orizu 0.5.43 → 0.5.45

package/dist/score-save-workflow.js

@@ -4,16 +4,19 @@ import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js';
 import { extractErrorMessage } from './error-response.js';
 import { appErrorOf, unreachedCode } from './request-outcome.js';
 // Loaded only through `await import(...)`, like the dataset workflows.
+const SavedScore = Schema.Struct({ scoreRun: Schema.Struct({ id: Schema.NonEmptyString }) });
+const SavedRun = Schema.Struct({ run: Schema.Struct({ id: Schema.NonEmptyString }) });
+// `serverMayBeSaved` is what the route says when it cannot tell whether the run was saved.
 const COMMANDS = {
-    submit: { label: 'Score submit', failed: 'Failed to submit score' },
-    exec: { label: 'Scorer exec', failed: 'Failed to execute scorer' },
+    submit: { label: 'Score submit', failed: 'Failed to submit score', serverMayBeSaved: 'Score run may already be saved', saved: SavedScore },
+    exec: { label: 'Scorer exec', failed: 'Failed to execute scorer', serverMayBeSaved: 'Score run may already be saved', saved: SavedScore },
+    run: { label: 'Run submit', failed: 'Failed to submit run', serverMayBeSaved: 'Run may already be saved', saved: SavedRun },
 };
-// What the server says when it cannot tell whether the run was saved.
-const SERVER_MAY_BE_SAVED = 'Score run may already be saved';
 // Node's fetch publishes this once a request's whole body has been written.
 const BODY_SENT = 'undici:request:bodySent';
-const SavedReply = Schema.Struct({ scoreRun: Schema.Struct({ id: Schema.NonEmptyString }) });
-const scoreMayBeSaved = (save) => `The score may already be saved: run \`orizu scorers detail ${save.scorerVersionId} --project ${save.project}\` and check its newest score runs before running this again.`;
+const mayBeSaved = (save) => save.command === 'run'
+    ? `The run may already be saved: run \`orizu runs list --project ${save.project} --prompt-version ${save.promptVersionId}\` and check its newest runs before running this again.`
+    : `The score may already be saved: run \`orizu scorers detail ${save.scorerVersionId} --project ${save.project}\` and check its newest score runs before running this again.`;
 // The run may be saved when the server says so, when the reply was lost, late
 // or unreadable after the request was sent, when a 5xx did not come from the
 // app (a gateway giving up while the app kept working), or when the reply has
@@ -30,7 +33,7 @@ class ScoreSaveFailure extends Error {
 // second run. The deadline starts once the whole body has been sent, so a
 // large upload on a slow link takes as long as it did before.
 function scoreSave(save, request, timeoutMs) {
-    const { label, failed } = COMMANDS[save.command];
+    const { label, failed, serverMayBeSaved, saved } = COMMANDS[save.command];
     return Effect.suspend(() => {
         let sent = false;
         let timedOut = false;
@@ -62,7 +65,7 @@ function scoreSave(save, request, timeoutMs) {
                     if (!response.ok) {
                         const appError = await appErrorOf(response.clone());
                         const detail = await extractErrorMessage(response);
-                        if (appError === SERVER_MAY_BE_SAVED)
+                        if (appError === serverMayBeSaved)
                             throw new ScoreSaveFailure(appError, true);
                         if (response.status < 400 || (response.status >= 500 && appError === null)) {
                             throw new ScoreSaveFailure(`${label} got no clear answer (status ${response.status}).`, true);
@@ -79,7 +82,7 @@ function scoreSave(save, request, timeoutMs) {
                         data = undefined;
                     }
                     const usable = save.saves
-                        ? Result.isSuccess(Schema.decodeUnknownResult(SavedReply)(data))
+                        ? Result.isSuccess(Schema.decodeUnknownResult(saved)(data))
                         : typeof data === 'object' && data !== null && !Array.isArray(data);
                     if (!usable) {
                         throw new ScoreSaveFailure(`${label} returned an unexpected response (status ${response.status}).`, true);
@@ -111,9 +114,9 @@ function scoreSave(save, request, timeoutMs) {
         });
     });
 }
-/** `orizu scores submit` and `orizu scorers exec`: the reply, or an error saying whether the score may be saved. */
+/** `orizu scores submit`, `orizu scorers exec` and `orizu runs submit`: the reply, or an error saying whether the save may have happened. */
 export async function sendScoreSave(save, request) {
-    const exit = await Effect.runPromiseExit(scoreSave(save, request, datasetTransferTimeoutMs()).pipe(Effect.mapError(failure => new Error(failure.mayBeSaved && save.saves ? `${failure.message}\n${scoreMayBeSaved(save)}` : failure.message))));
+    const exit = await Effect.runPromiseExit(scoreSave(save, request, datasetTransferTimeoutMs()).pipe(Effect.mapError(failure => new Error(failure.mayBeSaved && save.saves ? `${failure.message}\n${mayBeSaved(save)}` : failure.message))));
     if (Exit.isSuccess(exit))
         return exit.value;
     throw Cause.squash(exit.cause);

package/dist/secret-redaction.d.ts

@@ -28,6 +28,20 @@
  * event payload can be passed through before it is sent to the RunAPI.
  */
 export declare const REDACTION_PLACEHOLDER = "[redacted]";
+/**
+ * The shape pass alone, for servers that hold no secret values: the web app
+ * and the session coordinator scrub agent text with it before it reaches a
+ * browser (ORI-1905). One list of shapes for the CLI and both servers.
+ */
+export declare function redactSecretShapes(input: string): string;
+/**
+ * For reply text shown as it is written: each snapshot is the reply so far, so
+ * one can end part-way through a token, before it is long enough for its shape
+ * to match. Such a tail is redacted too. The saved read shows a reply's last
+ * snapshot, so a finished reply that really ends in a bare `sk-` loses those
+ * characters there as well.
+ */
+export declare function redactStreamedTextShapes(input: string): string;
 export interface RedactOptions {
     /** Verbatim secret values to strip wherever they appear (bearer, tokens). */
     secrets?: readonly string[];

package/dist/secret-redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-redaction.d.ts","sourceRoot":"","sources":["../src/secret-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,eAAO,MAAM,qBAAqB,eAAe,CAAA;AAgDjD,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,aAAkB,GAAG,CAAC,CAGzE;AAmBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQjF"}
+{"version":3,"file":"secret-redaction.d.ts","sourceRoot":"","sources":["../src/secret-redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,eAAO,MAAM,qBAAqB,eAAe,CAAA;AAgDjD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAUD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,aAAkB,GAAG,CAAC,CAGzE;AAmBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQjF"}

package/dist/secret-redaction.js

@@ -70,6 +70,31 @@ function redactString(input, secrets) {
     }
     return out;
 }
+/**
+ * The shape pass alone, for servers that hold no secret values: the web app
+ * and the session coordinator scrub agent text with it before it reaches a
+ * browser (ORI-1905). One list of shapes for the CLI and both servers.
+ */
+export function redactSecretShapes(input) {
+    return redactString(input, []);
+}
+// A known credential prefix at the end of the text, followed by fewer
+// characters than its shape above needs: the start of a token still being
+// written. Each run is bounded, so the scan stays linear in the text, and a
+// longer run that is not a token (a path, a word) is left alone. `Bearer` only
+// counts in an Authorization header, so prose like "a Bearer token" keeps its
+// last word.
+const OPEN_TOKEN_AT_END = /(?:\bgithub_pat_[A-Za-z0-9_]{0,19}|\bgh[posur]_[A-Za-z0-9_]{0,19}|\borizu_(?:agent|pat)_[A-Za-z0-9_-]{0,9}|\bsk-[A-Za-z0-9_-]{0,19}|\b(authorization:\s*bearer)\s+[A-Za-z0-9._~+/-]{0,15})$/i;
+/**
+ * For reply text shown as it is written: each snapshot is the reply so far, so
+ * one can end part-way through a token, before it is long enough for its shape
+ * to match. Such a tail is redacted too. The saved read shows a reply's last
+ * snapshot, so a finished reply that really ends in a bare `sk-` loses those
+ * characters there as well.
+ */
+export function redactStreamedTextShapes(input) {
+    return redactSecretShapes(input).replace(OPEN_TOKEN_AT_END, (_match, header) => header ? `${header} ${REDACTION_PLACEHOLDER}` : REDACTION_PLACEHOLDER);
+}
 /**
  * Deep-redact a JSON-ish value. Strings are scrubbed; arrays/objects are walked;
  * everything else is returned as-is. Object KEYS are never treated as secrets

package/dist/skilled-proposer-launch.d.ts

@@ -23,6 +23,11 @@ export interface SkilledProposerChildOutput {
     stdout: (chunk: string) => void;
     stderr: (chunk: string) => void;
 }
+/**
+ * Run the optimizer, passing a stop signal on to it. On a stop signal the CLI
+ * waits until the optimizer exits (capped at CHILD_STOP_WAIT_MS, then kills
+ * it) and then ends by that same signal.
+ */
 export declare function spawnSkilledProposerChild(command: string, args: string[], engine: GepaEngine, environment: NodeJS.ProcessEnv, onSpawn?: () => Promise<void>, output?: SkilledProposerChildOutput): Promise<{
     status: number | null;
     error?: Error;

package/dist/skilled-proposer-launch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skilled-proposer-launch.d.ts","sourceRoot":"","sources":["../src/skilled-proposer-launch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAO3D,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,oBAAoB,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAClC;AACD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,CAAC,EAAE,yBAAyB,CAAA;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAiBD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EACnF,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC7B,MAAM,CAAC,EAAE,0BAA0B;;;GA4DpC;AAwCD,UAAU,aAAa;IAAG,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE;AAQ9F,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,UAAQ,GAAG,MAAM,CAepF;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,qBAAqB,CAyBvB"}
+{"version":3,"file":"skilled-proposer-launch.d.ts","sourceRoot":"","sources":["../src/skilled-proposer-launch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAO3D,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,oBAAoB,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAClC;AACD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,CAAC,EAAE,yBAAyB,CAAA;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAsBD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EACnF,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC7B,MAAM,CAAC,EAAE,0BAA0B;YA0CX,MAAM,GAAG,IAAI;YAAU,KAAK;GAkDrD;AAwCD,UAAU,aAAa;IAAG,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE;AAQ9F,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,UAAQ,GAAG,MAAM,CAepF;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,qBAAqB,CAyBvB"}

package/dist/skilled-proposer-launch.js

@@ -23,70 +23,128 @@ function materializeConfigPayload(engine, environment) {
     }
     return () => rmSync(root, { recursive: true, force: true });
 }
+const STOP_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT'];
+// The optimizer marks its run stopped before exiting (at most 10 s for the
+// status write); past this it is killed so nothing is left running (ORI-2402).
+const CHILD_STOP_WAIT_MS = 15_000;
+/**
+ * Run the optimizer, passing a stop signal on to it. On a stop signal the CLI
+ * waits until the optimizer exits (capped at CHILD_STOP_WAIT_MS, then kills
+ * it) and then ends by that same signal.
+ */
 export async function spawnSkilledProposerChild(command, args, engine, environment, onSpawn, output) {
     const childEnvironment = { ...environment };
-    const shouldMaterialize = engine === 'official'
-        && childEnvironment.ORIZU_CANDIDATE_PROPOSER === 'skilled-proposer'
-        && childEnvironment.ORIZU_SKILLED_PROPOSER_CONFIG !== undefined;
-    if (!shouldMaterialize)
-        return spawnSync(command, args, { stdio: 'inherit', env: childEnvironment });
     let child;
     let cleanup = () => { };
-    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT'];
-    const handlers = signals.map(signal => ({
-        signal,
-        handle: () => {
+    let stopSignal;
+    // On the terminal path the optimizer leads its own process group, so a stop
+    // also reaches its runners, which may run in worker threads it can't stop.
+    let childGroup;
+    const forward = (signal) => {
+        if (childGroup) {
             try {
-                cleanup();
+                process.kill(-childGroup, signal);
+                return;
             }
-            finally {
-                try {
-                    child?.kill(signal);
-                }
-                finally {
-                    for (const entry of handlers)
-                        process.off(entry.signal, entry.handle);
-                    process.kill(process.pid, signal);
-                }
+            catch { /* group already gone */ }
+        }
+        try {
+            child?.kill(signal);
+        }
+        catch { /* already exited */ }
+    };
+    let giveUp;
+    const removeHandlers = () => { for (const entry of handlers)
+        process.off(entry.signal, entry.handle); };
+    const endBySignal = (signal) => {
+        if (giveUp)
+            clearTimeout(giveUp);
+        removeHandlers();
+        cleanup();
+        // With our handlers gone, the signal's default action ends the process.
+        process.kill(process.pid, signal);
+        return new Promise(() => { });
+    };
+    const handlers = STOP_SIGNALS.map(signal => ({
+        signal,
+        handle: () => {
+            if (!child) {
+                void endBySignal(signal);
+                return;
             }
+            forward(signal);
+            if (stopSignal)
+                return;
+            stopSignal = signal;
+            // The child read the private payload at start and a stopping run
+            // proposes nothing, so it goes now rather than when the child exits.
+            cleanup();
+            giveUp = setTimeout(() => forward('SIGKILL'), CHILD_STOP_WAIT_MS);
         },
     }));
     for (const entry of handlers)
-        process.once(entry.signal, entry.handle);
+        process.on(entry.signal, entry.handle);
     try {
         cleanup = materializeConfigPayload(engine, childEnvironment) ?? cleanup;
         await new Promise(resolve => setImmediate(resolve));
+        let result;
         if (output) {
-            return await runPipedChild(command, args, childEnvironment, async () => { await onSpawn?.(); }, output, spawnedChild => { child = spawnedChild; });
-        }
-        const spawnedChild = spawn(command, args, {
-            stdio: 'inherit',
-            env: childEnvironment,
-        });
-        child = spawnedChild;
-        const spawned = new Promise((resolve, reject) => {
-            spawnedChild.once('spawn', resolve);
-            spawnedChild.once('error', reject);
-        });
-        const closed = new Promise(resolve => {
-            let error;
-            spawnedChild.once('error', cause => { error = cause; });
-            spawnedChild.once('close', status => resolve(error ? { status, error } : { status }));
-        });
-        await spawned;
-        try {
-            await onSpawn?.();
+            result = await runPipedChild(command, args, childEnvironment, async () => { await onSpawn?.(); }, output, spawnedChild => { child = spawnedChild; });
         }
-        catch (error) {
-            spawnedChild.kill('SIGTERM');
-            await closed;
-            throw error;
+        else {
+            // stdin is not passed on: a process outside the terminal's foreground
+            // group that read the terminal would be stopped by it.
+            // Outside the CLI's group, the optimizer would outlive a SIGKILL of the
+            // CLI; it watches for that and stops itself.
+            const spawnedChild = spawn(command, args, {
+                stdio: ['ignore', 'inherit', 'inherit'],
+                env: { ...childEnvironment, ORIZU_STOP_WITH_PARENT: '1' },
+                detached: true,
+            });
+            child = spawnedChild;
+            childGroup = spawnedChild.pid;
+            const spawned = new Promise((resolve, reject) => {
+                spawnedChild.once('spawn', resolve);
+                spawnedChild.once('error', reject);
+            });
+            const closed = new Promise(resolve => {
+                let error;
+                spawnedChild.once('error', cause => { error = cause; });
+                spawnedChild.once('close', status => resolve(error ? { status, error } : { status }));
+            });
+            // A launch failure (e.g. ENOENT) is returned, not thrown, so callers
+            // name the engine as they did with spawnSync.
+            try {
+                await spawned;
+            }
+            catch (error) {
+                return { status: null, error: error };
+            }
+            try {
+                await onSpawn?.();
+            }
+            catch (error) {
+                spawnedChild.kill('SIGTERM');
+                await closed;
+                throw error;
+            }
+            result = await closed;
+            // A runner that ignored the stop must not outlive the optimizer.
+            if (stopSignal) {
+                try {
+                    process.kill(-spawnedChild.pid, 'SIGKILL');
+                }
+                catch { /* group already gone */ }
+            }
         }
-        return await closed;
+        if (stopSignal)
+            return await endBySignal(stopSignal);
+        return result;
     }
     finally {
-        for (const entry of handlers)
-            process.off(entry.signal, entry.handle);
+        if (giveUp)
+            clearTimeout(giveUp);
+        removeHandlers();
         cleanup();
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.43",
+  "version": "0.5.45",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",

package/src/hosted-agent-prompt.ts

@@ -19,3 +19,14 @@ export const HOSTED_AGENT_PROMPT = `You are the Orizu agent. You work in the per
 - Keep answers short and plain. Say what you did and what the person needs to know next.
 - Follow the repository's own conventions and any instructions in its AGENTS.md.
 - An Orizu app's page link is <Orizu server>${appPagePath('<app id>')}, where <Orizu server> is the server the orizu CLI talks to (https://app.orizu.ai by default). To give someone an app's link, run \`orizu projects list\` to get the \`<team>/<project>\` slug, then \`orizu apps list --project <team>/<project>\`: it prints each app's full link. The --project flag is required here: prompts cannot run in this environment. Never guess a link.`
+
+/**
+ * The prompt for one session. Every project of an approved team shares the
+ * team's repository (ORI-2601; ADR-041, added in PR #2292), which starts with one project's folder, so the
+ * agent is told which project this session is for (ORI-2601).
+ */
+export function hostedAgentPrompt(projectId?: string | null): string {
+  if (!projectId) return HOSTED_AGENT_PROMPT
+  return `${HOSTED_AGENT_PROMPT}
+- This session is for the Orizu project whose id is ${projectId}. Run \`orizu projects list --json\` to find its \`<team>/<project>\` slug, and pass that whole slug as \`--project <team>/<project>\` to orizu commands. In this repository the project's files live in the folder \`projects/<project>/\`, named by the part after the slash only (for \`acme/support-bot\`, the folder is \`projects/support-bot/\`). If that folder is missing, do not create it by hand: Orizu writes a project folder with its own files (\`orizu.project.json\`, \`README.md\`, \`memory.md\`). Tell the person this project's folder is not in the workspace yet, and keep working on what they asked. Do not change another project's folder unless the person asks.`
+}

package/src/hosted-boot.ts

@@ -60,6 +60,7 @@ import {
 import { DEFAULT_EGRESS_CANARY_HOST, DEFAULT_HOSTED_MODEL } from './hosted-loop-lifecycle.js'
 import { composeHostedAnswerPrompt } from './hosted-question.js'
 import { resumeRunEventSink } from './hosted-run-event-sink.js'
+import { seedProjectFolder } from './hosted-project-folder-seed.js'
 import { stageOrizuSkill } from './hosted-skill-staging.js'
 import { openHostedLiveChannel, type HostedLiveChannel } from './hosted-live-channel.js'
 
@@ -441,6 +442,9 @@ export interface ResolvedSession {
   agentSessionId: string | null
   seedOrigin: 'team' | 'session'
   projectId: string | null
+  /** The session's own project's slug and name (ORI-2609), when the server sends them. */
+  projectSlug: string | null
+  projectName: string | null
   /** Session lifetime in minutes (from client_info), if the coordinator recorded
    *  it — used to derive the per-prompt max-duration cap (ALI-1061). */
   durationMinutes: number | null
@@ -547,6 +551,8 @@ export async function resolveSession(opts: {
     // A server with copying switched off omits seedOrigin; no source is bound.
     seedOrigin: session.seedOrigin === 'session' ? 'session' : 'team',
     projectId: asString(session.projectId),
+    projectSlug: asString(session.projectSlug),
+    projectName: asString(session.projectName),
   }
 }
 
@@ -1342,6 +1348,18 @@ const c = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
   exec('git', ['-C', workspaceDir, 'config', 'user.email', AGENT_GIT_IDENTITY.email])
   if (!wokenDisk && !sessionCopyFilled) log(`cloned ${session.repoBranch}`)
 
+  // 5a — ORI-2609: the team copy holds only the projects the team seed knew
+  // about. Write this session's project folder if it is missing, before the
+  // agent starts. Never fails the boot. A woken disk is the agent's own saved
+  // state, so a folder it removed there is not put back.
+  log(wokenDisk
+    ? 'project folder left as the woken disk has it'
+    : seedProjectFolder({
+      workTree: workspaceDir,
+      project: { id: session.projectId, slug: session.projectSlug, name: session.projectName },
+      exec: (cmd, args) => exec(cmd, args),
+    }))
+
   // 5b — Stage the orizu skill into the cloned repo so the agent discovers the
   // Orizu workflows (ALI-1059). SHARED with the operator path via `stageOrizuSkill`
   // (one resolution chain + the harvest-safe .git/info/exclude append). Non-fatal:

package/src/hosted-bootstrap-rehearsal.ts

@@ -82,6 +82,7 @@ export function brokerEnv(config: BrokerConfig): Record<string, string> {
   if (config.tokensFile) env.HB_TOKENS_FILE = config.tokensFile
   if (config.sessionId) env.HB_SESSION_ID = config.sessionId
   if (config.sessionBranch) env.HB_SESSION_BRANCH = config.sessionBranch
+  if (config.projectId) env.HB_PROJECT_ID = config.projectId
   if (config.repoTokenStatus) env.HB_REPO_TOKEN_STATUS = String(config.repoTokenStatus)
   if (config.eventsStatus) env.HB_EVENTS_STATUS = String(config.eventsStatus)
   if (config.denyWrite) env.HB_DENY_WRITE = '1'
@@ -178,6 +179,8 @@ export interface HostedBootstrapRehearsal {
   sessionId: string
   runId: string
   sessionBranch: string
+  /** The project the fake /sessions endpoint reports for the session. */
+  projectId: string
   repoFullName: string
   provider: SandboxProvider
   resolveCloneUrl: (repo: string) => string
@@ -242,6 +245,7 @@ export async function createHostedBootstrapRehearsal(
 
   const workspaceId = 'ws-hosted-1'
   const sessionId = 'sess-hosted-1'
+  const projectId = '6f1c2d3e-4b5a-4c6d-8e7f-901a2b3c4d5e'
   const runId = 'run-hosted-1'
   const sessionBranch = `orizu/session-${sessionId}`
 
@@ -280,6 +284,7 @@ export async function createHostedBootstrapRehearsal(
     fullRunApi: options.fullRunApi,
     sessionId,
     sessionBranch,
+    projectId,
   })
 
   // Real authenticated smart-HTTP git server on loopback: this is what makes the
@@ -301,6 +306,7 @@ export async function createHostedBootstrapRehearsal(
     sessionId,
     runId,
     sessionBranch,
+    projectId,
     repoFullName: repo.repoFullName,
     provider,
     resolveCloneUrl: () => cloneUrl,

package/src/hosted-broker-server.ts

@@ -70,6 +70,8 @@ export interface BrokerConfig {
    *  a pre-seeded session branch on the local bare repo). */
   sessionId?: string
   sessionBranch?: string
+  /** E2E: the project the /sessions endpoint reports, as the real route does. */
+  projectId?: string
 }
 
 export function readBrokerConfigFromEnv(env: NodeJS.ProcessEnv): BrokerConfig {
@@ -87,6 +89,7 @@ export function readBrokerConfigFromEnv(env: NodeJS.ProcessEnv): BrokerConfig {
     fullRunApi: env.HB_FULL_RUN_API === '1',
     sessionId: env.HB_SESSION_ID,
     sessionBranch: env.HB_SESSION_BRANCH,
+    projectId: env.HB_PROJECT_ID,
   }
 }
 
@@ -151,7 +154,8 @@ export function startBrokerServer(config: BrokerConfig): { port: number; stop: (
         const id = config.sessionId ?? `sess-e2e-${sessions}`
         const repoBranch = config.sessionBranch ?? `orizu/session-${id}`
         return json(
-          { session: { id, workspaceId: sessionsMatch[1], repoBranch, status: 'active' } },
+          // Like the real route, a session has a project only when the request names one.
+          { session: { id, workspaceId: sessionsMatch[1], projectId: typeof body.projectSlug === 'string' ? config.projectId ?? null : null, repoBranch, status: 'active' } },
           201
         )
       }

package/src/hosted-harness-opencode.ts

@@ -53,7 +53,7 @@ import { readFileSync } from 'fs'
 
 import { refreshHostedModels } from '../src/hosted-model-cache.mjs'
 
-import { HOSTED_AGENT_NAME, HOSTED_AGENT_PROMPT } from './hosted-agent-prompt.js'
+import { HOSTED_AGENT_NAME, hostedAgentPrompt } from './hosted-agent-prompt.js'
 import { parseModelIdentity } from './provider-registry.js'
 
 import { HARNESS_NAMES } from './hosted-harness.js'
@@ -1098,6 +1098,8 @@ export interface OpenCodeConfigOptions {
   /** OpenCode permission map; defaults to allow-all EXCEPT the headless-denied
    *  tools below (sandbox is the boundary for everything else). */
   permission?: Record<string, unknown>
+  /** The session's Orizu project, named in the agent's prompt (ORI-2601). */
+  projectId?: string | null
 }
 
 /**
@@ -1134,7 +1136,7 @@ export function buildOpenCodeConfigContent(opts: OpenCodeConfigOptions): string
     model: opts.model,
     permission: opts.permission ?? defaultHeadlessPermission(),
     // Replaces OpenCode's built-in "You are opencode…" prompt (ORI-2207).
-    agent: { [HOSTED_AGENT_NAME]: { mode: 'primary', prompt: HOSTED_AGENT_PROMPT } },
+    agent: { [HOSTED_AGENT_NAME]: { mode: 'primary', prompt: hostedAgentPrompt(opts.projectId) } },
   })
 }
 

package/src/hosted-loop-lifecycle.ts

@@ -55,6 +55,8 @@ export interface HostedLoopContext {
   taskFile: string
   /** Directory the agent operates in (the cloned session-branch workspace). */
   workspaceDir: string
+  /** The session's Orizu project, named in the agent's prompt (ORI-2601). */
+  projectId?: string | null
   /** Validated destination branch for the CLI-owned checkpoint push. */
   sessionBranch: string
   /** Credential-free repository locator established by bootstrap. */

package/src/hosted-loop.ts

@@ -674,6 +674,7 @@ export async function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedL
       spawned = await spawnImpl({
         model: context.model,
         permission: permissionForOrigin(context.sessionOrigin),
+        projectId: context.projectId,
         cwd: context.workspaceDir,
         port: context.opencodePort,
         env: buildOpenCodeSpawnEnv(context),
@@ -1063,6 +1064,7 @@ function validateHostedLoopContext(value: unknown): { context: HostedLoopContext
   if (record.sandboxBudgetMs !== undefined && (typeof record.sandboxBudgetMs !== 'number' || !Number.isFinite(record.sandboxBudgetMs) || record.sandboxBudgetMs <= 0)) fields.push('sandboxBudgetMs')
   if (record.opencodePort !== undefined && (typeof record.opencodePort !== 'number' || !Number.isInteger(record.opencodePort) || record.opencodePort <= 0 || record.opencodePort > 65_535)) fields.push('opencodePort')
   for (const name of OPTIONAL_CONTEXT_STRINGS) if (record[name] !== undefined && typeof record[name] !== 'string') fields.push(name)
+  if (record.projectId !== undefined && record.projectId !== null && !isNonemptyString(record.projectId)) fields.push('projectId')
   for (const name of ['prebaked', 'runSetupHook'] as const) if (record[name] !== undefined && typeof record[name] !== 'boolean') fields.push(name)
   return { context: fields.length === 0 ? value as HostedLoopContext : null, fields: [...new Set(fields)] }
 }

package/src/hosted-project-folder-seed.ts

@@ -0,0 +1,95 @@
+/**
+ * ORI-2609: every project of an approved team shares the team's repository,
+ * but the team seed wrote only the first project's folder. A hosted session
+ * for another project writes that project's folder into its own checkout at
+ * boot, exactly as the team seed would have, and commits it locally. The
+ * session's normal save carries the commit; nothing is pushed here.
+ *
+ * A folder that is already there, whole or partial, is never touched, so a
+ * second session never duplicates or overwrites one. Never throws: a seed
+ * failure is reported for the boot to log, and the session still starts.
+ */
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+import {
+  buildSeedContractFiles,
+  SEED_COMMIT_AUTHOR_EMAIL,
+  SEED_COMMIT_AUTHOR_NAME,
+  SEED_COMMIT_DATE,
+} from './workspace-bootstrap-seed.js'
+
+export interface ProjectFolderSeedProject {
+  id: string | null
+  slug: string | null
+  name: string | null
+}
+
+type SeedExec = (cmd: string, args: string[]) => { status: number; stdout: string; stderr: string }
+
+// One plain folder name: no separators, no traversal, no leading dot or dash.
+const SAFE_PROJECT_SLUG = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
+
+function readTeamFacts(workTree: string): { id: string; slug: string } {
+  // The team manifest the team seed wrote is the source of the team facts, so
+  // the new project's manifest agrees with the repository it lands in.
+  const manifest = JSON.parse(readFileSync(join(workTree, 'orizu.team.json'), 'utf8')) as Record<string, unknown>
+  if (typeof manifest.slug !== 'string' || manifest.slug.length === 0) {
+    throw new Error('orizu.team.json carries no team slug')
+  }
+  // The team id does not appear in project files; it is passed for completeness.
+  return { id: typeof manifest.teamId === 'string' ? manifest.teamId : '', slug: manifest.slug }
+}
+
+/** Returns the one line the boot logs. */
+export function seedProjectFolder(input: {
+  workTree: string
+  project: ProjectFolderSeedProject
+  exec: SeedExec
+}): string {
+  const { workTree, project, exec } = input
+  if (!project.id) return 'project folder skipped: the session names no project'
+  // Without the slug there is no folder name; the server leaves it out when it
+  // could not read the project.
+  if (!project.slug) return 'project folder skipped: the server sent no project slug'
+  try {
+    const slug = project.slug
+    if (!SAFE_PROJECT_SLUG.test(slug)) throw new Error('the project slug is not a plain folder name')
+    const folder = `projects/${slug}`
+    const projectsDir = join(workTree, 'projects')
+    if (existsSync(projectsDir) && !lstatSync(projectsDir).isDirectory()) {
+      throw new Error('projects/ is not a folder')
+    }
+    if (existsSync(join(workTree, folder))) return `project folder ${folder}/ already present`
+
+    // Byte-for-byte the files the team seed writes for this project.
+    const files = buildSeedContractFiles({
+      team: readTeamFacts(workTree),
+      projects: [{ id: project.id, slug, name: project.name }],
+    }).filter(file => file.path.startsWith(`${folder}/`))
+    for (const file of files) {
+      const target = join(workTree, file.path)
+      mkdirSync(dirname(target), { recursive: true })
+      writeFileSync(target, file.bytes, { mode: 0o644 })
+    }
+    // No hook the checkout's config names runs inside the boot (as in harvest).
+    // The exec seam takes no `env` option, so `env` pins the commit dates.
+    const git = (step: string, ...args: string[]) => {
+      const result = exec('env', [
+        `GIT_AUTHOR_DATE=${SEED_COMMIT_DATE}`, `GIT_COMMITTER_DATE=${SEED_COMMIT_DATE}`,
+        'git', '-C', workTree, '-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', ...args,
+      ])
+      if (result.status !== 0) throw new Error(`git ${step} failed: ${(result.stderr || result.stdout).trim()}`)
+    }
+    git('add', 'add', '--', folder)
+    // Paths after `--` commit only this folder, whatever else is staged. A fixed
+    // author, committer and date make every session that starts from the same
+    // team head produce the same commit, so two sessions' publishes share it
+    // rather than conflict on files neither of them touched.
+    git('commit', '-c', 'commit.gpgsign=false', '-c', `user.name=${SEED_COMMIT_AUTHOR_NAME}`, '-c', `user.email=${SEED_COMMIT_AUTHOR_EMAIL}`,
+      'commit', '--quiet', '--no-verify', '-m', `Add the ${slug} project folder`, '--', folder)
+    return `project folder ${folder}/ seeded`
+  } catch (error) {
+    return `project folder seed failed: ${error instanceof Error ? error.message : String(error)}`
+  }
+}

package/src/hosted-session-cli.ts

@@ -678,8 +678,9 @@ export async function startHostedSession(
         }),
     }
   )
-  const session = sessionResp.session as { id?: unknown; repoBranch?: unknown } | undefined
+  const session = sessionResp.session as { id?: unknown; repoBranch?: unknown; projectId?: unknown } | undefined
   const sessionId = requireString(session?.id, 'session id')
+  const sessionProjectId = typeof session?.projectId === 'string' && session.projectId ? session.projectId : undefined
   const sessionBranch = requireString(session?.repoBranch, 'session repoBranch')
   log(`session ${sessionId} on ${sessionBranch}`)
 
@@ -821,6 +822,7 @@ export async function startHostedSession(
     taskFile: `${paths.runDirAbs}/task.txt`,
     workspaceDir: paths.repoDirRel,
     sessionBranch,
+    projectId: sessionProjectId,
     repositoryRemote: repo.cloneUrl,
     repositoryCredentialHelper: bootstrap.credentialHelper,
     model,