orizu 0.5.7 → 0.5.9

package/src/hosted-session-cli.ts

@@ -359,6 +359,12 @@ async function defaultResolveRepo(
 export async function startHostedSession(
   opts: StartHostedSessionOptions
 ): Promise<StartHostedSessionResult> {
+  // ALI-1035 fail-fast: a hosted run cannot reach the model provider without a key
+  // (the firewall brokers the real key onto egress). Refuse BEFORE creating any
+  // session, run row, or sandbox — no orphaned rows, no paid box, instant error.
+  if (!opts.modelApiKey) {
+    throw new Error('hosted session needs a model API key: set ANTHROPIC_API_KEY (or pass --model-key)')
+  }
   const rawFetch = opts.rawFetch ?? (globalThis.fetch as HostedFetch)
   const log = opts.logLine ?? ((): void => {})
   const model = opts.model ?? DEFAULT_HOSTED_MODEL
@@ -602,6 +608,32 @@ export async function startHostedSession(
   let sandboxBudgetMs = durationMs
   let tokenExpiresAtMs = now() + ttlMinutes * 60 * 1000
   let stopped = false
+
+  // ALI-1037 host-side idle gate: only KEEP a sandbox alive while its run is
+  // making progress. Before each keepalive extension we cheaply check whether any
+  // new run event landed since the last check; a run with NO new events since the
+  // previous rotation cycle is not extended (the in-sandbox watchdog is the
+  // primary stall killer — this stops the HOST from paying to keep a dead box
+  // alive). "Can't tell" (non-2xx / transport error) never starves a healthy run.
+  let lastEventCursor = 0
+  const hasEventProgress = async (): Promise<boolean> => {
+    try {
+      const res = await opts.fetcher(
+        `/api/cli/workbench-runs/${encodeURIComponent(runId)}/events?after=${lastEventCursor}&limit=500`
+      )
+      if (!res.ok) return true
+      const body = (await res.json().catch(() => ({}))) as { events?: unknown }
+      const events = Array.isArray(body.events) ? (body.events as Record<string, unknown>[]) : []
+      if (events.length === 0) return false
+      lastEventCursor = events.reduce((max, event) => {
+        const seq = typeof event.sequence === 'number' ? event.sequence : 0
+        return seq > max ? seq : max
+      }, lastEventCursor)
+      return true
+    } catch {
+      return true
+    }
+  }
   let cancelSleep: (() => void) | null = null
   const stop = (): void => {
     stopped = true
@@ -674,14 +706,21 @@ export async function startHostedSession(
         log('rotated agent bearer (file overwritten)')
         // Keepalive: extend the sandbox by one rotation interval each rotation
         // while attached (SDK supports extendTimeout(ms)), bounded by the 24h cap
-        // so a long attached session outlives the initial --duration window.
+        // so a long attached session outlives the initial --duration window — BUT
+        // only while the run is making progress (ALI-1037). A run with no new
+        // events since the last rotation is not extended: the box is left to wind
+        // down to its current budget instead of the host paying for a stalled run.
         if (sandbox.extendTimeout && sandboxBudgetMs + rotationIntervalMs <= sandboxCapMs) {
-          try {
-            await sandbox.extendTimeout(rotationIntervalMs)
-            sandboxBudgetMs += rotationIntervalMs
-            log(`extended sandbox timeout (+${Math.round(rotationIntervalMs / 1000)}s, budget ${Math.round(sandboxBudgetMs / 60000)}m)`)
-          } catch (error) {
-            log(`sandbox extendTimeout failed: ${error instanceof Error ? error.message : String(error)}`)
+          if (!(await hasEventProgress())) {
+            log('sandbox timeout NOT extended: no run events since the last rotation (agent stalled) — letting the box wind down')
+          } else {
+            try {
+              await sandbox.extendTimeout(rotationIntervalMs)
+              sandboxBudgetMs += rotationIntervalMs
+              log(`extended sandbox timeout (+${Math.round(rotationIntervalMs / 1000)}s, budget ${Math.round(sandboxBudgetMs / 60000)}m)`)
+            } catch (error) {
+              log(`sandbox extendTimeout failed: ${error instanceof Error ? error.message : String(error)}`)
+            }
           }
         }
       } catch (error) {
@@ -762,7 +801,7 @@ const HOSTED_USAGE =
   '[--model <provider/model>] [--project <team/project>] [--provider vercel|local-sim] ' +
   '[--image <orizu-hosted-runtime:tag> (pre-baked VCR image; default env ORIZU_HOSTED_IMAGE)] ' +
   '[--snapshot <snapshot-id> (pre-baked Vercel snapshot, zero-Docker; default env ORIZU_HOSTED_SNAPSHOT; ' +
-  'mutually exclusive with --image)] [--tail]\n' +
+  'mutually exclusive with --image)] [--model-key <key> (else ANTHROPIC_API_KEY; required)] [--tail]\n' +
   'Note (v0): if you disconnect, the agent token expires within its TTL (<=60m) and the run finishes ' +
   'cleanly; reconnect with `orizu run tail --run <id>`. The sandbox timeout is independent (up to 24h).'
 
@@ -821,7 +860,9 @@ export async function hostedCommand(args: string[], io: HostedCommandIo): Promis
     hostedImage: argVal(args, '--image') ?? process.env.ORIZU_HOSTED_IMAGE ?? undefined,
     hostedSnapshot: argVal(args, '--snapshot') ?? process.env.ORIZU_HOSTED_SNAPSHOT ?? undefined,
     tail,
-    modelApiKey: process.env.ANTHROPIC_API_KEY || undefined,
+    // Model key: explicit --model-key wins, else ANTHROPIC_API_KEY. Falsy → the
+    // fail-fast in startHostedSession throws before any session/sandbox is made.
+    modelApiKey: argVal(args, '--model-key') ?? (process.env.ANTHROPIC_API_KEY || undefined),
     logLine: line => io.print(line),
     onTailEvent: event =>
       io.print(io.json ? JSON.stringify(event) : `#${String(event.sequence ?? '?')} ${String(event.eventType ?? '')}`),

package/src/http.ts

@@ -1,4 +1,9 @@
-import { getActiveBaseUrl, getServerCredentials, updateServerCredentials } from './credentials.js'
+import {
+  getActiveBaseUrl,
+  getServerCredentials,
+  resolveEnvBearerToken,
+  updateServerCredentials,
+} from './credentials.js'
 import { getFlagBaseUrl, GlobalFlags, normalizeBaseUrl } from './global-flags.js'
 import { LoginResponse, ServerCredentials, SessionServerCredentials } from './types.js'
 
@@ -122,6 +127,23 @@ async function refreshCredentials(baseUrl: string, credentials: ServerCredential
 export async function authedFetch(path: string, init: RequestInit = {}) {
   const baseUrl = resolveBaseUrl()
   assertSecureTokenTransport(baseUrl)
+
+  // In-sandbox pre-auth (ALI-1044): a bearer supplied via ORIZU_TOKEN /
+  // ORIZU_TOKEN_FILE takes precedence over credentials.json. It is externally
+  // managed (the hosted loop rotates the token file), so it is read FRESH here on
+  // every request and NEVER refreshed by this client — on a 401 the loop rotates
+  // the file and the next request naturally picks up the new bearer.
+  const envBearer = resolveEnvBearerToken()
+  if (envBearer) {
+    return await fetch(`${baseUrl}${path}`, {
+      ...init,
+      headers: {
+        ...(init.headers || {}),
+        Authorization: `Bearer ${envBearer}`,
+      },
+    })
+  }
+
   const credentials = getServerCredentials(baseUrl)
   if (!credentials) {
     throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`)

package/src/index.ts

@@ -68,6 +68,11 @@ import { hostedCommand } from './hosted-session-cli.js'
 import { workspaceSyncCommand } from './workspace-sync.js'
 import { runGitCredential } from './git-credential.js'
 import { type GithubLinkResult, runGithubLink, runInteractiveHostedSetup } from './github-setup.js'
+import {
+  reportCommentsCommand,
+  throwDeprecatedPromptCommentsCommand,
+  type ReportCommentsCliContext,
+} from './report-comments-cli.js'
 
 function getErrorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
@@ -144,60 +149,18 @@ interface PromptSummary {
   description?: string | null
 }
 
-interface PromptCommentAuthor {
-  name: string
-  initials?: string
-  color?: string
-}
-
-interface PromptCommentAnchor {
-  text: string | null
-  startLine: number | null
-  endLine: number | null
-}
-
-interface PromptCommentReply {
-  id: string
-  body: string
-  author: PromptCommentAuthor
-  createdAt: string
-  updatedAt: string
-}
-
-interface PromptCommentThread {
-  id: string
-  status: 'open' | 'resolved'
-  body: string
-  anchor: PromptCommentAnchor | null
-  author: PromptCommentAuthor
-  createdAt: string
-  updatedAt: string
-  resolvedAt: string | null
-  resolvedByUserId: string | null
-  replyCount: number
-  replies: PromptCommentReply[]
-}
-
-interface PromptCommentsPayload {
-  prompt: {
-    id: string
-    name: string
-    role: string
-    description?: string | null
-  }
-  version: {
+interface TaskReportPayload {
+  task: {
     id: string
-    versionNumber?: number
-    versionLabel?: string | null
+    title?: string | null
     status?: string | null
+    report: {
+      markdown: string
+      sourceName: string | null
+      createdAt: string | null
+      updatedAt?: string | null
+    }
   }
-  summary: {
-    threadCount: number
-    openThreadCount: number
-    resolvedThreadCount: number
-    replyCount: number
-  }
-  comments: PromptCommentThread[]
 }
 
 interface ScorerSummary {
@@ -1083,78 +1046,6 @@ function printTaskStatusSummary(data: TaskStatusPayload) {
   }
 }
 
-function compactTerminalText(value: string, maxLength = 160): string {
-  const compact = sanitizeTerminalText(value).replace(/\s+/g, ' ').trim()
-  if (compact.length <= maxLength) {
-    return compact
-  }
-
-  return `${compact.slice(0, Math.max(0, maxLength - 1)).trim()}…`
-}
-
-function printIndentedBody(value: string, indent: string) {
-  const lines = sanitizeTerminalText(value || '').split(/\r?\n/)
-  for (const line of lines) {
-    printLine(`${indent}${line}`)
-  }
-}
-
-function formatPromptCommentAnchor(anchor: PromptCommentAnchor | null): string | null {
-  if (!anchor) {
-    return null
-  }
-
-  const lineLabel = anchor.startLine && anchor.endLine
-    ? anchor.startLine === anchor.endLine
-      ? `line ${anchor.startLine}`
-      : `lines ${anchor.startLine}-${anchor.endLine}`
-    : null
-  const selectedText = anchor.text ? `"${compactTerminalText(anchor.text, 180)}"` : null
-
-  if (lineLabel && selectedText) {
-    return `${lineLabel}: ${selectedText}`
-  }
-  return lineLabel || selectedText
-}
-
-function printPromptComments(data: PromptCommentsPayload) {
-  const versionLabel = data.version.versionLabel || (
-    data.version.versionNumber ? `v${data.version.versionNumber}` : data.version.id
-  )
-
-  printLine(`Prompt: ${sanitizeTerminalText(data.prompt.name)} (${sanitizeTerminalText(data.prompt.id)})`)
-  printLine(`Version: ${sanitizeTerminalText(String(versionLabel))} (${sanitizeTerminalText(data.version.id)})`)
-  printLine(
-    `Comments: ${data.summary.threadCount} thread${data.summary.threadCount === 1 ? '' : 's'} ` +
-    `(${data.summary.openThreadCount} open, ${data.summary.resolvedThreadCount} resolved, ${data.summary.replyCount} replies)`
-  )
-
-  if (data.comments.length === 0) {
-    printLine('\nNo comments found for this prompt version.')
-    return
-  }
-
-  for (const [index, thread] of data.comments.entries()) {
-    const authorName = thread.author?.name || 'Unknown'
-    const anchor = formatPromptCommentAnchor(thread.anchor)
-    printLine('')
-    printLine(`${index + 1}. [${thread.status}] ${sanitizeTerminalText(authorName)} · ${sanitizeTerminalText(thread.createdAt)}`)
-    if (anchor) {
-      printLine(`   Selection: ${anchor}`)
-    }
-    printIndentedBody(thread.body, '   ')
-
-    if (thread.replies.length > 0) {
-      printLine(`   Replies (${thread.replies.length})`)
-      for (const reply of thread.replies) {
-        const replyAuthor = reply.author?.name || 'Unknown'
-        printLine(`   - ${sanitizeTerminalText(replyAuthor)} · ${sanitizeTerminalText(reply.createdAt)}`)
-        printIndentedBody(reply.body, '     ')
-      }
-    }
-  }
-}
-
 const DEFAULT_AUTH_CALLBACK_PORT = 43123
 
 function resolveAuthCallbackPort(): number {
@@ -1562,37 +1453,6 @@ async function listJudges() {
   printPromptSummaries(data.judges, 'No judges found.')
 }
 
-async function listPromptComments() {
-  const promptRef = getPositionalArg(2)
-  const project = getArg('--project') || await resolveProjectSlug(null)
-  const label = getArg('--label')
-  const version = getArg('--version')
-
-  if (!promptRef) {
-    throw new Error('Usage: orizu prompts comments <prompt-id-or-name> --project <team/project> [--label <label> | --version <version-id>] [--json]')
-  }
-  if (label && version) {
-    throw new Error('Use either --label or --version, not both')
-  }
-
-  const params = new URLSearchParams({ project })
-  if (label) params.set('label', label)
-  if (version) params.set('version', version)
-
-  const response = await authedFetch(`/api/cli/prompts/${encodeURIComponent(promptRef)}/comments?${params.toString()}`)
-  if (!response.ok) {
-    throw new Error(`Failed to fetch prompt comments: ${await response.text()}`)
-  }
-
-  const data = await parseJsonResponse<PromptCommentsPayload>(response, 'Prompt comments')
-  if (hasJsonFlag()) {
-    printJson(data as unknown as Record<string, unknown>)
-    return
-  }
-
-  printPromptComments(data)
-}
-
 async function listScorers() {
   const project = getArg('--project') || await resolveProjectSlug(null)
   const response = await authedFetch(`/api/cli/scorers?project=${encodeURIComponent(project)}`)
@@ -2957,6 +2817,22 @@ function printJson(value: Record<string, unknown>) {
   printLine(JSON.stringify(value))
 }
 
+function createReportCommentsCliContext(): ReportCommentsCliContext {
+  return {
+    getArg,
+    getPositionalArg,
+    rejectDashPrefixedOptionValue,
+    resolveProjectSlug,
+    readSourceFile,
+    authedFetch,
+    parseJsonResponse,
+    hasJsonFlag,
+    printJson,
+    printLine,
+    sanitizeTerminalText,
+  }
+}
+
 function printCapabilities() {
   const capabilities = getCapabilities(getCliVersion())
   if (hasJsonFlag()) {
@@ -4994,6 +4870,39 @@ async function setTaskReport() {
   )
 }
 
+async function getTaskReport() {
+  const taskId = getArg('--task')
+  rejectDashPrefixedOptionValue('--task', taskId)
+  if (!taskId) {
+    throw new Error('Usage: orizu tasks report get --task <taskId> [--json]')
+  }
+
+  const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}/report`)
+  if (!response.ok) {
+    throw new Error(`Failed to read task report: ${await response.text()}`)
+  }
+
+  const data = await parseJsonResponse<TaskReportPayload>(response, 'Task report get')
+  if (hasJsonFlag()) {
+    printJson(data as unknown as Record<string, unknown>)
+    return
+  }
+
+  const title = data.task.title ? `${data.task.title} ` : ''
+  printLine(`Task report: ${sanitizeTerminalText(title)}(${sanitizeTerminalText(data.task.id)})`)
+  if (data.task.status) {
+    printLine(`Status: ${sanitizeTerminalText(data.task.status)}`)
+  }
+  if (data.task.report.sourceName) {
+    printLine(`Source: ${sanitizeTerminalText(data.task.report.sourceName)}`)
+  }
+  if (data.task.report.createdAt) {
+    printLine(`Created: ${sanitizeTerminalText(data.task.report.createdAt)}`)
+  }
+  printLine('')
+  printLine(sanitizeTerminalText(data.task.report.markdown))
+}
+
 interface AppDetailPayload {
   id: string
   name: string
@@ -6339,6 +6248,11 @@ export async function main(rawArgs = process.argv.slice(2)) {
     return
   }
 
+  if (command === 'comments') {
+    await reportCommentsCommand(subcommand, createReportCommentsCliContext())
+    return
+  }
+
   if (command === 'teams' && subcommand === 'list') {
     await listTeams()
     return
@@ -6383,8 +6297,7 @@ export async function main(rawArgs = process.argv.slice(2)) {
   }
 
   if (command === 'prompts' && subcommand === 'comments') {
-    await listPromptComments()
-    return
+    throwDeprecatedPromptCommentsCommand()
   }
 
   if (command === 'prompts' && subcommand === 'pull') {
@@ -6594,6 +6507,11 @@ export async function main(rawArgs = process.argv.slice(2)) {
     return
   }
 
+  if (command === 'tasks' && subcommand === 'report' && cliArgs[2] === 'get') {
+    await getTaskReport()
+    return
+  }
+
   if (command === 'tasks' && subcommand === 'pause') { await updateTaskStatus('paused'); return }
   if (command === 'tasks' && subcommand === 'unpause') { await updateTaskStatus('active'); return }
   if (command === 'tasks' && subcommand === 'complete') { await updateTaskStatus('completed'); return }

package/src/manifests-cli.ts

@@ -16,7 +16,7 @@ export interface ManifestsCommandIo {
   resolveProjectSlug?: (arg: string | null) => Promise<string>
 }
 
-const MANIFEST_ACTIONS = new Set(['approve', 'reject', 'apply'])
+const MANIFEST_ACTIONS = new Set(['approve', 'reject', 'apply', 'revert'])
 
 async function responseMessage(response: Response): Promise<string> {
   try {
@@ -93,6 +93,28 @@ function num(value: unknown): number {
   return typeof value === 'number' ? value : 0
 }
 
+// Auto-applied manifests (ALI-1040) landed by SERVER POLICY, not a human approver
+// (approved_by is NULL). Mark them so a reviewer can tell policy applies from
+// human applies at a glance; the reason lives in the outcome for `show`.
+function wasAutoApplied(manifest: Record<string, unknown>): boolean {
+  return asRecord(manifest.outcome).autoApplied === true
+}
+
+/** STATUS cell: `applied*` when the server auto-applied it, else the raw status. */
+function statusDisplay(manifest: Record<string, unknown>): string {
+  const status = typeof manifest.status === 'string' ? manifest.status : '(unknown)'
+  return wasAutoApplied(manifest) ? `${status}*` : status
+}
+
+/** One-line auto-apply audit note for `show`, or null when not auto-applied. */
+function autoApplyNote(manifest: Record<string, unknown>): string | null {
+  if (!wasAutoApplied(manifest)) return null
+  const reason = asRecord(manifest.outcome).autoApplyReason
+  return typeof reason === 'string' && reason.length > 0
+    ? `auto-applied by policy: ${reason}`
+    : 'auto-applied by policy'
+}
+
 // -- list table (ALI-1038) ----------------------------------------------------
 
 /** "3m" / "4h" / "2d" — enough resolution to pick a manifest out of a list. */
@@ -133,7 +155,7 @@ function manifestsTable(manifests: Record<string, unknown>[], now: number): stri
   if (manifests.length === 0) return 'promotion manifests\n(none)'
   const rows = [...manifests].sort(listOrder).map(manifest => ({
     id: typeof manifest.id === 'string' ? manifest.id : '(unknown)',
-    status: typeof manifest.status === 'string' ? manifest.status : '(unknown)',
+    status: statusDisplay(manifest),
     type: typeof manifest.actionType === 'string' ? manifest.actionType : '(unknown)',
     changes: changesSummary(manifest),
     author: typeof manifest.authorActorType === 'string' ? manifest.authorActorType : '-',
@@ -207,7 +229,9 @@ export async function manifestsCommand(args: string[], io: ManifestsCommandIo):
     const response = await fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`)
     const data = await requireOk(response, 'Manifest show')
     const manifest = (data.manifest ?? {}) as Record<string, unknown>
-    const human = manifest.actionType === 'repo_merge' ? repoMergeShow(manifest) : manifestLine(manifest)
+    const base = manifest.actionType === 'repo_merge' ? repoMergeShow(manifest) : manifestLine(manifest)
+    const note = autoApplyNote(manifest)
+    const human = note ? `${base}\n  ${note}` : base
     emit(io, { manifest }, human)
     return 0
   }
@@ -244,6 +268,6 @@ export async function manifestsCommand(args: string[], io: ManifestsCommandIo):
     return 0
   }
 
-  io.print('Usage: orizu manifests <list|show|approve|reject|apply> ... [--json]')
+  io.print('Usage: orizu manifests <list|show|approve|reject|apply|revert> ... [--json]')
   return 1
 }