@leostera/evalkit 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to `@leostera/evalkit`. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses [Semantic Versioning](https://semver.org/). Before 1.0, a minor version may include breaking changes; they are marked **Breaking**.
 
+## [0.5.0] - 2026-10-28
+
+### Added
+
+- `share.headers` in `evalkit.config.ts`: extra headers for every request to the share server, for an auth proxy such as Cloudflare Access in front of it. It can be an object or a function (sync or async), is called once per `evalkit share`, and its values are never printed.
+- `evalkit share` checks the server before uploading, in a new Server step.
+
+### Fixed
+
+- `evalkit share` no longer follows redirects or treats an HTML page as a successful upload. A redirect (for example to a login page), a 401 or 403, or a non-JSON answer stops sharing with an error naming the cause, instead of `JSON Parse error: Unrecognized token '<'` for every run.
+
 ## [0.4.0] - 2026-10-28
 
 Commit provenance and team sharing ([RFD0006](docs/rfds/RFD0006-commit-provenance-and-share-server.md)).
@@ -74,7 +85,8 @@ Commit provenance and team sharing ([RFD0006](docs/rfds/RFD0006-commit-provenanc
 - **Breaking:** the npm package moved to `@leostera/evalkit`. Replace the `@leostera-js/evalkit` dependency and update imports, including `/runner`. Eval definitions and local reports are unchanged.
 - Dashboard workflow refinements.
 
-[0.4.0]: https://github.com/leostera/evalkit/compare/5e67e72...main
+[0.5.0]: https://github.com/leostera/evalkit/compare/0dd8717...main
+[0.4.0]: https://github.com/leostera/evalkit/compare/5e67e72...0dd8717
 [0.3.0]: https://github.com/leostera/evalkit/compare/38c34be...5e67e72
 [0.2.0]: https://github.com/leostera/evalkit/compare/3f8855a...38c34be
 [0.1.0]: https://github.com/leostera/evalkit/compare/12d5a1e...3f8855a

package/dist/cli.mjs

@@ -9152,29 +9152,61 @@ async function runBundle(options) {
 	}, { workspaceFiles: options.workspaceFiles });
 	return encodeBundle(files);
 }
-/** The server refused the bundle (4xx): retrying the same bundle cannot help. */
+/** The server refused this bundle (4xx): retrying it cannot help. */
 var UploadRejected = class extends Error {};
+/**
+* The URL does not answer as an EvalKit share server (a redirect, an HTML page,
+* an auth proxy). Every upload would fail the same way, so sharing stops.
+*/
+var ShareServerError = class extends Error {};
+/** `share.headers` from the config: called once, checked, never printed. */
+async function resolveShareHeaders(headers) {
+	let value;
+	try {
+		value = typeof headers === "function" ? await headers() : headers ?? {};
+	} catch (error) {
+		throw new Error(`share.headers failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("share.headers must be an object of header names to values");
+	const entries = Object.entries(value);
+	for (const [name, item] of entries) if (typeof item !== "string" || !item) throw new Error(`share.headers "${name}" must be a non-empty string`);
+	return Object.fromEntries(entries);
+}
+/** Check that the URL is an EvalKit share server and the headers get through. */
+async function checkShareServer(serverUrl, headers) {
+	const response = await fetch(new URL("/api/v1/repos", serverUrl), {
+		headers,
+		redirect: "manual"
+	});
+	await expectShareServer(response, serverUrl);
+	await response.body?.cancel();
+}
 /** POST one bundle, retrying network errors and 5xx responses. */
 async function uploadBundle(serverUrl, bundle, options = {}) {
 	const attempts = options.attempts ?? 3;
 	let lastError;
 	for (let attempt = 1; attempt <= attempts; attempt++) {
 		try {
-			return await postBundle(serverUrl, bundle);
+			return await postBundle(serverUrl, bundle, options.headers ?? {});
 		} catch (error) {
-			if (error instanceof UploadRejected) throw error;
+			if (error instanceof UploadRejected || error instanceof ShareServerError) throw error;
 			lastError = error;
 		}
 		if (attempt < attempts) await Bun.sleep((options.delayMs ?? 500) * 2 ** (attempt - 1));
 	}
 	throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error(`Upload failed: ${String(lastError)}`);
 }
-async function postBundle(serverUrl, bundle) {
+async function postBundle(serverUrl, bundle, headers) {
 	const response = await fetch(new URL("/api/v1/uploads", serverUrl), {
 		method: "POST",
-		headers: { "content-type": "application/octet-stream" },
-		body: bundle
+		headers: {
+			...headers,
+			"content-type": "application/octet-stream"
+		},
+		body: bundle,
+		redirect: "manual"
 	});
+	await expectShareServer(response, serverUrl);
 	if (response.ok) return parseUploadResult(await response.json());
 	const reason = await response.text();
 	if (response.status < 500) throw new UploadRejected(`Share server rejected the upload: ${reason}`);
@@ -9186,7 +9218,18 @@ function parseUploadResult(value) {
 		status: result.status,
 		url: result.url
 	};
-	throw new UploadRejected(`Unexpected share server response: ${JSON.stringify(value)}`);
+	throw new ShareServerError(`Unexpected share server response: ${JSON.stringify(value)}`);
+}
+/** Redirects and non-JSON answers come from something in front of the server. */
+async function expectShareServer(response, serverUrl) {
+	if (response.status >= 300 && response.status < 400) {
+		const location = response.headers.get("location");
+		const target = location ? new URL(location, serverUrl).host : "elsewhere";
+		throw new ShareServerError(`${new URL(serverUrl).host} redirected to ${target} instead of answering. If an auth proxy is in front of the share server, set share.headers in evalkit.config.ts.`);
+	}
+	const type = response.headers.get("content-type") ?? "";
+	const denied = response.status === 401 || response.status === 403;
+	if (denied || response.ok && !type.includes("json")) throw new ShareServerError(`${new URL(serverUrl).host} did not answer as an EvalKit share server (${response.status}${type ? `, ${type.split(";")[0]}` : ""}). ` + (denied ? "Check share.headers." : "Check share.url."));
 }
 async function shareRuns(options) {
 	const reports = createDashboardReportReader(options.reportRoot, options.registry);
@@ -9207,10 +9250,11 @@ async function shareRuns(options) {
 					run,
 					workspaceFiles: options.workspaceFiles
 				});
-				const uploaded = await uploadBundle(options.serverUrl, bundle);
+				const uploaded = await uploadBundle(options.serverUrl, bundle, { headers: options.headers });
 				result.bytes += bundle.byteLength;
 				result[uploaded.status] += 1;
 			} catch (error) {
+				if (error instanceof ShareServerError) throw error;
 				result.failed.push({
 					runId: run.id,
 					error: error instanceof Error ? error.message : String(error)
@@ -9339,7 +9383,7 @@ scores, evidence, and candidate files (never evaluator workspaces): review it be
 }
 //#endregion
 //#region ../cli/src/new-project.ts
-const npmDependency = "^0.4.0";
+const npmDependency = "^0.5.0";
 const ignored = [
 	"node_modules/",
 	"_evalkit-results/",
@@ -9452,7 +9496,7 @@ async function writeStarterReadme(root, name, inPlace) {
 }
 //#endregion
 //#region ../cli/src/index.ts
-const VERSION = "0.4.0";
+const VERSION = "0.5.0";
 let projectRoot = process.cwd();
 let reportRoot = resolve(projectRoot, "_evalkit-results");
 const sandboxRoot = resolve(projectRoot, "_evalkit-sandbox");
@@ -9891,6 +9935,14 @@ const shareCommand = make$1("share", {
 		if (!selection.selected.length) throw new Error(noRunsMessage(selection, head, { all }));
 		const result = await shareRuns({
 			serverUrl,
+			headers: await step("Server", async () => {
+				const headers = await resolveShareHeaders(project.config.share?.headers);
+				await checkShareServer(serverUrl, headers);
+				return headers;
+			}, (headers) => {
+				const names = Object.keys(headers);
+				return `${new URL(serverUrl).host}${names.length ? dim(` with ${names.join(", ")}`) : ""}`;
+			}),
 			reportRoot,
 			registry,
 			runs: selection.selected,