orizu 0.5.48 → 0.5.49

package/dist/runner-version-materialization.js

@@ -1,13 +1,6 @@
-import { createHash } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { ARTIFACT_MAX_BYTES } from './artifact-pull.js';
-import { cleanupAll, throwWithCleanup } from './cleanup.js';
-import { authedFetch } from './http.js';
 import { sanitizeTerminalText } from './json-response.js';
-function unzip(zipPath, runnerDir) {
+export function unzipRunnerArchive(zipPath, runnerDir) {
     const listing = spawnSync('unzip', ['-Z1', zipPath], { encoding: 'utf8' });
     if (listing.error)
         throw listing.error;
@@ -27,38 +20,27 @@ function unzip(zipPath, runnerDir) {
         throw new Error(`unzip failed: ${sanitizeTerminalText(result.stderr || result.stdout || '')}`);
 }
 export async function materializeRunnerVersion(runnerVersionId, verifyRegisteredDigest = true) {
-    let contentSha256;
-    if (verifyRegisteredDigest) {
-        const detailResponse = await authedFetch(`/api/cli/runner-versions/${encodeURIComponent(runnerVersionId)}`);
-        if (!detailResponse.ok)
-            throw new Error(`Failed to resolve runner version: ${await detailResponse.text()}`);
-        const detail = await detailResponse.json();
-        if (detail.runnerVersionId !== runnerVersionId || detail.status !== 'sealed'
-            || typeof detail.contentSha256 !== 'string' || !/^[0-9a-f]{64}$/u.test(detail.contentSha256)) {
-            throw new Error('Runner version detail is invalid');
-        }
-        contentSha256 = detail.contentSha256;
-    }
-    const response = await authedFetch(`/api/cli/runner-versions/${encodeURIComponent(runnerVersionId)}/download`);
-    if (!response.ok)
-        throw new Error(`Failed to download runner version: ${await response.text()}`);
-    const tempDir = mkdtempSync(join(tmpdir(), 'orizu-runner-version-'));
-    const cleanup = () => rmSync(tempDir, { recursive: true, force: true });
+    // ORI-2429: the download runs on Effect (runner-folders.ts); this adapter
+    // keeps the { runnerDir, cleanup } shape for the existing Promise callers.
+    const { downloadedRunner, openScope, RemovalLedger } = await import('./runner-folders.js');
+    const { Effect, Scope } = await import('effect');
+    const ledger = new RemovalLedger();
+    const { scope, close } = openScope();
     try {
-        const zipBytes = new Uint8Array(await response.arrayBuffer());
-        if (zipBytes.byteLength > ARTIFACT_MAX_BYTES)
-            throw new Error(`Runner artifact exceeds ${ARTIFACT_MAX_BYTES} bytes`);
-        if (contentSha256 && createHash('sha256').update(zipBytes).digest('hex') !== contentSha256)
-            throw new Error('Runner artifact digest mismatch');
-        const zipPath = join(tempDir, 'runner.zip'), runnerDir = join(tempDir, 'runner');
-        writeFileSync(zipPath, zipBytes);
-        unzip(zipPath, runnerDir);
-        return { runnerDir, cleanup };
+        const { runnerDir } = await Effect.runPromise(downloadedRunner(runnerVersionId, ledger, verifyRegisteredDigest).pipe(Effect.provideService(Scope.Scope, scope)));
+        return {
+            runnerDir,
+            cleanup: () => {
+                close();
+                const [failure] = ledger.errors();
+                if (failure !== undefined)
+                    throw failure;
+            },
+        };
     }
     catch (error) {
-        throwWithCleanup(error, [cleanup], `Runner ${runnerVersionId} materialization failed and cleanup also failed`);
+        // downloadedRunner already removed this runner's folder on its own failure.
+        close();
+        throw error;
     }
 }
-export function cleanupMaterializedRunners(cleanups) {
-    cleanupAll(cleanups, 'Failed to clean materialized runner directories');
-}

package/dist/skilled-proposer-launch.d.ts

@@ -23,12 +23,22 @@ export interface SkilledProposerChildOutput {
     stdout: (chunk: string) => void;
     stderr: (chunk: string) => void;
 }
+export interface SkilledProposerStopOptions {
+    /**
+     * Runs once the optimizer has exited after a stop signal, just before the
+     * CLI ends by that signal (ORI-2429: the caller removes its runner copies).
+     * It gets whatever is left of CHILD_STOP_WAIT_MS since the signal; a hook
+     * still running then is abandoned so the stop cannot hang. A synchronous
+     * hook always runs to the end, even with no time left.
+     */
+    beforeSignalExit?: () => Promise<void> | void;
+}
 /**
  * Run the optimizer, passing a stop signal on to it. On a stop signal the CLI
  * waits until the optimizer exits (capped at CHILD_STOP_WAIT_MS, then kills
  * it) and then ends by that same signal.
  */
-export declare function spawnSkilledProposerChild(command: string, args: string[], engine: GepaEngine, environment: NodeJS.ProcessEnv, onSpawn?: () => Promise<void>, output?: SkilledProposerChildOutput): Promise<{
+export declare function spawnSkilledProposerChild(command: string, args: string[], engine: GepaEngine, environment: NodeJS.ProcessEnv, onSpawn?: () => Promise<void>, output?: SkilledProposerChildOutput, stopOptions?: SkilledProposerStopOptions): Promise<{
     status: number | null;
     error?: Error;
 }>;

package/dist/skilled-proposer-launch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skilled-proposer-launch.d.ts","sourceRoot":"","sources":["../src/skilled-proposer-launch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAO3D,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,oBAAoB,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAClC;AACD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,CAAC,EAAE,yBAAyB,CAAA;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAsBD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EACnF,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC7B,MAAM,CAAC,EAAE,0BAA0B;YA0CX,MAAM,GAAG,IAAI;YAAU,KAAK;GAkDrD;AAwCD,UAAU,aAAa;IAAG,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE;AAQ9F,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,UAAQ,GAAG,MAAM,CAepF;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,qBAAqB,CAyBvB"}
+{"version":3,"file":"skilled-proposer-launch.d.ts","sourceRoot":"","sources":["../src/skilled-proposer-launch.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAO3D,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,oBAAoB,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAClC;AACD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,CAAC,EAAE,yBAAyB,CAAA;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAsBD,MAAM,WAAW,0BAA0B;IACzC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC9C;AAcD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EACnF,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC7B,MAAM,CAAC,EAAE,0BAA0B,EACnC,WAAW,GAAE,0BAA+B;YAoDpB,MAAM,GAAG,IAAI;YAAU,KAAK;GAsDrD;AAwCD,UAAU,aAAa;IAAG,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE;AAQ9F,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,UAAQ,GAAG,MAAM,CAepF;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,qBAAqB,CAyBvB"}

package/dist/skilled-proposer-launch.js

@@ -27,16 +27,30 @@ const STOP_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT'];
 // The optimizer marks its run stopped before exiting (at most 10 s for the
 // status write); past this it is killed so nothing is left running (ORI-2402).
 const CHILD_STOP_WAIT_MS = 15_000;
+// Wait for `hook` at most until `deadline`; its failure never blocks the exit.
+async function runBeforeSignalExit(hook, deadline) {
+    if (!hook)
+        return;
+    let timer;
+    const expired = new Promise(resolve => { timer = setTimeout(resolve, Math.max(0, deadline - Date.now())); });
+    try {
+        await Promise.race([Promise.resolve().then(hook).catch(() => { }), expired]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * Run the optimizer, passing a stop signal on to it. On a stop signal the CLI
  * waits until the optimizer exits (capped at CHILD_STOP_WAIT_MS, then kills
  * it) and then ends by that same signal.
  */
-export async function spawnSkilledProposerChild(command, args, engine, environment, onSpawn, output) {
+export async function spawnSkilledProposerChild(command, args, engine, environment, onSpawn, output, stopOptions = {}) {
     const childEnvironment = { ...environment };
     let child;
     let cleanup = () => { };
     let stopSignal;
+    let stopDeadline = 0;
     // On the terminal path the optimizer leads its own process group, so a stop
     // also reaches its runners, which may run in worker threads it can't stop.
     let childGroup;
@@ -56,11 +70,18 @@ export async function spawnSkilledProposerChild(command, args, engine, environme
     let giveUp;
     const removeHandlers = () => { for (const entry of handlers)
         process.off(entry.signal, entry.handle); };
-    const endBySignal = (signal) => {
+    let ending = false;
+    const endBySignal = async (signal) => {
+        if (ending)
+            return new Promise(() => { });
+        ending = true;
         if (giveUp)
             clearTimeout(giveUp);
-        removeHandlers();
         cleanup();
+        // Our handlers stay installed during the caller's cleanup, so a second
+        // Ctrl-C then is absorbed instead of ending the CLI by default mid-cleanup.
+        await runBeforeSignalExit(stopOptions.beforeSignalExit, stopDeadline);
+        removeHandlers();
         // With our handlers gone, the signal's default action ends the process.
         process.kill(process.pid, signal);
         return new Promise(() => { });
@@ -68,6 +89,8 @@ export async function spawnSkilledProposerChild(command, args, engine, environme
     const handlers = STOP_SIGNALS.map(signal => ({
         signal,
         handle: () => {
+            if (!stopDeadline)
+                stopDeadline = Date.now() + CHILD_STOP_WAIT_MS;
             if (!child) {
                 void endBySignal(signal);
                 return;
@@ -87,9 +110,17 @@ export async function spawnSkilledProposerChild(command, args, engine, environme
     try {
         cleanup = materializeConfigPayload(engine, childEnvironment) ?? cleanup;
         await new Promise(resolve => setImmediate(resolve));
+        // A stop before the optimizer starts ends the CLI (endBySignal); never start it then.
+        if (stopDeadline)
+            return await new Promise(() => { });
         let result;
         if (output) {
-            result = await runPipedChild(command, args, childEnvironment, async () => { await onSpawn?.(); }, output, spawnedChild => { child = spawnedChild; });
+            result = await runPipedChild(command, args, childEnvironment, async () => { await onSpawn?.(); }, output, spawnedChild => {
+                child = spawnedChild;
+                // Stopped while the output sinks were prepared: the CLI is ending.
+                if (stopDeadline && !stopSignal)
+                    spawnedChild.kill('SIGKILL');
+            });
         }
         else {
             // stdin is not passed on: a process outside the terminal's foreground

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.48",
+  "version": "0.5.49",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",

package/scripts/build-cli-dist.mjs

@@ -1,5 +1,5 @@
 import { existsSync, rmSync } from 'node:fs'
-import { spawnSync } from 'node:child_process'
+import { spawn } from 'node:child_process'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -20,11 +20,49 @@ if (!isOrizuSourceCheckout(resolve(repoRoot, 'package.json'))) {
   process.exit(0)
 }
 
-const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
-// Delete old compiler output first: npm pack must never retain a module whose
-// TypeScript source was renamed or removed since the previous build.
-rmSync(resolve(cliRoot, 'dist'), { recursive: true, force: true })
-const result = spawnSync(npm, ['run', 'build'], { cwd: cliRoot, stdio: 'inherit' })
-if (result.status !== 0) {
-  throw new Error(`Unable to build CLI dist before packing: ${result.error?.message || 'npm run build failed'}`)
+// ORI-2425: in a source checkout Effect owns the build's lifetime. The build
+// runs in its own process group, so a stop of the pack (SIGTERM from a
+// cancelled job or a test timeout, or Ctrl-C) ends the compiler too, and the
+// script then ends by that signal. The published branch above never loads it.
+const { Effect } = await import('effect')
+const isWindows = process.platform === 'win32'
+const npm = isWindows ? 'npm.cmd' : 'npm'
+const buildFailed = message => new Error(`Unable to build CLI dist before packing: ${message}`)
+const build = Effect.callback(resume => {
+  // stdin is not passed on: a process group outside the terminal's foreground would be stopped reading it.
+  // Windows has no process groups (and detached opens a console), so there it stays attached.
+  const child = spawn(npm, ['run', 'build'], { cwd: cliRoot, stdio: ['ignore', 'inherit', 'inherit'], detached: !isWindows })
+  child.once('error', error => resume(Effect.fail(buildFailed(error.message))))
+  child.once('close', status => resume(status === 0 ? Effect.void : Effect.fail(buildFailed('npm run build failed'))))
+  // Interrupted: end the whole build group; the next pack rebuilds dist anyway.
+  return Effect.sync(() => {
+    try { if (isWindows) child.kill(); else process.kill(-child.pid, 'SIGKILL') } catch { /* already gone */ }
+  })
+})
+
+const STOP_SIGNALS = ['SIGINT', 'SIGTERM']
+const controller = new AbortController()
+let stopSignal
+const handlers = STOP_SIGNALS.map(signal => [signal, () => { stopSignal ??= signal; controller.abort() }])
+for (const [signal, handler] of handlers) process.on(signal, handler)
+// npm stops a pack by signalling only the shell running prepack; this script
+// is then re-parented and gets no signal. A changed parent means the pack is
+// gone, so stop the same way.
+const parentAtStart = process.ppid
+const parentWatch = setInterval(() => {
+  if (process.ppid !== parentAtStart) { stopSignal ??= 'SIGTERM'; controller.abort() }
+}, 200)
+let failure
+try {
+  // Delete old compiler output first: npm pack must never retain a module whose
+  // TypeScript source was renamed or removed since the previous build.
+  rmSync(resolve(cliRoot, 'dist'), { recursive: true, force: true })
+  await Effect.runPromise(build, { signal: controller.signal })
+} catch (error) {
+  failure = error
+} finally {
+  clearInterval(parentWatch)
+  for (const [signal, handler] of handlers) process.off(signal, handler)
 }
+if (stopSignal) process.kill(process.pid, stopSignal)
+else if (failure) throw failure

package/scripts/vendor-orizu-skill.mjs

@@ -1,4 +1,4 @@
-import { cpSync, existsSync, mkdirSync, rmSync } from 'node:fs'
+import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, renameSync, rmSync } from 'node:fs'
 import { dirname, isAbsolute, relative, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -32,9 +32,20 @@ function shouldCopyPath(sourcePath) {
   ) && !rel.endsWith('.pyc') && !rel.endsWith('.pyo')
 }
 
+const STAGING_PREFIX = '.orizu-staging-'
+// A pack killed outright leaves its staging folder next to the vendored skill.
+function removeStaleStaging() {
+  const vendorParent = dirname(vendorRoot)
+  if (!existsSync(vendorParent)) return
+  for (const name of readdirSync(vendorParent)) {
+    if (name.startsWith(STAGING_PREFIX)) rmSync(resolve(vendorParent, name), { recursive: true, force: true })
+  }
+}
+
 if (shouldClean) {
   if (hasSourceSkill) {
     rmSync(vendorRoot, { recursive: true, force: true })
+    removeStaleStaging()
   }
   process.exit(0)
 }
@@ -46,9 +57,43 @@ if (!hasSourceSkill) {
   throw new Error(`Unable to vendor orizu skill: source skill not found at ${sourceRoot}`)
 }
 
-rmSync(vendorRoot, { recursive: true, force: true })
-mkdirSync(vendorRoot, { recursive: true })
-cpSync(sourceRoot, vendorRoot, {
-  recursive: true,
-  filter: shouldCopyPath,
-})
+// ORI-2425: in a source checkout Effect owns the vendored copy's lifetime. It
+// is copied into a staging folder that the scope removes if the copy fails or
+// the pack is stopped, then swapped in whole, so the CLI (which prefers this
+// copy over skills/orizu) never finds a half-vendored skill.
+const { Effect } = await import('effect')
+const vendorParent = dirname(vendorRoot)
+const vendor = Effect.scoped(Effect.gen(function* () {
+  mkdirSync(vendorParent, { recursive: true })
+  removeStaleStaging()
+  const staging = yield* Effect.acquireRelease(
+    Effect.sync(() => {
+      const staging = mkdtempSync(resolve(vendorParent, STAGING_PREFIX))
+      // mkdtemp makes 0700 folders; keep the permissions a plain mkdir gave before.
+      chmodSync(staging, 0o755)
+      return staging
+    }),
+    staging => Effect.sync(() => rmSync(staging, { recursive: true, force: true })),
+  )
+  cpSync(sourceRoot, staging, { recursive: true, filter: shouldCopyPath })
+  yield* Effect.uninterruptible(Effect.sync(() => {
+    rmSync(vendorRoot, { recursive: true, force: true })
+    renameSync(staging, vendorRoot)
+  }))
+}))
+
+const STOP_SIGNALS = ['SIGINT', 'SIGTERM']
+const controller = new AbortController()
+let stopSignal
+const handlers = STOP_SIGNALS.map(signal => [signal, () => { stopSignal ??= signal; controller.abort() }])
+for (const [signal, handler] of handlers) process.on(signal, handler)
+let failure
+try {
+  await Effect.runPromise(vendor, { signal: controller.signal })
+} catch (error) {
+  failure = error
+} finally {
+  for (const [signal, handler] of handlers) process.off(signal, handler)
+}
+if (stopSignal) process.kill(process.pid, stopSignal)
+else if (failure) throw failure

package/src/hosted-optimization.ts

@@ -3,13 +3,12 @@ import { existsSync, readFileSync, rmSync } from 'node:fs'
 import { createServer } from 'node:http'
 import { tmpdir } from 'node:os'
 import { delimiter, join } from 'node:path'
-import { runPipedChild } from './child-output-tee.js'
 import { getGepaPythonPathEntries } from './gepa-python-paths.js'
 import { deliveredProviderLookup, HOSTED_PROVIDER_FAILURE, INJECTED_ENV_VARS_ENV, PROVIDER_REGISTRY_EXTRA_ENV } from './hosted-environment.js'
 import { credentialEnvFor, parseModelIdentity } from './provider-registry.js'
 import type { ProviderLookup } from './provider-lookup.js'
-import { materializeRunnerVersion, cleanupMaterializedRunners } from './runner-version-materialization.js'
 import { prepareSkilledProposerLaunch, spawnSkilledProposerChild } from './skilled-proposer-launch.js'
+import type { SkilledProposerStopOptions } from './skilled-proposer-launch.js'
 import { hostedProviderFromModel } from './hosted-provider-settings.js'
 import { validNormalizedSkilledProposerConfig } from './skilled-proposer-wire.js'
 import { REDACTION_PLACEHOLDER, redactSecrets } from './secret-redaction.js'
@@ -358,7 +357,8 @@ async function startTokenBroker(
   }
   return {
     url: `http://127.0.0.1:${address.port}/${nonce}`,
-    stop: () => { server.close() },
+    // Also drop open keep-alive connections, so no refresh succeeds after stop.
+    stop: () => { server.close(); server.closeAllConnections() },
     token: () => activeToken,
     secrets: () => [...tokens],
   }
@@ -367,30 +367,23 @@ async function spawnOfficial(
   python: string,
   environment: NodeJS.ProcessEnv,
   ready: () => Promise<void>,
-  output: ProcessOutputCapture
+  output: ProcessOutputCapture,
+  stopOptions: SkilledProposerStopOptions,
 ): Promise<{ status: number | null; error?: Error }> {
-  if (environment.ORIZU_CANDIDATE_PROPOSER === 'skilled-proposer') {
-    return spawnSkilledProposerChild(
-      python,
-      ['-m', 'orizu_gepa_connector'],
-      'official',
-      environment,
-      ready,
-      {
-        stdout: chunk => output.stdout.append(chunk),
-        stderr: chunk => output.stderr.append(chunk),
-      }
-    )
-  }
-  return runPipedChild(
+  // ORI-2429: both proposers start through the launcher (ORI-2402), so a stop
+  // signal reaches the optimizer, which then ends instead of outliving the
+  // CLI, and the CLI cleans up before it ends by that signal.
+  return spawnSkilledProposerChild(
     python,
     ['-m', 'orizu_gepa_connector'],
+    'official',
     environment,
     ready,
     {
       stdout: chunk => output.stdout.append(chunk),
       stderr: chunk => output.stderr.append(chunk),
-    }
+    },
+    stopOptions,
   )
 }
 async function ensureFailedRun(
@@ -430,7 +423,14 @@ export async function hostedOptimizationCommand(io: HostedOptimizationIo): Promi
   }
   delete process.env.ORIZU_BOOT_SECRET
   let reason = 'hosted_optimization_mint_refused'
-  const cleanups: Array<() => void> = []
+  // ORI-2429: one Effect scope owns the runner copies, the result file and the
+  // token broker, so a stop signal removes them too (see runner-folders.ts).
+  const { Effect, Scope } = await import('effect')
+  const { downloadedRunner, removeOnClose, RemovalLedger, stopClosesScope } = await import('./runner-folders.js')
+  const ledger = new RemovalLedger()
+  const { scope, close, stop, listen, removeHandlers } = stopClosesScope()
+  const inScope = <A>(effect: import('effect').Effect.Effect<A, unknown, import('effect').Scope.Scope>) =>
+    Effect.runPromise(effect.pipe(Effect.provideService(Scope.Scope, scope)))
   let broker: TokenBroker | undefined
   const resultFile = join(tmpdir(), `orizu-hosted-optimization-result-${boot.runId}-${randomUUID()}.json`)
   const diagnosticSecrets = () => injectedSecrets(boot, broker)
@@ -438,6 +438,7 @@ export async function hostedOptimizationCommand(io: HostedOptimizationIo): Promi
   const bootOutput = new BoundedTextCapture(diagnosticSecrets)
   let failureDiagnostics: FailureDiagnostics | undefined
   try {
+    listen()
     const first = await mint(boot)
     if (first.response.status === 422) reason = 'hosted_optimization_spec_missing'
     if (!first.response.ok) {
@@ -462,18 +463,28 @@ export async function hostedOptimizationCommand(io: HostedOptimizationIo): Promi
     process.env.ORIZU_BASE_URL = boot.baseUrl.origin
     process.env.ORIZU_TOKEN = minted.token
     reason = 'hosted_optimization_materialization_failed'
-    const candidate = await materializeRunnerVersion(String(minted.jobSpec.runnerVersionId)); cleanups.push(candidate.cleanup)
-    const scorer = await materializeRunnerVersion(String(minted.jobSpec.scorerRunnerVersionId)); cleanups.push(scorer.cleanup)
+    const candidate = await inScope(downloadedRunner(String(minted.jobSpec.runnerVersionId), ledger))
+    const scorer = await inScope(downloadedRunner(String(minted.jobSpec.scorerRunnerVersionId), ledger))
+    await inScope(removeOnClose(ledger, 'other', () => rmSync(resultFile, { force: true })))
     broker = await startTokenBroker(boot, minted)
+    const startedBroker = broker
+    await inScope(removeOnClose(ledger, 'other', () => startedBroker.stop()))
     const environment = childEnvironment(boot, minted, candidate.runnerDir, scorer.runnerDir, broker.url, resultFile)
     const launch = prepareSkilledProposerLaunch(process.env.PYTHON || 'python3', 'official', environment)
     reason = 'hosted_optimization_process_failed'
-    const result = await spawnOfficial(
-      launch.python,
-      launch.environment,
-      () => postBoot(boot, 'ready', { status: 'ready' }),
-      processOutput
-    )
+    stop.launcherOwnsStop()
+    let result: Awaited<ReturnType<typeof spawnOfficial>>
+    try {
+      result = await spawnOfficial(
+        launch.python,
+        launch.environment,
+        () => postBoot(boot, 'ready', { status: 'ready' }),
+        processOutput,
+        { beforeSignalExit: stop.beforeSignalExit },
+      )
+    } finally {
+      stop.launcherDone()
+    }
     if (result.error || result.status !== 0) {
       const processFailure = result.error?.message || `optimizer exited with status ${result.status}`
       const secrets = injectedSecrets(boot, broker)
@@ -506,8 +517,15 @@ export async function hostedOptimizationCommand(io: HostedOptimizationIo): Promi
     await io.printErr?.(reason)
     return 1
   } finally {
-    broker?.stop()
-    rmSync(resultFile, { force: true })
-    cleanupMaterializedRunners(cleanups)
+    removeHandlers()
+    // Closing stops the broker, deletes the result file and removes the copies.
+    close()
+    // As before: a broker or result-file failure is thrown first, then runner removals.
+    const otherFailure = ledger.failures.find(failure => failure.group === 'other')
+    if (otherFailure) throw otherFailure.error
+    const runnerFailures = ledger.failures.filter(failure => failure.group === 'downloads').map(failure => failure.error)
+    if (runnerFailures.length > 0) {
+        throw new AggregateError(runnerFailures, 'Failed to clean materialized runner directories')
+    }
   }
 }