@tuned-tensor/cli 0.4.18 → 0.4.20

package/dist/index.js

@@ -122,6 +122,9 @@ function post(path, body, opts) {
 function put(path, body, opts) {
   return request("PUT", path, { body, opts });
 }
+function patch(path, body, opts) {
+  return request("PATCH", path, { body, opts });
+}
 function del(path, opts) {
   return request("DELETE", path, { opts });
 }
@@ -297,10 +300,10 @@ var ResolveError = class extends Error {
 function isFullUuid(value) {
   return UUID_RE.test(value);
 }
-async function resolvePrefix(prefix, kind, listPath, describe, opts) {
+async function resolvePrefix(prefix, kind, listPath, describe, opts, listCmdOverride) {
   if (isFullUuid(prefix)) return prefix;
   const noun = kind;
-  const listCmd = `tt ${kind}s list --json`;
+  const listCmd = listCmdOverride ?? `tt ${kind}s list --json`;
   if (prefix.length < MIN_PREFIX_LEN) {
     throw new ResolveError(
       `${capitalize(noun)} ID prefix "${prefix}" is too short \u2014 provide at least ${MIN_PREFIX_LEN} characters or the full UUID.`
@@ -368,6 +371,16 @@ function resolveModelId(prefix, opts) {
     opts
   );
 }
+function resolveLabelingJobId(prefix, opts) {
+  return resolvePrefix(
+    prefix,
+    "labeling job",
+    "/labeling-jobs",
+    (j) => `${j.id}${j.name ? `  (${j.name})` : ""}`,
+    opts,
+    "tt label list --json"
+  );
+}
 
 // src/base-models.ts
 var SUPPORTED_BASE_MODELS = [
@@ -617,6 +630,29 @@ function formatMinutes(minutes) {
   if (minutes < 60) return `${Math.max(1, Math.round(minutes))}m`;
   return `${(minutes / 60).toFixed(1)}h`;
 }
+function formatCents(cents) {
+  const dollars = cents / 100;
+  if (Math.abs(dollars) >= 100) return `$${dollars.toFixed(0)}`;
+  return `$${dollars.toFixed(2)}`;
+}
+function formatEstimateRange(estimate) {
+  const duration = estimate.duration;
+  return `${formatMinutes(duration.estimated_minutes)} (${formatMinutes(duration.range_minutes.low)}-${formatMinutes(duration.range_minutes.high)})`;
+}
+function printRunEstimate(estimate) {
+  printDetail([
+    ["Estimated Time", formatEstimateRange(estimate)],
+    ["Confidence", estimate.duration.confidence],
+    ["History Samples", String(estimate.duration.sample_count)],
+    ["Basis", estimate.duration.basis.replaceAll("_", " ")],
+    ["Estimated Cost", formatCents(estimate.estimated_cost_cents)],
+    ["Training Tokens", `${(estimate.estimated_training_tokens / 1e3).toFixed(1)}k`],
+    ["Epochs", String(estimate.estimated_epochs)]
+  ]);
+  console.log(
+    "\nDuration is a rough historical range. Final cost uses provider-reported training tokens."
+  );
+}
 function formatEpochProgress(diagnostics) {
   const curve = diagnostics.training.curve;
   if (curve.latest_epoch == null) return void 0;
@@ -722,6 +758,46 @@ function printEvalOutputDiagnostics(diagnostics) {
     }
   }
 }
+function addRunConfigurationOptions(command) {
+  return command.option("--no-augment", "Disable data augmentation").option("--no-llm-judge", "Disable LLM judging").option("--epochs <n>", "Number of training epochs").option("--lr <rate>", "Learning rate").option("--batch-size <n>", "Batch size").option("--dataset <id>", "Dataset ID to use instead of inline spec examples (full UUID or 4+ char prefix)").option("--parent-model <id>", "Fine-tuned model ID to continue training from (full UUID or 4+ char prefix)").option("--train-ratio <ratio>", "Dataset training split ratio (default: 0.8 when any split ratio is set)").option("--validation-ratio <ratio>", "Dataset validation split ratio (default: 0.1 when any split ratio is set)").option("--test-ratio <ratio>", "Dataset test split ratio (default: 0.1 when any split ratio is set)").option("--lora-rank <n>", "LoRA rank").option("--lora-alpha <n>", "LoRA alpha").option("--max-eval-examples <n>", "Max examples for the primary eval pass").option("--max-test-eval-examples <n>", "Max examples for the secondary test eval pass").option("--long-examples <policy>", "Long training row policy: error, truncate, or skip").option("--max-seq-length <tokens>", "Maximum training sequence length in tokens").option("--max-output-tokens <tokens>", "Desired evaluation output budget in tokens").option("--eval-reserved-output-tokens <tokens>", "Minimum evaluation output tokens reserved per row");
+}
+async function buildRunRequestBody(cmdOpts, opts) {
+  const body = {};
+  if (cmdOpts.augment === false) body.augment = false;
+  if (cmdOpts.dataset) body.dataset_id = await resolveDatasetId(String(cmdOpts.dataset), opts);
+  if (cmdOpts.parentModel) {
+    body.parent_model_id = await resolveModelId(String(cmdOpts.parentModel), opts);
+  }
+  const splitRatioOptions = [
+    cmdOpts.trainRatio,
+    cmdOpts.validationRatio,
+    cmdOpts.testRatio
+  ];
+  if (splitRatioOptions.some((value) => value != null)) {
+    body.split_ratios = {
+      train: cmdOpts.trainRatio != null ? Number(cmdOpts.trainRatio) : 0.8,
+      validation: cmdOpts.validationRatio != null ? Number(cmdOpts.validationRatio) : 0.1,
+      test: cmdOpts.testRatio != null ? Number(cmdOpts.testRatio) : 0.1
+    };
+  }
+  const hp = {};
+  if (cmdOpts.epochs) hp.n_epochs = Number(cmdOpts.epochs);
+  if (cmdOpts.lr) hp.learning_rate = Number(cmdOpts.lr);
+  if (cmdOpts.batchSize) hp.batch_size = Number(cmdOpts.batchSize);
+  if (cmdOpts.loraRank) hp.lora_rank = Number(cmdOpts.loraRank);
+  if (cmdOpts.loraAlpha) hp.lora_alpha = Number(cmdOpts.loraAlpha);
+  if (cmdOpts.maxEvalExamples) hp.max_eval_examples = Number(cmdOpts.maxEvalExamples);
+  if (cmdOpts.maxTestEvalExamples) hp.max_test_eval_examples = Number(cmdOpts.maxTestEvalExamples);
+  if (cmdOpts.longExamples) hp.long_examples = parseLongExamplesPolicy(String(cmdOpts.longExamples));
+  if (cmdOpts.maxSeqLength) hp.max_seq_length = Number(cmdOpts.maxSeqLength);
+  if (cmdOpts.maxOutputTokens) hp.max_output_tokens = Number(cmdOpts.maxOutputTokens);
+  if (cmdOpts.evalReservedOutputTokens) {
+    hp.eval_reserved_output_tokens = Number(cmdOpts.evalReservedOutputTokens);
+  }
+  if (cmdOpts.llmJudge === false) body.use_llm_judge = false;
+  if (Object.keys(hp).length) body.hyperparameters = hp;
+  return body;
+}
 function registerRunsCommands(parent) {
   const runs = parent.command("runs").description("Manage runs");
   runs.command("list").description("List runs").option("-s, --spec <id>", "Filter by spec ID (full UUID or 8+ char prefix)").option("-p, --page <n>", "Page number", "1").option("--per-page <n>", "Results per page", "20").action(async (cmdOpts) => {
@@ -801,42 +877,25 @@ Eval Results (${data._evals.length}):`);
       );
     }
   });
-  runs.command("start").description("Start a new run for a behaviour spec").argument("<spec-id>", "Behaviour spec ID (full UUID or 8+ char prefix)").option("--no-augment", "Disable data augmentation").option("--no-llm-judge", "Disable LLM judging").option("--epochs <n>", "Number of training epochs").option("--lr <rate>", "Learning rate").option("--batch-size <n>", "Batch size").option("--dataset <id>", "Dataset ID to use instead of inline spec examples (full UUID or 4+ char prefix)").option("--parent-model <id>", "Fine-tuned model ID to continue training from (full UUID or 4+ char prefix)").option("--train-ratio <ratio>", "Dataset training split ratio (default: 0.8 when any split ratio is set)").option("--validation-ratio <ratio>", "Dataset validation split ratio (default: 0.1 when any split ratio is set)").option("--test-ratio <ratio>", "Dataset test split ratio (default: 0.1 when any split ratio is set)").option("--lora-rank <n>", "LoRA rank").option("--lora-alpha <n>", "LoRA alpha").option("--max-eval-examples <n>", "Max examples for the primary eval pass").option("--max-test-eval-examples <n>", "Max examples for the secondary test eval pass").option("--long-examples <policy>", "Long training row policy: error, truncate, or skip").option("--max-seq-length <tokens>", "Maximum training sequence length in tokens").option("--max-output-tokens <tokens>", "Desired evaluation output budget in tokens").option("--eval-reserved-output-tokens <tokens>", "Minimum evaluation output tokens reserved per row").action(async (specId, cmdOpts) => {
+  addRunConfigurationOptions(
+    runs.command("estimate").description("Estimate run cost and duration before starting").argument("<spec-id>", "Behaviour spec ID (full UUID or 8+ char prefix)")
+  ).action(async (specId, cmdOpts) => {
     const opts = parent.opts();
-    const body = {};
-    if (cmdOpts.augment === false) body.augment = false;
-    if (cmdOpts.dataset) body.dataset_id = await resolveDatasetId(cmdOpts.dataset, opts);
-    if (cmdOpts.parentModel) {
-      body.parent_model_id = await resolveModelId(cmdOpts.parentModel, opts);
-    }
-    const splitRatioOptions = [
-      cmdOpts.trainRatio,
-      cmdOpts.validationRatio,
-      cmdOpts.testRatio
-    ];
-    if (splitRatioOptions.some((value) => value != null)) {
-      body.split_ratios = {
-        train: cmdOpts.trainRatio != null ? Number(cmdOpts.trainRatio) : 0.8,
-        validation: cmdOpts.validationRatio != null ? Number(cmdOpts.validationRatio) : 0.1,
-        test: cmdOpts.testRatio != null ? Number(cmdOpts.testRatio) : 0.1
-      };
-    }
-    const hp = {};
-    if (cmdOpts.epochs) hp.n_epochs = Number(cmdOpts.epochs);
-    if (cmdOpts.lr) hp.learning_rate = Number(cmdOpts.lr);
-    if (cmdOpts.batchSize) hp.batch_size = Number(cmdOpts.batchSize);
-    if (cmdOpts.loraRank) hp.lora_rank = Number(cmdOpts.loraRank);
-    if (cmdOpts.loraAlpha) hp.lora_alpha = Number(cmdOpts.loraAlpha);
-    if (cmdOpts.maxEvalExamples) hp.max_eval_examples = Number(cmdOpts.maxEvalExamples);
-    if (cmdOpts.maxTestEvalExamples) hp.max_test_eval_examples = Number(cmdOpts.maxTestEvalExamples);
-    if (cmdOpts.longExamples) hp.long_examples = parseLongExamplesPolicy(cmdOpts.longExamples);
-    if (cmdOpts.maxSeqLength) hp.max_seq_length = Number(cmdOpts.maxSeqLength);
-    if (cmdOpts.maxOutputTokens) hp.max_output_tokens = Number(cmdOpts.maxOutputTokens);
-    if (cmdOpts.evalReservedOutputTokens) {
-      hp.eval_reserved_output_tokens = Number(cmdOpts.evalReservedOutputTokens);
-    }
-    if (cmdOpts.llmJudge === false) body.use_llm_judge = false;
-    if (Object.keys(hp).length) body.hyperparameters = hp;
+    const body = await buildRunRequestBody(cmdOpts, opts);
+    const fullSpecId = await resolveSpecId(specId, opts);
+    const { data } = await post(
+      `/behavior-specs/${fullSpecId}/runs/estimate`,
+      body,
+      opts
+    );
+    if (isJsonMode()) return printJson(data);
+    printRunEstimate(data);
+  });
+  addRunConfigurationOptions(
+    runs.command("start").description("Start a new run for a behaviour spec").argument("<spec-id>", "Behaviour spec ID (full UUID or 8+ char prefix)")
+  ).action(async (specId, cmdOpts) => {
+    const opts = parent.opts();
+    const body = await buildRunRequestBody(cmdOpts, opts);
     const fullSpecId = await resolveSpecId(specId, opts);
     const { data } = await post(
       `/behavior-specs/${fullSpecId}/runs`,
@@ -1107,27 +1166,425 @@ function registerDatasetsCommands(parent) {
   });
 }
 
+// src/commands/label.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
+function formatCents2(cents) {
+  return `$${(cents / 100).toFixed(2)}`;
+}
+function sleep(ms) {
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
+}
+function parseCsvHeader(line) {
+  const fields = [];
+  let current = "";
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (line[i + 1] === '"') {
+          current += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        current += ch;
+      }
+    } else if (ch === '"') {
+      inQuotes = true;
+    } else if (ch === ",") {
+      fields.push(current);
+      current = "";
+    } else {
+      current += ch;
+    }
+  }
+  fields.push(current);
+  return fields.map((f) => f.trim());
+}
+function validateUnlabeledFile(file, inputColumn) {
+  const lower = file.toLowerCase();
+  if (lower.endsWith(".csv")) {
+    if (!inputColumn) {
+      throw new Error(
+        "CSV uploads need --input-column <name> to say which column holds the input text."
+      );
+    }
+    const firstLine = readFileSync5(file, "utf8").split(/\r?\n/, 1)[0] ?? "";
+    const columns = parseCsvHeader(firstLine);
+    if (!columns.includes(inputColumn)) {
+      throw new Error(
+        `Column "${inputColumn}" not found in CSV header. Available columns: ${columns.join(", ")}`
+      );
+    }
+    return { format: "csv" };
+  }
+  if (!lower.endsWith(".jsonl") && !lower.endsWith(".json")) {
+    throw new Error("Labeling source file must be .jsonl or .csv");
+  }
+  const lines = readFileSync5(file, "utf8").split(/\r?\n/);
+  const errors = [];
+  let rowCount = 0;
+  for (const [index, rawLine] of lines.entries()) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    rowCount += 1;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      errors.push(`Row ${index + 1}: invalid JSON`);
+      continue;
+    }
+    if (!row || typeof row !== "object" || Array.isArray(row) || typeof row.input !== "string") {
+      errors.push(`Row ${index + 1}: expected an object with a string "input" field`);
+    }
+  }
+  if (rowCount === 0) {
+    errors.push("File contains no JSONL rows");
+  }
+  if (errors.length > 0) {
+    const preview = errors.slice(0, 5).join("\n");
+    const suffix = errors.length > 5 ? `
+...and ${errors.length - 5} more error(s)` : "";
+    throw new Error(
+      `Invalid labeling source. Each JSONL row must be {"input": "..."}.
+${preview}${suffix}`
+    );
+  }
+  return { format: "jsonl" };
+}
+function printJobDetail(job, counts) {
+  printDetail([
+    ["ID", job.id],
+    ["Name", job.name],
+    ["Status", formatStatus(job.status)],
+    ["Spec", shortId(job.behavior_spec_id)],
+    ["Teacher", job.teacher_model],
+    ["Rows", String(job.row_count)],
+    ["Labeled", String(job.labeled_count)],
+    ["Failed", String(job.failed_count)],
+    [
+      "Cost",
+      job.actual_cost_cents !== null ? formatCents2(job.actual_cost_cents) : `~${formatCents2(job.est_cost_cents)} (estimated)`
+    ],
+    ["Dataset", job.promoted_dataset_id ? shortId(job.promoted_dataset_id) : void 0],
+    ["Error", job.error ?? void 0],
+    ["Created", formatDate(job.created_at)]
+  ]);
+  if (counts) {
+    console.log(
+      `
+Review: ${counts.labeled} awaiting \xB7 ${counts.accepted} accepted \xB7 ${counts.edited} edited \xB7 ${counts.rejected} rejected \xB7 ${counts.failed} failed`
+    );
+  }
+}
+async function watchJob(jobId, opts) {
+  for (; ; ) {
+    const { data } = await get(
+      `/labeling-jobs/${jobId}`,
+      void 0,
+      opts
+    );
+    if (!isJsonMode()) {
+      if (data.status === "preparing") {
+        process.stdout.write("\rPreparing - parsing the source file...   ");
+      } else {
+        const done = data.counts.total - data.counts.pending;
+        process.stdout.write(`\rLabeling ${done}/${data.counts.total} rows   `);
+      }
+    }
+    if (data.status !== "preparing" && data.status !== "labeling") {
+      if (!isJsonMode()) process.stdout.write("\n");
+      return data;
+    }
+    await sleep(5e3);
+  }
+}
+async function resolveRowIds(jobId, indexes, opts) {
+  const PER_PAGE = 100;
+  const byPage = /* @__PURE__ */ new Map();
+  for (const index of indexes) {
+    const page = Math.floor(index / PER_PAGE) + 1;
+    byPage.set(page, [...byPage.get(page) ?? [], index]);
+  }
+  const found = /* @__PURE__ */ new Map();
+  for (const [page, wanted] of byPage) {
+    const { data } = await get(
+      `/labeling-jobs/${jobId}/rows`,
+      { page, per_page: PER_PAGE },
+      opts
+    );
+    for (const row of data) {
+      if (wanted.includes(row.row_index)) {
+        found.set(row.row_index, row.id);
+      }
+    }
+  }
+  const missing = indexes.filter((i) => !found.has(i));
+  if (missing.length > 0) {
+    throw new Error(`Row index(es) not found: ${missing.join(", ")}`);
+  }
+  return found;
+}
+function parseIndexList(value) {
+  const indexes = value.split(",").map((part) => Number.parseInt(part.trim(), 10));
+  if (indexes.some((n) => Number.isNaN(n) || n < 0)) {
+    throw new Error(`Invalid row index list: "${value}" (expected e.g. "0,3,12")`);
+  }
+  return indexes;
+}
+function registerLabelCommands(parent) {
+  const label = parent.command("label").description("Teacher-label real data into training datasets");
+  label.command("upload").description("Upload unlabeled inputs (.jsonl or .csv) and start a labeling job").argument("<file>", 'Path to JSONL ({"input": ...} per line) or CSV file').requiredOption("-s, --spec <id>", "Behaviour spec the teacher labels under").option("-c, --input-column <name>", "CSV column that holds the input text").option("-n, --name <name>", "Job name (defaults to filename)").option("--watch", "Block and show progress until labeling finishes").action(async (file, cmdOpts) => {
+    const opts = parent.opts();
+    if (!existsSync3(file)) {
+      printError(`File not found: ${file}`);
+      process.exit(1);
+    }
+    const { format } = validateUnlabeledFile(file, cmdOpts.inputColumn);
+    const specId = await resolveSpecId(cmdOpts.spec, opts);
+    const name = cmdOpts.name || file.split("/").pop().replace(/\.(jsonl|json|csv)$/, "");
+    const fileBytes = readFileSync5(file);
+    const contentType = format === "csv" ? "text/csv" : "application/jsonl";
+    const { data: uploadUrl } = await post(
+      "/labeling-jobs/upload-url",
+      {
+        filename: file.split("/").pop(),
+        size: statSync3(file).size,
+        contentType
+      },
+      opts
+    );
+    const uploadRes = await fetch(uploadUrl.upload_url, {
+      method: uploadUrl.method,
+      headers: uploadUrl.headers ?? { "Content-Type": contentType },
+      body: new Blob([fileBytes], { type: contentType })
+    });
+    if (!uploadRes.ok) {
+      throw new Error(`Upload failed: ${uploadRes.status} ${uploadRes.statusText}`);
+    }
+    const { data: job } = await post(
+      "/labeling-jobs",
+      {
+        path: uploadUrl.path,
+        name,
+        behavior_spec_id: specId,
+        source_format: format,
+        input_column: cmdOpts.inputColumn ?? null
+      },
+      opts
+    );
+    if (!cmdOpts.watch) {
+      if (isJsonMode()) return printJson(job);
+      printSuccess(
+        `Labeling started: ${job.name} (${shortId(job.id)}) \u2014 est. ${formatCents2(job.est_cost_cents)}. Runs in the cloud; no need to stay connected.`
+      );
+      console.log(`Follow progress with \`tt label watch ${shortId(job.id)}\`.`);
+      return;
+    }
+    const finished = await watchJob(job.id, opts);
+    if (isJsonMode()) return printJson(finished);
+    printSuccess(
+      `Labeling ${finished.status === "awaiting_review" ? "complete" : finished.status}: ${finished.labeled_count}/${finished.row_count} rows labeled.`
+    );
+    console.log(
+      `Review with \`tt label rows ${shortId(job.id)} --status labeled\`, then \`tt label promote ${shortId(job.id)} --name <dataset-name>\`.`
+    );
+  });
+  label.command("watch").description("Watch a labeling job until it is ready for review").argument("<id>", "Labeling job ID (full UUID or 4+ char prefix)").action(async (id) => {
+    const opts = parent.opts();
+    const jobId = await resolveLabelingJobId(id, opts);
+    const job = await watchJob(jobId, opts);
+    if (isJsonMode()) return printJson(job);
+    if (job.status === "awaiting_review") {
+      printSuccess(
+        `Labeling complete: ${job.labeled_count}/${job.row_count} rows labeled, cost ${job.actual_cost_cents !== null ? formatCents2(job.actual_cost_cents) : "n/a"}.`
+      );
+    } else {
+      printError(`Labeling ended with status: ${job.status}${job.error ? ` \u2014 ${job.error}` : ""}`);
+      process.exitCode = 1;
+    }
+  });
+  label.command("list").description("List labeling jobs").option("-p, --page <n>", "Page number", "1").option("--per-page <n>", "Results per page", "20").action(async (cmdOpts) => {
+    const opts = parent.opts();
+    const { data, meta } = await get(
+      "/labeling-jobs",
+      { page: cmdOpts.page, per_page: cmdOpts.perPage },
+      opts
+    );
+    if (isJsonMode()) return printJson({ data, meta });
+    printTable(
+      ["ID", "Name", "Status", "Progress", "Cost", "Created"],
+      data.map((j) => [
+        shortId(j.id),
+        truncate(j.name, 30),
+        formatStatus(j.status),
+        `${j.labeled_count}/${j.row_count}`,
+        j.actual_cost_cents !== null ? formatCents2(j.actual_cost_cents) : `~${formatCents2(j.est_cost_cents)}`,
+        formatDate(j.created_at)
+      ]),
+      meta
+    );
+  });
+  label.command("status").description("Show labeling job details and review progress").argument("<id>", "Labeling job ID (full UUID or 4+ char prefix)").action(async (id) => {
+    const opts = parent.opts();
+    const jobId = await resolveLabelingJobId(id, opts);
+    const { data } = await get(
+      `/labeling-jobs/${jobId}`,
+      void 0,
+      opts
+    );
+    if (isJsonMode()) return printJson(data);
+    printJobDetail(data, data.counts);
+  });
+  label.command("rows").description("List rows in a labeling job").argument("<id>", "Labeling job ID (full UUID or 4+ char prefix)").option(
+    "--status <status>",
+    "Filter by row status (pending|labeled|accepted|edited|rejected|failed)"
+  ).option("-p, --page <n>", "Page number", "1").option("--per-page <n>", "Results per page", "50").action(async (id, cmdOpts) => {
+    const opts = parent.opts();
+    const jobId = await resolveLabelingJobId(id, opts);
+    const query = {
+      page: cmdOpts.page,
+      per_page: cmdOpts.perPage
+    };
+    if (cmdOpts.status) query.status = cmdOpts.status;
+    const { data, meta } = await get(
+      `/labeling-jobs/${jobId}/rows`,
+      query,
+      opts
+    );
+    if (isJsonMode()) return printJson({ data, meta });
+    printTable(
+      ["Row", "Status", "Input", "Output"],
+      data.map((row) => [
+        String(row.row_index),
+        formatStatus(row.status),
+        truncate(row.input.replace(/\s+/g, " "), 40),
+        truncate(
+          (row.final_output ?? row.teacher_output ?? "\u2014").replace(/\s+/g, " "),
+          40
+        )
+      ]),
+      meta
+    );
+  });
+  label.command("accept").description("Accept teacher-labeled rows").argument("<id>", "Labeling job ID (full UUID or 4+ char prefix)").option("--all", "Accept all unreviewed labeled rows").option("--rows <indexes>", "Comma-separated row indexes (e.g. 0,3,12)").action(async (id, cmdOpts) => {
+    const opts = parent.opts();
+    if (!cmdOpts.all && !cmdOpts.rows) {
+      printError("Provide --all or --rows <indexes>.");
+      process.exit(1);
+    }
+    const jobId = await resolveLabelingJobId(id, opts);
+    if (cmdOpts.all) {
+      const { data } = await post(
+        `/labeling-jobs/${jobId}/rows/bulk`,
+        { action: "accept", all_labeled: true },
+        opts
+      );
+      if (isJsonMode()) return printJson(data);
+      return printSuccess(`Accepted ${data.accepted} rows.`);
+    }
+    const indexes = parseIndexList(cmdOpts.rows);
+    const rowIds = await resolveRowIds(jobId, indexes, opts);
+    for (const index of indexes) {
+      await patch(
+        `/labeling-jobs/${jobId}/rows/${rowIds.get(index)}`,
+        { action: "accept" },
+        opts
+      );
+    }
+    if (isJsonMode()) return printJson({ accepted: indexes.length });
+    printSuccess(`Accepted ${indexes.length} row(s).`);
+  });
+  label.command("reject").description("Reject rows so they are excluded from promotion").argument("<id>", "Labeling job ID (full UUID or 4+ char prefix)").requiredOption("--rows <indexes>", "Comma-separated row indexes (e.g. 0,3,12)").action(async (id, cmdOpts) => {
+    const opts = parent.opts();
+    const jobId = await resolveLabelingJobId(id, opts);
+    const indexes = parseIndexList(cmdOpts.rows);
+    const rowIds = await resolveRowIds(jobId, indexes, opts);
+    for (const index of indexes) {
+      await patch(
+        `/labeling-jobs/${jobId}/rows/${rowIds.get(index)}`,
+        { action: "reject" },
+        opts
+      );
+    }
+    if (isJsonMode()) return printJson({ rejected: indexes.length });
+    printSuccess(`Rejected ${indexes.length} row(s).`);
+  });
+  label.command("edit").description("Replace a row's output with your own").argument("<id>", "Labeling job ID (full UUID or 4+ char prefix)").requiredOption("--row <index>", "Row index to edit").option("-o, --output <text>", "Replacement output text").option("-f, --file <path>", "Read replacement output from a file").action(async (id, cmdOpts) => {
+    const opts = parent.opts();
+    if (!cmdOpts.output && !cmdOpts.file) {
+      printError("Provide --output <text> or --file <path>.");
+      process.exit(1);
+    }
+    const output = cmdOpts.output ?? readFileSync5(cmdOpts.file, "utf8");
+    const jobId = await resolveLabelingJobId(id, opts);
+    const indexes = parseIndexList(cmdOpts.row);
+    const rowIds = await resolveRowIds(jobId, indexes, opts);
+    await patch(
+      `/labeling-jobs/${jobId}/rows/${rowIds.get(indexes[0])}`,
+      { action: "edit", output },
+      opts
+    );
+    if (isJsonMode()) return printJson({ edited: indexes[0] });
+    printSuccess(`Row ${indexes[0]} edited.`);
+  });
+  label.command("promote").description("Promote reviewed rows into a validated dataset").argument("<id>", "Labeling job ID (full UUID or 4+ char prefix)").requiredOption("-n, --name <name>", "Name for the new dataset").option("-d, --description <desc>", "Dataset description").option("--include-unreviewed", "Also include unreviewed labeled rows").action(async (id, cmdOpts) => {
+    const opts = parent.opts();
+    const jobId = await resolveLabelingJobId(id, opts);
+    const { data } = await post(
+      `/labeling-jobs/${jobId}/promote`,
+      {
+        name: cmdOpts.name,
+        description: cmdOpts.description ?? null,
+        include_unreviewed_labeled: Boolean(cmdOpts.includeUnreviewed)
+      },
+      opts
+    );
+    if (isJsonMode()) return printJson(data);
+    printSuccess(
+      `Dataset created: ${data.name} (${shortId(data.id)}) \u2014 ${data.row_count} rows.`
+    );
+    console.log(
+      `Start a run with \`tt runs start <spec-id> --dataset ${shortId(data.id)}\`.`
+    );
+  });
+  label.command("cancel").description("Cancel a labeling job and release unused credits").argument("<id>", "Labeling job ID (full UUID or 4+ char prefix)").action(async (id) => {
+    const opts = parent.opts();
+    const jobId = await resolveLabelingJobId(id, opts);
+    const { data } = await post(
+      `/labeling-jobs/${jobId}/cancel`,
+      {},
+      opts
+    );
+    if (isJsonMode()) return printJson(data);
+    printSuccess(`Labeling job cancelled: ${shortId(jobId)}`);
+  });
+}
+
 // src/commands/models.ts
 import { spawn as spawn2, execFileSync } from "child_process";
 import { createHash } from "crypto";
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   mkdirSync as mkdirSync3,
-  statSync as statSync3,
+  statSync as statSync4,
   createWriteStream,
   unlinkSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   writeFileSync as writeFileSync3,
   readdirSync,
   rmSync
 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2, resolve as resolve2, basename as basename2 } from "path";
+import { dirname as dirname2, join as join2, resolve as resolve2, basename as basename2, normalize, isAbsolute } from "path";
 import { Readable, Transform } from "stream";
 import { pipeline } from "stream/promises";
 
 // src/commands/init.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
 import { resolve } from "path";
 var DEFAULT_SPEC_FILE = "tunedtensor.json";
 var SCAFFOLD = {
@@ -1145,7 +1602,7 @@ var SCAFFOLD = {
 function registerInitCommand(parent) {
   parent.command("init").description("Create a local behaviour spec file").option("-n, --name <name>", "Spec name").option("--model <model>", "Base model ID").option("-f, --file <path>", "Output file path", DEFAULT_SPEC_FILE).action(async (cmdOpts) => {
     const filePath = resolve(cmdOpts.file);
-    if (existsSync3(filePath)) {
+    if (existsSync4(filePath)) {
       printWarning(`${cmdOpts.file} already exists. Use tt eval to validate it or edit it directly.`);
       return;
     }
@@ -1162,14 +1619,14 @@ function registerInitCommand(parent) {
 }
 function loadSpec(filePath) {
   const resolved = resolve(filePath || DEFAULT_SPEC_FILE);
-  if (!existsSync3(resolved)) {
+  if (!existsSync4(resolved)) {
     printError(
       `Spec file not found: ${filePath || DEFAULT_SPEC_FILE}
 Run \`tt init\` to create one.`
     );
     process.exit(1);
   }
-  const raw = JSON.parse(readFileSync5(resolved, "utf-8"));
+  const raw = JSON.parse(readFileSync6(resolved, "utf-8"));
   return raw;
 }
 
@@ -1184,7 +1641,7 @@ var COMPLETION_ROUTES = /* @__PURE__ */ new Set(["/v1/chat/completions", "/chat/
 function parsePositiveInteger(value, fallback) {
   return Number.isInteger(value) && value >= 0 ? value : fallback;
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 function readRequestBody(req) {
@@ -1506,7 +1963,7 @@ var ManagedModelServer = class {
       child.kill("SIGTERM");
       await Promise.race([
         new Promise((resolve4) => child.once("exit", () => resolve4())),
-        sleep(5e3).then(() => {
+        sleep2(5e3).then(() => {
           if (child.exitCode == null && child.signalCode == null) child.kill("SIGKILL");
         })
       ]);
@@ -1536,7 +1993,7 @@ var ManagedModelServer = class {
       const health = await this.checkHealth();
       if (health.ok) return;
       if (!this.child) break;
-      await sleep(50);
+      await sleep2(50);
     }
     throw new Error("Model server did not become healthy within 120 seconds");
   }
@@ -2045,7 +2502,7 @@ if __name__ == "__main__":
 `;
 function resolveOutputPath(output, filename) {
   if (!output) return filename;
-  if (existsSync4(output) && statSync3(output).isDirectory()) {
+  if (existsSync5(output) && statSync4(output).isDirectory()) {
     return join2(output, filename);
   }
   return output;
@@ -2166,7 +2623,7 @@ function runtimePythonPath(cacheDir) {
 function resolveServePython(cacheDir, explicitPython) {
   if (explicitPython) return explicitPython;
   const managedPython = runtimePythonPath(cacheDir);
-  return existsSync4(managedPython) ? managedPython : "python3";
+  return existsSync5(managedPython) ? managedPython : "python3";
 }
 function commandExists(command) {
   try {
@@ -2245,11 +2702,28 @@ function safeSegment(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "model";
 }
 function directoryHasFiles(path) {
-  return existsSync4(path) && statSync3(path).isDirectory() && readdirSync(path).length > 0;
+  return existsSync5(path) && statSync4(path).isDirectory() && readdirSync(path).length > 0;
+}
+function validateArchiveEntryPath(entry) {
+  const normalized = normalize(entry).replace(/^[\\/]+/, "");
+  if (!entry.trim() || isAbsolute(entry) || normalized === ".." || normalized.startsWith(`..${"/"}`) || normalized.startsWith(`..${"\\"}`)) {
+    throw new Error(`Unsafe archive entry path: ${entry}`);
+  }
+  return normalized;
+}
+function validateArchiveEntries(archivePath) {
+  const listing = execFileSync("tar", ["-tzf", archivePath], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  for (const entry of listing.split(/\r?\n/)) {
+    if (entry.trim()) validateArchiveEntryPath(entry);
+  }
 }
 function extractArchive(archivePath, targetDir, force) {
   if (directoryHasFiles(targetDir) && !force) return targetDir;
-  if (existsSync4(targetDir)) rmSync(targetDir, { recursive: true, force: true });
+  validateArchiveEntries(archivePath);
+  if (existsSync5(targetDir)) rmSync(targetDir, { recursive: true, force: true });
   mkdirSync3(targetDir, { recursive: true });
   execFileSync("tar", ["-xzf", archivePath, "-C", targetDir], { stdio: "inherit" });
   return targetDir;
@@ -2276,21 +2750,21 @@ function findSpecPath(explicitPath, modelPath) {
   const candidates = explicitPath ? [explicitPath] : [join2(process.cwd(), DEFAULT_SPEC_FILE), join2(modelPath, DEFAULT_SPEC_FILE)];
   for (const candidate of candidates) {
     const resolved = resolve2(candidate);
-    if (existsSync4(resolved) && statSync3(resolved).isFile()) return resolved;
+    if (existsSync5(resolved) && statSync4(resolved).isFile()) return resolved;
   }
   return null;
 }
 function loadSystemPromptFromSpec(specPath) {
-  const spec = JSON.parse(readFileSync6(specPath, "utf8"));
+  const spec = JSON.parse(readFileSync7(specPath, "utf8"));
   return buildSystemPrompt(spec);
 }
 function loadJsonSchemaForServe(schemaPath) {
   const resolved = resolve2(schemaPath);
-  if (!existsSync4(resolved) || !statSync3(resolved).isFile()) {
+  if (!existsSync5(resolved) || !statSync4(resolved).isFile()) {
     throw new Error(`JSON schema file not found: ${schemaPath}`);
   }
   try {
-    const schema = JSON.parse(readFileSync6(resolved, "utf8"));
+    const schema = JSON.parse(readFileSync7(resolved, "utf8"));
     return JSON.stringify(schema);
   } catch (err) {
     throw new Error(`JSON schema file is not valid JSON: ${schemaPath}`);
@@ -2304,9 +2778,9 @@ function writeReferenceServerScript(cacheDir) {
   return scriptPath;
 }
 async function resolveServeTarget(target, opts, cacheDir, forceDownload) {
-  if (existsSync4(target)) {
+  if (existsSync5(target)) {
     const resolved = resolve2(target);
-    const stats = statSync3(resolved);
+    const stats = statSync4(resolved);
     if (stats.isDirectory()) {
       return {
         modelPath: resolved,
@@ -2330,7 +2804,7 @@ async function resolveServeTarget(target, opts, cacheDir, forceDownload) {
   const modelCacheDir = join2(cacheDir, fullId);
   const archivePath = join2(modelCacheDir, data.filename);
   const extractDir = join2(modelCacheDir, "model");
-  if (!existsSync4(archivePath) || forceDownload) {
+  if (!existsSync5(archivePath) || forceDownload) {
     await downloadUrlToFile(data.url, archivePath);
   }
   extractArchive(archivePath, extractDir, forceDownload);
@@ -2434,7 +2908,7 @@ function ollamaSlug(name) {
 }
 function firstExisting(candidates) {
   for (const candidate of candidates) {
-    if (candidate && existsSync4(candidate) && statSync3(candidate).isFile()) {
+    if (candidate && existsSync5(candidate) && statSync4(candidate).isFile()) {
       return resolve2(candidate);
     }
   }
@@ -2446,7 +2920,7 @@ function llamaCppDir(explicit) {
 function resolveConvertScript(opts, required) {
   if (opts.convertScript) {
     const resolved = resolve2(opts.convertScript);
-    if (required && !existsSync4(resolved)) {
+    if (required && !existsSync5(resolved)) {
       throw new Error(`Conversion script not found: ${opts.convertScript}`);
     }
     return resolved;
@@ -2465,7 +2939,7 @@ function resolveConvertScript(opts, required) {
 function resolveQuantizeBin(opts, required) {
   if (opts.quantizeBin) {
     const resolved = resolve2(opts.quantizeBin);
-    if (required && !existsSync4(resolved)) {
+    if (required && !existsSync5(resolved)) {
       throw new Error(`llama-quantize binary not found: ${opts.quantizeBin}`);
     }
     return resolved;
@@ -2600,7 +3074,7 @@ function registerModelsCommands(parent) {
       opts
     );
     const outputPath = resolveOutputPath(cmdOpts.output, data.filename);
-    if (existsSync4(outputPath) && !cmdOpts.force) {
+    if (existsSync5(outputPath) && !cmdOpts.force) {
       throw new Error(`Output file already exists: ${outputPath}. Use --force to overwrite.`);
     }
     const bytes = await downloadUrlToFile(data.url, outputPath);
@@ -2709,7 +3183,7 @@ function registerModelsCommands(parent) {
       ollama: ollamaInfo
     };
     if (printOnly) return printExportPlan(plan);
-    if (existsSync4(finalPath) && !cmdOpts.force) {
+    if (existsSync5(finalPath) && !cmdOpts.force) {
       throw new Error(`Output already exists: ${finalPath}. Use --force to overwrite.`);
     }
     mkdirSync3(outputDir, { recursive: true });
@@ -2730,7 +3204,7 @@ function registerModelsCommands(parent) {
         finalPath,
         quantPlan.quantizeType
       ]);
-      if (!cmdOpts.keepIntermediate && intermediatePath && existsSync4(intermediatePath)) {
+      if (!cmdOpts.keepIntermediate && intermediatePath && existsSync5(intermediatePath)) {
         rmSync(intermediatePath, { force: true });
       }
     }
@@ -2783,10 +3257,10 @@ function registerModelsCommands(parent) {
       ]);
       return;
     }
-    if (existsSync4(venvDir) && cmdOpts.force) {
+    if (existsSync5(venvDir) && cmdOpts.force) {
       rmSync(venvDir, { recursive: true, force: true });
     }
-    if (!existsSync4(venvPython)) {
+    if (!existsSync5(venvPython)) {
       mkdirSync3(cacheDir, { recursive: true });
       execFileSync(commands[0][0], commands[0].slice(1), { stdio: "inherit" });
     }
@@ -2927,15 +3401,15 @@ var KIND_LABELS = {
   refund: "Refund",
   adjustment: "Adjustment"
 };
-function formatCents(cents) {
+function formatCents3(cents) {
   const sign = cents < 0 ? "-" : "";
   const abs = Math.abs(cents);
   return `${sign}$${(abs / 100).toFixed(2)}`;
 }
 function formatSigned(cents) {
-  if (cents > 0) return chalk3.green(`+${formatCents(cents)}`);
-  if (cents < 0) return chalk3.red(formatCents(cents));
-  return formatCents(cents);
+  if (cents > 0) return chalk3.green(`+${formatCents3(cents)}`);
+  if (cents < 0) return chalk3.red(formatCents3(cents));
+  return formatCents3(cents);
 }
 function registerBalanceCommands(parent) {
   parent.command("balance").description("Show credit balance and recent transactions").option("-n, --limit <n>", "Number of transactions to show (default 10)", "10").action(async (options) => {
@@ -2949,10 +3423,10 @@ function registerBalanceCommands(parent) {
       return printJson({ balance, transactions });
     }
     const lowBalance = balance.balance_cents < 100;
-    const balanceLine = lowBalance ? chalk3.red(formatCents(balance.balance_cents)) + chalk3.dim(" (low)") : chalk3.bold.green(formatCents(balance.balance_cents));
+    const balanceLine = lowBalance ? chalk3.red(formatCents3(balance.balance_cents)) + chalk3.dim(" (low)") : chalk3.bold.green(formatCents3(balance.balance_cents));
     printDetail([
       ["Credits", balanceLine],
-      ["Lifetime top-ups", formatCents(balance.lifetime_topup_cents)]
+      ["Lifetime top-ups", formatCents3(balance.lifetime_topup_cents)]
     ]);
     if (transactions && transactions.length > 0) {
       console.log(`
@@ -2963,7 +3437,7 @@ ${chalk3.bold("Recent transactions")}`);
           formatDate(row.created_at),
           KIND_LABELS[row.kind] ?? row.kind,
           formatSigned(row.amount_cents),
-          formatCents(row.balance_after_cents),
+          formatCents3(row.balance_after_cents),
           row.reference_id ? shortId(row.reference_id) : chalk3.dim("\u2014")
         ])
       );
@@ -3261,7 +3735,7 @@ function printValidation(checks) {
 }
 
 // src/commands/push.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve3 } from "path";
 function registerPushCommand(parent) {
   parent.command("push").description("Push local spec to the Tuned Tensor API").option("-f, --file <path>", "Spec file path", DEFAULT_SPEC_FILE).action(async (cmdOpts) => {
@@ -3281,7 +3755,7 @@ function registerPushCommand(parent) {
     } else {
       const res = await post("/behavior-specs", body, opts);
       data = res.data;
-      const raw = JSON.parse(readFileSync7(filePath, "utf-8"));
+      const raw = JSON.parse(readFileSync8(filePath, "utf-8"));
       raw.id = data.id;
       writeFileSync4(filePath, JSON.stringify(raw, null, 2) + "\n");
     }
@@ -3294,7 +3768,7 @@ function registerPushCommand(parent) {
 
 // src/index.ts
 var program = new Command();
-program.name("tt").description("Tuned Tensor CLI \u2014 fine-tune and evaluate LLMs").version("0.4.18").option("-k, --api-key <key>", "API key (overrides stored key)").option(
+program.name("tt").description("Tuned Tensor CLI \u2014 fine-tune and evaluate LLMs").version("0.4.20").option("-k, --api-key <key>", "API key (overrides stored key)").option(
   "-u, --base-url <url>",
   "API base URL (default: https://tunedtensor.com)"
 ).option("--json", "Output raw JSON").option("--no-color", "Disable colors").hook("preAction", (_thisCommand, actionCommand) => {
@@ -3308,6 +3782,7 @@ registerAuthCommands(program);
 registerSpecsCommands(program);
 registerRunsCommands(program);
 registerDatasetsCommands(program);
+registerLabelCommands(program);
 registerModelsCommands(program);
 registerBalanceCommands(program);
 registerTopupCommands(program);