orizu 0.5.38 → 0.5.39

package/src/dataset-commands.ts

@@ -1,6 +1,6 @@
 // ORI-2044: moved from index.ts to keep dataset commands together.
 
-import { readFileSync, statSync, writeFileSync } from 'fs'
+import { readFileSync, writeFileSync } from 'fs'
 import { basename, extname } from 'path'
 import { createInterface } from 'readline/promises'
 import { stdin as input, stdout as output } from 'process'
@@ -28,7 +28,6 @@ import { printDatasetSummaries } from './archive-artifacts-cli.js'
 import { formatTerminalLink } from './auth-commands.js'
 import { parseDatasetFile } from './file-parser.js'
 import { parseDatasetReference } from './dataset-download.js'
-import { streamJsonlRowChunks } from './jsonl-stream.js'
 import { editDatasetRows as runEditDatasetRows } from './dataset-edit-rows.js'
 import { parseCommaSeparated } from './task-commands.js'
 import type { DatasetSelection } from './account-directory.js'
@@ -432,175 +431,16 @@ async function downloadDataset() {
   printLine(`Saved dataset ${sanitizeTerminalText(datasetId)} (${format.toUpperCase()}) to ${sanitizeTerminalText(filename)}`)
 }
 
-const MAX_INPUT_FILE_SIZE_BYTES = 50 * 1024 * 1024 // 50 MB
-const APPEND_CHUNK_SIZE_ROWS = 500
-async function appendChunk(
-  datasetId: string,
-  rows: Array<Record<string, unknown>>
-): Promise<{ dataset: { id: string; name: string; rowCount: number }; appendedCount: number }> {
-  const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/rows`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ rows }),
-  })
-
-  if (!response.ok) {
-    throw new Error(`Append failed: ${await response.text()}`)
-  }
-
-  return parseJsonResponse<{
-    dataset: { id: string; name: string; rowCount: number }
-    appendedCount: number
-  }>(response, 'Dataset append')
-}
-
-async function appendJsonlDatasetRowsInChunks(datasetId: string, file: string) {
-  let totalAppended = 0
-  let lastResult: { dataset: { id: string; name: string; rowCount: number } } | null = null
-  let chunkIndex = 0
-  const chunks = streamJsonlRowChunks(file)[Symbol.asyncIterator]()
-
-  while (true) {
-    let nextChunk: IteratorResult<Array<Record<string, unknown>>>
-    try {
-      nextChunk = await chunks.next()
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error)
-      throw new Error(
-        `Append stopped while reading the next JSONL chunk: ${message}\n` +
-        `${totalAppended} rows from ${chunkIndex} chunk(s) were already appended. ` +
-        `Fix the file, remove the first ${totalAppended} rows, and re-run the command.`
-      )
-    }
-
-    if (nextChunk.done) {
-      break
-    }
-
-    const chunk = nextChunk.value
-    chunkIndex += 1
-    printLine(`Uploading chunk ${chunkIndex} (${chunk.length} rows)...`)
-
-    try {
-      const data = await appendChunk(datasetId, chunk)
-      totalAppended += data.appendedCount
-      lastResult = data
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error)
-      throw new Error(
-        `Chunk ${chunkIndex} failed: ${message}\n` +
-        `${totalAppended} rows from ${chunkIndex - 1} chunk(s) were already appended. ` +
-        `To retry, remove the first ${totalAppended} rows from your file and re-run the command.`
-      )
-    }
-  }
-
-  if (!lastResult) {
-    throw new Error('Dataset append file must contain at least one row')
-  }
-
-  printLine(
-    `Appended ${totalAppended} rows to dataset ${sanitizeTerminalText(lastResult.dataset.name)} (${sanitizeTerminalText(lastResult.dataset.id)}). New row count: ${lastResult.dataset.rowCount}`
-  )
-}
-
 async function appendDatasetRows() {
-  const projectArg = getArg('--project')
-  const datasetInput = getDatasetReferenceInput()
-  const fileArg = getArg('--file')
-
-  if (!fileArg) {
-    throw new Error('Usage: orizu datasets append [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>')
-  }
-
-  let datasetId: string
-  if (datasetInput) {
-    datasetId = parseDatasetReference(datasetInput).datasetId
-  } else {
-    const selected = await selectDatasetInteractively(projectArg)
-    datasetId = selected.datasetId
-  }
-
-  const file = expandHomePath(fileArg)
-
-  if (extname(file).toLowerCase() === '.jsonl') {
-    await appendJsonlDatasetRowsInChunks(datasetId, file)
-    return
-  }
-
-  // Check file size before reading to prevent OOM on large files (ALI-565).
-  // Wrap statSync in try/catch so missing/inaccessible files get friendly
-  // errors instead of raw Node.js ENOENT/EPERM (ALI-554).
-  let fileSizeBytes: number
-  try {
-    fileSizeBytes = statSync(file).size
-  } catch (error) {
-    const maybeError = error as NodeJS.ErrnoException
-    if (maybeError.code === 'ENOENT') {
-      throw new Error(
-        `File not found: ${file}. Check the path and filename, then retry.`
-      )
-    }
-    if (maybeError.code === 'EPERM' || maybeError.code === 'EACCES') {
-      throw new Error(
-        `Cannot read file: ${file}. Grant folder permission to your terminal app and retry.`
-      )
-    }
-    throw new Error(`Failed to access file ${file}: ${maybeError.message}`)
-  }
-  if (fileSizeBytes > MAX_INPUT_FILE_SIZE_BYTES) {
-    const sizeMb = (fileSizeBytes / (1024 * 1024)).toFixed(1)
-    throw new Error(
-      `Input file is ${sizeMb} MB, which exceeds the 50 MB limit. Split the file into smaller parts and append each separately.`
-    )
-  }
-
-  const { rows } = parseDatasetFile(file)
-  if (!Array.isArray(rows) || rows.length === 0) {
-    throw new Error('Dataset append file must contain at least one row')
-  }
-
-  if (rows.length <= APPEND_CHUNK_SIZE_ROWS) {
-    const data = await appendChunk(datasetId, rows)
-    printLine(
-      `Appended ${data.appendedCount} rows to dataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}). New row count: ${data.dataset.rowCount}`
-    )
-    return
-  }
-
-  // Chunked upload for large row counts (ALI-555: track partial progress)
-  let totalAppended = 0
-  let lastResult: { dataset: { id: string; name: string; rowCount: number } } | null = null
-  const totalChunks = Math.ceil(rows.length / APPEND_CHUNK_SIZE_ROWS)
-
-  for (let offset = 0; offset < rows.length; offset += APPEND_CHUNK_SIZE_ROWS) {
-    const chunk = rows.slice(offset, offset + APPEND_CHUNK_SIZE_ROWS)
-    const chunkIndex = Math.floor(offset / APPEND_CHUNK_SIZE_ROWS) + 1
-
-    printLine(`Uploading chunk ${chunkIndex}/${totalChunks} (${chunk.length} rows)...`)
-    try {
-      const data = await appendChunk(datasetId, chunk)
-      totalAppended += data.appendedCount
-      lastResult = data
-    } catch (error) {
-      const msg = error instanceof Error ? error.message : String(error)
-      throw new Error(
-        `Chunk ${chunkIndex}/${totalChunks} failed: ${msg}\n` +
-        `${totalAppended} rows from ${chunkIndex - 1} chunk(s) were already appended. ` +
-        `To retry, remove the first ${totalAppended} rows from your file and re-run the command.`
-      )
-    }
-  }
-
-  if (lastResult) {
-    if (hasJsonFlag()) {
-      printJson({ dataset: lastResult.dataset, appendedCount: totalAppended })
-      return
-    }
-    printLine(
-      `Appended ${totalAppended} rows to dataset ${sanitizeTerminalText(lastResult.dataset.name)} (${sanitizeTerminalText(lastResult.dataset.id)}). New row count: ${lastResult.dataset.rowCount}`
-    )
-  }
+  const { appendDatasetWorkflow } = await import('./dataset-append-workflow.js')
+  process.exitCode = await appendDatasetWorkflow(async () => {
+    const projectArg = getArg('--project')
+    const datasetInput = getDatasetReferenceInput()
+    const fileArg = getArg('--file')
+    if (!fileArg) throw new Error('Usage: orizu datasets append [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>')
+    const datasetId = datasetInput ? parseDatasetReference(datasetInput).datasetId : (await selectDatasetInteractively(projectArg)).datasetId
+    return { datasetId, file: expandHomePath(fileArg) }
+  }, { json: hasJsonFlag(), print: printLine })
 }
 
 async function editDatasetRows() {

package/src/dataset-transfer-download.ts

@@ -1,4 +1,4 @@
-import { Effect, Either, Schedule } from 'effect'
+import { Effect, Result, Schedule } from 'effect'
 import { writeFileSync } from 'node:fs'
 import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js'
 import { authedFetch } from './http.js'
@@ -29,9 +29,9 @@ export async function transferDatasetDownload(datasetId: string, format: string,
       if (cause instanceof TypeError) return new DownloadTransportError(cause)
       return cause instanceof Error ? cause : new Error('Dataset download request failed', { cause })
     },
-  }).pipe(Effect.timeoutFail({
+  }).pipe(Effect.timeoutOrElse({
     duration: timeoutMs,
-    onTimeout: () => new Error('DATASET_TRANSFER_TIMEOUT: Dataset download exceeded its deadline'),
+    orElse: () => Effect.fail(new Error('DATASET_TRANSFER_TIMEOUT: Dataset download exceeded its deadline')),
   }), Effect.retry({
     times: 2,
     schedule: Schedule.spaced(100),
@@ -49,8 +49,8 @@ export async function transferDatasetDownload(datasetId: string, format: string,
   process.once('SIGINT', handleInterrupt)
   process.once('SIGTERM', handleInterrupt)
   try {
-    const result = await Effect.runPromise(Effect.either(Effect.flatMap(download, write)), { signal: controller.signal })
-    if (Either.isLeft(result)) throw result.left
+    const result = await Effect.runPromise(Effect.result(Effect.flatMap(download, write)), { signal: controller.signal })
+    if (Result.isFailure(result)) throw result.failure
   } catch (error) {
     if (controller.signal.aborted) throw new Error('DATASET_TRANSFER_INTERRUPTED: Dataset download cancelled')
     throw error

package/src/dataset-transfer-upload.ts

@@ -1,4 +1,4 @@
-import { Context, Effect, Either, Layer } from 'effect'
+import { Context, Effect, Layer, Result } from 'effect'
 
 import { ensureDatasetUploadSnapshot } from './dataset-upload-snapshot.js'
 import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js'
@@ -43,7 +43,7 @@ interface DatasetUploadApi {
   append: (id: string, rows: UploadRows) => Effect.Effect<DatasetAppendResponse, DatasetWriteFailure>
   snapshot: (id: string) => Effect.Effect<DatasetSnapshot, DatasetWriteFailure>
 }
-const DatasetUploadApi = Context.GenericTag<DatasetUploadApi>('orizu/DatasetUploadApi')
+const DatasetUploadApi = Context.Service<DatasetUploadApi>('orizu/DatasetUploadApi')
 
 // Only the existing authentication client's rejected-token refresh may replay a
 // request. No transient/transport retries belong around these non-idempotent writes.
@@ -64,9 +64,9 @@ function post<T>(path: string, body: unknown, context: string, prefix: string, t
       catch: cause => cause instanceof DatasetWriteFailure ? cause : new DatasetWriteFailure(
         cause instanceof Error ? cause.message : String(cause), requestStarted ? 'unknown' : 'rejected', { cause },
       ),
-    }).pipe(Effect.timeoutFail({
+    }).pipe(Effect.timeoutOrElse({
       duration: timeoutMs,
-      onTimeout: () => new DatasetWriteFailure(`DATASET_TRANSFER_TIMEOUT: ${context} exceeded its deadline`, requestStarted ? 'unknown' : 'rejected'),
+      orElse: () => Effect.fail(new DatasetWriteFailure(`DATASET_TRANSFER_TIMEOUT: ${context} exceeded its deadline`, requestStarted ? 'unknown' : 'rejected')),
     }))
   })
 }
@@ -84,9 +84,9 @@ function liveUploadApi(options: DatasetUploadOptions) {
 }
 
 async function expectedPromise<A, E>(program: Effect.Effect<A, E>): Promise<A> {
-  const result = await Effect.runPromise(Effect.either(program))
-  if (Either.isLeft(result)) throw result.left
-  return result.right
+  const result = await Effect.runPromise(Effect.result(program))
+  if (Result.isFailure(result)) throw result.failure
+  return result.success
 }
 
 function uploadProgram(options: DatasetUploadOptions) {

package/src/git-credential.ts

@@ -63,6 +63,9 @@ const SAFE_REMOTE_COMPONENT = /^[^\u0000-\u0020\u007f\\?#]+$/
 export const REPO_TOKEN_PURPOSES = [
   'read',
   'write',
+  // ORI-2280: a hosted session's read key for its team copy, used by the
+  // `orizu-team` remote a publish conflict adds. Artifacts remotes only.
+  'team_read',
 ] as const
 
 export type RepoTokenPurpose =
@@ -375,7 +378,7 @@ async function mintArtifactsCredential(
     {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ purpose }),
+      body: JSON.stringify({ purpose, ...(purpose === 'team_read' ? { sessionId: process.env.ORIZU_SESSION_ID?.trim() } : {}) }),
     }
   )
 
@@ -541,6 +544,10 @@ export async function runGitCredential(op: string, io: GitCredentialIo): Promise
     )
     return 1
   }
+  if (io.purpose === 'team_read') {
+    io.printErr('orizu git-credential: team_read is only for an Artifacts team copy')
+    return 1
+  }
   const primaryPurpose = io.purpose ?? 'write'
   let minted = await mintToken(
     fetcher,

package/src/help.ts

@@ -84,8 +84,8 @@ export const COMMAND_DOCS: CliCommandDoc[] = [
   { path: ['instructions', 'profiles', 'rollback'], aliases: [['instruction-sets', 'profiles', 'rollback']], usage: 'orizu instructions profiles rollback <set> --project <team/project> --model-config <identity> --to <n> [--json]', summary: 'Create a rollback version and move profile production to it.', group: 'Instruction sets', options: [{ name: '--model-config <identity>', help: 'Profile model config.', required: true }, { name: '--to <n>', help: 'Historical profile version to copy.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions profiles rollback planner --project core/evals --model-config anthropic/claude-haiku --to 1'] },
   { path: ['instructions', 'default', 'show'], aliases: [['instruction-sets', 'default', 'show']], usage: 'orizu instructions default show <set> --project <team/project> [--json]', summary: 'Show the Default Profile and its Production state.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions default show planner --project core/evals'] },
   { path: ['instructions', 'default', 'move'], aliases: [['instruction-sets', 'default', 'move']], usage: 'orizu instructions default move <set> --project <team/project> --model-config <identity> [--json]', summary: 'Move the instruction-set Default to a Profile.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--model-config <identity>', help: 'Target Profile identity.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions default move planner --project core/evals --model-config anthropic/claude-haiku'] },
-  { path: ['instructions', 'shape', 'add'], aliases: [['instruction-sets', 'shape', 'add']], usage: 'orizu instructions shape add <set> --project <team/project> --key <key> --from <manifest> [--json]', summary: 'Add one component key to every instruction-set profile.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--key <key>', help: 'Component key to add.', required: true }, { name: '--from <manifest>', help: 'Manifest containing the component body.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions shape add planner --project core/evals --key skill --from planner.json'] },
-  { path: ['instructions', 'shape', 'remove'], aliases: [['instruction-sets', 'shape', 'remove']], usage: 'orizu instructions shape remove <set> --project <team/project> --key <key> [--json]', summary: 'Remove one component key from every instruction-set profile.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--key <key>', help: 'Component key to remove.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions shape remove planner --project core/evals --key skill'] },
+  { path: ['instructions', 'shape', 'add'], aliases: [['instruction-sets', 'shape', 'add']], usage: 'orizu instructions shape add <set> --project <team/project> --key <key> --from <manifest> [--json]', summary: 'Add a component before first promotion; a frozen shape requires a new instruction set.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--key <key>', help: 'Component key to add.', required: true }, { name: '--from <manifest>', help: 'Manifest containing the component body.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions shape add planner --project core/evals --key skill --from planner.json'] },
+  { path: ['instructions', 'shape', 'remove'], aliases: [['instruction-sets', 'shape', 'remove']], usage: 'orizu instructions shape remove <set> --project <team/project> --key <key> [--json]', summary: 'Remove a component before first promotion; a frozen shape requires a new instruction set.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--key <key>', help: 'Component key to remove.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions shape remove planner --project core/evals --key skill'] },
   {
     path: ['instructions', 'sync'],
     aliases: [['instruction-sets', 'sync']],
@@ -742,7 +742,7 @@ export const COMMAND_DOCS: CliCommandDoc[] = [
   },
   {
     path: ['apps', 'create'],
-    usage: 'orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]',
+    usage: 'orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>] [--id <app-id>]',
     summary: 'Create a review app from a local component and schema files.',
     group: 'Apps',
     examples: [

package/src/hosted-boot.ts

@@ -34,6 +34,7 @@ import { spawnSync } from 'child_process'
 import { closeSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeSync } from 'fs'
 
 import { isValidCloudflareArtifactsGitRemote } from './cloudflare-artifacts-git-remote.js'
+import { seedSessionCopy } from './hosted-session-seed.js'
 import {
   AGENT_GIT_IDENTITY,
   BEARER_BASENAME,
@@ -681,6 +682,30 @@ export async function beginRunExecution(opts: {
   throw new Error(`run_started transition failed: ${detail}`)
 }
 
+/** Mint a `team_read` key (ORI-2280 B1) to learn this session's team copy, so
+ *  the boot can fill an empty session copy from it (ORI-2118). The credential
+ *  helper mints its own keys for the git commands; this one only names the
+ *  remote and lapses on its own (300 s). */
+export async function resolveTeamRemote(opts: {
+  baseUrl: string
+  workspaceId: string
+  sessionId: string
+  bearer: string
+  fetchImpl: BootFetch
+}): Promise<string> {
+  const url = `${opts.baseUrl}/api/cli/workspaces/${encodeURIComponent(opts.workspaceId)}/repo-token`
+  const minted = await bearerJson(opts.fetchImpl, url, opts.bearer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ purpose: 'team_read', sessionId: opts.sessionId }),
+  })
+  const remote = asString(minted.remote)
+  if (asString(minted.provider) !== 'cloudflare_artifacts' || !remote || !isValidCloudflareArtifactsGitRemote(remote)) {
+    throw new Error('team_read response carried no valid Artifacts remote')
+  }
+  return remote
+}
+
 /** Mint a session_read repo token to learn the repo full name, then build the
  *  GitHub clone URL (mirrors the operator path's `defaultResolveRepo`). */
 export async function resolveRepo(opts: {
@@ -740,6 +765,10 @@ export interface BootExecResult {
 }
 export type BootExec = (cmd: string, args: string[], opts?: { cwd?: string }) => BootExecResult
 
+/** The credential-helper context for the team copy, used only to fill an
+ *  empty session copy (ORI-2118). */
+const TEAM_BOOT_CONTEXT_BASENAME = 'boot-team.json'
+
 const defaultExec: BootExec = (cmd, args, opts) => {
   const res = spawnSync(cmd, args, { cwd: opts?.cwd, encoding: 'utf8' })
   return { status: res.status ?? 1, stdout: res.stdout ?? '', stderr: res.stderr ?? '' }
@@ -1037,9 +1066,35 @@ export async function runHostedBoot(opts: RunHostedBootOptions): Promise<HostedB
   }
   writeFile(bootContextAbs, serializeBootContext(bootContext))
 
+  const helperValue = `!node ${helperScriptAbs} ${bootContextAbs}`
+
+  // 4b — ORI-2118: a hosted session's Artifacts copy is created empty (forks
+  // of a busy team copy cannot be cloned), so fill it from the team copy
+  // before the first clone. A copy that already has `main` is left alone.
+  if (isValidCloudflareArtifactsGitRemote(repo.cloneUrl)) {
+    const credentialConfig = (helper: string) => [`credential.helper=${helper}`, 'credential.useHttpPath=true']
+    await seedSessionCopy({
+      exec,
+      sessionRemote: repo.cloneUrl,
+      sessionGitConfig: credentialConfig(helperValue),
+      scratchDir: `${sessionDirAbs}/seed.git`,
+      resolveTeam: async () => {
+        const teamRemote = await resolveTeamRemote({ baseUrl: env.baseUrl, workspaceId, sessionId: env.sessionId, bearer: bearer.token, fetchImpl })
+        assertSafeGitValue('teamRemote', teamRemote)
+        const teamContextAbs = `${sessionDirAbs}/${TEAM_BOOT_CONTEXT_BASENAME}`
+        writeFile(teamContextAbs, serializeBootContext({
+          ...bootContext,
+          repoFullName: teamRemote,
+          host: new URL(teamRemote).host.toLowerCase(),
+          tokenPurposes: { primary: 'team_read', fallback: 'team_read' },
+        }))
+        return { remote: teamRemote, gitConfig: credentialConfig(`!node ${helperScriptAbs} ${teamContextAbs}`) }
+      },
+    })
+  }
+
   // 5 — Clone the session branch VIA the pull-mode credential helper (same
   // invocation the operator path makes; no token in the URL/config).
-  const helperValue = `!node ${helperScriptAbs} ${bootContextAbs}`
   const clone = exec('git', [
     'clone',
     '--depth',

package/src/hosted-session-cli.ts

@@ -59,6 +59,7 @@ import { DEFAULT_HOSTED_MODEL, hostedLoopCommand, type HostedLoopContext } from
 import { hostedBootCommand } from './hosted-boot.js'
 import { mergeJobCommand } from './merge-job.js'
 import { workspaceBootstrapJobCommand } from './workspace-bootstrap-job.js'
+import { publishMergeJobCommand } from './publish-merge-job.js'
 import { hostedOptimizationCommand } from './hosted-optimization.js'
 import { writeChildStderr } from './child-output-tee.js'
 import { skilledProposerBakeCommand } from './skilled-proposer-launch.js'
@@ -1557,12 +1558,16 @@ export async function hostedCommand(
     if (positional[1] === 'workspace-bootstrap-job') {
       return workspaceBootstrapJobCommand(args, io)
     }
+    // ORI-2280: the one-shot publish merge (coordinator publish-merge job).
+    if (positional[1] === 'publish-merge-job') {
+      return publishMergeJobCommand(args, io)
+    }
     if (positional[1] === 'hosted-optimization') {
       return hostedOptimizationCommand({ ...io, printErr: writeChildStderr })
     }
     if (positional[1] === 'bake-skilled-proposer-venv') return skilledProposerBakeCommand(io)
     if (positional[1] === 'verify-skilled-proposer-bake') return skilledProposerBakeCommand(io, true)
-    io.printErr?.('Usage: orizu internal <hosted-loop --context <path> | hosted-boot | hosted-optimization | merge-job | workspace-bootstrap-job | bake-skilled-proposer-venv | verify-skilled-proposer-bake>')
+    io.printErr?.('Usage: orizu internal <hosted-loop --context <path> | hosted-boot | hosted-optimization | merge-job | workspace-bootstrap-job | publish-merge-job | bake-skilled-proposer-venv | verify-skilled-proposer-bake>')
     return 1
   }
 

package/src/hosted-session-seed.ts

@@ -0,0 +1,78 @@
+/**
+ * Fills an empty hosted session copy from its team copy (ORI-2118).
+ *
+ * Artifacts forks of a team copy whose history has a few file-adding commits
+ * cannot be cloned or pushed to (measured 2026-10-03, binding and REST). The
+ * broker therefore creates the session copy EMPTY, and the sandbox boot fills
+ * it here before its first clone: a bare clone of the team copy's `main`, then
+ * a push of that `main` into the session copy. A Worker cannot run git, so
+ * this is the first place in session start that can.
+ *
+ * It fills a copy only when the copy has no branches at all, which is what a
+ * freshly created copy looks like. A retried or resumed boot finds `main` and
+ * does nothing, so it never overwrites the agent's work, and a working
+ * repository whose content lives on another branch is never touched. The
+ * push is never forced; if another boot filled the copy first, that is fine.
+ * Credentials come only through the `-c` settings the caller passes (the
+ * boot's credential helper), never in a URL or argument.
+ */
+
+export const SESSION_COPY_SEED_FAILURE = 'session copy could not be filled from the team copy'
+
+interface SeedExecResult {
+  status: number
+  stdout: string
+  stderr: string
+}
+type SeedExec = (cmd: string, args: string[], opts?: { cwd?: string }) => SeedExecResult
+
+export interface SeedSessionCopyInput {
+  exec: SeedExec
+  sessionRemote: string
+  /** `git -c` settings that authenticate to the session copy. */
+  sessionGitConfig: string[]
+  /** Called only when the copy is empty: the team copy and its `-c` settings. */
+  resolveTeam: () => Promise<{ remote: string; gitConfig: string[] }>
+  /** A path owned only by this seed operation; cleared before and after use. */
+  scratchDir: string
+}
+
+function withConfig(config: string[]): string[] {
+  return config.flatMap(setting => ['-c', setting])
+}
+
+function failure(step: string, result: SeedExecResult): Error {
+  const detail = (result.stderr || result.stdout || `exit ${result.status}`).trim()
+  return new Error(`${SESSION_COPY_SEED_FAILURE}: ${step}: ${detail}`)
+}
+
+/** Whether the session copy has any branch. Measured on Artifacts: an empty
+ *  repository answers `ls-remote` with exit 0 and no output. Any non-zero
+ *  exit is an error, never "empty". */
+function sessionHasBranches(input: SeedSessionCopyInput): boolean {
+  const listed = input.exec('git', [...withConfig(input.sessionGitConfig), 'ls-remote', '--heads', input.sessionRemote])
+  if (listed.status !== 0) throw failure('reading the session copy', listed)
+  return listed.stdout.trim().length > 0
+}
+
+export async function seedSessionCopy(input: SeedSessionCopyInput): Promise<{ seeded: boolean }> {
+  if (sessionHasBranches(input)) return { seeded: false }
+  const team = await input.resolveTeam()
+  try {
+    // A sandbox shutdown can interrupt clone before finally runs. This path
+    // belongs only to seeding; never clear the surrounding session directory.
+    const cleared = input.exec('rm', ['-rf', '--', input.scratchDir])
+    if (cleared.status !== 0) throw failure('clearing the seed scratch', cleared)
+    const fetched = input.exec('git', [...withConfig(team.gitConfig), 'clone', '--quiet', '--bare', '--single-branch', '--branch', 'main', team.remote, input.scratchDir])
+    if (fetched.status !== 0) throw failure('reading the team copy', fetched)
+    const pushed = input.exec('git', ['-C', input.scratchDir, ...withConfig(input.sessionGitConfig), 'push', '--quiet', input.sessionRemote, 'refs/heads/main:refs/heads/main'])
+    if (pushed.status !== 0) {
+      // Another boot of the same session may have filled it first.
+      if (sessionHasBranches(input)) return { seeded: false }
+      throw failure('pushing into the session copy', pushed)
+    }
+    return { seeded: true }
+  } finally {
+    input.exec('rm', ['-rf', '--', input.scratchDir])
+  }
+}

package/src/jsonl-stream.ts

@@ -5,6 +5,7 @@ export const JSONL_UPLOAD_CHUNK_MAX_BYTES = 2 * 1024 * 1024
 
 interface JsonlChunkOptions {
   maxPayloadBytes?: number
+  signal?: AbortSignal
 }
 
 interface PendingRow {
@@ -66,11 +67,17 @@ export async function* streamJsonlRowChunks(
   let parsedRowCount = 0
   let lineNumber = 0
 
+  if (options.signal?.aborted) throw new Error('Dataset input interrupted')
+
   const stream = createReadStream(filePath, { encoding: 'utf8' })
   const lines = createInterface({
     input: stream,
     crlfDelay: Infinity,
   })
+  // Closing the owned reader unblocks an outstanding next() before a scoped
+  // caller awaits return(); return alone would queue behind that pending read.
+  const interrupt = () => { lines.close(); stream.destroy() }
+  options.signal?.addEventListener('abort', interrupt, { once: true })
 
   try {
     for await (const line of lines) {
@@ -117,6 +124,7 @@ export async function* streamJsonlRowChunks(
   } catch (error) {
     throw mapReadError(filePath, error)
   } finally {
+    options.signal?.removeEventListener('abort', interrupt)
     lines.close()
     stream.destroy()
   }

package/src/provider-list-workflow.ts

@@ -0,0 +1,108 @@
+import { Context, Effect, Result, Schema } from 'effect'
+
+import { authedFetch } from './http.js'
+import { providerWireRecord as record } from './provider-wire-record.js'
+import { isProviderRefusalCode } from './provider-refusals.js'
+
+import type { ModelConfigsCommandIo } from './model-configs-cli.js'
+
+type ProviderListFailure =
+  | { readonly _tag: 'Http'; readonly message: string }
+  | { readonly _tag: 'Transport' }
+  | { readonly _tag: 'Resolution'; readonly message: string }
+  | { readonly _tag: 'Adapter'; readonly message: string }
+
+function providerListFailureMessage(failure: ProviderListFailure): string {
+  switch (failure._tag) {
+    case 'Http': return failure.message
+    case 'Transport': return 'Provider request failed'
+    // Project selection remains the existing, separately owned adapter.
+    case 'Resolution': case 'Adapter': return failure.message
+    default: { const exhaustive: never = failure; return exhaustive }
+  }
+}
+
+const ProviderListTransport = Context.Service<{
+  readonly read: (project: string) => Effect.Effect<Response, ProviderListFailure>
+}>('orizu/cli/ProviderListTransport')
+
+const WireRecord = Schema.Record(Schema.String, Schema.Unknown)
+const emptyWireRecord: Record<string, unknown> = {}
+
+function providerListProgram(project: string, io: ModelConfigsCommandIo) {
+  return Effect.gen(function*() {
+    const transport = yield* ProviderListTransport
+    const response = yield* transport.read(project)
+    // Decode raw wire data; malformed JSON and non-record bodies retain the
+    // existing empty record fallback without narrowing accepted record fields.
+    const value = yield* Effect.promise(() => response.json().catch(() => null))
+    const body = yield* Schema.decodeUnknownEffect(WireRecord)(value).pipe(
+      Effect.catch(() => Effect.succeed(emptyWireRecord)),
+    )
+    if (!response.ok) {
+      const message = typeof body.error === 'string' && isProviderRefusalCode(body.error) ? body.error : 'Provider request failed'
+      return yield* Effect.fail<ProviderListFailure>({ _tag: 'Http', message })
+    }
+    yield* Effect.sync(() => {
+      if (io.json) io.print(JSON.stringify(body))
+      else {
+        io.print('ID  PROTOCOL  HOST  CREDENTIAL ENV  BUILT-IN')
+        for (const value of Array.isArray(body.providers) ? body.providers : []) {
+          const row = record(value)
+          io.print(`${row.id}  ${row.protocol}  ${row.host}  ${row.credentialEnv}  ${row.builtIn ? 'yes' : 'no'}`)
+        }
+      }
+    })
+  })
+}
+
+export async function listProviders(projectArg: string | null, io: ModelConfigsCommandIo): Promise<number> {
+  const controller = new AbortController()
+  let interrupted: 130 | 143 | undefined
+  const interrupt = () => { interrupted = 130; controller.abort() }
+  const terminate = () => { interrupted = 143; controller.abort() }
+  const transport = {
+    read: (project: string) => Effect.tryPromise({
+      try: signal => (io.fetcher ?? authedFetch)(`/api/cli/providers?project=${encodeURIComponent(project)}`, {
+        method: 'GET', signal: AbortSignal.any([signal, controller.signal]),
+      }),
+      // The retained HTTP adapter exposes login/config/refresh diagnostics as
+      // untyped Error values. Preserve its public messages until ORI-2420
+      // supplies typed adapter failures; never expose nested transport causes.
+      catch: (cause): ProviderListFailure => cause instanceof Error
+        ? { _tag: 'Adapter', message: cause.message }
+        : { _tag: 'Transport' },
+    }),
+  }
+  const program = Effect.gen(function*() {
+    const project = yield* Effect.tryPromise({
+      try: async () => {
+        const project = await io.resolveProjectSlug?.(projectArg)
+        if (!project) throw new Error('Project resolver unavailable')
+        return project
+      },
+      catch: (cause): ProviderListFailure => ({ _tag: 'Resolution', message: cause instanceof Error ? cause.message : 'Provider request failed' }),
+    })
+    // The retained resolver is unsignalled. Do not suppress Node's natural
+    // termination until the cancellable catalog transport has been admitted.
+    return yield* Effect.acquireUseRelease(
+      Effect.sync(() => { process.once('SIGINT', interrupt); process.once('SIGTERM', terminate) }),
+      () => providerListProgram(project, io).pipe(Effect.provideService(ProviderListTransport, transport)),
+      () => Effect.sync(() => {
+        process.removeListener('SIGINT', interrupt)
+        process.removeListener('SIGTERM', terminate)
+      }),
+    )
+  })
+  try {
+    const result = await Effect.runPromise(Effect.result(program), { signal: controller.signal })
+    if (Result.isSuccess(result)) return 0
+    const message = providerListFailureMessage(result.failure)
+    io.print(io.json ? JSON.stringify({ error: message }) : message)
+    return 1
+  } catch {
+    if (interrupted !== undefined) return interrupted
+    io.print(io.json ? JSON.stringify({ error: 'Provider request failed' }) : 'Provider request failed')
+    return 1
+  }
+}