@rulemetric/cli 0.1.1 → 0.2.1

package/README.md

@@ -0,0 +1,66 @@
+# @rulemetric/cli
+
+The RuleMetric CLI. Manages instructions, sessions, evals, and (as of the
+user-management release) organizations.
+
+## Auth
+
+```bash
+rulemetric auth login            # interactive — writes ~/.config/rulemetric/env
+rulemetric auth create-key       # generate a long-lived API key
+rulemetric auth whoami           # print the current user
+```
+
+Credentials are read from (first match wins):
+1. `RULEMETRIC_API_URL` + `RULEMETRIC_API_KEY` (or `RULEMETRIC_ACCESS_TOKEN`)
+2. `~/.config/rulemetric/env`
+3. `~/.config/rulemetric/auth.json` (JSON fallback, requires `jq`)
+4. `.env.local` in the project root (development)
+
+## Org commands
+
+The org commands let you list and switch the "active org" used by every
+subsequent CLI invocation. Sessions captured by hooks/proxy/MCP while an
+active org is set will stamp `sessions.org_id` to that org.
+
+```bash
+rulemetric org list              # list orgs you belong to; star marks the active one
+rulemetric org current           # print the active org's slug, name, and role
+rulemetric org switch <slug>     # set the active org (cached locally)
+rulemetric org switch --clear    # clear the active org (back to personal mode)
+```
+
+**Active-org resolution order:**
+1. `RULEMETRIC_ORG_ID` environment variable (process-scoped override)
+2. Local cache at `~/.config/rulemetric/active-org.json` (written by
+   `rulemetric org switch`)
+3. None (sessions captured without an org_id)
+
+A background prefetch refreshes the cache on a TTL so a slug change in the
+web UI is picked up by the next CLI run without an explicit `org switch`.
+
+**Creating an org:** Currently web-only — visit `/orgs/new` in the
+dashboard. The CLI will adopt the org once you `org switch <slug>` (or set
+the active org in the web UI, which the CLI cache picks up).
+
+## Other top-level commands
+
+- `rulemetric instructions ...` — list, get, create, edit, push, pull
+- `rulemetric convert ...` — format conversion (25+ formats)
+- `rulemetric import ...` — bulk import from a project tree
+- `rulemetric sessions ...` — list/get/import sessions
+- `rulemetric evals ...` — eval target/case/run/optimize commands
+- `rulemetric insights sync|generate` — push local session-meta + facets up
+- `rulemetric hooks install|uninstall|run <name>` — manage tool hook scripts
+- `rulemetric proxy ...` — start/stop the mitmproxy capture layer
+- `rulemetric service install|uninstall` — launchd services for API + worker
+
+## Tests
+
+```bash
+pnpm --filter @rulemetric/cli test:unit   # unit tests (no creds needed)
+pnpm --filter @rulemetric/cli test:e2e    # e2e (needs Supabase creds)
+```
+
+E2E tests start a real Hono API on port 3001 and create a temp Supabase
+user; see `apps/cli/e2e/global-setup.ts`.

package/dist/base-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-command.d.ts","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAI7C,8BAAsB,WAAY,SAAQ,OAAO;IAC/C,OAAgB,SAAS;;MAMvB;cAEuB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9C,SAAS,CAAC,WAAW,IAAI,IAAI;cAMJ,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAelF"}
+{"version":3,"file":"base-command.d.ts","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAM7C,8BAAsB,WAAY,SAAQ,OAAO;IAC/C,OAAgB,SAAS;;MAMvB;cAEuB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB9C,SAAS,CAAC,WAAW,IAAI,IAAI;cASJ,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAelF"}

package/dist/base-command.js

@@ -1,6 +1,8 @@
 import { Command, Flags } from '@oclif/core';
 import { isAuthenticated } from './lib/auth.js';
 import { ApiError } from './lib/api-client.js';
+import { maybeRefreshActiveOrg } from './lib/active-org-refresh.js';
+import { getUpgradeBanner, refreshVersionCacheInBackground } from './lib/version-check.js';
 export class BaseCommand extends Command {
     static baseFlags = {
         'api-url': Flags.string({
@@ -15,11 +17,24 @@ export class BaseCommand extends Command {
         if (flags['api-url']) {
             process.env.RULEMETRIC_API_URL = flags['api-url'];
         }
+        // Print the upgrade banner from the cache (populated by the previous
+        // command). To stderr so it doesn't pollute scriptable stdout. Then
+        // kick off a background refresh for the *next* invocation. Suppressed
+        // on commands meant to be machine-readable (`hooks run`, etc.) since
+        // a banner there would corrupt JSON output piped to other tools.
+        const banner = getUpgradeBanner(this.config.version);
+        if (banner && !this.argv.includes('--quiet') && !process.env.RULEMETRIC_QUIET) {
+            process.stderr.write(`\n${banner}\n\n`);
+        }
+        refreshVersionCacheInBackground();
     }
     requireAuth() {
         if (!isAuthenticated()) {
             this.error('Not logged in. Run `rulemetric auth login` to authenticate.');
         }
+        // Fire-and-forget refresh of the local active-org cache. Doesn't block
+        // the command — its only side effect is rewriting the cache file.
+        void maybeRefreshActiveOrg();
     }
     async catch(err) {
         if (err instanceof ApiError) {

package/dist/base-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-command.js","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,OAAgB,WAAY,SAAQ,OAAO;IAC/C,MAAM,CAAU,SAAS,GAAG;QAC1B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,uBAAuB;YACpC,GAAG,EAAE,oBAAoB;YACzB,MAAM,EAAE,IAAI;SACb,CAAC;KACH,CAAC;IAEiB,KAAK,CAAC,IAAI;QAC3B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAiC,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAES,WAAW;QACnB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,KAAK,CAAC,GAAkC;QAC/D,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACjF,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC"}
+{"version":3,"file":"base-command.js","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAE3F,MAAM,OAAgB,WAAY,SAAQ,OAAO;IAC/C,MAAM,CAAU,SAAS,GAAG;QAC1B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,uBAAuB;YACpC,GAAG,EAAE,oBAAoB;YACzB,MAAM,EAAE,IAAI;SACb,CAAC;KACH,CAAC;IAEiB,KAAK,CAAC,IAAI;QAC3B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAiC,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,+BAA+B,EAAE,CAAC;IACpC,CAAC;IAES,WAAW;QACnB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC5E,CAAC;QACD,uEAAuE;QACvE,kEAAkE;QAClE,KAAK,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAEkB,KAAK,CAAC,KAAK,CAAC,GAAkC;QAC/D,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACjF,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC"}

package/dist/commands/auth/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAWpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,OAAgB,WAAW,SAA0B;IAErD,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;MAGnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAiC3B"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAYpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,OAAgB,WAAW,SAA0B;IAErD,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;MAGnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAwC3B"}

package/dist/commands/auth/login.js

@@ -2,6 +2,7 @@ import { Flags } from '@oclif/core';
 import { BaseCommand } from '../../base-command.js';
 import { saveToken, saveEnvFile } from '../../lib/auth.js';
 import { apiPost } from '../../lib/api-client.js';
+import { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';
 export default class AuthLogin extends BaseCommand {
     static description = 'Log in to RuleMetric';
     static examples = [
@@ -34,6 +35,12 @@ export default class AuthLogin extends BaseCommand {
             email: data.email,
         });
         saveEnvFile(data.accessToken, process.env.RULEMETRIC_API_URL);
+        // Bootstrap the active-org cache now that auth is available. BaseCommand
+        // fired the guarded refresh BEFORE login completed (no creds → 401 →
+        // swallowed); without this explicit retry, the cache stays empty until
+        // the user runs another CLI command, and any Claude Code session that
+        // fires in the meantime lands with org_id = NULL.
+        await bootstrapActiveOrg();
         this.log(`Logged in as ${data.email}`);
     }
 }

package/dist/commands/auth/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AASlD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAU,WAAW,GAAG,sBAAsB,CAAC;IAErD,MAAM,CAAU,QAAQ,GAAG;QACzB,8BAA8B;QAC9B,kDAAkD;KACnD,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QAChE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;KACzF,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAE9E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAgB,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAErF,SAAS,CAAC;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAE9D,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AASrE,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAU,WAAW,GAAG,sBAAsB,CAAC;IAErD,MAAM,CAAU,QAAQ,GAAG;QACzB,8BAA8B;QAC9B,kDAAkD;KACnD,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QAChE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;KACzF,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAE9E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAgB,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAErF,SAAS,CAAC;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAE9D,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,kBAAkB,EAAE,CAAC;QAE3B,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC"}

package/dist/commands/crons/list.d.ts

@@ -0,0 +1,7 @@
+import { BaseCommand } from '../../base-command.js';
+export default class CronsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/crons/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/crons/list.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAC9C,OAAgB,WAAW,SAAwD;IAEnF,OAAgB,QAAQ,WAEtB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAc7B"}

package/dist/commands/crons/list.js

@@ -0,0 +1,24 @@
+import { printTable } from '@oclif/table';
+import { BaseCommand } from '../../base-command.js';
+import { CRON_REGISTRY } from '../../lib/cron-registry.js';
+export default class CronsList extends BaseCommand {
+    static description = 'List all registered cron tasks and their schedules';
+    static examples = [
+        '<%= config.bin %> crons list',
+    ];
+    async run() {
+        await this.parse(CronsList);
+        printTable({
+            data: CRON_REGISTRY.map((c) => ({
+                Name: c.name,
+                Schedule: c.schedule,
+                Description: c.description,
+            })),
+            columns: ['Name', 'Schedule', 'Description'],
+        });
+        this.log('');
+        this.log(`${CRON_REGISTRY.length} cron task(s) registered. Each runs on the user's local worker.`);
+        this.log('Run any of them on demand with: rulemetric crons run <name>');
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/crons/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../src/commands/crons/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAC9C,MAAM,CAAU,WAAW,GAAG,oDAAoD,CAAC;IAEnF,MAAM,CAAU,QAAQ,GAAG;QACvB,8BAA8B;KACjC,CAAC;IAEF,KAAK,CAAC,GAAG;QACL,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,UAAU,CAAC;YACP,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,iEAAiE,CAAC,CAAC;QACnG,IAAI,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC5E,CAAC"}

package/dist/commands/crons/run.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base-command.js';
+export default class CronsRun extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        quiet: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=run.d.ts.map

package/dist/commands/crons/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/crons/run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIpD,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC7C,OAAgB,WAAW,SAAyD;IAEpF,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,IAAI;;MAKlB;IAEF,OAAgB,KAAK;;MAKnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA2B7B"}

package/dist/commands/crons/run.js

@@ -0,0 +1,48 @@
+import { Args, Flags } from '@oclif/core';
+import { BaseCommand } from '../../base-command.js';
+import { CRON_REGISTRY } from '../../lib/cron-registry.js';
+import { runCronByName } from '../../lib/cron-runner.js';
+export default class CronsRun extends BaseCommand {
+    static description = 'Run a registered cron task synchronously, right now';
+    static examples = [
+        '<%= config.bin %> crons run cron_refresh_skills',
+        '<%= config.bin %> crons run cron_suggest_instructions --quiet',
+    ];
+    static args = {
+        name: Args.string({
+            description: 'Cron task name (run `rulemetric crons list` to see all)',
+            required: true,
+        }),
+    };
+    static flags = {
+        quiet: Flags.boolean({
+            char: 'q',
+            description: 'Suppress per-line log output; print summary only',
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(CronsRun);
+        this.requireAuth();
+        const def = CRON_REGISTRY.find((c) => c.name === args.name);
+        if (!def) {
+            this.error(`Unknown cron: ${args.name}\nRun \`rulemetric crons list\` to see available tasks.`);
+        }
+        this.log(`▶ Running ${def.name} …`);
+        const startedAt = Date.now();
+        const result = await runCronByName(args.name);
+        if (!flags.quiet) {
+            for (const line of result.logs) {
+                const prefix = line.level === 'error' || line.level === 'warn' ? `[${line.level}]` : '';
+                this.log(`  ${prefix} ${line.message}`);
+            }
+        }
+        const seconds = ((result.durationMs ?? Date.now() - startedAt) / 1000).toFixed(1);
+        if (result.ok) {
+            this.log(`✓ ${def.name} completed in ${seconds}s (${result.logs.length} log line${result.logs.length === 1 ? '' : 's'})`);
+        }
+        else {
+            this.error(`✗ ${def.name} failed after ${seconds}s: ${result.error}`);
+        }
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/crons/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/commands/crons/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC7C,MAAM,CAAU,WAAW,GAAG,qDAAqD,CAAC;IAEpF,MAAM,CAAU,QAAQ,GAAG;QACvB,iDAAiD;QACjD,+DAA+D;KAClE,CAAC;IAEF,MAAM,CAAU,IAAI,GAAG;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;YACd,WAAW,EAAE,yDAAyD;YACtE,QAAQ,EAAE,IAAI;SACjB,CAAC;KACL,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACpB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACjB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kDAAkD;SAClE,CAAC;KACL,CAAC;IAEF,KAAK,CAAC,GAAG;QACL,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,IAAI,yDAAyD,CAAC,CAAC;QACpG,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5C,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,iBAAiB,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC9H,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,iBAAiB,OAAO,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC"}

package/dist/commands/evals/listen.d.ts

@@ -1,10 +1,36 @@
 import { BaseCommand } from '../../base-command.js';
+/**
+ * Rewrite a Supabase Supavisor TRANSACTION-mode pooler URL (port 6543) to the
+ * SESSION-mode pooler URL (port 5432) on the same host.
+ *
+ *   in:  postgresql://postgres.PROJECTREF:PASS@aws-N-REGION.pooler.supabase.com:6543/postgres
+ *   out: postgresql://postgres.PROJECTREF:PASS@aws-N-REGION.pooler.supabase.com:5432/postgres
+ *
+ * graphile-worker relies on LISTEN/NOTIFY. Through transaction-mode pooling
+ * each pooled checkout can land on a different backend, so LISTEN registrations
+ * and the NOTIFYs meant to wake them are decoupled; the worker then reconnects
+ * in a tight loop and those failed LISTEN reconnects pile up as half-open
+ * pooler sessions (see docs/incidents/2026-05-18-supavisor-cascade.md).
+ * Session mode pins one backend for the lifetime of the client connection, so
+ * LISTEN works.
+ *
+ * We deliberately target the session POOLER, not the true direct connection
+ * (`db.<ref>.supabase.co:5432`): that host is IPv6-only on Supabase, so a
+ * worker on an IPv4-only network — `getaddrinfo` returns no address — could
+ * not connect at all. The session pooler shares the pooler host, which
+ * resolves on IPv4.
+ *
+ * Returns the input untouched when it isn't a transaction-mode Supavisor URL:
+ * an already-session-mode URL, a direct connection, or any self-hosted / local
+ * Postgres all work for graphile-worker as-is.
+ */
+export declare function deriveSessionPoolerUrl(input: string | undefined): string | undefined;
 export default class EvalListenCommand extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
-        'supabase-url': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'supabase-anon-key': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'supabase-url': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'supabase-anon-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/evals/listen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listen.d.ts","sourceRoot":"","sources":["../../../src/commands/evals/listen.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIpD,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IACxD,OAAgB,WAAW,SAAmE;IAE9F,OAAgB,QAAQ,WAEtB;IAEF,OAAgB,KAAK;;;MAWnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAqC3B"}
+{"version":3,"file":"listen.d.ts","sourceRoot":"","sources":["../../../src/commands/evals/listen.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAepF;AAED,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IACxD,OAAgB,WAAW,SAAmE;IAE9F,OAAgB,QAAQ,WAEtB;IAEF,OAAgB,KAAK;;;MAiBnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4H3B"}

package/dist/commands/evals/listen.js

@@ -1,53 +1,187 @@
 import { Flags } from '@oclif/core';
+import { initSentry, flushSentry, initTelemetry, shutdownTelemetry } from '@rulemetric/telemetry';
 import { BaseCommand } from '../../base-command.js';
-import { startWorker, createWorkerId, getUserIdFromJwt } from '../../lib/eval-worker.js';
+import { startWorker } from '../../lib/graphile-worker-runner.js';
 import { loadToken } from '../../lib/auth.js';
+import { apiGet } from '../../lib/api-client.js';
+/**
+ * Rewrite a Supabase Supavisor TRANSACTION-mode pooler URL (port 6543) to the
+ * SESSION-mode pooler URL (port 5432) on the same host.
+ *
+ *   in:  postgresql://postgres.PROJECTREF:PASS@aws-N-REGION.pooler.supabase.com:6543/postgres
+ *   out: postgresql://postgres.PROJECTREF:PASS@aws-N-REGION.pooler.supabase.com:5432/postgres
+ *
+ * graphile-worker relies on LISTEN/NOTIFY. Through transaction-mode pooling
+ * each pooled checkout can land on a different backend, so LISTEN registrations
+ * and the NOTIFYs meant to wake them are decoupled; the worker then reconnects
+ * in a tight loop and those failed LISTEN reconnects pile up as half-open
+ * pooler sessions (see docs/incidents/2026-05-18-supavisor-cascade.md).
+ * Session mode pins one backend for the lifetime of the client connection, so
+ * LISTEN works.
+ *
+ * We deliberately target the session POOLER, not the true direct connection
+ * (`db.<ref>.supabase.co:5432`): that host is IPv6-only on Supabase, so a
+ * worker on an IPv4-only network — `getaddrinfo` returns no address — could
+ * not connect at all. The session pooler shares the pooler host, which
+ * resolves on IPv4.
+ *
+ * Returns the input untouched when it isn't a transaction-mode Supavisor URL:
+ * an already-session-mode URL, a direct connection, or any self-hosted / local
+ * Postgres all work for graphile-worker as-is.
+ */
+export function deriveSessionPoolerUrl(input) {
+    if (!input)
+        return undefined;
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        return input;
+    }
+    // Only Supavisor pooler hosts have a transaction-vs-session port split.
+    if (!/\.pooler\.supabase\.com$/i.test(url.hostname))
+        return input;
+    // 6543 = transaction mode (breaks LISTEN); 5432 = session mode. Anything
+    // not on 6543 is left alone — credentials are identical across both modes.
+    if (url.port !== '6543')
+        return input;
+    url.port = '5432';
+    return url.toString();
+}
 export default class EvalListenCommand extends BaseCommand {
     static description = 'Listen for eval jobs from the web UI and execute them locally';
     static examples = [
         '<%= config.bin %> evals listen',
     ];
     static flags = {
+        // Legacy flags from the pre-graphile-worker queue. The graphile-worker
+        // runner connects directly to Postgres via DATABASE_URL, so these are
+        // no longer needed — but we keep them as silent no-ops so existing
+        // launchd plists that pass them keep working.
         'supabase-url': Flags.string({
-            description: 'Supabase project URL',
+            description: '[deprecated, ignored] Supabase project URL (no longer used)',
             env: 'SUPABASE_URL',
-            required: true,
+            required: false,
+            hidden: true,
         }),
         'supabase-anon-key': Flags.string({
-            description: 'Supabase anon key',
+            description: '[deprecated, ignored] Supabase anon key (no longer used)',
             env: 'SUPABASE_ANON_KEY',
-            required: true,
+            required: false,
+            hidden: true,
         }),
     };
     async run() {
-        const { flags } = await this.parse(EvalListenCommand);
+        await this.parse(EvalListenCommand);
         this.requireAuth();
+        process.env.PG_APPLICATION_NAME ||= 'rulemetric-worker';
+        // Sentry first — captures any uncaughtException / unhandledRejection that
+        // fires during the rest of init (queue derivation, profile fetch, runner
+        // boot). Silent no-op when SENTRY_DSN is unset so dev laptops aren't
+        // affected. The graphile-worker-runner additionally hooks `job:failed`
+        // events to forward task-level errors with the mirrorId/taskName tagged.
+        const sentryEnabled = initSentry({ serviceName: 'rulemetric-worker' });
+        if (sentryEnabled)
+            this.log('[sentry] error capture enabled');
+        // OpenTelemetry — defaults to ConsoleSpanExporter (writes spans to stdout
+        // as JSON, captured by launchd to worker-stdout.log) when no OTLP endpoint
+        // is set. The cron envelope wraps each cron firing in a span, so the
+        // worker-side trace surface mirrors the API: search for `cron <name>` in
+        // worker-stdout.log to see span duration, status, and any recorded
+        // exception. To ship spans to a backend, set OTEL_EXPORTER_OTLP_ENDPOINT
+        // in the worker's launchd EnvironmentVariables (same convention as the
+        // API on Fly).
+        const otelMode = initTelemetry({ serviceName: 'rulemetric-worker' });
+        if (otelMode === 'otlp') {
+            this.log(`[otel] traces exporting to ${process.env.OTEL_EXPORTER_OTLP_ENDPOINT}`);
+        }
+        else if (otelMode === 'console') {
+            this.log('[otel] cron spans printing to stdout (set OTEL_EXPORTER_OTLP_ENDPOINT to ship to a backend)');
+        }
+        else {
+            this.log('[otel] disabled (TELEMETRY_ENABLED=false)');
+        }
+        // Token isn't passed into the runner — api-client.ts loads it from
+        // ~/.config/rulemetric/env on every request. We still call loadToken()
+        // here as an early sanity check so the worker fails fast at startup
+        // if the user hasn't run `rulemetric auth login`.
         const token = loadToken();
-        const accessToken = token?.accessToken ?? flags['supabase-anon-key'];
-        const userId = token ? getUserIdFromJwt(token.accessToken) : null;
-        if (!userId) {
-            this.error('Could not determine user ID. Run `rulemetric auth login`.');
+        if (!token) {
+            this.error('No auth token found. Run `rulemetric auth login` first.');
+        }
+        // graphile-worker uses LISTEN/NOTIFY, which is incompatible with
+        // transaction-mode pooling (Supavisor :6543). Each failed LISTEN reconnect
+        // burns a pooler slot, and when the pooler saturates the retry storm
+        // (graphile-worker reconnects every 102 ms) perpetuates it indefinitely —
+        // we observed Supavisor pinned at 200/200 client connections for 24+ hours
+        // (docs/incidents/2026-05-18-supavisor-cascade.md).
+        //
+        // Resolution: run graphile-worker against the SESSION-mode pooler (:5432).
+        // Session mode pins a backend per connection so LISTEN works, and — unlike
+        // the true direct host (db.<ref>.supabase.co, IPv6-only) — it stays
+        // reachable on the IPv4-only networks most worker laptops run on.
+        // Precedence: WORKER_DATABASE_URL > auto-derived session URL > error.
+        const connectionString = process.env.WORKER_DATABASE_URL ||
+            deriveSessionPoolerUrl(process.env.DATABASE_URL);
+        if (!connectionString) {
+            this.error('Could not resolve a Postgres URL for the worker. Set WORKER_DATABASE_URL or DATABASE_URL (see .env.example).');
+        }
+        // Warn only on transaction-mode pooling — the cascade trigger. A
+        // session-mode pooler URL (:5432) or a direct connection is the goal,
+        // so neither should warn.
+        if (/:6543\b/.test(connectionString)) {
+            this.warn('Worker is connecting through the Supavisor TRANSACTION-mode pooler (:6543). graphile-worker LISTEN/NOTIFY is unstable there — set WORKER_DATABASE_URL to a session-mode (:5432) or direct URL.');
+        }
+        // Resolve the worker's userId — required so registered task names match
+        // the per-user suffix the API uses when enqueueing. Without this, the
+        // worker would register `process_eval__undefined` and claim nothing.
+        let userId;
+        try {
+            const profile = await apiGet('/api/profile');
+            userId = profile.id;
+        }
+        catch (err) {
+            this.error(`Failed to resolve worker user (GET /api/profile): ${err instanceof Error ? err.message : String(err)}`);
         }
-        this.log(`Starting eval worker (${createWorkerId()})...`);
+        this.log('Starting eval worker (graphile-worker)...');
         this.log('Press Ctrl+C to stop.\n');
         const cleanup = await startWorker({
-            supabaseUrl: flags['supabase-url'],
-            supabaseAnonKey: flags['supabase-anon-key'],
-            accessToken,
+            connectionString,
             userId,
             log: (msg) => this.log(msg),
         });
-        // Keep alive until SIGINT
-        await new Promise((resolve) => {
-            process.on('SIGINT', () => {
-                this.log('\nShutting down worker...');
-                cleanup();
-                resolve();
-            });
-            process.on('SIGTERM', () => {
-                cleanup();
-                resolve();
-            });
+        // Keep alive until SIGINT/SIGTERM. cleanup() awaits runner.stop() which
+        // drains in-flight jobs — but insights/cron jobs spawn `claude`
+        // subprocesses that don't respond to abort signals, so the graceful path
+        // can hang for minutes or hours. We race cleanup against a 10s timeout
+        // and then process.exit() unconditionally; any in-flight child processes
+        // get orphaned to launchd/init which is fine — they finish on their own.
+        // Diagnosed 2026-05-21 after observing 23h-old worker processes that
+        // survived multiple `launchctl unload` cycles because runner.stop()
+        // never resolved.
+        const SHUTDOWN_GRACE_MS = 10_000;
+        const shutdown = async (signal) => {
+            this.log(`\n[${signal}] shutting down worker (max ${SHUTDOWN_GRACE_MS}ms graceful)...`);
+            await Promise.race([
+                cleanup().catch((err) => {
+                    this.log(`cleanup error (continuing): ${err instanceof Error ? err.message : String(err)}`);
+                }),
+                new Promise((r) => setTimeout(r, SHUTDOWN_GRACE_MS)),
+            ]);
+            // Flush Sentry + OTel with tight ceilings so a wedged transport doesn't
+            // re-extend the shutdown beyond launchd's expectations. The BatchSpanProcessor
+            // can hold up to ~30s of in-flight spans by default; shutdownTelemetry()
+            // forces a final flush before resolving.
+            await Promise.allSettled([
+                flushSentry(2_000),
+                shutdownTelemetry(),
+            ]);
+            process.exit(0);
+        };
+        await new Promise(() => {
+            process.on('SIGINT', () => { void shutdown('SIGINT'); });
+            process.on('SIGTERM', () => { void shutdown('SIGTERM'); });
         });
     }
 }

package/dist/commands/evals/listen.js.map

@@ -1 +1 @@
-{"version":3,"file":"listen.js","sourceRoot":"","sources":["../../../src/commands/evals/listen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IACxD,MAAM,CAAU,WAAW,GAAG,+DAA+D,CAAC;IAE9F,MAAM,CAAU,QAAQ,GAAG;QACzB,gCAAgC;KACjC,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC;YAC3B,WAAW,EAAE,sBAAsB;YACnC,GAAG,EAAE,cAAc;YACnB,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC;YAChC,WAAW,EAAE,mBAAmB;YAChC,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,IAAI;SACf,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAE1B,MAAM,WAAW,GAAG,KAAK,EAAE,WAAW,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,yBAAyB,cAAc,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC;YAClC,eAAe,EAAE,KAAK,CAAC,mBAAmB,CAAC;YAC3C,WAAW;YACX,MAAM;YACN,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;SAC5B,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACxB,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACzB,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC"}
+{"version":3,"file":"listen.js","sourceRoot":"","sources":["../../../src/commands/evals/listen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,wEAAwE;IACxE,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IACxD,MAAM,CAAU,WAAW,GAAG,+DAA+D,CAAC;IAE9F,MAAM,CAAU,QAAQ,GAAG;QACzB,gCAAgC;KACjC,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,8CAA8C;QAC9C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC;YAC3B,WAAW,EAAE,6DAA6D;YAC1E,GAAG,EAAE,cAAc;YACnB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,IAAI;SACb,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC;YAChC,WAAW,EAAE,0DAA0D;YACvE,GAAG,EAAE,mBAAmB;YACxB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,IAAI;SACb,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;QAExD,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,aAAa,GAAG,UAAU,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvE,IAAI,aAAa;YAAE,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAE9D,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,mEAAmE;QACnE,yEAAyE;QACzE,uEAAuE;QACvE,eAAe;QACf,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACrE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,8BAA8B,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,6FAA6F,CAAC,CAAC;QAC1G,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACxD,CAAC;QAED,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,kDAAkD;QAClD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACxE,CAAC;QAED,iEAAiE;QACjE,2EAA2E;QAC3E,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,oDAAoD;QACpD,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,oEAAoE;QACpE,kEAAkE;QAClE,sEAAsE;QACtE,MAAM,gBAAgB,GACpB,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CACR,8GAA8G,CAC/G,CAAC;QACJ,CAAC;QACD,iEAAiE;QACjE,sEAAsE;QACtE,0BAA0B;QAC1B,IAAI,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CACP,gMAAgM,CACjM,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAiB,cAAc,CAAC,CAAC;YAC7D,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CACR,qDAAqD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,gBAAgB;YAChB,MAAM;YACN,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;SAC5B,CAAC,CAAC;QAEH,wEAAwE;QACxE,gEAAgE;QAChE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,oEAAoE;QACpE,kBAAkB;QAClB,MAAM,iBAAiB,GAAG,MAAM,CAAC;QACjC,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;YACxC,IAAI,CAAC,GAAG,CAAC,MAAM,MAAM,+BAA+B,iBAAiB,iBAAiB,CAAC,CAAC;YACxF,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACtB,IAAI,CAAC,GAAG,CAAC,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9F,CAAC,CAAC;gBACF,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;aAC3D,CAAC,CAAC;YACH,wEAAwE;YACxE,+EAA+E;YAC/E,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvB,WAAW,CAAC,KAAK,CAAC;gBAClB,iBAAiB,EAAE;aACpB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE;YAC3B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC"}

package/dist/commands/evals/listen.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=listen.test.d.ts.map

package/dist/commands/evals/listen.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen.test.d.ts","sourceRoot":"","sources":["../../../src/commands/evals/listen.test.ts"],"names":[],"mappings":""}

package/dist/commands/evals/listen.test.js

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { deriveSessionPoolerUrl } from './listen.js';
+describe('deriveSessionPoolerUrl', () => {
+    it('rewrites a transaction-mode pooler URL (:6543) to session mode (:5432)', () => {
+        const txn = 'postgresql://postgres.pkilumvmitlghljtqeud:secret@aws-1-us-east-1.pooler.supabase.com:6543/postgres';
+        expect(deriveSessionPoolerUrl(txn)).toBe('postgresql://postgres.pkilumvmitlghljtqeud:secret@aws-1-us-east-1.pooler.supabase.com:5432/postgres');
+    });
+    it('changes only the port — host, username, password and database are preserved', () => {
+        const txn = 'postgresql://postgres.abc123:pw@aws-0-eu-central-1.pooler.supabase.com:6543/postgres';
+        const out = deriveSessionPoolerUrl(txn);
+        expect(out).toBeDefined();
+        const u = new URL(out);
+        expect(u.port).toBe('5432');
+        expect(u.hostname).toBe('aws-0-eu-central-1.pooler.supabase.com');
+        expect(u.username).toBe('postgres.abc123');
+        expect(u.password).toBe('pw');
+        expect(u.pathname).toBe('/postgres');
+    });
+    it('leaves an already session-mode pooler URL (:5432) untouched', () => {
+        const session = 'postgresql://postgres.abc123:pw@aws-0-us-east-1.pooler.supabase.com:5432/postgres';
+        expect(deriveSessionPoolerUrl(session)).toBe(session);
+    });
+    it('leaves a true direct connection (db.<ref>.supabase.co) untouched', () => {
+        // The direct host is IPv6-only on Supabase, so we never auto-target it —
+        // a worker on an IPv4-only network could not resolve it. If a caller
+        // explicitly supplies a direct URL we pass it through unchanged.
+        const direct = 'postgresql://postgres:pw@db.abc123.supabase.co:5432/postgres';
+        expect(deriveSessionPoolerUrl(direct)).toBe(direct);
+    });
+    it('leaves non-Supabase URLs untouched (self-hosted / local pg)', () => {
+        const local = 'postgresql://user:pw@localhost:6543/mydb';
+        expect(deriveSessionPoolerUrl(local)).toBe(local);
+    });
+    it('rewrites regardless of the role name in the username', () => {
+        // The port is the only thing that distinguishes transaction mode from
+        // session mode — the pooler uses the same credentials for both, so a
+        // non-standard role is still safe to carry across.
+        const odd = 'postgresql://service_role.abc123:pw@aws-0-us-east-1.pooler.supabase.com:6543/postgres';
+        expect(deriveSessionPoolerUrl(odd)).toBe('postgresql://service_role.abc123:pw@aws-0-us-east-1.pooler.supabase.com:5432/postgres');
+    });
+    it('returns undefined for undefined input', () => {
+        expect(deriveSessionPoolerUrl(undefined)).toBeUndefined();
+    });
+    it('returns input unchanged for malformed URLs', () => {
+        expect(deriveSessionPoolerUrl('not-a-url')).toBe('not-a-url');
+    });
+});
+//# sourceMappingURL=listen.test.js.map

package/dist/commands/evals/listen.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen.test.js","sourceRoot":"","sources":["../../../src/commands/evals/listen.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,GAAG,GACP,qGAAqG,CAAC;QACxG,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACtC,qGAAqG,CACtG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,GAAG,GACP,sFAAsF,CAAC;QACzF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAa,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,OAAO,GACX,mFAAmF,CAAC;QACtF,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,MAAM,GAAG,8DAA8D,CAAC;QAC9E,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,KAAK,GAAG,0CAA0C,CAAC;QACzD,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,sEAAsE;QACtE,qEAAqE;QACrE,mDAAmD;QACnD,MAAM,GAAG,GACP,uFAAuF,CAAC;QAC1F,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACtC,uFAAuF,CACxF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/gateway/ensure.js

@@ -9,7 +9,7 @@ export default class GatewayEnsure extends BaseCommand {
             return; // Already running, silent success
         }
         try {
-            spawnGateway();
+            spawnGateway(this.config.version);
         }
         catch (err) {
             // Don't crash the hook — just warn