orizu 0.5.38 → 0.5.40

package/README.md

@@ -19,7 +19,7 @@ Note: the one task we do _not_ let you perform from your CLI is any reviews assi
 
 ## Requirements
 
-- [Node.js 20+](https://nodejs.org/en/download)
+- [Node.js 22+](https://nodejs.org/en/download)
 - Access to an Orizu web app/API
 - A valid Orizu account
 
@@ -195,8 +195,8 @@ Agents are first-class users of this CLI: **every command supports `--json`**
 (as a prefix, `orizu --json teams list`, or a trailing flag) and emits a single
 machine-readable JSON document instead of formatted text. Discover the full
 command surface, including global options, with `orizu capabilities --json`.
-Hosted agents may read and sync instruction sets, create profile seeds, run shape add/remove with team-scoped curator authority, and prepare complete manifests. A local coding agent using the user's token runs instruction create, push, shape add/remove, archive, and restore itself after plan ratification. It gathers only read-only pointer-resolution and binding evidence; a human curator executes every production/default pointer command on every surface.
-In a hosted session, a human curator using the local CLI must run create/push, archive/restore, and every pointer command; shape add/remove stays agent-runnable because it creates unpromoted heads only.
+Hosted agents may read and sync instruction sets, create profile seeds, run shape add/remove before first promotion with team-scoped curator authority, and prepare complete manifests. A local coding agent using the user's token runs instruction create, push, shape add/remove, archive, and restore itself after plan ratification. It gathers only read-only pointer-resolution and binding evidence; a human curator executes every production/default pointer command on every surface.
+In a hosted session, a human curator using the local CLI must run create/push, archive/restore, and every pointer command; shape add/remove stays agent-runnable before first promotion because it creates unpromoted heads only; sets that existed when the freeze shipped are already frozen. The first promotion of any profile permanently freezes component names; a changed published shape requires a new instruction set, even after archiving or removing production pointers.
 
 ## Authentication
 
@@ -336,6 +336,10 @@ orizu logout
     <td>Download a dataset</td>
     <td><code>orizu datasets download --dataset &lt;datasetId&gt; --format jsonl --out ./dataset.jsonl</code></td>
   </tr>
+  <tr>
+    <td>Inspect saved splits and download validation rows</td>
+    <td><code>orizu datasets splits list &lt;datasetVersionId&gt; --json</code><br><code>orizu datasets splits show &lt;splitSetId&gt; --json</code><br><code>orizu datasets download --dataset-version &lt;datasetVersionId&gt; --split-set &lt;splitSetId&gt; --split validation --format jsonl --out ./validation.jsonl</code></td>
+  </tr>
   <tr>
     <td>Append dataset rows</td>
     <td><code>orizu datasets append --dataset &lt;datasetId&gt; --file ./datasets/support-extra.jsonl</code></td>
@@ -485,6 +489,52 @@ SIGINT/SIGTERM cancels a download. Upload writes
 have no additional transient retries; the existing session refresh behavior is
 unchanged.
 
+Dataset `append` prints one result document with `--json`, including JSONL and
+multiple chunks. Its failure document preserves the resolved `datasetId`,
+`confirmedRows` and `confirmedChunks`, and identifies the acquired `failedChunk`
+when one exists. A lost or malformed receipt leaves that chunk's outcome
+`unknown`: inspect and reconcile the dataset before repeating the write.
+Earlier acknowledged rows remain appended. Each admitted append request uses
+the same two-minute transfer deadline and validated environment override,
+including response-body consumption. This deadline does not time out file input
+or interactive selection. SIGINT/SIGTERM closes append's owned JSONL reader and
+in-flight transport; retained interactive selection keeps ordinary process signal
+termination. Append adds no transient write retries or write deduplication.
+
+Dataset `edit-rows` and `delete-rows` use the same transfer deadline for each
+request, including its response body. When a request times out, loses its
+connection or gets a server error or a malformed reply, the message says the
+change may already be applied (or removed): check those rows before retrying.
+A refusal from the server (for example, a locked dataset) leaves `edit-rows`
+with the usual retry advice, and reports `delete-rows` as refused.
+SIGINT/SIGTERM aborts the request in flight and exits 130/143. Neither command
+retries a write automatically.
+
+Dataset `lock` uses the same transfer deadline for its request, including the
+response body. After a timeout, a lost connection, a server error or a malformed
+reply, the message says the dataset may already be locked: running `lock` again
+is safe and shows its current state. A refusal from the server keeps its usual
+message. Lock keeps ordinary process signal termination and never retries.
+
+Dataset `delete` asks you to type the dataset id first, then uses the same
+transfer deadline for its request, including the response body. After a
+timeout, a lost connection, a server error or a malformed reply, the message
+says the dataset may already be deleted: check with
+`orizu datasets list --status all` before retrying. When tasks or app versions
+still use the dataset, the refusal also names `orizu datasets archive <id>`.
+Delete keeps ordinary process signal termination and never retries.
+
+Dataset `readme set` uses the same transfer deadline for its request, including
+the response body. Each save adds a new README version. After a timeout, a lost
+connection, a server error or a malformed reply, the message says the README may
+already be saved as a new version: check the dataset's README tab before saving
+again, since another save would add a second version. When another save for the
+same dataset happened at the same time, the message says yours was not saved
+and to run the command again. A README file that cannot be read is named and
+nothing is sent. `readme set` keeps ordinary process signal termination and
+never retries.
+
+
 ## Interactive And Automated Usage
 
 Many commands can prompt for missing team, project, app, dataset, or task selections in an interactive terminal. In scripts and CI, pass explicit flags instead:
@@ -499,3 +549,45 @@ Use `--json` on supported task and app commands when automation needs structured
 
 - [docs/cli.md](docs/cli.md): complete CLI guide and command reference
 - [skills/orizu/references/cli-reference.md](skills/orizu/references/cli-reference.md): compact command matrix and end-to-end flows
+
+If the server loses or cannot decode a database append acknowledgement, it preserves the request's prepared row artifacts because rows may already reference them. Unknown outcomes require inspection; automatic orphan reconciliation and write deduplication are not promised. Known SQL refusals clean up only that request's newly prepared artifacts.
+
+### Enrich validation rows while preserving split assignments
+
+Start with the immutable dataset version ID returned by dataset upload or version
+creation. List its saved split sets, then inspect one set to find the exact
+partition name (custom names and empty partitions are retained):
+
+```bash
+orizu datasets splits list DATASET_VERSION_ID --json
+orizu datasets splits show SPLIT_SET_ID --json > split.json
+orizu datasets download --dataset-version DATASET_VERSION_ID --split-set SPLIT_SET_ID --split validation --format jsonl --out validation.jsonl
+```
+
+`validation.jsonl` contains only that partition, in its saved order. Each row has
+its canonical `id` and the fields stored in that version. These reads stay fixed
+when the live dataset changes. No prompt, runner, scorer or optimization is needed.
+
+The assignment JSON retains set and partition metadata, including arrays, scalars
+and null values, together with exact saved memberships.
+
+Enrich the exported rows in your own workflow, keeping every `id` unchanged.
+Combine them with the other rows when preparing the complete enriched dataset.
+After uploading that dataset or creating its version, use the new version's ID
+explicitly to reuse every original assignment:
+
+```bash
+orizu datasets splits create TARGET_DATASET_VERSION_ID --from-file split.json --json
+```
+
+The import accepts the `name`, `strategy`, `seed`, `metadata` and
+`partitions: [{name, row_ids}]` from show JSON. Source identity is for inspection;
+the command's target version decides where assignments are created. Every
+referenced canonical row ID must exist in that target. Missing IDs fail instead
+of being dropped or remapped. Unknown or inaccessible versions, sets or names,
+mismatched selectors and incomplete artifacts fail; pinned reads never fall back
+to live data. Existing live downloads remain available with `--dataset`.
+
+For saved split names beginning with `--`, use the unambiguous equals spelling:
+`orizu datasets download --dataset-version DATASET_VERSION_ID --split-set SPLIT_SET_ID --split=--validation --format jsonl --out validation.jsonl`.
+The same spelling supports `--split=--json` and `--split=--help`; all pinned selectors remain required.

package/dist/app-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-commands.d.ts","sourceRoot":"","sources":["../src/app-commands.ts"],"names":[],"mappings":"AAkCA,iBAAe,QAAQ,kBActB;AAED,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAY9D;AAED,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1F;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjD;AAED,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAeA;AAED,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM;;;;;IAoB/E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAGjE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAED,iBAAe,iBAAiB,kBAiD/B;AAED,iBAAe,kBAAkB,kBAiDhC;AAED,iBAAe,iBAAiB,kBAiD/B;AAED,iBAAe,cAAc,kBAgD5B;AA+CD,iBAAe,SAAS,kBA2CvB;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAK3G;AAED,iBAAe,eAAe,kBAmD7B;AAED,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,CAAA"}
+{"version":3,"file":"app-commands.d.ts","sourceRoot":"","sources":["../src/app-commands.ts"],"names":[],"mappings":"AAuCA,iBAAe,QAAQ,kBActB;AAED,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9D;AAeD,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1F;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjD;AAED,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAeA;AAED,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM;;;;;IAoB/E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAGjE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAyED,iBAAe,iBAAiB,kBAmG/B;AAED,iBAAe,kBAAkB,kBAiDhC;AAED,iBAAe,iBAAiB,kBAwF/B;AAED,iBAAe,cAAc,kBAgD5B;AA+CD,iBAAe,SAAS,kBA2CvB;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAK3G;AAED,iBAAe,eAAe,kBAmD7B;AAED,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,CAAA"}

package/dist/app-commands.js

@@ -1,16 +1,20 @@
 // ORI-2044: moved from index.ts to keep app commands together.
 import { readFileSync, statSync, mkdirSync, writeFileSync, realpathSync, } from 'fs';
 import { normalize, isAbsolute, join, dirname, } from 'path';
-import { createHash } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { getArg, getArchiveListStatus, hasJsonFlag, expandHomePath, hasArg, } from './command-line-arguments.js';
 import { resolveProjectSlug, fetchApps, selectAppIdInteractively } from './account-directory.js';
 import { printJson, printLine, getErrorMessage } from './cli-console-output.js';
 import { printAppSummaries } from './archive-artifacts-cli.js';
 import { isNodeError, formatTerminalLink } from './auth-commands.js';
+import { parseCliProjectSlug } from './cli-project-slug.js';
+import { AppPublishFailure } from './app-publish-failure.js';
+import { inspectAppDestination } from './app-publish-paths.js';
 import { authedFetch, getBaseUrl } from './http.js';
 import { appPageUrl } from './app-page-url.js';
 import { parseJsonResponse, sanitizeHumanInlineText, sanitizeTerminalText } from './json-response.js';
 import { runLocalAppPreview } from './preview-runtime.js';
+import { findWorkspaceRoot } from './workspace.js';
 async function listApps() {
     const project = getArg('--project') || await resolveProjectSlug(null);
     const baseUrl = getBaseUrl();
@@ -51,7 +55,9 @@ function readSourceBytes(pathArg) {
     }
 }
 function readJsonFile(pathArg) {
-    const raw = readSourceFile(pathArg);
+    return parseJsonFileContents(readSourceFile(pathArg), pathArg);
+}
+function parseJsonFileContents(raw, pathArg) {
     try {
         const parsed = JSON.parse(raw);
         if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
@@ -127,47 +133,160 @@ function writeTextFileEnsuringDir(pathArg, content) {
 function readManifestFile(dirArg) {
     return readJsonFile(join(expandHomePath(dirArg), 'manifest.json'));
 }
+const LOCAL_PUBLISH_NOTE = 'Note: this app version is not in the team repository yet; it reaches git when published from a hosted session.';
+const APP_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** The workspace root when this runs in a hosted session, else null. */
+function hostedWorkspaceRoot() {
+    if (!process.env.ORIZU_SESSION_ID?.trim())
+        return null;
+    const workspaceRoot = findWorkspaceRoot(process.cwd());
+    if (!workspaceRoot)
+        throw new Error('Hosted app publishing must run inside the attached workspace. Run this command from the workspace containing orizu.team.json.');
+    return workspaceRoot;
+}
+/** The hosted publish path, loaded only when it runs: it needs Effect, which
+ * the rest of the CLI does not load at startup. */
+function loadAppPublishWorkspace() {
+    return import('./app-publish-workspace.js');
+}
+/** The app as committed into its folder: the files exactly as the agent wrote them. */
+function appFilesFromArgs(filePath, inputSchemaPath, outputSchemaPath) {
+    return { sourceCode: readSourceFile(filePath), inputSchema: readSourceFile(inputSchemaPath), outputSchema: readSourceFile(outputSchemaPath) };
+}
+/** ORI-2280: a hosted publish the merge stopped. The server's text says what to
+ * do; a create's rerun must name the same app id, so its folder is reused. A
+ * conflict also adds the team copy remote the text tells the agent to pull. */
+async function publishRefusalError(responseText, workspaceRoot) {
+    let body;
+    try {
+        body = JSON.parse(responseText);
+    }
+    catch {
+        return null;
+    }
+    if (!isRecord(body) || typeof body.error !== 'string' || typeof body.code !== 'string' || !body.code.startsWith('publish_'))
+        return null;
+    let message = sanitizeTerminalText(body.error);
+    if (body.code === 'publish_conflict') {
+        const { addTeamCopyRemote } = await loadAppPublishWorkspace();
+        const remoteNote = await addTeamCopyRemote(workspaceRoot);
+        if (remoteNote)
+            message = `${message} ${remoteNote}`;
+    }
+    return new Error(message);
+}
+function printPublishedCommit(commit, isHosted) {
+    if (commit) {
+        const where = commit.outcome === 'merged' ? 'Merged into' : 'Already in';
+        printLine(`${where} the team copy: ${sanitizeTerminalText(commit.sha.slice(0, 7))}`);
+    }
+    else if (!isHosted) {
+        printLine(LOCAL_PUBLISH_NOTE);
+    }
+}
+/** Quote each original argument so spaces and quotes survive a copied retry. */
+function shellSingleQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function canonicalRetryInputPath(workspaceRoot, folder, filename, originalPath) {
+    const canonicalPath = join(workspaceRoot, folder, filename);
+    try {
+        return inspectAppDestination(workspaceRoot, join(folder, filename)) ? canonicalPath : originalPath;
+    }
+    catch {
+        return originalPath;
+    }
+}
 async function createAppFromFile() {
-    const project = getArg('--project');
+    const workspaceRoot = hostedWorkspaceRoot();
+    let project = getArg('--project');
     const name = getArg('--name');
     const datasetId = getArg('--dataset');
     const filePath = getArg('--file');
     const inputSchemaPath = getArg('--input-schema');
     const outputSchemaPath = getArg('--output-schema');
     const component = getArg('--component') || undefined;
+    const requestedAppId = getArg('--id') ?? undefined;
     if (!project || !name || !datasetId || !filePath || !inputSchemaPath || !outputSchemaPath) {
-        throw new Error('Usage: orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]');
+        throw new Error('Usage: orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>] [--id <app-id>]');
     }
-    const sourceCode = readSourceFile(filePath);
-    const inputJsonSchema = readJsonFile(inputSchemaPath);
-    const outputJsonSchema = readJsonFile(outputSchemaPath);
-    const response = await authedFetch('/api/cli/apps/create-from-file', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            projectSlug: project,
-            name,
-            datasetId,
-            sourceCode,
-            componentName: component,
-            inputJsonSchema,
-            outputJsonSchema,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to create app: ${await response.text()}`);
+    if (requestedAppId !== undefined && !APP_ID_PATTERN.test(requestedAppId)) {
+        throw new Error('--id must be a lowercase app id (UUID), as printed by the earlier publish');
     }
-    const data = await parseJsonResponse(response, 'App create');
-    if (hasJsonFlag()) {
-        printJson({ app: { ...data.app, pageUrl: data.app.url || appPageUrl(getBaseUrl(), data.app.id) }, warnings: data.warnings || [] });
-        return;
-    }
-    printLine(`Created app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) v${data.app.versionNum}`);
-    if (data.app.url) {
-        printLine(`View app: ${formatTerminalLink(data.app.url)}`);
+    if (workspaceRoot) {
+        const parsedProject = parseCliProjectSlug(project);
+        const slug = /^[a-z0-9][a-z0-9-]{0,99}$/;
+        if (!parsedProject || !slug.test(parsedProject.teamSlug) || !slug.test(parsedProject.projectSlug)) {
+            throw new Error('--project must be a valid <team/project> reference');
+        }
+        project = `${parsedProject.teamSlug}/${parsedProject.projectSlug}`;
+    }
+    const files = appFilesFromArgs(filePath, inputSchemaPath, outputSchemaPath);
+    const sourceCode = files.sourceCode;
+    const inputJsonSchema = parseJsonFileContents(files.inputSchema, inputSchemaPath);
+    const outputJsonSchema = parseJsonFileContents(files.outputSchema, outputSchemaPath);
+    // In a hosted session the app is committed into its folder and pushed first;
+    // the server merges that commit into the team copy before recording the app.
+    let appId = requestedAppId;
+    let sessionCommitSha;
+    let recoveryFolder;
+    let filesMaterialized = false;
+    try {
+        if (workspaceRoot) {
+            const projectSlug = parseCliProjectSlug(project).projectSlug;
+            appId ??= randomUUID();
+            recoveryFolder = `projects/${projectSlug}/apps/${appId}`;
+            const { pushAppToSessionCopy } = await loadAppPublishWorkspace();
+            sessionCommitSha = await pushAppToSessionCopy(workspaceRoot, {
+                projectSlug,
+                appId,
+                files,
+            });
+            filesMaterialized = true;
+        }
+        const response = await authedFetch('/api/cli/apps/create-from-file', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                projectSlug: project,
+                name,
+                datasetId,
+                sourceCode,
+                componentName: component,
+                inputJsonSchema,
+                outputJsonSchema,
+                ...(appId !== undefined ? { appId } : {}),
+                ...(sessionCommitSha !== undefined ? { sessionCommitSha } : {}),
+            }),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            const refusal = workspaceRoot ? await publishRefusalError(text, workspaceRoot) : null;
+            throw refusal ?? new Error(`Failed to create app: ${text}`);
+        }
+        const data = await parseJsonResponse(response, 'App create');
+        if (hasJsonFlag()) {
+            printJson({ app: { ...data.app, pageUrl: data.app.url || appPageUrl(getBaseUrl(), data.app.id) }, warnings: data.warnings || [] });
+            return;
+        }
+        printLine(`Created app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) v${data.app.versionNum}`);
+        if (data.app.url) {
+            printLine(`View app: ${formatTerminalLink(data.app.url)}`);
+        }
+        printPublishedCommit(data.app.publishedCommit, workspaceRoot !== null);
+        if (data.warnings?.length) {
+            printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`);
+        }
     }
-    if (data.warnings?.length) {
-        printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`);
+    catch (error) {
+        if (!workspaceRoot || !appId || !recoveryFolder)
+            throw error;
+        const useCanonicalInputs = filesMaterialized || (error instanceof AppPublishFailure && error.filesMaterialized);
+        const retryArgs = ['orizu', '--server', getBaseUrl(), 'apps', 'create', '--project', project, '--name', name, '--dataset', datasetId,
+            '--file', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'App.tsx', filePath) : filePath, '--input-schema', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'input.schema.json', inputSchemaPath) : inputSchemaPath,
+            '--output-schema', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'output.schema.json', outputSchemaPath) : outputSchemaPath,
+            ...(component ? ['--component', component] : []), ...(hasJsonFlag() ? ['--json'] : []), '--id', appId];
+        throw new Error(`${getErrorMessage(error)}\nApp ID: ${appId}\nFolder: ${recoveryFolder}\nRetry: ${retryArgs.map(shellSingleQuote).join(' ')}`);
     }
 }
 async function previewAppFromFile() {
@@ -217,6 +336,7 @@ async function previewAppFromFile() {
     }
 }
 async function updateAppFromFile() {
+    const workspaceRoot = hostedWorkspaceRoot();
     const filePath = getArg('--file');
     const inputSchemaPath = getArg('--input-schema');
     const outputSchemaPath = getArg('--output-schema');
@@ -230,32 +350,70 @@ async function updateAppFromFile() {
         const selected = await selectAppIdInteractively(project);
         appId = selected.appId;
     }
-    const sourceCode = readSourceFile(filePath);
-    const inputJsonSchema = readJsonFile(inputSchemaPath);
-    const outputJsonSchema = readJsonFile(outputSchemaPath);
-    const response = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}/update-from-file`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            sourceCode,
-            componentName: component,
-            inputJsonSchema,
-            outputJsonSchema,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to update app: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'App update');
-    const pageUrl = appPageUrl(getBaseUrl(), data.app.id);
-    if (hasJsonFlag()) {
-        printJson({ app: { ...data.app, pageUrl }, warnings: data.warnings || [] });
-        return;
+    const files = appFilesFromArgs(filePath, inputSchemaPath, outputSchemaPath);
+    const sourceCode = files.sourceCode;
+    const inputJsonSchema = parseJsonFileContents(files.inputSchema, inputSchemaPath);
+    const outputJsonSchema = parseJsonFileContents(files.outputSchema, outputSchemaPath);
+    // In a hosted session the app is committed into its folder and pushed first;
+    // the server merges that commit into the team copy before recording the version.
+    let recoveryFolder;
+    let filesMaterialized = false;
+    try {
+        let sessionCommitSha;
+        if (workspaceRoot) {
+            const folderResponse = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}`);
+            if (!folderResponse.ok) {
+                throw new Error(`Failed to find the app's project: ${await folderResponse.text()}`);
+            }
+            const folder = await parseJsonResponse(folderResponse, 'App folder');
+            recoveryFolder = `projects/${folder.projectSlug}/apps/${folder.appId}`;
+            const { pushAppToSessionCopy } = await loadAppPublishWorkspace();
+            sessionCommitSha = await pushAppToSessionCopy(workspaceRoot, {
+                projectSlug: folder.projectSlug,
+                appId: folder.appId,
+                files,
+            });
+            filesMaterialized = true;
+        }
+        const response = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}/update-from-file`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                sourceCode,
+                componentName: component,
+                inputJsonSchema,
+                outputJsonSchema,
+                ...(sessionCommitSha !== undefined ? { sessionCommitSha } : {}),
+            }),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            const refusal = workspaceRoot ? await publishRefusalError(text, workspaceRoot) : null;
+            throw refusal ?? new Error(`Failed to update app: ${text}`);
+        }
+        const data = await parseJsonResponse(response, 'App update');
+        const pageUrl = appPageUrl(getBaseUrl(), data.app.id);
+        if (hasJsonFlag()) {
+            printJson({ app: { ...data.app, pageUrl }, warnings: data.warnings || [] });
+            return;
+        }
+        printLine(`Updated app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) to v${data.app.versionNum}`);
+        printLine(`View app: ${formatTerminalLink(pageUrl)}`);
+        printPublishedCommit(data.app.publishedCommit, workspaceRoot !== null);
+        if (data.warnings?.length) {
+            printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`);
+        }
     }
-    printLine(`Updated app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) to v${data.app.versionNum}`);
-    printLine(`View app: ${formatTerminalLink(pageUrl)}`);
-    if (data.warnings?.length) {
-        printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`);
+    catch (error) {
+        if (!workspaceRoot || !recoveryFolder)
+            throw error;
+        const useCanonicalInputs = filesMaterialized || (error instanceof AppPublishFailure && error.filesMaterialized);
+        const retryArgs = ['orizu', '--server', getBaseUrl(), 'apps', 'update', '--app', appId,
+            '--file', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'App.tsx', filePath) : filePath,
+            '--input-schema', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'input.schema.json', inputSchemaPath) : inputSchemaPath,
+            '--output-schema', useCanonicalInputs ? canonicalRetryInputPath(workspaceRoot, recoveryFolder, 'output.schema.json', outputSchemaPath) : outputSchemaPath,
+            ...(component ? ['--component', component] : []), ...(hasJsonFlag() ? ['--json'] : [])];
+        throw new Error(`${getErrorMessage(error)}\nApp ID: ${appId}\nFolder: ${recoveryFolder}\nRetry: ${retryArgs.map(shellSingleQuote).join(' ')}`);
     }
 }
 async function linkAppDataset() {

package/dist/app-publish-failure.d.ts

@@ -0,0 +1,6 @@
+/** Recovery may use canonical inputs only after this attempt wrote its full snapshot. */
+export declare class AppPublishFailure extends Error {
+    readonly filesMaterialized: boolean;
+    constructor(message: string, filesMaterialized: boolean);
+}
+//# sourceMappingURL=app-publish-failure.d.ts.map

package/dist/app-publish-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-publish-failure.d.ts","sourceRoot":"","sources":["../src/app-publish-failure.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,qBAAa,iBAAkB,SAAQ,KAAK;IACb,QAAQ,CAAC,iBAAiB,EAAE,OAAO;gBAApD,OAAO,EAAE,MAAM,EAAW,iBAAiB,EAAE,OAAO;CAIjE"}

package/dist/app-publish-failure.js

@@ -0,0 +1,9 @@
+/** Recovery may use canonical inputs only after this attempt wrote its full snapshot. */
+export class AppPublishFailure extends Error {
+    filesMaterialized;
+    constructor(message, filesMaterialized) {
+        super(message);
+        this.filesMaterialized = filesMaterialized;
+        this.name = 'AppPublishFailure';
+    }
+}

package/dist/app-publish-paths.d.ts

@@ -0,0 +1,4 @@
+/** Inspect canonical destinations without following aliases. All callers check
+ * the whole set before materializing it; this does not claim race-proof access. */
+export declare function inspectAppDestination(root: string, path: string): boolean;
+//# sourceMappingURL=app-publish-paths.d.ts.map

package/dist/app-publish-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-publish-paths.d.ts","sourceRoot":"","sources":["../src/app-publish-paths.ts"],"names":[],"mappings":"AAGA;mFACmF;AACnF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAqBzE"}

package/dist/app-publish-paths.js

@@ -0,0 +1,32 @@
+import { lstatSync } from 'node:fs';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+/** Inspect canonical destinations without following aliases. All callers check
+ * the whole set before materializing it; this does not claim race-proof access. */
+export function inspectAppDestination(root, path) {
+    const base = resolve(root);
+    const destination = resolve(base, path);
+    const tail = relative(base, destination);
+    if (!tail || tail === '..' || tail.startsWith(`..${sep}`) || isAbsolute(tail))
+        throw new Error('App destination is outside the workspace');
+    const rootStat = lstatSync(base);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
+        throw new Error('App workspace must be an ordinary directory');
+    const segments = tail.split(sep);
+    let current = base;
+    for (const [index, segment] of segments.entries()) {
+        current = resolve(current, segment);
+        const stat = lstatSync(current, { throwIfNoEntry: false });
+        if (!stat)
+            return false;
+        if (stat.isSymbolicLink())
+            throw new Error('App destination must not contain symbolic links');
+        if (index < segments.length - 1) {
+            if (!stat.isDirectory())
+                throw new Error('App destination parent must be an ordinary directory');
+        }
+        else if (!stat.isFile() || stat.nlink > 1) {
+            throw new Error('App destination must be an ordinary file without hardlink aliases');
+        }
+    }
+    return true;
+}

package/dist/app-publish-workspace.d.ts

@@ -0,0 +1,16 @@
+export interface AppFiles {
+    readonly sourceCode: string;
+    readonly inputSchema: string;
+    readonly outputSchema: string;
+}
+/** Commits and pushes the app, answering the commit to publish. Throws the
+ * message the agent should act on. */
+export declare function pushAppToSessionCopy(root: string, input: {
+    projectSlug: string;
+    appId: string;
+    files: AppFiles;
+}): Promise<string>;
+/** Adds the team copy remote; answers a sentence to add to the conflict
+ * message when it could not, else null. */
+export declare function addTeamCopyRemote(root: string): Promise<string | null>;
+//# sourceMappingURL=app-publish-workspace.d.ts.map

package/dist/app-publish-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-publish-workspace.d.ts","sourceRoot":"","sources":["../src/app-publish-workspace.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AA+GD;sCACsC;AACtC,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAcxI;AAgCD;2CAC2C;AAC3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAStE"}