orizu 0.5.6 → 0.5.8

package/dist/hosted-loop.js

@@ -36,10 +36,33 @@ import { spawnSync, spawn as nodeSpawn } from 'child_process';
 import { closeSync, existsSync, openSync, readFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
-import { PREBAKED_MARKER_PATH, SETUP_HOOK_RELATIVE_PATH, parsePrebakedMarker, } from './hosted-runtime-assets.js';
+import { HOSTED_TASK_PREAMBLE, PREBAKED_MARKER_PATH, SETUP_HOOK_RELATIVE_PATH, composeHostedTaskPrompt, parsePrebakedMarker, } from './hosted-runtime-assets.js';
+import { harvestWorkspace } from './hosted-harvest.js';
+import { annotateHeadlessQuestions, withIdleWatchdog } from './hosted-headless.js';
 import { OPENCODE_PINNED_VERSION, createOpenCodeHarness, spawnOpenCode, } from './hosted-harness-opencode.js';
 import { createClaudeAgentHarness } from './hosted-harness-claude.js';
 import { drainHarnessToSink, resumeRunEventSink, } from './hosted-run-event-sink.js';
+/**
+ * Environment injected into the spawned OpenCode server so the AGENT's bash sees a
+ * PRE-AUTHENTICATED `orizu` CLI (ALI-1044). ORIZU_TOKEN_FILE points at the 0600
+ * rotated bearer file and ORIZU_BASE_URL at the Orizu API — the exact vars the
+ * CLI's auth resolution reads (resolveEnvBearerToken + resolveBaseUrl). The dummy
+ * ANTHROPIC key (model-key brokering, G3) is preserved. No real secret is carried
+ * here: the bearer stays on disk and is read fresh per request from the file.
+ */
+export function buildOpenCodeSpawnEnv(context) {
+    const env = {};
+    if (context.anthropicDummyKey) {
+        env.ANTHROPIC_API_KEY = context.anthropicDummyKey;
+    }
+    if (context.bearerFile) {
+        env.ORIZU_TOKEN_FILE = context.bearerFile;
+    }
+    if (context.apiBaseUrl) {
+        env.ORIZU_BASE_URL = context.apiBaseUrl;
+    }
+    return Object.keys(env).length > 0 ? env : undefined;
+}
 /** Default egress-canary probe host (a known non-allowlisted destination). */
 export const DEFAULT_EGRESS_CANARY_HOST = 'example.com';
 /** Bound (ms) on the canary probe — a live firewall resets/times out fast; a
@@ -181,6 +204,25 @@ function defaultRunSetupHook({ workspaceDir }) {
     const ok = (res.status ?? 1) === 0;
     return { ran: true, ok, detail: ok ? 'setup.sh ok' : `setup.sh exit ${res.status ?? 'unknown'}` };
 }
+/** Default idle-watchdog window (ALI-1037): abort a prompt that makes no progress
+ *  for this long. The timer resets on every harness EVENT, and a legitimate long
+ *  single tool call (a big `npm install`, a build, an optimization step) emits no
+ *  intermediate events — so this must comfortably exceed the longest expected
+ *  quiet tool call (review finding #2). Overridable per-run via `idleTimeoutMs` or
+ *  the `ORIZU_AGENT_IDLE_TIMEOUT_MS` env var. */
+export const DEFAULT_AGENT_IDLE_TIMEOUT_MS = 25 * 60 * 1000;
+/** Resolve the idle window: explicit option wins, then env, then the default. */
+function resolveIdleTimeoutMs(override) {
+    if (typeof override === 'number' && Number.isFinite(override))
+        return override;
+    const raw = process.env.ORIZU_AGENT_IDLE_TIMEOUT_MS;
+    if (raw) {
+        const parsed = Number.parseInt(raw, 10);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return DEFAULT_AGENT_IDLE_TIMEOUT_MS;
+}
 /** Model-key env vars whose value must be scrubbed from every run event. */
 const MODEL_KEY_ENV_VARS = ['ANTHROPIC_API_KEY', 'OPENAI_API_KEY'];
 function redactionListFromEnv() {
@@ -365,6 +407,49 @@ export async function runHostedLoop(opts) {
             }
         }
     }
+    // End-of-run auto-harvest (ALI-1036): commit + push anything the agent left
+    // uncommitted/unpushed so a run NEVER loses work — on BOTH the success and
+    // failure paths. Runs at most once (guarded), records exactly one of
+    // work_persisted / work_none / work_persist_failed, and NEVER throws or changes
+    // the run's terminal status: a harvest failure is recorded and the run proceeds.
+    let harvested = false;
+    const runAutoHarvest = async () => {
+        if (harvested)
+            return;
+        harvested = true;
+        let outcome;
+        try {
+            outcome = harvestWorkspace({
+                workspaceDir: context.workspaceDir,
+                runId: context.runId,
+                author: context.author,
+                exec: opts.harvestExec,
+                // Real harvest only inside a genuine hosted sandbox (prebaked marker
+                // present) — never on a host/test working tree (review finding #1).
+                enabled: existsSync(PREBAKED_MARKER_PATH),
+            });
+        }
+        catch (error) {
+            outcome = { kind: 'work_persist_failed', error: error instanceof Error ? error.message : String(error) };
+        }
+        if (sink.sealed)
+            return;
+        try {
+            if (outcome.kind === 'work_persisted') {
+                await sink.append({ kind: 'work_persisted', payload: { sha: outcome.sha, files: outcome.files } });
+            }
+            else if (outcome.kind === 'work_none') {
+                await sink.append({ kind: 'work_none', payload: {} });
+            }
+            else {
+                await sink.append({ kind: 'work_persist_failed', payload: { error: outcome.error } });
+            }
+        }
+        catch {
+            // Recording harvest is best-effort — never fail the run because the harvest
+            // event append failed.
+        }
+    };
     let spawned = null;
     let agentSessionId = null;
     let installOk = false;
@@ -417,7 +502,7 @@ export async function runHostedLoop(opts) {
                 model: context.model,
                 cwd: context.workspaceDir,
                 port: context.opencodePort,
-                env: context.anthropicDummyKey ? { ANTHROPIC_API_KEY: context.anthropicDummyKey } : undefined,
+                env: buildOpenCodeSpawnEnv(context),
                 spawn: nodeChildSpawner,
                 logPath: join(tmpdir(), `opencode-serve-${context.runId}.log`),
                 signal,
@@ -437,14 +522,41 @@ export async function runHostedLoop(opts) {
             resumeAgentSessionId: context.resumeAgentSessionId,
         });
         agentSessionId = started.agentSessionId;
+        // Prompt scaffolding (ALI-1036): wrap the user task with the standing
+        // headless preamble, keeping the task verbatim beneath a delimiter.
         const prompt = {
             runId: context.runId,
             messageId: context.messageId,
-            content: taskPrompt,
+            content: composeHostedTaskPrompt(taskPrompt, opts.taskPreamble ?? HOSTED_TASK_PREAMBLE),
             author: context.author,
         };
-        const status = await drainHarnessToSink(harness.runPrompt(prompt, signal), sink, {
+        // Drive the prompt through (a) question auto-handling annotation and (b) the
+        // idle watchdog (ALI-1037): no harness event for `idleTimeoutMs` aborts the
+        // prompt and throws `AgentStalledError` → the catch below harvests, then
+        // finishes the run `failed`. The prompt runs under a CHILD AbortController
+        // linked to the loop signal so the watchdog can abort the in-flight prompt
+        // (unblocking a signal-respecting harness the same way a cancel would), then
+        // best-effort `harness.stop()` the driver.
+        const idleTimeoutMs = resolveIdleTimeoutMs(opts.idleTimeoutMs);
+        const promptController = new AbortController();
+        if (signal.aborted)
+            promptController.abort();
+        else
+            signal.addEventListener('abort', () => promptController.abort(), { once: true });
+        const annotated = annotateHeadlessQuestions(harness.runPrompt(prompt, promptController.signal));
+        const drivenStream = idleTimeoutMs > 0
+            ? withIdleWatchdog(annotated, {
+                timeoutMs: idleTimeoutMs,
+                onTimeout: async () => {
+                    promptController.abort();
+                    await harness.stop();
+                },
+            })
+            : annotated;
+        const status = await drainHarnessToSink(drivenStream, sink, {
             summary: { agentSessionId },
+            // Auto-harvest runs on EVERY terminal path, before the sink seals.
+            beforeFinish: runAutoHarvest,
         });
         await harness.shutdown();
         return { status, agentSessionId, installOk, error: null };
@@ -452,7 +564,9 @@ export async function runHostedLoop(opts) {
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         // Fail closed: never leave the run non-terminal. finish() is idempotent and
-        // no-ops when the drain already sealed the sink.
+        // no-ops when the drain already sealed the sink. Harvest FIRST (partial work
+        // is valuable, incl. an idle-watchdog abort) — before the terminal seals.
+        await runAutoHarvest();
         if (!sink.sealed) {
             try {
                 await sink.finish('failed', { summary: { error: message } });

package/dist/hosted-run-event-sink.js

@@ -71,6 +71,13 @@ const EVENT_TYPE_BY_KIND = {
     // through this SAME sink (single writer). See EGRESS_*_EVENT_TYPE below.
     egress_blocked: EGRESS_BLOCKED_EVENT_TYPE,
     egress_allowed: EGRESS_ALLOWED_EVENT_TYPE,
+    // Durability + headless (ALI-1036 / ALI-1037), emitted by the in-sandbox loop
+    // through this SAME sink (single writer): auto-harvest results + headless
+    // question auto-handling record.
+    work_persisted: 'work_persisted',
+    work_none: 'work_none',
+    work_persist_failed: 'work_persist_failed',
+    question_auto_answered: 'agent_question_auto_answered',
 };
 /** The RunAPI event type a harness kind maps to, or null if it is not appendable
  *  (terminal kinds route through the PATCH; deferred kinds have no mapping yet). */
@@ -457,6 +464,16 @@ export async function resumeRunEventSink(options) {
  * run's final status.
  */
 export async function drainHarnessToSink(events, sink, opts = {}) {
+    // Run the pre-terminal hook (auto-harvest) at most once, right before the first
+    // finish() on any terminal path — while the sink is still writable.
+    let beforeFinishRan = false;
+    const runBeforeFinish = async () => {
+        if (beforeFinishRan)
+            return;
+        beforeFinishRan = true;
+        if (opts.beforeFinish)
+            await opts.beforeFinish();
+    };
     for await (const event of events) {
         if (event.kind === 'execution_complete') {
             // A prompt the caller/agent stopped is a cancellation, not a failure: the
@@ -464,6 +481,7 @@ export async function drainHarnessToSink(events, sink, opts = {}) {
             // and stop()-initiated paths. A genuine failure (success:false, no abort
             // flag) still lands 'failed'.
             if (event.payload.aborted === true) {
+                await runBeforeFinish();
                 await sink.finish('cancelled', {
                     summary: opts.summary,
                     evidence: opts.evidence,
@@ -476,10 +494,12 @@ export async function drainHarnessToSink(events, sink, opts = {}) {
             const summary = success
                 ? opts.summary
                 : { ...(opts.summary ?? {}), error: event.payload.error ?? 'execution failed' };
+            await runBeforeFinish();
             await sink.finish(status, { summary, evidence: opts.evidence, transcript: opts.transcript });
             return status;
         }
         if (event.kind === 'error') {
+            await runBeforeFinish();
             await sink.finish('failed', {
                 summary: { ...(opts.summary ?? {}), error: event.payload.error ?? 'agent error' },
                 evidence: opts.evidence,
@@ -491,6 +511,7 @@ export async function drainHarnessToSink(events, sink, opts = {}) {
     }
     // The harness contract guarantees a terminal event; reaching here means the
     // stream ended abnormally. Fail closed so the run never dangles non-terminal.
+    await runBeforeFinish();
     await sink.finish('failed', {
         summary: { ...(opts.summary ?? {}), error: 'harness stream ended without a terminal event' },
         transcript: opts.transcript,

package/dist/hosted-runtime-assets.js

@@ -39,6 +39,33 @@ export const SETUP_HOOK_RELATIVE_PATH = '.orizu/setup.sh';
  * same identity for run-event attribution; keep them identical.
  */
 export const AGENT_GIT_IDENTITY = { name: 'Orizu Agent', email: 'agent@orizu.ai' };
+// -- Hosted task prompt scaffolding (ALI-1036) -------------------------------
+/**
+ * Standing preamble wrapped around every hosted task prompt so a NATURAL task
+ * ("review X and update the readme") runs unattended with zero magic words. The
+ * agent is told to work autonomously (never block on the human), commit as it
+ * goes, and treat Orizu — not the repo — as the home for production pointers and
+ * run metadata. An end-of-run auto-harvest (ALI-1036, `harvestWorkspace`) is the
+ * safety net for anything left uncommitted; the preamble names it so the agent
+ * knows partial work is preserved.
+ */
+export const HOSTED_TASK_PREAMBLE = 'You are running unattended in a hosted sandbox. Work autonomously: never ask the user ' +
+    'questions — when uncertain, choose the most reasonable/reversible option and note the ' +
+    'decision. Commit your work to the current branch in logical units as you go (an automatic ' +
+    'checkpoint will also save anything uncommitted at the end). Never switch branches. ' +
+    'Production/default pointers and run metadata live in Orizu, not this repo.';
+/** Delimiter separating the standing preamble from the verbatim user task. */
+export const HOSTED_TASK_DELIMITER = '--- YOUR TASK ---';
+/**
+ * Compose the full hosted prompt: the standing preamble, a clear delimiter, then
+ * the user's task VERBATIM beneath it. Passing an empty preamble yields the task
+ * unchanged (an explicit opt-out for tests / callers that scaffold elsewhere).
+ */
+export function composeHostedTaskPrompt(task, preamble = HOSTED_TASK_PREAMBLE) {
+    if (!preamble)
+        return task;
+    return `${preamble}\n\n${HOSTED_TASK_DELIMITER}\n${task}`;
+}
 // -- Pre-baked runtime marker (ALI-1017) -------------------------------------
 /**
  * Absolute path of the marker the pre-baked hosted-runtime image writes at build

package/dist/hosted-session-cli.js

@@ -198,6 +198,12 @@ async function defaultResolveRepo(fetcher, workspaceId, sessionId) {
     return { repoFullName, cloneUrl: `https://github.com/${repoFullName}.git` };
 }
 export async function startHostedSession(opts) {
+    // ALI-1035 fail-fast: a hosted run cannot reach the model provider without a key
+    // (the firewall brokers the real key onto egress). Refuse BEFORE creating any
+    // session, run row, or sandbox — no orphaned rows, no paid box, instant error.
+    if (!opts.modelApiKey) {
+        throw new Error('hosted session needs a model API key: set ANTHROPIC_API_KEY (or pass --model-key)');
+    }
     const rawFetch = opts.rawFetch ?? globalThis.fetch;
     const log = opts.logLine ?? (() => { });
     const model = opts.model ?? DEFAULT_HOSTED_MODEL;
@@ -418,6 +424,32 @@ export async function startHostedSession(opts) {
     let sandboxBudgetMs = durationMs;
     let tokenExpiresAtMs = now() + ttlMinutes * 60 * 1000;
     let stopped = false;
+    // ALI-1037 host-side idle gate: only KEEP a sandbox alive while its run is
+    // making progress. Before each keepalive extension we cheaply check whether any
+    // new run event landed since the last check; a run with NO new events since the
+    // previous rotation cycle is not extended (the in-sandbox watchdog is the
+    // primary stall killer — this stops the HOST from paying to keep a dead box
+    // alive). "Can't tell" (non-2xx / transport error) never starves a healthy run.
+    let lastEventCursor = 0;
+    const hasEventProgress = async () => {
+        try {
+            const res = await opts.fetcher(`/api/cli/workbench-runs/${encodeURIComponent(runId)}/events?after=${lastEventCursor}&limit=500`);
+            if (!res.ok)
+                return true;
+            const body = (await res.json().catch(() => ({})));
+            const events = Array.isArray(body.events) ? body.events : [];
+            if (events.length === 0)
+                return false;
+            lastEventCursor = events.reduce((max, event) => {
+                const seq = typeof event.sequence === 'number' ? event.sequence : 0;
+                return seq > max ? seq : max;
+            }, lastEventCursor);
+            return true;
+        }
+        catch {
+            return true;
+        }
+    };
     let cancelSleep = null;
     const stop = () => {
         stopped = true;
@@ -485,15 +517,23 @@ export async function startHostedSession(opts) {
                 log('rotated agent bearer (file overwritten)');
                 // Keepalive: extend the sandbox by one rotation interval each rotation
                 // while attached (SDK supports extendTimeout(ms)), bounded by the 24h cap
-                // so a long attached session outlives the initial --duration window.
+                // so a long attached session outlives the initial --duration window — BUT
+                // only while the run is making progress (ALI-1037). A run with no new
+                // events since the last rotation is not extended: the box is left to wind
+                // down to its current budget instead of the host paying for a stalled run.
                 if (sandbox.extendTimeout && sandboxBudgetMs + rotationIntervalMs <= sandboxCapMs) {
-                    try {
-                        await sandbox.extendTimeout(rotationIntervalMs);
-                        sandboxBudgetMs += rotationIntervalMs;
-                        log(`extended sandbox timeout (+${Math.round(rotationIntervalMs / 1000)}s, budget ${Math.round(sandboxBudgetMs / 60000)}m)`);
+                    if (!(await hasEventProgress())) {
+                        log('sandbox timeout NOT extended: no run events since the last rotation (agent stalled) — letting the box wind down');
                     }
-                    catch (error) {
-                        log(`sandbox extendTimeout failed: ${error instanceof Error ? error.message : String(error)}`);
+                    else {
+                        try {
+                            await sandbox.extendTimeout(rotationIntervalMs);
+                            sandboxBudgetMs += rotationIntervalMs;
+                            log(`extended sandbox timeout (+${Math.round(rotationIntervalMs / 1000)}s, budget ${Math.round(sandboxBudgetMs / 60000)}m)`);
+                        }
+                        catch (error) {
+                            log(`sandbox extendTimeout failed: ${error instanceof Error ? error.message : String(error)}`);
+                        }
                     }
                 }
             }
@@ -562,7 +602,7 @@ const HOSTED_USAGE = 'Usage: orizu session start --hosted --task "<prompt>" [--d
     '[--model <provider/model>] [--project <team/project>] [--provider vercel|local-sim] ' +
     '[--image <orizu-hosted-runtime:tag> (pre-baked VCR image; default env ORIZU_HOSTED_IMAGE)] ' +
     '[--snapshot <snapshot-id> (pre-baked Vercel snapshot, zero-Docker; default env ORIZU_HOSTED_SNAPSHOT; ' +
-    'mutually exclusive with --image)] [--tail]\n' +
+    'mutually exclusive with --image)] [--model-key <key> (else ANTHROPIC_API_KEY; required)] [--tail]\n' +
     'Note (v0): if you disconnect, the agent token expires within its TTL (<=60m) and the run finishes ' +
     'cleanly; reconnect with `orizu run tail --run <id>`. The sandbox timeout is independent (up to 24h).';
 /**
@@ -618,7 +658,9 @@ export async function hostedCommand(args, io) {
         hostedImage: argVal(args, '--image') ?? process.env.ORIZU_HOSTED_IMAGE ?? undefined,
         hostedSnapshot: argVal(args, '--snapshot') ?? process.env.ORIZU_HOSTED_SNAPSHOT ?? undefined,
         tail,
-        modelApiKey: process.env.ANTHROPIC_API_KEY || undefined,
+        // Model key: explicit --model-key wins, else ANTHROPIC_API_KEY. Falsy → the
+        // fail-fast in startHostedSession throws before any session/sandbox is made.
+        modelApiKey: argVal(args, '--model-key') ?? (process.env.ANTHROPIC_API_KEY || undefined),
         logLine: line => io.print(line),
         onTailEvent: event => io.print(io.json ? JSON.stringify(event) : `#${String(event.sequence ?? '?')} ${String(event.eventType ?? '')}`),
         tailImpl: tail

package/dist/http.js

@@ -1,4 +1,4 @@
-import { getActiveBaseUrl, getServerCredentials, updateServerCredentials } from './credentials.js';
+import { getActiveBaseUrl, getServerCredentials, resolveEnvBearerToken, updateServerCredentials, } from './credentials.js';
 import { getFlagBaseUrl, normalizeBaseUrl } from './global-flags.js';
 let runtimeFlags = { local: false, server: null };
 export function setGlobalFlags(flags) {
@@ -94,6 +94,21 @@ async function refreshCredentials(baseUrl, credentials) {
 export async function authedFetch(path, init = {}) {
     const baseUrl = resolveBaseUrl();
     assertSecureTokenTransport(baseUrl);
+    // In-sandbox pre-auth (ALI-1044): a bearer supplied via ORIZU_TOKEN /
+    // ORIZU_TOKEN_FILE takes precedence over credentials.json. It is externally
+    // managed (the hosted loop rotates the token file), so it is read FRESH here on
+    // every request and NEVER refreshed by this client — on a 401 the loop rotates
+    // the file and the next request naturally picks up the new bearer.
+    const envBearer = resolveEnvBearerToken();
+    if (envBearer) {
+        return await fetch(`${baseUrl}${path}`, {
+            ...init,
+            headers: {
+                ...(init.headers || {}),
+                Authorization: `Bearer ${envBearer}`,
+            },
+        });
+    }
     const credentials = getServerCredentials(baseUrl);
     if (!credentials) {
         throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);

package/dist/index.js

@@ -36,6 +36,7 @@ import { hostedCommand } from './hosted-session-cli.js';
 import { workspaceSyncCommand } from './workspace-sync.js';
 import { runGitCredential } from './git-credential.js';
 import { runGithubLink, runInteractiveHostedSetup } from './github-setup.js';
+import { reportCommentsCommand, throwDeprecatedPromptCommentsCommand, } from './report-comments-cli.js';
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -609,63 +610,6 @@ function printTaskStatusSummary(data) {
         });
     }
 }
-function compactTerminalText(value, maxLength = 160) {
-    const compact = sanitizeTerminalText(value).replace(/\s+/g, ' ').trim();
-    if (compact.length <= maxLength) {
-        return compact;
-    }
-    return `${compact.slice(0, Math.max(0, maxLength - 1)).trim()}…`;
-}
-function printIndentedBody(value, indent) {
-    const lines = sanitizeTerminalText(value || '').split(/\r?\n/);
-    for (const line of lines) {
-        printLine(`${indent}${line}`);
-    }
-}
-function formatPromptCommentAnchor(anchor) {
-    if (!anchor) {
-        return null;
-    }
-    const lineLabel = anchor.startLine && anchor.endLine
-        ? anchor.startLine === anchor.endLine
-            ? `line ${anchor.startLine}`
-            : `lines ${anchor.startLine}-${anchor.endLine}`
-        : null;
-    const selectedText = anchor.text ? `"${compactTerminalText(anchor.text, 180)}"` : null;
-    if (lineLabel && selectedText) {
-        return `${lineLabel}: ${selectedText}`;
-    }
-    return lineLabel || selectedText;
-}
-function printPromptComments(data) {
-    const versionLabel = data.version.versionLabel || (data.version.versionNumber ? `v${data.version.versionNumber}` : data.version.id);
-    printLine(`Prompt: ${sanitizeTerminalText(data.prompt.name)} (${sanitizeTerminalText(data.prompt.id)})`);
-    printLine(`Version: ${sanitizeTerminalText(String(versionLabel))} (${sanitizeTerminalText(data.version.id)})`);
-    printLine(`Comments: ${data.summary.threadCount} thread${data.summary.threadCount === 1 ? '' : 's'} ` +
-        `(${data.summary.openThreadCount} open, ${data.summary.resolvedThreadCount} resolved, ${data.summary.replyCount} replies)`);
-    if (data.comments.length === 0) {
-        printLine('\nNo comments found for this prompt version.');
-        return;
-    }
-    for (const [index, thread] of data.comments.entries()) {
-        const authorName = thread.author?.name || 'Unknown';
-        const anchor = formatPromptCommentAnchor(thread.anchor);
-        printLine('');
-        printLine(`${index + 1}. [${thread.status}] ${sanitizeTerminalText(authorName)} · ${sanitizeTerminalText(thread.createdAt)}`);
-        if (anchor) {
-            printLine(`   Selection: ${anchor}`);
-        }
-        printIndentedBody(thread.body, '   ');
-        if (thread.replies.length > 0) {
-            printLine(`   Replies (${thread.replies.length})`);
-            for (const reply of thread.replies) {
-                const replyAuthor = reply.author?.name || 'Unknown';
-                printLine(`   - ${sanitizeTerminalText(replyAuthor)} · ${sanitizeTerminalText(reply.createdAt)}`);
-                printIndentedBody(reply.body, '     ');
-            }
-        }
-    }
-}
 const DEFAULT_AUTH_CALLBACK_PORT = 43123;
 function resolveAuthCallbackPort() {
     const envPort = process.env.ORIZU_AUTH_PORT;
@@ -1029,33 +973,6 @@ async function listJudges() {
     }
     printPromptSummaries(data.judges, 'No judges found.');
 }
-async function listPromptComments() {
-    const promptRef = getPositionalArg(2);
-    const project = getArg('--project') || await resolveProjectSlug(null);
-    const label = getArg('--label');
-    const version = getArg('--version');
-    if (!promptRef) {
-        throw new Error('Usage: orizu prompts comments <prompt-id-or-name> --project <team/project> [--label <label> | --version <version-id>] [--json]');
-    }
-    if (label && version) {
-        throw new Error('Use either --label or --version, not both');
-    }
-    const params = new URLSearchParams({ project });
-    if (label)
-        params.set('label', label);
-    if (version)
-        params.set('version', version);
-    const response = await authedFetch(`/api/cli/prompts/${encodeURIComponent(promptRef)}/comments?${params.toString()}`);
-    if (!response.ok) {
-        throw new Error(`Failed to fetch prompt comments: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Prompt comments');
-    if (hasJsonFlag()) {
-        printJson(data);
-        return;
-    }
-    printPromptComments(data);
-}
 async function listScorers() {
     const project = getArg('--project') || await resolveProjectSlug(null);
     const response = await authedFetch(`/api/cli/scorers?project=${encodeURIComponent(project)}`);
@@ -2144,6 +2061,21 @@ function hasJsonFlag() {
 function printJson(value) {
     printLine(JSON.stringify(value));
 }
+function createReportCommentsCliContext() {
+    return {
+        getArg,
+        getPositionalArg,
+        rejectDashPrefixedOptionValue,
+        resolveProjectSlug,
+        readSourceFile,
+        authedFetch,
+        parseJsonResponse,
+        hasJsonFlag,
+        printJson,
+        printLine,
+        sanitizeTerminalText,
+    };
+}
 function printCapabilities() {
     const capabilities = getCapabilities(getCliVersion());
     if (hasJsonFlag()) {
@@ -3859,6 +3791,35 @@ async function setTaskReport() {
     printLine(`Uploaded task report for ${sanitizeTerminalText(data.task.id)} ` +
         `[${sanitizeTerminalText(data.task.status)}]`);
 }
+async function getTaskReport() {
+    const taskId = getArg('--task');
+    rejectDashPrefixedOptionValue('--task', taskId);
+    if (!taskId) {
+        throw new Error('Usage: orizu tasks report get --task <taskId> [--json]');
+    }
+    const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}/report`);
+    if (!response.ok) {
+        throw new Error(`Failed to read task report: ${await response.text()}`);
+    }
+    const data = await parseJsonResponse(response, 'Task report get');
+    if (hasJsonFlag()) {
+        printJson(data);
+        return;
+    }
+    const title = data.task.title ? `${data.task.title} ` : '';
+    printLine(`Task report: ${sanitizeTerminalText(title)}(${sanitizeTerminalText(data.task.id)})`);
+    if (data.task.status) {
+        printLine(`Status: ${sanitizeTerminalText(data.task.status)}`);
+    }
+    if (data.task.report.sourceName) {
+        printLine(`Source: ${sanitizeTerminalText(data.task.report.sourceName)}`);
+    }
+    if (data.task.report.createdAt) {
+        printLine(`Created: ${sanitizeTerminalText(data.task.report.createdAt)}`);
+    }
+    printLine('');
+    printLine(sanitizeTerminalText(data.task.report.markdown));
+}
 function defaultAppExportFilename(appName, versionNum) {
     const safeName = appName
         .trim()
@@ -4896,6 +4857,10 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await logOptimizationEvent();
         return;
     }
+    if (command === 'comments') {
+        await reportCommentsCommand(subcommand, createReportCommentsCliContext());
+        return;
+    }
     if (command === 'teams' && subcommand === 'list') {
         await listTeams();
         return;
@@ -4934,8 +4899,7 @@ export async function main(rawArgs = process.argv.slice(2)) {
         return;
     }
     if (command === 'prompts' && subcommand === 'comments') {
-        await listPromptComments();
-        return;
+        throwDeprecatedPromptCommentsCommand();
     }
     if (command === 'prompts' && subcommand === 'pull') {
         await pullPromptArtifact('prompt');
@@ -5100,6 +5064,10 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await setTaskReport();
         return;
     }
+    if (command === 'tasks' && subcommand === 'report' && cliArgs[2] === 'get') {
+        await getTaskReport();
+        return;
+    }
     if (command === 'tasks' && subcommand === 'pause') {
         await updateTaskStatus('paused');
         return;