orizu 0.5.22 → 0.5.24

package/README.md

@@ -28,24 +28,52 @@ By default, the CLI talks to `https://orizu.ai`.
 ## Updating bundled GEPA
 
 The CLI ships a verified, source-only copy of official GEPA so optimization
-users never need `pip` or a network connection. To upgrade it, make a PR that
-updates the version, release commit, and SHA-256 pin in
-`scripts/vendor-gepa-python.mjs`, then re-runs the refresh command with the
-matching downloaded wheel:
+users never need `pip` or a network connection. From the repository root,
+derive both mandatory pins independently from the downloaded wheel:
 
 ```bash
-node scripts/vendor-gepa-python.mjs --refresh --archive /path/to/gepa-<version>-py3-none-any.whl
+python3 - /path/to/gepa-<version>-py3-none-any.whl <version> <<'PY'
+import hashlib, json, sys, zipfile
+from pathlib import Path
+
+wheel, version = Path(sys.argv[1]), sys.argv[2]
+license_member = f'gepa-{version}.dist-info/licenses/LICENSE'
+files = {}
+with zipfile.ZipFile(wheel) as archive:
+    for member in archive.infolist():
+        if member.is_dir():
+            continue
+        if member.filename.startswith('gepa/'):
+            path = f'src/{member.filename}'
+        elif member.filename == license_member:
+            path = 'LICENSE'
+        else:
+            continue
+        files[path] = hashlib.sha256(archive.read(member)).hexdigest()
+entries = sorted(files.items())
+print('GEPA_WHEEL_SHA256=' + hashlib.sha256(wheel.read_bytes()).hexdigest())
+print('GEPA_TREE_SHA256=' + hashlib.sha256(json.dumps(entries, separators=(',', ':')).encode()).hexdigest())
+PY
 ```
 
-Commit the refreshed `gepa-python-source.zip` and run the CLI packaging test.
-`npm pack` verifies that archive and materializes only the shipped source tree;
-it never downloads GEPA.
+Update `GEPA_VERSION`, `GEPA_RELEASE_COMMIT`, `GEPA_WHEEL_FILENAME`,
+`GEPA_WHEEL_SHA256`, `GEPA_TREE_SHA256`, and the extractor's license member in
+`packages/cli/scripts/vendor-gepa-python.mjs`. Both SHA-256 constants must
+change together before running the matching refresh command:
+
+```bash
+node packages/cli/scripts/vendor-gepa-python.mjs --refresh --archive /path/to/gepa-<version>-py3-none-any.whl
+```
+
+Commit the refreshed `packages/cli/gepa-python-source.zip`, then run
+`bun test test/cli-gepa-packaging.test.ts test/cli/provision-snapshot.test.ts`.
+These gates cover both pins. `npm pack` never downloads GEPA.
 
 For a development checkout, materialize that same verified source before local
 work that imports GEPA:
 
 ```bash
-node scripts/vendor-gepa-python.mjs
+node packages/cli/scripts/vendor-gepa-python.mjs
 ```
 
 ## Install
@@ -58,12 +86,15 @@ Install the CLI globally with your package manager:
 | pnpm | `pnpm add -g orizu` |
 | Bun | `bun add -g orizu` |
 
-Then run the guided setup — it signs you in, initializes the local workspace
-contract, installs global coding-agent skill symlinks, and shows the next
-command for repo-specific Orizu adoption:
+Then run the guided setup — it signs you in, asks you to choose or create a
+team and project, initializes the local workspace contract, installs the shared
+`~/.agents/skills/orizu` skill plus selected native targets, and optionally
+launches Claude, Codex, or Pi:
 
 ```bash
 orizu setup
+# Scripts use explicit choices after `orizu login --headless`:
+orizu setup --team acme --project support-agent --agent codex --non-interactive
 ```
 
 To repair or customize skill installs later, run the companion skill installer
@@ -109,9 +140,8 @@ Agents are first-class users of this CLI: **every command supports `--json`**
 (as a prefix, `orizu --json teams list`, or a trailing flag) and emits a single
 machine-readable JSON document instead of formatted text. Discover the full
 command surface, including global options, with `orizu capabilities --json`.
-Hosted agents may read and sync instruction sets and prepare complete manifests,
-but a human curator using the local CLI with a user token must run instruction
-create, push, shape, archive, restore, and production/default pointer mutations.
+Hosted agents may read and sync instruction sets, create profile seeds, run shape add/remove with team-scoped curator authority, and prepare complete manifests. A local coding agent using the user's token runs instruction create, push, shape add/remove, archive, and restore itself after plan ratification. It gathers only read-only pointer-resolution and binding evidence; a human curator executes every production/default pointer command on every surface.
+In a hosted session, a human curator using the local CLI must run create/push, archive/restore, and every pointer command; shape add/remove stays agent-runnable because it creates unpromoted heads only.
 
 ## Authentication
 
@@ -124,6 +154,12 @@ orizu login
 This will open a browser tab for you to login with. You must either have an account on the [Orizu platform](https://orizu.ai) or it will help you create one.
 Approving the login creates a personal access token for the CLI and stores it in your local Orizu credentials file. You can revoke CLI tokens from the Personal Tokens page in Orizu.
 
+In an SSH or display-less Linux session, the CLI automatically prints an approval URL and polls for completion instead of opening a local browser. Force this mode when needed with:
+
+```bash
+orizu login --headless
+```
+
 **Check the signed-in user**
 
 ```bash
@@ -196,11 +232,11 @@ orizu logout
     <td><code>orizu prompts list --project ops-eval/support-qa [--status active|archived|all]</code></td>
   </tr>
   <tr>
-    <td>Archive or restore an instruction set (human/local CLI only)</td>
+    <td>Archive or restore an instruction set (local agent or human; hosted human only)</td>
     <td><code>orizu instructions archive &lt;slug-or-exact-name&gt; --project ops-eval/support-qa</code><br><code>orizu instructions restore &lt;slug-or-exact-name&gt; --project ops-eval/support-qa</code></td>
   </tr>
   <tr>
-    <td>Push an instruction-set manifest (human/local CLI only)</td>
+    <td>Push an instruction-set manifest (local agent or human; hosted human only)</td>
     <td><code>orizu instructions push ./orizu.instruction-set.json --project ops-eval/support-qa --set &lt;slug-or-exact-name&gt;</code></td>
   </tr>
   <tr>
@@ -211,12 +247,12 @@ orizu logout
     <td colspan="2"><strong>Report comments</strong></td>
   </tr>
   <tr>
-    <td>List report comments</td>
-    <td><code>orizu comments list --prompt &lt;promptIdOrName&gt; --project ops-eval/support-qa</code><br><code>orizu comments list --run &lt;runId&gt;</code><br><code>orizu comments list --task &lt;taskId&gt;</code></td>
+    <td>List report or README comments</td>
+    <td><code>orizu comments list --prompt &lt;promptIdOrName&gt; --project ops-eval/support-qa</code><br><code>orizu comments list --run &lt;runId&gt;</code><br><code>orizu comments list --task &lt;taskId&gt;</code><br><code>orizu comments list --dataset &lt;datasetIdOrName&gt; --project ops-eval/support-qa</code></td>
   </tr>
   <tr>
     <td>Add or update comments</td>
-    <td><code>orizu comments add --run &lt;runId&gt; --body @comment.md --anchor "Summary" --lines 4:6</code><br><code>orizu comments reply &lt;commentId&gt; --body "Fixed"</code><br><code>orizu comments resolve &lt;commentId&gt;</code></td>
+    <td><code>orizu comments add --run &lt;runId&gt; --body @comment.md --anchor "Summary" --lines 4:6</code><br><code>orizu comments add --dataset &lt;datasetIdOrName&gt; --project ops-eval/support-qa --body "Clarify this README" --anchor "Summary" --lines 4:6</code><br><code>orizu comments reply &lt;commentId&gt; --body "Fixed"</code><br><code>orizu comments resolve &lt;commentId&gt;</code></td>
   </tr>
   <tr>
     <td colspan="2"><strong>Diff comments</strong></td>
@@ -384,4 +420,4 @@ Use `--json` on supported task and app commands when automation needs structured
 ## More Documentation
 
 - [docs/cli.md](docs/cli.md): complete CLI guide and command reference
-- [skills/orizu-cli/references/cli-reference.md](skills/orizu-cli/references/cli-reference.md): compact command matrix and end-to-end flows
+- [skills/orizu/references/cli-reference.md](skills/orizu/references/cli-reference.md): compact command matrix and end-to-end flows

package/dist/child-output-tee.d.ts

@@ -0,0 +1,48 @@
+import { Readable, Writable } from 'node:stream';
+declare class FileDescriptorSink extends Writable {
+    private readonly descriptor;
+    private readonly activeWriteCancellations;
+    private isLiveOutputAvailable;
+    private relay;
+    constructor(descriptor: number);
+    _write(chunk: Buffer, _encoding: BufferEncoding, callback: (error?: Error | null) => void): void;
+    prepare(): Promise<void>;
+    cancelPendingWrites(): void;
+    private relayProcess;
+}
+export declare const childOutputSinks: {
+    stdout: FileDescriptorSink;
+    stderr: FileDescriptorSink;
+};
+export interface PipedChild {
+    stdout: Readable;
+    stderr: Readable;
+    exited: Promise<number | null>;
+    signalCode: NodeJS.Signals | null;
+    kill(signal?: number | NodeJS.Signals): void;
+}
+export declare function spawnPipedChild(command: string, args: string[], environment: NodeJS.ProcessEnv): Promise<PipedChild>;
+export declare function writeChildStderr(text: string): Promise<void>;
+export interface ChildOutputForwarding {
+    completed: Promise<void>;
+    failure: Promise<Error>;
+    failureReason(): Error | undefined;
+    expectSourceClose(): void;
+    stopLiveOutput(): void;
+}
+export interface ChildOutputCapture {
+    stdout(chunk: string): void;
+    stderr(chunk: string): void;
+}
+export declare function completePipedChild(child: PipedChild, forwarding: readonly ChildOutputForwarding[]): Promise<number | null>;
+export declare function runPipedChild(command: string, args: string[], environment: NodeJS.ProcessEnv, onSpawn: () => Promise<void>, capture: ChildOutputCapture, observeChild?: (child: PipedChild) => void): Promise<{
+    status: number | null;
+    error?: Error;
+}>;
+/**
+ * Forward a child stream live while retaining a bounded caller-owned copy.
+ * Transient sink slowness pushes back; a stall degrades safely to capture-only.
+ */
+export declare function teeChildOutput(source: Readable, destination: Writable, capture: (chunk: string) => void): ChildOutputForwarding;
+export {};
+//# sourceMappingURL=child-output-tee.d.ts.map

package/dist/child-output-tee.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-output-tee.d.ts","sourceRoot":"","sources":["../src/child-output-tee.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAsHhD,cAAM,kBAAmB,SAAQ,QAAQ;IAK3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJvC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAwB;IACjE,OAAO,CAAC,qBAAqB,CAAO;IACpC,OAAO,CAAC,KAAK,CAA6B;gBAEb,UAAU,EAAE,MAAM;IAItC,MAAM,CACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,cAAc,EACzB,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GACvC,IAAI;IAgCD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B,mBAAmB,IAAI,IAAI;IAS3B,OAAO,CAAC,YAAY;CAiCrB;AAED,eAAO,MAAM,gBAAgB;;;CAG5B,CAAA;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC9B,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;IACjC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAC7C;AAqDD,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,OAAO,CAAC,UAAU,CAAC,CAiDrB;AAoCD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWlE;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACvB,aAAa,IAAI,KAAK,GAAG,SAAS,CAAA;IAClC,iBAAiB,IAAI,IAAI,CAAA;IACzB,cAAc,IAAI,IAAI,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAuCD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAC3C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6CxB;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC5B,OAAO,EAAE,kBAAkB,EAC3B,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GACzC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,CAqBnD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,QAAQ,EACrB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAC/B,qBAAqB,CA2DvB"}