orizu 0.5.38 → 0.5.39

package/src/provider-wire-record.ts

@@ -0,0 +1,4 @@
+/** Preserve the provider commands' permissive ordinary-TypeScript row coercion. */
+export function providerWireRecord(value: unknown): Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {}
+}

package/src/providers-cli.ts

@@ -1,4 +1,5 @@
 import { authedFetch } from './http.js'
+import { providerWireRecord as object } from './provider-wire-record.js'
 import { credentialEnvFor, providerLookupFor } from './provider-lookup.js'
 import { CREDENTIAL_ENV_PATTERN, PROVIDER_FIELD_PATTERNS, RESERVED_CREDENTIAL_ENVS, isProviderRefusalCode } from './provider-refusals.js'
 import { findProvider, parseModelIdentity } from './provider-registry.js'
@@ -8,9 +9,6 @@ import type { ModelConfigsCommandIo } from './model-configs-cli.js'
 import type { ProviderEntry, WireProtocol } from './provider-registry.js'
 
 const FIELD_CONTRACT = 'Anthropic Messages base URL excludes /v1; OpenAI base URLs include the version segment.'
-function object(value: unknown): Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {}
-}
 function assertProtocol(value: unknown): asserts value is WireProtocol {
   if (typeof value !== 'string' || !Object.hasOwn(PROBE_PROTOCOLS, value)) throw new Error('provider_protocol_invalid')
 }
@@ -89,6 +87,10 @@ export async function providersCommand(args: string[], io: ModelConfigsCommandIo
       baseUrl = baseUrl.replace(/^(https:\/\/)([^/]+)/, (_, scheme: string, host: string) => scheme + host.toLowerCase())
       provider = providerRow({ id, baseUrl, protocol: flags.get('--protocol') ?? 'openai-chat', credentialEnv: flags.get('--credential-env') ?? credentialEnvFor(id), authHeader: flags.get('--auth-header') ?? 'Authorization', authValuePrefix: flags.get('--auth-value-prefix') ?? 'Bearer ' })
     }
+    if (checkIdentity === undefined && command === 'list' && positional.length === 1) {
+      const { listProviders } = await import('./provider-list-workflow.js')
+      return listProviders(flags.get('--project') || null, io)
+    }
     const project = await io.resolveProjectSlug?.(flags.get('--project') || null)
     if (!project) throw new Error('Project resolver unavailable')
     const fetcher = io.fetcher ?? authedFetch
@@ -116,16 +118,6 @@ export async function providersCommand(args: string[], io: ModelConfigsCommandIo
       const entry = lookup.find(identity.provider)
       if (!entry) throw new Error('provider_not_found')
       await runProbe(entry, identity.modelId, io)
-    } else if (command === 'list' && positional.length === 1) {
-      const body = await request(root, { method: 'GET' })
-      if (io.json) io.print(JSON.stringify(body))
-      else {
-        io.print('ID  PROTOCOL  HOST  CREDENTIAL ENV  BUILT-IN')
-        for (const value of Array.isArray(body.providers) ? body.providers : []) {
-          const row = object(value)
-          io.print(`${row.id}  ${row.protocol}  ${row.host}  ${row.credentialEnv}  ${row.builtIn ? 'yes' : 'no'}`)
-        }
-      }
     } else if (command === 'remove' && id && positional.length === 2) {
       await request(`/api/cli/providers/${encodeURIComponent(id)}?project=${encodeURIComponent(project)}`, { method: 'DELETE' })
       io.print(io.json ? JSON.stringify({ removed: id }) : `Removed provider ${id}`)

package/src/publish-merge-job.ts

@@ -0,0 +1,350 @@
+/** ORI-2280: the agent-free publish merge one-shot. The coordinator runs it
+ * in a sandbox with network access to Artifacts only. It merges one session
+ * copy into its team copy with `publishSessionMerge`, getting one scoped key
+ * at a time from the web app and revoking every key before it reports. */
+import { execFile } from 'node:child_process'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+
+import { createEphemeralAskPass, type GitAuth } from './artifacts-git-runtime.js'
+import { publishSessionMerge, type PublishSessionMergeResult } from './artifacts-session-merge.js'
+import { CLOUDFLARE_ARTIFACTS_HOST_PATTERN } from './cloudflare-artifacts-git-remote.js'
+import { assertSecureTokenTransport } from './http.js'
+import { assertWorkspaceBootstrapRemote, isLoopbackOrigin } from './workspace-bootstrap-job.js'
+import {
+  PUBLISH_MERGE_CONFLICT_FILES_LIMIT,
+  PUBLISH_MERGE_CONFLICT_PATH_MAX,
+  PUBLISH_MERGE_COORDINATOR_WALL_MS,
+  PUBLISH_MERGE_WALL_AT_ENV,
+  type PublishMergeJobFailureCode,
+} from './publish-merge-timing.js'
+import { DEFAULT_REPOSITORY_BACKUP_LIMITS } from './repository-backup-core.js'
+
+const PUBLISH_MERGE_JOB_CAPABILITY = 'publish-merge-job:v1'
+/** Timing. The job's wall is the earlier of:
+ *  - ORIZU_PUBLISH_MERGE_WALL_AT, when set: the epoch-ms moment the
+ *    coordinator stops the sandbox (its createdAt + 120 s, so sandbox create
+ *    and CLI boot are already counted);
+ *  - 110 s from the job's own start, the fallback when it is not set.
+ * Within it:
+ *  - the merge ends by 90 s from start, and always 10 s before the wall;
+ *  - revoking the keys still live ends 10 s before the wall, each call at
+ *    most 15 s or whatever is left;
+ *  - the last 10 s are kept for posting the result, so it always goes out.
+ * All of this is well below the read keys' five-minute life, so no key is
+ * ever renewed. */
+const JOB_DEADLINE_MS = 90_000
+const RESULT_RESERVE_MS = 10_000
+const JOB_WALL_MS = PUBLISH_MERGE_COORDINATOR_WALL_MS - RESULT_RESERVE_MS
+const LATE_CALL_TIMEOUT_MS = 15_000
+const GIT_TIMEOUT_MS = 60_000
+/** ADR-012's envelope for a repository's whole object graph. The graph is
+ * always larger than the content it was seeded from, so ADR-011's 1 GiB
+ * content limit is not the measure here. */
+const ADMISSION = {
+  totalBytes: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxObjectBytes,
+  objectBytes: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxSingleObjectBytes,
+  objects: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxObjects,
+  commits: DEFAULT_REPOSITORY_BACKUP_LIMITS.maxCommits,
+}
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+const IDENTITY = {
+  GIT_AUTHOR_NAME: 'Orizu',
+  GIT_AUTHOR_EMAIL: 'publish@orizu.invalid',
+  GIT_COMMITTER_NAME: 'Orizu',
+  GIT_COMMITTER_EMAIL: 'publish@orizu.invalid',
+}
+
+interface PublishMergeJobEnv {
+  bootSecret: string
+  jobId: string
+  coordinatorUrl: string
+  baseUrl: string
+  /** The Artifacts git host the coordinator expects; localhost only in tests. */
+  expectedGitHost: string
+  /** The coordinator's wall, epoch ms; see the timing note above. */
+  wallAt?: number
+}
+
+export type PublishMergeJobOutcome =
+  | { outcome: 'merged'; mergeSha: string }
+  | { outcome: 'already_merged'; headSha: string }
+  /** At most PUBLISH_MERGE_CONFLICT_FILES_LIMIT paths; `moreFiles` counts the rest. */
+  | { outcome: 'conflict'; files: readonly string[]; moreFiles: number }
+  | { outcome: 'denied' }
+  | { outcome: 'race_lost' }
+  | { outcome: 'failed'; code: PublishMergeJobFailureCode }
+
+interface Credential {
+  tokenId: string
+  plaintext: string
+  remote: string
+}
+
+class JobFailure extends Error {
+  constructor(readonly code: PublishMergeJobFailureCode | 'denied') {
+    super(code)
+  }
+}
+
+function resolvePublishMergeJobEnv(env: Record<string, string | undefined>): PublishMergeJobEnv | string {
+  const value = (name: string) => env[name]?.trim() ?? ''
+  const resolved = {
+    bootSecret: value('ORIZU_BOOT_SECRET'),
+    jobId: value('ORIZU_PUBLISH_MERGE_JOB_ID'),
+    coordinatorUrl: value('ORIZU_COORDINATOR_URL').replace(/\/+$/, ''),
+    baseUrl: value('ORIZU_BASE_URL').replace(/\/+$/, ''),
+    expectedGitHost: value('ORIZU_PUBLISH_MERGE_GIT_HOST').toLowerCase(),
+  }
+  if (Object.values(resolved).some((item) => item.length === 0)) return 'missing required env'
+  const wallAtText = value(PUBLISH_MERGE_WALL_AT_ENV)
+  const wallAt = wallAtText ? Number(wallAtText) : undefined
+  if (wallAt !== undefined && (!/^[0-9]{13}$/.test(wallAtText) || !Number.isSafeInteger(wallAt))) return 'invalid wall deadline'
+  try {
+    assertSecureTokenTransport(resolved.coordinatorUrl)
+    assertSecureTokenTransport(resolved.baseUrl)
+  } catch {
+    return 'insecure coordinator or base URL'
+  }
+  const localGitAllowed = isLoopbackOrigin(resolved.coordinatorUrl) && isLoopbackOrigin(resolved.baseUrl) && resolved.expectedGitHost === 'localhost'
+  if (!UUID_PATTERN.test(resolved.jobId) || (!CLOUDFLARE_ARTIFACTS_HOST_PATTERN.test(resolved.expectedGitHost) && !localGitAllowed)) {
+    return 'invalid job id or git host'
+  }
+  return wallAt === undefined ? resolved : { ...resolved, wallAt }
+}
+
+/** Every remote must be an https repository in the hosted namespace on the expected host. */
+function assertRemote(remote: unknown, expectedGitHost: string): string {
+  try {
+    assertWorkspaceBootstrapRemote(String(remote), expectedGitHost)
+  } catch {
+    throw new JobFailure('scope_refused')
+  }
+  return new URL(String(remote)).toString()
+}
+
+async function post(url: string, bearer: string, body: object, signal?: AbortSignal): Promise<Record<string, unknown>> {
+  let response: Response
+  try {
+    response = await fetch(url, {
+      method: 'POST',
+      redirect: 'error',
+      signal,
+      headers: { authorization: `Bearer ${bearer}`, 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+  } catch {
+    throw new JobFailure(signal?.aborted ? 'job_timed_out' : 'api_unavailable')
+  }
+  const value: unknown = await response.json().catch(() => null)
+  const record = value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : null
+  // The session lost its authority while a key was being minted: a refusal.
+  if (response.status === 403 && record?.error === 'gate_denied') throw new JobFailure('denied')
+  if (response.status === 401 || response.status === 403) throw new JobFailure('scope_refused')
+  if (!response.ok || !record) throw new JobFailure('api_unavailable')
+  return record
+}
+
+/** The permission check's answer, or unavailable for anything else. */
+function gateAllows(value: Record<string, unknown>): boolean {
+  const keys = Object.keys(value).sort().join(',')
+  if (keys === 'allowed' && value.allowed === true) return true
+  if (keys === 'allowed,reason' && value.allowed === false && typeof value.reason === 'string') return false
+  throw new JobFailure('api_unavailable')
+}
+
+/** ADR-012: the team copy is canonical state, so the merged graph must fit
+ * the admission envelope before a write key is asked for. The merge folder
+ * holds exactly both copies' fetched objects and the merge commit. */
+async function assertMergeAdmitted(worktree: string, signal: AbortSignal, narrower: Partial<typeof ADMISSION> = {}): Promise<void> {
+  const { stdout } = await promisify(execFile)(
+    'git',
+    ['cat-file', '--batch-all-objects', '--batch-check=%(objecttype) %(objectsize)'],
+    { cwd: worktree, maxBuffer: 64 * 1024 * 1024, signal }
+  )
+  if (!isMergeInventoryAdmitted(stdout, narrower)) throw new JobFailure('admission_refused')
+}
+
+/** One `<type> <size>` line per object, as `git cat-file --batch-check` prints them. */
+export function isMergeInventoryAdmitted(inventory: string, narrower: Partial<typeof ADMISSION> = {}): boolean {
+  const limits = Object.fromEntries(
+    Object.entries(ADMISSION).map(([key, max]) => [key, Math.min(max, narrower[key as keyof typeof ADMISSION] ?? max)])
+  ) as typeof ADMISSION
+  let totalBytes = 0
+  let objects = 0
+  let commits = 0
+  for (const line of inventory.split('\n')) {
+    if (!line) continue
+    const [type, size] = line.split(' ')
+    const bytes = Number(size)
+    objects += 1
+    totalBytes += bytes
+    if (type === 'commit') commits += 1
+    if (!Number.isSafeInteger(bytes) || bytes > limits.objectBytes) return false
+  }
+  return totalBytes <= limits.totalBytes && objects <= limits.objects && commits <= limits.commits
+}
+
+/** A post with its own time limit. An AbortController and timer, as for the
+ * deadline: AbortSignal.timeout did not fire inside the job under bun test. */
+async function postWithin(timeoutMs: number, url: string, bearer: string, body: object): Promise<Record<string, unknown>> {
+  const stop = new AbortController()
+  const timer = setTimeout(() => stop.abort(), timeoutMs)
+  try {
+    return await post(url, bearer, body, stop.signal)
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** The conflict list the job reports, bounded so the result always fits the
+ * coordinator's body limit. A path too long to name is counted instead. */
+export function boundConflictFiles(files: readonly string[]): { files: string[]; moreFiles: number } {
+  const named = files.filter((file) => file.length <= PUBLISH_MERGE_CONFLICT_PATH_MAX).slice(0, PUBLISH_MERGE_CONFLICT_FILES_LIMIT)
+  return { files: named, moreFiles: files.length - named.length }
+}
+
+function toOutcome(result: PublishSessionMergeResult): PublishMergeJobOutcome {
+  switch (result.kind) {
+    case 'merged':
+      return { outcome: 'merged', mergeSha: result.mergeSha }
+    case 'already_merged':
+      return { outcome: 'already_merged', headSha: result.canonicalSha }
+    case 'conflict':
+      return { outcome: 'conflict', ...boundConflictFiles(result.files) }
+    case 'denied':
+      return { outcome: 'denied' }
+    case 'race_lost':
+      return { outcome: 'race_lost' }
+  }
+}
+
+export async function runPublishMergeJob(options: {
+  env: PublishMergeJobEnv
+  deadlineMs?: number
+  /** Narrower admission limits; tests only. Never wider than ADMISSION. */
+  admission?: Partial<typeof ADMISSION>
+  /** Shorter timing; tests only. Each is clamped to its production value. */
+  timing?: { resultReserveMs?: number; lateCallMs?: number }
+}): Promise<{ reported: boolean; outcome: PublishMergeJobOutcome }> {
+  const { env } = options
+  const startedAt = Date.now()
+  const wallEnd = Math.min(startedAt + JOB_WALL_MS, env.wallAt ?? Number.POSITIVE_INFINITY)
+  const reserveMs = Math.min(options.timing?.resultReserveMs ?? RESULT_RESERVE_MS, RESULT_RESERVE_MS)
+  const lateCallMs = Math.min(options.timing?.lateCallMs ?? LATE_CALL_TIMEOUT_MS, LATE_CALL_TIMEOUT_MS)
+  const stop = new AbortController()
+  const timer = setTimeout(() => stop.abort(), Math.max(0, Math.min(options.deadlineMs ?? JOB_DEADLINE_MS, wallEnd - reserveMs - startedAt)))
+  const deadline = stop.signal
+  const api = (action: string) => `${env.baseUrl}/api/internal/publish-merge/${env.jobId}/${action}`
+  const issued: Array<{ target: 'session' | 'team'; tokenId: string }> = []
+  let jobToken = ''
+  /** A late call's bound: its own limit, or the time left before the last `keepMs` of the wall. */
+  const lateBound = (keepMs: number) => Math.min(lateCallMs, wallEnd - keepMs - Date.now())
+  const revokeCall = async (target: 'session' | 'team', tokenId: string) => {
+    const bound = lateBound(reserveMs)
+    if (bound <= 0) throw new JobFailure('credentials_pending')
+    return postWithin(bound, api('revoke'), jobToken, { target, tokenId })
+  }
+  let outcome: PublishMergeJobOutcome
+  const root = await mkdtemp(join(tmpdir(), 'orizu-publish-merge-'))
+  try {
+    const askPass = await createEphemeralAskPass(root)
+    const claimed = await post(`${env.coordinatorUrl}/publish-merge-jobs/${env.jobId}/claim`, env.bootSecret, {}, deadline)
+    if (typeof claimed.jobToken !== 'string' || !claimed.jobToken) throw new JobFailure('scope_refused')
+    jobToken = claimed.jobToken
+    const spec = await post(api('spec'), jobToken, {}, deadline)
+    const sessionRemote = assertRemote((spec.session as { remote?: unknown } | undefined)?.remote, env.expectedGitHost)
+    if (spec.jobId !== env.jobId || typeof spec.sessionCommitSha !== 'string' || spec.ref !== 'refs/heads/main' || typeof spec.commitMessage !== 'string') {
+      throw new JobFailure('scope_refused')
+    }
+    const mint = async (target: 'session' | 'team', scope: 'read' | 'write'): Promise<Credential> => {
+      const value = await post(api('credential'), jobToken, { target, scope }, deadline)
+      if (typeof value.tokenId !== 'string' || typeof value.plaintext !== 'string') throw new JobFailure('scope_refused')
+      issued.push({ target, tokenId: value.tokenId })
+      return { tokenId: value.tokenId, plaintext: value.plaintext, remote: assertRemote(value.remote, env.expectedGitHost) }
+    }
+    const revoke = async (target: 'session' | 'team', tokenId: string) => {
+      const value = await revokeCall(target, tokenId)
+      if (value.revoked !== true) throw new JobFailure('credentials_pending')
+      issued.splice(issued.findIndex((item) => item.tokenId === tokenId), 1)
+    }
+    const auth = (credential: Credential): GitAuth => ({ askPassPath: askPass.path, token: credential.plaintext })
+
+    const sessionRead = await mint('session', 'read')
+    if (sessionRead.remote !== sessionRemote) throw new JobFailure('scope_refused')
+    const teamRead = await mint('team', 'read')
+    const result = await publishSessionMerge({
+      root,
+      canonical: { remote: teamRead.remote, auth: auth(teamRead) },
+      source: { remote: sessionRemote, auth: auth(sessionRead) },
+      canonicalRef: 'refs/heads/main',
+      sourceRef: 'refs/heads/main',
+      expectedSourceSha: spec.sessionCommitSha,
+      commitMessage: spec.commitMessage,
+      commitIdentityEnv: IDENTITY,
+      authorize: async (merge) => {
+        await assertMergeAdmitted(merge.worktree, deadline, options.admission)
+        return gateAllows(await post(api('gate'), jobToken, {}, deadline))
+      },
+      withCanonicalWrite: async (push) => {
+        const write = await mint('team', 'write')
+        if (write.remote !== teamRead.remote) throw new JobFailure('scope_refused')
+        try {
+          return await push(auth(write))
+        } finally {
+          await revoke('team', write.tokenId)
+        }
+      },
+      timeoutMs: GIT_TIMEOUT_MS,
+      signal: deadline,
+    })
+    outcome = toOutcome(result)
+  } catch (error) {
+    if (error instanceof JobFailure && error.code === 'denied') outcome = { outcome: 'denied' }
+    else if (deadline.aborted) outcome = { outcome: 'failed', code: 'job_timed_out' }
+    else outcome = { outcome: 'failed', code: error instanceof JobFailure && error.code !== 'denied' ? error.code : 'publish_failed' }
+  } finally {
+    clearTimeout(timer)
+    // Revoke whatever is still live, newest first, even past the deadline; an
+    // unrevoked key wins over the merge outcome because its authority is then uncertain.
+    for (const { target, tokenId } of [...issued].reverse()) {
+      try {
+        const value = await revokeCall(target, tokenId)
+        if (value.revoked !== true) throw new JobFailure('credentials_pending')
+      } catch {
+        outcome = { outcome: 'failed', code: 'credentials_pending' }
+      }
+    }
+    await rm(root, { recursive: true, force: true })
+  }
+  let reported = false
+  try {
+    const bound = lateBound(0)
+    if (bound <= 0) throw new JobFailure('job_timed_out')
+    await postWithin(bound, `${env.coordinatorUrl}/publish-merge-jobs/${env.jobId}/result`, env.bootSecret, outcome)
+    reported = true
+  } catch {
+    reported = false
+  }
+  return { reported, outcome }
+}
+
+export async function publishMergeJobCommand(
+  args: readonly string[],
+  io: { print: (line: string) => void; printErr?: (line: string) => void }
+): Promise<number> {
+  if (args.includes('--capability-check')) {
+    io.print(PUBLISH_MERGE_JOB_CAPABILITY)
+    return 0
+  }
+  const env = resolvePublishMergeJobEnv(process.env)
+  if (typeof env === 'string') {
+    io.printErr?.(`publish-merge-job: ${env}`)
+    return 1
+  }
+  const result = await runPublishMergeJob({ env })
+  io.print(JSON.stringify(result.outcome))
+  return result.reported ? 0 : 1
+}

package/src/publish-merge-timing.ts

@@ -0,0 +1,27 @@
+/** ORI-2280: the publish merge job's wall, shared by the coordinator, which
+ * stops the sandbox at it, and the CLI job, which must report before it. No
+ * Node or Worker imports: both sides compile this file. */
+
+/** From the coordinator creating the job to it stopping the sandbox. */
+export const PUBLISH_MERGE_COORDINATOR_WALL_MS = 2 * 60 * 1000
+/** The coordinator sets this on the sandbox to `createdAt + PUBLISH_MERGE_COORDINATOR_WALL_MS`, in epoch milliseconds. */
+export const PUBLISH_MERGE_WALL_AT_ENV = 'ORIZU_PUBLISH_MERGE_WALL_AT'
+
+/** A conflict result names at most this many paths, each at most
+ * PUBLISH_MERGE_CONFLICT_PATH_MAX characters, and counts the rest, so the
+ * result always fits the coordinator's result body limit. */
+export const PUBLISH_MERGE_CONFLICT_FILES_LIMIT = 200
+export const PUBLISH_MERGE_CONFLICT_PATH_MAX = 1024
+
+/** The failure codes the sandbox may report. The coordinator's own codes
+ * (`timed_out`, `provider_unavailable`, `snapshot_missing_command`, ...) are
+ * not among them, so a reported failure always says which side saw it. */
+export const PUBLISH_MERGE_JOB_FAILURE_CODES = [
+  'scope_refused',
+  'admission_refused',
+  'credentials_pending',
+  'api_unavailable',
+  'job_timed_out',
+  'publish_failed',
+] as const
+export type PublishMergeJobFailureCode = (typeof PUBLISH_MERGE_JOB_FAILURE_CODES)[number]

package/src/workbench-cli.ts

@@ -45,6 +45,8 @@ export interface WorkbenchRunCosts {
 export interface WorkbenchRunSummary extends WorkbenchRunCosts {
   id: string
   status: string
+  /** Why a failed run failed, in plain words, mapped by the server (ORI-2264). */
+  failureReason?: string
 }
 
 export interface WorkbenchSession {
@@ -76,6 +78,8 @@ export interface WorkbenchRun extends WorkbenchRunCosts {
   status: string
   evidence?: Record<string, unknown>
   summary?: Record<string, unknown>
+  /** Why a failed run failed, in plain words, mapped by the server (ORI-2264). */
+  failureReason?: string
   latestSequence?: number
   startedAt?: string | null
   finishedAt?: string | null
@@ -1130,6 +1134,8 @@ function formatSessionStatus(result: SessionStatusResult): string {
       const cost = finiteOrNull(run.modelCostUsd)
       const suffix = cost !== null ? `  ${formatUsd(cost)}` : ''
       lines.push(`  run ${run.id}  ${run.status}${suffix}`)
+      const why = failedRunLine(run)
+      if (why) lines.push(`    ${why}`)
     }
     return lines.join('\n')
   }
@@ -1167,10 +1173,18 @@ function formatSessionFinishOutcome(result: SessionFinishResult): string {
   return `manifest ${id}  ${status}  repo_merge  (${files} files, +${additions}/-${deletions})`
 }
 
+// The web page's failed line, with the reason the server mapped (ORI-2264).
+function failedRunLine(run: { status: string; failureReason?: unknown }): string | null {
+  return run.status === 'failed' && typeof run.failureReason === 'string' && run.failureReason
+    ? `The agent stopped: ${run.failureReason}.`
+    : null
+}
+
 function formatRunStatus(run: WorkbenchRun): string {
   const sequence = typeof run.latestSequence === 'number' ? `  latestSequence=${run.latestSequence}` : ''
   const costLine = formatCostSummary(run)
-  return `run ${run.id}  ${run.status}${sequence}${costLine ? `\n  ${costLine}` : ''}`
+  const why = failedRunLine(run)
+  return `run ${run.id}  ${run.status}${sequence}${costLine ? `\n  ${costLine}` : ''}${why ? `\n  ${why}` : ''}`
 }
 
 // ALI-1045: one compact digest line per event — shared with the attached

package/src/workspace-bootstrap-job.ts

@@ -114,7 +114,7 @@ function isObject(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value)
 }
 
-function isLoopbackOrigin(value: string): boolean {
+export function isLoopbackOrigin(value: string): boolean {
   try {
     const host = new URL(value).hostname
     return host === 'localhost' || host === '127.0.0.1' || host === '::1'

package/vendor/skills/orizu/flows/onboard.md

@@ -20,7 +20,7 @@ Compare the inventoried surfaces using source metadata only: availability, prove
 
 ## Install and establish the project
 
-After the human chooses Orizu, check whether `orizu` is available and record `orizu --version`. If it is missing, require Node.js 20+ and install the CLI with `npm i -g orizu`. Then run `orizu setup`; verify authentication and runtime with `orizu whoami --json` and `orizu capabilities --json`, and verify the installed skill separately with `orizu skills status --json` (use `orizu skills update` when stale). Use `references/cli-reference.md` for authentication and team/project commands. Follow `references/authority-map.md` for who executes each action. Do not rely on remembered commands.
+After the human chooses Orizu, check that `node --version` is 22 or newer (the CLI requires Node.js 22+), then check whether `orizu` is available and record `orizu --version`. If it is missing, install the CLI with `npm i -g orizu`. Then run `orizu setup`; verify authentication and runtime with `orizu whoami --json` and `orizu capabilities --json`, and verify the installed skill separately with `orizu skills status --json` (use `orizu skills update` when stale). Use `references/cli-reference.md` for authentication and team/project commands. Follow `references/authority-map.md` for who executes each action. Do not rely on remembered commands.
 
 ## Ratify the improvement plan
 

package/vendor/skills/orizu/references/authority-map.md

@@ -8,12 +8,12 @@ This is the single source of truth for who runs each action. Replace placeholder
 | All surfaces | Edit files | Edit and commit source, configs, `App.tsx`, schemas, and local traces under `logs/<run-id>` in the repo working set. | Repo files are not canonical pointer or run state. |
 | Local and hosted agents | Product feedback filing | File product feedback autonomously with `orizu feedback`, using scrubbed narrative and no customer content. | This bounded feedback command is the agent's own authority; no human approval is required. |
 | Local agent under the user's token | Workflow | Survey the customer codebase, resolve state, prepare the plan, files, manifests, diffs, and evidence, then ask the human to ratify the workflow design. | The human moments are plan ratification and execution of all production/default pointer moves. |
-| Local agent under the user's token | Catalog mutations and pointer preparation | After plan ratification, pull instruction material from the customer codebase and run `orizu instructions create <manifest> --project <team/project>`, `orizu instructions push <manifest> --project <team/project> --set <slug-or-exact-name>`, shape add/remove, archive/restore itself under the user's token. For pointer changes, gather only read-only resolution and binding evidence, prepare the exact commands, then hand them off. | Per the Micro-round 3 custody ruling, a human admin or curator using a user token executes every runner default-label move, optimizer-label move, scorer production-label move, profile promote/rollback, default move, and labeled optimization promotion on every surface. |
+| Local agent under the user's token | Catalog mutations and pointer preparation | After plan ratification, pull instruction material from the customer codebase and run `orizu instructions create <manifest> --project <team/project>`, `orizu instructions push <manifest> --project <team/project> --set <slug-or-exact-name>`, shape add/remove before first promotion, archive/restore itself under the user's token. For pointer changes, gather only read-only resolution and binding evidence, prepare the exact commands, then hand them off. | Per the Micro-round 3 custody ruling, a human admin or curator using a user token executes every runner default-label move, optimizer-label move, scorer production-label move, profile promote/rollback, default move, and labeled optimization promotion on every surface. |
 | Hosted session | Start and scope | Use the pre-authenticated CLI from `ORIZU_TOKEN_FILE` and `ORIZU_BASE_URL`; resolve only the session's signed team with `orizu teams list`, then list or create projects only within it. Run `orizu projects create --name "<project name>" --team <signed-team>` when needed. | Team creation is platform-enforced human-only. Hand off: `orizu teams create --name "<team name>"`, then ask the human to start a new hosted session scoped to that team; the current session cannot switch teams. |
 | Hosted session | Team-wide curator work | While the hosted session is active and its kill switch is clear, perform setup plus ordinary curator reads and writes within the signed team. Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>` and `orizu instructions sync <set> --project <team/project> --out <app-root>`; synced material lands under `<app-root>/orizu/`. For git-canonical judges, scorers, runners, and optimizers, write with `--session <session-id>`, keep bytes as commits on the session branch, then verify with `git ls-files <path>` and inspect the commit. | The agent executes this work; an Orizu version id alone is not proof of committed bytes. Signed-project exceptions are in the next row. |
 | Hosted session | Signed-project work | Run optimization mutations only for the JWT's project, keep git-canonical draft writes on that session and project, and read diff comments only for that project. | Sibling-project optimization mutations, draft writes, and diff-comment reads are out of scope even where ordinary curator access is team-wide. |
 | Hosted session | Materialize an instruction set | When the survey finds only a candidate seed, turn it into the complete manifest. | ADR-008 requires a human curator using a local CLI user token. Create/push are hosted CLI route-enforced; direct RPC remains agent-writable and is a fix-forward gap. Hand off `orizu instructions create <manifest> --project <team/project>` for a fresh set, or `orizu instructions push <manifest> --project <team/project> --set <slug-or-exact-name>` for an existing set. Their measured 403 is `Sessionless registration is not available to the hosted agent: this artifact class is git-canonical (ADR-007) and its bytes must be committed to the session branch. Re-run with --session <session-id>.` Neither create nor push accepts `--session`. |
-| Hosted session | Profiles and component shape | Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>`, `orizu instructions shape add <set> --project <team/project> --key <key> --from <manifest>`, and `orizu instructions shape remove <set> --project <team/project> --key <key>` with team-scoped curator authority. Shape changes create unpromoted profile heads and do not move pointers. | A human admin or curator with `can_manage_project` runs every profile promote/rollback, instruction-set default move, and other production/default pointer move. |
+| Hosted session | Profiles and component shape | Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>`, `orizu instructions shape add <set> --project <team/project> --key <key> --from <manifest>`, and `orizu instructions shape remove <set> --project <team/project> --key <key>` with team-scoped curator authority. Shape add/remove works only until the first promotion of any profile, creates unpromoted profile heads, and does not move pointers. First promotion permanently freezes the shape, and sets that existed when this rule shipped are frozen too; a changed frozen shape requires a new instruction set. | A human admin or curator with `can_manage_project` runs every profile promote/rollback, instruction-set default move, and other production/default pointer move. |
 | Hosted session | Instruction-set visibility | Prepare the requested visibility change. | A human admin or curator with `can_manage_project` runs `orizu instructions archive <slug-or-exact-name> --project <team/project>` or `orizu instructions restore <slug-or-exact-name> --project <team/project>`. Hosted CLI route enforcement returns `Agent sessions cannot perform this action`; direct RPC remains agent-writable. |
 | Hosted session | Instruction scorers | Run `orizu instructions scorers set-headline <set> --key <component-key> --scorer-version <id> --project <team/project>` and `orizu instructions scorers add <set> --key <component-key> --scorer-version <id> --project <team/project>`; prepare scorer-pointer evidence. | A human admin or curator with `can_manage_project` runs `orizu scorers labels set <scorer-name> production --version <scorer-version-id> --project <team/project>`. The measured 403 is `Agents cannot move scorer labels; labels are human-only pointers. Propose the label change as a promotion manifest for a human to apply.` |
 | Hosted session | Promotion | After report acceptance, the two-stage path materializes once with unlabeled `orizu optimizations promote <run-id> --candidate <id> --project <team/project>`; hand the exact run id, candidate id, project, and report evidence to the human. | For the staged path, a human admin or curator with `can_manage_project` re-runs the same promotion as `orizu optimizations promote <run-id> --candidate <id> --label production --project <team/project>`. The idempotent finalizer finds the existing version by run and candidate provenance, moves production to that exact materialized version, and creates no duplicate profile version or candidate-promoted event. Equivalent simpler one-shot path: without prior materialization, the human runs the same labeled command once. A human admin or curator also runs `orizu manifests approve <id>`, `orizu manifests reject <id>`, and, after approval, `orizu manifests apply <id>`. |

package/vendor/skills/orizu/references/building-apps.md

@@ -1608,3 +1608,27 @@ Before `orizu apps create`:
 - [ ] `?` shortcut overlay or visible cheat sheet
 - [ ] Smoke test passes (`node scripts/test-app.mjs ...`)
 - [ ] Local preview renders and screenshot is inspected against the user's intended workflow (`orizu apps preview ... --screenshot preview.png`)
+
+---
+
+## Publishing from a hosted session
+
+In a hosted session, `orizu apps create` and `orizu apps update` publish through git. Pass `--file`, `--input-schema` and `--output-schema` as usual; the command then:
+
+1. Copies the three files into `projects/<project-slug>/apps/<app-id>/` in the workspace as `App.tsx`, `input.schema.json` and `output.schema.json`, commits only App.tsx, input.schema.json, and output.schema.json, and pushes the session copy.
+2. Merges the session into the team copy, then records the version. It prints `Merged into the team copy: <sha>` or `Already in the team copy: <sha>`.
+
+Edit an existing app in its folder and pass those files to `apps update`. A new app can live anywhere until `apps create` places it.
+
+The merge includes all earlier committed work on the session branch, including files outside the app folder. Review that work before publishing. Unrelated uncommitted work stays local. A conflict may name files outside the app folder; resolve and commit those files too.
+
+When a hosted `apps create` or `apps update` stops after its folder is known, its error prints `App ID`, `Folder`, and a full `Retry` command. Keep that ID and folder. After all three app files have been written, the retry uses safe canonical files, preserving committed conflict resolutions. If the attempt stops before all three files are written, the retry keeps the original input paths. Both retries preserve the selected server. After following the error's instructions, run the printed retry command; create keeps its original `--id`, and update keeps its `--app`. This also applies when the push is rejected, the API refuses the create, or the merge is still running. The files and commits already made stay in the workspace; a refused push has not sent them to the server.
+
+An explicit publish refusal before recording means no app version was recorded. Act on its message, then use the printed retry command. If transport fails or the response cannot be read, the outcome is uncertain: check the retained app ID before retrying.
+
+- **Conflict** (names the files): run the full printed `Recovery` command. It checks whether the workspace is shallow, fetches missing history from origin if needed, then pulls the team copy with an explicit merge strategy. If ancestry preparation fails, stop and repair origin before retrying; the team pull must not run. Resolve those files and commit. For `apps create`, use the printed retry command with its original `--id`, so the app keeps its folder.
+- **Session copy has commits this workspace does not**: run `git pull --no-rebase --no-edit`, then retry. For `apps create`, keep the printed `--id`.
+- **Still merging, other publishes landed first, or failed**: retry. For `apps create`, use the printed retry command with its original `--id`; for `apps update`, use its printed retry command.
+- **Refused** (the session ended or the team paused agents): stop and tell the user.
+
+Outside a hosted session the command records the version only, and prints a note that it is not in the team repository yet.

package/vendor/skills/orizu/references/cli-reference.md

@@ -192,10 +192,17 @@ Profile, never a version, and exposes no fallback or affected-Profile list.
 `default move` repoints
 Default to the named Profile without moving Production; if that Profile is
 unpromoted, bare resolution refuses with `instruction_set_profile_not_promoted`.
-`shape add` and `shape remove` create a new complete version for every profile;
-they never move Default or a Production label. The set does not resolve for affected model
-configs until those pointers move to the new shape-change profile versions; the
-text CLI prints the required follow-up commands.
+`shape add` and `shape remove` work only until the first promotion of any
+profile. They create a new complete unpromoted version for every profile and
+never move Default or a Production label. First promotion permanently freezes
+the shape; changing component names after publication requires a new instruction
+set, even after archiving or removing production pointers. Every set that
+existed when this rule shipped is already frozen, including drafts, so a 409
+`Instruction set shape is permanently frozen` on an existing set means: create a
+new instruction set. If sync or a run refuses with
+`instruction_set_production_shape_mismatch`, the Production version predates the
+freeze and disagrees with the set's components; hand off creating and promoting
+a compatible version to a human. Exact `@vN` sync still works.
 
 The manifest is a JSON object with `name`, optional unversioned `description`,
 ordered `shape`, and `components`. The description belongs to the instruction
@@ -309,6 +316,8 @@ orizu apps update \
   --output-schema ./schemas/output.json
 ```
 
+In a hosted session both commands commit the app into `projects/<project-slug>/apps/<app-id>/` and merge it into the team copy before recording it; `apps create --id <app-id>` reruns a create that stopped and keeps its folder. See [building-apps.md](building-apps.md#publishing-from-a-hosted-session).
+
 Link dataset:
 
 ```bash

package/vendor/skills/orizu/references/optimization-reports.md

@@ -52,7 +52,7 @@ Second, before pushing, require the target profile's `model_config_settings_vers
 
 Once a supported surface can prove equality, the agent may copy the selected value exactly into the complete manifest while preserving every other override and pin, then use the runner-pinned push above on the local surface. Moving exactly one verified serving pointer remains human-only. An existing Production Profile would be promoted by the human and recover with `orizu instructions profiles rollback <set> --project <team/project> --model-config <identity> --to <previous-production-version-number>`. A human managing Default would first confirm the target Profile has a reviewed Production Version, move Default to that Profile identity, and recover by moving the prior Default Profile identity back. If a change must affect only one identity, a curator establishes a dedicated Profile only when none exists and confirms a recovery target; an existing unpromoted Profile makes `profiles new` reject and remains unusable until promoted. These are blocked flow shapes, not permission to bypass the settings proof.
 
-If the blocked set-of-one run should instead become a profile-recorded optimization, change the instruction-set shape to more than one real, separately optimized component, validate the new multi-component manifest and dataset contract, and only then rerun. Repeating the same one-component shape remains a prompt-version run. If that material redesign is not warranted, keep the current run at **Gather more evidence**.
+If the blocked set-of-one run should instead become a profile-recorded optimization, give it more than one real, separately optimized component, validate the new multi-component manifest and dataset contract, and only then rerun. Shape edits work only until a set's first promotion; a published or rollout-frozen set needs a new instruction set with the new shape. Repeating the same one-component shape remains a prompt-version run. If that material redesign is not warranted, keep the current run at **Gather more evidence**.
 
 Pre-promotion Final-held-out confirmation is unsupported for a plain-prompt run today: the selected prompt version does not exist until its live pointer move. The report must present validation-only evidence, mark Final-held-out as **not obtainable before promotion**, and never describe Final-held-out proof as completed. If policy requires Final-held-out evidence before production, recommend **Gather more evidence** and do not run the promotion command. If a human explicitly accepts live-first verification, phrase the ship recommendation as a **post-promotion verification plan**: name the watch window, failure threshold, and confirmed rollback path before promotion. The current CLI has no plain-prompt rollback command, so do not invent one; if no external/manual rollback path is confirmed, recommend **Gather more evidence**. A set-of-one run also stops today when complete local runner evidence is unavailable and, even when that runner is known, because run-versus-target settings equality cannot be proven through the supported CLI.
 

package/vendor/skills/orizu/references/primer.md

@@ -125,6 +125,7 @@ Two artifacts: an **app** (custom labeler UI) and a **task** (the labeling round
 
 ```bash
 # 1. Create the labeler app, bound to the dataset
+#    (in a hosted session it is committed and merged into the team copy first; see building-apps.md)
 orizu apps create \
   --project <teamSlug>/<projectSlug> \
   --name "Support QA Labeler" \

package/vendor/skills/orizu/references/prompt-control-plane.md

@@ -67,17 +67,21 @@ display name. Archiving changes list visibility only, so archived sets still res
 and sync; use `--status archived` or `--status all` to find them before
 restoring.
 
-Shape changes create unpromoted profile heads but leave the default and
-production pointers in place. The instruction set does not resolve for affected
-model configs until those pointers move to their new shape-change versions; use
-the follow-up commands printed by the text CLI.
+Shape add/remove works only until the first promotion of any profile. Draft
+shape changes create unpromoted profile heads and leave Default in place. First
+promotion permanently freezes component names; changing a published shape
+requires a new instruction set, even after archiving or removing production
+pointers. Sets that existed when this rule shipped are frozen too, including
+drafts. `instruction_set_production_shape_mismatch` means a pre-freeze Production
+version disagrees with the set's components; a human must promote a compatible
+version, and exact `@vN` sync still works meanwhile.
 
 `default show` reports the Default Profile and the Version its Production
 currently names, or `null` when that Profile is unpromoted. `default move`
 targets a Profile by model-config identity, never a Version, and does not move
 Production. Moving Default to an unpromoted Profile makes bare resolution refuse
 with `instruction_set_profile_not_promoted`; no other Profile falls back to it.
-Shape changes create a new `shape_change` Version for every Profile; they do not
+Before first promotion, shape changes create a new `shape_change` Version for every Profile; they do not
 repoint Default or any Production label.
 
 Sync an offline runner directory with `orizu instructions sync planner