hivenet 0.6.0 → 0.7.1

package/dist/owner-I3AOD2FJ.js

@@ -0,0 +1,1005 @@
+import {
+  attachmentFlags
+} from "./chunk-OEHURQBM.js";
+import {
+  ATTACHMENT_TARGET_TYPES,
+  EVAL_STATUSES,
+  EVENT_STATUSES,
+  FEEDBACK_CATEGORIES,
+  FeedbackError,
+  ISSUE_STATUSES,
+  MAX_TRAJECTORY_BYTES,
+  MAX_TRIALS_PER_PUSH,
+  SECRET_ENV_NAME,
+  SECRET_VALUE_PATTERNS,
+  __toESM,
+  attachmentTargetSchema,
+  ownerApi,
+  require_arg,
+  resolveApiOrigin
+} from "./chunk-A3UY57EQ.js";
+
+// src/owner.ts
+import { chmodSync, mkdirSync, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync } from "fs";
+import path2 from "path";
+var import_arg = __toESM(require_arg(), 1);
+
+// src/ci-context.ts
+import { readFileSync } from "fs";
+var CHECKOUT_EVENTS = /* @__PURE__ */ new Set(["push", "schedule", "workflow_dispatch", "merge_group"]);
+var str = (value) => typeof value === "string" && value ? value : void 0;
+function ciContext(env = process.env) {
+  if (env.GITHUB_ACTIONS !== "true" || !env.GITHUB_REPOSITORY) return void 0;
+  let pullRequest;
+  try {
+    const event = env.GITHUB_EVENT_PATH ? JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, "utf8")) : void 0;
+    pullRequest = event?.pull_request;
+  } catch {
+    pullRequest = void 0;
+  }
+  const checkedOut = CHECKOUT_EVENTS.has(env.GITHUB_EVENT_NAME ?? "");
+  const commit = pullRequest ? str(pullRequest.head?.sha) : checkedOut ? env.GITHUB_SHA : void 0;
+  const branch = pullRequest ? str(pullRequest.head?.ref) || env.GITHUB_HEAD_REF : checkedOut ? env.GITHUB_REF_NAME : void 0;
+  const server = env.GITHUB_SERVER_URL || "https://github.com";
+  return {
+    provider: "github",
+    repository: env.GITHUB_REPOSITORY,
+    ...commit && /^[0-9a-f]{7,64}$/i.test(commit) ? { commit } : {},
+    ...branch ? { branch } : {},
+    ...typeof pullRequest?.number === "number" ? { pull_request: pullRequest.number } : {},
+    ...env.GITHUB_EVENT_NAME ? { event: env.GITHUB_EVENT_NAME } : {},
+    ...env.GITHUB_RUN_ID ? { run_url: `${server}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` } : {}
+  };
+}
+
+// src/harbor-job.ts
+import { existsSync, readdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import path from "path";
+function readJson(file) {
+  try {
+    const value = JSON.parse(readFileSync2(file, "utf8"));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function str2(value) {
+  return typeof value === "string" && value ? value : void 0;
+}
+function num(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function seconds(timing) {
+  const t = timing;
+  const start = str2(t?.started_at);
+  const end = str2(t?.finished_at);
+  if (!start || !end) return void 0;
+  const ms = Date.parse(end) - Date.parse(start);
+  return Number.isFinite(ms) && ms >= 0 ? Math.round(ms / 100) / 10 : void 0;
+}
+function rewardCriteria(node, out = {}) {
+  if (!node || typeof node !== "object") return out;
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "criteria" && Array.isArray(value)) {
+      for (const criterion of value) {
+        const id = str2(criterion?.id) ?? str2(criterion?.name);
+        const score = num(criterion?.value);
+        if (id && score !== void 0) out[id] = score;
+      }
+    } else {
+      rewardCriteria(value, out);
+    }
+  }
+  return out;
+}
+function rewardsOf(result) {
+  const raw = result.verifier_result?.rewards;
+  if (!raw || typeof raw !== "object") return void 0;
+  const rewards = Object.fromEntries(
+    Object.entries(raw).filter((entry) => num(entry[1]) !== void 0)
+  );
+  return Object.keys(rewards).length ? rewards : void 0;
+}
+function list(value) {
+  return Array.isArray(value) ? value : [];
+}
+function scenarioOf(config, lock) {
+  const agent = config.agent ?? {};
+  const environment = config.environment ?? {};
+  const mounts = list(environment.mounts).map((mount) => str2(mount?.source)).filter((source) => !!source).map((source) => path.basename(path.resolve(source)));
+  const skills = list(lock?.skills).map((skill) => str2(skill?.name)).filter((name) => !!name);
+  const mcpServers = list(agent.mcp_servers).map((server) => str2(server?.name)).filter((name) => !!name);
+  const instructions = [
+    ...list(config.extra_instructions).map(str2),
+    ...list(config.extra_instruction_paths).map(
+      (file) => str2(file) ? path.basename(str2(file)) : void 0
+    )
+  ].filter((text) => !!text).map((text) => text.slice(0, 500));
+  const options = {};
+  for (const [key, value] of [
+    ...Object.entries(agent.kwargs ?? {}),
+    ...Object.entries(agent.env ?? {})
+  ]) {
+    if (key === "reasoning_effort" || SECRET_ENV_NAME.test(key)) continue;
+    if (!["string", "number", "boolean"].includes(typeof value)) continue;
+    options[key.slice(0, 64)] = String(value).slice(0, 200);
+  }
+  const scenario = {
+    ...mounts.length ? { mounts: mounts.slice(0, 5) } : {},
+    ...skills.length ? { skills: skills.slice(0, 20) } : {},
+    ...mcpServers.length ? { mcp_servers: mcpServers.slice(0, 20) } : {},
+    ...instructions.length ? { instructions: instructions.slice(0, 5) } : {},
+    ...Object.keys(options).length ? { agent_options: Object.fromEntries(Object.entries(options).slice(0, 20)) } : {}
+  };
+  return Object.keys(scenario).length ? scenario : void 0;
+}
+function readTrial(dir, job) {
+  const result = readJson(path.join(dir, "result.json"));
+  if (!result) return { reason: "no result.json yet (still running?)" };
+  const lock = readJson(path.join(dir, "lock.json"));
+  const digest = str2(lock?.task?.digest);
+  if (!digest) return { reason: "no task digest in lock.json" };
+  const config = result.config ?? {};
+  const agentInfo = result.agent_info ?? {};
+  const modelInfo = agentInfo.model_info ?? null;
+  const agentResult = result.agent_result ?? {};
+  const exception = result.exception_info ?? null;
+  const source = config.source_trial ?? null;
+  const jobId = str2(config.job_id);
+  const id = str2(result.id);
+  const taskName = str2(result.task_name);
+  if (!id || !jobId || !taskName) return { reason: "result.json lacks the trial, job or task id" };
+  const model = str2(modelInfo?.name) ?? str2(config.agent?.model_name);
+  const provider = str2(modelInfo?.provider);
+  const effort = str2(
+    config.agent?.kwargs?.reasoning_effort
+  );
+  const scenario = scenarioOf(config, lock);
+  const rewards = rewardsOf(result);
+  const details = readJson(path.join(dir, "verifier", "reward-details.json"));
+  const metrics = Object.fromEntries(
+    Object.entries({
+      input_tokens: num(agentResult.n_input_tokens),
+      output_tokens: num(agentResult.n_output_tokens),
+      cache_tokens: num(agentResult.n_cache_tokens),
+      cost_usd: num(agentResult.cost_usd),
+      setup_sec: seconds(result.environment_setup),
+      agent_sec: seconds(result.agent_execution),
+      verifier_sec: seconds(result.verifier)
+    }).filter((entry) => entry[1] !== void 0)
+  );
+  return {
+    harbor_trial_id: id,
+    harbor_job_id: jobId,
+    harbor_job_name: job.name,
+    ...str2(source?.trial_id) ? { source_harbor_trial_id: str2(source?.trial_id) } : {},
+    task_name: taskName,
+    task_digest: digest,
+    agent: str2(agentInfo.name) ?? "unknown",
+    ...str2(agentInfo.version) ? { agent_version: str2(agentInfo.version) } : {},
+    ...model ? { model: provider && !model.includes("/") ? `${provider}/${model}` : model } : {},
+    ...effort ? { effort } : {},
+    ...job.harbor_version ? { harbor_version: job.harbor_version } : {},
+    ...exception ? {
+      exception: {
+        type: str2(exception.exception_type) ?? "UnknownError",
+        message: (str2(exception.exception_message) ?? "").slice(0, 2e3)
+      }
+    } : {},
+    ...rewards ? { rewards, criteria: rewardCriteria(details) } : {},
+    ...Object.keys(metrics).length ? { metrics } : {},
+    ...str2(result.started_at) ? { started_at: str2(result.started_at) } : {},
+    ...str2(result.finished_at) ? { finished_at: str2(result.finished_at) } : {},
+    ...scenario ? { scenario } : {}
+  };
+}
+function readHarborJob(jobDir) {
+  if (!existsSync(jobDir) || !statSync(jobDir).isDirectory()) {
+    throw new Error(`${jobDir} is not a directory.`);
+  }
+  const harborVersion = str2(readJson(path.join(jobDir, "lock.json"))?.harbor?.version);
+  const job = {
+    name: path.basename(path.resolve(jobDir)),
+    ...harborVersion ? { harbor_version: harborVersion } : {}
+  };
+  const read = { job, trials: [], trajectories: {}, unreadable: [] };
+  for (const entry of readdirSync(jobDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const dir = path.join(jobDir, entry.name);
+    if (!existsSync(path.join(dir, "result.json")) && !existsSync(path.join(dir, "lock.json"))) {
+      continue;
+    }
+    const trial = readTrial(dir, job);
+    if ("reason" in trial) {
+      read.unreadable.push({ trial: entry.name, reason: trial.reason });
+      continue;
+    }
+    read.trials.push(trial);
+    const trajectory = path.join(dir, "agent", "trajectory.json");
+    if (existsSync(trajectory)) read.trajectories[trial.harbor_trial_id.toLowerCase()] = trajectory;
+  }
+  return read;
+}
+
+// src/owner.ts
+var SECRET_ENV_VAR = "HIVENET_SECRET_KEY";
+async function runAttach(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, ...attachmentFlags() }, { argv });
+  if (args["--help"]) {
+    console.log(`
+  Usage
+    $ npx hivenet attach <record type> <id> --attach <path> [--describe "<what it shows>"] \u2026
+
+  Record types: ${ATTACHMENT_TARGET_TYPES.join(" | ")}.
+  Up to 10 files per record, 20 MiB each. Files on a question are shared with every agent
+  that receives it; everything else stays private. Auth: --secret or ${SECRET_ENV_VAR}.
+`);
+    return;
+  }
+  const target = attachmentTargetSchema.safeParse({ type: args._[0], id: args._[1] });
+  if (!target.success || args._.length !== 2 || !args["--attach"]?.length) {
+    throw new FeedbackError(
+      "Usage: hivenet attach <record type> <id> --attach <path>. See hivenet attach --help."
+    );
+  }
+  const api = await buildApi(args);
+  const result = await api.attachFiles(target.data, args["--attach"]);
+  console.log(
+    args["--json"] ? JSON.stringify(result, null, 2) : `\u2713 Attached ${args["--attach"].length} file(s) to ${target.data.type} ${target.data.id}.`
+  );
+}
+var OWNER_FLAGS = {
+  "--to": String,
+  "--dsn": String,
+  "--api": String,
+  "--registry": String,
+  "--secret": String,
+  "--json": Boolean,
+  "--help": Boolean,
+  "-h": "--help"
+};
+async function buildApi(args) {
+  const secretKey = args["--secret"] ?? process.env[SECRET_ENV_VAR];
+  if (!secretKey?.startsWith("hv_sec_")) {
+    throw new FeedbackError(
+      `An owner secret key is required (hv_sec_\u2026, from your project's Settings).
+Pass --secret <key> or set ${SECRET_ENV_VAR}.`
+    );
+  }
+  const apiOrigin = args["--api"] ?? await resolveApiOrigin({
+    ...args["--to"] !== void 0 ? { to: args["--to"] } : {},
+    ...args["--dsn"] !== void 0 ? { dsn: args["--dsn"] } : {},
+    ...args["--registry"] !== void 0 ? { registry: args["--registry"] } : {}
+  });
+  return {
+    ...ownerApi({ secretKey, apiOrigin }),
+    // Copy the destination into next-step hints, never the owner's credential.
+    command: (subcommand) => `npx hivenet ${subcommand} --api ${JSON.stringify(apiOrigin)}`
+  };
+}
+function statusIcon(status) {
+  return { new: "\u25CF", seen: "\u25D0", in_progress: "\u25D2", resolved: "\u2713", wont_fix: "\u2717", spam: "\u2298" }[status];
+}
+function printEvent(event, verbose = false) {
+  const subject = event.subject ? ` \xB7 ${event.subject}` : "";
+  console.log(
+    `${statusIcon(event.status)} ${event.id}  [${event.status}]  ${event.category}${subject}  (${event.agent ?? event.author ?? "unknown"}, ${event.received_at.slice(0, 16).replace("T", " ")})`
+  );
+  console.log(`    ${event.feedback}`);
+  if (event.triage_note) {
+    console.log(`    \u21B3 note: ${event.triage_note}`);
+  }
+  if (verbose) {
+    console.log(
+      `    thread ${event.thread_id} \xB7 telemetry ${event.consent_telemetry ? "on" : "off"}`
+    );
+  }
+}
+async function runInbox(argv) {
+  const args = (0, import_arg.default)(
+    {
+      ...OWNER_FLAGS,
+      "--status": String,
+      "--category": String,
+      "--thread": String,
+      "--limit": Number
+    },
+    { argv }
+  );
+  if (args["--help"]) {
+    console.log(`
+  Usage
+    $ npx hivenet inbox [--status new] [--category mcp] [--thread <id>] [--limit 50]
+
+  List feedback for your project (owners only). Auth: --secret <hv_sec_\u2026> or
+  ${SECRET_ENV_VAR}. Destination: --to <slug|domain>, --dsn, HIVENET_DSN, or --api <origin>
+  (or --registry / HIVENET_REGISTRY for your instance). Statuses: ${EVENT_STATUSES.join(" | ")}. --json for raw output.
+`);
+    return;
+  }
+  const status = args["--status"];
+  if (status && !EVENT_STATUSES.includes(status)) {
+    throw new FeedbackError(
+      `Invalid --status "${status}". Expected: ${EVENT_STATUSES.join(", ")}.`
+    );
+  }
+  const api = await buildApi(args);
+  const result = await api.listFeedback({
+    ...status ? { status } : {},
+    ...args["--category"] ? { category: args["--category"] } : {},
+    ...args["--thread"] ? { thread: args["--thread"] } : {},
+    ...args["--limit"] ? { limit: args["--limit"] } : {}
+  });
+  if (args["--json"]) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (result.events.length === 0) {
+    console.log(`No matching feedback for ${result.project}.`);
+    return;
+  }
+  console.log(`${result.events.length} event(s) for ${result.project}:
+`);
+  for (const event of result.events) {
+    printEvent(event);
+  }
+  console.log(
+    `
+Triage: ${api.command("triage")} <eventId> --status <${EVENT_STATUSES.join("|")}> [--note "\u2026"]`
+  );
+}
+async function runTriage(argv) {
+  const args = (0, import_arg.default)(
+    { ...OWNER_FLAGS, "--status": String, "--note": String, "--link": String },
+    { argv }
+  );
+  if (args["--help"] || args._.length === 0) {
+    console.log(`
+  Usage
+    $ npx hivenet triage <eventId> [--status <status>] [--note "why"] [--link <url>]
+
+  Set triage status and/or attach an external link (Slack, Linear, GitHub, PR) to a
+  feedback event (owners only). Statuses: ${EVENT_STATUSES.join(" | ")}.
+  Auth: --secret <hv_sec_\u2026> or ${SECRET_ENV_VAR}. Destination: --to/--dsn/--api.
+`);
+    if (!args["--help"]) {
+      throw new FeedbackError("An event ID is required.");
+    }
+    return;
+  }
+  const status = args["--status"];
+  if (status && !EVENT_STATUSES.includes(status)) {
+    throw new FeedbackError(`Invalid --status. Expected: ${EVENT_STATUSES.join(", ")}.`);
+  }
+  if (!status && !args["--link"]) {
+    throw new FeedbackError("Provide --status and/or --link.");
+  }
+  const api = await buildApi(args);
+  const id = args._[0];
+  if (args["--link"]) {
+    await api.addLink(id, args["--link"]);
+  }
+  const event = status ? (await api.setFeedbackStatus(
+    id,
+    status,
+    args["--note"] !== void 0 ? args["--note"] : void 0
+  )).event : (await api.getFeedback(id)).event;
+  if (args["--json"]) {
+    console.log(JSON.stringify({ event }, null, 2));
+    return;
+  }
+  console.log("Updated:");
+  printEvent(event, true);
+  printLinks(event.links_json);
+}
+function printLinks(linksJson) {
+  try {
+    const links = JSON.parse(linksJson ?? "[]");
+    for (const link of links) {
+      console.log(`    \u21C4 ${link.kind}: ${link.url}`);
+    }
+  } catch {
+  }
+}
+function issueIcon(status) {
+  return {
+    open: "\u25CF",
+    in_progress: "\u25D2",
+    needs_review: "\u25CE",
+    resolved: "\u2713",
+    wont_fix: "\u2717",
+    spam: "\u2298"
+  }[status];
+}
+function printIssue(issue) {
+  const regressed = issue.reopened_count > 0 ? `  \u21BB regressed \xD7${issue.reopened_count}` : "";
+  console.log(
+    `${issueIcon(issue.status)} ${issue.id}  [${issue.status}]  ${issue.title}  (${issue.event_count} event${issue.event_count === 1 ? "" : "s"}, last ${issue.last_seen.slice(0, 16).replace("T", " ")})${regressed}`
+  );
+  printLinks(issue.links_json);
+}
+async function runIssues(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, "--status": String, "--limit": Number }, { argv });
+  if (args["--help"]) {
+    console.log(`
+  Usage
+    $ npx hivenet issues [--status open] [--limit 50]
+
+  List issues \u2014 feedback clustered by thread and (category, subject) fingerprint.
+  Statuses: ${ISSUE_STATUSES.join(" | ")}. Auth: --secret or ${SECRET_ENV_VAR}.
+  Manage one: npx hivenet issue <issueId> --status resolved --note "\u2026" --link <url>
+`);
+    return;
+  }
+  const status = args["--status"];
+  if (status && !ISSUE_STATUSES.includes(status)) {
+    throw new FeedbackError(`Invalid --status. Expected: ${ISSUE_STATUSES.join(", ")}.`);
+  }
+  const api = await buildApi(args);
+  const result = await api.listIssues({
+    ...status ? { status } : {},
+    ...args["--limit"] ? { limit: args["--limit"] } : {}
+  });
+  if (args["--json"]) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (result.issues.length === 0) {
+    console.log(`No matching issues for ${result.project}.`);
+    return;
+  }
+  console.log(`${result.issues.length} issue(s) for ${result.project}:
+`);
+  for (const issue of result.issues) {
+    printIssue(issue);
+  }
+}
+async function runIssue(argv) {
+  const args = (0, import_arg.default)(
+    { ...OWNER_FLAGS, "--status": String, "--note": String, "--link": String },
+    { argv }
+  );
+  if (args["--help"] || args._.length === 0) {
+    console.log(`
+  Usage
+    $ npx hivenet issue <issueId>                         (show with events)
+    $ npx hivenet issue <issueId> --status resolved --note "\u2026" --link <url>
+
+  Statuses: ${ISSUE_STATUSES.join(" | ")}. Resolving cascades to member events; new
+  feedback on a resolved issue reopens it. Auth: --secret or ${SECRET_ENV_VAR}.
+`);
+    if (!args["--help"]) {
+      throw new FeedbackError("An issue ID is required.");
+    }
+    return;
+  }
+  const status = args["--status"];
+  if (status && !ISSUE_STATUSES.includes(status)) {
+    throw new FeedbackError(`Invalid --status. Expected: ${ISSUE_STATUSES.join(", ")}.`);
+  }
+  if (args["--note"] !== void 0 && !status) {
+    throw new FeedbackError("--note requires --status.");
+  }
+  const api = await buildApi(args);
+  const id = args._[0];
+  if (args["--link"]) {
+    await api.addLink(id, args["--link"]);
+  }
+  if (status) {
+    await api.setIssueStatus(id, status, args["--note"] !== void 0 ? args["--note"] : void 0);
+  }
+  const { issue, events } = await api.getIssue(id);
+  if (args["--json"]) {
+    console.log(JSON.stringify({ issue, events }, null, 2));
+    return;
+  }
+  printIssue(issue);
+  if (issue.summary) {
+    console.log(`    ${issue.summary}`);
+  }
+  console.log("");
+  for (const event of events) {
+    printEvent(event);
+  }
+}
+function printQuestion(question) {
+  const icon = question.status === "active" ? "\u25CF" : "\u2713";
+  const auto = question.source === "system" ? " [auto]" : "";
+  const target = question.target.category ? ` \xB7 ${question.target.category}` : question.target.issue_id ? ` \xB7 verifies ${question.target.issue_id.slice(0, 14)}\u2026` : "";
+  console.log(`${icon} ${question.id}  [${question.status}]${auto}${target}`);
+  console.log(`    ${question.prompt}`);
+  for (const answer of question.answers) {
+    const who = answer.agent ?? answer.client_name ?? "unknown";
+    console.log(
+      `    \u21B3 (${who}, ${answer.received_at.slice(0, 16).replace("T", " ")}) ${answer.feedback}`
+    );
+  }
+}
+async function runQuestions(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, "--status": String }, { argv });
+  if (args["--help"]) {
+    console.log(`
+  Usage
+    $ npx hivenet questions [--status active|closed]      (list with answers)
+    $ npx hivenet ask "<prompt>" [--category cli]         (publish a question)
+    $ npx hivenet question <id> --close                   (stop delivery)
+
+  Questions ride along with submission responses \u2014 one per response, delivered
+  to matching agents; answers group under each question. Auth: --secret or
+  ${SECRET_ENV_VAR}.
+
+  Show agents what you mean: --attach <path> [--describe "<what it shows>"] on ask
+  (repeatable; 10 files, 20 MiB each). Every agent the question reaches can open them.
+`);
+    return;
+  }
+  const status = args["--status"];
+  if (status && status !== "active" && status !== "closed") {
+    throw new FeedbackError("Invalid --status. Expected: active or closed.");
+  }
+  const api = await buildApi(args);
+  const result = await api.listQuestions(status ? { status } : {});
+  if (args["--json"]) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (result.questions.length === 0) {
+    console.log(`No questions yet. Publish one: ${api.command("ask")} "<prompt>" [--category cli]`);
+    return;
+  }
+  console.log(`${result.questions.length} question(s):
+`);
+  for (const question of result.questions) {
+    printQuestion(question);
+    console.log("");
+  }
+}
+async function runAsk(argv) {
+  const args = (0, import_arg.default)(
+    { ...OWNER_FLAGS, "--category": String, "--idempotency-key": String, ...attachmentFlags() },
+    { argv }
+  );
+  const prompt = args._.join(" ").trim();
+  if (args["--help"] || prompt.length === 0) {
+    console.log(`
+  Usage
+    $ npx hivenet ask "If you used <feature>: what broke or was missing?" [--category cli]
+
+  Publishes a question to the agents using your product. Targeted beats
+  open-ended. Categories: ${FEEDBACK_CATEGORIES.join(" | ")}. Auth: --secret or ${SECRET_ENV_VAR}.
+  --attach <path> [--describe "<what it shows>"] shares a file with every agent that receives it.
+  --idempotency-key <key> publishes the question once however often you retry (8\u201364 letters,
+  digits, _ or -).
+`);
+    if (!args["--help"]) {
+      throw new FeedbackError("A question prompt is required.");
+    }
+    return;
+  }
+  const api = await buildApi(args);
+  const { question } = await api.createQuestion(prompt, args["--category"], {
+    ...args["--attach"] ? { files: args["--attach"] } : {},
+    ...args["--idempotency-key"] ? { idempotencyKey: args["--idempotency-key"] } : {}
+  });
+  if (args["--json"]) {
+    console.log(JSON.stringify({ question }, null, 2));
+    return;
+  }
+  console.log(`\u2713 Question published (${question.id})`);
+  console.log(`  It rides along with matching submission responses \u2014 one ask per response.`);
+  console.log(
+    `  Answers: ${api.command("questions")} \xB7 close: ${api.command("question")} ${question.id} --close`
+  );
+}
+async function runQuestion(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, "--close": Boolean }, { argv });
+  if (args["--help"] || args._.length === 0) {
+    console.log(`
+  Usage
+    $ npx hivenet question <questionId>            (show with answers)
+    $ npx hivenet question <questionId> --close    (stop delivery)
+`);
+    if (!args["--help"]) {
+      throw new FeedbackError("A question ID is required.");
+    }
+    return;
+  }
+  const api = await buildApi(args);
+  const id = args._[0];
+  if (args["--close"]) {
+    await api.closeQuestion(id);
+  }
+  const { questions } = await api.listQuestions();
+  const question = questions.find((candidate) => candidate.id === id);
+  if (!question) {
+    throw new FeedbackError(`Question "${id}" not found.`);
+  }
+  if (args["--json"]) {
+    console.log(JSON.stringify({ question }, null, 2));
+    return;
+  }
+  printQuestion(question);
+}
+function evalIcon(status) {
+  return { proposed: "\u25C7", accepted: "\u25C6", archived: "\u229F" }[status];
+}
+function printEval(entry) {
+  console.log(`${evalIcon(entry.status)} ${entry.id}  [${entry.status}]  ${entry.title}`);
+  console.log(`    task: ${entry.task}`);
+  if (entry.expected) console.log(`    expected: ${entry.expected}`);
+  if (entry.setup) {
+    console.log(`    setup: ${entry.setup}`);
+  } else {
+    console.log(
+      `    setup: missing${entry.setup_pending ? " \u2014 reporter asked on their thread" : ""}`
+    );
+  }
+  if (entry.source) {
+    const who = entry.source.agent ?? entry.source.client_name ?? "unknown";
+    const attempts = entry.source.attempts ? ` \xB7 ${entry.source.attempts} attempts` : "";
+    console.log(`    from ${entry.source.event_id} (${who}${attempts})`);
+  }
+  if (entry.note) console.log(`    \u21B3 note: ${entry.note}`);
+  const version = entry.current_version ?? entry.latest_version;
+  if (version) {
+    const results = entry.results;
+    const runs = results?.graded ? ` \xB7 ${results.passed}/${results.graded} passed` : results?.errored ? ` \xB7 ${results.errored} errored` : " \xB7 no runs yet";
+    const validation = results?.validation.status ?? "unvalidated";
+    console.log(
+      `    runnable: v${version.number} ${entry.current_version ? "approved" : "draft"} \xB7 ${validation}${runs}`
+    );
+  }
+}
+async function runEvals(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, "--status": String }, { argv });
+  if (args["--help"]) {
+    console.log(`
+  Usage
+    $ npx hivenet evals [--status proposed|accepted|archived]   (list the corpus)
+    $ npx hivenet eval <id> [--status accepted] [--note "\u2026"]    (curate one)
+    $ npx hivenet promote <eventId>                             (report \u2192 eval)
+
+  Evals are real tasks agents failed at, promoted from failed-task reports.
+  Use --json for a machine-readable corpus export. Auth: --secret or ${SECRET_ENV_VAR}.
+`);
+    return;
+  }
+  const status = args["--status"];
+  if (status && !EVAL_STATUSES.includes(status)) {
+    throw new FeedbackError(`Invalid --status. Expected: ${EVAL_STATUSES.join(", ")}.`);
+  }
+  const api = await buildApi(args);
+  const result = await api.listEvals(status ? { status } : {});
+  if (args["--json"]) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (result.evals.length === 0) {
+    console.log(`No evals yet. Promote a failed-task report: ${api.command("promote")} <eventId>`);
+    return;
+  }
+  console.log(`${result.evals.length} eval(s):
+`);
+  for (const entry of result.evals) {
+    printEval(entry);
+    console.log("");
+  }
+}
+async function runEval(argv) {
+  if (argv[0] === "draft") return runEvalDraft(argv.slice(1));
+  if (argv[0] === "pull") return runEvalPull(argv.slice(1));
+  if (argv[0] === "push") return runEvalPush(argv.slice(1));
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, "--status": String, "--note": String }, { argv });
+  if (args["--help"] || args._.length === 0) {
+    console.log(`
+  Usage
+    $ npx hivenet eval <evalId>                            (show)
+    $ npx hivenet eval <evalId> --status accepted          (curate)
+    $ npx hivenet eval <evalId> --status archived --note "why"
+    $ npx hivenet eval draft <evalId> --file version.json   (draft a runnable version)
+    $ npx hivenet eval pull [evalId[@N] \u2026] --harbor <dir>  (write Harbor tasks)
+    $ npx hivenet eval push <harbor job dir> \u2026              (send results back)
+
+  Statuses: ${EVAL_STATUSES.join(" | ")}. Auth: --secret or ${SECRET_ENV_VAR}.
+`);
+    if (!args["--help"]) {
+      throw new FeedbackError("An eval ID is required.");
+    }
+    return;
+  }
+  const status = args["--status"];
+  if (status && !EVAL_STATUSES.includes(status)) {
+    throw new FeedbackError(`Invalid --status. Expected: ${EVAL_STATUSES.join(", ")}.`);
+  }
+  if (args["--note"] !== void 0 && !status) {
+    throw new FeedbackError("--note requires --status.");
+  }
+  const api = await buildApi(args);
+  const id = args._[0];
+  if (status) {
+    await api.setEvalStatus(id, status, args["--note"] !== void 0 ? args["--note"] : void 0);
+  }
+  const { eval: entry } = await api.getEval(id);
+  if (args["--json"]) {
+    console.log(JSON.stringify({ eval: entry }, null, 2));
+    return;
+  }
+  printEval(entry);
+}
+async function runPromote(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS }, { argv });
+  if (args["--help"] || args._.length === 0) {
+    console.log(`
+  Usage
+    $ npx hivenet promote <eventId>    (failed-task report \u2192 eval candidate)
+
+  Idempotent per event. When the report lacks reproduction state, the reporter
+  is asked for it on their thread; the answer fills the eval's setup.
+`);
+    if (!args["--help"]) {
+      throw new FeedbackError("An event ID is required.");
+    }
+    return;
+  }
+  const api = await buildApi(args);
+  const { eval: entry, created } = await api.promoteEval(args._[0]);
+  if (args["--json"]) {
+    console.log(JSON.stringify({ eval: entry, created }, null, 2));
+    return;
+  }
+  console.log(created ? `\u2713 Promoted to eval (${entry.id})` : `Already promoted (${entry.id})`);
+  printEval(entry);
+}
+var TEMPLATE = /\$\{([A-Za-z_][A-Za-z0-9_]*)(:-[^}]*)?\}/g;
+function hostEnv(tasks) {
+  const required = /* @__PURE__ */ new Set();
+  const optional = /* @__PURE__ */ new Set();
+  for (const task of tasks) {
+    for (const match of (task.files["task.toml"] ?? "").matchAll(TEMPLATE)) {
+      (match[2] ? optional : required).add(match[1]);
+    }
+  }
+  for (const name of required) optional.delete(name);
+  return { required: [...required].sort(), optional: [...optional].sort() };
+}
+async function runEvalPull(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, "--harbor": String }, { argv });
+  if (args["--help"]) {
+    console.log(`
+  Usage
+    $ npx hivenet eval pull --harbor <dir>                  (every accepted eval, current version)
+    $ npx hivenet eval pull <evalId> [<evalId>@N \u2026] --harbor <dir>
+
+  Writes each eval's compiled Harbor task to <dir>/<evalId>. A ref without @N takes the current
+  version, else the newest draft; @N picks any version, so a draft can be validated before a
+  person approves it in the dashboard. Pulling again replaces <dir>/<evalId>.
+  Auth: --secret or ${SECRET_ENV_VAR}.
+`);
+    return;
+  }
+  const dir = args["--harbor"];
+  if (!dir) {
+    throw new FeedbackError(
+      "Usage: hivenet eval pull [evalId[@N] \u2026] --harbor <dir>. See hivenet eval pull --help."
+    );
+  }
+  const api = await buildApi(args);
+  const { tasks, missing } = await api.pullEvalTasks(args._);
+  const root = path2.resolve(dir);
+  for (const task of tasks) {
+    if (!/^ev_[a-z0-9]+$/.test(task.eval_id)) {
+      throw new FeedbackError(`Refusing to write a task named ${JSON.stringify(task.eval_id)}.`);
+    }
+    const target = path2.join(root, task.eval_id);
+    rmSync(target, { recursive: true, force: true });
+    for (const [file, text] of Object.entries(task.files)) {
+      const full = path2.resolve(target, file);
+      if (!full.startsWith(`${target}${path2.sep}`)) {
+        throw new FeedbackError(`Refusing to write ${file} outside ${target}.`);
+      }
+      mkdirSync(path2.dirname(full), { recursive: true });
+      writeFileSync(full, text);
+      if (file.endsWith(".sh")) chmodSync(full, 493);
+    }
+  }
+  if (args["--json"]) {
+    console.log(
+      JSON.stringify(
+        {
+          dir: root,
+          tasks: tasks.map(({ files: _files, ...task }) => task),
+          missing,
+          env: hostEnv(tasks)
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (!tasks.length) {
+    console.log(
+      args._.length ? "Nothing to pull." : "No approved versions yet. Pull a draft by id (hivenet eval pull ev_\u2026@N --harbor <dir>), or approve one in the dashboard."
+    );
+  }
+  for (const task of tasks) {
+    console.log(
+      `\u2713 ${task.eval_id} v${task.version.number} (${task.version.status}) \u2192 ${path2.join(dir, task.eval_id)}  ${task.title}`
+    );
+  }
+  for (const ref of missing) console.log(`\u2717 ${ref}: no such eval or version`);
+  if (missing.length) process.exitCode = 1;
+  if (!tasks.length) return;
+  const env = hostEnv(tasks);
+  const hasSolution = tasks.some((task) => "solution/solve.sh" in task.files);
+  console.log(`
+  Next
+${hasSolution ? `    harbor run -p ${dir} -a oracle     (validate: the reference solution passes)
+` : ""}    harbor run -p ${dir} -a nop        (validate: doing nothing fails)
+    harbor run -p ${dir} -a claude-code -m anthropic/claude-sonnet-5 -k 3
+    hivenet eval push jobs/<job name>`);
+  if (env.required.length) console.log(`
+  Set on this machine: ${env.required.join(", ")}`);
+  if (env.optional.length) console.log(`  Optional (defaulted): ${env.optional.join(", ")}`);
+}
+function keepLocal(file) {
+  const size = statSync2(file).size;
+  if (size > MAX_TRAJECTORY_BYTES) {
+    return { reason: `over ${MAX_TRAJECTORY_BYTES / 1024 / 1024} MB` };
+  }
+  const text = readFileSync3(file, "utf8");
+  const named = Object.entries(process.env).find(
+    ([name, value]) => SECRET_ENV_NAME.test(name) && value && value.length >= 8 && text.includes(value)
+  );
+  if (named) return { reason: `it contains the value of ${named[0]}` };
+  const secret = SECRET_VALUE_PATTERNS.find(([pattern]) => pattern.test(text));
+  return secret ? { reason: `it contains what looks like ${secret[1]}` } : { text };
+}
+async function runEvalPush(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, "--no-trajectories": Boolean }, { argv });
+  if (args["--help"] || !args._.length) {
+    console.log(`
+  Usage
+    $ npx hivenet eval push <harbor job dir> [<job dir> \u2026] [--no-trajectories]
+
+  Sends each trial's result and grade back to Hivenet: which version it ran (by the task digest
+  in lock.json), the agent, model and scenario, the reward and every criterion, cost and time.
+  Then uploads each trial's trajectory (agent/trajectory.json) so the dashboard and your agents
+  can read why it failed; --no-trajectories keeps them here. In GitHub Actions it also records
+  the repository, commit, branch, pull request and workflow run. Logs stay on this machine.
+  Pushing a job twice stores only what's new. Auth: --secret or ${SECRET_ENV_VAR}.
+`);
+    if (!args["--help"]) throw new FeedbackError("A Harbor job directory is required.");
+    return;
+  }
+  const api = await buildApi(args);
+  const ci = ciContext();
+  const reports = [];
+  const empty = [];
+  for (const jobDir of args._) {
+    const read = readHarborJob(jobDir);
+    if (!read.trials.length) {
+      empty.push(jobDir);
+      process.exitCode = 1;
+      continue;
+    }
+    const summary = {
+      stored: 0,
+      duplicates: 0,
+      skipped: [],
+      trajectories: 0,
+      kept_local: [],
+      runs: []
+    };
+    for (let start = 0; start < read.trials.length; start += MAX_TRIALS_PER_PUSH) {
+      const pushed = await api.pushEvalResults(
+        read.trials.slice(start, start + MAX_TRIALS_PER_PUSH).map((trial) => ({ ...trial, ci }))
+      );
+      summary.stored += pushed.stored;
+      summary.duplicates += pushed.duplicates;
+      summary.skipped.push(...pushed.skipped);
+      for (const run of pushed.runs) {
+        if (!summary.runs.some((known) => known.job_id === run.job_id)) summary.runs.push(run);
+      }
+      if (args["--no-trajectories"]) continue;
+      for (const id of pushed.trajectories) {
+        const file = read.trajectories[id];
+        if (!file) continue;
+        const upload = keepLocal(file);
+        if ("reason" in upload) {
+          summary.kept_local.push({ harbor_trial_id: id, reason: upload.reason });
+          continue;
+        }
+        try {
+          if ((await api.pushTrialTrajectory(id, upload.text)).stored) summary.trajectories += 1;
+        } catch (error) {
+          summary.kept_local.push({
+            harbor_trial_id: id,
+            reason: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+    }
+    reports.push({
+      job: jobDir,
+      trials: read.trials.length,
+      unreadable: read.unreadable,
+      ...summary
+    });
+  }
+  if (args["--json"]) {
+    console.log(JSON.stringify({ jobs: reports, ...empty.length ? { empty } : {} }, null, 2));
+    return;
+  }
+  for (const dir of empty) {
+    console.log(`\u2717 ${dir}: no finished trials here. Pass a job folder, jobs/<job name>.`);
+  }
+  for (const report of reports) {
+    const dupes = report.duplicates ? `, ${report.duplicates} already stored` : "";
+    const trajectories = report.trajectories ? `, ${report.trajectories} trajectories` : "";
+    console.log(`\u2713 ${report.job}: ${report.stored} trial(s) stored${dupes}${trajectories}.`);
+    for (const run of report.runs) console.log(`  \u2192 ${run.url}`);
+    for (const skipped of report.skipped) {
+      console.log(`  skipped ${skipped.task_name}: ${skipped.reason}`);
+    }
+    for (const kept of report.kept_local) {
+      console.log(`  trajectory of ${kept.harbor_trial_id} kept here: ${kept.reason}`);
+    }
+    for (const unreadable of report.unreadable) {
+      console.log(`  unreadable ${unreadable.trial}: ${unreadable.reason}`);
+    }
+  }
+}
+async function runEvalDraft(argv) {
+  const args = (0, import_arg.default)({ ...OWNER_FLAGS, "--file": String }, { argv });
+  if (args["--help"] || args._.length !== 1 || !args["--file"]) {
+    console.log(`
+  Usage
+    $ npx hivenet eval draft <evalId> --file version.json    (or --file - to read stdin)
+
+  Drafts a runnable version: instruction, criteria, environment and an optional solution, as
+  JSON (the draft_eval_version MCP tool takes the same fields; evals.md shows an example).
+  Hivenet compiles it into a Harbor task and prints lint warnings. Identical fields return the
+  existing version. A person approves it in the dashboard. Auth: --secret or ${SECRET_ENV_VAR}.
+`);
+    if (!args["--help"]) {
+      throw new FeedbackError("Usage: hivenet eval draft <evalId> --file version.json.");
+    }
+    return;
+  }
+  let fields;
+  try {
+    const text = args["--file"] === "-" ? readFileSync3(0, "utf8") : readFileSync3(args["--file"], "utf8");
+    fields = JSON.parse(text);
+  } catch (error) {
+    throw new FeedbackError(
+      `Could not read ${args["--file"]} as JSON (${error instanceof Error ? error.message : String(error)}).`
+    );
+  }
+  const api = await buildApi(args);
+  const { version, created } = await api.draftEvalVersion(args._[0], fields);
+  if (args["--json"]) {
+    console.log(JSON.stringify({ version, created }, null, 2));
+    return;
+  }
+  console.log(
+    `${created ? "\u2713 Drafted" : "= Unchanged,"} ${args._[0]} v${version.number} (${version.status}) \xB7 ${version.digest.slice(0, 19)}\u2026`
+  );
+  for (const warning of version.warnings) console.log(`  \u26A0 ${warning}`);
+  console.log(
+    `  Validate it: hivenet eval pull ${args._[0]}@${version.number} --harbor <dir>, then harbor run -a oracle and -a nop.`
+  );
+}
+export {
+  runAsk,
+  runAttach,
+  runEval,
+  runEvals,
+  runInbox,
+  runIssue,
+  runIssues,
+  runPromote,
+  runQuestion,
+  runQuestions,
+  runTriage
+};