orizu 0.5.23 → 0.5.24

package/dist/cli-auth-browser-page.js

@@ -0,0 +1,107 @@
+export function renderCliAuthBrowserPage(status) {
+    const isSuccess = status === 'success';
+    const eyebrow = isSuccess ? '// cli login complete' : '// cli login';
+    const title = isSuccess ? 'Browser authorization complete' : 'Missing authorization code';
+    const detail = isSuccess
+        ? 'Your terminal will finish connecting the Orizu CLI. You can close this tab.'
+        : 'Close this tab and run orizu login again to start a fresh browser request.';
+    const accent = isSuccess ? '#E8923C' : '#C8442A';
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Orizu CLI Login</title>
+    <style>
+      @import url('https://fonts.googleapis.com/css2?family=Geist+Mono:wght@400;500;700&display=swap');
+      :root {
+        color-scheme: light;
+        --paper: #F4EFE3;
+        --border: #E6DFCE;
+        --ink: #353535;
+        --muted: #6B6358;
+      }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0;
+        min-height: 100vh;
+        background: #FFFFFF;
+        color: #4B4B4B;
+        font-family: 'Geist Mono', Menlo, Monaco, Consolas, monospace;
+        letter-spacing: -0.025em;
+      }
+      main {
+        min-height: 100vh;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 48px 24px;
+      }
+      section {
+        width: min(100%, 520px);
+        text-align: center;
+      }
+      .brand {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        gap: 12px;
+        margin-bottom: 28px;
+      }
+      .brand svg {
+        width: 42px;
+        height: 42px;
+        color: #202124;
+      }
+      .brand span {
+        color: #000000;
+        font-size: 16px;
+        font-weight: 700;
+      }
+      .eyebrow {
+        margin: 0 0 12px;
+        color: ${accent};
+        font-size: 12px;
+        text-transform: lowercase;
+      }
+      h1 {
+        margin: 0 0 8px;
+        color: var(--ink);
+        font-size: 24px;
+        line-height: 1.15;
+        letter-spacing: -0.05em;
+      }
+      .detail {
+        margin: 0;
+        color: var(--muted);
+        font-size: 13px;
+        line-height: 1.6;
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <section>
+        <div class="brand" aria-hidden="true">
+          <svg viewBox="0 0 2048 2048" xmlns="http://www.w3.org/2000/svg">
+            <g fill="currentColor">
+              <polygon points="1545,879 787,1195 1189,1577"></polygon>
+              <polygon points="992,624 444,1104 688,1338"></polygon>
+              <polygon points="602,1593 1180,1594 768,1202"></polygon>
+              <polygon points="1650,1195 1398,1203 1204,1594 1229,1593"></polygon>
+              <polygon points="807,413 751,509 823,744 980,608"></polygon>
+              <polygon points="441,1127 592,1572 681,1356"></polygon>
+              <polygon points="793,399 611,457 604,471 658,602"></polygon>
+              <polygon points="593,493 498,667 636,600"></polygon>
+            </g>
+          </svg>
+          <span>orizu</span>
+        </div>
+        <p class="eyebrow">${eyebrow}</p>
+        <h1>${title}</h1>
+        <p class="detail">${detail}</p>
+      </section>
+    </main>
+  </body>
+</html>`;
+}

package/dist/github-setup.js

@@ -46,8 +46,8 @@ function alreadyInstalledHintLines(teamSlug) {
         '     • Install the App into a DIFFERENT GitHub org for this team (each org',
         '       installation can be linked to exactly one Orizu team).',
         '     • If the org is not linked to any Orizu team, uninstall the Orizu App',
-        '       from the org (GitHub → org Settings → GitHub Apps) and re-run',
-        `       \`orizu github link --team ${teamSlug}\` to do a fresh install.`,
+        '       from the org (GitHub → org Settings → GitHub Apps), then',
+        `       contact Orizu support to restart GitHub linking for team ${teamSlug}.`,
     ];
 }
 function defaultSleep(ms) {
@@ -99,7 +99,7 @@ export async function runGithubLink(teamSlug, io) {
     else {
         io.print('   Open the URL above and install the App, then return here.');
     }
-    io.print(`   Waiting for you to finish installing in the browser… (Ctrl+C to abort; resume later with \`orizu github link --team ${teamSlug}\`).`);
+    io.print('   Waiting for you to finish installing in the browser… (Ctrl+C to abort).');
     const now = io.now ?? (() => Date.now());
     const sleep = io.sleep ?? defaultSleep;
     const interval = io.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
@@ -125,7 +125,7 @@ export async function runGithubLink(teamSlug, io) {
             // the server's reason and exit non-zero instead of polling until timeout.
             if (data.status === 'unsupported_account' || data.status === 'expired') {
                 throw new Error(data.error ??
-                    `GitHub link could not be completed. Re-run \`orizu github link --team ${teamSlug}\`.`);
+                    `GitHub link could not be completed for team ${teamSlug}. Contact Orizu support to restart it.`);
             }
             // status 'pending' → keep waiting.
         }
@@ -135,12 +135,12 @@ export async function runGithubLink(teamSlug, io) {
             throw new Error(`Timed out waiting for the GitHub App install to complete after ${Math.round(timeout / 60000)} minutes. ` +
                 'If the Orizu GitHub App is already installed in that org, GitHub never notifies Orizu when you finish the "Configure" flow — ' +
                 'install the App into a DIFFERENT GitHub org for this team (or uninstall it from the org first if no other Orizu team uses it). ' +
-                `Resume with \`orizu github link --team ${teamSlug}\` after finishing the install.`);
+                `Contact Orizu support to resume GitHub linking for team ${teamSlug} after finishing the install.`);
         }
         if (!printedAlreadyInstalledHint && now() - started >= ALREADY_INSTALLED_HINT_MS) {
             for (const line of alreadyInstalledHintLines(teamSlug))
                 io.print(line);
-            io.print(`   Still waiting (Ctrl+C to abort; resume later with \`orizu github link --team ${teamSlug}\`)…`);
+            io.print('   Still waiting (Ctrl+C to abort)…');
             printedAlreadyInstalledHint = true;
             lastHeartbeat = now();
         }
@@ -160,12 +160,12 @@ async function confirmLink(teamSlug, orgLogin, io, fetcher) {
     io.print(`   GitHub reported installation on org: ${orgLogin ?? '(unknown)'}`);
     if (!io.confirm) {
         throw new Error(`Org ${orgLogin ?? '(unknown)'} is bound but needs confirmation. ` +
-            `Run \`orizu github link --team ${teamSlug}\` interactively to confirm.`);
+            `Contact Orizu support to confirm GitHub linking for team ${teamSlug}.`);
     }
     const approved = await io.confirm(orgLogin);
     if (!approved) {
         throw new Error(`Did not confirm org ${orgLogin ?? '(unknown)'}. ` +
-            `Re-run \`orizu github link --team ${teamSlug}\` to link the correct org.`);
+            `Contact Orizu support to link the correct GitHub organization for team ${teamSlug}.`);
     }
     const resp = await fetcher('/api/cli/github/link/confirm', {
         method: 'POST',

package/dist/headless-login.d.ts

@@ -0,0 +1,17 @@
+interface HeadlessLoginDependencies {
+    parseJsonResponse: <T>(response: Response, context: string) => Promise<T>;
+    printProgress: (message: string) => void;
+    sanitizeTerminalText: (text: string) => string;
+    validateBrowserUrl: (url: string, expectedOrigin?: string) => URL;
+}
+export declare function shouldUseHeadlessLogin({ isForced, platform, environment, }: {
+    isForced: boolean;
+    platform?: NodeJS.Platform;
+    environment?: Record<string, string | undefined>;
+}): boolean;
+export declare function waitForHeadlessAuthorization({ baseUrl, codeChallenge, }: {
+    baseUrl: string;
+    codeChallenge: string;
+}, dependencies: HeadlessLoginDependencies): Promise<string>;
+export {};
+//# sourceMappingURL=headless-login.d.ts.map

package/dist/headless-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-login.d.ts","sourceRoot":"","sources":["../src/headless-login.ts"],"names":[],"mappings":"AAYA,UAAU,yBAAyB;IACjC,iBAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IACzE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,GAAG,CAAA;CAClE;AAED,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,QAA2B,EAC3B,WAAyB,GAC1B,EAAE;IACD,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACjD,GAAG,OAAO,CAMV;AAsCD,wBAAsB,4BAA4B,CAChD,EACE,OAAO,EACP,aAAa,GACd,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;CACtB,EACD,YAAY,EAAE,yBAAyB,GACtC,OAAO,CAAC,MAAM,CAAC,CAiGjB"}

package/dist/headless-login.js

@@ -0,0 +1,105 @@
+export function shouldUseHeadlessLogin({ isForced, platform = process.platform, environment = process.env, }) {
+    if (isForced || environment.SSH_CONNECTION || environment.SSH_TTY) {
+        return true;
+    }
+    return platform === 'linux' && !environment.DISPLAY && !environment.WAYLAND_DISPLAY;
+}
+const POLL_INTERVAL_MS = 2_000;
+const POLL_REQUEST_TIMEOUT_MS = 15_000;
+const MAX_RETRY_DELAY_MS = 60_000;
+const MAX_CONSECUTIVE_TRANSPORT_ERRORS = 3;
+function retryDelayMs(response) {
+    if (response.status !== 429)
+        return POLL_INTERVAL_MS;
+    const retryAfterHeader = response.headers.get('retry-after');
+    const retryAfterSeconds = retryAfterHeader === null ? NaN : Number(retryAfterHeader);
+    return Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
+        ? Math.min(retryAfterSeconds * 1000, MAX_RETRY_DELAY_MS)
+        : POLL_INTERVAL_MS;
+}
+async function sleepWithinDeadline(delayMs, expiresAt) {
+    const remainingMs = expiresAt - Date.now();
+    if (remainingMs <= 0)
+        return;
+    await new Promise(resolve => setTimeout(resolve, Math.min(delayMs, remainingMs)));
+}
+async function retryAfterTransportError(error, consecutiveErrors, expiresAt) {
+    const nextCount = consecutiveErrors + 1;
+    if (nextCount >= MAX_CONSECUTIVE_TRANSPORT_ERRORS) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Headless login could not reach the server after ${nextCount} attempts: ${detail}`);
+    }
+    await sleepWithinDeadline(POLL_INTERVAL_MS, expiresAt);
+    return nextCount;
+}
+export async function waitForHeadlessAuthorization({ baseUrl, codeChallenge, }, dependencies) {
+    const startResponse = await fetch(`${baseUrl}/api/cli/auth/start`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ codeChallenge, flow: 'headless' }),
+        signal: AbortSignal.timeout(POLL_REQUEST_TIMEOUT_MS),
+    });
+    if (!startResponse.ok) {
+        throw new Error(`Failed to start login: ${await startResponse.text()}`);
+    }
+    const started = await dependencies.parseJsonResponse(startResponse, 'CLI headless auth start');
+    const authorizeUrl = dependencies.validateBrowserUrl(started.authorizeUrl, baseUrl).href;
+    if (!started.requestId || !started.pollToken || !Number.isFinite(started.expiresInSeconds)) {
+        throw new Error('Server returned an invalid headless login response.');
+    }
+    dependencies.printProgress(`Open this URL to log in: ${dependencies.sanitizeTerminalText(authorizeUrl)}`);
+    const expiresAt = Date.now() + (started.expiresInSeconds * 1000);
+    let consecutiveTransportErrors = 0;
+    while (Date.now() < expiresAt) {
+        const remainingMs = expiresAt - Date.now();
+        let pollResponse;
+        try {
+            pollResponse = await fetch(`${baseUrl}/api/cli/auth/poll`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    requestId: started.requestId,
+                    pollToken: started.pollToken,
+                }),
+                signal: AbortSignal.timeout(Math.max(1, Math.min(POLL_REQUEST_TIMEOUT_MS, remainingMs))),
+            });
+        }
+        catch (error) {
+            consecutiveTransportErrors = await retryAfterTransportError(error, consecutiveTransportErrors, expiresAt);
+            continue;
+        }
+        if (!pollResponse.ok) {
+            if (pollResponse.status === 429) {
+                consecutiveTransportErrors = 0;
+                await sleepWithinDeadline(retryDelayMs(pollResponse), expiresAt);
+                continue;
+            }
+            if (pollResponse.status >= 500) {
+                const detail = await pollResponse.text().catch(() => 'response body unavailable');
+                consecutiveTransportErrors = await retryAfterTransportError(new Error(`Server returned ${pollResponse.status}: ${detail}`), consecutiveTransportErrors, expiresAt);
+                continue;
+            }
+            throw new Error(`Failed to poll login: ${await pollResponse.text()}`);
+        }
+        let polled;
+        try {
+            polled = await dependencies.parseJsonResponse(pollResponse, 'CLI headless auth poll');
+        }
+        catch (error) {
+            consecutiveTransportErrors = await retryAfterTransportError(error, consecutiveTransportErrors, expiresAt);
+            continue;
+        }
+        consecutiveTransportErrors = 0;
+        if (polled.status === 'approved' && polled.code) {
+            return polled.code;
+        }
+        if (polled.status === 'expired') {
+            break;
+        }
+        if (polled.status !== 'pending') {
+            throw new Error('Server returned an invalid headless login status.');
+        }
+        await sleepWithinDeadline(POLL_INTERVAL_MS, expiresAt);
+    }
+    throw new Error('Headless login expired. Run `orizu login --headless` to try again.');
+}

package/dist/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;IACpB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAoCD,eAAO,MAAM,YAAY,EAAE,aAAa,EA6nCvC,CAAA;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAMxE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAWrE;AAOD,wBAAgB,cAAc,IAAI,MAAM,CA0CvC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAoBtD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CA4B5D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAgBxD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;EAoB9C"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;IACpB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAoCD,eAAO,MAAM,YAAY,EAAE,aAAa,EAqoCvC,CAAA;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAMxE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAWrE;AAOD,wBAAgB,cAAc,IAAI,MAAM,CA0CvC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAoBtD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CA4B5D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAgBxD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;EAoB9C"}

package/dist/help.js

@@ -12,7 +12,7 @@ const GROUPS = [
     { name: 'Projects', summary: 'Manage projects inside teams.' },
     { name: 'Prompts and judges', summary: 'Work with versioned prompt and judge artifacts.' },
     { name: 'Instruction sets', summary: 'Inspect the project-scoped instruction-set control plane.' },
-    { name: 'Report comments', summary: 'Review and mutate anchored report comments across prompt, optimization, and task reports.' },
+    { name: 'Report comments', summary: 'Review and mutate anchored report comments across prompt, optimization, task, and dataset README surfaces.' },
     { name: 'Diff comments', summary: 'Export inline comments with recoverable prompt-diff context.' },
     { name: 'Scorers and runners', summary: 'Register scorers, push runnable artifacts, execute runners, and submit scores.' },
     { name: 'Optimizations', summary: 'Start, run, export, and finalize optimization runs.' },
@@ -100,13 +100,14 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['login'],
-        usage: 'orizu login [--no-prompt-if-logged-in]',
+        usage: 'orizu login [--headless] [--no-prompt-if-logged-in]',
         summary: 'Open the browser login flow and store CLI credentials for the selected server.',
         group: 'Auth',
         options: [
+            { name: '--headless', help: 'Print an approval URL and poll instead of opening a browser. Selected automatically for SSH and display-less Linux sessions.' },
             { name: '--no-prompt-if-logged-in', help: 'Return immediately when credentials already exist.' },
         ],
-        examples: ['orizu login', 'orizu --local login'],
+        examples: ['orizu login', 'orizu login --headless', 'orizu --local login'],
     },
     {
         path: ['logout'],
@@ -134,22 +135,24 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['comments', 'list'],
-        usage: 'orizu comments list (--prompt <id-or-name> --project <team/project> [--label <label> | --version <id>] | --run <run-id> | --task <task-id>) [--json]',
-        summary: 'List report comment threads with open/resolved status and replies.',
+        usage: 'orizu comments list (--prompt <id-or-name> --project <team/project> [--label <label> | --version <id>] | --run <run-id> | --task <task-id> | --dataset <id-or-name> --project <team/project>) [--json]',
+        summary: 'List report or README comment threads with open/resolved status and replies.',
         group: 'Report comments',
         options: [
             { name: '--prompt <id-or-name>', help: 'Prompt report target. Requires --project.' },
-            { name: '--project <team/project>', help: 'Project slug for prompt targets.' },
+            { name: '--project <team/project>', help: 'Project slug for prompt and dataset targets.' },
             { name: '--label <label>', help: 'Prompt version label to comment on.' },
             { name: '--version <id>', help: 'Prompt version ID to comment on.' },
             { name: '--run <run-id>', help: 'Optimization run report target.' },
             { name: '--task <task-id>', help: 'Task report target.' },
+            { name: '--dataset <id-or-name>', help: 'Dataset target; resolves the current README version in --project.' },
             { name: '--json', help: 'Emit the full comments payload.' },
         ],
         examples: [
             'orizu comments list --prompt Generator --project core/evals --label production',
             'orizu comments list --run <run-id>',
             'orizu comments list --task <task-id>',
+            'orizu comments list --dataset Golden --project core/evals',
         ],
     },
     {
@@ -172,19 +175,22 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['comments', 'add'],
-        usage: 'orizu comments add (--prompt <id-or-name> --project <team/project> [--label <label> | --version <id>] | --run <run-id> | --task <task-id>) --body <text|@file> [--anchor <text>] [--lines <start:end>] [--via <name>] [--json]',
-        summary: 'Add an anchored top-level comment to a report.',
+        usage: 'orizu comments add (--prompt <id-or-name> --project <team/project> [--label <label> | --version <id>] | --run <run-id> | --task <task-id> | --dataset <id-or-name> --project <team/project>) --body <text|@file> [--anchor <text>] [--lines <start:end>] [--via <name>] [--json]',
+        summary: 'Add an anchored top-level comment to a report or current dataset README.',
         group: 'Report comments',
         options: [
             { name: '--body <text|@file>', help: 'Comment body or @file reference.', required: true },
-            { name: '--anchor <text>', help: 'Quoted report text for the comment anchor.' },
+            { name: '--anchor <text>', help: 'Quoted report or README text for the comment anchor.' },
             { name: '--lines <start:end>', help: 'One-based inclusive line range for the anchor.' },
             { name: '--via <name>', help: 'Tool or agent name to show in attribution.' },
+            { name: '--dataset <id-or-name>', help: 'Dataset target; resolves the current README version in --project.' },
+            { name: '--project <team/project>', help: 'Project slug for prompt and dataset targets.' },
             { name: '--json', help: 'Emit the created comment payload.' },
         ],
         examples: [
             'orizu comments add --run <run-id> --body @comment.md --anchor "Score summary" --lines 4:6',
             'orizu comments add --task <task-id> --body "Clarify this finding" --via Codex',
+            'orizu comments add --dataset Golden --project core/evals --body "Clarify this README" --anchor "Scoring column" --lines 4:4',
         ],
     },
     {
@@ -213,11 +219,14 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['setup'],
-        usage: 'orizu setup [--team <slug>] [--agent <claude|codex>]... [--workspace [path]|--no-workspace] [--validate] [--fix] [--no-symlinks] [--verbose] [--no-install] [--handoff|--no-handoff] [--launch <claude|codex>] [--skip-login] [--yes] [--dry-run] [--no-input|--non-interactive] [--json]',
+        usage: 'orizu setup [--team <slug>|--create-team <name>] [--project <slug>|--create-project <name>] [--agent <agent>]... [--workspace [path]|--no-workspace] [--validate] [--fix] [--no-symlinks] [--verbose] [--no-install] [--handoff|--no-handoff] [--launch <claude|codex|pi>] [--skip-login] [--dry-run] [--no-input|--non-interactive] [--json]',
         summary: 'Guided onboarding: sign in, initialize the workbench contract, and install agent skills.',
         group: 'Agent setup',
         options: [
-            { name: '--team <slug>', help: 'Team/workbench slug. Authenticated setup materializes all projects in this team.' },
+            { name: '--team <slug>', help: 'Choose an existing accessible team.' },
+            { name: '--create-team <name>', help: 'Create and select a new team; mutually exclusive with --team.' },
+            { name: '--project <slug>', help: 'Choose the project to use as coding-agent handoff context. The workspace still materializes all team projects.' },
+            { name: '--create-project <name>', help: 'Create and select a project in the chosen team; mutually exclusive with --project.' },
             { name: '--workspace [path]', help: 'Initialize or validate a workspace path, or the current directory when no path is provided. If provided, the value must be a filesystem path.' },
             { name: '--service-origin <url>', help: 'Service origin written to setup metadata. Defaults to the active CLI server.' },
             { name: '--attach-workspace <id>', help: 'Record an existing Orizu workspace id for future attachment.' },
@@ -225,14 +234,13 @@ export const COMMAND_DOCS = [
             { name: '--fix', help: 'Apply safe idempotent repairs only.' },
             { name: '--no-symlinks', help: 'Write CLAUDE.md as a pointer file instead of a symlink to AGENTS.md.' },
             { name: '--verbose', help: 'Show per-file setup actions. Default setup output is summary-oriented.' },
-            { name: '--agent <agent>', help: 'Install the global Orizu skill for this coding agent after workspace setup. Repeat for multiple agents.', repeatable: true, choices: ['claude', 'codex'] },
+            { name: '--agent <agent>', help: 'Non-interactive opt-in to install the shared global Orizu skill plus any applicable native target. Repeat for multiple agents.', repeatable: true, choices: ['claude', 'codex', 'pi', 'devin', 'droid', 'grok', 'windsurf', 'opencode'] },
             { name: '--no-workspace', help: 'Skip workspace creation during guided setup. `--validate` and `--fix` still inspect or repair the workspace contract.' },
             { name: '--no-install', help: 'Skip the coding-agent skill install step.' },
-            { name: '--handoff', help: 'Print the coding-agent setup prompt after setup. By default, setup points to `orizu setup prompt` instead of printing it inline.' },
-            { name: '--no-handoff', help: 'Compatibility flag; suppresses --handoff/--launch. Setup does not print the handoff prompt by default.' },
-            { name: '--launch <agent>', help: 'Launch a detected coding agent with the setup prompt (interactive terminals only).', choices: ['claude', 'codex'] },
+            { name: '--handoff', help: 'Print the llms.txt and selected-project handoff prompt after setup.' },
+            { name: '--no-handoff', help: 'Compatibility flag; suppresses the final launch picker and explicit handoff/launch.' },
+            { name: '--launch <agent>', help: 'Launch a detected coding agent with the selected project and llms.txt prompt (interactive terminals only).', choices: ['claude', 'codex', 'pi'] },
             { name: '--skip-login', help: 'Skip the authentication phase.' },
-            { name: '--yes', help: 'Replace existing managed skill links without prompting.' },
             { name: '--dry-run', help: 'Preview every planned change without writing.' },
             { name: '--no-input', help: 'Never prompt; behave as in a non-interactive terminal.' },
             { name: '--non-interactive', help: 'Alias for --no-input.' },
@@ -240,8 +248,8 @@ export const COMMAND_DOCS = [
         ],
         examples: [
             'orizu setup',
-            'orizu setup --team highlight',
-            'orizu setup --team highlight --agent codex --agent claude --non-interactive --yes',
+            'orizu setup --team highlight --project support-agent',
+            'orizu setup --create-team "Acme" --create-project "Support Agent" --agent codex --agent claude --non-interactive',
             'orizu setup --validate --workspace ./workbench',
         ],
     },
@@ -254,7 +262,7 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['install-skill'],
-        usage: 'orizu install-skill [--agent <claude|codex|opencode>]... [--scope global|project] [--mode auto|link|copy] [--target <target>]... [--yes] [--dry-run]',
+        usage: 'orizu install-skill [--agent <claude|codex|pi|devin|droid|grok|windsurf|opencode>]... [--scope global|project] [--mode auto|link|copy] [--target <target>]... [--yes] [--dry-run]',
         summary: 'Install or repair the Orizu coding-agent skill.',
         group: 'Agent setup',
         aliases: [['skills', 'install']],
@@ -263,7 +271,7 @@ export const COMMAND_DOCS = [
                 name: '--agent <agent>',
                 help: 'Coding agent to set up. Repeat for multiple agents.',
                 repeatable: true,
-                choices: ['claude', 'codex'],
+                choices: ['claude', 'codex', 'pi', 'devin', 'droid', 'grok', 'windsurf', 'opencode'],
             },
             {
                 name: '--scope <scope>',
@@ -279,7 +287,7 @@ export const COMMAND_DOCS = [
                 name: '--target <target>',
                 help: 'Advanced: explicit install destination ID. Repeat for multiple targets.',
                 repeatable: true,
-                choices: ['codex-user', 'agent-user', 'agents-project', 'codex-project', 'claude-user', 'claude-project', 'agents-md'],
+                choices: ['codex-user', 'agent-user', 'agents-project', 'codex-project', 'claude-user', 'claude-project', 'devin-user', 'droid-user', 'grok-user', 'windsurf-user', 'opencode-user', 'opencode-project', 'agents-md'],
             },
             { name: '--yes', help: 'Replace an existing managed skill or AGENTS.md section without prompting.' },
             { name: '--dry-run', help: 'Show planned writes without changing files.' },
@@ -576,7 +584,7 @@ export const COMMAND_DOCS = [
     {
         path: ['optimizations', 'run-gepa'],
         usage: 'orizu optimizations run-gepa [--hosted [--launch-intent-id <uuid>]] --project <team/project> --optimizer-version-id <id> (--candidate-version-id <id> | --instruction-set <name> --model-config <identity> [--component-selector round-robin|all]) --runner-version-id <id> [--candidate-runner-dir <dir>] --scorer-version-id <id> --scorer-runner-version-id <id> [--scorer-runner-dir <dir>] [--engine official|legacy] [--candidate-proposer skilled-proposer [--candidate-proposer-config <@file|path>] [--proposal-max-calls <n>] [--proposal-max-tokens <n>]] [--scorer-input-contract gepa|flat_row] [--scorer-candidate-field <row-field>] [--allow-degenerate-seed] [--seed <n>] --dataset-version-id <id> --split-set-id <id> [--train-split train] [--val-split validation] [--minibatch-size <n>] [--candidate-selection-strategy pareto|current_best|epsilon_greedy] [--epsilon <n>] [--objective <text>] [--budget auto|light|medium|heavy | --max-metric-calls <n> | --max-full-evals <n> | --max-iterations <n> | --max-candidate-proposals <n>] [--num-threads auto|N] [--reflection-model <provider/model>] [--reflection-temperature <n>] [--reflection-prompt-template <text|@file>] [--reflection-max-tokens N] [--reflection-provider-settings <json|@file>] [--reflection-retry-attempts N] [--reflection-http-timeout-seconds N] [--skip-perfect-parent-reflection|--no-skip-perfect-parent-reflection] [--disable-evaluation-cache] [--auto-promote] [--promotion-label <label>] [--log-row-snapshots] [--metadata <json>] [--python <command>] [--log-dir logs] [--no-local-log] [--json]',
-        summary: 'Run official GEPA locally and stream events, or use --hosted for a queued Orizu launch. Hosted mode does not require --candidate-runner-dir or --scorer-runner-dir, accepts only a named --budget preset, and supports response-loss recovery with --launch-intent-id. Local runner version ids materialize registered bytes, while optional runner dirs are additionally byte-verified before execution. Pass --engine legacy only for the frozen safety hatch. Skilled-proposer is official-only, its config requires that selection, and the selection cannot be combined with --reflection-prompt-template. --instruction-set requires --model-config and cannot be combined with --candidate-version-id; round-robin updates one component-map entry per round and all updates every component. --max-candidate-proposals is official-engine-only. Validates the scorer contract on the seed before iterating; judge runners built for flat-row score runs need --scorer-input-contract flat_row (ALI-1158).',
+        summary: 'Run official GEPA locally and stream events, or use --hosted for a queued Orizu-managed sandbox launch. Hosted eligibility requires a staff-enabled team, capacity below its concurrent-run cap, a launch-project optimizer version whose validated manifest.optimizer_family is gepa, registered candidate/scorer runners, an Anthropic or OpenAI reflection model, and a named --budget preset within the team ceiling. Hosted eligibility catalog refusals use stable code/remediation JSON with optional bounded detail, and capacity refusals include monitor URLs for running runs. A successful launch prints a durable monitor URL; queued means accepted, not completed. Hosted mode does not require --candidate-runner-dir or --scorer-runner-dir; when supplied, those directories must byte-match their registered versions. Retry response loss with the same --launch-intent-id. Local runner version ids materialize registered bytes, while optional runner dirs are additionally byte-verified before execution. Pass --engine legacy only for the frozen safety hatch. Skilled-proposer is official-only, its config requires that selection, and the selection cannot be combined with --reflection-prompt-template. --instruction-set requires --model-config and cannot be combined with --candidate-version-id; round-robin updates one component-map entry per round and all updates every component. --max-candidate-proposals is official-engine-only. Validates the scorer contract on the seed before iterating; judge runners built for flat-row score runs need --scorer-input-contract flat_row (ALI-1158).',
         group: 'Optimizations',
     },
     {

package/dist/hosted-boot.js

@@ -509,7 +509,7 @@ export async function runHostedBoot(opts) {
     exec('git', ['-C', workspaceDir, 'config', 'user.name', AGENT_GIT_IDENTITY.name]);
     exec('git', ['-C', workspaceDir, 'config', 'user.email', AGENT_GIT_IDENTITY.email]);
     log(`cloned ${session.repoBranch}`);
-    // 5b — Stage the orizu-cli skill into the cloned repo so the agent discovers the
+    // 5b — Stage the orizu skill into the cloned repo so the agent discovers the
     // Orizu workflows (ALI-1059). SHARED with the operator path via `stageOrizuSkill`
     // (one resolution chain + the harvest-safe .git/info/exclude append). Non-fatal:
     // a staging failure is logged, never aborts the boot. The DO `BootExec` is
@@ -522,10 +522,10 @@ export async function runHostedBoot(opts) {
                 return { exitCode: res.status, stdout: res.stdout, stderr: res.stderr ?? '' };
             },
         });
-        log(`orizu-cli skill staged: ${skillStage.ok ? skillStage.method : 'unresolved'}`);
+        log(`orizu skill staged: ${skillStage.ok ? skillStage.method : 'unresolved'}`);
     }
     catch (error) {
-        log(`orizu-cli skill staging failed: ${error instanceof Error ? error.message : String(error)}`);
+        log(`orizu skill staging failed: ${error instanceof Error ? error.message : String(error)}`);
     }
     // ALI-1060: the agent is now genuinely LIVE — bearer minted, connectors
     // applied, session/run resolved, repo cloned, skill staged. Signal the

package/dist/hosted-bootstrap.js

@@ -266,7 +266,7 @@ export async function bootstrapHostedSandbox(opts) {
                 outputTail: tail(install.stdout, install.stderr),
             });
         }
-        // 4b — Stage the orizu-cli skill into the workspace so the agent discovers it
+        // 4b — Stage the orizu skill into the workspace so the agent discovers it
         // (ALI-1044). SHARED with the DO path (ALI-1059): the resolution chain + the
         // .git/info/exclude append live in `stageOrizuSkill`; here we only adapt the
         // sandbox exec seam and record the outcome. Non-fatal + recorded, exactly like
@@ -280,7 +280,7 @@ export async function bootstrapHostedSandbox(opts) {
             },
         });
         record('skill_staged', stage.ok, stage.ok
-            ? `orizu-cli skill staged (${stage.method})`
+            ? `orizu skill staged (${stage.method})`
             : `skill staging unresolved: ${stage.stdout.trim() || `exit ${stage.exitCode}`}`);
         await sink.append('skill_staged', {
             ok: stage.ok,

package/dist/hosted-commands.d.ts

@@ -1,3 +1,5 @@
+import type { GepaEngineDispatch } from './gepa-engine-dispatch.js';
+export declare function applyHostedInstructionSetProfileOverride(dispatch: GepaEngineDispatch): GepaEngineDispatch;
 interface HostedCommandContext {
     environment: NodeJS.ProcessEnv;
     getArg: (name: string) => string | null;

package/dist/hosted-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-commands.d.ts","sourceRoot":"","sources":["../src/hosted-commands.ts"],"names":[],"mappings":"AAEA,UAAU,oBAAoB;IAAG,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAAC,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE;AAC/V,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAwqB"}
+{"version":3,"file":"hosted-commands.d.ts","sourceRoot":"","sources":["../src/hosted-commands.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAEnE,wBAAgB,wCAAwC,CACtD,QAAQ,EAAE,kBAAkB,GAC3B,kBAAkB,CAUpB;AAED,UAAU,oBAAoB;IAAG,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAAC,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE;AAC/V,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAwqB"}

package/dist/hosted-commands.js

@@ -1,5 +1,16 @@
 import { runHostedGepaOptimization } from './hosted-gepa-cli.js';
 import { hostedCommand } from './hosted-session-cli.js';
+export function applyHostedInstructionSetProfileOverride(dispatch) {
+    const profileVersionId = process.env.ORIZU_HOSTED_INSTRUCTION_SET_PROFILE_VERSION_ID;
+    if (process.env.ORIZU_HOSTED_OPTIMIZATION_RUN_ID && profileVersionId) {
+        dispatch.environment.ORIZU_INSTRUCTION_SET_PROFILE_VERSION_ID = profileVersionId;
+    }
+    const proposerConfig = process.env.ORIZU_HOSTED_SKILLED_PROPOSER_CONFIG;
+    if (process.env.ORIZU_HOSTED_OPTIMIZATION_RUN_ID && proposerConfig) {
+        dispatch.environment.ORIZU_SKILLED_PROPOSER_CONFIG = proposerConfig;
+    }
+    return dispatch;
+}
 export async function dispatchHostedCommands(args, context) { const [command, subcommand] = args; if (command === 'optimizations' && subcommand === 'run-gepa' && args.includes('--hosted')) {
     const project = context.getArg('--project') || await context.resolveProjectSlug(null);
     await runHostedGepaOptimization({ args: args.slice(2), project, environment: context.environment, json: context.json, printJson: context.printJson, printLine: context.printLine });

package/dist/hosted-environment.d.ts

@@ -0,0 +1,3 @@
+/** Env var naming every secret-bearing environment variable injected into a hosted run. */
+export declare const INJECTED_ENV_VARS_ENV = "ORIZU_INJECTED_ENV_VARS";
+//# sourceMappingURL=hosted-environment.d.ts.map

package/dist/hosted-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-environment.d.ts","sourceRoot":"","sources":["../src/hosted-environment.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,eAAO,MAAM,qBAAqB,4BAA4B,CAAA"}

package/dist/hosted-environment.js

@@ -0,0 +1,2 @@
+/** Env var naming every secret-bearing environment variable injected into a hosted run. */
+export const INJECTED_ENV_VARS_ENV = 'ORIZU_INJECTED_ENV_VARS';

package/dist/hosted-gepa-cli.d.ts

@@ -1,3 +1,4 @@
+import { verifyRunnerDirRegistered } from './runner-dir-verify.js';
 interface HostedGepaOptions {
     args: string[];
     project: string;
@@ -5,6 +6,8 @@ interface HostedGepaOptions {
     json: boolean;
     printJson: (value: Record<string, unknown>) => void;
     printLine: (value: string) => void;
+    /** Test seam for cleanup-failure orchestration; production always uses the real verifier. */
+    verifyRunnerDir?: typeof verifyRunnerDirRegistered;
 }
 export declare function runHostedGepaOptimization(options: HostedGepaOptions): Promise<void>;
 export {};

package/dist/hosted-gepa-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-gepa-cli.d.ts","sourceRoot":"","sources":["../src/hosted-gepa-cli.ts"],"names":[],"mappings":"AAQA,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnD,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CACnC;AAmBD,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwEzF"}
+{"version":3,"file":"hosted-gepa-cli.d.ts","sourceRoot":"","sources":["../src/hosted-gepa-cli.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAE/B,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnD,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,6FAA6F;IAC7F,eAAe,CAAC,EAAE,OAAO,yBAAyB,CAAA;CACnD;AAmBD,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyKzF"}