orizu 0.5.19 → 0.5.20

package/dist/report-replacement-warning.js

@@ -0,0 +1,31 @@
+/**
+ * ALI-1452: a shared, human-readable warning for a replaced prompt-version
+ * report on a push/draft response.
+ *
+ * Re-pushing an unchanged prompt with a report deliberately replaces the
+ * version's existing report (reports are correctable; versions are immutable).
+ * The server discloses that replacement as `report_replaced:
+ * { source_name, updated_at } | null`; this turns a non-null disclosure into
+ * the stderr warning line the push commands print. JSON mode prints nothing —
+ * the payload already carries `report_replaced`.
+ */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * A one-line warning when a push response discloses that it replaced an
+ * existing report, or null when nothing was replaced (or no report was sent).
+ */
+export function reportReplacementWarning(data) {
+    const replaced = data.report_replaced;
+    if (!isRecord(replaced))
+        return null;
+    const sourceName = typeof replaced.source_name === 'string'
+        ? replaced.source_name
+        : 'unknown source';
+    const updatedAt = typeof replaced.updated_at === 'string'
+        ? replaced.updated_at
+        : 'unknown time';
+    return ('Warning: replaced the existing report for this version ' +
+        `(${sourceName}, last updated ${updatedAt})`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.19",
+  "version": "0.5.20",
   "private": false,
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "prepack": "node scripts/vendor-gepa-python.mjs && node scripts/vendor-orizu-skill.mjs",
+    "prepack": "node scripts/build-cli-dist.mjs && node scripts/vendor-gepa-python.mjs && node scripts/vendor-orizu-skill.mjs",
     "postpack": "node scripts/vendor-gepa-python.mjs --clean && node scripts/vendor-orizu-skill.mjs --clean"
   },
   "dependencies": {

package/scripts/build-cli-dist.mjs

@@ -0,0 +1,30 @@
+import { existsSync, rmSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { isOrizuSourceCheckout } from './orizu-source-checkout.mjs'
+
+const scriptDir = dirname(fileURLToPath(import.meta.url))
+const cliRoot = resolve(scriptDir, '..')
+const repoRoot = resolve(cliRoot, '..', '..')
+const packedEntrypoint = resolve(cliRoot, 'dist', 'index.js')
+
+// A source checkout has the compiler and must always rebuild before packing so
+// ignored dist cannot carry an old CLI. A published tarball has no dev compiler;
+// it may be repacked only when it already carries the built entrypoint.
+if (!isOrizuSourceCheckout(resolve(repoRoot, 'package.json'))) {
+  if (!existsSync(packedEntrypoint)) {
+    throw new Error('Unable to pack CLI: published package is missing dist/index.js')
+  }
+  process.exit(0)
+}
+
+const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+// Delete old compiler output first: npm pack must never retain a module whose
+// TypeScript source was renamed or removed since the previous build.
+rmSync(resolve(cliRoot, 'dist'), { recursive: true, force: true })
+const result = spawnSync(npm, ['run', 'build'], { cwd: cliRoot, stdio: 'inherit' })
+if (result.status !== 0) {
+  throw new Error(`Unable to build CLI dist before packing: ${result.error?.message || 'npm run build failed'}`)
+}

package/scripts/orizu-source-checkout.d.mts

@@ -0,0 +1 @@
+export function isOrizuSourceCheckout(packageJsonPath: string): boolean

package/scripts/orizu-source-checkout.mjs

@@ -0,0 +1,10 @@
+import { readFileSync } from 'node:fs'
+
+/** True only for the Orizu monorepo, never merely for a consumer Git checkout. */
+export function isOrizuSourceCheckout(packageJsonPath) {
+  try {
+    return JSON.parse(readFileSync(packageJsonPath, 'utf8')).name === 'orizu'
+  } catch {
+    return false
+  }
+}

package/scripts/vendor-gepa-python.mjs

@@ -1,4 +1,6 @@
-import { cpSync, existsSync, mkdirSync, rmSync } from 'node:fs'
+import { cpSync, existsSync, mkdirSync, readdirSync, rmSync, statSync, writeFileSync, readFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -7,32 +9,194 @@ const cliRoot = resolve(scriptDir, '..')
 const repoRoot = resolve(cliRoot, '..', '..')
 const sourceRoot = resolve(repoRoot, 'packages', 'orizu-gepa-python')
 const vendorRoot = resolve(cliRoot, 'vendor', 'orizu-gepa-python')
+const connectorSourceRoot = resolve(repoRoot, 'packages', 'orizu-gepa')
+const connectorVendorRoot = resolve(cliRoot, 'vendor', 'orizu-gepa')
+const officialArchive = resolve(cliRoot, 'gepa-python-source.zip')
+const officialVendorRoot = resolve(cliRoot, 'vendor', 'gepa-python')
 const shouldClean = process.argv.includes('--clean')
+const shouldRefresh = process.argv.includes('--refresh')
+const archiveArgumentIndex = process.argv.indexOf('--archive')
+const suppliedArchive = archiveArgumentIndex === -1
+  ? null
+  : process.argv[archiveArgumentIndex + 1]
 const sourceSrc = resolve(sourceRoot, 'src')
 const sourcePyproject = resolve(sourceRoot, 'pyproject.toml')
 const sourceManifest = resolve(sourceRoot, 'manifest.json')
 const vendoredSrc = resolve(vendorRoot, 'src')
 const vendoredPyproject = resolve(vendorRoot, 'pyproject.toml')
 const vendoredManifest = resolve(vendorRoot, 'manifest.json')
+const officialVendoredManifest = resolve(officialVendorRoot, 'manifest.json')
+const officialVendoredGepa = resolve(officialVendorRoot, 'src', 'gepa', '__init__.py')
+const GEPA_VERSION = '0.1.4'
+const GEPA_RELEASE_COMMIT = '8b0ce6cd99a234f6b74daf37558a2ac0ce18f975'
+const GEPA_WHEEL_FILENAME = 'gepa-0.1.4-py3-none-any.whl'
+const GEPA_WHEEL_SHA256 = '12b971039599625c156d2231f6d72a29c31a22e9c237689459b5f1a3c353f532'
 const hasSourcePackage = existsSync(sourceSrc)
   && existsSync(sourcePyproject)
   && existsSync(sourceManifest)
+const hasConnectorSourcePackage = existsSync(resolve(connectorSourceRoot, 'src'))
+  && existsSync(resolve(connectorSourceRoot, 'pyproject.toml'))
 const hasVendoredPackage = existsSync(vendoredSrc)
   && existsSync(vendoredPyproject)
   && existsSync(vendoredManifest)
+const hasVendoredConnectorPackage = existsSync(resolve(connectorVendorRoot, 'src', 'orizu_gepa_connector', '__main__.py'))
+  && existsSync(resolve(connectorVendorRoot, 'pyproject.toml'))
+const hasOfficialVendoredPackage = existsSync(officialVendoredManifest)
+  && existsSync(officialVendoredGepa)
+
+function sha256File(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function assertPinnedGepaArchive(path) {
+  if (!existsSync(path)) {
+    throw new Error(`Unable to vendor official GEPA: source archive not found at ${path}`)
+  }
+
+  const actualSha256 = sha256File(path)
+  if (actualSha256 !== GEPA_WHEEL_SHA256) {
+    throw new Error(
+      `Official GEPA source archive sha256 mismatch: expected ${GEPA_WHEEL_SHA256}, got ${actualSha256}`
+    )
+  }
+}
+
+function collectFileHashes(root, prefix = '') {
+  const files = {}
+  for (const entry of readdirSync(root).sort()) {
+    const path = resolve(root, entry)
+    const relativePath = prefix ? `${prefix}/${entry}` : entry
+    if (statSync(path).isDirectory()) {
+      Object.assign(files, collectFileHashes(path, relativePath))
+    } else {
+      files[relativePath] = sha256File(path)
+    }
+  }
+  return files
+}
+
+function assertOfficialVendoredManifest() {
+  let manifest
+  try {
+    manifest = JSON.parse(readFileSync(officialVendoredManifest, 'utf8'))
+  } catch (error) {
+    throw new Error(`Official GEPA vendored manifest is unreadable: ${error.message}`)
+  }
+
+  if (!manifest.files || typeof manifest.files !== 'object' || Array.isArray(manifest.files)) {
+    throw new Error('Official GEPA vendored manifest is missing file hashes')
+  }
+
+  const actualFiles = collectFileHashes(officialVendorRoot)
+  delete actualFiles['manifest.json']
+  const expectedEntries = Object.entries(manifest.files).sort(([left], [right]) => left.localeCompare(right))
+  const actualEntries = Object.entries(actualFiles).sort(([left], [right]) => left.localeCompare(right))
+  if (expectedEntries.length !== actualEntries.length) {
+    throw new Error('Official GEPA vendored manifest file count does not match extracted files')
+  }
+
+  for (let index = 0; index < expectedEntries.length; index += 1) {
+    const [expectedPath, expectedSha256] = expectedEntries[index]
+    const [actualPath, actualSha256] = actualEntries[index]
+    if (expectedPath !== actualPath || expectedSha256 !== actualSha256) {
+      throw new Error(`Official GEPA vendored manifest mismatch at ${expectedPath}`)
+    }
+  }
+}
+
+function extractPinnedGepa(archivePath) {
+  const extractor = String.raw`
+from pathlib import Path, PurePosixPath
+import shutil
+import sys
+import zipfile
+
+archive_path = Path(sys.argv[1])
+destination_root = Path(sys.argv[2])
+license_member = 'gepa-0.1.4.dist-info/licenses/LICENSE'
+
+with zipfile.ZipFile(archive_path) as archive:
+    for member in archive.infolist():
+        if member.is_dir():
+            continue
+        if member.filename.startswith('gepa/'):
+            relative_path = PurePosixPath('src') / PurePosixPath(member.filename)
+        elif member.filename == license_member:
+            relative_path = PurePosixPath('LICENSE')
+        else:
+            continue
+        if relative_path.is_absolute() or '..' in relative_path.parts:
+            raise ValueError(f'unsafe GEPA wheel member: {member.filename}')
+        destination = destination_root.joinpath(*relative_path.parts)
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        with archive.open(member) as source, destination.open('wb') as output:
+            shutil.copyfileobj(source, output)
+`
+  const result = spawnSync('python3', ['-c', extractor, archivePath, officialVendorRoot], {
+    encoding: 'utf8',
+  })
+  if (result.status !== 0) {
+    const details = result.error?.message || result.stderr || result.stdout || 'no subprocess output'
+    throw new Error(`Unable to extract verified official GEPA wheel; python3 is required: ${details}`)
+  }
+}
+
+function vendorOfficialGepa(archivePath) {
+  assertPinnedGepaArchive(archivePath)
+  rmSync(officialVendorRoot, { recursive: true, force: true })
+  mkdirSync(officialVendorRoot, { recursive: true })
+  extractPinnedGepa(archivePath)
+
+  const files = collectFileHashes(officialVendorRoot)
+  writeFileSync(officialVendoredManifest, `${JSON.stringify({
+    schemaVersion: 'gepa-vendor.v1',
+    upstream: {
+      package: 'gepa',
+      version: GEPA_VERSION,
+      repositoryCommit: GEPA_RELEASE_COMMIT,
+      wheel: {
+        filename: GEPA_WHEEL_FILENAME,
+        sha256: GEPA_WHEEL_SHA256,
+      },
+    },
+    files,
+  }, null, 2)}\n`)
+}
+
+if (archiveArgumentIndex !== -1 && (!suppliedArchive || suppliedArchive.startsWith('--'))) {
+  throw new Error('Expected a source archive path after --archive')
+}
+
+if (shouldRefresh) {
+  if (!suppliedArchive) {
+    throw new Error('Refreshing official GEPA requires --archive <verified-wheel-path>')
+  }
+  assertPinnedGepaArchive(suppliedArchive)
+  cpSync(suppliedArchive, officialArchive)
+}
 
 if (shouldClean) {
   if (hasSourcePackage) {
     rmSync(vendorRoot, { recursive: true, force: true })
   }
+  if (hasConnectorSourcePackage) {
+    rmSync(connectorVendorRoot, { recursive: true, force: true })
+  }
+  if (hasSourcePackage || hasConnectorSourcePackage) {
+    rmSync(officialVendorRoot, { recursive: true, force: true })
+  }
   process.exit(0)
 }
 
-if (!hasSourcePackage) {
-  if (hasVendoredPackage) {
+if (!hasSourcePackage || !hasConnectorSourcePackage) {
+  if (hasVendoredPackage && hasVendoredConnectorPackage && hasOfficialVendoredPackage) {
+    assertOfficialVendoredManifest()
     process.exit(0)
   }
-  throw new Error(`Unable to vendor orizu-gepa-python: source package not found at ${sourceRoot}`)
+  if (hasVendoredPackage || hasVendoredConnectorPackage || hasOfficialVendoredPackage) {
+    throw new Error('Unable to vendor GEPA packages: vendored legacy, connector, or official package is incomplete')
+  }
+  throw new Error(`Unable to vendor GEPA packages: source package not found at ${sourceRoot} or ${connectorSourceRoot}`)
 }
 
 rmSync(vendorRoot, { recursive: true, force: true })
@@ -52,3 +216,22 @@ cpSync(sourceSrc, resolve(vendorRoot, 'src'), {
       && !normalizedPath.endsWith('/.DS_Store')
   },
 })
+
+rmSync(connectorVendorRoot, { recursive: true, force: true })
+mkdirSync(connectorVendorRoot, { recursive: true })
+cpSync(resolve(connectorSourceRoot, 'pyproject.toml'), resolve(connectorVendorRoot, 'pyproject.toml'))
+cpSync(resolve(connectorSourceRoot, 'src'), resolve(connectorVendorRoot, 'src'), {
+  recursive: true,
+  filter: sourcePath => {
+    const normalizedPath = sourcePath.replace(/\\/g, '/')
+    return !normalizedPath.endsWith('/__pycache__')
+      && !normalizedPath.includes('/__pycache__/')
+      && !normalizedPath.endsWith('.pyc')
+      && !normalizedPath.endsWith('.pyo')
+      && !normalizedPath.endsWith('/.pytest_cache')
+      && !normalizedPath.includes('/.pytest_cache/')
+      && !normalizedPath.endsWith('/.DS_Store')
+  },
+})
+
+vendorOfficialGepa(suppliedArchive ?? officialArchive)

package/src/diff-comments-cli.ts

@@ -50,7 +50,11 @@ interface DiffCommentPayloadPairContext {
   bodies: { from: string; to: string } | null
   degraded: { reason: DiffCommentContextUnavailableReason } | null
   lengthStats: CliLengthStatsPair | null
-  lengthDelta: CliLengthDelta | null
+  lengthDelta: (
+    Partial<Record<keyof Omit<CliLengthDelta, 'splitUnavailableReason'>, unknown>> & {
+      splitUnavailableReason?: unknown
+    }
+  ) | null
   lengthDeltaUnavailableReason?: CliLengthMeasurementUnavailableReason
   comments: DiffCommentPayloadComment[]
 }
@@ -76,6 +80,12 @@ interface DiffCommentsPayload {
   pairs: DiffCommentPayloadPair[]
 }
 
+interface RenderableLengthMetricDelta {
+  removed: number | null
+  added: number | null
+  net: number | null
+}
+
 export interface DiffCommentsCliContext {
   getArg: (name: string) => string | null
   rejectDashPrefixedOptionValue: (name: string, value: string | null) => void
@@ -171,6 +181,22 @@ function formatDeltaValue(
   return metric === 'tokens' ? `~${formatted}` : formatted
 }
 
+function isLengthMetricDelta(
+  value: unknown
+): value is RenderableLengthMetricDelta {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return false
+  }
+  const delta = value as Record<string, unknown>
+  const isNullableFiniteNumber = (candidate: unknown) =>
+    candidate === null || (
+      typeof candidate === 'number' && Number.isFinite(candidate)
+    )
+  return isNullableFiniteNumber(delta.removed) &&
+    isNullableFiniteNumber(delta.added) &&
+    isNullableFiniteNumber(delta.net)
+}
+
 function printLengthMeasurements(
   ctx: DiffCommentsCliContext,
   pair: DiffCommentPayloadPair
@@ -210,11 +236,15 @@ function printLengthMeasurements(
     return
   }
 
-  if (pair.lengthDelta.splitUnavailableReason) {
+  const splitUnavailableReason = pair.lengthDelta.splitUnavailableReason
+  if (
+    typeof splitUnavailableReason === 'string' &&
+    splitUnavailableReason.length > 0
+  ) {
     ctx.printLine(
       `  Split unavailable: ${sanitizeHumanInlineText(
         ctx.sanitizeTerminalText,
-        pair.lengthDelta.splitUnavailableReason
+        splitUnavailableReason
       )}`
     )
   }
@@ -225,6 +255,10 @@ function printLengthMeasurements(
     ['words', 'Words'],
   ] as const) {
     const delta = pair.lengthDelta[metric]
+    if (!isLengthMetricDelta(delta)) {
+      ctx.printLine(`  ${label}: unavailable`)
+      continue
+    }
     ctx.printLine(
       `  ${label}: removed ${formatDeltaValue(delta.removed, metric)} · ` +
       `added ${formatDeltaValue(delta.added, metric)} · ` +