orizu 0.5.18 → 0.5.20

package/dist/markdown-report-input.js

@@ -1,5 +1,6 @@
 import { readFileSync } from 'fs';
 import { basename } from 'path';
+import { hasCanonicalReportMarkdownContent } from './report-markdown-blankness.js';
 export const MARKDOWN_REPORT_MAX_BYTES = 2 * 1024 * 1024;
 function getArg(args, name) {
     const index = args.indexOf(name);
@@ -17,6 +18,11 @@ function rejectDashPrefixedOptionValue(name, value) {
         throw new Error(`Invalid value for ${name}: option values cannot start with a dash`);
     }
 }
+function rejectMissingOptionValue(args, name) {
+    if (args.some((arg, index) => arg === name && index + 1 >= args.length)) {
+        throw new Error(`${name} requires a value`);
+    }
+}
 function readSourceFile(pathArg) {
     const expandedPath = expandHomePath(pathArg);
     try {
@@ -31,6 +37,14 @@ function readSourceFile(pathArg) {
     }
 }
 export function readMarkdownReportInput(args, reportLabel) {
+    if (args.some(arg => arg.startsWith('--report='))) {
+        throw new Error('use --report <markdown|@file> with a space, not =');
+    }
+    if (args.some(arg => arg.startsWith('--report-file='))) {
+        throw new Error('use --report-file <path> with a space, not =');
+    }
+    rejectMissingOptionValue(args, '--report');
+    rejectMissingOptionValue(args, '--report-file');
     const report = getArg(args, '--report');
     const reportFile = getArg(args, '--report-file');
     rejectDashPrefixedOptionValue('--report', report);
@@ -57,7 +71,7 @@ export function readMarkdownReportInput(args, reportLabel) {
         markdown = report || '';
         sourceName = 'inline';
     }
-    if (!markdown.trim()) {
+    if (!hasCanonicalReportMarkdownContent(markdown)) {
         throw new Error(`${reportLabel} report markdown must not be blank`);
     }
     if (Buffer.byteLength(markdown, 'utf8') > MARKDOWN_REPORT_MAX_BYTES) {

package/dist/prompt-length-wire.js

@@ -0,0 +1,30 @@
+export const CLI_LENGTH_STATS_FIELDS = [
+    'tokens',
+    'lines',
+    'chars',
+    'words',
+];
+export const CLI_LENGTH_DELTA_SPLIT_UNAVAILABLE_REASONS = [
+    'diff_degraded_size_limit',
+    'diff_degraded_cell_limit',
+];
+export const CLI_LENGTH_MEASUREMENT_UNAVAILABLE_REASONS = [
+    'length_measurement_size_limit',
+    'length_measurement_failed',
+    'body_resolution_failed',
+    'measurement_cap_exceeded',
+    'enrichment_failed',
+    'bodies_unavailable_event_cap',
+];
+export function formatFiniteLengthCount(value, signed = false) {
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        return null;
+    if (!signed)
+        return value.toLocaleString('en-US');
+    const formatted = Math.abs(value).toLocaleString('en-US');
+    if (value > 0)
+        return `+${formatted}`;
+    if (value < 0)
+        return `-${formatted}`;
+    return formatted;
+}

package/dist/prompt-report-cli.js

@@ -27,7 +27,7 @@ export async function promptReportCommand(args, context) {
         rejectDashPrefixedOptionValue(name, value);
     }
     if (!prompt) {
-        throw new Error('Usage: orizu prompts report set --prompt <id-or-name> --project <team/project> ' +
+        throw new Error('Usage: orizu prompts report set --prompt <id-or-name> [--project <team/project>] ' +
             '(--version <n> | --version-id <id>) ' +
             '(--report <markdown|@file> | --report-file <path>) [--json]');
     }
@@ -39,7 +39,7 @@ export async function promptReportCommand(args, context) {
     }
     const report = readMarkdownReportInput(args, 'Prompt');
     if (!report) {
-        throw new Error('Usage: orizu prompts report set --prompt <id-or-name> --project <team/project> ' +
+        throw new Error('Usage: orizu prompts report set --prompt <id-or-name> [--project <team/project>] ' +
             '(--version <n> | --version-id <id>) ' +
             '(--report <markdown|@file> | --report-file <path>) [--json]');
     }

package/dist/prompt-summary-table.js

@@ -0,0 +1,37 @@
+import { sanitizeTerminalText } from './json-response.js';
+import { formatFiniteLengthCount, } from './prompt-length-wire.js';
+export function printPromptSummaryTable(items, emptyMessage, printLine) {
+    if (items.length === 0) {
+        printLine(emptyMessage);
+        return;
+    }
+    const rows = items.map(item => ({
+        id: sanitizeTerminalText(item.id),
+        name: sanitizeTerminalText(item.name),
+        role: sanitizeTerminalText(item.role),
+        status: sanitizeTerminalText(item.status || 'active'),
+        tokens: item.lengthStats == null
+            ? '—'
+            : (() => {
+                const count = formatFiniteLengthCount(item.lengthStats.tokens);
+                return count === null ? '—' : `~${count}`;
+            })(),
+        lines: item.lengthStats == null
+            ? '—'
+            : formatFiniteLengthCount(item.lengthStats.lines) ?? '—',
+        chars: item.lengthStats == null
+            ? '—'
+            : formatFiniteLengthCount(item.lengthStats.chars) ?? '—',
+        words: item.lengthStats == null
+            ? '—'
+            : formatFiniteLengthCount(item.lengthStats.words) ?? '—',
+    }));
+    const headers = ['ID', 'NAME', 'ROLE', 'STATUS', 'TOKENS', 'LINES', 'CHARS', 'WORDS'];
+    const keys = ['id', 'name', 'role', 'status', 'tokens', 'lines', 'chars', 'words'];
+    const widths = keys.map((key, index) => Math.max(headers[index].length, ...rows.map(row => row[key].length)));
+    printLine(headers.map((header, index) => header.padEnd(widths[index])).join('  '));
+    printLine(widths.map(width => '-'.repeat(width)).join('  '));
+    rows.forEach(row => {
+        printLine(keys.map((key, index) => row[key].padEnd(widths[index])).join('  '));
+    });
+}

package/dist/report-markdown-blankness.js

@@ -0,0 +1,6 @@
+// JavaScript's \s is broader than the database locale's POSIX [:space:]
+// predicate. These four code points are content in the measured PostgreSQL
+// boundary, so retain them explicitly when validating CLI report input.
+export function hasCanonicalReportMarkdownContent(markdown) {
+    return /(?:[^\s]|[\u00a0\u2007\u202f\ufeff])/u.test(markdown);
+}

package/dist/report-replacement-warning.js

@@ -0,0 +1,31 @@
+/**
+ * ALI-1452: a shared, human-readable warning for a replaced prompt-version
+ * report on a push/draft response.
+ *
+ * Re-pushing an unchanged prompt with a report deliberately replaces the
+ * version's existing report (reports are correctable; versions are immutable).
+ * The server discloses that replacement as `report_replaced:
+ * { source_name, updated_at } | null`; this turns a non-null disclosure into
+ * the stderr warning line the push commands print. JSON mode prints nothing —
+ * the payload already carries `report_replaced`.
+ */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * A one-line warning when a push response discloses that it replaced an
+ * existing report, or null when nothing was replaced (or no report was sent).
+ */
+export function reportReplacementWarning(data) {
+    const replaced = data.report_replaced;
+    if (!isRecord(replaced))
+        return null;
+    const sourceName = typeof replaced.source_name === 'string'
+        ? replaced.source_name
+        : 'unknown source';
+    const updatedAt = typeof replaced.updated_at === 'string'
+        ? replaced.updated_at
+        : 'unknown time';
+    return ('Warning: replaced the existing report for this version ' +
+        `(${sourceName}, last updated ${updatedAt})`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.18",
+  "version": "0.5.20",
   "private": false,
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "prepack": "node scripts/vendor-gepa-python.mjs && node scripts/vendor-orizu-skill.mjs",
+    "prepack": "node scripts/build-cli-dist.mjs && node scripts/vendor-gepa-python.mjs && node scripts/vendor-orizu-skill.mjs",
     "postpack": "node scripts/vendor-gepa-python.mjs --clean && node scripts/vendor-orizu-skill.mjs --clean"
   },
   "dependencies": {

package/scripts/build-cli-dist.mjs

@@ -0,0 +1,30 @@
+import { existsSync, rmSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { isOrizuSourceCheckout } from './orizu-source-checkout.mjs'
+
+const scriptDir = dirname(fileURLToPath(import.meta.url))
+const cliRoot = resolve(scriptDir, '..')
+const repoRoot = resolve(cliRoot, '..', '..')
+const packedEntrypoint = resolve(cliRoot, 'dist', 'index.js')
+
+// A source checkout has the compiler and must always rebuild before packing so
+// ignored dist cannot carry an old CLI. A published tarball has no dev compiler;
+// it may be repacked only when it already carries the built entrypoint.
+if (!isOrizuSourceCheckout(resolve(repoRoot, 'package.json'))) {
+  if (!existsSync(packedEntrypoint)) {
+    throw new Error('Unable to pack CLI: published package is missing dist/index.js')
+  }
+  process.exit(0)
+}
+
+const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+// Delete old compiler output first: npm pack must never retain a module whose
+// TypeScript source was renamed or removed since the previous build.
+rmSync(resolve(cliRoot, 'dist'), { recursive: true, force: true })
+const result = spawnSync(npm, ['run', 'build'], { cwd: cliRoot, stdio: 'inherit' })
+if (result.status !== 0) {
+  throw new Error(`Unable to build CLI dist before packing: ${result.error?.message || 'npm run build failed'}`)
+}

package/scripts/orizu-source-checkout.d.mts

@@ -0,0 +1 @@
+export function isOrizuSourceCheckout(packageJsonPath: string): boolean

package/scripts/orizu-source-checkout.mjs

@@ -0,0 +1,10 @@
+import { readFileSync } from 'node:fs'
+
+/** True only for the Orizu monorepo, never merely for a consumer Git checkout. */
+export function isOrizuSourceCheckout(packageJsonPath) {
+  try {
+    return JSON.parse(readFileSync(packageJsonPath, 'utf8')).name === 'orizu'
+  } catch {
+    return false
+  }
+}

package/scripts/vendor-gepa-python.mjs

@@ -1,4 +1,6 @@
-import { cpSync, existsSync, mkdirSync, rmSync } from 'node:fs'
+import { cpSync, existsSync, mkdirSync, readdirSync, rmSync, statSync, writeFileSync, readFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -7,32 +9,194 @@ const cliRoot = resolve(scriptDir, '..')
 const repoRoot = resolve(cliRoot, '..', '..')
 const sourceRoot = resolve(repoRoot, 'packages', 'orizu-gepa-python')
 const vendorRoot = resolve(cliRoot, 'vendor', 'orizu-gepa-python')
+const connectorSourceRoot = resolve(repoRoot, 'packages', 'orizu-gepa')
+const connectorVendorRoot = resolve(cliRoot, 'vendor', 'orizu-gepa')
+const officialArchive = resolve(cliRoot, 'gepa-python-source.zip')
+const officialVendorRoot = resolve(cliRoot, 'vendor', 'gepa-python')
 const shouldClean = process.argv.includes('--clean')
+const shouldRefresh = process.argv.includes('--refresh')
+const archiveArgumentIndex = process.argv.indexOf('--archive')
+const suppliedArchive = archiveArgumentIndex === -1
+  ? null
+  : process.argv[archiveArgumentIndex + 1]
 const sourceSrc = resolve(sourceRoot, 'src')
 const sourcePyproject = resolve(sourceRoot, 'pyproject.toml')
 const sourceManifest = resolve(sourceRoot, 'manifest.json')
 const vendoredSrc = resolve(vendorRoot, 'src')
 const vendoredPyproject = resolve(vendorRoot, 'pyproject.toml')
 const vendoredManifest = resolve(vendorRoot, 'manifest.json')
+const officialVendoredManifest = resolve(officialVendorRoot, 'manifest.json')
+const officialVendoredGepa = resolve(officialVendorRoot, 'src', 'gepa', '__init__.py')
+const GEPA_VERSION = '0.1.4'
+const GEPA_RELEASE_COMMIT = '8b0ce6cd99a234f6b74daf37558a2ac0ce18f975'
+const GEPA_WHEEL_FILENAME = 'gepa-0.1.4-py3-none-any.whl'
+const GEPA_WHEEL_SHA256 = '12b971039599625c156d2231f6d72a29c31a22e9c237689459b5f1a3c353f532'
 const hasSourcePackage = existsSync(sourceSrc)
   && existsSync(sourcePyproject)
   && existsSync(sourceManifest)
+const hasConnectorSourcePackage = existsSync(resolve(connectorSourceRoot, 'src'))
+  && existsSync(resolve(connectorSourceRoot, 'pyproject.toml'))
 const hasVendoredPackage = existsSync(vendoredSrc)
   && existsSync(vendoredPyproject)
   && existsSync(vendoredManifest)
+const hasVendoredConnectorPackage = existsSync(resolve(connectorVendorRoot, 'src', 'orizu_gepa_connector', '__main__.py'))
+  && existsSync(resolve(connectorVendorRoot, 'pyproject.toml'))
+const hasOfficialVendoredPackage = existsSync(officialVendoredManifest)
+  && existsSync(officialVendoredGepa)
+
+function sha256File(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function assertPinnedGepaArchive(path) {
+  if (!existsSync(path)) {
+    throw new Error(`Unable to vendor official GEPA: source archive not found at ${path}`)
+  }
+
+  const actualSha256 = sha256File(path)
+  if (actualSha256 !== GEPA_WHEEL_SHA256) {
+    throw new Error(
+      `Official GEPA source archive sha256 mismatch: expected ${GEPA_WHEEL_SHA256}, got ${actualSha256}`
+    )
+  }
+}
+
+function collectFileHashes(root, prefix = '') {
+  const files = {}
+  for (const entry of readdirSync(root).sort()) {
+    const path = resolve(root, entry)
+    const relativePath = prefix ? `${prefix}/${entry}` : entry
+    if (statSync(path).isDirectory()) {
+      Object.assign(files, collectFileHashes(path, relativePath))
+    } else {
+      files[relativePath] = sha256File(path)
+    }
+  }
+  return files
+}
+
+function assertOfficialVendoredManifest() {
+  let manifest
+  try {
+    manifest = JSON.parse(readFileSync(officialVendoredManifest, 'utf8'))
+  } catch (error) {
+    throw new Error(`Official GEPA vendored manifest is unreadable: ${error.message}`)
+  }
+
+  if (!manifest.files || typeof manifest.files !== 'object' || Array.isArray(manifest.files)) {
+    throw new Error('Official GEPA vendored manifest is missing file hashes')
+  }
+
+  const actualFiles = collectFileHashes(officialVendorRoot)
+  delete actualFiles['manifest.json']
+  const expectedEntries = Object.entries(manifest.files).sort(([left], [right]) => left.localeCompare(right))
+  const actualEntries = Object.entries(actualFiles).sort(([left], [right]) => left.localeCompare(right))
+  if (expectedEntries.length !== actualEntries.length) {
+    throw new Error('Official GEPA vendored manifest file count does not match extracted files')
+  }
+
+  for (let index = 0; index < expectedEntries.length; index += 1) {
+    const [expectedPath, expectedSha256] = expectedEntries[index]
+    const [actualPath, actualSha256] = actualEntries[index]
+    if (expectedPath !== actualPath || expectedSha256 !== actualSha256) {
+      throw new Error(`Official GEPA vendored manifest mismatch at ${expectedPath}`)
+    }
+  }
+}
+
+function extractPinnedGepa(archivePath) {
+  const extractor = String.raw`
+from pathlib import Path, PurePosixPath
+import shutil
+import sys
+import zipfile
+
+archive_path = Path(sys.argv[1])
+destination_root = Path(sys.argv[2])
+license_member = 'gepa-0.1.4.dist-info/licenses/LICENSE'
+
+with zipfile.ZipFile(archive_path) as archive:
+    for member in archive.infolist():
+        if member.is_dir():
+            continue
+        if member.filename.startswith('gepa/'):
+            relative_path = PurePosixPath('src') / PurePosixPath(member.filename)
+        elif member.filename == license_member:
+            relative_path = PurePosixPath('LICENSE')
+        else:
+            continue
+        if relative_path.is_absolute() or '..' in relative_path.parts:
+            raise ValueError(f'unsafe GEPA wheel member: {member.filename}')
+        destination = destination_root.joinpath(*relative_path.parts)
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        with archive.open(member) as source, destination.open('wb') as output:
+            shutil.copyfileobj(source, output)
+`
+  const result = spawnSync('python3', ['-c', extractor, archivePath, officialVendorRoot], {
+    encoding: 'utf8',
+  })
+  if (result.status !== 0) {
+    const details = result.error?.message || result.stderr || result.stdout || 'no subprocess output'
+    throw new Error(`Unable to extract verified official GEPA wheel; python3 is required: ${details}`)
+  }
+}
+
+function vendorOfficialGepa(archivePath) {
+  assertPinnedGepaArchive(archivePath)
+  rmSync(officialVendorRoot, { recursive: true, force: true })
+  mkdirSync(officialVendorRoot, { recursive: true })
+  extractPinnedGepa(archivePath)
+
+  const files = collectFileHashes(officialVendorRoot)
+  writeFileSync(officialVendoredManifest, `${JSON.stringify({
+    schemaVersion: 'gepa-vendor.v1',
+    upstream: {
+      package: 'gepa',
+      version: GEPA_VERSION,
+      repositoryCommit: GEPA_RELEASE_COMMIT,
+      wheel: {
+        filename: GEPA_WHEEL_FILENAME,
+        sha256: GEPA_WHEEL_SHA256,
+      },
+    },
+    files,
+  }, null, 2)}\n`)
+}
+
+if (archiveArgumentIndex !== -1 && (!suppliedArchive || suppliedArchive.startsWith('--'))) {
+  throw new Error('Expected a source archive path after --archive')
+}
+
+if (shouldRefresh) {
+  if (!suppliedArchive) {
+    throw new Error('Refreshing official GEPA requires --archive <verified-wheel-path>')
+  }
+  assertPinnedGepaArchive(suppliedArchive)
+  cpSync(suppliedArchive, officialArchive)
+}
 
 if (shouldClean) {
   if (hasSourcePackage) {
     rmSync(vendorRoot, { recursive: true, force: true })
   }
+  if (hasConnectorSourcePackage) {
+    rmSync(connectorVendorRoot, { recursive: true, force: true })
+  }
+  if (hasSourcePackage || hasConnectorSourcePackage) {
+    rmSync(officialVendorRoot, { recursive: true, force: true })
+  }
   process.exit(0)
 }
 
-if (!hasSourcePackage) {
-  if (hasVendoredPackage) {
+if (!hasSourcePackage || !hasConnectorSourcePackage) {
+  if (hasVendoredPackage && hasVendoredConnectorPackage && hasOfficialVendoredPackage) {
+    assertOfficialVendoredManifest()
     process.exit(0)
   }
-  throw new Error(`Unable to vendor orizu-gepa-python: source package not found at ${sourceRoot}`)
+  if (hasVendoredPackage || hasVendoredConnectorPackage || hasOfficialVendoredPackage) {
+    throw new Error('Unable to vendor GEPA packages: vendored legacy, connector, or official package is incomplete')
+  }
+  throw new Error(`Unable to vendor GEPA packages: source package not found at ${sourceRoot} or ${connectorSourceRoot}`)
 }
 
 rmSync(vendorRoot, { recursive: true, force: true })
@@ -52,3 +216,22 @@ cpSync(sourceSrc, resolve(vendorRoot, 'src'), {
       && !normalizedPath.endsWith('/.DS_Store')
   },
 })
+
+rmSync(connectorVendorRoot, { recursive: true, force: true })
+mkdirSync(connectorVendorRoot, { recursive: true })
+cpSync(resolve(connectorSourceRoot, 'pyproject.toml'), resolve(connectorVendorRoot, 'pyproject.toml'))
+cpSync(resolve(connectorSourceRoot, 'src'), resolve(connectorVendorRoot, 'src'), {
+  recursive: true,
+  filter: sourcePath => {
+    const normalizedPath = sourcePath.replace(/\\/g, '/')
+    return !normalizedPath.endsWith('/__pycache__')
+      && !normalizedPath.includes('/__pycache__/')
+      && !normalizedPath.endsWith('.pyc')
+      && !normalizedPath.endsWith('.pyo')
+      && !normalizedPath.endsWith('/.pytest_cache')
+      && !normalizedPath.includes('/.pytest_cache/')
+      && !normalizedPath.endsWith('/.DS_Store')
+  },
+})
+
+vendorOfficialGepa(suppliedArchive ?? officialArchive)

package/src/diff-comments-cli.ts

@@ -3,6 +3,13 @@ import {
   isJsonErrorResponsePayload,
 } from './error-response.js'
 import { sanitizeHumanInlineText } from './json-response.js'
+import {
+  formatFiniteLengthCount,
+  type CliLengthDelta,
+  type CliLengthMeasurementUnavailableReason,
+  type CliLengthStats,
+  type CliLengthStatsPair,
+} from './prompt-length-wire.js'
 
 interface DiffCommentAuthor {
   name?: string
@@ -42,6 +49,13 @@ interface DiffCommentPayloadPairContext {
   diff: string | null
   bodies: { from: string; to: string } | null
   degraded: { reason: DiffCommentContextUnavailableReason } | null
+  lengthStats: CliLengthStatsPair | null
+  lengthDelta: (
+    Partial<Record<keyof Omit<CliLengthDelta, 'splitUnavailableReason'>, unknown>> & {
+      splitUnavailableReason?: unknown
+    }
+  ) | null
+  lengthDeltaUnavailableReason?: CliLengthMeasurementUnavailableReason
   comments: DiffCommentPayloadComment[]
 }
 
@@ -66,6 +80,12 @@ interface DiffCommentsPayload {
   pairs: DiffCommentPayloadPair[]
 }
 
+interface RenderableLengthMetricDelta {
+  removed: number | null
+  added: number | null
+  net: number | null
+}
+
 export interface DiffCommentsCliContext {
   getArg: (name: string) => string | null
   rejectDashPrefixedOptionValue: (name: string, value: string | null) => void
@@ -143,6 +163,110 @@ function humanLineNumber(
     : sanitizeHumanInlineText(ctx.sanitizeTerminalText, String(line + 1))
 }
 
+function formatStats(stats: CliLengthStats): string {
+  const tokens = formatFiniteLengthCount(stats.tokens)
+  return `${tokens === null ? '—' : `~${tokens}`} tokens · ` +
+    `${formatFiniteLengthCount(stats.lines) ?? '—'} lines · ` +
+    `${formatFiniteLengthCount(stats.chars) ?? '—'} chars · ` +
+    `${formatFiniteLengthCount(stats.words) ?? '—'} words`
+}
+
+function formatDeltaValue(
+  value: number | null,
+  metric: keyof Omit<CliLengthDelta, 'splitUnavailableReason'>,
+  signed = false
+): string {
+  const formatted = formatFiniteLengthCount(value, signed)
+  if (formatted === null) return '—'
+  return metric === 'tokens' ? `~${formatted}` : formatted
+}
+
+function isLengthMetricDelta(
+  value: unknown
+): value is RenderableLengthMetricDelta {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return false
+  }
+  const delta = value as Record<string, unknown>
+  const isNullableFiniteNumber = (candidate: unknown) =>
+    candidate === null || (
+      typeof candidate === 'number' && Number.isFinite(candidate)
+    )
+  return isNullableFiniteNumber(delta.removed) &&
+    isNullableFiniteNumber(delta.added) &&
+    isNullableFiniteNumber(delta.net)
+}
+
+function printLengthMeasurements(
+  ctx: DiffCommentsCliContext,
+  pair: DiffCommentPayloadPair
+) {
+  function unavailableSuffix(reason: unknown): string {
+    if (typeof reason !== 'string' || reason.length === 0) return ''
+    return ` (${sanitizeHumanInlineText(ctx.sanitizeTerminalText, reason)})`
+  }
+
+  if (!pair.lengthStats && !pair.lengthDelta) {
+    ctx.printLine(
+      `  Length: unavailable${unavailableSuffix(
+        pair.lengthDeltaUnavailableReason ?? pair.degraded?.reason
+      )}`
+    )
+    return
+  }
+
+  if (pair.lengthStats) {
+    ctx.printLine(pair.lengthStats.from
+      ? `  From: ${formatStats(pair.lengthStats.from)}`
+      : `  From: unavailable${unavailableSuffix(
+        pair.lengthStats.fromUnavailableReason
+      )}`)
+    ctx.printLine(pair.lengthStats.to
+      ? `  To: ${formatStats(pair.lengthStats.to)}`
+      : `  To: unavailable${unavailableSuffix(
+        pair.lengthStats.toUnavailableReason
+      )}`)
+  }
+  if (!pair.lengthDelta) {
+    ctx.printLine(
+      `  Length delta: unavailable${unavailableSuffix(
+        pair.lengthDeltaUnavailableReason ?? pair.degraded?.reason
+      )}`
+    )
+    return
+  }
+
+  const splitUnavailableReason = pair.lengthDelta.splitUnavailableReason
+  if (
+    typeof splitUnavailableReason === 'string' &&
+    splitUnavailableReason.length > 0
+  ) {
+    ctx.printLine(
+      `  Split unavailable: ${sanitizeHumanInlineText(
+        ctx.sanitizeTerminalText,
+        splitUnavailableReason
+      )}`
+    )
+  }
+  for (const [metric, label] of [
+    ['tokens', 'Tokens'],
+    ['lines', 'Lines'],
+    ['chars', 'Chars'],
+    ['words', 'Words'],
+  ] as const) {
+    const delta = pair.lengthDelta[metric]
+    if (!isLengthMetricDelta(delta)) {
+      ctx.printLine(`  ${label}: unavailable`)
+      continue
+    }
+    ctx.printLine(
+      `  ${label}: removed ${formatDeltaValue(delta.removed, metric)} · ` +
+      `added ${formatDeltaValue(delta.added, metric)} · ` +
+      `net ${formatDeltaValue(delta.net, metric, true)}`
+    )
+  }
+}
+
 function buildParams(ctx: DiffCommentsCliContext): URLSearchParams {
   const runId = ctx.getArg('--run')
   const promptId = ctx.getArg('--prompt')
@@ -210,6 +334,7 @@ function printDiffComments(ctx: DiffCommentsCliContext, payload: DiffCommentsPay
       `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, from)} → ` +
       `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, to)}`
     )
+    printLengthMeasurements(ctx, pair)
     if (pair.degraded) {
       ctx.printLine(
         `  Context unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, pair.degraded.reason)}`