@leostera/evalkit 0.3.0 → 0.5.0

package/dist/cli.mjs

@@ -1,11 +1,13 @@
 #!/usr/bin/env bun
-import { F as defineEvalMatrix, I as canonicalParameters, m as registerEvals, n as authoringId } from "./src-DrwwgaPn.mjs";
-import { a as readTrialEvents, c as readTrialSummary, i as readRunSummary, l as localReportStore, n as runMatrix, o as readTrialManifest, r as readRunManifest, t as runEval } from "./src-DluldGKn.mjs";
+import { I as defineEvalMatrix, L as canonicalParameters, m as registerEvals, n as authoringId } from "./src-ButXPY8P.mjs";
+import { a as readTrialEvents, c as readTrialSummary, i as readRunSummary, l as localReportStore, n as runMatrix, o as readTrialManifest, r as readRunManifest, t as runEval } from "./src-DoPs9Yug.mjs";
+import { c as dashboardIndex, d as encodeBundle, o as repoKey } from "./index-db-vbqEGFaU.mjs";
+import { t as createDirectoryShareApp } from "./src-DzZueFn3.mjs";
 import * as Schema from "effect/Schema";
 import { Effect, LogLevel, Logger, Option } from "effect";
-import { cp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import * as Path from "node:path";
-import { basename, dirname, extname, relative, resolve, sep } from "node:path";
+import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
 import * as OS from "node:os";
 import * as Crypto from "node:crypto";
 import * as NFS from "node:fs";
@@ -65,8 +67,9 @@ import * as FiberSet from "effect/FiberSet";
 import "effect/Fiber";
 import "effect/Pool";
 import * as MutableRef from "effect/MutableRef";
-import { parseArgs } from "node:util";
+import { parseArgs, promisify } from "node:util";
 import * as ChildProcess from "node:child_process";
+import { execFile } from "node:child_process";
 import * as RcRef from "effect/RcRef";
 import * as readline from "node:readline";
 import { Hono } from "hono";
@@ -3463,7 +3466,7 @@ function handleProcessInteger(options) {
 	};
 }
 /** @internal */
-const integer = (options) => {
+const integer$3 = (options) => {
 	const opts = {
 		min: Number.NEGATIVE_INFINITY,
 		max: Number.POSITIVE_INFINITY,
@@ -4029,6 +4032,12 @@ const choice = (alternatives) => {
 	return op;
 };
 /** @internal */
+const integer$2 = /*#__PURE__*/ (() => {
+	const op = /*#__PURE__*/ Object.create(proto$5);
+	op._tag = "Integer";
+	return op;
+})();
+/** @internal */
 const text$4 = /*#__PURE__*/ (() => {
 	const op = /*#__PURE__*/ Object.create(proto$5);
 	op._tag = "Text";
@@ -4184,7 +4193,7 @@ const wizardInternal$3 = (self, help) => {
 		case "Integer": {
 			const primitiveHelp = p("Enter an integer");
 			const message = sequence(help, primitiveHelp);
-			return integer({ message: toAnsiText(message).trimEnd() }).pipe(map$3((value) => `${value}`));
+			return integer$3({ message: toAnsiText(message).trimEnd() }).pipe(map$3((value) => `${value}`));
 		}
 		case "Path": {
 			const primitiveHelp = p("Select a file system path");
@@ -4689,7 +4698,7 @@ const wizardInternal$2 = (self, config) => {
 		case "Variadic": {
 			const repeatHelp = p("How many times should this argument should be repeated?");
 			const message = pipe(getHelpInternal$2(self), sequence(repeatHelp));
-			return integer({
+			return integer$3({
 				message: toAnsiText(message).trimEnd(),
 				min: getMinSizeInternal$1(self),
 				max: getMaxSizeInternal$1(self)
@@ -4874,13 +4883,15 @@ const boolean$1 = (name, options) => {
 		const head = Arr.headNonEmpty(negationNames);
 		const tail = Arr.tailNonEmpty(negationNames);
 		const negationOption = makeSingle(head, tail, boolean$2(Option$1.some(!ifPresent)));
-		return withDefault(orElse(option, negationOption), !ifPresent);
+		return withDefault$1(orElse(option, negationOption), !ifPresent);
 	}
-	return withDefault(option, !ifPresent);
+	return withDefault$1(option, !ifPresent);
 };
 /** @internal */
 const choiceWithValue = (name, choices) => makeSingle(name, Arr.empty(), choice(choices));
 /** @internal */
+const integer$1 = (name) => makeSingle(name, Arr.empty(), integer$2);
+/** @internal */
 const none = /*#__PURE__*/ (() => {
 	const op = /*#__PURE__*/ Object.create(proto$2);
 	op._tag = "Empty";
@@ -4895,7 +4906,7 @@ const getUsage$1 = (self) => getUsageInternal$1(self);
 /** @internal */
 const map$1 = /*#__PURE__*/ dual(2, (self, f) => makeMap(self, (a) => Either$1.right(f(a))));
 /** @internal */
-const optional$1 = (self) => withDefault(map$1(self, Option$1.some), Option$1.none());
+const optional$1 = (self) => withDefault$1(map$1(self, Option$1.some), Option$1.none());
 /** @internal */
 const orElse = /*#__PURE__*/ dual(2, (self, that) => orElseEither(self, that).pipe(map$1(Either$1.merge)));
 /** @internal */
@@ -4917,7 +4928,7 @@ const withAlias = /*#__PURE__*/ dual(2, (self, alias) => modifySingle(self, (sin
 	return makeSingle(single.name, aliases, single.primitiveType, single.description, single.pseudoName);
 }));
 /** @internal */
-const withDefault = /*#__PURE__*/ dual(2, (self, fallback) => makeWithDefault(self, fallback));
+const withDefault$1 = /*#__PURE__*/ dual(2, (self, fallback) => makeWithDefault(self, fallback));
 /** @internal */
 const withDescription = /*#__PURE__*/ dual(2, (self, desc) => modifySingle(self, (single) => {
 	const description = sequence(single.description, p(desc));
@@ -5305,7 +5316,7 @@ const wizardInternal$1 = (self, config) => {
 		case "Variadic": {
 			const repeatHelp = p("How many times should this argument be repeated?");
 			const message = pipe(getHelpInternal$1(self), sequence(repeatHelp));
-			return integer({
+			return integer$3({
 				message: toAnsiText(message).trimEnd(),
 				min: getMinSizeInternal(self),
 				max: getMaxSizeInternal(self)
@@ -5957,6 +5968,11 @@ const boolean = boolean$1;
 * @since 1.0.0
 * @category constructors
 */
+const integer = integer$1;
+/**
+* @since 1.0.0
+* @category constructors
+*/
 const text = text$1;
 /**
 * @since 1.0.0
@@ -5974,6 +5990,11 @@ const optional = optional$1;
 * @category combinators
 */
 const repeated = repeated$1;
+/**
+* @since 1.0.0
+* @category combinators
+*/
+const withDefault = withDefault$1;
 //#endregion
 //#region ../../node_modules/.bun/@effect+cli@0.77.2+74e017304edf4bf0/node_modules/@effect/cli/dist/esm/internal/commandDirective.js
 /** @internal */
@@ -8126,6 +8147,7 @@ function createDashboardReportReader(root, registry) {
 		return {
 			id,
 			...await ifPresent(() => stat(resolve(root, id, "archived.json"))) ? { archived: true } : {},
+			...manifest.source ? { source: manifest.source } : {},
 			evalId: manifest.evalId,
 			...manifest.suiteId ? { suiteId: manifest.suiteId } : {},
 			...manifest.matrix ? {
@@ -8244,7 +8266,7 @@ async function buildDashboard(options, step = quietStep) {
 		await prepareOutDir(outDir);
 		await cp(dashboardRoot, outDir, { recursive: true });
 		await writeFile(resolve(outDir, MARKER), "Generated by `evalkit build`.\n");
-		await writeFile(resolve(outDir, "index.html"), staticIndex(template));
+		await writeFile(resolve(outDir, "index.html"), dashboardIndex(template, { base: "./" }));
 	}, () => "read-only UI with relative assets");
 	await step("Eval catalog", async () => {
 		await write("catalog.json", { evals: registry.catalog() });
@@ -8265,13 +8287,10 @@ async function buildDashboard(options, step = quietStep) {
 		const trialIds = [];
 		for (const [index, run] of runs.entries()) {
 			progress(`run ${index + 1}/${runs.length} · ${run.id.slice(0, 8)}`);
-			const runTrials = await reports.listTrials(run.id);
-			await write(`runs/${run.id}/trials.json`, { trials: runTrials });
-			for (const trial of runTrials) {
-				trials += 1;
-				trialIds.push(trial.id);
-				files += await snapshotTrial(reports, write, data, run.id, trial.id);
-			}
+			const written = await snapshotRun(reports, run.id, directorySink(resolve(data, "runs", run.id)));
+			trials += written.trialIds.length;
+			files += written.files;
+			trialIds.push(...written.trialIds);
 		}
 		return {
 			runs: runs.length,
@@ -8293,9 +8312,9 @@ async function buildDashboard(options, step = quietStep) {
 		for (const route of routes) {
 			const file = resolve(outDir, `${route}.html`);
 			await mkdir(dirname(file), { recursive: true });
-			await writeFile(file, staticIndex(template, baseFor(route)));
+			await writeFile(file, dashboardIndex(template, { base: baseFor(route) }));
 		}
-		await writeFile(resolve(outDir, "404.html"), staticIndex(template, "/"));
+		await writeFile(resolve(outDir, "404.html"), dashboardIndex(template, { base: "/" }));
 		return routes.length;
 	}, (pages) => `${count(pages, "page")} with clean /path URLs`);
 	const { runIds: _runs, trialIds: _trials, ...summary } = snapshot;
@@ -8333,26 +8352,55 @@ function baseFor(route) {
 function count(value, noun) {
 	return `${value} ${noun}${value === 1 ? "" : "s"}`;
 }
-/** Writes one trial's JSON views and candidate files; returns the file count. */
-async function snapshotTrial(reports, write, data, runId, trialId) {
-	const base = `runs/${runId}/trials/${trialId}`;
-	await write(`${base}/detail.json`, await reports.trialDetail(runId, trialId));
-	await write(`${base}/events.json`, { events: await reports.trajectory(runId, trialId) });
-	await write(`${base}/artifacts.json`, { artifacts: await reports.listArtifacts(runId, trialId) });
-	const workspace = await reports.listCandidateWorkspace(runId, trialId);
-	await write(`${base}/workspace.json`, workspace);
-	const root = resolve(data, base, "workspace");
+/** Writes a run's snapshot below `root` (static builds). */
+function directorySink(root) {
+	const target = (path) => {
+		const file = resolve(root, path);
+		if (!file.startsWith(`${resolve(root)}${sep}`)) throw new Error(`Invalid snapshot path: ${path}`);
+		return file;
+	};
+	return {
+		async json(path, value) {
+			const file = target(path);
+			await mkdir(dirname(file), { recursive: true });
+			await writeFile(file, `${JSON.stringify(value)}\n`);
+		},
+		async bytes(path, data) {
+			const file = target(path);
+			await mkdir(dirname(file), { recursive: true });
+			await writeFile(file, data);
+		}
+	};
+}
+/**
+* One run's snapshot, shared by `evalkit build` (files on disk) and
+* `evalkit share` (an upload bundle): `trials.json`, then per trial
+* `detail.json`, `events.json`, `artifacts.json`, `workspace.json`, and the
+* candidate files under `workspace/`. Evaluator workspaces are never read.
+*/
+async function snapshotRun(reports, runId, sink, options = {}) {
+	const trials = await reports.listTrials(runId);
+	await sink.json("trials.json", { trials });
 	let files = 0;
-	for (const entry of workspace) {
-		if (entry.kind !== "file") continue;
-		const target = resolve(root, entry.path);
-		if (!target.startsWith(`${root}${sep}`)) throw new Error(`Invalid workspace path: ${entry.path}`);
-		const response = await reports.candidateFile(runId, trialId, entry.path);
-		await mkdir(dirname(target), { recursive: true });
-		await writeFile(target, new Uint8Array(await response.arrayBuffer()));
-		files += 1;
+	for (const trial of trials) {
+		const base = `trials/${trial.id}`;
+		await sink.json(`${base}/detail.json`, await reports.trialDetail(runId, trial.id));
+		await sink.json(`${base}/events.json`, { events: await reports.trajectory(runId, trial.id) });
+		await sink.json(`${base}/artifacts.json`, { artifacts: await reports.listArtifacts(runId, trial.id) });
+		const workspace = await reports.listCandidateWorkspace(runId, trial.id);
+		await sink.json(`${base}/workspace.json`, workspace);
+		if (options.workspaceFiles === false) continue;
+		for (const entry of workspace) {
+			if (entry.kind !== "file") continue;
+			const response = await reports.candidateFile(runId, trial.id, entry.path);
+			await sink.bytes(`${base}/workspace/${entry.path}`, new Uint8Array(await response.arrayBuffer()));
+			files += 1;
+		}
 	}
-	return files;
+	return {
+		trialIds: trials.map((trial) => trial.id),
+		files
+	};
 }
 /** Total size and file count of a directory, for the build summary. */
 async function directorySize(root) {
@@ -8371,15 +8419,6 @@ async function directorySize(root) {
 		files
 	};
 }
-/**
-* Select the static API and make every URL relative to `<base href>`, which
-* points at the snapshot root. The app derives its router basename from it.
-*/
-function staticIndex(html, base = "./") {
-	const result = html.replace("<html lang=\"en\">", "<html lang=\"en\" data-evalkit-snapshot=\"static\">").replace("<head>", `<head>\n    <base href="${base}" />`).replaceAll("\"/assets/", "\"./assets/");
-	if (!result.includes("data-evalkit-snapshot=\"static\"") || !result.includes("<base href=")) throw new Error("Bundled dashboard index.html has an unexpected shape");
-	return result;
-}
 async function prepareOutDir(outDir) {
 	let entries;
 	try {
@@ -8678,6 +8717,126 @@ async function confirm(question) {
 	}
 }
 //#endregion
+//#region ../cli/src/source.ts
+const exec = promisify(execFile);
+/**
+* Normalize a git remote to a stable repository key: lowercase host, no
+* credentials, port, scheme, `.git`, or trailing slash.
+*
+*   git@GitLab.example.com:group/sub/repo.git → gitlab.example.com/group/sub/repo
+*   https://user:token@github.com/o/r/        → github.com/o/r
+*   /srv/repos/thing.git (no host)            → local/thing
+*/
+function normalizeRepoUrl(url) {
+	const trimmed = url.trim().replace(/\/+$/, "").replace(/\.git$/, "");
+	const scp = /^(?:[^@/]+@)?([^:/]+):(?!\/)(.+)$/.exec(trimmed);
+	if (scp && !/^[a-z]+:\/\//i.test(trimmed)) return `${scp[1].toLowerCase()}/${scp[2].replace(/^\/+/, "")}`;
+	try {
+		const parsed = new URL(trimmed);
+		if (parsed.protocol !== "file:" && parsed.hostname) return `${parsed.hostname.toLowerCase()}${parsed.pathname.replace(/\/+$/, "")}`;
+	} catch {}
+	return `local/${basename(trimmed)}`;
+}
+async function git(cwd, ...args) {
+	try {
+		const { stdout } = await exec("git", [
+			"-C",
+			cwd,
+			...args
+		], { timeout: 1e4 });
+		return stdout.trim() || void 0;
+	} catch {
+		return;
+	}
+}
+const posix = (path) => path.split(sep).join("/");
+const projectPath = (root, projectRoot) => root ? posix(relative(root, projectRoot)) : "";
+function ciSource(env, projectRoot) {
+	if (env.EVALKIT_SOURCE_REPO && env.EVALKIT_SOURCE_COMMIT) return {
+		repo: normalizeRepoUrl(env.EVALKIT_SOURCE_REPO),
+		project: env.EVALKIT_SOURCE_PROJECT ?? "",
+		commit: env.EVALKIT_SOURCE_COMMIT,
+		...env.EVALKIT_SOURCE_REF ? { ref: env.EVALKIT_SOURCE_REF } : {},
+		...env.EVALKIT_SOURCE_COMMITTED_AT ? { committedAt: env.EVALKIT_SOURCE_COMMITTED_AT } : {}
+	};
+	if (env.GITLAB_CI === "true" && env.CI_PROJECT_URL && env.CI_COMMIT_SHA) return {
+		repo: normalizeRepoUrl(env.CI_PROJECT_URL),
+		project: projectPath(env.CI_PROJECT_DIR, projectRoot),
+		commit: env.CI_COMMIT_SHA,
+		...env.CI_MERGE_REQUEST_SOURCE_BRANCH_NAME ?? env.CI_COMMIT_REF_NAME ? { ref: env.CI_MERGE_REQUEST_SOURCE_BRANCH_NAME ?? env.CI_COMMIT_REF_NAME } : {},
+		...env.CI_COMMIT_TIMESTAMP ? { committedAt: env.CI_COMMIT_TIMESTAMP } : {},
+		ci: {
+			provider: "gitlab",
+			...env.CI_PIPELINE_ID ? { pipeline: env.CI_PIPELINE_ID } : {},
+			...env.CI_JOB_ID ? { job: env.CI_JOB_ID } : {},
+			...env.CI_JOB_URL ? { url: env.CI_JOB_URL } : {}
+		}
+	};
+	if (env.GITHUB_ACTIONS === "true" && env.GITHUB_REPOSITORY && env.GITHUB_SHA) {
+		const server = env.GITHUB_SERVER_URL ?? "https://github.com";
+		return {
+			repo: normalizeRepoUrl(`${server}/${env.GITHUB_REPOSITORY}`),
+			project: projectPath(env.GITHUB_WORKSPACE, projectRoot),
+			commit: env.GITHUB_SHA,
+			...env.GITHUB_HEAD_REF || env.GITHUB_REF_NAME ? { ref: env.GITHUB_HEAD_REF || env.GITHUB_REF_NAME } : {},
+			ci: {
+				provider: "github",
+				...env.GITHUB_RUN_ID ? { pipeline: env.GITHUB_RUN_ID } : {},
+				...env.GITHUB_JOB ? { job: env.GITHUB_JOB } : {},
+				...env.GITHUB_RUN_ID ? { url: `${server}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` } : {}
+			}
+		};
+	}
+}
+/**
+* Determine which repository and commit this project's eval code comes from.
+* Order: EVALKIT_SOURCE_* variables, GitLab/GitHub CI variables, then git.
+* Returns undefined outside git with no CI variables ("untracked" results).
+*
+* `outputDirs` (results, sandbox, snapshot) never make the tree dirty, even
+* when a project forgot to ignore them.
+*/
+async function detectSource(givenRoot, options = {}) {
+	const env = options.env ?? process.env;
+	const projectRoot = await realpath(givenRoot).catch(() => givenRoot);
+	const top = await git(projectRoot, "rev-parse", "--show-toplevel");
+	const excludes = top ? (options.outputDirs ?? []).map((dir) => join(projectRoot, relative(givenRoot, dir))).map((dir) => posix(relative(top, dir))).filter((dir) => dir && !dir.startsWith("..")).map((dir) => `:(exclude)${dir}`) : [];
+	const dirty = top ? Boolean(await git(top, "status", "--porcelain", "--", ".", ...excludes)) : false;
+	const fromCi = ciSource(env, projectRoot);
+	if (fromCi) return {
+		...fromCi,
+		...top && !env.EVALKIT_SOURCE_PROJECT ? { project: projectPath(top, projectRoot) } : {},
+		dirty
+	};
+	if (!top) return void 0;
+	const commit = await git(top, "rev-parse", "HEAD");
+	if (!commit) return void 0;
+	const remote = await git(top, "config", "--get", "remote.origin.url") ?? (await git(top, "remote"))?.split("\n").map((name) => name.trim()).find(Boolean);
+	const remoteUrl = remote && !remote.includes("/") && !remote.includes(":") ? await git(top, "config", "--get", `remote.${remote}.url`) : remote;
+	const ref = await git(top, "symbolic-ref", "--short", "-q", "HEAD");
+	const committedAt = await git(top, "show", "-s", "--format=%cI", "HEAD");
+	return {
+		repo: normalizeRepoUrl(remoteUrl ?? top),
+		project: projectPath(top, projectRoot),
+		commit,
+		...ref ? { ref } : {},
+		...committedAt ? { committedAt } : {},
+		dirty
+	};
+}
+/** The project's evals and suites, saved with each run (`catalog.json`). */
+function runCatalog(registry) {
+	return {
+		catalog: registry.catalog(),
+		evals: registry.metadata(),
+		suites: registry.suiteMetadata()
+	};
+}
+/** `abc1234` or `abc1234+dirty`. */
+function shortSource(source) {
+	return `${source.commit.slice(0, 7)}${source.dirty ? "+dirty" : ""}`;
+}
+//#endregion
 //#region ../cli/src/run-command.ts
 function parseRunArgs(args) {
 	const { values, positionals } = parseArgs({
@@ -8824,15 +8983,24 @@ async function runProjectCommand(args, cwd = process.cwd(), parsed = parseRunArg
 		return;
 	}
 	if (cells > (project.config.execution?.maxCells ?? 100) && !values.all) throw new Error(`Selected ${cells} cells. Narrow the selection, inspect --dry-run, or pass --all.`);
-	if (!values.json) console.log(`Running ${cells} cell(s) from ${plan.matrix}`);
+	const reportDir = resolve(project.root, project.config.reportDir ?? "_evalkit-results");
+	const sandboxDir = resolve(project.root, project.config.sandboxDir ?? "_evalkit-sandbox");
+	const source = await detectSource(project.root, { outputDirs: [
+		reportDir,
+		sandboxDir,
+		resolve(project.root, "_evalkit-dashboard")
+	] });
+	if (!values.json) console.log(`Running ${cells} cell(s) from ${plan.matrix}` + (source ? ` at ${shortSource(source)}${source.ref ? ` (${source.ref})` : ""}` : " (untracked: not in a git repository)"));
 	if ((await Effect.runPromise(runnerLogs(runMatrix(matrix, {
 		selection,
 		concurrency: parsed.concurrency ?? project.config.execution?.concurrency ?? 4,
 		trials,
 		...suiteId ? { suiteId } : {},
 		...values.local ? { runtime: "local" } : {},
-		report: localReportStore(resolve(project.root, project.config.reportDir ?? "_evalkit-results")),
-		workspaceRoot: resolve(project.root, project.config.sandboxDir ?? "_evalkit-sandbox"),
+		...source ? { source } : {},
+		catalog: runCatalog(registry),
+		report: localReportStore(reportDir),
+		workspaceRoot: sandboxDir,
 		onResult: (cell, result) => {
 			if (values.json) console.log(JSON.stringify({
 				cell: {
@@ -8903,6 +9071,205 @@ async function tidyReports(options) {
 	return result;
 }
 //#endregion
+//#region ../cli/src/share-command.ts
+/**
+* Which local runs `evalkit share` uploads: finished runs with a source, at
+* HEAD (or any commit with `all`), not dirty (unless `allowDirty`), not archived.
+*/
+function selectRuns(runs, head, options) {
+	const result = {
+		selected: [],
+		untracked: 0,
+		otherCommits: 0,
+		dirty: 0,
+		archived: 0,
+		running: 0
+	};
+	for (const run of runs) {
+		const { source } = run;
+		if (!source) result.untracked += 1;
+		else if (!options.all && (source.commit !== head.commit || repoKey(source) !== repoKey(head))) result.otherCommits += 1;
+		else if (source.dirty && !options.allowDirty) result.dirty += 1;
+		else if (run.archived) result.archived += 1;
+		else if (run.status === "running") result.running += 1;
+		else result.selected.push({
+			...run,
+			source
+		});
+	}
+	return result;
+}
+/** One line for the Runs step: what will be shared and what was skipped. */
+function selectionSummary(selection, options) {
+	return [
+		`${plural(selection.selected.length, "run")} to share`,
+		selection.otherCommits && !options.all ? `${selection.otherCommits} from other commits` : "",
+		selection.running ? `${selection.running} still running skipped` : "",
+		selection.dirty ? `${selection.dirty} dirty skipped` : "",
+		selection.untracked ? `${selection.untracked} untracked skipped` : "",
+		selection.archived ? `${selection.archived} archived skipped` : ""
+	].filter(Boolean).join(" · ");
+}
+/** Why nothing was selected, and what to do about it. */
+function noRunsMessage(selection, head, options) {
+	const at = shortSource(head);
+	if (selection.dirty) return `No committed runs for ${at}: ${plural(selection.dirty, "run")} came from uncommitted changes. Commit and rerun \`evalkit run\`, or pass --allow-dirty.`;
+	if (selection.running) return `No finished runs for ${at}: ${plural(selection.running, "run")} still running. Share again when they finish.`;
+	return `No runs for ${at}. Run \`evalkit run\` first${options.all ? "" : ", or pass --all to share runs from other commits"}.`;
+}
+/** Where to look after sharing: the commit, or the repository if several commits were shared. */
+function shareTarget(serverUrl, head, runs) {
+	const commits = new Set(runs.map((run) => run.source.commit));
+	const commit = commits.size === 1 ? `/-/${[...commits][0]}` : "";
+	return new URL(`/${repoKey(head)}${commit}`, serverUrl).href;
+}
+/** Build one run's upload bundle: run.json, catalog.json, and its snapshot. */
+async function runBundle(options) {
+	const files = [];
+	const encode = (value) => new TextEncoder().encode(`${JSON.stringify(value)}\n`);
+	files.push({
+		path: "run.json",
+		data: encode(options.run)
+	});
+	const saved = await readFile(resolve(options.reportRoot, options.run.id, "catalog.json")).catch(() => void 0);
+	files.push({
+		path: "catalog.json",
+		data: saved ? new Uint8Array(saved) : encode(runCatalog(options.registry))
+	});
+	await snapshotRun(options.reports, options.run.id, {
+		async json(path, value) {
+			files.push({
+				path,
+				data: encode(value)
+			});
+		},
+		async bytes(path, data) {
+			files.push({
+				path,
+				data
+			});
+		}
+	}, { workspaceFiles: options.workspaceFiles });
+	return encodeBundle(files);
+}
+/** The server refused this bundle (4xx): retrying it cannot help. */
+var UploadRejected = class extends Error {};
+/**
+* The URL does not answer as an EvalKit share server (a redirect, an HTML page,
+* an auth proxy). Every upload would fail the same way, so sharing stops.
+*/
+var ShareServerError = class extends Error {};
+/** `share.headers` from the config: called once, checked, never printed. */
+async function resolveShareHeaders(headers) {
+	let value;
+	try {
+		value = typeof headers === "function" ? await headers() : headers ?? {};
+	} catch (error) {
+		throw new Error(`share.headers failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("share.headers must be an object of header names to values");
+	const entries = Object.entries(value);
+	for (const [name, item] of entries) if (typeof item !== "string" || !item) throw new Error(`share.headers "${name}" must be a non-empty string`);
+	return Object.fromEntries(entries);
+}
+/** Check that the URL is an EvalKit share server and the headers get through. */
+async function checkShareServer(serverUrl, headers) {
+	const response = await fetch(new URL("/api/v1/repos", serverUrl), {
+		headers,
+		redirect: "manual"
+	});
+	await expectShareServer(response, serverUrl);
+	await response.body?.cancel();
+}
+/** POST one bundle, retrying network errors and 5xx responses. */
+async function uploadBundle(serverUrl, bundle, options = {}) {
+	const attempts = options.attempts ?? 3;
+	let lastError;
+	for (let attempt = 1; attempt <= attempts; attempt++) {
+		try {
+			return await postBundle(serverUrl, bundle, options.headers ?? {});
+		} catch (error) {
+			if (error instanceof UploadRejected || error instanceof ShareServerError) throw error;
+			lastError = error;
+		}
+		if (attempt < attempts) await Bun.sleep((options.delayMs ?? 500) * 2 ** (attempt - 1));
+	}
+	throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error(`Upload failed: ${String(lastError)}`);
+}
+async function postBundle(serverUrl, bundle, headers) {
+	const response = await fetch(new URL("/api/v1/uploads", serverUrl), {
+		method: "POST",
+		headers: {
+			...headers,
+			"content-type": "application/octet-stream"
+		},
+		body: bundle,
+		redirect: "manual"
+	});
+	await expectShareServer(response, serverUrl);
+	if (response.ok) return parseUploadResult(await response.json());
+	const reason = await response.text();
+	if (response.status < 500) throw new UploadRejected(`Share server rejected the upload: ${reason}`);
+	throw new Error(`Share server error ${response.status}: ${reason}`);
+}
+function parseUploadResult(value) {
+	const result = value;
+	if ((result?.status === "created" || result?.status === "exists") && typeof result.url === "string") return {
+		status: result.status,
+		url: result.url
+	};
+	throw new ShareServerError(`Unexpected share server response: ${JSON.stringify(value)}`);
+}
+/** Redirects and non-JSON answers come from something in front of the server. */
+async function expectShareServer(response, serverUrl) {
+	if (response.status >= 300 && response.status < 400) {
+		const location = response.headers.get("location");
+		const target = location ? new URL(location, serverUrl).host : "elsewhere";
+		throw new ShareServerError(`${new URL(serverUrl).host} redirected to ${target} instead of answering. If an auth proxy is in front of the share server, set share.headers in evalkit.config.ts.`);
+	}
+	const type = response.headers.get("content-type") ?? "";
+	const denied = response.status === 401 || response.status === 403;
+	if (denied || response.ok && !type.includes("json")) throw new ShareServerError(`${new URL(serverUrl).host} did not answer as an EvalKit share server (${response.status}${type ? `, ${type.split(";")[0]}` : ""}). ` + (denied ? "Check share.headers." : "Check share.url."));
+}
+async function shareRuns(options) {
+	const reports = createDashboardReportReader(options.reportRoot, options.registry);
+	return options.step("Uploading", async (progress) => {
+		const result = {
+			created: 0,
+			exists: 0,
+			failed: [],
+			bytes: 0
+		};
+		for (const [index, run] of options.runs.entries()) {
+			progress(`run ${index + 1}/${options.runs.length} · ${formatBytes(result.bytes)}`);
+			try {
+				const bundle = await runBundle({
+					reports,
+					reportRoot: options.reportRoot,
+					registry: options.registry,
+					run,
+					workspaceFiles: options.workspaceFiles
+				});
+				const uploaded = await uploadBundle(options.serverUrl, bundle, { headers: options.headers });
+				result.bytes += bundle.byteLength;
+				result[uploaded.status] += 1;
+			} catch (error) {
+				if (error instanceof ShareServerError) throw error;
+				result.failed.push({
+					runId: run.id,
+					error: error instanceof Error ? error.message : String(error)
+				});
+			}
+		}
+		return result;
+	}, (result) => `${result.created} new · ${result.exists} already shared` + (result.failed.length ? ` · ${result.failed.length} failed` : "") + ` · ${formatBytes(result.bytes)}`);
+}
+function formatBytes(size) {
+	if (size < 1024) return `${size} B`;
+	if (size < 1024 ** 2) return `${(size / 1024).toFixed(1)} kB`;
+	return `${(size / 1024 ** 2).toFixed(1)} MB`;
+}
+//#endregion
 //#region ../cli/src/new-project-template.ts
 /** Provider-free example: one fixture, agent, scorer, and a two-cell matrix. */
 const starterFiles = {
@@ -9002,12 +9369,11 @@ Replace these examples with your own agent, tasks, and checks.
 
 \`\`\`sh
 bun install
-bun run check        # type-check your eval, agent, scorer, and config
-bun run evals        # run the example across both styles
-bun run matrix:plan  # inspect the matrix without running it
-bun run matrix       # run the configured matrix
-bun run dashboard    # inspect local reports and launch runs
-bun run dashboard:build  # write a read-only, shareable snapshot
+bun run check                                   # type-check your eval, agent, scorer, and config
+bun run evalkit run                             # run the example across both styles
+bun run evalkit run --matrix styles --dry-run   # inspect the matrix without running it
+bun run evalkit dev                             # inspect local reports and launch runs
+bun run evalkit build                           # write a read-only, shareable snapshot
 \`\`\`
 
 EvalKit installs from npm. Reports, trial workspaces, and dashboard snapshots stay local
@@ -9017,12 +9383,13 @@ scores, evidence, and candidate files (never evaluator workspaces): review it be
 }
 //#endregion
 //#region ../cli/src/new-project.ts
-const npmDependency = "^0.3.0";
+const npmDependency = "^0.5.0";
 const ignored = [
 	"node_modules/",
 	"_evalkit-results/",
 	"_evalkit-sandbox/",
-	"_evalkit-dashboard/"
+	"_evalkit-dashboard/",
+	"_evalkit-share/"
 ];
 const readIfExists = async (path) => {
 	try {
@@ -9101,11 +9468,6 @@ async function preparePackage(packagePath, name) {
 	const devDependencies = pkg.devDependencies ?? {};
 	if (!scripts || typeof scripts !== "object" || Array.isArray(scripts) || !dependencies || typeof dependencies !== "object" || Array.isArray(dependencies) || !devDependencies || typeof devDependencies !== "object" || Array.isArray(devDependencies)) throw new Error(`Invalid package.json scripts/dependencies: ${packagePath}`);
 	scripts.check ??= "tsc --noEmit";
-	scripts.evals ??= "evalkit run greeting --local";
-	scripts.matrix ??= "evalkit run --matrix styles --local";
-	scripts["matrix:plan"] ??= "evalkit run --matrix styles --dry-run";
-	scripts.dashboard ??= "evalkit dev";
-	scripts["dashboard:build"] ??= "evalkit build";
 	if (!dependencies["@leostera/evalkit"] && !devDependencies["@leostera/evalkit"]) dependencies["@leostera/evalkit"] = npmDependency;
 	if (!dependencies.typescript && !devDependencies.typescript) devDependencies.typescript = "^6.0.0";
 	if (!dependencies["@types/bun"] && !devDependencies["@types/bun"]) devDependencies["@types/bun"] = "^1.4.0";
@@ -9134,7 +9496,7 @@ async function writeStarterReadme(root, name, inPlace) {
 }
 //#endregion
 //#region ../cli/src/index.ts
-const VERSION = "0.3.0";
+const VERSION = "0.5.0";
 let projectRoot = process.cwd();
 let reportRoot = resolve(projectRoot, "_evalkit-results");
 const sandboxRoot = resolve(projectRoot, "_evalkit-sandbox");
@@ -9154,6 +9516,7 @@ async function runEvals(options) {
 	const registry = await loadRegistry();
 	const evaluations = options.evalIds.map((id) => registry.get(id));
 	if (evaluations.some((e) => !e)) throw new Error("Unknown eval");
+	const provenance = await runProvenance(registry);
 	await Effect.runPromise(runnerLogs(Effect.all(evaluations.map((evaluation) => {
 		const name = evaluation.name ?? authoringId(evaluation);
 		const started = performance.now();
@@ -9162,10 +9525,23 @@ async function runEvals(options) {
 			workspaceRoot: sandboxRoot,
 			suiteId: options.suiteId,
 			runtime: runtimeFor(evaluation),
-			concurrency: options.concurrency
+			concurrency: options.concurrency,
+			...provenance
 		})), Effect.tap((result) => runLog.finished(name, {}, result, performance.now() - started)), Effect.tapError((error) => Effect.sync(() => runLog.failed(name, error))));
 	}), { concurrency: options.concurrency })));
 }
+/** Detected per launch: `evalkit dev` keeps running while commits change. */
+async function runProvenance(registry) {
+	const source = await detectSource(projectRoot, { outputDirs: [
+		reportRoot,
+		sandboxRoot,
+		resolve(projectRoot, "_evalkit-dashboard")
+	] });
+	return {
+		...source ? { source } : {},
+		catalog: runCatalog(registry)
+	};
+}
 function registerMatrixRoutes(app, registry, dashboardMatrix, trials) {
 	let matrixRunning = false;
 	app.get("/v1/matrix", (context) => context.json({ matrix: dashboardMatrix ? {
@@ -9210,15 +9586,16 @@ function registerMatrixRoutes(app, registry, dashboardMatrix, trials) {
 			const name = evaluation.name ?? authoringId(evaluation);
 			const started = performance.now();
 			runLog.started(name, body.parameters ?? {}, suiteId);
-			Effect.runPromise(runnerLogs(runMatrix(dashboardMatrix, {
+			runProvenance(registry).then((provenance) => Effect.runPromise(runnerLogs(runMatrix(dashboardMatrix, {
 				selection,
 				concurrency: 1,
 				trials,
 				...suiteId ? { suiteId } : {},
 				report: localReportStore(reportRoot),
 				workspaceRoot: sandboxRoot,
+				...provenance,
 				onResult: (cell, result) => runLog.cell(cell, result, performance.now() - started)
-			}))).catch((error) => runLog.failed(name, error)).finally(() => {
+			})))).catch((error) => runLog.failed(name, error)).finally(() => {
 				matrixRunning = false;
 			});
 		} else {
@@ -9413,7 +9790,7 @@ const runCommand = make$1("run", {
 const newCommand = make$1("new", { directory: text$2({ name: "directory" }) }, ({ directory }) => Effect.tryPromise({
 	try: async () => {
 		const root = await newProject([directory]);
-		console.log(`Created EvalKit project at ${root}\nRun cd ${root} && bun install && bun run evals.`);
+		console.log(`Created EvalKit project at ${root}\nRun cd ${root} && bun install && bun run evalkit run.`);
 	},
 	catch: (error) => error
 }));
@@ -9505,12 +9882,88 @@ const tidyCommand = make$1("tidy", { config }, ({ config }) => Effect.tryPromise
 	},
 	catch: (error) => error
 }));
+const shareServeCommand = make$1("serve", {
+	dir: text("dir").pipe(withDefault("_evalkit-share")),
+	port: integer("port").pipe(withDefault(4318))
+}, ({ dir, port }) => Effect.tryPromise({
+	try: async () => {
+		const root = resolve(process.cwd(), dir);
+		const app = await createDirectoryShareApp({
+			dir: root,
+			dashboardRoot: dashboardAssets()
+		});
+		let server;
+		try {
+			server = Bun.serve({
+				port,
+				fetch: app.fetch
+			});
+		} catch (error) {
+			if (error.code === "EADDRINUSE") throw new Error(`Port ${port} is already in use. Choose another: evalkit share serve --port 4319`);
+			throw error;
+		}
+		banner("share serve", VERSION);
+		console.log(`  ${cyan("➜")}  ${bold("Local:".padEnd(9))}${cyan(`http://localhost:${server.port}`)}`);
+		console.log(`  ${cyan("➜")}  ${bold("Storage:".padEnd(9))}${relative(process.cwd(), root) || "."}`);
+		console.log(`\n  ${dim(`Upload with share.url = "http://localhost:${server.port}". No authentication: keep it private.`)}\n`);
+	},
+	catch: (error) => error
+}));
+const shareCommand = make$1("share", {
+	config,
+	all: boolean("all"),
+	allowDirty: boolean("allow-dirty"),
+	noWorkspace: boolean("no-workspace")
+}, ({ config, all, allowDirty, noWorkspace }) => Effect.tryPromise({
+	try: async () => {
+		const started = performance.now();
+		banner("share", VERSION);
+		await loadProjectStep(Option.getOrUndefined(config));
+		const serverUrl = process.env.EVALKIT_SHARE_URL ?? project.config.share?.url;
+		if (!serverUrl) throw new Error("No share server configured. Set share: { url } in evalkit.config.ts or EVALKIT_SHARE_URL.");
+		const head = await step("Source", () => detectSource(projectRoot, { outputDirs: [
+			reportRoot,
+			sandboxRoot,
+			resolve(projectRoot, "_evalkit-dashboard")
+		] }), (source) => source ? `${repoKey(source)} @ ${shortSource(source)}${source.ref ? ` (${source.ref})` : ""}` : "not a git repository");
+		if (!head) throw new Error("evalkit share needs to know the commit: run it inside a git repository or set EVALKIT_SOURCE_REPO and EVALKIT_SOURCE_COMMIT. `evalkit build` works without one.");
+		const registry = project.registry;
+		const selection = await step("Runs", async () => selectRuns(await createDashboardReportReader(reportRoot, registry).listRuns(), head, {
+			all,
+			allowDirty
+		}), (value) => selectionSummary(value, { all }));
+		if (!selection.selected.length) throw new Error(noRunsMessage(selection, head, { all }));
+		const result = await shareRuns({
+			serverUrl,
+			headers: await step("Server", async () => {
+				const headers = await resolveShareHeaders(project.config.share?.headers);
+				await checkShareServer(serverUrl, headers);
+				return headers;
+			}, (headers) => {
+				const names = Object.keys(headers);
+				return `${new URL(serverUrl).host}${names.length ? dim(` with ${names.join(", ")}`) : ""}`;
+			}),
+			reportRoot,
+			registry,
+			runs: selection.selected,
+			workspaceFiles: !noWorkspace,
+			step
+		});
+		for (const failure of result.failed) console.log(`  ${yellow("✗")} ${failure.runId.slice(0, 8)} ${dim(failure.error)}`);
+		const target = shareTarget(serverUrl, head, selection.selected);
+		console.log(`\n  ${bold(result.failed.length ? "Shared with errors" : "Shared")} in ${duration(performance.now() - started)}\n`);
+		console.log(`  ${cyan("➜")}  ${cyan(target)}\n`);
+		if (result.failed.length) process.exitCode = 1;
+	},
+	catch: (error) => error
+})).pipe(withSubcommands([shareServeCommand]));
 const cli = run(make$1("evalkit").pipe(withSubcommands([
 	newCommand,
 	runCommand,
 	devCommand,
 	buildCommand,
-	tidyCommand
+	tidyCommand,
+	shareCommand
 ])), {
 	name: "EvalKit",
 	version: VERSION