orizu 0.5.37 → 0.5.39

package/src/provider-list-workflow.ts

@@ -0,0 +1,108 @@
+import { Context, Effect, Result, Schema } from 'effect'
+
+import { authedFetch } from './http.js'
+import { providerWireRecord as record } from './provider-wire-record.js'
+import { isProviderRefusalCode } from './provider-refusals.js'
+
+import type { ModelConfigsCommandIo } from './model-configs-cli.js'
+
+type ProviderListFailure =
+  | { readonly _tag: 'Http'; readonly message: string }
+  | { readonly _tag: 'Transport' }
+  | { readonly _tag: 'Resolution'; readonly message: string }
+  | { readonly _tag: 'Adapter'; readonly message: string }
+
+function providerListFailureMessage(failure: ProviderListFailure): string {
+  switch (failure._tag) {
+    case 'Http': return failure.message
+    case 'Transport': return 'Provider request failed'
+    // Project selection remains the existing, separately owned adapter.
+    case 'Resolution': case 'Adapter': return failure.message
+    default: { const exhaustive: never = failure; return exhaustive }
+  }
+}
+
+const ProviderListTransport = Context.Service<{
+  readonly read: (project: string) => Effect.Effect<Response, ProviderListFailure>
+}>('orizu/cli/ProviderListTransport')
+
+const WireRecord = Schema.Record(Schema.String, Schema.Unknown)
+const emptyWireRecord: Record<string, unknown> = {}
+
+function providerListProgram(project: string, io: ModelConfigsCommandIo) {
+  return Effect.gen(function*() {
+    const transport = yield* ProviderListTransport
+    const response = yield* transport.read(project)
+    // Decode raw wire data; malformed JSON and non-record bodies retain the
+    // existing empty record fallback without narrowing accepted record fields.
+    const value = yield* Effect.promise(() => response.json().catch(() => null))
+    const body = yield* Schema.decodeUnknownEffect(WireRecord)(value).pipe(
+      Effect.catch(() => Effect.succeed(emptyWireRecord)),
+    )
+    if (!response.ok) {
+      const message = typeof body.error === 'string' && isProviderRefusalCode(body.error) ? body.error : 'Provider request failed'
+      return yield* Effect.fail<ProviderListFailure>({ _tag: 'Http', message })
+    }
+    yield* Effect.sync(() => {
+      if (io.json) io.print(JSON.stringify(body))
+      else {
+        io.print('ID  PROTOCOL  HOST  CREDENTIAL ENV  BUILT-IN')
+        for (const value of Array.isArray(body.providers) ? body.providers : []) {
+          const row = record(value)
+          io.print(`${row.id}  ${row.protocol}  ${row.host}  ${row.credentialEnv}  ${row.builtIn ? 'yes' : 'no'}`)
+        }
+      }
+    })
+  })
+}
+
+export async function listProviders(projectArg: string | null, io: ModelConfigsCommandIo): Promise<number> {
+  const controller = new AbortController()
+  let interrupted: 130 | 143 | undefined
+  const interrupt = () => { interrupted = 130; controller.abort() }
+  const terminate = () => { interrupted = 143; controller.abort() }
+  const transport = {
+    read: (project: string) => Effect.tryPromise({
+      try: signal => (io.fetcher ?? authedFetch)(`/api/cli/providers?project=${encodeURIComponent(project)}`, {
+        method: 'GET', signal: AbortSignal.any([signal, controller.signal]),
+      }),
+      // The retained HTTP adapter exposes login/config/refresh diagnostics as
+      // untyped Error values. Preserve its public messages until ORI-2420
+      // supplies typed adapter failures; never expose nested transport causes.
+      catch: (cause): ProviderListFailure => cause instanceof Error
+        ? { _tag: 'Adapter', message: cause.message }
+        : { _tag: 'Transport' },
+    }),
+  }
+  const program = Effect.gen(function*() {
+    const project = yield* Effect.tryPromise({
+      try: async () => {
+        const project = await io.resolveProjectSlug?.(projectArg)
+        if (!project) throw new Error('Project resolver unavailable')
+        return project
+      },
+      catch: (cause): ProviderListFailure => ({ _tag: 'Resolution', message: cause instanceof Error ? cause.message : 'Provider request failed' }),
+    })
+    // The retained resolver is unsignalled. Do not suppress Node's natural
+    // termination until the cancellable catalog transport has been admitted.
+    return yield* Effect.acquireUseRelease(
+      Effect.sync(() => { process.once('SIGINT', interrupt); process.once('SIGTERM', terminate) }),
+      () => providerListProgram(project, io).pipe(Effect.provideService(ProviderListTransport, transport)),
+      () => Effect.sync(() => {
+        process.removeListener('SIGINT', interrupt)
+        process.removeListener('SIGTERM', terminate)
+      }),
+    )
+  })
+  try {
+    const result = await Effect.runPromise(Effect.result(program), { signal: controller.signal })
+    if (Result.isSuccess(result)) return 0
+    const message = providerListFailureMessage(result.failure)
+    io.print(io.json ? JSON.stringify({ error: message }) : message)
+    return 1
+  } catch {
+    if (interrupted !== undefined) return interrupted
+    io.print(io.json ? JSON.stringify({ error: 'Provider request failed' }) : 'Provider request failed')
+    return 1
+  }
+}

package/src/provider-wire-record.ts

@@ -0,0 +1,4 @@
+/** Preserve the provider commands' permissive ordinary-TypeScript row coercion. */
+export function providerWireRecord(value: unknown): Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {}
+}

package/src/providers-cli.ts

@@ -1,4 +1,5 @@
 import { authedFetch } from './http.js'
+import { providerWireRecord as object } from './provider-wire-record.js'
 import { credentialEnvFor, providerLookupFor } from './provider-lookup.js'
 import { CREDENTIAL_ENV_PATTERN, PROVIDER_FIELD_PATTERNS, RESERVED_CREDENTIAL_ENVS, isProviderRefusalCode } from './provider-refusals.js'
 import { findProvider, parseModelIdentity } from './provider-registry.js'
@@ -8,9 +9,6 @@ import type { ModelConfigsCommandIo } from './model-configs-cli.js'
 import type { ProviderEntry, WireProtocol } from './provider-registry.js'
 
 const FIELD_CONTRACT = 'Anthropic Messages base URL excludes /v1; OpenAI base URLs include the version segment.'
-function object(value: unknown): Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {}
-}
 function assertProtocol(value: unknown): asserts value is WireProtocol {
   if (typeof value !== 'string' || !Object.hasOwn(PROBE_PROTOCOLS, value)) throw new Error('provider_protocol_invalid')
 }
@@ -89,6 +87,10 @@ export async function providersCommand(args: string[], io: ModelConfigsCommandIo
       baseUrl = baseUrl.replace(/^(https:\/\/)([^/]+)/, (_, scheme: string, host: string) => scheme + host.toLowerCase())
       provider = providerRow({ id, baseUrl, protocol: flags.get('--protocol') ?? 'openai-chat', credentialEnv: flags.get('--credential-env') ?? credentialEnvFor(id), authHeader: flags.get('--auth-header') ?? 'Authorization', authValuePrefix: flags.get('--auth-value-prefix') ?? 'Bearer ' })
     }
+    if (checkIdentity === undefined && command === 'list' && positional.length === 1) {
+      const { listProviders } = await import('./provider-list-workflow.js')
+      return listProviders(flags.get('--project') || null, io)
+    }
     const project = await io.resolveProjectSlug?.(flags.get('--project') || null)
     if (!project) throw new Error('Project resolver unavailable')
     const fetcher = io.fetcher ?? authedFetch
@@ -116,16 +118,6 @@ export async function providersCommand(args: string[], io: ModelConfigsCommandIo
       const entry = lookup.find(identity.provider)
       if (!entry) throw new Error('provider_not_found')
       await runProbe(entry, identity.modelId, io)
-    } else if (command === 'list' && positional.length === 1) {
-      const body = await request(root, { method: 'GET' })
-      if (io.json) io.print(JSON.stringify(body))
-      else {
-        io.print('ID  PROTOCOL  HOST  CREDENTIAL ENV  BUILT-IN')
-        for (const value of Array.isArray(body.providers) ? body.providers : []) {
-          const row = object(value)
-          io.print(`${row.id}  ${row.protocol}  ${row.host}  ${row.credentialEnv}  ${row.builtIn ? 'yes' : 'no'}`)
-        }
-      }
     } else if (command === 'remove' && id && positional.length === 2) {
       await request(`/api/cli/providers/${encodeURIComponent(id)}?project=${encodeURIComponent(project)}`, { method: 'DELETE' })
       io.print(io.json ? JSON.stringify({ removed: id }) : `Removed provider ${id}`)

package/src/publish-merge-job.ts

@@ -0,0 +1,350 @@
+/** ORI-2280: the agent-free publish merge one-shot. The coordinator runs it
+ * in a sandbox with network access to Artifacts only. It merges one session
+ * copy into its team copy with `publishSessionMerge`, getting one scoped key
+ * at a time from the web app and revoking every key before it reports. */
+import { execFile } from 'node:child_process'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+
+import { createEphemeralAskPass, type GitAuth } from './artifacts-git-runtime.js'
+import { publishSessionMerge, type PublishSessionMergeResult } from './artifacts-session-merge.js'
+import { CLOUDFLARE_ARTIFACTS_HOST_PATTERN } from './cloudflare-artifacts-git-remote.js'
+import { assertSecureTokenTransport } from './http.js'
+import { assertWorkspaceBootstrapRemote, isLoopbackOrigin } from './workspace-bootstrap-job.js'
+import {
+  PUBLISH_MERGE_CONFLICT_FILES_LIMIT,
+  PUBLISH_MERGE_CONFLICT_PATH_MAX,
+  PUBLISH_MERGE_COORDINATOR_WALL_MS,
+  PUBLISH_MERGE_WALL_AT_ENV,
+  type PublishMergeJobFailureCode,
+} from './publish-merge-timing.js'
+import { DEFAULT_REPOSITORY_BACKUP_LIMITS } from './repository-backup-core.js'
+
+const PUBLISH_MERGE_JOB_CAPABILITY = 'publish-merge-job:v1'
+/** Timing. The job's wall is the earlier of:
+ *  - ORIZU_PUBLISH_MERGE_WALL_AT, when set: the epoch-ms moment the
+ *    coordinator stops the sandbox (its createdAt + 120 s, so sandbox create
+ *    and CLI boot are already counted);
+ *  - 110 s from the job's own start, the fallback when it is not set.
+ * Within it:
+ *  - the merge ends by 90 s from start, and always 10 s before the wall;
+ *  - revoking the keys still live ends 10 s before the wall, each call at
+ *    most 15 s or whatever is left;
+ *  - the last 10 s are kept for posting the result, so it always goes out.
+ * All of this is well below the read keys' five-minute life, so no key is
+ * ever renewed. */
+const JOB_DEADLINE_MS = 90_000
+const RESULT_RESERVE_MS = 10_000
+const JOB_WALL_MS = PUBLISH_MERGE_COORDINATOR_WALL_MS - RESULT_RESERVE_MS
+const LATE_CALL_TIMEOUT_MS = 15_000
+const GIT_TIMEOUT_MS = 60_000
+/** ADR-012's envelope for a repository's whole object graph. The graph is
+ * always larger than the content it was seeded from, so ADR-011's 1 GiB
+ * content limit is not the measure here. */
+const ADMISSION = {
+  totalBytes: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxObjectBytes,
+  objectBytes: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxSingleObjectBytes,
+  objects: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxObjects,
+  commits: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxCommits,
+}
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+const IDENTITY = {
+  GIT_AUTHOR_NAME: 'Orizu',
+  GIT_AUTHOR_EMAIL: 'publish@orizu.invalid',
+  GIT_COMMITTER_NAME: 'Orizu',
+  GIT_COMMITTER_EMAIL: 'publish@orizu.invalid',
+}
+
+interface PublishMergeJobEnv {
+  bootSecret: string
+  jobId: string
+  coordinatorUrl: string
+  baseUrl: string
+  /** The Artifacts git host the coordinator expects; localhost only in tests. */
+  expectedGitHost: string
+  /** The coordinator's wall, epoch ms; see the timing note above. */
+  wallAt?: number
+}
+
+export type PublishMergeJobOutcome =
+  | { outcome: 'merged'; mergeSha: string }
+  | { outcome: 'already_merged'; headSha: string }
+  /** At most PUBLISH_MERGE_CONFLICT_FILES_LIMIT paths; `moreFiles` counts the rest. */
+  | { outcome: 'conflict'; files: readonly string[]; moreFiles: number }
+  | { outcome: 'denied' }
+  | { outcome: 'race_lost' }
+  | { outcome: 'failed'; code: PublishMergeJobFailureCode }
+
+interface Credential {
+  tokenId: string
+  plaintext: string
+  remote: string
+}
+
+class JobFailure extends Error {
+  constructor(readonly code: PublishMergeJobFailureCode | 'denied') {
+    super(code)
+  }
+}
+
+function resolvePublishMergeJobEnv(env: Record<string, string | undefined>): PublishMergeJobEnv | string {
+  const value = (name: string) => env[name]?.trim() ?? ''
+  const resolved = {
+    bootSecret: value('ORIZU_BOOT_SECRET'),
+    jobId: value('ORIZU_PUBLISH_MERGE_JOB_ID'),
+    coordinatorUrl: value('ORIZU_COORDINATOR_URL').replace(/\/+$/, ''),
+    baseUrl: value('ORIZU_BASE_URL').replace(/\/+$/, ''),
+    expectedGitHost: value('ORIZU_PUBLISH_MERGE_GIT_HOST').toLowerCase(),
+  }
+  if (Object.values(resolved).some((item) => item.length === 0)) return 'missing required env'
+  const wallAtText = value(PUBLISH_MERGE_WALL_AT_ENV)
+  const wallAt = wallAtText ? Number(wallAtText) : undefined
+  if (wallAt !== undefined && (!/^[0-9]{13}$/.test(wallAtText) || !Number.isSafeInteger(wallAt))) return 'invalid wall deadline'
+  try {
+    assertSecureTokenTransport(resolved.coordinatorUrl)
+    assertSecureTokenTransport(resolved.baseUrl)
+  } catch {
+    return 'insecure coordinator or base URL'
+  }
+  const localGitAllowed = isLoopbackOrigin(resolved.coordinatorUrl) && isLoopbackOrigin(resolved.baseUrl) && resolved.expectedGitHost === 'localhost'
+  if (!UUID_PATTERN.test(resolved.jobId) || (!CLOUDFLARE_ARTIFACTS_HOST_PATTERN.test(resolved.expectedGitHost) && !localGitAllowed)) {
+    return 'invalid job id or git host'
+  }
+  return wallAt === undefined ? resolved : { ...resolved, wallAt }
+}
+
+/** Every remote must be an https repository in the hosted namespace on the expected host. */
+function assertRemote(remote: unknown, expectedGitHost: string): string {
+  try {
+    assertWorkspaceBootstrapRemote(String(remote), expectedGitHost)
+  } catch {
+    throw new JobFailure('scope_refused')
+  }
+  return new URL(String(remote)).toString()
+}
+
+async function post(url: string, bearer: string, body: object, signal?: AbortSignal): Promise<Record<string, unknown>> {
+  let response: Response
+  try {
+    response = await fetch(url, {
+      method: 'POST',
+      redirect: 'error',
+      signal,
+      headers: { authorization: `Bearer ${bearer}`, 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+  } catch {
+    throw new JobFailure(signal?.aborted ? 'job_timed_out' : 'api_unavailable')
+  }
+  const value: unknown = await response.json().catch(() => null)
+  const record = value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : null
+  // The session lost its authority while a key was being minted: a refusal.
+  if (response.status === 403 && record?.error === 'gate_denied') throw new JobFailure('denied')
+  if (response.status === 401 || response.status === 403) throw new JobFailure('scope_refused')
+  if (!response.ok || !record) throw new JobFailure('api_unavailable')
+  return record
+}
+
+/** The permission check's answer, or unavailable for anything else. */
+function gateAllows(value: Record<string, unknown>): boolean {
+  const keys = Object.keys(value).sort().join(',')
+  if (keys === 'allowed' && value.allowed === true) return true
+  if (keys === 'allowed,reason' && value.allowed === false && typeof value.reason === 'string') return false
+  throw new JobFailure('api_unavailable')
+}
+
+/** ADR-012: the team copy is canonical state, so the merged graph must fit
+ * the admission envelope before a write key is asked for. The merge folder
+ * holds exactly both copies' fetched objects and the merge commit. */
+async function assertMergeAdmitted(worktree: string, signal: AbortSignal, narrower: Partial<typeof ADMISSION> = {}): Promise<void> {
+  const { stdout } = await promisify(execFile)(
+    'git',
+    ['cat-file', '--batch-all-objects', '--batch-check=%(objecttype) %(objectsize)'],
+    { cwd: worktree, maxBuffer: 64 * 1024 * 1024, signal }
+  )
+  if (!isMergeInventoryAdmitted(stdout, narrower)) throw new JobFailure('admission_refused')
+}
+
+/** One `<type> <size>` line per object, as `git cat-file --batch-check` prints them. */
+export function isMergeInventoryAdmitted(inventory: string, narrower: Partial<typeof ADMISSION> = {}): boolean {
+  const limits = Object.fromEntries(
+    Object.entries(ADMISSION).map(([key, max]) => [key, Math.min(max, narrower[key as keyof typeof ADMISSION] ?? max)])
+  ) as typeof ADMISSION
+  let totalBytes = 0
+  let objects = 0
+  let commits = 0
+  for (const line of inventory.split('\n')) {
+    if (!line) continue
+    const [type, size] = line.split(' ')
+    const bytes = Number(size)
+    objects += 1
+    totalBytes += bytes
+    if (type === 'commit') commits += 1
+    if (!Number.isSafeInteger(bytes) || bytes > limits.objectBytes) return false
+  }
+  return totalBytes <= limits.totalBytes && objects <= limits.objects && commits <= limits.commits
+}
+
+/** A post with its own time limit. An AbortController and timer, as for the
+ * deadline: AbortSignal.timeout did not fire inside the job under bun test. */
+async function postWithin(timeoutMs: number, url: string, bearer: string, body: object): Promise<Record<string, unknown>> {
+  const stop = new AbortController()
+  const timer = setTimeout(() => stop.abort(), timeoutMs)
+  try {
+    return await post(url, bearer, body, stop.signal)
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** The conflict list the job reports, bounded so the result always fits the
+ * coordinator's body limit. A path too long to name is counted instead. */
+export function boundConflictFiles(files: readonly string[]): { files: string[]; moreFiles: number } {
+  const named = files.filter((file) => file.length <= PUBLISH_MERGE_CONFLICT_PATH_MAX).slice(0, PUBLISH_MERGE_CONFLICT_FILES_LIMIT)
+  return { files: named, moreFiles: files.length - named.length }
+}
+
+function toOutcome(result: PublishSessionMergeResult): PublishMergeJobOutcome {
+  switch (result.kind) {
+    case 'merged':
+      return { outcome: 'merged', mergeSha: result.mergeSha }
+    case 'already_merged':
+      return { outcome: 'already_merged', headSha: result.canonicalSha }
+    case 'conflict':
+      return { outcome: 'conflict', ...boundConflictFiles(result.files) }
+    case 'denied':
+      return { outcome: 'denied' }
+    case 'race_lost':
+      return { outcome: 'race_lost' }
+  }
+}
+
+export async function runPublishMergeJob(options: {
+  env: PublishMergeJobEnv
+  deadlineMs?: number
+  /** Narrower admission limits; tests only. Never wider than ADMISSION. */
+  admission?: Partial<typeof ADMISSION>
+  /** Shorter timing; tests only. Each is clamped to its production value. */
+  timing?: { resultReserveMs?: number; lateCallMs?: number }
+}): Promise<{ reported: boolean; outcome: PublishMergeJobOutcome }> {
+  const { env } = options
+  const startedAt = Date.now()
+  const wallEnd = Math.min(startedAt + JOB_WALL_MS, env.wallAt ?? Number.POSITIVE_INFINITY)
+  const reserveMs = Math.min(options.timing?.resultReserveMs ?? RESULT_RESERVE_MS, RESULT_RESERVE_MS)
+  const lateCallMs = Math.min(options.timing?.lateCallMs ?? LATE_CALL_TIMEOUT_MS, LATE_CALL_TIMEOUT_MS)
+  const stop = new AbortController()
+  const timer = setTimeout(() => stop.abort(), Math.max(0, Math.min(options.deadlineMs ?? JOB_DEADLINE_MS, wallEnd - reserveMs - startedAt)))
+  const deadline = stop.signal
+  const api = (action: string) => `${env.baseUrl}/api/internal/publish-merge/${env.jobId}/${action}`
+  const issued: Array<{ target: 'session' | 'team'; tokenId: string }> = []
+  let jobToken = ''
+  /** A late call's bound: its own limit, or the time left before the last `keepMs` of the wall. */
+  const lateBound = (keepMs: number) => Math.min(lateCallMs, wallEnd - keepMs - Date.now())
+  const revokeCall = async (target: 'session' | 'team', tokenId: string) => {
+    const bound = lateBound(reserveMs)
+    if (bound <= 0) throw new JobFailure('credentials_pending')
+    return postWithin(bound, api('revoke'), jobToken, { target, tokenId })
+  }
+  let outcome: PublishMergeJobOutcome
+  const root = await mkdtemp(join(tmpdir(), 'orizu-publish-merge-'))
+  try {
+    const askPass = await createEphemeralAskPass(root)
+    const claimed = await post(`${env.coordinatorUrl}/publish-merge-jobs/${env.jobId}/claim`, env.bootSecret, {}, deadline)
+    if (typeof claimed.jobToken !== 'string' || !claimed.jobToken) throw new JobFailure('scope_refused')
+    jobToken = claimed.jobToken
+    const spec = await post(api('spec'), jobToken, {}, deadline)
+    const sessionRemote = assertRemote((spec.session as { remote?: unknown } | undefined)?.remote, env.expectedGitHost)
+    if (spec.jobId !== env.jobId || typeof spec.sessionCommitSha !== 'string' || spec.ref !== 'refs/heads/main' || typeof spec.commitMessage !== 'string') {
+      throw new JobFailure('scope_refused')
+    }
+    const mint = async (target: 'session' | 'team', scope: 'read' | 'write'): Promise<Credential> => {
+      const value = await post(api('credential'), jobToken, { target, scope }, deadline)
+      if (typeof value.tokenId !== 'string' || typeof value.plaintext !== 'string') throw new JobFailure('scope_refused')
+      issued.push({ target, tokenId: value.tokenId })
+      return { tokenId: value.tokenId, plaintext: value.plaintext, remote: assertRemote(value.remote, env.expectedGitHost) }
+    }
+    const revoke = async (target: 'session' | 'team', tokenId: string) => {
+      const value = await revokeCall(target, tokenId)
+      if (value.revoked !== true) throw new JobFailure('credentials_pending')
+      issued.splice(issued.findIndex((item) => item.tokenId === tokenId), 1)
+    }
+    const auth = (credential: Credential): GitAuth => ({ askPassPath: askPass.path, token: credential.plaintext })
+
+    const sessionRead = await mint('session', 'read')
+    if (sessionRead.remote !== sessionRemote) throw new JobFailure('scope_refused')
+    const teamRead = await mint('team', 'read')
+    const result = await publishSessionMerge({
+      root,
+      canonical: { remote: teamRead.remote, auth: auth(teamRead) },
+      source: { remote: sessionRemote, auth: auth(sessionRead) },
+      canonicalRef: 'refs/heads/main',
+      sourceRef: 'refs/heads/main',
+      expectedSourceSha: spec.sessionCommitSha,
+      commitMessage: spec.commitMessage,
+      commitIdentityEnv: IDENTITY,
+      authorize: async (merge) => {
+        await assertMergeAdmitted(merge.worktree, deadline, options.admission)
+        return gateAllows(await post(api('gate'), jobToken, {}, deadline))
+      },
+      withCanonicalWrite: async (push) => {
+        const write = await mint('team', 'write')
+        if (write.remote !== teamRead.remote) throw new JobFailure('scope_refused')
+        try {
+          return await push(auth(write))
+        } finally {
+          await revoke('team', write.tokenId)
+        }
+      },
+      timeoutMs: GIT_TIMEOUT_MS,
+      signal: deadline,
+    })
+    outcome = toOutcome(result)
+  } catch (error) {
+    if (error instanceof JobFailure && error.code === 'denied') outcome = { outcome: 'denied' }
+    else if (deadline.aborted) outcome = { outcome: 'failed', code: 'job_timed_out' }
+    else outcome = { outcome: 'failed', code: error instanceof JobFailure && error.code !== 'denied' ? error.code : 'publish_failed' }
+  } finally {
+    clearTimeout(timer)
+    // Revoke whatever is still live, newest first, even past the deadline; an
+    // unrevoked key wins over the merge outcome because its authority is then uncertain.
+    for (const { target, tokenId } of [...issued].reverse()) {
+      try {
+        const value = await revokeCall(target, tokenId)
+        if (value.revoked !== true) throw new JobFailure('credentials_pending')
+      } catch {
+        outcome = { outcome: 'failed', code: 'credentials_pending' }
+      }
+    }
+    await rm(root, { recursive: true, force: true })
+  }
+  let reported = false
+  try {
+    const bound = lateBound(0)
+    if (bound <= 0) throw new JobFailure('job_timed_out')
+    await postWithin(bound, `${env.coordinatorUrl}/publish-merge-jobs/${env.jobId}/result`, env.bootSecret, outcome)
+    reported = true
+  } catch {
+    reported = false
+  }
+  return { reported, outcome }
+}
+
+export async function publishMergeJobCommand(
+  args: readonly string[],
+  io: { print: (line: string) => void; printErr?: (line: string) => void }
+): Promise<number> {
+  if (args.includes('--capability-check')) {
+    io.print(PUBLISH_MERGE_JOB_CAPABILITY)
+    return 0
+  }
+  const env = resolvePublishMergeJobEnv(process.env)
+  if (typeof env === 'string') {
+    io.printErr?.(`publish-merge-job: ${env}`)
+    return 1
+  }
+  const result = await runPublishMergeJob({ env })
+  io.print(JSON.stringify(result.outcome))
+  return result.reported ? 0 : 1
+}

package/src/publish-merge-timing.ts

@@ -0,0 +1,27 @@
+/** ORI-2280: the publish merge job's wall, shared by the coordinator, which
+ * stops the sandbox at it, and the CLI job, which must report before it. No
+ * Node or Worker imports: both sides compile this file. */
+
+/** From the coordinator creating the job to it stopping the sandbox. */
+export const PUBLISH_MERGE_COORDINATOR_WALL_MS = 2 * 60 * 1000
+/** The coordinator sets this on the sandbox to `createdAt + PUBLISH_MERGE_COORDINATOR_WALL_MS`, in epoch milliseconds. */
+export const PUBLISH_MERGE_WALL_AT_ENV = 'ORIZU_PUBLISH_MERGE_WALL_AT'
+
+/** A conflict result names at most this many paths, each at most
+ * PUBLISH_MERGE_CONFLICT_PATH_MAX characters, and counts the rest, so the
+ * result always fits the coordinator's result body limit. */
+export const PUBLISH_MERGE_CONFLICT_FILES_LIMIT = 200
+export const PUBLISH_MERGE_CONFLICT_PATH_MAX = 1024
+
+/** The failure codes the sandbox may report. The coordinator's own codes
+ * (`timed_out`, `provider_unavailable`, `snapshot_missing_command`, ...) are
+ * not among them, so a reported failure always says which side saw it. */
+export const PUBLISH_MERGE_JOB_FAILURE_CODES = [
+  'scope_refused',
+  'admission_refused',
+  'credentials_pending',
+  'api_unavailable',
+  'job_timed_out',
+  'publish_failed',
+] as const
+export type PublishMergeJobFailureCode = (typeof PUBLISH_MERGE_JOB_FAILURE_CODES)[number]

package/src/workbench-cli.ts

@@ -45,6 +45,8 @@ export interface WorkbenchRunCosts {
 export interface WorkbenchRunSummary extends WorkbenchRunCosts {
   id: string
   status: string
+  /** Why a failed run failed, in plain words, mapped by the server (ORI-2264). */
+  failureReason?: string
 }
 
 export interface WorkbenchSession {
@@ -76,6 +78,8 @@ export interface WorkbenchRun extends WorkbenchRunCosts {
   status: string
   evidence?: Record<string, unknown>
   summary?: Record<string, unknown>
+  /** Why a failed run failed, in plain words, mapped by the server (ORI-2264). */
+  failureReason?: string
   latestSequence?: number
   startedAt?: string | null
   finishedAt?: string | null
@@ -1130,6 +1134,8 @@ function formatSessionStatus(result: SessionStatusResult): string {
       const cost = finiteOrNull(run.modelCostUsd)
       const suffix = cost !== null ? `  ${formatUsd(cost)}` : ''
       lines.push(`  run ${run.id}  ${run.status}${suffix}`)
+      const why = failedRunLine(run)
+      if (why) lines.push(`    ${why}`)
     }
     return lines.join('\n')
   }
@@ -1167,10 +1173,18 @@ function formatSessionFinishOutcome(result: SessionFinishResult): string {
   return `manifest ${id}  ${status}  repo_merge  (${files} files, +${additions}/-${deletions})`
 }
 
+// The web page's failed line, with the reason the server mapped (ORI-2264).
+function failedRunLine(run: { status: string; failureReason?: unknown }): string | null {
+  return run.status === 'failed' && typeof run.failureReason === 'string' && run.failureReason
+    ? `The agent stopped: ${run.failureReason}.`
+    : null
+}
+
 function formatRunStatus(run: WorkbenchRun): string {
   const sequence = typeof run.latestSequence === 'number' ? `  latestSequence=${run.latestSequence}` : ''
   const costLine = formatCostSummary(run)
-  return `run ${run.id}  ${run.status}${sequence}${costLine ? `\n  ${costLine}` : ''}`
+  const why = failedRunLine(run)
+  return `run ${run.id}  ${run.status}${sequence}${costLine ? `\n  ${costLine}` : ''}${why ? `\n  ${why}` : ''}`
 }
 
 // ALI-1045: one compact digest line per event — shared with the attached

package/src/workspace-bootstrap-job.ts

@@ -114,7 +114,7 @@ function isObject(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value)
 }
 
-function isLoopbackOrigin(value: string): boolean {
+export function isLoopbackOrigin(value: string): boolean {
   try {
     const host = new URL(value).hostname
     return host === 'localhost' || host === '127.0.0.1' || host === '::1'

package/vendor/skills/orizu/flows/onboard.md

@@ -20,7 +20,7 @@ Compare the inventoried surfaces using source metadata only: availability, prove
 
 ## Install and establish the project
 
-After the human chooses Orizu, check whether `orizu` is available and record `orizu --version`. If it is missing, require Node.js 20+ and install the CLI with `npm i -g orizu`. Then run `orizu setup`; verify authentication and runtime with `orizu whoami --json` and `orizu capabilities --json`, and verify the installed skill separately with `orizu skills status --json` (use `orizu skills update` when stale). Use `references/cli-reference.md` for authentication and team/project commands. Follow `references/authority-map.md` for who executes each action. Do not rely on remembered commands.
+After the human chooses Orizu, check that `node --version` is 22 or newer (the CLI requires Node.js 22+), then check whether `orizu` is available and record `orizu --version`. If it is missing, install the CLI with `npm i -g orizu`. Then run `orizu setup`; verify authentication and runtime with `orizu whoami --json` and `orizu capabilities --json`, and verify the installed skill separately with `orizu skills status --json` (use `orizu skills update` when stale). Use `references/cli-reference.md` for authentication and team/project commands. Follow `references/authority-map.md` for who executes each action. Do not rely on remembered commands.
 
 ## Ratify the improvement plan
 

package/vendor/skills/orizu/references/authority-map.md

@@ -8,12 +8,12 @@ This is the single source of truth for who runs each action. Replace placeholder
 | All surfaces | Edit files | Edit and commit source, configs, `App.tsx`, schemas, and local traces under `logs/<run-id>` in the repo working set. | Repo files are not canonical pointer or run state. |
 | Local and hosted agents | Product feedback filing | File product feedback autonomously with `orizu feedback`, using scrubbed narrative and no customer content. | This bounded feedback command is the agent's own authority; no human approval is required. |
 | Local agent under the user's token | Workflow | Survey the customer codebase, resolve state, prepare the plan, files, manifests, diffs, and evidence, then ask the human to ratify the workflow design. | The human moments are plan ratification and execution of all production/default pointer moves. |
-| Local agent under the user's token | Catalog mutations and pointer preparation | After plan ratification, pull instruction material from the customer codebase and run `orizu instructions create <manifest> --project <team/project>`, `orizu instructions push <manifest> --project <team/project> --set <slug-or-exact-name>`, shape add/remove, archive/restore itself under the user's token. For pointer changes, gather only read-only resolution and binding evidence, prepare the exact commands, then hand them off. | Per the Micro-round 3 custody ruling, a human admin or curator using a user token executes every runner default-label move, optimizer-label move, scorer production-label move, profile promote/rollback, default move, and labeled optimization promotion on every surface. |
+| Local agent under the user's token | Catalog mutations and pointer preparation | After plan ratification, pull instruction material from the customer codebase and run `orizu instructions create <manifest> --project <team/project>`, `orizu instructions push <manifest> --project <team/project> --set <slug-or-exact-name>`, shape add/remove before first promotion, archive/restore itself under the user's token. For pointer changes, gather only read-only resolution and binding evidence, prepare the exact commands, then hand them off. | Per the Micro-round 3 custody ruling, a human admin or curator using a user token executes every runner default-label move, optimizer-label move, scorer production-label move, profile promote/rollback, default move, and labeled optimization promotion on every surface. |
 | Hosted session | Start and scope | Use the pre-authenticated CLI from `ORIZU_TOKEN_FILE` and `ORIZU_BASE_URL`; resolve only the session's signed team with `orizu teams list`, then list or create projects only within it. Run `orizu projects create --name "<project name>" --team <signed-team>` when needed. | Team creation is platform-enforced human-only. Hand off: `orizu teams create --name "<team name>"`, then ask the human to start a new hosted session scoped to that team; the current session cannot switch teams. |
 | Hosted session | Team-wide curator work | While the hosted session is active and its kill switch is clear, perform setup plus ordinary curator reads and writes within the signed team. Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>` and `orizu instructions sync <set> --project <team/project> --out <app-root>`; synced material lands under `<app-root>/orizu/`. For git-canonical judges, scorers, runners, and optimizers, write with `--session <session-id>`, keep bytes as commits on the session branch, then verify with `git ls-files <path>` and inspect the commit. | The agent executes this work; an Orizu version id alone is not proof of committed bytes. Signed-project exceptions are in the next row. |
 | Hosted session | Signed-project work | Run optimization mutations only for the JWT's project, keep git-canonical draft writes on that session and project, and read diff comments only for that project. | Sibling-project optimization mutations, draft writes, and diff-comment reads are out of scope even where ordinary curator access is team-wide. |
 | Hosted session | Materialize an instruction set | When the survey finds only a candidate seed, turn it into the complete manifest. | ADR-008 requires a human curator using a local CLI user token. Create/push are hosted CLI route-enforced; direct RPC remains agent-writable and is a fix-forward gap. Hand off `orizu instructions create <manifest> --project <team/project>` for a fresh set, or `orizu instructions push <manifest> --project <team/project> --set <slug-or-exact-name>` for an existing set. Their measured 403 is `Sessionless registration is not available to the hosted agent: this artifact class is git-canonical (ADR-007) and its bytes must be committed to the session branch. Re-run with --session <session-id>.` Neither create nor push accepts `--session`. |
-| Hosted session | Profiles and component shape | Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>`, `orizu instructions shape add <set> --project <team/project> --key <key> --from <manifest>`, and `orizu instructions shape remove <set> --project <team/project> --key <key>` with team-scoped curator authority. Shape changes create unpromoted profile heads and do not move pointers. | A human admin or curator with `can_manage_project` runs every profile promote/rollback, instruction-set default move, and other production/default pointer move. |
+| Hosted session | Profiles and component shape | Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>`, `orizu instructions shape add <set> --project <team/project> --key <key> --from <manifest>`, and `orizu instructions shape remove <set> --project <team/project> --key <key>` with team-scoped curator authority. Shape add/remove works only until the first promotion of any profile, creates unpromoted profile heads, and does not move pointers. First promotion permanently freezes the shape, and sets that existed when this rule shipped are frozen too; a changed frozen shape requires a new instruction set. | A human admin or curator with `can_manage_project` runs every profile promote/rollback, instruction-set default move, and other production/default pointer move. |
 | Hosted session | Instruction-set visibility | Prepare the requested visibility change. | A human admin or curator with `can_manage_project` runs `orizu instructions archive <slug-or-exact-name> --project <team/project>` or `orizu instructions restore <slug-or-exact-name> --project <team/project>`. Hosted CLI route enforcement returns `Agent sessions cannot perform this action`; direct RPC remains agent-writable. |
 | Hosted session | Instruction scorers | Run `orizu instructions scorers set-headline <set> --key <component-key> --scorer-version <id> --project <team/project>` and `orizu instructions scorers add <set> --key <component-key> --scorer-version <id> --project <team/project>`; prepare scorer-pointer evidence. | A human admin or curator with `can_manage_project` runs `orizu scorers labels set <scorer-name> production --version <scorer-version-id> --project <team/project>`. The measured 403 is `Agents cannot move scorer labels; labels are human-only pointers. Propose the label change as a promotion manifest for a human to apply.` |
 | Hosted session | Promotion | After report acceptance, the two-stage path materializes once with unlabeled `orizu optimizations promote <run-id> --candidate <id> --project <team/project>`; hand the exact run id, candidate id, project, and report evidence to the human. | For the staged path, a human admin or curator with `can_manage_project` re-runs the same promotion as `orizu optimizations promote <run-id> --candidate <id> --label production --project <team/project>`. The idempotent finalizer finds the existing version by run and candidate provenance, moves production to that exact materialized version, and creates no duplicate profile version or candidate-promoted event. Equivalent simpler one-shot path: without prior materialization, the human runs the same labeled command once. A human admin or curator also runs `orizu manifests approve <id>`, `orizu manifests reject <id>`, and, after approval, `orizu manifests apply <id>`. |