceName: report.sourceName,
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to update prompt report: ${await extractErrorMessage(response)}`);
+    }
+    const data = await parseJsonResponse(response, 'Prompt report update');
+    if (context.json) {
+        context.printJson(data);
+        return;
+    }
+    const versionLabel = data.version
+        ? data.version.versionNumber === null
+            ? data.version.id
+            : `v${data.version.versionNumber}`
+        : data.promptVersionId || versionId || `v${version}`;
+    const promptName = data.prompt?.name || prompt;
+    const status = data.version?.status || 'updated';
+    context.printLine(`Uploaded prompt report for ${sanitizeTerminalText(promptName)} ` +
+        `(${sanitizeTerminalText(versionLabel)}) [${sanitizeTerminalText(status)}]`);
+}
+export async function promptPushErrorMessage(response, kind, hasReport) {
+    const message = await extractErrorMessage(response);
+    if (hasReport && response.status === 409 && message === IDENTICAL_PROMPT_VERSION_ERROR) {
+        return (`${IDENTICAL_PROMPT_VERSION_ERROR} ` +
+            'Attach the report to the existing version with `orizu prompts report set`.');
+    }
+    return `Failed to push ${kind}: ${message}`;
+}

package/dist/prompt-summary-table.js

@@ -0,0 +1,37 @@
+import { sanitizeTerminalText } from './json-response.js';
+import { formatFiniteLengthCount, } from './prompt-length-wire.js';
+export function printPromptSummaryTable(items, emptyMessage, printLine) {
+    if (items.length === 0) {
+        printLine(emptyMessage);
+        return;
+    }
+    const rows = items.map(item => ({
+        id: sanitizeTerminalText(item.id),
+        name: sanitizeTerminalText(item.name),
+        role: sanitizeTerminalText(item.role),
+        status: sanitizeTerminalText(item.status || 'active'),
+        tokens: item.lengthStats == null
+            ? '—'
+            : (() => {
+                const count = formatFiniteLengthCount(item.lengthStats.tokens);
+                return count === null ? '—' : `~${count}`;
+            })(),
+        lines: item.lengthStats == null
+            ? '—'
+            : formatFiniteLengthCount(item.lengthStats.lines) ?? '—',
+        chars: item.lengthStats == null
+            ? '—'
+            : formatFiniteLengthCount(item.lengthStats.chars) ?? '—',
+        words: item.lengthStats == null
+            ? '—'
+            : formatFiniteLengthCount(item.lengthStats.words) ?? '—',
+    }));
+    const headers = ['ID', 'NAME', 'ROLE', 'STATUS', 'TOKENS', 'LINES', 'CHARS', 'WORDS'];
+    const keys = ['id', 'name', 'role', 'status', 'tokens', 'lines', 'chars', 'words'];
+    const widths = keys.map((key, index) => Math.max(headers[index].length, ...rows.map(row => row[key].length)));
+    printLine(headers.map((header, index) => header.padEnd(widths[index])).join('  '));
+    printLine(widths.map(width => '-'.repeat(width)).join('  '));
+    rows.forEach(row => {
+        printLine(keys.map((key, index) => row[key].padEnd(widths[index])).join('  '));
+    });
+}

package/dist/scorer-draft-push.js

@@ -1,27 +1,6 @@
 import { authedFetch } from './http.js';
+import { sanitizeTerminalText } from './json-response.js';
 import { appendRegistrationTagWarning } from './registration-tag-warning.js';
-/**
- * ADR-007 P5 (ALI-1074): the session-scoped, commit-first scorer push.
- *
- * `orizu scorers register --session <id>` creates the version through
- * POST /api/cli/scorers/drafts: the server commits the scorer's canonical
- * `manifest.json` to the session's `orizu/session-*` branch (one Git Data API
- * commit) and then writes a DRAFT row pinning
- * repo_path/content_sha/commit_sha. The draft seals — and gets its version
- * number — when the session branch merges via `orizu session finish` +
- * promotion-manifest apply.
- *
- * The git filename is ALWAYS `manifest.json`: the server read side
- * (lib/artifact-git-read.ts SCORER_MANIFEST_FILENAMES) prefers that name.
- *
- * Lives outside index.ts per the CLI line ratchet (ALI-976); mirrors
- * prompt-draft-push.ts.
- */
-// Mirrors index.ts `sanitizeTerminalText` (precedent: artifact-pull.ts keeps
-// its own copy to avoid importing the CLI entrypoint).
-function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 /** The full `orizu scorers register` command (moved out of index.ts for the
  * CLI line ratchet): --session takes the ADR-007 P5 commit-first draft path,
  * sessionless stays on the legacy create endpoint. */

package/dist/scores-accept-cli.js

@@ -11,9 +11,7 @@
  * own argument parsing and printing via injected io.
  */
 import { authedFetch } from './http.js';
-function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
+import { sanitizeTerminalText } from './json-response.js';
 function argValue(args, flag) {
     const index = args.indexOf(flag);
     if (index === -1 || index + 1 >= args.length || args[index + 1].startsWith('--')) {

package/dist/zip-draft-push.js

@@ -1,31 +1,8 @@
 import { basename } from 'path';
 import { zipDirectoryToBase64 } from './artifact-archive.js';
 import { authedFetch } from './http.js';
+import { sanitizeTerminalText } from './json-response.js';
 import { appendRegistrationTagWarning } from './registration-tag-warning.js';
-/**
- * ADR-007 P5 (ALI-1074): the session-scoped, commit-first runner/optimizer
- * push.
- *
- * `orizu runners|optimizers push --session <id>` sends the SAME deterministic
- * zip as the legacy push to POST /api/cli/{runners|optimizers}/drafts: the
- * server unpacks the zip's file set and commits it to the session's
- * `orizu/session-*` branch (one Git Data API commit; binary entries travel
- * base64), keeps uploading the zip to storage (dual-write until ALI-1046),
- * and writes a DRAFT row pinning repo_path/content_sha/commit_sha. The draft
- * seals — and gets its version number — when the session branch merges via
- * `orizu session finish` + promotion-manifest apply.
- *
- * Labels cannot ride a draft push (`--label` with `--session` is an error at
- * the command layer): labels address sealed versions only.
- *
- * Lives outside index.ts per the CLI line ratchet (ALI-976); mirrors
- * prompt-draft-push.ts.
- */
-// Mirrors index.ts `sanitizeTerminalText` (precedent: artifact-pull.ts keeps
-// its own copy to avoid importing the CLI entrypoint).
-function sanitizeTerminalText(value) {
-    return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
-}
 /** The full `orizu runners|optimizers push` command (moved out of index.ts
  * for the CLI line ratchet): --session takes the ADR-007 P5 commit-first
  * draft path, sessionless stays on the legacy zip-only endpoint. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.17",
+  "version": "0.5.19",
   "private": false,
   "type": "module",
   "bin": {

package/src/archive-artifacts-cli.ts

@@ -8,6 +8,7 @@
 
 import { authedFetch } from './http.js'
 import { extractErrorMessage } from './error-response.js'
+import { sanitizeTerminalText } from './json-response.js'
 
 type ArchiveStatus = 'active' | 'archived' | 'all'
 type ArchiveAction = 'archive' | 'restore'
@@ -109,13 +110,6 @@ function argValue(args: readonly string[], flag: string): string | null {
   return args[index + 1]
 }
 
-function sanitizeTerminalText(value: unknown): string {
-  return String(value).replace(
-    /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g,
-    ''
-  )
-}
-
 function columnWidths(headers: string[], rows: string[][]): number[] {
   return headers.map((header, index) =>
     Math.max(header.length, ...rows.map(row => row[index]?.length || 0))

package/src/artifact-pull.ts

@@ -18,6 +18,7 @@ import { tmpdir } from 'os'
 import { dirname, join } from 'path'
 
 import { authedFetch } from './http.js'
+import { sanitizeTerminalText } from './json-response.js'
 
 export type PullableArtifactKind = 'runner' | 'optimizer'
 
@@ -31,10 +32,6 @@ export interface PullArtifactIo {
 // Shared with the runners exec download path in index.ts.
 export const ARTIFACT_MAX_BYTES = 25 * 1024 * 1024
 
-function sanitizeTerminalText(value: unknown): string {
-  return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '')
-}
-
 function expandHomePath(path: string): string {
   if (path.startsWith('~/')) {
     const home = process.env.HOME || ''