orizu 0.5.22 → 0.5.23

package/dist/index.js

@@ -21,7 +21,7 @@ import { parseGlobalFlags } from './global-flags.js';
 import { getCapabilities, renderHelpForArgs, renderRootHelp } from './help.js';
 import { runLocalAppPreview } from './preview-runtime.js';
 import { readAssignmentManifestJsonlFile } from './task-assignment-manifest.js';
-import { assertSecureTokenTransport, authedFetch, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags } from './http.js';
+import { assertSecureTokenTransport, authedFetch, credentialRequestRedirectPolicy, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags, } from './http.js';
 import { computeSkillContentHash, getSkillInstallPath, getSkillTargetStatus, getTargetForAgent, installSkillTarget, isSkillInstallAgent, isSkillInstallTarget, resolveSkillSource, SKILL_INSTALL_AGENTS, SKILL_INSTALL_TARGETS, targetNeedsOverwrite, } from './skill-installer.js';
 import { renderBanner } from './banner.js';
 import { formatTaskCreateError } from './task-create-error.js';
@@ -33,6 +33,7 @@ import { ARTIFACT_MAX_BYTES, runnerOptimizerCommand } from './artifact-pull.js';
 import { killSwitchCommand } from './kill-switch-cli.js';
 import { egressAllowlistCommand } from './egress-allowlist-cli.js';
 import { acceptScoreRunCommand } from './scores-accept-cli.js';
+import { cleanupAll, throwWithCleanup } from './cleanup.js';
 import { listOptimizationRunsCommand } from './optimizations-list-cli.js';
 import { promoteOptimizationCommand } from './optimizations-promote-cli.js';
 import { scorersCommand } from './scorers-cli.js';
@@ -41,7 +42,7 @@ import { archiveArtifactCommand, listAssignmentsCommand, printAppSummaries, prin
 import { teamConnectorsCommand } from './team-connectors-cli.js';
 import { manifestsCommand } from './manifests-cli.js';
 import { workbenchCommand } from './workbench-cli.js';
-import { hostedCommand } from './hosted-session-cli.js';
+import { dispatchHostedCommands } from './hosted-commands.js';
 import { workspaceSyncCommand } from './workspace-sync.js';
 import { runGitCredentialInvocation } from './git-credential.js';
 import { instructionSetsCommand, syncToDisk } from './instruction-sets-cli.js';
@@ -52,7 +53,7 @@ import { readMarkdownReportInput } from './markdown-report-input.js';
 import { promptPushErrorMessage, promptReportCommand } from './prompt-report-cli.js';
 import { setPromptLabel } from './prompt-label-cli.js';
 import { printPromptSummaryTable } from './prompt-summary-table.js';
-import { assertSnapshotManifestConfined, verifyGepaRunnerDirsFromArgs, verifyRunnerDirRegistered } from './runner-dir-verify.js';
+import { assertSnapshotManifestConfined, extractFlagValue, verifyGepaRunnerDirsFromArgs, verifyRunnerDirRegistered, } from './runner-dir-verify.js';
 import { runScorersRegister } from './scorer-draft-push.js';
 import { runZipArtifactPush } from './zip-draft-push.js';
 import { runGithubLink, runInteractiveHostedSetup } from './github-setup.js';
@@ -811,6 +812,7 @@ async function logout() {
             body: 'refreshToken' in credentials
                 ? JSON.stringify({ refreshToken: credentials.refreshToken })
                 : undefined,
+            ...credentialRequestRedirectPolicy(),
         });
         if (!response.ok) {
             remoteLogoutError = sanitizeTerminalText(await response.text()).slice(0, 180);
@@ -1751,6 +1753,30 @@ async function updateOptimizationRunLifecycle(action) {
 }
 // ALI-1073 list moved to optimizations-list-cli.ts (line ratchet, ALI-976);
 // ALI-1175 labels its best scores as agent-reported evidence there.
+const GEPA_RUNNER_MATERIALIZATION_PAIRS = [
+    { versionFlag: '--runner-version-id', dirFlag: '--candidate-runner-dir' },
+    { versionFlag: '--scorer-runner-version-id', dirFlag: '--scorer-runner-dir' },
+];
+async function materializeMissingGepaRunnerDirs(args) {
+    const rewritten = [...args];
+    const cleanups = [];
+    const cleanup = () => cleanupAll(cleanups, 'Failed to clean materialized runner directories');
+    try {
+        for (const pair of GEPA_RUNNER_MATERIALIZATION_PAIRS) {
+            const runnerVersionId = extractFlagValue(rewritten, pair.versionFlag);
+            const runnerDir = extractFlagValue(rewritten, pair.dirFlag);
+            if (!runnerVersionId || runnerDir)
+                continue;
+            const materialized = await materializeRunnerVersion(runnerVersionId);
+            cleanups.push(materialized.cleanup);
+            rewritten.push(pair.dirFlag, materialized.runnerDir);
+        }
+    }
+    catch (error) {
+        throwWithCleanup(error, cleanups, 'Runner materialization failed and cleanup also failed');
+    }
+    return { args: rewritten, cleanup };
+}
 async function runGepaOptimization() {
     const project = getArg('--project') || await resolveProjectSlug(null);
     const baseUrl = getBaseUrl();
@@ -1763,11 +1789,12 @@ async function runGepaOptimization() {
     // itself (both argparse flag forms), fail-closed on half-populated pairs,
     // and REWRITES the dir flags to verified snapshots (the exact hashed bytes)
     // so a post-hash mutation of the original dirs cannot change what runs.
-    const verified = await verifyGepaRunnerDirsFromArgs(forwardedArgs);
-    forwardedArgs = verified.args;
-    let result;
+    const materialized = await materializeMissingGepaRunnerDirs(forwardedArgs);
+    let verified;
     let selectedEngine = 'official';
     try {
+        verified = await verifyGepaRunnerDirsFromArgs(materialized.args);
+        forwardedArgs = verified.args;
         // Uniform resolution (ALI-1090): honors ORIZU_TOKEN / ORIZU_TOKEN_FILE before
         // credentials.json so hosted sandboxes can run optimizations. Read at spawn
         // time — AFTER the verification awaits above, so a hosted token-file
@@ -1794,17 +1821,21 @@ async function runGepaOptimization() {
             dispatch.environment.ORIZU_INSTRUCTION_SET_PROFILE_VERSION_ID = instructionSetProfileVersionId;
         selectedEngine = dispatch.engine;
         const launch = prepareSkilledProposerLaunch(python, dispatch.engine, dispatch.environment);
-        result = await spawnSkilledProposerChild(launch.python, ['-m', dispatch.module, ...dispatch.args], dispatch.engine, launch.environment);
-    }
-    finally {
-        verified.cleanup();
-    }
-    if (result.error) {
-        throw new Error(`${selectedEngine} GEPA engine failed: ${result.error.message}`, { cause: result.error });
+        const result = await spawnSkilledProposerChild(launch.python, ['-m', dispatch.module, ...dispatch.args], dispatch.engine, launch.environment);
+        if (result.error) {
+            throw new Error(`${selectedEngine} GEPA engine failed: ${result.error.message}`, { cause: result.error });
+        }
+        if (result.status !== 0) {
+            throw new Error(`${selectedEngine} GEPA engine failed with exit code ${result.status}`);
+        }
     }
-    if (result.status !== 0) {
-        throw new Error(`${selectedEngine} GEPA engine failed with exit code ${result.status}`);
+    catch (error) {
+        throwWithCleanup(error, [
+            ...(verified ? [verified.cleanup] : []),
+            materialized.cleanup,
+        ], 'GEPA launch failed and runner cleanup also failed');
     }
+    cleanupAll([verified.cleanup, materialized.cleanup], 'Failed to clean GEPA runner directories');
     if (hasJsonFlag()) {
         printJson({ status: 'completed', exitCode: 0 });
     }
@@ -4467,24 +4498,27 @@ export async function materializeRunnerVersion(runnerVersionId) {
     const tempDir = mkdtempSync(join(tmpdir(), 'orizu-runner-version-'));
     const zipPath = join(tempDir, 'runner.zip');
     const runnerDir = join(tempDir, 'runner');
-    const zipBytes = new Uint8Array(await response.arrayBuffer());
-    if (zipBytes.byteLength > ARTIFACT_MAX_BYTES) {
-        rmSync(tempDir, { recursive: true, force: true });
-        throw new Error(`Runner artifact exceeds ${ARTIFACT_MAX_BYTES} bytes`);
-    }
-    writeFileSync(zipPath, zipBytes);
-    const result = spawnSync('unzip', ['-q', zipPath, '-d', runnerDir], {
-        encoding: 'utf8',
-    });
-    if (result.error) {
-        rmSync(tempDir, { recursive: true, force: true });
-        throw result.error;
+    const cleanup = () => rmSync(tempDir, { recursive: true, force: true });
+    try {
+        const zipBytes = new Uint8Array(await response.arrayBuffer());
+        if (zipBytes.byteLength > ARTIFACT_MAX_BYTES) {
+            throw new Error(`Runner artifact exceeds ${ARTIFACT_MAX_BYTES} bytes`);
+        }
+        writeFileSync(zipPath, zipBytes);
+        const result = spawnSync('unzip', ['-q', zipPath, '-d', runnerDir], {
+            encoding: 'utf8',
+        });
+        if (result.error) {
+            throw result.error;
+        }
+        if (result.status !== 0) {
+            throw new Error(`unzip failed: ${sanitizeTerminalText(result.stderr || result.stdout || '')}`);
+        }
+        return { runnerDir, cleanup };
     }
-    if (result.status !== 0) {
-        rmSync(tempDir, { recursive: true, force: true });
-        throw new Error(`unzip failed: ${sanitizeTerminalText(result.stderr || result.stdout || '')}`);
+    catch (error) {
+        throwWithCleanup(error, [cleanup], `Runner ${runnerVersionId} materialization failed and cleanup also failed`);
     }
-    return { runnerDir, cleanup: () => rmSync(tempDir, { recursive: true, force: true }) };
 }
 async function runnersExec() {
     const prompt = getArg('--prompt');
@@ -4895,6 +4929,8 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await acceptScoreRunCommand(cliArgs.slice(2), { json: hasJsonFlag(), print: printLine, resolveProjectSlug });
         return;
     }
+    if (await dispatchHostedCommands(cliArgs, { environment: process.env, getArg, json: hasJsonFlag(), printJson, printLine, printErr: printError, resolveProjectSlug, setExitCode: code => { process.exitCode = code; } }))
+        return;
     if (command === 'optimizations' && subcommand === 'start') {
         await startOptimizationRun();
         return;
@@ -4923,7 +4959,8 @@ export async function main(rawArgs = process.argv.slice(2)) {
     }
     if (command === 'optimizations' && subcommand === 'promote') {
         await promoteOptimizationCommand(cliArgs.slice(2), {
-            json: hasJsonFlag(), print: printLine, resolveProjectSlug, fetcher: authedFetch,
+            json: hasJsonFlag(), origin: parsed.flags, print: printLine, printErr: printError,
+            resolveProjectSlug, fetcher: authedFetch,
         });
         return;
     }
@@ -5071,10 +5108,6 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await downloadAnnotations();
         return;
     }
-    if (command === 'internal' || (command === 'session' && subcommand === 'start' && hasArg('--hosted'))) {
-        process.exitCode = await hostedCommand(cliArgs, { json: hasJsonFlag(), print: printLine, printErr: printError });
-        return;
-    }
     if (command === 'session' || command === 'run') {
         process.exitCode = await workbenchCommand(cliArgs, { json: hasJsonFlag(), print: printLine });
         return;

package/dist/optimizations-promote-cli.d.ts

@@ -1,6 +1,9 @@
+import type { GlobalFlags } from './global-flags.js';
 export interface OptimizationsPromoteIo {
     json: boolean;
+    origin: GlobalFlags;
     print: (line: string) => void;
+    printErr: (line: string) => void;
     resolveProjectSlug: (projectArg: string | null) => Promise<string>;
     fetcher: (path: string, init?: RequestInit) => Promise<Response>;
 }

package/dist/optimizations-promote-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"optimizations-promote-cli.d.ts","sourceRoot":"","sources":["../src/optimizations-promote-cli.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACjE;AAOD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB1G"}
+{"version":3,"file":"optimizations-promote-cli.d.ts","sourceRoot":"","sources":["../src/optimizations-promote-cli.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,WAAW,CAAA;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACjE;AA0DD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD1G"}

package/dist/optimizations-promote-cli.js

@@ -1,9 +1,59 @@
 import { extractErrorMessage } from './error-response.js';
-import { sanitizeTerminalText } from './json-response.js';
+import { sanitizeHumanInlineText, sanitizeTerminalText } from './json-response.js';
 function option(args, name) {
     const index = args.indexOf(name);
     return index === -1 || !args[index + 1] || args[index + 1].startsWith('--') ? null : args[index + 1];
 }
+function shellArgument(value) {
+    if (/^[A-Za-z0-9._/:@-]+$/.test(value))
+        return value;
+    if (/[\u0000-\u001F\u007F-\u009F\u2028\u2029]/.test(value)) {
+        let escaped = '';
+        for (const character of value) {
+            if (character === '\\')
+                escaped += '\\\\';
+            else if (character === "'")
+                escaped += "\\'";
+            else if (character === '\n')
+                escaped += '\\n';
+            else if (character === '\r')
+                escaped += '\\r';
+            else if (character === '\t')
+                escaped += '\\t';
+            else {
+                const codePoint = character.codePointAt(0);
+                if (codePoint <= 0x1f || codePoint === 0x7f) {
+                    escaped += `\\x${codePoint.toString(16).padStart(2, '0')}`;
+                }
+                else if ((codePoint >= 0x80 && codePoint <= 0x9f) || codePoint === 0x2028 || codePoint === 0x2029) {
+                    for (const byte of new TextEncoder().encode(character)) {
+                        escaped += `\\x${byte.toString(16).padStart(2, '0')}`;
+                    }
+                }
+                else {
+                    escaped += character;
+                }
+            }
+        }
+        return `$'${escaped}'`;
+    }
+    const safeValue = sanitizeTerminalText(value);
+    return `'${safeValue.replace(/'/g, `'\\''`)}'`;
+}
+function inlineTerminalText(value) {
+    return sanitizeHumanInlineText(sanitizeTerminalText, value)
+        .replaceAll('\u2028', '\\u2028')
+        .replaceAll('\u2029', '\\u2029');
+}
+const APPLIED_LABEL_VERSION_SKEW_NOTE = 'Server response predates the appliedLabel discriminator; printing the production-promotion follow-up as a fail-safe.';
+function productionPromotionReplay(runId, candidateId, project, origin) {
+    const originArguments = origin.local
+        ? ' --local'
+        : origin.server
+            ? ` --server ${shellArgument(origin.server)}`
+            : '';
+    return `Promote this profile with: orizu${originArguments} optimizations promote ${shellArgument(runId)} --candidate ${shellArgument(candidateId)} --label production --project ${shellArgument(project)}`;
+}
 export async function promoteOptimizationCommand(args, io) {
     const runId = args.find(arg => !arg.startsWith('--') && arg !== option(args, '--candidate') && arg !== option(args, '--label') && arg !== option(args, '--project'));
     const candidateId = option(args, '--candidate');
@@ -18,17 +68,35 @@ export async function promoteOptimizationCommand(args, io) {
     if (!response.ok)
         throw new Error(`Failed to promote optimization candidate: ${await extractErrorMessage(response)}`);
     const data = await response.json();
+    const isProfilePromotion = 'profileVersionId' in data;
+    const replay = isProfilePromotion && data.appliedLabel !== 'production'
+        ? productionPromotionReplay(runId, candidateId, project, io.origin)
+        : null;
     if (io.json) {
-        io.print(JSON.stringify(data.profileVersionId
-            ? { profileVersionId: data.profileVersionId, components: data.components ?? [] }
+        io.print(JSON.stringify(isProfilePromotion
+            ? {
+                profileVersionId: data.profileVersionId,
+                versionNumber: data.versionNumber,
+                appliedLabel: data.appliedLabel,
+                components: data.components,
+            }
             : { promptVersionId: data.promptVersionId }));
+        if (isProfilePromotion && data.appliedLabel === undefined) {
+            io.printErr(APPLIED_LABEL_VERSION_SKEW_NOTE);
+            io.printErr(replay);
+        }
         return;
     }
-    if (data.profileVersionId) {
+    if (isProfilePromotion) {
         io.print(`Promoted profile version ${sanitizeTerminalText(data.profileVersionId)}`);
-        for (const component of data.components ?? [])
-            io.print(`${sanitizeTerminalText(component.key)}: ${sanitizeTerminalText(component.status)}`);
+        if (data.appliedLabel === undefined) {
+            io.printErr(APPLIED_LABEL_VERSION_SKEW_NOTE);
+        }
+        if (replay)
+            io.print(replay);
+        for (const component of data.components)
+            io.print(`${inlineTerminalText(component.key)}: ${inlineTerminalText(component.status)}`);
         return;
     }
-    io.print(`Promoted prompt version ${sanitizeTerminalText(data.promptVersionId ?? '')}`);
+    io.print(`Promoted prompt version ${sanitizeTerminalText(data.promptVersionId)}`);
 }

package/dist/runner-dir-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-dir-verify.d.ts","sourceRoot":"","sources":["../src/runner-dir-verify.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;GAWG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AA6DD,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA4F5G;AAonBD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CA0EtF;AAYD;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5E;AAoBD,MAAM,WAAW,gBAAgB;IAC/B;gFAC4E;IAC5E,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,uEAAuE;IACvE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAChE,OAAO,CAAC,gBAAgB,CAAC,CAmD3B"}
+{"version":3,"file":"runner-dir-verify.d.ts","sourceRoot":"","sources":["../src/runner-dir-verify.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;GAWG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AA6DD,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA4F5G;AAonBD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CA0EtF;AAYD;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5E;AAoBD,MAAM,WAAW,gBAAgB;IAC/B;gFAC4E;IAC5E,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,uEAAuE;IACvE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAChE,OAAO,CAAC,gBAAgB,CAAC,CAuD3B"}

package/dist/runner-dir-verify.js

@@ -3,6 +3,7 @@ import { tmpdir } from 'os';
 import { basename, dirname, isAbsolute, join, normalize } from 'path';
 import { archiveArtifactEntries, expandHomePath, readArtifactEntries, shouldExcludeArtifactPath, } from './artifact-archive.js';
 import { authedFetch } from './http.js';
+import { cleanupAll, throwWithCleanup } from './cleanup.js';
 function scanRunnerDir(dir, relativeDir = '') {
     const absoluteDir = relativeDir ? join(dir, relativeDir) : dir;
     const result = { envFiles: [], symlinks: [] };
@@ -82,7 +83,7 @@ export async function verifyRunnerDirRegistered(input) {
             'cannot be verified against it. Drop the flag to execute the registered bytes.');
     }
     if (registeredSha.toLowerCase() !== localSha.toLowerCase()) {
-        throw new Error(`Local runner bytes at ${dir} are not registered runner version ${input.runnerVersionId} ` +
+        throw new Error(`runner_version_bytes_mismatch: Local runner bytes at ${dir} are not registered runner version ${input.runnerVersionId} ` +
             `(content sha ${localSha} != ${registeredSha}). Runs may only execute registered runner bytes ` +
             '(ADR-007): register the directory first with `orizu runners push` ' +
             '(use --session <session-id> inside a workspace session) and re-run against the new version, ' +
@@ -802,10 +803,7 @@ export async function verifyGepaRunnerDirsFromArgs(args, fetcher) {
     let rewritten = [...args];
     const verifiedDirs = [];
     const cleanups = [];
-    const cleanup = () => {
-        for (const dispose of cleanups)
-            dispose();
-    };
+    const cleanup = () => cleanupAll(cleanups, 'Failed to clean verified runner snapshots');
     try {
         for (const pair of GEPA_RUNNER_FLAG_PAIRS) {
             // Duplicate flags are refused outright (codex round 3, P1): argparse
@@ -841,8 +839,7 @@ export async function verifyGepaRunnerDirsFromArgs(args, fetcher) {
         }
     }
     catch (error) {
-        cleanup();
-        throw error;
+        throwWithCleanup(error, cleanups, 'Runner verification failed and snapshot cleanup also failed');
     }
     return { args: rewritten, verifiedDirs, cleanup };
 }

package/dist/skilled-proposer-bake-report.d.ts

@@ -0,0 +1,2 @@
+export declare const SKILLED_PROPOSER_BAKE_REPORT_FIELDS: readonly ["venv", "publishKey", "publishedVenv", "waitedForPublishLock", "pythonPathEntries", "executedPipArgv", "sslCertFile", "warnings", "marker", "python", "packageRoot", "manager", "lock", "vendoredGepaPath", "launcherVenv", "launcherSslCertFile"];
+//# sourceMappingURL=skilled-proposer-bake-report.d.ts.map

package/dist/skilled-proposer-bake-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skilled-proposer-bake-report.d.ts","sourceRoot":"","sources":["../src/skilled-proposer-bake-report.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mCAAmC,8PAA+P,CAAA"}

package/dist/skilled-proposer-bake-report.js

@@ -0,0 +1 @@
+export const SKILLED_PROPOSER_BAKE_REPORT_FIELDS = ['venv', 'publishKey', 'publishedVenv', 'waitedForPublishLock', 'pythonPathEntries', 'executedPipArgv', 'sslCertFile', 'warnings', 'marker', 'python', 'packageRoot', 'manager', 'lock', 'vendoredGepaPath', 'launcherVenv', 'launcherSslCertFile'];

package/dist/skilled-proposer-launch.d.ts

@@ -1,11 +1,33 @@
 import type { GepaEngine } from './gepa-engine-dispatch.js';
+interface SkilledProposerVenvReport {
+    venv: string;
+    publishKey: string;
+    sslCertFile: string | null;
+    pythonPathEntries: string[];
+    warnings: Array<{
+        code: string;
+        message: string;
+    }>;
+    waitedForPublishLock: boolean;
+    error?: string;
+    message?: string;
+    publishedVenv?: boolean | null;
+    executedPipArgv?: string[] | null;
+}
 export interface SkilledProposerLaunch {
     python: string;
     environment: NodeJS.ProcessEnv;
+    report?: SkilledProposerVenvReport;
 }
 export declare function spawnSkilledProposerChild(command: string, args: string[], engine: GepaEngine, environment: NodeJS.ProcessEnv): Promise<{
     status: number | null;
     error?: Error;
 }>;
+interface BakeCommandIo {
+    print: (value: string) => void;
+    printErr?: (value: string) => void;
+}
+export declare function skilledProposerBakeCommand(io: BakeCommandIo, verify?: boolean): number;
 export declare function prepareSkilledProposerLaunch(python: string, engine: GepaEngine, environment: NodeJS.ProcessEnv): SkilledProposerLaunch;
+export {};
 //# sourceMappingURL=skilled-proposer-launch.d.ts.map

package/dist/skilled-proposer-launch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skilled-proposer-launch.d.ts","sourceRoot":"","sources":["../src/skilled-proposer-launch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAa3D,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;CAC/B;AAiBD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU;YA4B9C,MAAM,GAAG,IAAI;YAAU,KAAK;GAUlE;AAwCD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,qBAAqB,CAwBvB"}
+{"version":3,"file":"skilled-proposer-launch.d.ts","sourceRoot":"","sources":["../src/skilled-proposer-launch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAK3D,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,oBAAoB,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAClC;AACD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,CAAC,EAAE,yBAAyB,CAAA;CACnC;AAiBD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU;YA4B9C,MAAM,GAAG,IAAI;YAAU,KAAK;GAUlE;AAwCD,UAAU,aAAa;IAAG,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE;AAQ9F,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,UAAQ,GAAG,MAAM,CAepF;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,qBAAqB,CAyBvB"}

package/dist/skilled-proposer-launch.js

@@ -1,10 +1,11 @@
 import { spawn, spawnSync } from 'child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'fs';
+import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
 import { fileURLToPath } from 'url';
-import { bundledOfficialGepaPythonPath } from './gepa-python-paths.js';
+import { bundledOfficialGepaPythonPath, getGepaPythonPathEntries } from './gepa-python-paths.js';
 import { sanitizeTerminalText } from './json-response.js';
+import { SKILLED_PROPOSER_BAKE_REPORT_FIELDS } from './skilled-proposer-bake-report.js';
 function materializeConfigPayload(engine, environment) {
     const payload = environment.ORIZU_SKILLED_PROPOSER_CONFIG;
     if (engine !== 'official' || environment.ORIZU_CANDIDATE_PROPOSER !== 'skilled-proposer' || payload === undefined)
@@ -67,12 +68,11 @@ export async function spawnSkilledProposerChild(command, args, engine, environme
         cleanup();
     }
 }
-function ensureSelectedSkilledProposerVenv(python, vendoredGepaPath) {
+function ensureSelectedSkilledProposerVenv(python, vendoredGepaPath, cacheRoot = existsSync('/opt/orizu/prebaked.json')
+    ? '/opt/orizu/cache/skilled-proposer'
+    : join(process.cwd(), '.orizu', 'cache', 'skilled-proposer')) {
     const manager = fileURLToPath(new URL('../scripts/ensure-skilled-proposer-venv.mjs', import.meta.url));
     const lock = fileURLToPath(new URL('../requirements/skilled-proposer.lock', import.meta.url));
-    // This is a regenerable workspace cache. The manager's publish key further
-    // separates interpreters, platforms, and lock revisions inside it.
-    const cacheRoot = join(process.cwd(), '.orizu', 'cache', 'skilled-proposer');
     const result = spawnSync(process.execPath, [manager, '--python', python, '--cache-root', cacheRoot, '--lock', lock,
         '--vendored-gepa-path', vendoredGepaPath, '--json'], {
         env: process.env,
@@ -98,6 +98,38 @@ function ensureSelectedSkilledProposerVenv(python, vendoredGepaPath) {
     }
     return report;
 }
+const packageRoot = join(fileURLToPath(new URL('.', import.meta.url)), '..');
+const managerPath = join(packageRoot, 'scripts/ensure-skilled-proposer-venv.mjs');
+const lockPath = join(packageRoot, 'requirements/skilled-proposer.lock');
+const vendoredGepaPath = join(packageRoot, 'vendor/gepa-python/src');
+const packagedPythonPathEntries = ['vendor/orizu-gepa/src', 'vendor/orizu-gepa-python/src', 'vendor/gepa-python/src'].map(path => join(packageRoot, path));
+const bakedCacheRoot = '/opt/orizu/cache/skilled-proposer';
+export function skilledProposerBakeCommand(io, verify = false) {
+    try {
+        const python = process.env.PYTHON || 'python3';
+        if (!verify) {
+            io.print(JSON.stringify(ensureSelectedSkilledProposerVenv(python, vendoredGepaPath, bakedCacheRoot)));
+            return 0;
+        }
+        if (!readdirSync(join(bakedCacheRoot, 'venvs'), { withFileTypes: true }).some(entry => entry.isDirectory() && existsSync(join(bakedCacheRoot, 'venvs', entry.name, '.orizu-skilled-proposer-venv.json'))))
+            throw new Error('ALI_1588_VENV_MARKER_MISSING');
+        const environment = { ...process.env, ORIZU_CANDIDATE_PROPOSER: 'skilled-proposer' };
+        const launch = prepareSkilledProposerLaunch(python, 'official', environment);
+        const report = launch.report;
+        if (report.publishedVenv !== false || report.executedPipArgv !== null)
+            throw new Error('ALI_1588_DEPENDENCY_SETUP_NOT_REUSED');
+        const pythonPathEntries = getGepaPythonPathEntries(undefined);
+        if (JSON.stringify(pythonPathEntries) !== JSON.stringify(packagedPythonPathEntries))
+            throw new Error('ALI_1588_PYTHON_ROOT_MISSING');
+        const completeReport = { ...report, pythonPathEntries, marker: 'ALI_1588_DEPENDENCY_SETUP_REUSED', python: launch.python, packageRoot, manager: managerPath, lock: lockPath, vendoredGepaPath, launcherVenv: launch.environment.ORIZU_SKILLED_PROPOSER_VENV ?? null, launcherSslCertFile: launch.environment.SSL_CERT_FILE ?? null };
+        io.print(JSON.stringify(Object.fromEntries(SKILLED_PROPOSER_BAKE_REPORT_FIELDS.map(key => [key, completeReport[key]]))));
+        return 0;
+    }
+    catch (error) {
+        io.printErr?.(`${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}
 export function prepareSkilledProposerLaunch(python, engine, environment) {
     if (engine !== 'official' || environment.ORIZU_CANDIDATE_PROPOSER !== 'skilled-proposer') {
         return { python, environment };
@@ -120,5 +152,6 @@ export function prepareSkilledProposerLaunch(python, engine, environment) {
             ? join(report.venv, 'Scripts', 'python.exe')
             : join(report.venv, 'bin', 'python'),
         environment,
+        report,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.22",
+  "version": "0.5.23",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",