@alpic-ai/tracks 0.5.1 → 0.7.1

package/dist/main.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
 import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity, OpenApi } from "effect/http-api";
-import { Config, Console, Context, Deferred, Effect, Layer, Option, Redacted, Result, Schema, SchemaTransformation, Stream, Struct } from "effect";
-import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { Config, Console, Context, Deferred, Effect, FileSystem, Layer, Option, Path, Redacted, Result, Schedule, Schema, SchemaTransformation, Stream, Struct } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 import { isIPv4 } from "node:net";
-import { Argument, Command, Flag } from "effect/cli";
+import { Argument, CliError, Command, Flag } from "effect/cli";
 import { createServer } from "node:http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 Context.Service()("@tracks/contract/RequestOrganization");
@@ -30,8 +30,7 @@ const List = (item) => Schema.Struct({
 	data: Schema.Array(item),
 	has_more: Schema.Boolean.annotate({ description: "Whether more items are available after this page." })
 });
-//#endregion
-//#region ../contract/src/validation.ts
+// ../contract/src/validation.ts
 const RequestIssue = Schema.Struct({
 	path: Schema.Array(Schema.Union([Schema.String, Schema.Number])).annotate({ description: "Keys leading to the wrong value inside that part of the request, such as `[\"agent\", \"model\"]`. Empty when the problem concerns that part as a whole." }),
 	message: Schema.String.annotate({ description: "What is wrong with the value." })
@@ -53,8 +52,7 @@ var InvalidRequest = class extends Schema.TaggedError()("InvalidRequest", {
 	description: "The request is invalid: a value is missing, has the wrong type or is out of range. Fix it before sending the request again."
 }) {};
 var RequestValidation = class extends HttpApiMiddleware.Service()("@tracks/contract/RequestValidation", { error: InvalidRequest }) {};
-//#endregion
-//#region ../contract/src/connections.ts
+// ../contract/src/connections.ts
 const ConnectionId = Schema.String.pipe(Schema.brand("ConnectionId")).annotate({
 	identifier: "ConnectionId",
 	description: "Unique identifier of the connection."
@@ -114,7 +112,7 @@ var ConnectionsApi = class extends HttpApiGroup.make("connections").add(HttpApiE
 	error: [ConnectionRefused, ServerUnreachable]
 }).annotateMerge(OpenApi.annotations({
 	summary: "Create a connection",
-	description: "Starts connecting to an MCP server that acts as one of its users. Send the user's browser to `consent_url`. Once they consent, they get a `confirmation`: as a code shown to them, to give back to you, or, if you passed the optional `return_url`, sent to it with `connection_id`. Confirm the connection with it within 10 minutes to make it `active`, then give its MCP server's URL to runs."
+	description: "Starts connecting to an MCP server that acts as one of its users. Send the user's browser to `consent_url`. Once they consent, they get a `confirmation`: as a code shown to them, to give back to you, or, if you passed the optional `return_url`, sent to it with `connection_id`. Confirm the connection with it within 10 minutes to make it `active`, then give its `id` to runs as `connection_id`."
 })), HttpApiEndpoint.get("list", "/connections", { success: List(Connection) }).annotateMerge(OpenApi.annotations({
 	summary: "List connections",
 	description: "Returns every connection."
@@ -144,22 +142,62 @@ var ConnectionsApi = class extends HttpApiGroup.make("connections").add(HttpApiE
 	title: "Connections",
 	description: "Let agents use MCP servers as one of their users, without their credentials entering the sandbox."
 })).middleware(ApiKeyAuthorization).middleware(RequestValidation) {};
-//#endregion
-//#region ../contract/src/runs.ts
+// ../contract/src/files.ts
+const FileId = Schema.String.check(Schema.isPattern(/^[0-9a-f-]{36}$/)).pipe(Schema.brand("FileId")).annotate({ description: "Reference returned when requesting a file upload." });
+const FileName = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._ -]{0,127}$/)).annotate({ description: "Filename, without directories; up to 128 ASCII letters, digits, spaces, dots, hyphens or underscores, starting with a letter or digit." });
+const FileContentType = Schema.String.check(Schema.isPattern(/^[\w!#$&^.+-]{1,127}\/[\w!#$&^.+-]{1,127}$/)).annotate({ description: "MIME type, without parameters; `application/octet-stream` when unknown." });
+const FileSize = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 20971520
+})).annotate({ description: "Exact size in bytes, from 1 to 20 MiB." });
+const CreateUploadInput = Schema.Struct({
+	name: FileName,
+	content_type: FileContentType,
+	size: FileSize
+});
+const InputFile = Schema.Struct({
+	id: FileId,
+	name: FileName,
+	content_type: FileContentType,
+	size: FileSize,
+	path: Schema.String.annotate({ description: "Absolute path in the agent's sandbox." }),
+	download_url: Schema.String.annotate({ description: "Signed download URL, valid for 15 minutes." }),
+	download_expires_at: Schema.DateTimeUtc.annotate({ description: "When the download URL expires; fetch the run again to get a fresh link." })
+});
+var FileUnavailable = class extends Schema.TaggedError()("FileUnavailable", { message: Schema.String }, {
+	httpApiStatus: 422,
+	description: "An input file is missing, expired, or inaccessible to your organization."
+}) {};
+var FilesApi = class extends HttpApiGroup.make("files").add(HttpApiEndpoint.post("createUpload", "/files", {
+	payload: CreateUploadInput,
+	success: Schema.Struct({
+		id: FileId,
+		url: Schema.String,
+		method: Schema.Literal("PUT"),
+		headers: Schema.Record(Schema.String, Schema.String),
+		upload_expires_at: Schema.DateTimeUtc,
+		expires_at: Schema.DateTimeUtc
+	}).pipe(HttpApiSchema.status(201))
+}).annotateMerge(OpenApi.annotations({
+	summary: "Request a file upload",
+	description: "Request with `name`, `content_type` and exact byte `size`, e.g. `{\"name\":\"photo.png\",\"content_type\":\"image/png\",\"size\":12345}`. Any type of file, up to 20 MiB each. PUT raw bytes (not JSON or base64) to the returned `url` with every returned header within 15 minutes; browsers set `content-length` from the body. Uploads are write-once; repeating the PUT returns 412. Pass the returned `id` in `input_files` when creating a run. Files in the landing zone expire after 24 hours and are deleted asynchronously. Files attached to a run are retained permanently and their references can be reused by your organization."
+}))).middleware(ApiKeyAuthorization).middleware(RequestValidation) {};
+// ../contract/src/runs.ts
 const RunId = Schema.String.pipe(Schema.brand("RunId")).annotate({
 	identifier: "RunId",
 	description: "Unique identifier of the run."
 });
 const Harness = Schema.Literals([
 	"claude-code",
+	"claude-desktop",
 	"codex",
 	"codex-app",
 	"cursor"
 ]).annotate({
 	identifier: "Harness",
-	description: "The coding agent to run: `claude-code` (Claude Code), `codex` (OpenAI's Codex CLI), `codex-app` (the Codex mode of OpenAI's ChatGPT desktop app, with its browser, computer-use and document tools) or `cursor` (Cursor's CLI)."
+	description: "The coding agent to run: `claude-code` (Claude Code), `claude-desktop` (Cowork, the agent workspace of Anthropic's Claude desktop app, for documents, research and longer tasks), `codex` (OpenAI's Codex CLI), `codex-app` (the Codex mode of OpenAI's ChatGPT desktop app, with its browser, computer-use and document tools) or `cursor` (Cursor's CLI)."
 });
-const Agent = Schema.Struct({
+const Agent$1 = Schema.Struct({
 	harness: Harness,
 	model: Schema.NonEmptyString.annotate({ description: "Model the agent uses, such as `claude-sonnet-5-5`, or a Cursor model id such as `gpt-5.6-luna-low`." })
 }).annotate({
@@ -198,9 +236,14 @@ const MCP_SERVER_NAME = /^[A-Za-z0-9_-]{1,64}$/;
 const MAX_MCP_SERVERS = 20;
 const RESERVED_MCP_SERVER_NAMES = /* @__PURE__ */ new Set(["chatgpt_plugins"]);
 const McpServerName = Schema.String.check(Schema.isPattern(MCP_SERVER_NAME)).annotate({ description: "Name the agent knows the MCP server by, unique in the run, matching `^[A-Za-z0-9_-]{1,64}$`, such as `linear`. `chatgpt_plugins` is reserved for running the agent." });
+const HEADER_NAME = /^[A-Za-z0-9-]{1,64}$/;
+const MAX_HEADERS = 20;
+const MAX_HEADER_VALUE_LENGTH = 8192;
+const McpServerHeaders = Schema.Record(Schema.String, Schema.String.check(Schema.isMaxLength(MAX_HEADER_VALUE_LENGTH), Schema.isPattern(/^[^\r\n]*$/))).annotate({ description: `Headers we add to every request to the MCP server, typically its API key, such as \`{ "Authorization": "Bearer …" }\` or \`{ "x-api-key": "…" }\`. They never enter the sandbox and their values are never returned. Names match \`${HEADER_NAME.source}\`; at most ${MAX_HEADERS} headers of up to ${MAX_HEADER_VALUE_LENGTH} characters each, on one line.` }).check(Schema.isMinProperties(1), Schema.isMaxProperties(MAX_HEADERS), Schema.isPropertyNames(Schema.String.check(Schema.isPattern(HEADER_NAME))));
 const McpServerInput = Schema.Union([Schema.Struct({
 	name: McpServerName,
-	url: HttpsUrl.annotate({ description: "URL of the MCP server. When you have one `active` connection to this exact URL, the agent uses it; otherwise the server is used without one. Requests come from the addresses listed at `GET /egress-ips`." }),
+	url: HttpsUrl.annotate({ description: "URL of the MCP server, called with `headers` if you set them, otherwise without credentials. To call it as a user, give a `connection_id` instead. Requests come from the addresses listed at `GET /egress-ips`." }),
+	headers: Schema.OptionFromOptionalKey(McpServerHeaders),
 	connection_id: Schema.optionalKey(Schema.Never)
 }).annotate({
 	identifier: "McpServerByUrlInput",
@@ -208,13 +251,14 @@ const McpServerInput = Schema.Union([Schema.Struct({
 }), Schema.Struct({
 	name: McpServerName,
 	connection_id: ConnectionId.annotate({ description: "An `active` connection: the agent uses its MCP server as the user who consented." }),
-	url: Schema.optionalKey(Schema.Never)
+	url: Schema.optionalKey(Schema.Never),
+	headers: Schema.optionalKey(Schema.Never)
 }).annotate({
 	identifier: "McpServerByConnectionInput",
-	description: "An MCP server given by a connection to it, to pick between several accounts."
+	description: "An MCP server given by a connection to it, called as the user who consented."
 })]).annotate({
 	identifier: "McpServerInput",
-	description: "An MCP server the agent can use, reached through us: credentials never enter the sandbox. Set `url` or `connection_id`."
+	description: "An MCP server the agent can use, reached through us: credentials never enter the sandbox. Set `url`, with `headers` if it takes an API key, or `connection_id`."
 });
 const McpServersInput = Schema.Array(McpServerInput).check(Schema.isMaxLength(MAX_MCP_SERVERS), Schema.makeFilter((servers) => {
 	const names = servers.map((server) => server.name);
@@ -223,11 +267,66 @@ const McpServersInput = Schema.Array(McpServerInput).check(Schema.isMaxLength(MA
 	path: [index, "name"],
 	issue: "Expected a name not reserved for the agent"
 }] : []))).annotate({ description: `MCP servers the agent can use, at most ${MAX_MCP_SERVERS}.` });
+const SKILL_NAME = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const SKILL_ENTRY = "SKILL.md";
+const MAX_SKILLS = 20;
+const MAX_SKILL_FILES = 100;
+const MAX_SKILLS_BYTES = 2097152;
+const MAX_SKILL_DESCRIPTION_LENGTH = 1024;
+const MAX_SKILL_PATH_LENGTH = 200;
+const RESERVED_SKILL_NAMES = /* @__PURE__ */ new Set(["plugin-management"]);
+const FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
+const frontmatterValue = (content, key) => {
+	const block = FRONTMATTER.exec(content)?.[1];
+	const unquoted = (block === void 0 ? void 0 : new RegExp(`^${key}:[ \\t]*(.*)$`, "m").exec(block)?.[1])?.trim().replace(/^(["'])(.*)\1$/, "$2");
+	return unquoted === "" ? void 0 : unquoted;
+};
+const SkillFileInput = Schema.Struct({
+	path: Schema.String.check(Schema.isMaxLength(MAX_SKILL_PATH_LENGTH), Schema.makeFilter((path) => !path.includes("\\") && path.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..") || "Expected a plain relative path, such as scripts/build.sh")).annotate({ description: `Path of the file in the skill's folder, such as \`${SKILL_ENTRY}\` or \`scripts/build.sh\`, of up to ${MAX_SKILL_PATH_LENGTH} characters.` }),
+	content: Schema.String.annotate({ description: "Text of the file. A file starting with `#!` is made executable." })
+}).annotate({
+	identifier: "SkillFileInput",
+	description: "A text file of a skill."
+});
+const skillEntryIssue = (skill) => {
+	const entry = skill.files.find((file) => file.path === SKILL_ENTRY);
+	if (entry === void 0) return `Expected a ${SKILL_ENTRY}`;
+	if (frontmatterValue(entry.content, "name") !== skill.name) return `Expected its ${SKILL_ENTRY} to give its name, ${skill.name}, in its frontmatter`;
+	const description = frontmatterValue(entry.content, "description");
+	if (description === void 0) return `Expected its ${SKILL_ENTRY} to give a description in its frontmatter`;
+	if (description.length > MAX_SKILL_DESCRIPTION_LENGTH) return `Expected a description of at most ${MAX_SKILL_DESCRIPTION_LENGTH} characters`;
+	return true;
+};
+const SkillInput = Schema.Struct({
+	name: Schema.String.check(Schema.isMaxLength(64), Schema.isPattern(SKILL_NAME)).annotate({ description: `Name of the skill, unique in the run, matching \`${SKILL_NAME.source}\` and up to 64 characters, such as \`release-notes\`. \`plugin-management\` is reserved for running the agent.` }),
+	files: Schema.Array(SkillFileInput).check(Schema.isMaxLength(MAX_SKILL_FILES), Schema.makeFilter((files) => {
+		const paths = files.map((file) => file.path);
+		return new Set(paths).size === paths.length || "Expected each file path once";
+	})).annotate({ description: `The files of the skill's folder, at most ${MAX_SKILL_FILES}, including a \`${SKILL_ENTRY}\` whose frontmatter gives the skill's \`name\` and a \`description\` of up to ${MAX_SKILL_DESCRIPTION_LENGTH} characters.` })
+}).check(Schema.makeFilter((skill) => {
+	const issue = skillEntryIssue(skill);
+	return issue === true || {
+		path: ["files"],
+		issue
+	};
+})).annotate({
+	identifier: "SkillInput",
+	description: "An Agent Skill: instructions and the text files they point to, installed for the agent before setup, outside the repository."
+});
+const encoder = new TextEncoder();
+const SkillsInput = Schema.Array(SkillInput).check(Schema.isMaxLength(MAX_SKILLS), Schema.makeFilter((skills) => {
+	const names = skills.map((skill) => skill.name);
+	return new Set(names).size === names.length || "Skill names must be unique";
+}), Schema.makeFilter((skills) => skills.flatMap((skill, index) => RESERVED_SKILL_NAMES.has(skill.name) ? [{
+	path: [index, "name"],
+	issue: "Expected a name not reserved for the agent"
+}] : [])), Schema.makeFilter((skills) => skills.flatMap((skill) => skill.files).reduce((total, file) => total + encoder.encode(file.content).length, 0) <= MAX_SKILLS_BYTES || `Expected at most ${MAX_SKILLS_BYTES / 1024 / 1024} MB of skills together`)).annotate({ description: `Skills the agent can load, at most ${MAX_SKILLS} and ${MAX_SKILLS_BYTES / 1024 / 1024} MB together.` });
 const EnvironmentInput = Schema.Struct({
 	repository,
 	variables: Schema.OptionFromOptionalKey(Variables$1),
 	setup,
 	teardown,
+	skills: Schema.OptionFromOptionalKey(SkillsInput),
 	mcp_servers: Schema.OptionFromOptionalKey(McpServersInput)
 }).annotate({
 	identifier: "EnvironmentInput",
@@ -236,16 +335,25 @@ const EnvironmentInput = Schema.Struct({
 const RunMcpServer = Schema.Struct({
 	name: Schema.String.annotate({ description: "Name the agent knows the MCP server by." }),
 	url: Schema.String.annotate({ description: "URL of the MCP server." }),
-	connection_id: Schema.OptionFromOptionalKey(ConnectionId.annotate({ description: "The connection the agent uses it through, if any." }))
+	connection_id: Schema.OptionFromOptionalKey(ConnectionId.annotate({ description: "The connection the agent uses it through, if any." })),
+	headers: Schema.Array(Schema.String).annotate({ description: "Names of the headers we add to every request to the MCP server. Their values are never returned." })
 }).annotate({
 	identifier: "McpServer",
 	description: "An MCP server the agent can use."
 });
+const RunSkill = Schema.Struct({
+	name: Schema.String.annotate({ description: "Name of the skill." }),
+	files: Schema.Array(Schema.String).annotate({ description: "Paths of the files in the skill's folder." })
+}).annotate({
+	identifier: "Skill",
+	description: "A skill the agent can load."
+});
 const RunEnvironment = Schema.Struct({
 	repository,
 	variables: Schema.Array(Schema.String).annotate({ description: "Names of the environment variables set in every process of the agent. Their values are never returned." }),
 	setup,
 	teardown,
+	skills: Schema.Array(RunSkill),
 	mcp_servers: Schema.Array(RunMcpServer)
 }).annotate({
 	identifier: "Environment",
@@ -255,6 +363,7 @@ const LABEL_KEY_PATTERN = "[A-Za-z0-9_.-]{1,64}";
 const LABEL_KEY = new RegExp(`^${LABEL_KEY_PATTERN}$`);
 const MAX_LABELS = 20;
 const MAX_LABEL_VALUE_LENGTH = 256;
+const STARTED_BY_LABEL = "started_by";
 const Labels = Schema.Record(Schema.String, Schema.String.check(Schema.isMaxLength(MAX_LABEL_VALUE_LENGTH))).annotate({ description: `Labels you attach to the run to find it again, as keys and values, such as \`{ "ticket": "ENG-42" }\`. We never read them. Keys match \`${LABEL_KEY.source}\`; at most ${MAX_LABELS} labels with values of up to ${MAX_LABEL_VALUE_LENGTH} characters.` }).check(Schema.isMaxProperties(MAX_LABELS), Schema.makeFilter((labels) => Object.keys(labels).flatMap((key) => LABEL_KEY.test(key) ? [] : [{
 	path: [key],
 	issue: `Expected a key matching ${LABEL_KEY.source}`
@@ -271,17 +380,19 @@ const LabelFilters = Schema.Array(Schema.String.check(Schema.isPattern(LABEL_FIL
 	decode: (filters) => Object.fromEntries(filters.map(keyAndValueOf)),
 	encode: (labels) => Object.entries(labels).map(([key, value]) => `${key}:${value}`)
 })));
+const MAX_BUDGET_USD = 1e4;
 const Budget = Schema.Finite.check(Schema.isBetween({
 	minimum: .01,
-	maximum: 1e4
+	maximum: MAX_BUDGET_USD
 })).annotate({ description: "Maximum the run may spend, in US dollars. Defaults to a standard budget when omitted. The run ends with `budget_exceeded` once it is reached." });
 const MIN_IDLE_TIMEOUT_SECONDS = 120;
 const MAX_IDLE_TIMEOUT_SECONDS = 900;
 const MIN_TIME_LIMIT_SECONDS = 60;
 const MAX_TIME_LIMIT_SECONDS = 43200;
 const CreateRunInput = Schema.Struct({
-	agent: Agent,
+	agent: Agent$1,
 	prompt: Schema.NonEmptyString.annotate({ description: "What you ask the agent to do first." }),
+	input_files: Schema.optionalKey(Schema.Array(FileId).check(Schema.isMaxLength(20)).annotate({ description: "Up to 20 uploaded file ids, staged in the sandbox before setup and referenced in the first prompt." })),
 	environment: EnvironmentInput,
 	labels: Schema.optionalKey(Labels),
 	budget_usd: Schema.OptionFromOptionalKey(Budget),
@@ -294,7 +405,10 @@ const CreateRunInput = Schema.Struct({
 		minimum: MIN_TIME_LIMIT_SECONDS,
 		maximum: MAX_TIME_LIMIT_SECONDS
 	})).annotate({ description: `Longest the run may last, in seconds from when it starts, from ${MIN_TIME_LIMIT_SECONDS} to ${MAX_TIME_LIMIT_SECONDS}. Defaults to 7200. Once reached, the run ends with \`time_limit\`, even in the middle of a prompt.` }))
-}).check(Schema.makeFilter((input) => Option.contains(input.one_shot, false) || Option.isNone(input.idle_timeout_seconds) || "idle_timeout_seconds is only allowed when one_shot is false")).annotate({ identifier: "CreateRunInput" });
+}).check(Schema.makeFilter((input) => Option.contains(input.one_shot, false) || Option.isNone(input.idle_timeout_seconds) || "idle_timeout_seconds is only allowed when one_shot is false"), Schema.makeFilter((input) => Object.keys(input.labels ?? {}).filter((key) => key !== STARTED_BY_LABEL).length < MAX_LABELS || {
+	path: ["labels"],
+	issue: `Expected at most 19 labels besides ${STARTED_BY_LABEL}, which is set to the API key`
+})).annotate({ identifier: "CreateRunInput" });
 const SendPromptInput = Schema.Struct({
 	text: Schema.NonEmptyString.annotate({ description: "What you ask the agent to do next." }),
 	model: Schema.OptionFromOptionalKey(Schema.NonEmptyString.annotate({ description: "Model for this prompt only. Defaults to the run's model." }))
@@ -350,8 +464,9 @@ const FailureKind = Schema.Literals([
 });
 const runFields = {
 	id: RunId,
+	input_files: Schema.Array(InputFile),
 	labels: Labels.annotate({ description: "Labels attached to the run when it was created." }),
-	agent: Agent,
+	agent: Agent$1,
 	environment: RunEnvironment,
 	budget_usd: Schema.Number.annotate({ description: "Maximum the run may spend, in US dollars." }),
 	one_shot: Schema.Boolean.annotate({ description: "Whether the run ends as soon as its first prompt finishes." }),
@@ -406,7 +521,7 @@ var RunNotFound = class extends Schema.TaggedError()("RunNotFound", { message: S
 }) {};
 var ConnectionUnusable = class extends Schema.TaggedError()("ConnectionUnusable", { message: Schema.String }, {
 	httpApiStatus: 422,
-	description: "A `connection_id` in `environment.mcp_servers` does not exist or is not `active`, or a `url` matches several `active` connections: pick one with `connection_id`."
+	description: "A `connection_id` in `environment.mcp_servers` does not exist or is not `active`."
 }) {};
 var ModelNotOffered = class extends Schema.TaggedError()("ModelNotOffered", { message: Schema.String }, {
 	httpApiStatus: 422,
@@ -431,13 +546,13 @@ var RunNotIdle = class extends Schema.TaggedError()("RunNotIdle", { message: Sch
 	httpApiStatus: 409,
 	description: "The run accepts no prompt now: it is one-shot, has ended, or is still working on a prompt."
 }) {};
-const Count = Schema.Natural;
+const Count$1 = Schema.Natural;
 const RunUsage = Schema.Struct({
 	cost_usd: Schema.Number.annotate({ description: "Total cost of the run so far, in US dollars." }),
 	models: Schema.Array(Schema.Struct({
 		provider: Schema.String.annotate({ description: "Company serving the model, such as `anthropic`." }),
 		model: Schema.String,
-		quantities: Schema.Record(Schema.String, Count).annotate({ description: "Units consumed, keyed by unit as the provider counts them, such as input tokens or web searches." }),
+		quantities: Schema.Record(Schema.String, Count$1).annotate({ description: "Units consumed, keyed by unit as the provider counts them, such as input tokens or web searches." }),
 		cost_usd: Schema.Number.annotate({ description: "Cost of this model's usage, in US dollars." })
 	})).annotate({ description: "Model usage, one entry per model." }),
 	sandbox: Schema.Struct({
@@ -566,19 +681,15 @@ const EventStreamItem = Schema.Union([Schema.Struct({
 	event: Schema.Literal("heartbeat"),
 	data: Schema.Literal("")
 })]);
-const STARTED_BY_LABEL = "started_by";
-const CreateRunInputBesidesStartedBy = CreateRunInput.check(Schema.makeFilter((input) => Object.keys(input.labels ?? {}).filter((key) => key !== STARTED_BY_LABEL).length < MAX_LABELS || {
-	path: ["labels"],
-	issue: `Expected at most 19 labels besides ${STARTED_BY_LABEL}, which is set to the API key`
-}));
 var RunsApi = class extends HttpApiGroup.make("runs").add(HttpApiEndpoint.post("create", "/runs", {
 	headers: { "idempotency-key": Schema.OptionFromOptionalKey(Schema.NonEmptyString.check(Schema.isMaxLength(255)).annotate({ description: "A unique value you choose, up to 255 characters, to retry safely: a request with a key already used in your organization returns the run the first request created, without starting another, whatever its body." })) },
-	payload: CreateRunInputBesidesStartedBy,
+	payload: CreateRunInput,
 	success: Run.pipe(HttpApiSchema.status(201)),
 	error: [
 		ModelNotOffered,
 		ModelProviderUnavailable,
 		ConnectionUnusable,
+		FileUnavailable,
 		InsufficientBalance,
 		OrganizationBlocked
 	]
@@ -686,8 +797,328 @@ var RunsApi = class extends HttpApiGroup.make("runs").add(HttpApiEndpoint.post("
 	title: "Runs",
 	description: "Start coding agents and follow their work."
 })).middleware(ApiKeyAuthorization).middleware(RequestValidation) {};
-//#endregion
-//#region ../contract/src/system.ts
+// ../contract/src/experiments.ts
+const ExperimentId = Schema.String.pipe(Schema.brand("ExperimentId")).annotate({
+	identifier: "ExperimentId",
+	description: "Unique identifier of the experiment."
+});
+const ExecutionId = Schema.String.pipe(Schema.brand("ExecutionId")).annotate({
+	identifier: "ExecutionId",
+	description: "Unique identifier of the execution."
+});
+const Agent = Schema.Struct({
+	harness: Harness,
+	model: Schema.String.annotate({ description: "Model the agent uses, such as `claude-sonnet-5-5`." })
+}).annotate({
+	identifier: "ExperimentAgent",
+	description: "A coding agent and the model it uses."
+});
+const MAX_ID_LENGTH = 128;
+const idChosenFor = (item, example) => Schema.NonEmptyString.check(Schema.isMaxLength(MAX_ID_LENGTH)).annotate({ description: `Identifier you choose for the ${item}, up to ${MAX_ID_LENGTH} characters, such as \`${example}\`. Results refer to it.` });
+const withUniqueIds = (item, items) => Schema.Array(item).check(Schema.makeFilter((all) => {
+	const ids = all.map((each) => each.id);
+	return new Set(ids).size === ids.length || `Expected each of the ${items}' ids once`;
+}));
+const libraryIds = (items) => Schema.Array(Schema.String).annotate({ description: `Ids of ${items} from your library, as listed by \`GET /library\`.` });
+const Evaluation = Schema.Struct({
+	id: idChosenFor("evaluation, unique in its scenario", "tests-pass"),
+	name: Schema.String.annotate({ description: "Short name of what is checked." }),
+	judging_instructions: Schema.String.annotate({ description: "The yes-or-no question a judge answers from what the agent did, such as `Do the tests pass?`." }),
+	weight: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)).annotate({ description: "How much it counts in the run's score. Defaults to 1." })
+}).annotate({
+	identifier: "Evaluation",
+	description: "One criterion every run of the scenario is judged on."
+});
+const MAX_INPUT_FILES = 20;
+const Scenario = Schema.Struct({
+	id: idChosenFor("scenario, unique in the experiment", "checkout"),
+	name: Schema.String.annotate({ description: "Short name of the scenario." }),
+	prompt: Schema.String.annotate({ description: "What the agent is asked to do." }),
+	input_files: Schema.Array(FileId).check(Schema.isMaxLength(MAX_INPUT_FILES)).annotate({ description: `Up to ${MAX_INPUT_FILES} uploaded file ids, given to each of the scenario's runs. Kept for good once saved. Defaults to none.` }),
+	evaluations: withUniqueIds(Evaluation, "evaluations").annotate({ description: "What a run is judged on. Runs of a scenario without evaluations are not judged." }),
+	passing_score: Schema.OptionFromOptionalKey(Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 100
+	})).annotate({ description: "Score out of 100, weighted by the evaluations' weights, a run needs to pass. Omit it so a run passes only when it passes every evaluation." }))
+}).annotate({
+	identifier: "Scenario",
+	description: "One task given to the agents."
+});
+const AgentTools = Schema.Struct({
+	id: idChosenFor("agent tool configuration, unique in the experiment", "with-docs-mcp"),
+	name: Schema.String.annotate({ description: "Short name of the agent tools, such as `No agent tools` for the baseline." }),
+	skills: libraryIds("skills"),
+	mcp_servers: libraryIds("MCP servers"),
+	command_line_tools: libraryIds("command-line tools")
+}).annotate({
+	identifier: "AgentTools",
+	description: "Skills, MCP servers and command-line tools given to the agent. Keep one with none as the baseline the others are compared to."
+});
+const ExcludedVariant = Schema.Struct({
+	repository_id: Schema.OptionFromOptionalKey(Schema.String.annotate({ description: "Id of one of the experiment's repositories. Omit it for no repository." })),
+	agent_tools_id: Schema.String.annotate({ description: "Id of one of the experiment's agent tool configurations." })
+}).annotate({
+	identifier: "ExcludedVariant",
+	description: "A combination of repository and agent tools not to run."
+});
+const RunSettings = Schema.Struct({
+	repetitions: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1)).annotate({ description: "Identical runs started for each scenario, variant and agent, to compare results beyond chance." }),
+	time_limit_seconds: Schema.Finite.check(Schema.isBetween({
+		minimum: 0,
+		exclusiveMinimum: true,
+		maximum: MAX_TIME_LIMIT_SECONDS
+	})).annotate({ description: `Longest each run may last, in seconds, above 0 and at most ${MAX_TIME_LIMIT_SECONDS}.` }),
+	budget_usd: Schema.Finite.check(Schema.isBetween({
+		minimum: 0,
+		exclusiveMinimum: true,
+		maximum: MAX_BUDGET_USD
+	})).annotate({ description: `Most each run may spend, in US dollars, above 0 and at most ${MAX_BUDGET_USD}.` }),
+	setup: script("Shell script run in each run's sandbox after checkout and before the prompt."),
+	teardown: script("Shell script run in each run's sandbox after the run ends."),
+	variables: Schema.Array(Schema.Struct({
+		name: Schema.String,
+		value: Schema.String
+	})).annotate({ description: "Environment variables set in every process of each run's agent, each name once. Defaults to none." })
+}).annotate({
+	identifier: "RunSettings",
+	description: "What every run of the experiment shares."
+});
+const experimentFields = {
+	name: Schema.String.annotate({ description: "Name of the experiment." }),
+	scenarios: withUniqueIds(Scenario, "scenarios"),
+	agents: Schema.Array(Agent).annotate({ description: "Agents every scenario is given to, each once." }),
+	repositories: libraryIds("repositories").annotate({ description: "Ids of repositories from your library, as listed by `GET /library`, each once, tried in turn with every agent tool configuration. Defaults to none: runs start without a repository." }),
+	agent_tools: withUniqueIds(AgentTools, "agent_tools").annotate({ description: "Agent tool configurations each tried in turn with every repository." }),
+	excluded_variants: Schema.Array(ExcludedVariant).annotate({ description: "Combinations of repository and agent tools not to run. Every other combination is a variant, run for each scenario and agent. Defaults to none." }),
+	run_settings: RunSettings
+};
+const Experiment = Schema.Struct({
+	id: ExperimentId,
+	...experimentFields
+}).annotate({
+	identifier: "Experiment",
+	description: "Scenarios given to several agents in several variants, each run judged on the scenario's evaluations."
+});
+const EvaluationInput = Evaluation.mapFields(Struct.evolve({ weight: (weight) => weight.pipe(Schema.withDecodingDefaultKey(Effect.succeed(1))) })).annotate({ identifier: "EvaluationInput" });
+const ScenarioInput = Scenario.mapFields(Struct.evolve({
+	input_files: (inputFiles) => inputFiles.pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+	evaluations: () => withUniqueIds(EvaluationInput, "evaluations")
+})).annotate({ identifier: "ScenarioInput" });
+const RunSettingsInput = RunSettings.mapFields(Struct.evolve({ variables: (variables) => variables.pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))) })).annotate({ identifier: "RunSettingsInput" });
+const unknownExclusions = (input) => input.excluded_variants.flatMap((excluded, index) => [...input.agent_tools.some((agentTools) => agentTools.id === excluded.agent_tools_id) ? [] : [{
+	path: [
+		"excluded_variants",
+		index,
+		"agent_tools_id"
+	],
+	issue: "Expected the id of one of the agent tool configurations"
+}], ...Option.match(excluded.repository_id, {
+	onNone: () => true,
+	onSome: (repository) => input.repositories.includes(repository)
+}) ? [] : [{
+	path: [
+		"excluded_variants",
+		index,
+		"repository_id"
+	],
+	issue: "Expected one of the repositories"
+}]]);
+const ExperimentInput = Schema.Struct(experimentFields).mapFields(Struct.evolve({
+	scenarios: () => withUniqueIds(ScenarioInput, "scenarios"),
+	repositories: (repositories) => repositories.check(Schema.isUnique()).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+	excluded_variants: (excluded) => excluded.pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+	run_settings: () => RunSettingsInput
+})).check(Schema.makeFilter(unknownExclusions)).annotate({ identifier: "ExperimentInput" });
+const Count = Schema.Natural;
+const Execution = Schema.Struct({
+	id: ExecutionId,
+	experiment_id: ExperimentId,
+	number: Schema.Int.annotate({ description: "Its place among the experiment's executions, from 1." }),
+	launched_at: Schema.DateTimeUtc.annotate({ description: "When the execution was launched." }),
+	canceled_at: Schema.OptionFromOptionalKey(Schema.DateTimeUtc.annotate({ description: "When the execution was canceled. Absent unless it was." })),
+	pending: Schema.Boolean.annotate({ description: "Whether some of its runs have not ended yet or wait for their evaluation results. Its pass rate is final once it is `false`, canceled or not." }),
+	slots: Schema.Struct({
+		total: Count.annotate({ description: "Runs the execution plans." }),
+		running: Count.annotate({ description: "Runs not started yet or not ended." }),
+		judging: Count.annotate({ description: "Ended runs waiting for their evaluation results." }),
+		judged: Count.annotate({ description: "Runs with a verdict." }),
+		passed: Count.annotate({ description: "Runs that passed their scenario." })
+	}).annotate({ description: "How many of its planned runs stand where." }),
+	pass_rate: Schema.OptionFromOptionalKey(Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 100
+	})).annotate({ description: "Runs that passed out of those with a verdict, as a whole percent. Absent until one run has a verdict." })),
+	cost_usd: Schema.Number.annotate({ description: "What its runs cost so far, in US dollars." })
+}).annotate({
+	identifier: "Execution",
+	description: "One launch of an experiment: a run for every scenario, variant, agent and repetition, with the experiment as it was when launched."
+});
+const NotEvaluatedReason = Schema.Literals([
+	"never_started",
+	"no_evaluations",
+	"run_not_completed",
+	"agent_failed",
+	"evidence_too_long",
+	"too_many_attempts"
+]).annotate({ description: "Why the run has no verdict: it never started, its scenario has no evaluations, it did not end `completed`, its agent stopped with an error such as its model provider being unreachable, what it did was too long to judge, or judging failed too many times." });
+const Slot = Schema.Struct({
+	id: Schema.String.annotate({ description: "Unique identifier of the slot." }),
+	scenario_id: Schema.String,
+	repository_id: Schema.OptionFromOptionalKey(Schema.String.annotate({ description: "Absent when the run has no repository." })),
+	agent_tools_id: Schema.String,
+	agent: Agent,
+	repetition: Schema.Int.annotate({ description: "Which of the identical runs it is, from 1." }),
+	run_id: Schema.OptionFromOptionalKey(RunId.annotate({ description: "The run, once started." })),
+	outcome: Schema.Literals([
+		"running",
+		"judging",
+		"judged",
+		"not_evaluated"
+	]).annotate({ description: "`running` while its run waits to start or has not ended, `judging` while it waits for evaluation results, `judged` once they are all in, or `not_evaluated` when it never will be." }),
+	verdict: Schema.OptionFromOptionalKey(Schema.Literals(["passed", "failed"]).annotate({ description: "Whether the run passed its scenario, once judged." })),
+	score: Schema.OptionFromOptionalKey(Schema.Number.annotate({ description: "Weighted share of evaluations passed, out of 100, once every evaluation result is in." })),
+	not_evaluated_reason: Schema.OptionFromOptionalKey(NotEvaluatedReason),
+	refusal: Schema.OptionFromOptionalKey(Schema.String.annotate({ description: "Why its run could not start." })),
+	evaluation_results: Schema.Array(Schema.Struct({
+		evaluation_id: Schema.String,
+		passed: Schema.Boolean
+	})).annotate({ description: "Each evaluation judged so far, and whether the run passed it." })
+}).annotate({
+	identifier: "Slot",
+	description: "One run an execution plans, for one scenario, variant, agent and repetition, and how it was judged."
+});
+var ExperimentNotFound = class extends Schema.TaggedError()("ExperimentNotFound", { message: Schema.String }, {
+	httpApiStatus: 404,
+	description: "No experiment with this id exists in your organization."
+}) {};
+var ExecutionNotFound = class extends Schema.TaggedError()("ExecutionNotFound", { message: Schema.String }, {
+	httpApiStatus: 404,
+	description: "No execution with this id exists in your organization."
+}) {};
+var ExperimentIncomplete = class extends Schema.TaggedError()("ExperimentIncomplete", {
+	message: Schema.String,
+	missing: Schema.Array(Schema.String).annotate({ description: "Each thing to fix before launching, in a sentence." })
+}, {
+	httpApiStatus: 422,
+	description: "The experiment cannot be launched as it is: `missing` says what to fix."
+}) {};
+const experimentParams = { id: ExperimentId };
+var ExperimentsApi = class extends HttpApiGroup.make("experiments").add(HttpApiEndpoint.post("create", "/experiments", {
+	payload: ExperimentInput,
+	success: Experiment.pipe(HttpApiSchema.status(201)),
+	error: FileUnavailable
+}).annotateMerge(OpenApi.annotations({
+	summary: "Create an experiment",
+	description: "Creates an experiment from its scenarios, agents, variants and run settings. Launch it to start its runs."
+})), HttpApiEndpoint.get("list", "/experiments", { success: List(Experiment) }).annotateMerge(OpenApi.annotations({
+	summary: "List experiments",
+	description: "Returns every experiment."
+})), HttpApiEndpoint.get("get", "/experiments/:id", {
+	params: experimentParams,
+	success: Experiment,
+	error: ExperimentNotFound
+}).annotateMerge(OpenApi.annotations({
+	summary: "Get an experiment",
+	description: "Returns an experiment."
+})), HttpApiEndpoint.put("update", "/experiments/:id", {
+	params: experimentParams,
+	payload: ExperimentInput,
+	success: Experiment,
+	error: [ExperimentNotFound, FileUnavailable]
+}).annotateMerge(OpenApi.annotations({
+	summary: "Update an experiment",
+	description: "Replaces the whole experiment: send it complete, as `GET /experiments/{id}` returns it. Executions already launched keep the experiment as it was."
+})), HttpApiEndpoint.delete("delete", "/experiments/:id", {
+	params: experimentParams,
+	success: HttpApiSchema.NoContent,
+	error: ExperimentNotFound
+}).annotateMerge(OpenApi.annotations({
+	summary: "Delete an experiment",
+	description: "Deletes an experiment. Its executions, their runs and results stay."
+}))).annotateMerge(OpenApi.annotations({
+	title: "Experiments",
+	description: "Define scenarios to give several agents in several variants, judged on what they did."
+})).middleware(ApiKeyAuthorization).middleware(RequestValidation) {};
+const executionParams = { id: ExecutionId };
+var ExecutionsApi = class extends HttpApiGroup.make("executions").add(HttpApiEndpoint.post("launch", "/experiments/:id/executions", {
+	params: experimentParams,
+	success: Execution.pipe(HttpApiSchema.status(201)),
+	error: [
+		ExperimentNotFound,
+		ExperimentIncomplete,
+		InsufficientBalance,
+		OrganizationBlocked
+	]
+}).annotateMerge(OpenApi.annotations({
+	summary: "Launch an experiment",
+	description: "Starts an execution of the experiment as it is now: a run for every scenario, variant, agent and repetition, at most 500, started in the background. Each run is judged on its scenario's evaluations once it ends. Executions start only while your organization's balance is above $0."
+})), HttpApiEndpoint.get("list", "/experiments/:id/executions", {
+	params: experimentParams,
+	success: List(Execution)
+}).annotateMerge(OpenApi.annotations({
+	summary: "List an experiment's executions",
+	description: "Returns the experiment's executions, the latest launched first, even after it was deleted."
+})), HttpApiEndpoint.get("get", "/executions/:id", {
+	params: executionParams,
+	success: Execution,
+	error: ExecutionNotFound
+}).annotateMerge(OpenApi.annotations({
+	summary: "Get an execution",
+	description: "Returns an execution, where its runs stand and its pass rate. Poll it until it is no longer `pending`."
+})), HttpApiEndpoint.get("listSlots", "/executions/:id/slots", {
+	params: executionParams,
+	success: List(Slot),
+	error: ExecutionNotFound
+}).annotateMerge(OpenApi.annotations({
+	summary: "List an execution's slots",
+	description: "Returns every run the execution plans, with its run once started and its verdict once judged. Read a run's work with the runs endpoints."
+})), HttpApiEndpoint.post("cancel", "/executions/:id/cancel", {
+	params: executionParams,
+	success: Execution.pipe(HttpApiSchema.status(202)),
+	error: ExecutionNotFound
+}).annotateMerge(OpenApi.annotations({
+	summary: "Cancel an execution",
+	description: "Starts none of its runs left and cancels those started. Canceling an execution already canceled does nothing."
+}))).annotateMerge(OpenApi.annotations({
+	title: "Executions",
+	description: "Launch experiments and read their results."
+})).middleware(ApiKeyAuthorization).middleware(RequestValidation) {};
+// ../contract/src/library.ts
+const id = Schema.String.annotate({ description: "Id to pick it in an experiment." });
+const Library = Schema.Struct({
+	repositories: Schema.Array(Schema.Struct({
+		id,
+		name: Schema.String,
+		url: Schema.String.annotate({ description: "URL of the Git repository." }),
+		ref: Schema.String.annotate({ description: "Branch, tag or commit checked out." })
+	})),
+	skills: Schema.Array(Schema.Struct({
+		id,
+		name: Schema.String,
+		description: Schema.String
+	})),
+	mcp_servers: Schema.Array(Schema.Struct({
+		id,
+		name: Schema.String.annotate({ description: "Name the agent knows the MCP server by." }),
+		url: Schema.String,
+		connected: Schema.Boolean.annotate({ description: "Whether runs can use it: always for one without an account, otherwise once connected in the web app." })
+	})),
+	command_line_tools: Schema.Array(Schema.Struct({
+		id,
+		name: Schema.String
+	}))
+}).annotate({
+	identifier: "Library",
+	description: "What your organization keeps for its experiments, added in the web app."
+});
+var LibraryApi = class extends HttpApiGroup.make("library").add(HttpApiEndpoint.get("get", "/library", { success: Library }).annotateMerge(OpenApi.annotations({
+	summary: "Get the library",
+	description: "Returns the repositories, skills, MCP servers and command-line tools your experiments can pick, by id."
+}))).annotateMerge(OpenApi.annotations({
+	title: "Library",
+	description: "What your experiments can give their agents."
+})).middleware(ApiKeyAuthorization).middleware(RequestValidation) {};
+// ../contract/src/system.ts
 const EgressIps = Schema.Struct({ ips: Schema.Array(Schema.String).annotate({ description: "IPv4 addresses, empty when the API runs locally." }) }).annotate({ identifier: "EgressIps" });
 var SystemApi = class extends HttpApiGroup.make("system", { topLevel: true }).add(HttpApiEndpoint.get("health", "/health", { success: HttpApiSchema.NoContent }).annotateMerge(OpenApi.annotations({
 	summary: "Check health",
@@ -696,14 +1127,12 @@ var SystemApi = class extends HttpApiGroup.make("system", { topLevel: true }).ad
 	summary: "List egress IPs",
 	description: "The fixed addresses we call MCP servers and their authorization servers from. Allow them on an MCP server that only accepts known addresses. Commands the agent runs in its sandbox, such as cloning the repository, come from other addresses. No key required."
 }))).annotateMerge(OpenApi.annotations({ title: "System" })) {};
-//#endregion
-//#region ../contract/src/api.ts
-var TracksApi = class extends HttpApi.make("tracks").add(RunsApi).add(ConnectionsApi).add(SystemApi).annotate(HttpApi.ParseOptions, { errors: "all" }).annotateMerge(OpenApi.annotations({
+// ../contract/src/api.ts
+var TracksApi = class extends HttpApi.make("tracks").add(RunsApi).add(FilesApi).add(ConnectionsApi).add(ExperimentsApi).add(ExecutionsApi).add(LibraryApi).add(SystemApi).annotate(HttpApi.ParseOptions, { errors: "all" }).annotateMerge(OpenApi.annotations({
 	title: "Tracks API",
-	description: "Run coding agents such as Claude Code in isolated sandboxes with an API key of your organization. Create a run with a prompt, then follow its output and what it costs."
+	description: "Run coding agents such as Claude Code in isolated sandboxes with an API key of your organization. Create a run with a prompt, then follow its output and what it costs, or launch an experiment to compare agents on your scenarios."
 })) {};
-//#endregion
-//#region ../contract/src/client.ts
+// ../contract/src/client.ts
 const CLI_USER_AGENT = "tracks";
 var ApiClient = class ApiClient extends Context.Service()("@tracks/contract/ApiClient") {
 	static layer = (options) => Layer.effect(ApiClient, HttpApiClient.make(TracksApi, { transformClient: HttpClient.mapRequest((request) => {
@@ -711,8 +1140,7 @@ var ApiClient = class ApiClient extends Context.Service()("@tracks/contract/ApiC
 		return options.userAgent === void 0 ? located : HttpClientRequest.setHeader(located, "user-agent", options.userAgent);
 	}) })).pipe(Layer.provide(HttpApiMiddleware.layerClient(ApiKeyAuthorization, ({ next, request }) => next(HttpClientRequest.bearerToken(request, Redacted.value(options.apiKey))))));
 };
-//#endregion
-//#region ../env/src/env.ts
+// ../env/src/env.ts
 const Secret = Schema.Redacted(Schema.NonEmptyString);
 const StripeKey = (prefix) => Schema.Redacted(Schema.String.check(Schema.isStartingWith(prefix)));
 const Port = Schema.Int.check(Schema.isBetween({
@@ -749,8 +1177,12 @@ const Secrets = Schema.Struct({
 	TYPESAFE_API_KEY: Secret,
 	DATABASE_PASSWORD: Secret,
 	CONNECTION_ENCRYPTION_KEY: EncryptionKey,
+	TRAFFIC_ENCRYPTION_KEY: EncryptionKey,
 	STRIPE_SECRET_KEY: StripeKey("rk_"),
 	STRIPE_WEBHOOK_SECRET: StripeKey("whsec_"),
+	IDENTITY_PROVIDER_CLIENT_ID: Secret,
+	IDENTITY_PROVIDER_CLIENT_SECRET: Secret,
+	SESSION_SECRET: Secret,
 	SENTRY_DSN: Schema.optionalKey(Schema.Redacted(SentryDsn))
 });
 const Variables = Schema.Struct({
@@ -758,6 +1190,8 @@ const Variables = Schema.Struct({
 	TRACKS_API_URL: Schema.URLFromString.pipe(Schema.withDecodingDefaultKey(Effect.succeed(`https://agent-runner.lab.alpic.ai${TRACKS_API_PATH}`))),
 	DAYTONA_API_URL: Schema.NonEmptyString.pipe(Schema.withDecodingDefaultKey(Effect.succeed("https://app.daytona.io/api"))),
 	AGENT_RUNNER_URL: SecureUrl,
+	FILES_BUCKET: Schema.NonEmptyString,
+	FILES_ENDPOINT: Schema.optionalKey(SecureUrl),
 	CONNECTION_RETURN_ORIGINS: Origins.pipe(Schema.withDecodingDefaultKey(Effect.succeed(""))),
 	EGRESS_IPS: IpAddresses.pipe(Schema.withDecodingDefaultKey(Effect.succeed(""))),
 	DATABASE_HOST: Schema.NonEmptyString,
@@ -776,7 +1210,11 @@ const Variables = Schema.Struct({
 	]).pipe(Schema.withDecodingDefaultKey(Effect.succeed("Info"))),
 	DEPLOYMENT_ENVIRONMENT: Schema.NonEmptyString.pipe(Schema.withDecodingDefaultKey(Effect.succeed("local"))),
 	OTLP_METRICS_URL: Schema.optionalKey(Schema.URLFromString),
-	LOAD_BALANCER_ARN: Schema.optionalKey(Schema.NonEmptyString)
+	RELEASE: Schema.optionalKey(Schema.NonEmptyString),
+	POSTHOG_KEY: Schema.optionalKey(Schema.NonEmptyString),
+	POSTHOG_HOST: SecureUrl.pipe(Schema.withDecodingDefaultKey(Effect.succeed("https://us.i.posthog.com"))),
+	CLOUDFLARE_CLIENT_ID: Schema.NonEmptyString,
+	IDENTITY_PROVIDER_URL: SecureUrl.pipe(Schema.withDecodingDefaultKey(Effect.succeed("https://idp.alpic.ai")))
 });
 const Env = Schema.Struct({
 	...Secrets.fields,
@@ -806,7 +1244,16 @@ const CONNECTIONS_ENV = [
 	"CONNECTION_ENCRYPTION_KEY"
 ];
 const PAYMENTS_ENV = ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"];
+const IDENTITY_ENV = [
+	"IDENTITY_PROVIDER_URL",
+	"IDENTITY_PROVIDER_CLIENT_ID",
+	"IDENTITY_PROVIDER_CLIENT_SECRET",
+	"SESSION_SECRET"
+];
+const TRAFFIC_ENV = ["CLOUDFLARE_CLIENT_ID", "TRAFFIC_ENCRYPTION_KEY"];
 const AGENT_RUNNER_ENV = [
+	"FILES_BUCKET",
+	"FILES_ENDPOINT",
 	...DATABASE_ENV,
 	...DAYTONA_ENV,
 	...E2B_ENV,
@@ -816,27 +1263,30 @@ const AGENT_RUNNER_ENV = [
 const LOG_ENV = ["LOG_FORMAT", "LOG_LEVEL"];
 const OBSERVABILITY_ENV = [
 	"SENTRY_DSN",
+	"POSTHOG_KEY",
+	"POSTHOG_HOST",
 	"DEPLOYMENT_ENVIRONMENT",
-	"OTLP_METRICS_URL"
+	"OTLP_METRICS_URL",
+	"RELEASE"
 ];
 const SERVICE_ENV = [
+	"TYPESAFE_API_KEY",
 	"PORT",
 	"EGRESS_IPS",
-	"LOAD_BALANCER_ARN",
 	...LOG_ENV,
 	...OBSERVABILITY_ENV,
 	...AGENT_RUNNER_ENV,
-	...PAYMENTS_ENV
+	...PAYMENTS_ENV,
+	...IDENTITY_ENV,
+	...TRAFFIC_ENV
 ];
 const CLI_ENV = ["TRACKS_API_KEY", "TRACKS_API_URL"];
 const isDatabaseVariable = (name) => DATABASE_ENV.some((databaseName) => databaseName === name);
 SERVICE_ENV.flatMap((name) => isSecret(name) && !isDatabaseVariable(name) ? [name] : []);
 const readEnv = (...names) => Config.schema(Env.mapFields(Struct.pick(names)));
-//#endregion
-//#region package.json
-var version = "0.5.1";
-//#endregion
-//#region src/connections.ts
+// package.json
+var version = "0.7.1";
+// src/connections.ts
 const encodeConnection = Schema.encodeEffect(Schema.fromJsonString(Connection, { space: 2 }));
 const encodeConnections = Schema.encodeEffect(Schema.fromJsonString(List(Connection), { space: 2 }));
 const connectionId = Argument.String("id").pipe(Argument.withDescription("Connection id"), Argument.withSchema(ConnectionId));
@@ -899,7 +1349,7 @@ const confirmationOf = (params, id) => {
 		onNone: () => Effect.fail(new ConsentFailed({ reason: params.get("error") ?? "no confirmation came back" }))
 	});
 };
-const create$1 = Command.make("create", { server: Argument.String("server-url").pipe(Argument.withDescription("URL of the MCP server, in https")) }, Effect.fn("connections.create")(function* ({ server }) {
+const create$2 = Command.make("create", { server: Argument.String("server-url").pipe(Argument.withDescription("URL of the MCP server, in https")) }, Effect.fn("connections.create")(function* ({ server }) {
 	const client = yield* ApiClient;
 	const callback = yield* loopbackCallback;
 	const created = yield* client.connections.create({ payload: {
@@ -919,11 +1369,11 @@ const create$1 = Command.make("create", { server: Argument.String("server-url").
 	});
 	yield* Console.log(yield* encodeConnection(connection));
 }, Effect.scoped)).pipe(Command.withDescription("Connect to an MCP server as one of its users: consent in your browser, then use the connection in runs"));
-const list = Command.make("list", {}, Effect.fn("connections.list")(function* () {
+const list$1 = Command.make("list", {}, Effect.fn("connections.list")(function* () {
 	const client = yield* ApiClient;
 	yield* Console.log(yield* encodeConnections(yield* client.connections.list()));
 })).pipe(Command.withDescription("List connections"));
-const get$1 = Command.make("get", { id: connectionId }, Effect.fn("connections.get")(function* ({ id }) {
+const get$2 = Command.make("get", { id: connectionId }, Effect.fn("connections.get")(function* ({ id }) {
 	const client = yield* ApiClient;
 	yield* Console.log(yield* encodeConnection(yield* client.connections.get({ params: { id } })));
 })).pipe(Command.withDescription("Show a connection"));
@@ -931,13 +1381,143 @@ const deleteConnection = Command.make("delete", { id: connectionId }, Effect.fn(
 	yield* (yield* ApiClient).connections.delete({ params: { id } });
 })).pipe(Command.withDescription("Delete a connection and the access it holds"));
 const connections = Command.make("connections").pipe(Command.withDescription("Manage connections to MCP servers"), Command.withSubcommands([
+	create$2,
+	list$1,
+	get$2,
+	deleteConnection
+]));
+// src/experiments.ts
+const encodeExperiment = Schema.encodeEffect(Schema.fromJsonString(Experiment, { space: 2 }));
+const encodeExperiments = Schema.encodeEffect(Schema.fromJsonString(List(Experiment), { space: 2 }));
+const encodeExecution = Schema.encodeEffect(Schema.fromJsonString(Execution, { space: 2 }));
+const encodeExecutions = Schema.encodeEffect(Schema.fromJsonString(List(Execution), { space: 2 }));
+const encodeSlots = Schema.encodeEffect(Schema.fromJsonString(List(Slot), { space: 2 }));
+const experimentId = Argument.String("id").pipe(Argument.withDescription("Experiment id"), Argument.withSchema(ExperimentId));
+const executionId = Argument.String("id").pipe(Argument.withDescription("Execution id"), Argument.withSchema(ExecutionId));
+const definition = Argument.FileSchema("file", ExperimentInput).pipe(Argument.withDescription("JSON file of the experiment, as `tracks experiments get` prints it, without its id"));
+const POLL_INTERVAL = "10 seconds";
+var PassRateTooLow = class extends Schema.TaggedError()("PassRateTooLow", {
+	passRate: Schema.Option(Schema.Number),
+	minimum: Schema.Number
+}) {
+	get message() {
+		const reached = Option.match(this.passRate, {
+			onNone: () => "no run was judged",
+			onSome: (rate) => `${rate}%`
+		});
+		return `The execution's pass rate is below ${this.minimum}%: ${reached}`;
+	}
+};
+const create$1 = Command.make("create", { definition }, Effect.fn("experiments.create")(function* ({ definition: payload }) {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeExperiment(yield* client.experiments.create({ payload })));
+})).pipe(Command.withDescription("Create an experiment from a JSON file"));
+const list = Command.make("list", {}, Effect.fn("experiments.list")(function* () {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeExperiments(yield* client.experiments.list()));
+})).pipe(Command.withDescription("List experiments"));
+const get$1 = Command.make("get", { id: experimentId }, Effect.fn("experiments.get")(function* ({ id }) {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeExperiment(yield* client.experiments.get({ params: { id } })));
+})).pipe(Command.withDescription("Show an experiment"));
+const update = Command.make("update", {
+	id: experimentId,
+	definition
+}, Effect.fn("experiments.update")(function* ({ id, definition: payload }) {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeExperiment(yield* client.experiments.update({
+		params: { id },
+		payload
+	})));
+})).pipe(Command.withDescription("Replace a whole experiment with a JSON file"));
+const deleteExperiment = Command.make("delete", { id: experimentId }, Effect.fn("experiments.delete")(function* ({ id }) {
+	yield* (yield* ApiClient).experiments.delete({ params: { id } });
+})).pipe(Command.withDescription("Delete an experiment; its executions and their results stay"));
+const launch = Command.make("launch", {
+	id: experimentId,
+	wait: Flag.Boolean("wait").pipe(Flag.withAlias("w"), Flag.withDescription(`Wait until no run is pending, checking every ${POLL_INTERVAL}, then print the execution`), Flag.withDefault(false)),
+	minPassRate: Flag.Int("min-pass-rate").pipe(Flag.withSchema(Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 100
+	}))), Flag.withDescription("Wait, then exit with an error when the pass rate ends below this percentage, from 0 to 100"), Flag.optional)
+}, Effect.fn("experiments.launch")(function* ({ id, wait, minPassRate }) {
+	const client = yield* ApiClient;
+	const launched = yield* client.executions.launch({ params: { id } });
+	if (!wait && Option.isNone(minPassRate)) return yield* Console.log(yield* encodeExecution(launched));
+	yield* Console.error(`Launched execution ${launched.id}: ${launched.slots.total} runs`);
+	const done = yield* client.executions.get({ params: { id: launched.id } }).pipe(Effect.tap(({ slots }) => Console.error(`${slots.running} running, ${slots.judging} judging, ${slots.judged} judged`)), Effect.repeat({
+		schedule: Schedule.spaced(POLL_INTERVAL),
+		until: (execution) => !execution.pending
+	}));
+	yield* Console.log(yield* encodeExecution(done));
+	if (Option.isSome(minPassRate) && !Option.exists(done.pass_rate, (rate) => rate >= minPassRate.value)) return yield* new PassRateTooLow({
+		passRate: done.pass_rate,
+		minimum: minPassRate.value
+	});
+})).pipe(Command.withDescription("Launch an experiment: start a run for every scenario, variant, agent and repetition"));
+const executionsOfExperiment = Command.make("executions", { id: experimentId }, Effect.fn("experiments.executions")(function* ({ id }) {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeExecutions(yield* client.executions.list({ params: { id } })));
+})).pipe(Command.withDescription("List an experiment's executions"));
+const experiments = Command.make("experiments").pipe(Command.withDescription("Compare agents on your scenarios"), Command.withSubcommands([
 	create$1,
 	list,
 	get$1,
-	deleteConnection
+	update,
+	deleteExperiment,
+	launch,
+	executionsOfExperiment
 ]));
-//#endregion
-//#region src/runs.ts
+const getExecution = Command.make("get", { id: executionId }, Effect.fn("executions.get")(function* ({ id }) {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeExecution(yield* client.executions.get({ params: { id } })));
+})).pipe(Command.withDescription("Show an execution, where its runs stand and its pass rate"));
+const slots = Command.make("slots", { id: executionId }, Effect.fn("executions.slots")(function* ({ id }) {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeSlots(yield* client.executions.listSlots({ params: { id } })));
+})).pipe(Command.withDescription("List every run an execution plans, with its verdict once judged"));
+const cancel$1 = Command.make("cancel", { id: executionId }, Effect.fn("executions.cancel")(function* ({ id }) {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeExecution(yield* client.executions.cancel({ params: { id } })));
+})).pipe(Command.withDescription("Cancel an execution: start none of its runs left and cancel those started"));
+const executions = Command.make("executions").pipe(Command.withDescription("Follow and cancel experiments' executions"), Command.withSubcommands([
+	getExecution,
+	slots,
+	cancel$1
+]));
+// src/library.ts
+const encodeLibrary = Schema.encodeEffect(Schema.fromJsonString(Library, { space: 2 }));
+const library = Command.make("library", {}, Effect.fn("library")(function* () {
+	const client = yield* ApiClient;
+	yield* Console.log(yield* encodeLibrary(yield* client.library.get()));
+})).pipe(Command.withDescription("List the repositories, skills, MCP servers and command-line tools experiments can pick"));
+// src/files.ts
+const CONTENT_TYPES = {
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".webp": "image/webp",
+	".gif": "image/gif",
+	".pdf": "application/pdf",
+	".txt": "text/plain",
+	".md": "text/markdown",
+	".csv": "text/csv",
+	".json": "application/json"
+};
+const uploadFile = Effect.fn("uploadFile")(function* (localPath) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const contentType = CONTENT_TYPES[path.extname(localPath).toLowerCase()] ?? "application/octet-stream";
+	const bytes = yield* fileSystem.readFile(localPath);
+	const upload = yield* (yield* ApiClient).files.createUpload({ payload: {
+		name: path.basename(localPath),
+		content_type: contentType,
+		size: bytes.byteLength
+	} });
+	yield* (yield* HttpClient.HttpClient).execute(HttpClientRequest.put(upload.url).pipe(HttpClientRequest.bodyUint8Array(bytes, contentType), HttpClientRequest.setHeaders(upload.headers))).pipe(Effect.flatMap(HttpClientResponse.filterStatusOk));
+	return upload.id;
+});
+// src/runs.ts
 const encodeRun = Schema.encodeEffect(Schema.fromJsonString(Run, { space: 2 }));
 const encodeFrames = Schema.encodeEffect(Schema.fromJsonString(List(Frame), { space: 2 }));
 const encodeEvents = Schema.encodeEffect(Schema.fromJsonString(List(Event), { space: 2 }));
@@ -965,27 +1545,64 @@ const mcpServerOf = (entry) => {
 	const target = entry.slice(equals + 1);
 	return Option.some(URL.canParse(target) ? {
 		name,
-		url: target
+		url: target,
+		headers: Option.none()
 	} : {
 		name,
 		connection_id: ConnectionId.make(target)
 	});
 };
+const fixedHeaderOf = (entry) => {
+	const equals = entry.indexOf("=");
+	const colon = entry.indexOf(":", equals);
+	if (equals === -1 || colon === -1) return Option.none();
+	return Option.some({
+		server: entry.slice(0, equals),
+		name: entry.slice(equals + 1, colon).trim(),
+		value: entry.slice(colon + 1).trim()
+	});
+};
+var FixedHeaderUnmatched = class extends Schema.TaggedError()("FixedHeaderUnmatched", { server: Schema.String }) {
+	get message() {
+		return `--mcp-header ${this.server}=… needs an --mcp ${this.server}=URL`;
+	}
+};
 const create = Command.make("create", {
 	prompt: Argument.String("prompt").pipe(Argument.withDescription("Prompt sent to the agent")),
 	harness: Flag.Literals("harness", Harness.literals).pipe(Flag.withAlias("H"), Flag.withDescription("Harness running the agent")),
 	model: Flag.String("model").pipe(Flag.withAlias("m"), Flag.withDescription("Model used by the harness")),
+	file: Flag.File("file", { mustExist: true }).pipe(Flag.withAlias("f"), Flag.withDescription("Local file uploaded and placed in the sandbox before setup, its path given to the agent with the prompt; repeat for several"), Flag.atLeast(0)),
 	repository: Flag.String("repository").pipe(Flag.withAlias("r"), Flag.withDescription("Git repository cloned into the sandbox"), Flag.optional),
 	env: Flag.String("env").pipe(Flag.withAlias("e"), Flag.withDescription("Environment variable set in the agent's processes, as KEY=VALUE, or KEY to pass its local value"), Flag.filterMap(variableOf, (entry) => `${entry} is not set in the local environment`), Flag.atLeast(0)),
 	setup: Flag.String("setup").pipe(Flag.withDescription("Shell script run in the sandbox after checkout, before the first prompt; from a file: --setup \"$(cat setup.sh)\""), Flag.optional),
 	teardown: Flag.String("teardown").pipe(Flag.withDescription("Shell script run in the sandbox after the run ends, before the sandbox is destroyed; from a file: --teardown \"$(cat teardown.sh)\""), Flag.optional),
-	mcp: Flag.String("mcp").pipe(Flag.withDescription("MCP server the agent can use, as NAME=URL, through your connection to that URL if you have one, or NAME=CONNECTION_ID"), Flag.filterMap(mcpServerOf, (entry) => `${entry} is not NAME=URL or NAME=CONNECTION_ID`), Flag.atLeast(0)),
+	mcp: Flag.String("mcp").pipe(Flag.withDescription("MCP server the agent can use, as NAME=URL, called without credentials, or NAME=CONNECTION_ID, called as the user who connected it"), Flag.filterMap(mcpServerOf, (entry) => `${entry} is not NAME=URL or NAME=CONNECTION_ID`), Flag.atLeast(0)),
+	mcpHeader: Flag.String("mcp-header").pipe(Flag.withDescription("Header added to every request to the MCP server NAME given by URL, typically its API key, as NAME=HEADER: VALUE, such as 'docs=Authorization: Bearer KEY'"), Flag.mapEffect((entry) => Option.match(fixedHeaderOf(entry), {
+		onNone: () => Effect.fail(new CliError.InvalidValue({
+			option: "mcp-header",
+			value: "(hidden, it may hold a key)",
+			expected: "NAME=HEADER: VALUE",
+			kind: "flag"
+		})),
+		onSome: Effect.succeed
+	})), Flag.atLeast(0)),
 	budget: Flag.Finite("budget").pipe(Flag.withAlias("b"), Flag.withDescription("Most the run may spend, in US dollars"), Flag.optional),
 	oneShot: Flag.Boolean("one-shot").pipe(Flag.withDescription("End the run once its first prompt finishes (default); --no-one-shot waits for follow-ups"), Flag.optional),
 	idleTimeout: Flag.Int("idle-timeout").pipe(Flag.withDescription("Seconds an idle run waits for a follow-up before it ends"), Flag.optional),
 	timeLimit: Flag.Int("time-limit").pipe(Flag.withDescription("Longest the run may last, in seconds, before it is stopped"), Flag.optional),
 	idempotencyKey: Flag.String("idempotency-key").pipe(Flag.withDescription("Retry safely: running again with the same key returns the run already created"), Flag.optional)
-}, Effect.fn("runs.create")(function* ({ prompt, harness, model, repository, env, setup, teardown, mcp, budget, oneShot, idleTimeout, timeLimit, idempotencyKey }) {
+}, Effect.fn("runs.create")(function* ({ prompt, harness, model, file, repository, env, setup, teardown, mcp, mcpHeader, budget, oneShot, idleTimeout, timeLimit, idempotencyKey }) {
+	const unmatched = mcpHeader.find((header) => !mcp.some((server) => server.url !== void 0 && server.name === header.server));
+	if (unmatched !== void 0) return yield* new FixedHeaderUnmatched({ server: unmatched.server });
+	const mcpServers = mcp.map((server) => {
+		const headers = mcpHeader.filter((header) => header.server === server.name);
+		if (server.url === void 0 || headers.length === 0) return server;
+		return {
+			...server,
+			headers: Option.some(Object.fromEntries(headers.map(({ name, value }) => [name, value])))
+		};
+	});
+	const inputFiles = yield* Effect.forEach(file, uploadFile, { concurrency: "unbounded" });
 	const run = yield* (yield* ApiClient).runs.create({
 		headers: { "idempotency-key": idempotencyKey },
 		payload: {
@@ -994,12 +1611,14 @@ const create = Command.make("create", {
 				model
 			},
 			prompt,
+			input_files: inputFiles,
 			environment: {
 				repository,
 				variables: Option.some(Object.fromEntries(env.map(({ name, value }) => [name, value]))),
 				setup,
 				teardown,
-				mcp_servers: Option.some(mcp)
+				skills: Option.none(),
+				mcp_servers: Option.some(mcpServers)
 			},
 			budget_usd: budget,
 			one_shot: oneShot,
@@ -1117,27 +1736,28 @@ const runs = Command.make("runs").pipe(Command.withDescription("Manage runs"), C
 	end,
 	cancel
 ]));
-//#endregion
-//#region src/main.ts
+// src/main.ts
 const health = Command.make("health", {}, Effect.fn("health")(function* () {
 	yield* (yield* ApiClient).health();
 	yield* Console.log("ok");
 })).pipe(Command.withDescription("Check that the API is reachable"));
-const cli = Command.make("tracks").pipe(Command.withDescription("Run coding agents in sandboxes"), Command.withSubcommands([
+const cli = Command.make("tracks").pipe(Command.withDescription("Run coding agents in sandboxes and compare them on your scenarios"), Command.withSubcommands([
 	health,
 	runs,
-	connections
+	connections,
+	experiments,
+	executions,
+	library
 ]));
 const ApiClientLayer = Layer.unwrap(Effect.map(readEnv(...CLI_ENV), (env) => ApiClient.layer({
 	baseUrl: env.TRACKS_API_URL,
 	apiKey: env.TRACKS_API_KEY,
 	userAgent: `${CLI_USER_AGENT}/${version}`
-}))).pipe(Layer.provide(FetchHttpClient.layer));
-const MainLayer = Layer.mergeAll(ApiClientLayer, NodeServices.layer);
+})));
+const MainLayer = Layer.mergeAll(ApiClientLayer, NodeServices.layer).pipe(Layer.provideMerge(FetchHttpClient.layer));
 Command.run(cli, { version }).pipe(Effect.catch((error) => {
 	const explainedByHelp = error._tag === "ShowHelp";
 	const line = "message" in error ? `${error._tag}: ${error.message}` : error._tag;
 	return Effect.andThen(explainedByHelp ? Effect.void : Console.error(line), Effect.sync(() => void (process.exitCode = 1)));
 }), Effect.provide(MainLayer), NodeRuntime.runMain);
-//#endregion
 export {};