orizu 0.5.37 → 0.5.39

package/src/app-commands.ts

@@ -13,7 +13,7 @@ import {
   join,
   dirname,
 } from 'path'
-import { createHash } from 'crypto'
+import { createHash, randomUUID } from 'crypto'
 import {
   getArg,
   getArchiveListStatus,
@@ -25,10 +25,15 @@ import { resolveProjectSlug, fetchApps, selectAppIdInteractively } from './accou
 import { printJson, printLine, getErrorMessage } from './cli-console-output.js'
 import { printAppSummaries } from './archive-artifacts-cli.js'
 import { isNodeError, formatTerminalLink } from './auth-commands.js'
+import { parseCliProjectSlug } from './cli-project-slug.js'
+import { AppPublishFailure } from './app-publish-failure.js'
+import { inspectAppDestination } from './app-publish-paths.js'
 import { authedFetch, getBaseUrl } from './http.js'
 import { appPageUrl } from './app-page-url.js'
 import { parseJsonResponse, sanitizeHumanInlineText, sanitizeTerminalText } from './json-response.js'
 import { runLocalAppPreview } from './preview-runtime.js'
+import type { AppFiles } from './app-publish-workspace.js'
+import { findWorkspaceRoot } from './workspace.js'
 
 
 
@@ -73,7 +78,10 @@ function readSourceBytes(pathArg: string): Buffer {
 }
 
 function readJsonFile(pathArg: string): Record<string, unknown> {
-  const raw = readSourceFile(pathArg)
+  return parseJsonFileContents(readSourceFile(pathArg), pathArg)
+}
+
+function parseJsonFileContents(raw: string, pathArg: string): Record<string, unknown> {
   try {
     const parsed = JSON.parse(raw) as unknown
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
@@ -163,54 +171,175 @@ function readManifestFile(dirArg: string): Record<string, unknown> {
   return readJsonFile(join(expandHomePath(dirArg), 'manifest.json'))
 }
 
+const LOCAL_PUBLISH_NOTE =
+  'Note: this app version is not in the team repository yet; it reaches git when published from a hosted session.'
+const APP_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+
+interface PublishedCommit {
+  outcome: 'merged' | 'already_merged'
+  sha: string
+}
+
+/** The workspace root when this runs in a hosted session, else null. */
+function hostedWorkspaceRoot(): string | null {
+  if (!process.env.ORIZU_SESSION_ID?.trim()) return null
+  const workspaceRoot = findWorkspaceRoot(process.cwd())
+  if (!workspaceRoot) throw new Error('Hosted app publishing must run inside the attached workspace. Run this command from the workspace containing orizu.team.json.')
+  return workspaceRoot
+}
+
+/** The hosted publish path, loaded only when it runs: it needs Effect, which
+ * the rest of the CLI does not load at startup. */
+function loadAppPublishWorkspace() {
+  return import('./app-publish-workspace.js')
+}
+
+/** The app as committed into its folder: the files exactly as the agent wrote them. */
+function appFilesFromArgs(filePath: string, inputSchemaPath: string, outputSchemaPath: string): AppFiles {
+  return { sourceCode: readSourceFile(filePath), inputSchema: readSourceFile(inputSchemaPath), outputSchema: readSourceFile(outputSchemaPath) }
+}
+
+/** ORI-2280: a hosted publish the merge stopped. The server's text says what to
+ * do; a create's rerun must name the same app id, so its folder is reused. A
+ * conflict also adds the team copy remote the text tells the agent to pull. */
+async function publishRefusalError(responseText: string, workspaceRoot: string): Promise<Error | null> {
+  let body: unknown
+  try {
+    body = JSON.parse(responseText)
+  } catch {
+    return null
+  }
+  if (!isRecord(body) || typeof body.error !== 'string' || typeof body.code !== 'string' || !body.code.startsWith('publish_')) return null
+  let message = sanitizeTerminalText(body.error)
+  if (body.code === 'publish_conflict') {
+    const { addTeamCopyRemote } = await loadAppPublishWorkspace()
+    const remoteNote = await addTeamCopyRemote(workspaceRoot)
+    if (remoteNote) message = `${message} ${remoteNote}`
+  }
+  return new Error(message)
+}
+
+function printPublishedCommit(commit: PublishedCommit | null | undefined, isHosted: boolean) {
+  if (commit) {
+    const where = commit.outcome === 'merged' ? 'Merged into' : 'Already in'
+    printLine(`${where} the team copy: ${sanitizeTerminalText(commit.sha.slice(0, 7))}`)
+  } else if (!isHosted) {
+    printLine(LOCAL_PUBLISH_NOTE)
+  }
+}
+
+/** Quote each original argument so spaces and quotes survive a copied retry. */
+function shellSingleQuote(value: string): string {
+  return `'${value.replace(/'/g, "'\\''")}'`
+}
+
+function canonicalRetryInputPath(workspaceRoot: string, folder: string, filename: string, originalPath: string): string {
+  const canonicalPath = join(workspaceRoot, folder, filename)
+  try {
+    return inspectAppDestination(workspaceRoot, join(folder, filename)) ? canonicalPath : originalPath
+  } catch {
+    return originalPath
+  }
+}
+
 async function createAppFromFile() {
-  const project = getArg('--project')
+  const workspaceRoot = hostedWorkspaceRoot()
+  let project = getArg('--project')
   const name = getArg('--name')
   const datasetId = getArg('--dataset')
   const filePath = getArg('--file')
   const inputSchemaPath = getArg('--input-schema')
   const outputSchemaPath = getArg('--output-schema')
   const component = getArg('--component') || undefined
+  const requestedAppId = getArg('--id') ?? undefined
 
   if (!project || !name || !datasetId || !filePath || !inputSchemaPath || !outputSchemaPath) {
-    throw new Error('Usage: orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]')
+    throw new Error('Usage: orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>] [--id <app-id>]')
   }
-
-  const sourceCode = readSourceFile(filePath)
-  const inputJsonSchema = readJsonFile(inputSchemaPath)
-  const outputJsonSchema = readJsonFile(outputSchemaPath)
-  const response = await authedFetch('/api/cli/apps/create-from-file', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      projectSlug: project,
-      name,
-      datasetId,
-      sourceCode,
-      componentName: component,
-      inputJsonSchema,
-      outputJsonSchema,
-    }),
-  })
-
-  if (!response.ok) {
-    throw new Error(`Failed to create app: ${await response.text()}`)
+  if (requestedAppId !== undefined && !APP_ID_PATTERN.test(requestedAppId)) {
+    throw new Error('--id must be a lowercase app id (UUID), as printed by the earlier publish')
   }
 
-  const data = await parseJsonResponse<{
-    app: { id: string; name: string; versionNum: number; componentName?: string; url?: string }
-    warnings?: string[]
-  }>(response, 'App create')
-  if (hasJsonFlag()) {
-    printJson({ app: { ...data.app, pageUrl: data.app.url || appPageUrl(getBaseUrl(), data.app.id) }, warnings: data.warnings || [] })
-    return
-  }
-  printLine(`Created app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) v${data.app.versionNum}`)
-  if (data.app.url) {
-    printLine(`View app: ${formatTerminalLink(data.app.url)}`)
+  if (workspaceRoot) {
+    const parsedProject = parseCliProjectSlug(project)
+    const slug = /^[a-z0-9][a-z0-9-]{0,99}$/
+    if (!parsedProject || !slug.test(parsedProject.teamSlug) || !slug.test(parsedProject.projectSlug)) {
+      throw new Error('--project must be a valid <team/project> reference')
+    }
+    project = `${parsedProject.teamSlug}/${parsedProject.projectSlug}`
   }
-  if (data.warnings?.length) {
-    printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`)
+
+  const files = appFilesFromArgs(filePath, inputSchemaPath, outputSchemaPath)
+  const sourceCode = files.sourceCode
+  const inputJsonSchema = parseJsonFileContents(files.inputSchema, inputSchemaPath)
+  const outputJsonSchema = parseJsonFileContents(files.outputSchema, outputSchemaPath)
+
+  // In a hosted session the app is committed into its folder and pushed first;
+  // the server merges that commit into the team copy before recording the app.
+  let appId = requestedAppId
+  let sessionCommitSha: string | undefined
+  let recoveryFolder: string | undefined
+  let filesMaterialized = false
+  try {
+    if (workspaceRoot) {
+      const projectSlug = parseCliProjectSlug(project)!.projectSlug
+      appId ??= randomUUID()
+      recoveryFolder = `projects/${projectSlug}/apps/${appId}`
+      const { pushAppToSessionCopy } = await loadAppPublishWorkspace()
+      sessionCommitSha = await pushAppToSessionCopy(workspaceRoot, {
+        projectSlug,
+        appId,
+        files,
+      })
+      filesMaterialized = true
+    }
+
+    const response = await authedFetch('/api/cli/apps/create-from-file', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        projectSlug: project,
+        name,
+        datasetId,
+        sourceCode,
+        componentName: component,
+        inputJsonSchema,
+        outputJsonSchema,
+        ...(appId !== undefined ? { appId } : {}),
+        ...(sessionCommitSha !== undefined ? { sessionCommitSha } : {}),
+      }),
+    })
+
+    if (!response.ok) {
+      const text = await response.text()
+      const refusal = workspaceRoot ? await publishRefusalError(text, workspaceRoot) : null
+      throw refusal ?? new Error(`Failed to create app: ${text}`)
+    }
+
+    const data = await parseJsonResponse<{
+      app: { id: string; name: string; versionNum: number; componentName?: string; url?: string; publishedCommit?: PublishedCommit | null }
+      warnings?: string[]
+    }>(response, 'App create')
+    if (hasJsonFlag()) {
+      printJson({ app: { ...data.app, pageUrl: data.app.url || appPageUrl(getBaseUrl(), data.app.id) }, warnings: data.warnings || [] })
+      return
+    }
+    printLine(`Created app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) v${data.app.versionNum}`)
+    if (data.app.url) {
+      printLine(`View app: ${formatTerminalLink(data.app.url)}`)
+    }
+    printPublishedCommit(data.app.publishedCommit, workspaceRoot !== null)
+    if (data.warnings?.length) {
+      printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`)
+    }
+  } catch (error) {
+    if (!workspaceRoot || !appId || !recoveryFolder) throw error
+    const useCanonicalInputs = filesMaterialized || (error instanceof AppPublishFailure && error.filesMaterialized)
+    const retryArgs = ['orizu', '--server', getBaseUrl(), 'apps', 'create', '--project', project, '--name', name, '--dataset', datasetId,
+      '--file', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'App.tsx', filePath) : filePath, '--input-schema', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'input.schema.json', inputSchemaPath) : inputSchemaPath,
+      '--output-schema', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'output.schema.json', outputSchemaPath) : outputSchemaPath,
+      ...(component ? ['--component', component] : []), ...(hasJsonFlag() ? ['--json'] : []), '--id', appId]
+    throw new Error(`${getErrorMessage(error)}\nApp ID: ${appId}\nFolder: ${recoveryFolder}\nRetry: ${retryArgs.map(shellSingleQuote).join(' ')}`)
   }
 }
 
@@ -266,6 +395,7 @@ async function previewAppFromFile() {
 }
 
 async function updateAppFromFile() {
+  const workspaceRoot = hostedWorkspaceRoot()
   const filePath = getArg('--file')
   const inputSchemaPath = getArg('--input-schema')
   const outputSchemaPath = getArg('--output-schema')
@@ -282,37 +412,75 @@ async function updateAppFromFile() {
     appId = selected.appId
   }
 
-  const sourceCode = readSourceFile(filePath)
-  const inputJsonSchema = readJsonFile(inputSchemaPath)
-  const outputJsonSchema = readJsonFile(outputSchemaPath)
-  const response = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}/update-from-file`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      sourceCode,
-      componentName: component,
-      inputJsonSchema,
-      outputJsonSchema,
-    }),
-  })
+  const files = appFilesFromArgs(filePath, inputSchemaPath, outputSchemaPath)
+  const sourceCode = files.sourceCode
+  const inputJsonSchema = parseJsonFileContents(files.inputSchema, inputSchemaPath)
+  const outputJsonSchema = parseJsonFileContents(files.outputSchema, outputSchemaPath)
 
-  if (!response.ok) {
-    throw new Error(`Failed to update app: ${await response.text()}`)
-  }
+  // In a hosted session the app is committed into its folder and pushed first;
+  // the server merges that commit into the team copy before recording the version.
+  let recoveryFolder: string | undefined
+  let filesMaterialized = false
+  try {
+    let sessionCommitSha: string | undefined
+    if (workspaceRoot) {
+      const folderResponse = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}`)
+      if (!folderResponse.ok) {
+        throw new Error(`Failed to find the app's project: ${await folderResponse.text()}`)
+      }
+      const folder = await parseJsonResponse<{ appId: string; projectSlug: string }>(folderResponse, 'App folder')
+      recoveryFolder = `projects/${folder.projectSlug}/apps/${folder.appId}`
+      const { pushAppToSessionCopy } = await loadAppPublishWorkspace()
+      sessionCommitSha = await pushAppToSessionCopy(workspaceRoot, {
+        projectSlug: folder.projectSlug,
+        appId: folder.appId,
+        files,
+      })
+      filesMaterialized = true
+    }
 
-  const data = await parseJsonResponse<{
-    app: { id: string; name: string; versionNum: number; componentName?: string }
-    warnings?: string[]
-  }>(response, 'App update')
-  const pageUrl = appPageUrl(getBaseUrl(), data.app.id)
-  if (hasJsonFlag()) {
-    printJson({ app: { ...data.app, pageUrl }, warnings: data.warnings || [] })
-    return
-  }
-  printLine(`Updated app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) to v${data.app.versionNum}`)
-  printLine(`View app: ${formatTerminalLink(pageUrl)}`)
-  if (data.warnings?.length) {
-    printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`)
+    const response = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}/update-from-file`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        sourceCode,
+        componentName: component,
+        inputJsonSchema,
+        outputJsonSchema,
+        ...(sessionCommitSha !== undefined ? { sessionCommitSha } : {}),
+      }),
+    })
+
+    if (!response.ok) {
+      const text = await response.text()
+      const refusal = workspaceRoot ? await publishRefusalError(text, workspaceRoot) : null
+      throw refusal ?? new Error(`Failed to update app: ${text}`)
+    }
+
+    const data = await parseJsonResponse<{
+      app: { id: string; name: string; versionNum: number; componentName?: string; publishedCommit?: PublishedCommit | null }
+      warnings?: string[]
+    }>(response, 'App update')
+    const pageUrl = appPageUrl(getBaseUrl(), data.app.id)
+    if (hasJsonFlag()) {
+      printJson({ app: { ...data.app, pageUrl }, warnings: data.warnings || [] })
+      return
+    }
+    printLine(`Updated app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) to v${data.app.versionNum}`)
+    printLine(`View app: ${formatTerminalLink(pageUrl)}`)
+    printPublishedCommit(data.app.publishedCommit, workspaceRoot !== null)
+    if (data.warnings?.length) {
+      printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`)
+    }
+  } catch (error) {
+    if (!workspaceRoot || !recoveryFolder) throw error
+    const useCanonicalInputs = filesMaterialized || (error instanceof AppPublishFailure && error.filesMaterialized)
+    const retryArgs = ['orizu', '--server', getBaseUrl(), 'apps', 'update', '--app', appId,
+      '--file', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'App.tsx', filePath) : filePath,
+      '--input-schema', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'input.schema.json', inputSchemaPath) : inputSchemaPath,
+      '--output-schema', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'output.schema.json', outputSchemaPath) : outputSchemaPath,
+      ...(component ? ['--component', component] : []), ...(hasJsonFlag() ? ['--json'] : [])]
+    throw new Error(`${getErrorMessage(error)}\nApp ID: ${appId}\nFolder: ${recoveryFolder}\nRetry: ${retryArgs.map(shellSingleQuote).join(' ')}`)
   }
 }
 

package/src/app-publish-failure.ts

@@ -0,0 +1,7 @@
+/** Recovery may use canonical inputs only after this attempt wrote its full snapshot. */
+export class AppPublishFailure extends Error {
+  constructor(message: string, readonly filesMaterialized: boolean) {
+    super(message)
+    this.name = 'AppPublishFailure'
+  }
+}

package/src/app-publish-paths.ts

@@ -0,0 +1,27 @@
+import { lstatSync } from 'node:fs'
+import { isAbsolute, relative, resolve, sep } from 'node:path'
+
+/** Inspect canonical destinations without following aliases. All callers check
+ * the whole set before materializing it; this does not claim race-proof access. */
+export function inspectAppDestination(root: string, path: string): boolean {
+  const base = resolve(root)
+  const destination = resolve(base, path)
+  const tail = relative(base, destination)
+  if (!tail || tail === '..' || tail.startsWith(`..${sep}`) || isAbsolute(tail)) throw new Error('App destination is outside the workspace')
+  const rootStat = lstatSync(base)
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) throw new Error('App workspace must be an ordinary directory')
+  const segments = tail.split(sep)
+  let current = base
+  for (const [index, segment] of segments.entries()) {
+    current = resolve(current, segment)
+    const stat = lstatSync(current, { throwIfNoEntry: false })
+    if (!stat) return false
+    if (stat.isSymbolicLink()) throw new Error('App destination must not contain symbolic links')
+    if (index < segments.length - 1) {
+      if (!stat.isDirectory()) throw new Error('App destination parent must be an ordinary directory')
+    } else if (!stat.isFile() || stat.nlink > 1) {
+      throw new Error('App destination must be an ordinary file without hardlink aliases')
+    }
+  }
+  return true
+}

package/src/app-publish-workspace.ts

@@ -0,0 +1,207 @@
+/** ORI-2280 (2280-B2): in a hosted session, an app is published from git. The
+ * CLI writes the app into its folder in the workspace, commits those three files
+ * alone, and pushes the session copy; the web app then merges that commit into
+ * the team copy before it records the version. Written with Effect: git, the
+ * files and the web app are services, and each way this can stop is a tagged
+ * failure. It holds no key (the clone's credential helper asks for one per git
+ * command) and makes no temporary folder, so it has nothing to scope. */
+import { spawn } from 'node:child_process'
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+import { Context, Data, Effect, Layer } from 'effect'
+
+import { isValidCloudflareArtifactsGitRemote } from './cloudflare-artifacts-git-remote.js'
+import { AppPublishFailure } from './app-publish-failure.js'
+import { inspectAppDestination } from './app-publish-paths.js'
+import { resolveAttachedWorkspaceId } from './git-credential.js'
+import { authedFetch, getBaseUrl } from './http.js'
+
+/** The session copy's branch, which the publish merge reads (ORI-2279). */
+const SESSION_BRANCH_REF = 'refs/heads/main'
+const TEAM_REMOTE_NAME = 'orizu-team'
+const PROJECT_SLUG = /^[a-z0-9][a-z0-9-]{0,99}$/
+const APP_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+
+/** Where an app lives in the team repository. */
+function appFolder(projectSlug: string, appId: string): string {
+  if (!PROJECT_SLUG.test(projectSlug)) throw new Error(`Invalid project slug for the app folder: ${projectSlug}`)
+  if (!APP_ID.test(appId)) throw new Error(`Invalid app id for the app folder: ${appId}`)
+  return `projects/${projectSlug}/apps/${appId}`
+}
+
+export interface AppFiles {
+  readonly sourceCode: string
+  readonly inputSchema: string
+  readonly outputSchema: string
+}
+
+// -- Failures --------------------------------------------------------------------
+
+class PushRejected extends Data.TaggedError('PushRejected') {}
+class GitFailed extends Data.TaggedError('GitFailed')<{ step: string; detail: string }> {}
+class TeamRemoteUnavailable extends Data.TaggedError('TeamRemoteUnavailable')<{ reason: string }> {}
+
+// -- Services --------------------------------------------------------------------
+
+interface GitResult {
+  readonly code: number
+  readonly stdout: string
+  readonly stderr: string
+}
+
+class WorkspaceGit extends Context.Service<WorkspaceGit, { readonly run: (args: readonly string[]) => Effect.Effect<GitResult> }>()('WorkspaceGit') {}
+class WorkspaceFiles extends Context.Service<WorkspaceFiles, { readonly write: (files: readonly { path: string; content: string }[]) => Effect.Effect<void, GitFailed> }>()('WorkspaceFiles') {}
+class PublishApi extends Context.Service<PublishApi, { readonly teamReadRemote: (workspaceId: string) => Effect.Effect<string, TeamRemoteUnavailable>; readonly teamRemoteHelper: string }>()('PublishApi') {}
+
+function liveLayer(root: string, attempt?: { filesMaterialized: boolean }) {
+  const serverOrigin = getBaseUrl()
+  const teamRemoteHelper = `!orizu --server '${serverOrigin.replace(/'/g, "'\\''")}' git-credential --purpose=team_read`
+  const git = WorkspaceGit.of({
+    run: (args) =>
+      Effect.callback<GitResult>((resume) => {
+        const child = spawn('git', args, { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] })
+        let stdout = ''
+        let stderr = ''
+        child.stdout.on('data', (chunk) => (stdout += chunk))
+        child.stderr.on('data', (chunk) => (stderr += chunk))
+        child.on('error', (error) => resume(Effect.succeed({ code: 127, stdout, stderr: error.message })))
+        child.on('close', (code) => resume(Effect.succeed({ code: code ?? 1, stdout, stderr })))
+      }),
+  })
+  const files = WorkspaceFiles.of({
+    write: (files) =>
+      Effect.try({
+        try: () => {
+          for (const file of files) inspectAppDestination(root, file.path)
+          for (const file of files) {
+            mkdirSync(join(root, file.path, '..'), { recursive: true })
+            writeFileSync(join(root, file.path), file.content)
+          }
+          if (attempt) attempt.filesMaterialized = true
+        },
+        catch: (error) => new GitFailed({ step: 'write the app files', detail: String(error) }),
+      }),
+  })
+  const api = PublishApi.of({
+    teamRemoteHelper,
+    teamReadRemote: (workspaceId) =>
+      Effect.tryPromise({
+        try: async (signal) => {
+          const response = await authedFetch(`/api/cli/workspaces/${encodeURIComponent(workspaceId)}/repo-token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ purpose: 'team_read', sessionId: process.env.ORIZU_SESSION_ID?.trim() }),
+            signal,
+          })
+          if (!response.ok) throw new Error(`the repository key service answered ${response.status}`)
+          const remote = ((await response.json()) as { remote?: unknown }).remote
+          if (!isValidCloudflareArtifactsGitRemote(remote)) throw new Error('the repository key service named no team copy')
+          return remote
+        },
+        catch: (error) => new TeamRemoteUnavailable({ reason: error instanceof Error ? error.message : String(error) }),
+      }),
+  })
+  return Layer.mergeAll(Layer.succeed(WorkspaceGit, git), Layer.succeed(WorkspaceFiles, files), Layer.succeed(PublishApi, api))
+}
+
+const gitOrFail = (step: string, args: readonly string[]) =>
+  Effect.flatMap(WorkspaceGit, (git) => git.run(args)).pipe(
+    Effect.filterOrFail(
+      (result) => result.code === 0,
+      (result) => new GitFailed({ step, detail: (result.stderr || result.stdout).trim() })
+    )
+  )
+
+// -- Commit and push -------------------------------------------------------------
+
+/** Writes the app into its folder, commits those three files alone (other work in
+ * the workspace stays as it is), and pushes the session copy. Answers the
+ * commit the web app should publish: the new one, or HEAD if nothing changed. */
+const commitAndPush = (folder: string, files: AppFiles, appId: string) =>
+  Effect.gen(function* () {
+    const workspaceFiles = yield* WorkspaceFiles
+    yield* workspaceFiles.write([
+      { path: `${folder}/App.tsx`, content: files.sourceCode },
+      { path: `${folder}/input.schema.json`, content: files.inputSchema },
+      { path: `${folder}/output.schema.json`, content: files.outputSchema },
+    ])
+    const paths = ['App.tsx', 'input.schema.json', 'output.schema.json'].map(filename => `${folder}/${filename}`)
+    yield* gitOrFail('stage the app files', ['add', '--', ...paths])
+    const git = yield* WorkspaceGit
+    // Exit 1: the three app files differ from HEAD.
+    const changed = yield* git.run(['diff', '--cached', '--quiet', 'HEAD', '--', ...paths])
+    if (changed.code === 1) {
+      yield* gitOrFail('commit the app files', ['commit', '-q', '-m', `Publish app ${appId}`, '--', ...paths])
+    } else if (changed.code !== 0) {
+      return yield* new GitFailed({ step: 'compare the app folder', detail: changed.stderr.trim() })
+    }
+    const sha = (yield* gitOrFail('read the commit', ['rev-parse', 'HEAD'])).stdout.trim()
+    const pushed = yield* git.run(['push', '-q', 'origin', `HEAD:${SESSION_BRANCH_REF}`])
+    if (pushed.code !== 0) {
+      if (/\[rejected\]|non-fast-forward|fetch first/.test(pushed.stderr)) return yield* new PushRejected()
+      return yield* new GitFailed({ step: 'push the session copy', detail: pushed.stderr.trim() })
+    }
+    return sha
+  })
+
+/** Commits and pushes the app, answering the commit to publish. Throws the
+ * message the agent should act on. */
+export async function pushAppToSessionCopy(root: string, input: { projectSlug: string; appId: string; files: AppFiles }): Promise<string> {
+  const program = commitAndPush(appFolder(input.projectSlug, input.appId), input.files, input.appId).pipe(
+    Effect.catchTags({
+      PushRejected: () =>
+        Effect.fail(new Error('Publish stopped: your session copy has commits this workspace does not. Run "git pull --no-rebase --no-edit" in the workspace, then run this command again.')),
+      GitFailed: (failure) => Effect.fail(new Error(`Publish stopped before anything was sent: could not ${failure.step} (${failure.detail}).`)),
+    })
+  )
+  const attempt = { filesMaterialized: false }
+  try {
+    return await Effect.runPromise(Effect.provide(program, liveLayer(root, attempt)))
+  } catch (error) {
+    throw new AppPublishFailure(error instanceof Error ? error.message : String(error), attempt.filesMaterialized)
+  }
+}
+
+// -- The team copy, after a conflict ---------------------------------------------
+
+/** Adds the `orizu-team` remote so the agent can pull the team copy and fix a
+ * conflict. It reads with its own team_read key: an empty helper entry first
+ * stops the session copy's helper from answering for it. Refreshes the URL and
+ * helper each time so interrupted recovery or an old remote is repaired. */
+const addTeamRemote = (workspaceId: string | null) =>
+  Effect.gen(function* () {
+    const git = yield* WorkspaceGit
+    const hasRemote = (yield* git.run(['remote', 'get-url', TEAM_REMOTE_NAME])).code === 0
+    if (!workspaceId) return yield* new TeamRemoteUnavailable({ reason: 'this workspace names no Orizu workspace id' })
+    const api = yield* PublishApi
+    const remote = yield* api.teamReadRemote(workspaceId)
+    const failed = (step: string) => (failure: GitFailed) => new TeamRemoteUnavailable({ reason: `${step}: ${failure.detail}` })
+    const remoteAction = hasRemote ? 'set-url' : 'add'
+    yield* gitOrFail(remoteAction, ['remote', remoteAction, TEAM_REMOTE_NAME, remote]).pipe(Effect.mapError(failed(`git remote ${remoteAction}`)))
+    const cleared = yield* git.run(['config', '--unset-all', `credential.${remote}.helper`])
+    // Git exits 5 when there was no matching key, which is normal on first use.
+    if (cleared.code !== 0 && cleared.code !== 5) {
+      return yield* new TeamRemoteUnavailable({ reason: `git config: ${(cleared.stderr || cleared.stdout).trim()}` })
+    }
+    for (const [operation, key, value] of [
+      ['--add', `credential.${remote}.helper`, ''],
+      ['--add', `credential.${remote}.helper`, api.teamRemoteHelper],
+      ['--replace-all', `credential.${remote}.useHttpPath`, 'true'],
+    ] as const) {
+      yield* gitOrFail('config', ['config', operation, key, value]).pipe(Effect.mapError(failed('git config')))
+    }
+  })
+
+/** Adds the team copy remote; answers a sentence to add to the conflict
+ * message when it could not, else null. */
+export function addTeamCopyRemote(root: string): Promise<string | null> {
+  const workspaceId = process.env.ORIZU_WORKSPACE_ID?.trim() || resolveAttachedWorkspaceId(root)
+  const program = addTeamRemote(workspaceId).pipe(
+    Effect.as(null),
+    Effect.catchTag('TeamRemoteUnavailable', (failure) =>
+      Effect.succeed(`The ${TEAM_REMOTE_NAME} remote could not be added (${failure.reason}); add it with "git remote add ${TEAM_REMOTE_NAME} <team copy>".`)
+    )
+  )
+  return Effect.runPromise(Effect.provide(program, liveLayer(root)))
+}