orizu 0.5.47 → 0.5.49

package/src/runner-folders.ts

@@ -0,0 +1,223 @@
+import { createHash } from 'node:crypto'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Cause, Effect, Exit, Fiber, Scope } from 'effect'
+
+import { ARTIFACT_MAX_BYTES } from './artifact-pull.js'
+import { authedFetch } from './http.js'
+import { unzipRunnerArchive } from './runner-version-materialization.js'
+
+// ORI-2429: Effect owns the lifetime of the runner copies the CLI writes to
+// the temp folder (downloaded runner versions and verified snapshots). They
+// hold the customer's runner code, so the scope removes them however the run
+// ends: success, failure or a stop signal. Loaded with a dynamic import, so
+// commands that never copy a runner do not load Effect.
+
+export type RemovalGroup = 'downloads' | 'snapshots' | 'other'
+
+/** Removal failures seen while a scope closes; Effect finalizers cannot fail. */
+export class RemovalLedger {
+  readonly failures: { group: RemovalGroup; error: unknown }[] = []
+  has(group?: RemovalGroup): boolean {
+    return this.failures.some(failure => !group || failure.group === group)
+  }
+  errors(): unknown[] {
+    return this.failures.map(failure => failure.error)
+  }
+}
+
+/** Remove with `remove` when the surrounding scope closes, recording a failure. */
+export function removeOnClose(ledger: RemovalLedger, group: RemovalGroup, remove: () => void) {
+  return Effect.addFinalizer(() => Effect.sync(() => {
+    try { remove() } catch (error) { ledger.failures.push({ group, error }) }
+  }))
+}
+
+function request(path: string, signal: AbortSignal) {
+  return Effect.tryPromise({
+    try: requestSignal => authedFetch(path, { signal: AbortSignal.any([requestSignal, signal]) }),
+    catch: error => error,
+  })
+}
+
+function text(response: Response) {
+  return Effect.tryPromise({ try: () => response.text(), catch: error => error })
+}
+
+/**
+ * Download a registered runner version into a private temp folder that the
+ * caller's scope removes. A stop mid-download aborts the transfer and still
+ * removes the folder. Messages match the previous Promise implementation.
+ */
+export function downloadedRunner(runnerVersionId: string, ledger: RemovalLedger, verifyRegisteredDigest = true) {
+  return Effect.gen(function* () {
+    // Aborting on close also ends a body still streaming when a stop arrives.
+    const controller = yield* Effect.acquireRelease(
+      Effect.sync(() => new AbortController()),
+      controller => Effect.sync(() => controller.abort()),
+    )
+    let contentSha256: string | undefined
+    if (verifyRegisteredDigest) {
+      const detailResponse = yield* request(`/api/cli/runner-versions/${encodeURIComponent(runnerVersionId)}`, controller.signal)
+      if (!detailResponse.ok) return yield* Effect.fail(new Error(`Failed to resolve runner version: ${yield* text(detailResponse)}`))
+      const detail = (yield* Effect.tryPromise({ try: () => detailResponse.json(), catch: error => error })) as Record<string, unknown>
+      if (detail.runnerVersionId !== runnerVersionId || detail.status !== 'sealed'
+        || typeof detail.contentSha256 !== 'string' || !/^[0-9a-f]{64}$/u.test(detail.contentSha256)) {
+        return yield* Effect.fail(new Error('Runner version detail is invalid'))
+      }
+      contentSha256 = detail.contentSha256
+    }
+    const response = yield* request(`/api/cli/runner-versions/${encodeURIComponent(runnerVersionId)}/download`, controller.signal)
+    if (!response.ok) return yield* Effect.fail(new Error(`Failed to download runner version: ${yield* text(response)}`))
+    // The previous implementation removed the folder as soon as this runner
+    // failed, naming the runner when that removal failed too. Keep both.
+    let removed = false
+    let tempDir = ''
+    const remove = () => { if (!removed) { removed = true; rmSync(tempDir, { recursive: true, force: true }) } }
+    // Created and registered for removal in one uninterruptible step.
+    yield* Effect.acquireRelease(
+      Effect.sync(() => { tempDir = mkdtempSync(join(tmpdir(), 'orizu-runner-version-')) }),
+      () => Effect.sync(() => {
+        try { remove() } catch (error) { ledger.failures.push({ group: 'downloads', error }) }
+      }),
+    )
+    return yield* Effect.gen(function* () {
+      const zipBytes = new Uint8Array(yield* Effect.tryPromise({ try: () => response.arrayBuffer(), catch: error => error }))
+      if (zipBytes.byteLength > ARTIFACT_MAX_BYTES) return yield* Effect.fail(new Error(`Runner artifact exceeds ${ARTIFACT_MAX_BYTES} bytes`))
+      if (contentSha256 && createHash('sha256').update(zipBytes).digest('hex') !== contentSha256) {
+        return yield* Effect.fail(new Error('Runner artifact digest mismatch'))
+      }
+      const zipPath = join(tempDir, 'runner.zip'), runnerDir = join(tempDir, 'runner')
+      yield* Effect.try({ try: () => { writeFileSync(zipPath, zipBytes); unzipRunnerArchive(zipPath, runnerDir) }, catch: error => error })
+      return { runnerDir, remove }
+    }).pipe(Effect.catch(error => Effect.suspend(() => {
+      try { remove() } catch (cleanupError) {
+        return Effect.fail(new AggregateError([error, cleanupError], `Runner ${runnerVersionId} materialization failed and cleanup also failed`))
+      }
+      return Effect.fail(error)
+    })))
+  })
+}
+
+/** A Promise-returning resource (acquired whole) whose cleanup the scope runs. */
+export function heldUntilClose<A extends { cleanup: () => void }>(ledger: RemovalLedger, group: RemovalGroup, acquire: () => Promise<A>) {
+  // Acquiring stays uninterruptible: a stop waits for it to finish, so a
+  // half-created snapshot is never orphaned; the scope then removes it.
+  return Effect.acquireRelease(
+    Effect.tryPromise({ try: acquire, catch: error => error }),
+    resource => Effect.sync(() => {
+      try { resource.cleanup() } catch (error) { ledger.failures.push({ group, error }) }
+    }),
+  )
+}
+
+const STOP_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT'] as const
+// Matches the launcher's stop cap (ORI-2402): a stop never waits longer.
+const STOP_CLEANUP_WAIT_MS = 15_000
+
+export interface StopControl {
+  /** Hand stop signals to the optimizer launcher; pass this as its beforeSignalExit. */
+  readonly beforeSignalExit: () => Promise<void> | void
+  readonly launcherOwnsStop: () => void
+  readonly launcherDone: () => void
+}
+
+/**
+ * Run `program` in a scope that removes the runner copies however it ends.
+ * Before the optimizer starts, a stop signal interrupts the program (the scope
+ * closes as it unwinds) and the CLI then ends by that signal. While the
+ * launcher runs the optimizer, the launcher owns the signal and calls
+ * `beforeSignalExit`, which closes the scope synchronously: the removal then
+ * finishes even when the optimizer used up the whole stop cap.
+ */
+export async function runStoppable<A>(program: (stop: StopControl) => Effect.Effect<A, unknown, Scope.Scope>): Promise<A> {
+  const { scope, close } = openScope()
+  let launcherOwned = false
+  let stopping = false
+  // eslint-disable-next-line prefer-const -- assigned after the handlers that read it
+  let fiber: Fiber.Fiber<A, unknown>
+  const interrupt = () => Effect.runPromise(Fiber.interrupt(fiber))
+  const removeHandlers = () => { for (const entry of handlers) process.off(entry.signal, entry.handle) }
+  const handlers = STOP_SIGNALS.map(signal => ({
+    signal,
+    handle: () => {
+      if (launcherOwned || stopping) return
+      stopping = true
+      let timer: ReturnType<typeof setTimeout> | undefined
+      const expired = new Promise<void>(resolve => { timer = setTimeout(resolve, STOP_CLEANUP_WAIT_MS) })
+      void Promise.race([interrupt(), expired]).finally(() => {
+        clearTimeout(timer)
+        removeHandlers()
+        process.kill(process.pid, signal)
+      })
+    },
+  }))
+  const control: StopControl = {
+    beforeSignalExit: () => {
+      stopping = true
+      // The launcher re-sends the signal next; none of ours may catch it.
+      removeHandlers()
+      close()
+    },
+    launcherOwnsStop: () => { launcherOwned = true },
+    launcherDone: () => { launcherOwned = false },
+  }
+  for (const entry of handlers) process.on(entry.signal, entry.handle)
+  fiber = Effect.runFork(Scope.provide(scope)(program(control)).pipe(Effect.ensuring(Effect.sync(close))))
+  try {
+    const exit = await Effect.runPromise(Effect.exit(Fiber.join(fiber)))
+    // A stop ends the process by its signal; nothing more to report here.
+    if (stopping) return await new Promise<never>(() => {})
+    if (Exit.isSuccess(exit)) return exit.value
+    throw Cause.squash(exit.cause)
+  } finally {
+    removeHandlers()
+  }
+}
+
+/**
+ * For a workflow that stays a Promise (hosted optimization): a scope that a
+ * stop signal closes before the CLI ends by that signal. Before the optimizer
+ * starts our handlers do it; while the launcher runs it, the launcher calls
+ * `stop.beforeSignalExit`. Closing aborts an in-flight download and removes
+ * every registered file, folder and server; the finalizers are synchronous.
+ */
+export function stopClosesScope() {
+  const { scope, close } = openScope()
+  let launcherOwned = false
+  let stopping = false
+  const removeHandlers = () => { for (const entry of handlers) process.off(entry.signal, entry.handle) }
+  const handlers = STOP_SIGNALS.map(signal => ({
+    signal,
+    handle: () => {
+      if (launcherOwned || stopping) return
+      stopping = true
+      close()
+      removeHandlers()
+      process.kill(process.pid, signal)
+    },
+  }))
+  // Installed by the caller inside its try, so a setup throw cannot leave them behind.
+  const listen = () => { for (const entry of handlers) process.on(entry.signal, entry.handle) }
+  const stop: StopControl = {
+    beforeSignalExit: () => { stopping = true; removeHandlers(); close() },
+    launcherOwnsStop: () => { launcherOwned = true },
+    launcherDone: () => { launcherOwned = false },
+  }
+  return { scope, close, stop, listen, removeHandlers }
+}
+
+/** Open a scope for an adapter that must hand back a synchronous cleanup. */
+export function openScope() {
+  const scope = Scope.makeUnsafe()
+  let closed = false
+  return {
+    scope,
+    close: () => {
+      if (closed) return
+      closed = true
+      Effect.runSync(Scope.close(scope, Exit.void))
+    },
+  }
+}

package/src/runner-version-materialization.ts

@@ -1,13 +1,6 @@
-import { createHash } from 'node:crypto'
 import { spawnSync } from 'node:child_process'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { ARTIFACT_MAX_BYTES } from './artifact-pull.js'
-import { cleanupAll, throwWithCleanup } from './cleanup.js'
-import { authedFetch } from './http.js'
 import { sanitizeTerminalText } from './json-response.js'
-function unzip(zipPath: string, runnerDir: string): void {
+export function unzipRunnerArchive(zipPath: string, runnerDir: string): void {
   const listing = spawnSync('unzip', ['-Z1', zipPath], { encoding: 'utf8' })
   if (listing.error) throw listing.error
   if (listing.status !== 0) throw new Error(`unzip listing failed: ${sanitizeTerminalText(listing.stderr || listing.stdout || '')}`)
@@ -24,33 +17,27 @@ function unzip(zipPath: string, runnerDir: string): void {
 export async function materializeRunnerVersion(runnerVersionId: string, verifyRegisteredDigest = true): Promise<{
   runnerDir: string; cleanup: () => void
 }> {
-  let contentSha256: string | undefined
-  if (verifyRegisteredDigest) {
-    const detailResponse = await authedFetch(`/api/cli/runner-versions/${encodeURIComponent(runnerVersionId)}`)
-    if (!detailResponse.ok) throw new Error(`Failed to resolve runner version: ${await detailResponse.text()}`)
-    const detail = await detailResponse.json() as Record<string, unknown>
-    if (detail.runnerVersionId !== runnerVersionId || detail.status !== 'sealed'
-      || typeof detail.contentSha256 !== 'string' || !/^[0-9a-f]{64}$/u.test(detail.contentSha256)) {
-      throw new Error('Runner version detail is invalid')
-    }
-    contentSha256 = detail.contentSha256
-  }
-  const response = await authedFetch(`/api/cli/runner-versions/${encodeURIComponent(runnerVersionId)}/download`)
-  if (!response.ok) throw new Error(`Failed to download runner version: ${await response.text()}`)
-  const tempDir = mkdtempSync(join(tmpdir(), 'orizu-runner-version-'))
-  const cleanup = () => rmSync(tempDir, { recursive: true, force: true })
+  // ORI-2429: the download runs on Effect (runner-folders.ts); this adapter
+  // keeps the { runnerDir, cleanup } shape for the existing Promise callers.
+  const { downloadedRunner, openScope, RemovalLedger } = await import('./runner-folders.js')
+  const { Effect, Scope } = await import('effect')
+  const ledger = new RemovalLedger()
+  const { scope, close } = openScope()
   try {
-    const zipBytes = new Uint8Array(await response.arrayBuffer())
-    if (zipBytes.byteLength > ARTIFACT_MAX_BYTES) throw new Error(`Runner artifact exceeds ${ARTIFACT_MAX_BYTES} bytes`)
-    if (contentSha256 && createHash('sha256').update(zipBytes).digest('hex') !== contentSha256) throw new Error('Runner artifact digest mismatch')
-    const zipPath = join(tempDir, 'runner.zip'), runnerDir = join(tempDir, 'runner')
-    writeFileSync(zipPath, zipBytes)
-    unzip(zipPath, runnerDir)
-    return { runnerDir, cleanup }
+    const { runnerDir } = await Effect.runPromise(
+      downloadedRunner(runnerVersionId, ledger, verifyRegisteredDigest).pipe(Effect.provideService(Scope.Scope, scope))
+    )
+    return {
+      runnerDir,
+      cleanup: () => {
+        close()
+        const [failure] = ledger.errors()
+        if (failure !== undefined) throw failure
+      },
+    }
   } catch (error) {
-    throwWithCleanup(error, [cleanup], `Runner ${runnerVersionId} materialization failed and cleanup also failed`)
+    // downloadedRunner already removed this runner's folder on its own failure.
+    close()
+    throw error
   }
 }
-export function cleanupMaterializedRunners(cleanups: Array<() => void>): void {
-  cleanupAll(cleanups, 'Failed to clean materialized runner directories')
-}

package/src/session-publish.ts

@@ -0,0 +1,127 @@
+/** ORI-2653: `orizu session publish`. In a hosted session, `git push` reaches
+ * only the session's own copy; this command saves the work there, then asks the
+ * web app to merge that commit into the team's main (the publish merge job app
+ * publishing already uses). It says "Published" only when the merge landed. */
+import { spawnSync } from 'node:child_process'
+
+import { isValidCloudflareArtifactsGitRemote } from './cloudflare-artifacts-git-remote.js'
+import { authedFetch } from './http.js'
+import { sanitizeTerminalText } from './json-response.js'
+import { findWorkspaceRoot } from './workspace.js'
+
+const DEFAULT_MESSAGE = 'Publish from session'
+// The web app waits up to 100 s for the merge; leave room for the reply.
+const PUBLISH_TIMEOUT_MS = 170_000
+// The codes the publish route words itself; their text already says what to do.
+const PUBLISH_CODES = new Set(['publish_conflict', 'publish_race_lost', 'publish_still_running', 'publish_denied', 'publish_unavailable', 'publish_failed'])
+const CHECK_AGAIN = 'It may have landed: wait a moment, then run `orizu session publish` again to check.'
+
+export interface SessionPublishIo {
+  json: boolean
+  print: (line: string) => void
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function loadAppPublishWorkspace() {
+  return import('./app-publish-workspace.js')
+}
+
+/** Every answer that is not a confirmed merge: its text already leads with
+ * "Not published" or "Not confirmed" and ends with what to do. */
+function refuse(io: SessionPublishIo, text: string, code: string): number {
+  const safe = sanitizeTerminalText(text)
+  io.print(io.json ? JSON.stringify({ error: safe, code }) : safe)
+  return 1
+}
+
+/** True when `origin` is this session's own Artifacts copy. In an older
+ * GitHub-backed session `origin` is the team's repository itself, where a push
+ * of main would skip the merge and its checks. Reads the configured URL, not
+ * one rewritten by git's `insteadOf`. */
+function originIsThisSessionCopy(root: string, sessionId: string): boolean {
+  const read = spawnSync('git', ['config', '--get', 'remote.origin.url'], { cwd: root, encoding: 'utf8' })
+  const remote = read.status === 0 ? read.stdout.trim() : ''
+  return isValidCloudflareArtifactsGitRemote(remote) &&
+    new URL(remote).pathname.endsWith(`/hosted-session-${sessionId.replaceAll('-', '')}.git`)
+}
+
+export async function runSessionPublish(io: SessionPublishIo, options: { message?: string | null } = {}): Promise<number> {
+  const sessionId = process.env.ORIZU_SESSION_ID?.trim()
+  const root = sessionId ? findWorkspaceRoot(process.cwd()) : null
+  if (!sessionId || !root) {
+    return refuse(io, 'Not published: orizu session publish runs inside a hosted session, from its workspace. In your own clone, push to your team repository instead.', 'publish_not_hosted')
+  }
+  if (!originIsThisSessionCopy(root, sessionId)) {
+    return refuse(io, "Not published: this workspace's origin is not this session's own copy, so publishing from here could write to the team's repository directly. Stop and tell the user.", 'publish_not_session_copy')
+  }
+
+  const { addTeamCopyRemote, pushSessionCopy } = await loadAppPublishWorkspace()
+  let pushed: { sha: string; committed: string[] }
+  try {
+    pushed = await pushSessionCopy(root, options.message?.trim() || DEFAULT_MESSAGE)
+  } catch (error) {
+    return refuse(io, `Not published: ${error instanceof Error ? error.message : String(error)}`, 'publish_not_sent')
+  }
+
+  let response: Response
+  let text: string
+  try {
+    response = await authedFetch(`/api/cli/sessions/${encodeURIComponent(sessionId)}/publish`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ sessionCommitSha: pushed.sha }),
+      signal: AbortSignal.timeout(PUBLISH_TIMEOUT_MS),
+    })
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error)
+    return refuse(io, `Not confirmed: could not reach Orizu (${reason}). Your work is saved in this session's copy. ${CHECK_AGAIN}`, 'publish_unreachable')
+  }
+  try {
+    text = await response.text()
+  } catch (error) {
+    // The merge may have run before the answer was cut off.
+    const reason = error instanceof Error ? error.message : String(error)
+    return refuse(io, `Not confirmed: could not read the answer from Orizu (${reason}). Your work is saved in this session's copy. ${CHECK_AGAIN}`, 'publish_unreachable')
+  }
+  let body: unknown = null
+  try {
+    body = JSON.parse(text)
+  } catch {
+    // An answer that is not JSON is reported below as it came.
+  }
+
+  if (response.ok && isRecord(body) && (body.outcome === 'merged' || body.outcome === 'already_merged') && typeof body.sha === 'string') {
+    const sha = sanitizeTerminalText(body.sha)
+    if (io.json) {
+      io.print(JSON.stringify({ outcome: body.outcome, sha }))
+    } else if (body.outcome === 'merged') {
+      const files = pushed.committed.map(file => `\n  ${sanitizeTerminalText(file)}`).join('')
+      io.print(`Published: merged into the team's main as ${sha.slice(0, 7)}. New sessions on this project will see it.${files ? `\nCommitted first:${files}` : ''}`)
+    } else {
+      io.print(`Already on the team's main (${sha.slice(0, 7)}). Nothing new to publish.`)
+    }
+    return 0
+  }
+
+  if (isRecord(body) && typeof body.error === 'string' && typeof body.code === 'string' && PUBLISH_CODES.has(body.code)) {
+    const code = body.code
+    let message = body.error
+    if (code === 'publish_conflict') {
+      const remoteNote = await addTeamCopyRemote(root)
+      // Its own line: the recovery line above must stay a runnable command.
+      if (remoteNote) message = `${message}\n${remoteNote}`
+    }
+    return refuse(io, message, code)
+  }
+  // Any other answer is not worded for this command. A 4xx refused the request
+  // before any merge; a 5xx, or a 2xx that is not the route's answer, may have
+  // come after one.
+  const said = sanitizeTerminalText(isRecord(body) && typeof body.error === 'string' ? body.error : text.slice(0, 300))
+  if (response.status >= 400 && response.status < 500) {
+    return refuse(io, `Not published: Orizu refused the request (${response.status}: ${said}). Stop and tell the user.`, `http_${response.status}`)
+  }
+  return refuse(io, `Not confirmed: Orizu answered ${response.status} (${said}). ${CHECK_AGAIN}`, `http_${response.status}`)
+}

package/src/skilled-proposer-launch.ts

@@ -54,6 +54,29 @@ const STOP_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT'] as const
 // status write); past this it is killed so nothing is left running (ORI-2402).
 const CHILD_STOP_WAIT_MS = 15_000
 
+export interface SkilledProposerStopOptions {
+  /**
+   * Runs once the optimizer has exited after a stop signal, just before the
+   * CLI ends by that signal (ORI-2429: the caller removes its runner copies).
+   * It gets whatever is left of CHILD_STOP_WAIT_MS since the signal; a hook
+   * still running then is abandoned so the stop cannot hang. A synchronous
+   * hook always runs to the end, even with no time left.
+   */
+  beforeSignalExit?: () => Promise<void> | void
+}
+
+// Wait for `hook` at most until `deadline`; its failure never blocks the exit.
+async function runBeforeSignalExit(hook: SkilledProposerStopOptions['beforeSignalExit'], deadline: number): Promise<void> {
+  if (!hook) return
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const expired = new Promise<void>(resolve => { timer = setTimeout(resolve, Math.max(0, deadline - Date.now())) })
+  try {
+    await Promise.race([Promise.resolve().then(hook).catch(() => {}), expired])
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
 /**
  * Run the optimizer, passing a stop signal on to it. On a stop signal the CLI
  * waits until the optimizer exits (capped at CHILD_STOP_WAIT_MS, then kills
@@ -63,11 +86,13 @@ export async function spawnSkilledProposerChild(
   command: string, args: string[], engine: GepaEngine, environment: NodeJS.ProcessEnv,
   onSpawn?: () => Promise<void>,
   output?: SkilledProposerChildOutput,
+  stopOptions: SkilledProposerStopOptions = {},
 ) {
   const childEnvironment = { ...environment }
   let child: ReturnType<typeof spawn> | PipedChild | undefined
   let cleanup = () => {}
   let stopSignal: NodeJS.Signals | undefined
+  let stopDeadline = 0
   // On the terminal path the optimizer leads its own process group, so a stop
   // also reaches its runners, which may run in worker threads it can't stop.
   let childGroup: number | undefined
@@ -79,10 +104,16 @@ export async function spawnSkilledProposerChild(
   }
   let giveUp: ReturnType<typeof setTimeout> | undefined
   const removeHandlers = () => { for (const entry of handlers) process.off(entry.signal, entry.handle) }
-  const endBySignal = (signal: NodeJS.Signals): Promise<never> => {
+  let ending = false
+  const endBySignal = async (signal: NodeJS.Signals): Promise<never> => {
+    if (ending) return new Promise<never>(() => {})
+    ending = true
     if (giveUp) clearTimeout(giveUp)
-    removeHandlers()
     cleanup()
+    // Our handlers stay installed during the caller's cleanup, so a second
+    // Ctrl-C then is absorbed instead of ending the CLI by default mid-cleanup.
+    await runBeforeSignalExit(stopOptions.beforeSignalExit, stopDeadline)
+    removeHandlers()
     // With our handlers gone, the signal's default action ends the process.
     process.kill(process.pid, signal)
     return new Promise<never>(() => {})
@@ -90,6 +121,7 @@ export async function spawnSkilledProposerChild(
   const handlers = STOP_SIGNALS.map(signal => ({
     signal,
     handle: () => {
+      if (!stopDeadline) stopDeadline = Date.now() + CHILD_STOP_WAIT_MS
       if (!child) { void endBySignal(signal); return }
       forward(signal)
       if (stopSignal) return
@@ -104,6 +136,8 @@ export async function spawnSkilledProposerChild(
   try {
     cleanup = materializeConfigPayload(engine, childEnvironment) ?? cleanup
     await new Promise<void>(resolve => setImmediate(resolve))
+    // A stop before the optimizer starts ends the CLI (endBySignal); never start it then.
+    if (stopDeadline) return await new Promise<never>(() => {})
     let result: { status: number | null, error?: Error }
     if (output) {
       result = await runPipedChild(
@@ -112,7 +146,11 @@ export async function spawnSkilledProposerChild(
         childEnvironment,
         async () => { await onSpawn?.() },
         output,
-        spawnedChild => { child = spawnedChild }
+        spawnedChild => {
+          child = spawnedChild
+          // Stopped while the output sinks were prepared: the CLI is ending.
+          if (stopDeadline && !stopSignal) spawnedChild.kill('SIGKILL')
+        }
       )
     } else {
       // stdin is not passed on: a process outside the terminal's foreground

package/src/workbench-cli.ts

@@ -336,6 +336,7 @@ const SESSION_START_OPTIONS = new Set([
   '--session',
   '--json',
 ])
+const SESSION_PUBLISH_OPTIONS = new Set(['--message', '--json'])
 const WORKBENCH_VALUE_OPTIONS = new Set([
   '--after',
   '--interval',
@@ -1221,7 +1222,7 @@ function terminalStatusForCommand(command: string): string | null {
 }
 
 const USAGE_LINE =
-  'Usage: orizu session <start|status|end|finish> ... | orizu run <start|status|tail|complete|fail|cancel> ...  (run tail --once drains all currently persisted events, then exits without following)'
+  'Usage: orizu session <start|status|end|finish|publish> ... | orizu run <start|status|tail|complete|fail|cancel> ...  (run tail --once drains all currently persisted events, then exits without following)'
 
 // In --json mode ANY command failure — bad usage, or an operational failure
 // such as a 401/403/404/409/network error surfaced by assertOk — must still
@@ -1268,6 +1269,18 @@ async function dispatchWorkbenchCommand(args: string[], io: WorkbenchCommandIo):
     // `--workspace <dir>`: the workbench clone directory when the command is
     // not run from inside it (defaults to cwd).
     const workspaceDir = argValue(args, '--workspace') ?? undefined
+    if (subcommand === 'publish') {
+      const unknownOption = findUnknownOption(args, SESSION_PUBLISH_OPTIONS, WORKBENCH_VALUE_OPTIONS)
+      if (unknownOption) {
+        return emitJsonError(io, `unknown option ${unknownOption}\nUsage: orizu session publish [--message <text>] [--json]`)
+      }
+      const stray = positional[2]
+      if (stray !== undefined) {
+        return emitJsonError(io, `unexpected argument ${stray}\nUsage: orizu session publish [--message <text>] [--json]`)
+      }
+      const { runSessionPublish } = await import('./session-publish.js')
+      return runSessionPublish(io, { message: argValue(args, '--message') })
+    }
     if (subcommand === 'start') {
       const unknownOption = findUnknownOption(args, SESSION_START_OPTIONS, WORKBENCH_VALUE_OPTIONS)
       if (unknownOption) {

package/vendor/skills/orizu/references/authority-map.md

@@ -10,7 +10,7 @@ This is the single source of truth for who runs each action. Replace placeholder
 | Local agent under the user's token | Workflow | Survey the customer codebase, resolve state, prepare the plan, files, manifests, diffs, and evidence, then ask the human to ratify the workflow design. | The human moments are plan ratification and execution of all production/default pointer moves. |
 | Local agent under the user's token | Catalog mutations and pointer preparation | After plan ratification, pull instruction material from the customer codebase and run `orizu instructions create <manifest> --project <team/project>`, `orizu instructions push <manifest> --project <team/project> --set <slug-or-exact-name>`, shape add/remove before first promotion, archive/restore itself under the user's token. For pointer changes, gather only read-only resolution and binding evidence, prepare the exact commands, then hand them off. | Per the Micro-round 3 custody ruling, a human admin or curator using a user token executes every runner default-label move, optimizer-label move, scorer production-label move, profile promote/rollback, default move, and labeled optimization promotion on every surface. |
 | Hosted session | Start and scope | Use the pre-authenticated CLI from `ORIZU_TOKEN_FILE` and `ORIZU_BASE_URL`; resolve only the session's signed team with `orizu teams list`, then list or create projects only within it. Run `orizu projects create --name "<project name>" --team <signed-team>` when needed. | Team creation is platform-enforced human-only. Hand off: `orizu teams create --name "<team name>"`, then ask the human to start a new hosted session scoped to that team; the current session cannot switch teams. |
-| Hosted session | Team-wide curator work | While the hosted session is active and its kill switch is clear, perform setup plus ordinary curator reads and writes within the signed team. Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>` and `orizu instructions sync <set> --project <team/project> --out <app-root>`; synced material lands under `<app-root>/orizu/`. For git-canonical judges, scorers, runners, and optimizers, write with `--session <session-id>`, keep bytes as commits on the session branch, then verify with `git ls-files <path>` and inspect the commit. | The agent executes this work; an Orizu version id alone is not proof of committed bytes. Signed-project exceptions are in the next row. |
+| Hosted session | Team-wide curator work | While the hosted session is active and its kill switch is clear, perform setup plus ordinary curator reads and writes within the signed team. Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>` and `orizu instructions sync <set> --project <team/project> --out <app-root>`; synced material lands under `<app-root>/orizu/`. For git-canonical judges, scorers, runners, and optimizers, write with `--session <session-id>`, keep bytes as commits on the session branch, then verify with `git ls-files <path>` and inspect the commit. Run `orizu session publish` to put committed work on the team's main; `git push` reaches only the session's copy. | The agent executes this work; an Orizu version id alone is not proof of committed bytes. Signed-project exceptions are in the next row. |
 | Hosted session | Signed-project work | Run optimization mutations only for the JWT's project, keep git-canonical draft writes on that session and project, and read diff comments only for that project. | Sibling-project optimization mutations, draft writes, and diff-comment reads are out of scope even where ordinary curator access is team-wide. |
 | Hosted session | Materialize an instruction set | When the survey finds only a candidate seed, turn it into the complete manifest. | ADR-008 requires a human curator using a local CLI user token. Create/push are hosted CLI route-enforced; direct RPC remains agent-writable and is a fix-forward gap. Hand off `orizu instructions create <manifest> --project <team/project>` for a fresh set, or `orizu instructions push <manifest> --project <team/project> --set <slug-or-exact-name>` for an existing set. Their measured 403 is `Sessionless registration is not available to the hosted agent: this artifact class is git-canonical (ADR-007) and its bytes must be committed to the session branch. Re-run with --session <session-id>.` Neither create nor push accepts `--session`. |
 | Hosted session | Profiles and component shape | Run `orizu instructions profiles new <set> --project <team/project> --model-config <identity>`, `orizu instructions shape add <set> --project <team/project> --key <key> --from <manifest>`, and `orizu instructions shape remove <set> --project <team/project> --key <key>` with team-scoped curator authority. Shape add/remove works only until the first promotion of any profile, creates unpromoted profile heads, and does not move pointers. First promotion permanently freezes the shape, and sets that existed when this rule shipped are frozen too; a changed frozen shape requires a new instruction set. | A human admin or curator with `can_manage_project` runs every profile promote/rollback, instruction-set default move, and other production/default pointer move. |

package/vendor/skills/orizu/references/building-apps.md

@@ -1620,7 +1620,7 @@ In a hosted session, `orizu apps create` and `orizu apps update` publish through
 
 Edit an existing app in its folder and pass those files to `apps update`. A new app can live anywhere until `apps create` places it.
 
-The merge includes all earlier committed work on the session branch, including files outside the app folder. Review that work before publishing. Unrelated uncommitted work stays local. A conflict may name files outside the app folder; resolve and commit those files too.
+The merge includes all earlier committed work on the session branch, including files outside the app folder. Review that work before publishing. Unrelated uncommitted work stays local. To publish work that is not an app (notes, memory, other files), use `orizu session publish` (see [cli-reference.md](cli-reference.md#publishing-hosted-work)). A conflict may name files outside the app folder; resolve and commit those files too.
 
 When a hosted `apps create` or `apps update` stops after its folder is known, its error prints `App ID`, `Folder`, and a full `Retry` command. Keep that ID and folder. After all three app files have been written, the retry uses safe canonical files, preserving committed conflict resolutions. If the attempt stops before all three files are written, the retry keeps the original input paths. Both retries preserve the selected server. After following the error's instructions, run the printed retry command; create keeps its original `--id`, and update keeps its `--app`. This also applies when the push is rejected, the API refuses the create, or the merge is still running. The files and commits already made stay in the workspace; a refused push has not sent them to the server.
 

package/vendor/skills/orizu/references/cli-reference.md

@@ -35,6 +35,22 @@ Behavior:
 - PAT authorization follows the owning user's current team/project roles, so demotion or removal takes effect without rotating the token.
 - A hosted session is pre-authenticated via `ORIZU_TOKEN_FILE` (no `orizu login` needed); an explicit `ORIZU_TOKEN` env var overrides both the token file and stored credentials when set.
 
+### Publishing hosted work
+
+In a hosted session, `git push` and the automatic save reach only the session's own copy of the team repository. Run this to put the work on the team's main:
+
+```bash
+orizu session publish [--message <text>] [--json]
+```
+
+- It commits any uncommitted work (the staged Orizu skill links are left out), pushes the session's copy, then merges it into the team's main. New sessions on the project start from that main. The merge includes all earlier committed work on the session branch, including the automatic saves; review that work before publishing.
+- It prints `Published: merged into the team's main as <sha>` or `Already on the team's main (<sha>)` only when the work is there. Never tell the user work is published without one of those lines.
+- Anything else starts with `Not published:` (the work cannot have landed) or `Not confirmed:` (it may have), and ends with what to do:
+  - **Conflict** (names the files): run the printed `Recovery` command, resolve those files, commit, then run `orizu session publish` again.
+  - **Session copy has commits this workspace does not**: run `git pull --no-rebase --no-edit`, then publish again.
+  - **Not confirmed, or other publishes landed first**: wait a moment and publish again; a merge that landed answers `Already on the team's main`.
+  - **Stop and tell the user**: the session ended, the team paused agents, publishing is not available for this session, or the workspace's origin is not the session's own copy.
+
 ### Product feedback
 
 ```bash