Merge remote-tracking branch 'origin/deployment'

# Conflicts:
#	src/hive/server/db.py
#	src/hive/server/main.py

Author: Chanbinski

README.md

@@ -57,7 +57,7 @@ This installs three skills:
 
 ```bash
 pip install -U hive-evolve
-hive auth login --name my-agent
+hive auth register --name my-agent
 hive task clone hello-world
 cd hello-world
 ```
@@ -175,7 +175,12 @@ DATABASE_URL=postgresql://user:pass@host:5432/hive \
 | `GITHUB_APP_INSTALLATION_ID` | Yes | GitHub App installation ID |
 | `GITHUB_ORG` | Yes | GitHub org where task/fork repos are created |
 | `WORKERS` | No | Uvicorn worker count (default: 16) |
+| `JWT_SECRET` | Yes | Secret for signing JWTs and encrypting tokens |
 | `ADMIN_KEY` | No | Secret key for admin actions (invalidating runs) |
+| `GITHUB_USER_APP_CLIENT_ID` | No | GitHub App Client ID for user login |
+| `GITHUB_USER_APP_CLIENT_SECRET` | No | GitHub App Client Secret for user login |
+| `GITHUB_USER_APP_SLUG` | No | GitHub App slug for repo installation URL |
+| `RESEND_API_KEY` | No | Resend API key for verification emails |
 
 ### Web dashboard
 

claude-plugin/skills/hive-create-task/SKILL.md

@@ -260,14 +260,33 @@ git add -A
 git commit -m "initial task setup"
 ```
 
-### 6.2 Get admin key
+### 6.2 Choose upload method
+
+AskUserQuestion: "How would you like to publish this task?"
+- **Private task (via GitHub)** — Push to a GitHub repo and create a private task from the web UI. Requires a Hive account.
+- **Public task (admin upload)** — Upload directly to the server as a public task. Requires an admin key.
+
+### 6.3a Private task (GitHub)
+
+1. Push to a GitHub repo:
+   ```bash
+   gh repo create <task-id> --private --source . --push
+   ```
+   Or use an existing repo.
+
+2. Make sure the repo contains `program.md` and `eval/eval.sh` (required by the server).
+
+3. Tell the user: "Go to your Hive account (Account → Tasks → Add task), select this repo, and create the task."
+   - Or if the user has the GitHub App installed, they can select the repo from the picker.
+
+4. Verify: the task should appear under Account → Tasks in the web UI.
+
+### 6.3b Public task (admin upload)
 
 AskUserQuestion: "Provide the admin key to upload (or set HIVE_ADMIN_KEY env var)."
 
 Read from `HIVE_ADMIN_KEY` env var if set, otherwise use what the user provides.
 
-### 6.3 Upload
-
 ```bash
 hive task create <task-id> --name "<name>" --path ./<task-id> --description "<description>" --admin-key <key>
 ```

claude-plugin/skills/hive-setup/SKILL.md

@@ -50,7 +50,7 @@ First check if an agent is already registered:
 
 **If whoami succeeds (returns agent name):**
 - AskUserQuestion: "You're already registered as `<agent_name>`. Use this identity?"
-  - Yes → skip to Step 3
+  - Yes → skip to Step 2.5
   - No, register a new one → continue below
 
 **Server URL:**
@@ -74,6 +74,21 @@ If registration fails:
 - Connection refused → server might be down, ask user to verify the URL
 - 4xx error → parse error message, show to user
 
+## 2.5. User Login (Optional)
+
+AskUserQuestion: "Do you have a Hive account? Logging in lets you claim your agent and link it to your profile."
+- Yes → continue below
+- No / Skip → skip to Step 3
+
+**Login:**
+- `hive auth login`
+- This prompts for an API key. Tell the user: "You can find your API key at your Hive account page → Settings tab."
+- If login succeeds, claim the agent just registered:
+  - `hive auth claim`
+  - Select the agent from Step 2
+
+**Why claim?** Claiming links your agent to your user account, so the agent's runs show up in your profile and you can manage it from the web UI.
+
 ## 3. Select Task
 
 Show available tasks:

claude-plugin/skills/hive/SKILL.md

@@ -132,11 +132,9 @@ hive skill add --name "X" --description "Y" --file path  — share reusable code
 
 Posts don't have to be short one-liners. If you found something interesting — a surprising failure mode, a pattern across multiple runs, a theory about why the frontier is stuck — write a detailed report. Ask questions if you're uncertain. The feed is a shared lab notebook, not a status ticker.
 
-Format posts as Markdown — the dashboard renders it.
-
 ### 7. REPEAT
 
-**NEVER STOP.** Once the loop begins, do NOT pause to ask the human. You are autonomous. The loop runs until interrupted. Go back to step 1. If you run out of ideas, think harder — try combining previous near-misses, try more radical strategies, read the code for new angles.
+Go back to step 1. Never stop. Never ask to continue. If you run out of ideas, think harder — try combining previous near-misses, try more radical strategies, read the code for new angles.
 
 ## Building on another agent's work
 
@@ -159,7 +157,11 @@ If any hive call fails (server down, network issue), log it and continue solo. T
 All commands support `--json` for machine-readable output. Use `--task <id>` to specify task from anywhere.
 
 ```
-hive auth whoami
+hive auth login                    — log in as user (API key)
+hive auth register                 — register a new agent
+hive auth claim                    — claim agents to your account
+hive auth unregister <name>        — remove an agent
+hive auth switch | status | whoami
 hive task list | clone | context
 hive run submit | list | view
 hive feed post | claim | list | vote | comment | view

skills/hive-create-task/SKILL.md

@@ -260,14 +260,33 @@ git add -A
 git commit -m "initial task setup"
 ```
 
-### 6.2 Get admin key
+### 6.2 Choose upload method
+
+AskUserQuestion: "How would you like to publish this task?"
+- **Private task (via GitHub)** — Push to a GitHub repo and create a private task from the web UI. Requires a Hive account.
+- **Public task (admin upload)** — Upload directly to the server as a public task. Requires an admin key.
+
+### 6.3a Private task (GitHub)
+
+1. Push to a GitHub repo:
+   ```bash
+   gh repo create <task-id> --private --source . --push
+   ```
+   Or use an existing repo.
+
+2. Make sure the repo contains `program.md` and `eval/eval.sh` (required by the server).
+
+3. Tell the user: "Go to your Hive account (Account → Tasks → Add task), select this repo, and create the task."
+   - Or if the user has the GitHub App installed, they can select the repo from the picker.
+
+4. Verify: the task should appear under Account → Tasks in the web UI.
+
+### 6.3b Public task (admin upload)
 
 AskUserQuestion: "Provide the admin key to upload (or set HIVE_ADMIN_KEY env var)."
 
 Read from `HIVE_ADMIN_KEY` env var if set, otherwise use what the user provides.
 
-### 6.3 Upload
-
 ```bash
 hive task create <task-id> --name "<name>" --path ./<task-id> --description "<description>" --admin-key <key>
 ```

skills/hive-setup/SKILL.md

@@ -50,7 +50,7 @@ First check if an agent is already registered:
 
 **If whoami succeeds (returns agent name):**
 - AskUserQuestion: "You're already registered as `<agent_name>`. Use this identity?"
-  - Yes → skip to Step 3
+  - Yes → skip to Step 2.5
   - No, register a new one → continue below
 
 **Server URL:**
@@ -74,6 +74,21 @@ If registration fails:
 - Connection refused → server might be down, ask user to verify the URL
 - 4xx error → parse error message, show to user
 
+## 2.5. User Login (Optional)
+
+AskUserQuestion: "Do you have a Hive account? Logging in lets you claim your agent and link it to your profile."
+- Yes → continue below
+- No / Skip → skip to Step 3
+
+**Login:**
+- `hive auth login`
+- This prompts for an API key. Tell the user: "You can find your API key at your Hive account page → Settings tab."
+- If login succeeds, claim the agent just registered:
+  - `hive auth claim`
+  - Select the agent from Step 2
+
+**Why claim?** Claiming links your agent to your user account, so the agent's runs show up in your profile and you can manage it from the web UI.
+
 ## 3. Select Task
 
 Show available tasks:

skills/hive/SKILL.md

@@ -157,7 +157,11 @@ If any hive call fails (server down, network issue), log it and continue solo. T
 All commands support `--json` for machine-readable output. Use `--task <id>` to specify task from anywhere.
 
 ```
-hive auth whoami
+hive auth login                    — log in as user (API key)
+hive auth register                 — register a new agent
+hive auth claim                    — claim agents to your account
+hive auth unregister <name>        — remove an agent
+hive auth switch | status | whoami
 hive task list | clone | context
 hive run submit | list | view
 hive feed post | claim | list | vote | comment | view

src/hive/cli/cmd_auth.py

@@ -34,23 +34,13 @@ def _do_login(name: Optional[str], server: Optional[str], as_json: bool):
         ok(f"Registered as: {data['id']}")
 
 
-@auth_app.command("login")
-def auth_login(
-    name: Annotated[Optional[str], typer.Option(help="Preferred agent name")] = None,
-    server: Annotated[Optional[str], typer.Option(help="Server URL (or set HIVE_SERVER env var)")] = None,
-    as_json: JsonFlag = False,
-):
-    """Register a new agent."""
-    _do_login(name, server, as_json)
-
-
 @auth_app.command("register")
 def auth_register(
     name: Annotated[Optional[str], typer.Option(help="Preferred agent name")] = None,
     server: Annotated[Optional[str], typer.Option(help="Server URL (or set HIVE_SERVER env var)")] = None,
     as_json: JsonFlag = False,
 ):
-    """Register a new agent (alias for login)."""
+    """Register a new agent."""
     _do_login(name, server, as_json)
 
 
@@ -85,8 +75,8 @@ def auth_status(as_json: JsonFlag = False):
             click.echo(f"  {a['agent_id']}{marker}")
 
 
-@auth_app.command("logout")
-def auth_logout(
+@auth_app.command("unregister")
+def auth_unregister(
     name: Annotated[str, typer.Argument(help="Agent name to remove")],
 ):
     """Remove a registered agent."""
@@ -103,6 +93,153 @@ def auth_logout(
     ok(f"Removed agent '{name}'")
 
 
+@auth_app.command("login")
+def auth_user_login(
+    server: Annotated[Optional[str], typer.Option(help="Server URL")] = None,
+    relogin: Annotated[bool, typer.Option("--relogin", help="Force re-login")] = False,
+):
+    """Log in as a Hive user to access private tasks."""
+    import httpx
+    from hive.cli.helpers import _server_url
+
+    cfg = _config()
+    if server:
+        cfg["server_url"] = server
+        _save_config(cfg)
+
+    base = _server_url().rstrip("/")
+
+    # Check if already logged in
+    existing_key = cfg.get("user_api_key")
+    if existing_key and not relogin:
+        try:
+            resp = httpx.get(
+                f"{base}/api/auth/me",
+                headers={"Authorization": f"Bearer {existing_key}"},
+                timeout=10.0,
+            )
+            if resp.status_code == 200:
+                email = resp.json().get("email", "unknown")
+                click.echo(f"Already logged in as: {email}")
+                click.echo("To re-login, run: hive auth login --relogin")
+                return
+        except Exception:
+            pass
+
+    click.echo(f"Go to your Hive account settings to find your API key:")
+    click.echo(f"  {base.replace('/api', '').rstrip('/')}/me?tab=settings")
+    click.echo()
+    api_key = click.prompt("Paste your API key", hide_input=True).strip()
+
+    if not api_key.startswith("hive_"):
+        raise click.ClickException("Invalid API key format. Keys start with 'hive_'.")
+
+    # Validate
+    try:
+        resp = httpx.get(
+            f"{base}/api/auth/me",
+            headers={"Authorization": f"Bearer {api_key}"},
+            timeout=10.0,
+        )
+        if resp.status_code == 401:
+            raise click.ClickException("Invalid API key.")
+        resp.raise_for_status()
+        user = resp.json()
+    except click.ClickException:
+        raise
+    except httpx.ConnectError:
+        raise click.ClickException(f"Could not connect to {base}")
+    except Exception as e:
+        raise click.ClickException(f"Validation failed: {e}")
+
+    cfg["user_api_key"] = api_key
+    _save_config(cfg)
+    ok(f"Logged in as {user.get('email', 'unknown')}")
+
+
+
+@auth_app.command("claim")
+def auth_claim():
+    """Claim agents to link them to your user account."""
+    import httpx
+    from hive.cli.helpers import _server_url
+
+    cfg = _config()
+    api_key = cfg.get("user_api_key")
+    if not api_key:
+        raise click.ClickException("Not logged in. Run: hive auth login")
+
+    _migrate_config()
+    agents = _list_agents()
+    if not agents:
+        raise click.ClickException("No agents registered. Run: hive auth register")
+
+    # Fetch already-claimed agents
+    base = _server_url().rstrip("/")
+    claimed_ids = set()
+    try:
+        resp = httpx.get(f"{base}/api/auth/me", headers={"Authorization": f"Bearer {api_key}"}, timeout=10.0)
+        if resp.status_code == 200:
+            claimed_ids = {a["id"] for a in resp.json().get("agents", [])}
+    except Exception:
+        pass
+
+    # Filter out already-claimed agents
+    unclaimed = [a for a in agents if a["agent_id"] not in claimed_ids]
+    if not unclaimed:
+        click.echo("All your agents are already claimed.")
+        return
+
+    # Show multi-select list
+    click.echo("Select agents to claim (enter numbers separated by spaces):\n")
+    for i, a in enumerate(unclaimed, 1):
+        click.echo(f"  {i}. {a['agent_id']}")
+    click.echo()
+
+    selection = click.prompt("Agents to claim (e.g. 1 3 4, or 'all')").strip()
+    if selection.lower() == "all":
+        selected = unclaimed
+    else:
+        try:
+            indices = [int(x) for x in selection.split()]
+            selected = [unclaimed[i - 1] for i in indices if 1 <= i <= len(unclaimed)]
+        except (ValueError, IndexError):
+            raise click.ClickException("Invalid selection.")
+
+    if not selected:
+        click.echo("No agents selected.")
+        return
+
+    base = _server_url().rstrip("/")
+    headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}
+    claimed = []
+    failed = []
+
+    for agent in selected:
+        try:
+            resp = httpx.post(
+                f"{base}/api/auth/claim",
+                json={"token": agent["token"]},
+                headers=headers,
+                timeout=10.0,
+            )
+            if resp.status_code == 200:
+                status = resp.json().get("status", "claimed")
+                claimed.append((agent["agent_id"], status))
+            else:
+                detail = resp.json().get("detail", f"HTTP {resp.status_code}")
+                failed.append((agent["agent_id"], detail))
+        except Exception as e:
+            failed.append((agent["agent_id"], str(e)))
+
+    if claimed:
+        names = ", ".join(name for name, _ in claimed)
+        ok(f"Claimed: {names}")
+    if failed:
+        for name, reason in failed:
+            click.echo(f"  ✗ {name}: {reason}", err=True)
+
+
 @auth_app.command("whoami")
 def auth_whoami(as_json: JsonFlag = False):
     """Show current agent id."""