hivenet 0.6.0 → 0.7.1

package/README.md

@@ -64,6 +64,8 @@ is still sent — or queued — without them, and the output names them so you c
 later with `--resume <thread> --attach <path>`. A file the server rejects stops the send.
 After a text-only report the CLI suggests that same command (`attach_hint` with `--json`),
 since a screenshot or log often says more than the text.
+New deliveries include `attachmentCount` in `--json` output (zero for text-only reports).
+Duplicate receipts omit it because the original report's files may differ from this attempt.
 
 Structured reports can come from one JSON object, with the same fields as the SDK:
 
@@ -85,6 +87,18 @@ optional and must be grounded in what you actually did; never guess.
 - `--json` machine output · `--dry-run` shows the exact event before anything is sent.
 - Destinations: `--to <slug|domain>`, `--dsn`, `HIVENET_DSN`, or feedback.config.json.
 
+Self-hosters use the same CLI with their own server (0.7.0+):
+
+```sh
+npx hivenet@^0.7.0 --registry https://feedback.example.com --to my-project "Test feedback"
+```
+
+Copy the full command from your instance's Integration page. `--registry` + `--to` pins that
+installation ahead of ambient DSN/config settings; explicit `--dsn` still wins. Older clients
+can use `--dsn "<your instance's DSN>"`. Owner commands use your own secret key and
+`--api https://feedback.example.com`. See [self-hosting and forks](../../docs/self-hosting.md)
+for setup, checks, SDK/MCP access and publishing a customized client.
+
 Vendors: claim a slug and get paste-ready snippets at https://hivenet.app.
 The reference self-hosted ingest implementation remains available in the
 [Hivenet repository](https://github.com/zvadaadam/hivenet/tree/master/packages/server).

package/dist/{chunk-DNR6HNJD.js → chunk-A3UY57EQ.js}

@@ -15234,6 +15234,169 @@ function mediaTypeForFilename(filename) {
   const extension = /\.([^./\\]+)$/.exec(filename)?.[1]?.toLowerCase();
   return extension && MEDIA_TYPES[extension] || "application/octet-stream";
 }
+var SECRET_ENV_NAME = /KEY|SECRET|TOKEN(?!S)|PASSWORD|CREDENTIAL|AUTH/i;
+var SECRET_VALUE_PATTERNS = [
+  [/hv_sec_[A-Za-z0-9]{8,}/, "a Hivenet secret key"],
+  [/sk-ant-[A-Za-z0-9_-]{8,}/, "an Anthropic API key"],
+  // OpenAI (sk-, sk-proj-, sk-svcacct-), OpenRouter (sk-or-v1-) and others.
+  [/\bsk-[A-Za-z0-9_-]{20,}/, "an API key (sk-\u2026)"],
+  [/\bAIza[0-9A-Za-z_-]{35}/, "a Google API key"],
+  [/\bgh[pousr]_[A-Za-z0-9]{20,}/, "a GitHub token"],
+  [/\bgithub_pat_[A-Za-z0-9_]{20,}/, "a GitHub token"],
+  [/\bAKIA[0-9A-Z]{16}\b/, "an AWS access key"],
+  [/\bxox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"]
+];
+var evalCriterionIdSchema = external_exports.string().regex(
+  /^[a-z][a-z0-9_]{0,47}$/,
+  "Criterion ids are snake_case: a lowercase letter, then lowercase letters, digits or _ (at most 48)."
+);
+var weightSchema = external_exports.number().positive().max(100).optional();
+var evalJudgeCriterionSchema = external_exports.object({
+  id: evalCriterionIdSchema,
+  kind: external_exports.literal("judge"),
+  description: external_exports.string().trim().min(1).max(2e3).describe("The yes/no question the judge answers about the result."),
+  weight: weightSchema
+});
+var evalCommandCriterionSchema = external_exports.object({
+  id: evalCriterionIdSchema,
+  kind: external_exports.literal("command"),
+  description: external_exports.string().trim().min(1).max(500).describe("What the check proves, for people reading results."),
+  command: external_exports.string().trim().min(1).max(4e3),
+  contains: external_exports.string().min(1).max(1e3).optional().describe("Stdout must contain this text."),
+  regex: external_exports.string().min(1).max(500).optional().describe("Stdout must match this regex."),
+  timeout_sec: external_exports.number().int().min(1).max(600).optional(),
+  weight: weightSchema
+}).refine((criterion) => !(criterion.contains && criterion.regex), {
+  message: "A command criterion takes contains or regex, not both."
+});
+var evalCriterionSchema = external_exports.discriminatedUnion("kind", [
+  evalJudgeCriterionSchema,
+  evalCommandCriterionSchema
+]);
+var evalJudgeSchema = external_exports.object({
+  model: external_exports.string().trim().min(1).max(128).default("anthropic/claude-sonnet-5"),
+  /** Give the judge the agent's ATIF trajectory, e.g. to grade which tool or skill it used. */
+  reads_trajectory: external_exports.boolean().default(false),
+  /** Workspace files the judge reads, relative to the workdir. */
+  files: external_exports.array(external_exports.string().trim().min(1).max(256)).max(20).default([])
+});
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+var SINGLE_LINE = /^[^\r\n]+$/;
+var evalMcpServerSchema = external_exports.object({
+  name: external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/),
+  transport: external_exports.enum(["stdio", "sse", "streamable-http"]),
+  url: external_exports.url().max(2e3).optional(),
+  command: external_exports.string().trim().min(1).max(500).optional(),
+  args: external_exports.array(external_exports.string().max(500)).max(30).default([])
+});
+var evalEnvironmentSchema = external_exports.object({
+  /** The base image, e.g. `node:22-slim`. */
+  image: external_exports.string().trim().regex(/^[A-Za-z0-9][A-Za-z0-9._\-/:@]{0,255}$/, "image must be a Docker image reference."),
+  /** Dockerfile RUN lines, cached in the image: toolchains, not the product under test. */
+  build: external_exports.array(external_exports.string().trim().regex(SINGLE_LINE).max(2e3)).max(30).default([]),
+  /**
+   * Runs before every trial, so each one tests the current product. Harbor runs it as the
+   * healthcheck and retries it on failure, so it must be safe to run twice.
+   */
+  setup: external_exports.object({
+    command: external_exports.string().trim().min(1).max(8e3),
+    timeout_sec: external_exports.number().int().min(10).max(3600).default(600)
+  }).nullable().default(null),
+  workdir: external_exports.string().regex(/^\/[A-Za-z0-9._\-/]{0,255}$/).default("/app"),
+  network: external_exports.object({
+    mode: external_exports.enum(["public", "allowlist", "no-network"]).default("public"),
+    allowed_hosts: external_exports.array(external_exports.string().trim().min(1).max(253)).max(50).default([])
+  }).prefault({}),
+  /** Values reach setup and the agent; secret-like names take only `${VAR}` templates. */
+  env: external_exports.record(external_exports.string().regex(ENV_NAME), external_exports.string().max(2e3)).default({}),
+  mcp_servers: external_exports.array(evalMcpServerSchema).max(10).default([])
+});
+var evalAgentSchema = external_exports.object({
+  timeout_sec: external_exports.number().int().min(30).max(7200).default(900)
+});
+var evalVersionFieldsSchema = external_exports.object({
+  /** The task in the owner's words. Never the reporter's `actual` or `mistake`. */
+  instruction: external_exports.string().trim().min(1).max(2e4),
+  /** What "done" means, in one or two sentences. */
+  end_goal: external_exports.string().trim().min(1).max(2e3).optional(),
+  criteria: external_exports.array(evalCriterionSchema).min(1).max(30),
+  judge: evalJudgeSchema.optional(),
+  environment: evalEnvironmentSchema,
+  agent: evalAgentSchema.prefault({}),
+  /** A reference solution for Harbor's `oracle` agent, as a bash script. */
+  solution: external_exports.string().trim().min(1).max(2e4).optional(),
+  change_note: external_exports.string().trim().min(1).max(500).optional()
+});
+var evalVersionInputSchema = evalVersionFieldsSchema.refine(
+  (input) => new Set(input.criteria.map((c) => c.id)).size === input.criteria.length,
+  { message: "Criterion ids must be unique.", path: ["criteria"] }
+);
+var HARBOR_ID = external_exports.string().regex(/^[0-9a-f-]{36}$/i, "Harbor ids are UUIDs.");
+var boundedRecord = (max) => external_exports.record(external_exports.string().min(1).max(200), external_exports.number()).refine((record2) => Object.keys(record2).length <= max, `At most ${max} keys.`);
+var evalTrialScenarioSchema = external_exports.object({
+  /** Folders the job mounted (`harbor run --mounts`), by name: the path stays on the machine. */
+  mounts: external_exports.array(external_exports.string().min(1).max(200)).max(5).optional(),
+  /** `--skill` */
+  skills: external_exports.array(external_exports.string().min(1).max(200)).max(20).optional(),
+  /** `--mcp-config` */
+  mcp_servers: external_exports.array(external_exports.string().min(1).max(100)).max(20).optional(),
+  /** `--extra-instruction` text, or the file `--extra-instruction-path` named. */
+  instructions: external_exports.array(external_exports.string().min(1).max(500)).max(5).optional(),
+  /** `--ak` and `--ae`, without secret-looking names. */
+  agent_options: external_exports.record(external_exports.string().min(1).max(64), external_exports.string().max(200)).refine((record2) => Object.keys(record2).length <= 20, "At most 20 agent options.").optional()
+});
+var evalTrialCiSchema = external_exports.object({
+  provider: external_exports.literal("github"),
+  /** `owner/name` */
+  repository: external_exports.string().min(1).max(200),
+  /** The commit under test: a pull request's head, else the commit that triggered the run. */
+  commit: external_exports.string().regex(/^[0-9a-f]{7,64}$/i).optional(),
+  branch: external_exports.string().min(1).max(250).optional(),
+  pull_request: external_exports.number().int().positive().optional(),
+  /** What started the workflow: pull_request, push, schedule, workflow_dispatch… */
+  event: external_exports.string().min(1).max(50).optional(),
+  run_url: external_exports.url({ protocol: /^https?$/ }).max(500).optional()
+});
+var evalTrialUploadSchema = external_exports.object({
+  harbor_trial_id: HARBOR_ID,
+  harbor_job_id: HARBOR_ID,
+  harbor_job_name: external_exports.string().max(200).optional(),
+  /** Set on a regrade: the trial it derives from. */
+  source_harbor_trial_id: HARBOR_ID.optional(),
+  /** `[task].name` from the trial's result: `<project slug>/<eval id>` for Hivenet tasks. */
+  task_name: external_exports.string().min(1).max(300),
+  /** `task.digest` from the trial's lock.json. */
+  task_digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/),
+  agent: external_exports.string().min(1).max(100),
+  agent_version: external_exports.string().max(100).optional(),
+  model: external_exports.string().max(200).optional(),
+  /** The reasoning effort it ran at (`harbor run --ak reasoning_effort=…`): part of the lane. */
+  effort: external_exports.string().min(1).max(40).optional(),
+  harbor_version: external_exports.string().max(50).optional(),
+  exception: external_exports.object({ type: external_exports.string().min(1).max(200), message: external_exports.string().max(2e3) }).optional(),
+  /** reward.json. Absent when the verifier wrote nothing: the trial wasn't graded. */
+  rewards: boundedRecord(32).optional(),
+  /** reward-details.json leaves, keyed by criterion id. */
+  criteria: boundedRecord(64).optional(),
+  metrics: external_exports.object({
+    input_tokens: external_exports.number().int().nonnegative(),
+    output_tokens: external_exports.number().int().nonnegative(),
+    cache_tokens: external_exports.number().int().nonnegative(),
+    cost_usd: external_exports.number().nonnegative(),
+    setup_sec: external_exports.number().nonnegative(),
+    agent_sec: external_exports.number().nonnegative(),
+    verifier_sec: external_exports.number().nonnegative()
+  }).partial().optional(),
+  started_at: external_exports.iso.datetime({ offset: true }).optional(),
+  finished_at: external_exports.iso.datetime({ offset: true }).optional(),
+  scenario: evalTrialScenarioSchema.optional(),
+  ci: evalTrialCiSchema.optional()
+});
+var MAX_TRIALS_PER_PUSH = 200;
+var MAX_TRAJECTORY_BYTES = 8 * 1024 * 1024;
+var evalResultsUploadSchema = external_exports.object({
+  trials: external_exports.array(evalTrialUploadSchema).min(1).max(MAX_TRIALS_PER_PUSH)
+});
 var PROTOCOL_VERSION = 1;
 var MAX_FEEDBACK_LENGTH = 5e3;
 var MAX_SUBJECT_LENGTH = 500;
@@ -15337,8 +15500,12 @@ var metadataSchema = external_exports.record(
   external_exports.string().min(1).max(40),
   external_exports.union([external_exports.string().max(200), external_exports.number().finite(), external_exports.boolean()])
 ).refine((value) => Object.keys(value).length <= 20, { message: "at most 20 metadata keys" });
+var threadSchema = external_exports.object({ id: external_exports.string().regex(THREAD_ID_PATTERN) });
+function newThreadId() {
+  return crypto.randomUUID().replaceAll("-", "");
+}
 var feedbackEventSchema = external_exports.object({
-  v: external_exports.literal(PROTOCOL_VERSION),
+  v: external_exports.literal(PROTOCOL_VERSION).default(PROTOCOL_VERSION),
   /** Tenant slug or domain this feedback is addressed to. Optional when the write key implies it. */
   to: external_exports.string().max(253).optional(),
   feedback: external_exports.string().min(1).max(MAX_FEEDBACK_LENGTH),
@@ -15346,7 +15513,7 @@ var feedbackEventSchema = external_exports.object({
   subject: external_exports.string().min(1).max(MAX_SUBJECT_LENGTH).optional(),
   sentiment: sentimentSchema.optional(),
   author: authorSchema.optional(),
-  thread: external_exports.object({ id: external_exports.string().regex(THREAD_ID_PATTERN) }),
+  thread: threadSchema.optional().transform((thread) => thread ?? { id: newThreadId() }),
   eval: evalReportSchema.optional(),
   /** Id of an owner/system question this submission answers (from a prior response's `ask`). */
   question: external_exports.string().max(64).optional(),
@@ -15359,8 +15526,8 @@ var feedbackEventSchema = external_exports.object({
   client: external_exports.object({
     name: external_exports.string().max(64),
     version: external_exports.string().max(32)
-  }),
-  consent: external_exports.object({ telemetry: external_exports.boolean() })
+  }).default({ name: "http", version: "0" }),
+  consent: external_exports.object({ telemetry: external_exports.boolean() }).default({ telemetry: false })
 });
 var knownIssueSchema = external_exports.object({
   title: external_exports.string().max(120),
@@ -16087,7 +16254,7 @@ function inferAuthor(context) {
 }
 var CONFIG_FILE_NAME = "feedback.config.json";
 var DESCRIPTOR_CACHE_TTL_MS = 60 * 60 * 1e3;
-var RESOLVE_TIMEOUT_MS = 5e3;
+var RESOLVE_TIMEOUT_MS = 1e4;
 function parseDsn(dsn) {
   let url2;
   try {
@@ -16203,7 +16370,17 @@ function destinationFromDescriptor(descriptor, to) {
   };
 }
 function registryUrl(env = process.env) {
-  return env[REGISTRY_ENV_VAR]?.trim() || DEFAULT_REGISTRY_URL;
+  const value = env[REGISTRY_ENV_VAR]?.trim() || DEFAULT_REGISTRY_URL;
+  try {
+    const url2 = new URL(value);
+    if (!["http:", "https:"].includes(url2.protocol) || url2.username || url2.password || url2.search || url2.hash || url2.pathname !== "/" || !/^[a-z0-9._:[\]-]+$/i.test(url2.hostname))
+      throw new Error("Not an origin");
+    return url2.origin;
+  } catch {
+    throw new FeedbackError(
+      "Registry must be an HTTP(S) origin, such as https://feedback.example.com, without credentials, a path, query or fragment."
+    );
+  }
 }
 async function resolveDestination(options = {}) {
   const env = options.env ?? process.env;
@@ -16212,6 +16389,19 @@ async function resolveDestination(options = {}) {
   if (options.dsn) {
     return parseDsn(options.dsn);
   }
+  if (options.registry !== void 0) {
+    const to2 = options.to?.trim();
+    if (!options.registry.trim() || !to2 || to2.includes(".")) {
+      throw new FeedbackError("Use --registry with --to <project-slug>, not a domain.");
+    }
+    const origin = registryUrl({ [REGISTRY_ENV_VAR]: options.registry });
+    return resolveViaDescriptor(
+      `${origin}/v1/registry/${encodeURIComponent(to2)}`,
+      to2,
+      fetchImpl,
+      cacheDir
+    );
+  }
   const envDsn = env[DSN_ENV_VAR]?.trim();
   if (envDsn) {
     return parseDsn(envDsn);
@@ -16274,23 +16464,24 @@ async function postEvent(options) {
     body = void 0;
   }
   const parsed = validateIngestResponse(body);
-  return {
-    kind: "accepted",
-    response: parsed.ok ? parsed.data : { id: "unknown", thread: options.event.thread.id }
-  };
+  return parsed.ok ? { kind: "accepted", response: parsed.data } : { kind: "unreachable", error: "Server returned an invalid delivery receipt." };
 }
 var OUTBOX_FILE = "outbox.jsonl";
-var MAX_OUTBOX_ENTRIES = 100;
+var MAX_FLUSH_ENTRIES = 100;
 var STALE_CLAIM_MS = 30 * 60 * 1e3;
 function outboxPath(env = process.env) {
   return path5.join(feedbackHomeDir(env), OUTBOX_FILE);
 }
 function appendToOutbox(entry, env = process.env) {
+  return appendEntriesToOutbox([entry], env);
+}
+function appendEntriesToOutbox(entries, env) {
+  if (entries.length === 0) return true;
   try {
     const file2 = outboxPath(env);
     mkdirSync2(path5.dirname(file2), { recursive: true });
-    appendFileSync(file2, `${JSON.stringify(entry)}
-`);
+    appendFileSync(file2, entries.map((entry) => `${JSON.stringify(entry)}
+`).join(""));
     return true;
   } catch {
     return false;
@@ -16332,24 +16523,30 @@ function claimQueue(env) {
 async function flushOutbox(options = {}) {
   const env = options.env ?? process.env;
   const claims = claimQueue(env);
-  const entries = claims.flatMap(readEntries).slice(-MAX_OUTBOX_ENTRIES);
+  const entries = claims.flatMap(readEntries);
+  const deadline = Date.now() + (options.maxDurationMs ?? Number.POSITIVE_INFINITY);
   const failures = [];
+  let attempted = 0;
   let delivered = 0;
-  for (const entry of entries) {
+  for (const entry of entries.slice(0, MAX_FLUSH_ENTRIES)) {
+    const timeLeft = deadline - Date.now();
+    if (timeLeft <= 0) break;
+    attempted++;
     const result = await postEvent({
       endpoint: entry.endpoint,
       ...entry.writeKey ? { writeKey: entry.writeKey } : {},
       event: entry.event,
-      timeoutMs: options.timeoutMs ?? 5e3,
+      timeoutMs: Math.max(1, Math.floor(Math.min(options.timeoutMs ?? 5e3, timeLeft))),
       ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
     });
-    if (result.kind === "accepted" || result.kind === "rejected") {
-      delivered += result.kind === "accepted" ? 1 : 0;
+    if (result.kind === "accepted") {
+      delivered++;
     } else {
       failures.push(entry);
     }
   }
-  if (failures.every((entry) => appendToOutbox(entry, env))) {
+  const remaining = entries.slice(attempted).concat(failures);
+  if (appendEntriesToOutbox(remaining, env)) {
     for (const claim of claims) {
       try {
         rmSync(claim, { force: true });
@@ -16357,16 +16554,22 @@ async function flushOutbox(options = {}) {
       }
     }
   }
-  return { delivered, remaining: failures.length };
+  return { delivered, remaining: remaining.length };
 }
 async function resolveApiOrigin(options) {
-  if (!options.to && !options.dsn) {
-    return new URL(DEFAULT_REGISTRY_URL).origin;
+  const env = options.env ?? process.env;
+  if (options.registry !== void 0 && !options.to && !options.dsn) {
+    if (!options.registry.trim()) throw new FeedbackError("Registry must not be empty.");
+    return registryUrl({ [REGISTRY_ENV_VAR]: options.registry });
+  }
+  if (!options.to && !options.dsn && !env[DSN_ENV_VAR]?.trim()) {
+    return registryUrl(env);
   }
   const destination = await resolveDestination({
     ...options.to !== void 0 ? { to: options.to } : {},
     ...options.dsn !== void 0 ? { dsn: options.dsn } : {},
-    ...options.env ? { env: options.env } : {},
+    ...options.registry !== void 0 ? { registry: options.registry } : {},
+    env,
     ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
   });
   return new URL(destination.endpoint).origin;
@@ -16375,12 +16578,12 @@ function ownerApi(options) {
   const origin = (options.apiOrigin ?? new URL(DEFAULT_REGISTRY_URL).origin).replace(/\/$/, "");
   const fetchImpl = options.fetchImpl ?? fetch;
   const timeoutMs = options.timeoutMs ?? 15e3;
-  async function request(path6, init) {
+  async function request(path6, init, timeout = timeoutMs) {
     let response;
     try {
       response = await fetchImpl(`${origin}${path6}`, {
         ...init,
-        signal: AbortSignal.timeout(timeoutMs),
+        signal: AbortSignal.timeout(timeout),
         headers: {
           authorization: `Bearer ${options.secretKey}`,
           ...init?.body ? { "content-type": "application/json" } : {},
@@ -16513,6 +16716,33 @@ function ownerApi(options) {
         body: JSON.stringify({ status, ...note !== void 0 ? { note } : {} })
       });
     },
+    /** Draft a runnable version of an eval (a person approves it in the dashboard). */
+    async draftEvalVersion(id, fields) {
+      return request(`/v1/evals/${encodeURIComponent(id)}/versions`, {
+        method: "POST",
+        body: JSON.stringify(fields)
+      });
+    },
+    /** Compiled Harbor tasks: every accepted eval's current version, or the given refs. */
+    async pullEvalTasks(refs = []) {
+      const query = refs.map((ref) => `ref=${encodeURIComponent(ref)}`).join("&");
+      return request(`/v1/evals/tasks${query ? `?${query}` : ""}`);
+    },
+    /** Harbor trials read from a job directory, with their grades. */
+    async pushEvalResults(trials) {
+      return request("/v1/evals/results", {
+        method: "POST",
+        body: JSON.stringify({ trials })
+      });
+    },
+    /** A stored trial's ATIF trajectory (`agent/trajectory.json`), as read from disk. */
+    async pushTrialTrajectory(harborTrialId, trajectory) {
+      return request(
+        `/v1/evals/trials/${encodeURIComponent(harborTrialId)}/trajectory`,
+        { method: "PUT", body: trajectory },
+        Math.max(timeoutMs, 6e4)
+      );
+    },
     /** Attach an external link (Slack message, Linear/GitHub issue, PR) to evt_… or iss_…. */
     async addLink(id, url2, label) {
       const path6 = id.startsWith("iss_") ? `/v1/issues/${id}` : `/v1/events/${id}`;
@@ -16552,6 +16782,7 @@ async function prepareFeedback(options) {
   const resolveOptions = {
     ...options.to !== void 0 ? { to: options.to } : {},
     ...options.dsn !== void 0 ? { dsn: options.dsn } : {},
+    ...options.registry !== void 0 ? { registry: options.registry } : {},
     cwd,
     env,
     ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
@@ -16676,9 +16907,14 @@ export {
   attachmentDescriptionSchema,
   ATTACHMENT_TARGET_TYPES,
   attachmentTargetSchema,
+  SECRET_ENV_NAME,
+  SECRET_VALUE_PATTERNS,
+  MAX_TRIALS_PER_PUSH,
+  MAX_TRAJECTORY_BYTES,
   PROTOCOL_VERSION,
   MAX_FEEDBACK_LENGTH,
   WELL_KNOWN_PATH,
+  DEFAULT_REGISTRY_URL,
   FEEDBACK_CATEGORIES,
   EVENT_STATUSES,
   ISSUE_STATUSES,
@@ -16686,11 +16922,13 @@ export {
   sentimentSchema,
   authorSchema,
   evalReportSchema,
+  threadSchema,
   feedbackEventSchema,
   validateFeedbackEvent,
   validateDescriptor,
   FeedbackError,
   parseDsn,
+  findConfigFile,
   registryUrl,
   postEvent,
   flushOutbox,

package/dist/{chunk-AK23JXBN.js → chunk-OEHURQBM.js}

@@ -1,7 +1,7 @@
 import {
   FeedbackError,
   attachmentDescriptionSchema
-} from "./chunk-DNR6HNJD.js";
+} from "./chunk-A3UY57EQ.js";
 
 // src/attachment-flags.ts
 function attachmentFlags() {

package/dist/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import {
   attachmentFlags
-} from "./chunk-AK23JXBN.js";
+} from "./chunk-OEHURQBM.js";
 import {
+  DEFAULT_REGISTRY_URL,
   FEEDBACK_CATEGORIES,
   FeedbackError,
   MAX_ATTACHMENTS,
@@ -13,12 +14,42 @@ import {
   evalReportSchema,
   external_exports,
   feedbackEventSchema,
+  findConfigFile,
   flushOutbox,
   prepareFeedback,
+  registryUrl,
   require_arg,
   sendFeedback,
-  sentimentSchema
-} from "./chunk-DNR6HNJD.js";
+  sentimentSchema,
+  threadSchema
+} from "./chunk-A3UY57EQ.js";
+
+// ../snippets/dist/index.js
+function registryOrigin(input) {
+  if (!input.endpoint) return void 0;
+  const url = new URL(input.endpoint);
+  if (!["http:", "https:"].includes(url.protocol) || !/^[a-z0-9._:[\]-]+$/i.test(url.hostname)) {
+    throw new Error("The reporting endpoint must use an HTTP(S) server hostname.");
+  }
+  return url.origin === new URL(DEFAULT_REGISTRY_URL).origin ? void 0 : url.origin;
+}
+function invocationFlags(input) {
+  if (input.slug) {
+    const registry = registryOrigin(input);
+    return `${registry ? `--registry "${registry}" ` : ""}--to ${input.slug} `;
+  }
+  if (input.domain) return `--to ${input.domain} `;
+  if (input.dsn) return `--dsn "${input.dsn}" `;
+  return "";
+}
+function cliInvocation(input) {
+  const version = input.slug && registryOrigin(input) ? "^0.7.0" : "latest";
+  return `npx --yes hivenet@${version}`;
+}
+function agentCommand(input, extra = "", trailing = '"<specific, actionable feedback>"') {
+  const parts = [invocationFlags(input).trim(), extra.trim(), trailing].filter(Boolean);
+  return `${cliInvocation(input)} ${parts.join(" ")}`;
+}
 
 // src/cli.ts
 var import_arg = __toESM(require_arg(), 1);
@@ -42,7 +73,7 @@ var inputSchema = feedbackEventSchema.pick({
   to: feedbackEventSchema.shape.to.unwrap().trim().min(1).optional(),
   dsn: external_exports.url().optional(),
   eval: evalReportSchema.strict().optional(),
-  resume: feedbackEventSchema.shape.thread.shape.id.optional(),
+  resume: threadSchema.shape.id.optional(),
   question: feedbackEventSchema.shape.question.unwrap().min(1).optional(),
   attachments: external_exports.array(
     external_exports.preprocess(
@@ -174,18 +205,18 @@ function inputTooLarge() {
 
 // src/cli.ts
 var CLI_NAME = "hivenet";
-var CLI_VERSION = "0.6.0";
+var CLI_VERSION = "0.7.1";
 var rawArgs = process.argv.slice(2);
 var flagArgs = rawArgs.slice(0, rawArgs.includes("--") ? rawArgs.indexOf("--") : void 0);
 async function main() {
   const subcommand = process.argv[2];
   if (subcommand === "doctor") {
-    const { runDoctor } = await import("./doctor-EA2GJRUS.js");
+    const { runDoctor } = await import("./doctor-UOEWIXXV.js");
     await runDoctor(process.argv.slice(3), CLI_VERSION);
     return;
   }
   if (subcommand === "inbox" || subcommand === "triage" || subcommand === "issues" || subcommand === "issue" || subcommand === "questions" || subcommand === "ask" || subcommand === "question" || subcommand === "evals" || subcommand === "eval" || subcommand === "promote" || subcommand === "attach") {
-    const owner = await import("./owner-ZWROA7AU.js");
+    const owner = await import("./owner-I3AOD2FJ.js");
     const run = {
       inbox: owner.runInbox,
       triage: owner.runTriage,
@@ -209,6 +240,7 @@ async function main() {
       "--version": Boolean,
       "--to": String,
       "--dsn": String,
+      "--registry": String,
       "--category": String,
       "--subject": String,
       "--sentiment": String,
@@ -259,7 +291,7 @@ async function main() {
   }
   let options;
   if (args["--input"] !== void 0) {
-    const allowed = /* @__PURE__ */ new Set(["_", "--input", "--json", "--dry-run", "--to", "--dsn"]);
+    const allowed = /* @__PURE__ */ new Set(["_", "--input", "--json", "--dry-run", "--to", "--dsn", "--registry"]);
     const conflicts = Object.keys(args).filter((flag) => !allowed.has(flag));
     if (args._.length || conflicts.length)
       throw new FeedbackInputError(
@@ -305,6 +337,7 @@ Usage: npx ${CLI_NAME} --to <slug|domain> "<specific, actionable feedback>"`
       ...args["--attach"] ? { attachments: args["--attach"] } : {}
     };
   }
+  if (args["--registry"] !== void 0) options.registry = args["--registry"];
   options.clientName = CLI_NAME;
   options.clientVersion = CLI_VERSION;
   if (args["--dry-run"]) {
@@ -312,11 +345,38 @@ Usage: npx ${CLI_NAME} --to <slug|domain> "<specific, actionable feedback>"`
     console.log(JSON.stringify(preview, null, 2));
     return;
   }
-  flushOutbox({ timeoutMs: 3e3 }).catch(() => {
+  flushOutbox({ timeoutMs: 3e3, maxDurationMs: 250 }).catch(() => {
   });
+  const requestedTo = options.to?.trim() ?? findConfigFile(options.cwd ?? process.cwd())?.config.slug;
+  const selectedDsn = options.dsn || process.env.HIVENET_DSN?.trim();
   const result = await sendFeedback(options);
   if (!result.delivered && !result.queued) process.exitCode = 1;
-  const resume = (result.delivered ? result.response.resume : void 0) ?? `npx ${CLI_NAME}${result.destination.to ? ` --to ${result.destination.to}` : ""} --resume ${result.event.thread.id}`;
+  const destination = result.destination;
+  let directDsn;
+  if (selectedDsn && !destination.descriptor) {
+    const url = new URL(destination.endpoint);
+    url.username = destination.writeKey ?? "";
+    url.pathname = destination.to ?? "";
+    directDsn = url.toString();
+  }
+  const resume = agentCommand(
+    destination.descriptor ? requestedTo?.includes(".") ? { domain: requestedTo } : {
+      ...destination.to ? { slug: destination.to } : {},
+      endpoint: `${registryUrl(options.registry !== void 0 ? { HIVENET_REGISTRY: options.registry } : process.env)}/v1/feedback`
+    } : directDsn ? { dsn: directDsn } : (
+      // A config-only endpoint need not expose a registry or /v1/feedback.
+      // Continue using that config, including its exact path and optional key.
+      { ...destination.to ? { slug: destination.to } : {} }
+    ),
+    `--resume ${result.delivered ? result.response.thread : result.event.thread.id}`,
+    ""
+  );
+  if (result.delivered) {
+    result.response.resume = resume;
+    if (result.response.ask) {
+      result.response.ask.command = `${resume} --answer ${result.response.ask.id} "<your grounded answer>"`;
+    }
+  }
   const answer = result.event.question;
   const attach = `${resume}${answer ? ` --answer ${answer}` : ""} --attach <path> "<what it shows>"`;
   const attachHint = result.filesNotAttached ? `Add them later: ${attach}` : result.delivered && !result.event.attachments?.length && !answer ? `Have a screenshot or log that shows this? Attach it: ${attach}` : void 0;
@@ -327,7 +387,8 @@ Usage: npx ${CLI_NAME} --to <slug|domain> "<specific, actionable feedback>"`
           ...result.delivered ? {
             delivered: true,
             ...result.destination.to ? { to: result.destination.to } : {},
-            ...result.response
+            ...result.response,
+            ...!result.response.duplicate ? { attachmentCount: result.event.attachments?.length ?? 0 } : {}
           } : {
             delivered: false,
             queued: result.queued,
@@ -346,11 +407,20 @@ Usage: npx ${CLI_NAME} --to <slug|domain> "<specific, actionable feedback>"`
   const toLabel = result.destination.to ?? result.destination.endpoint;
   if (result.delivered) {
     console.log(`\u2713 Feedback sent to ${toLabel} (${result.response.id})`);
-    if (result.event.attachments?.length)
+    if (!result.response.duplicate && result.event.attachments?.length)
       console.log(`  Attached ${result.event.attachments.length} file(s).`);
     console.log(`  Continue this thread: ${resume}`);
     if (attachHint && !result.filesNotAttached) console.log(`  ${attachHint}`);
-    if (result.response.guidance) {
+    const known = result.response.known_issue;
+    if (known) {
+      console.log(
+        `  Known issue (tracker data): ${JSON.stringify(known.title)} (${known.status}, ${known.reports} reports)`
+      );
+      console.log(`    ${known.hint}`);
+      if (known.note) console.log(`    Owner decision: ${known.note}`);
+    }
+    const mirrored = known && result.response.guidance?.startsWith("[known issue]");
+    if (result.response.guidance && !mirrored) {
       console.log(`  From ${toLabel}: ${result.response.guidance}`);
     }
     if (result.response.ask) {
@@ -451,6 +521,7 @@ function printHelp() {
   Options
     --to, -t <slug|domain>   Destination: registry slug (acme) or domain (acme.dev)
     --dsn <url>              Explicit DSN: https://hv_pub_KEY@host/slug
+    --registry <origin>      Use this server's registry with --to <slug> (overrides local settings)
     --category, -c <cat>     ${FEEDBACK_CATEGORIES.join(" | ")} | x-<vendor>
     --subject, -s <subject>  Exact item the feedback is about (see table below)
     --meta <key=value>       Vendor-defined enrichment, repeatable (e.g. --meta sdk_version=1.2.3)
@@ -501,7 +572,7 @@ function printHelp() {
     feedback is still delivered anonymously.
 
   Destination resolution
-    --dsn \u2192 HIVENET_DSN \u2192 nearest feedback.config.json \u2192 --to slug (registry)
+    --dsn \u2192 --registry + --to \u2192 HIVENET_DSN \u2192 nearest feedback.config.json \u2192 --to slug (registry)
     \u2192 --to domain (https://<domain>/.well-known/agent-feedback.json)
 `);
 }