kanros share

Upload a completed run to a share endpoint and print the resulting URL. Designed for ad-hoc sharing of a single eval result (a regression investigation, a customer demo) without having to email JSON around.

kanros share [--endpoint <URL>] [--token <TOKEN>] [--anonymize] [--cache-path <PATH>] <RUN_ID>
kanros share [--endpoint <URL>] upload <RUN_ID>
kanros share [--endpoint <URL>] login [--token <kp_…>]
kanros share [--endpoint <URL>] whoami
kanros share logout

There is no default endpoint: nothing is uploaded unless you name one. Every invocation needs --endpoint or the KANROS_SHARE_ENDPOINT environment variable, pointing at your Kanros Cloud endpoint (see Where runs go). --endpoint and --token may be given before or after the subcommand.

Flag / arg	Default	Meaning
`<RUN_ID>`	required	Run UUID or `latest` / `latest~N`.
`--endpoint <URL>`	env `KANROS_SHARE_ENDPOINT` (no default; one of the two is required)	Base URL of the share service.
`--token <TOKEN>`	env `KANROS_SHARE_TOKEN`, then the keyring (`share login`)	Personal API token (`kp_…`) for the share endpoint.
`--anonymize`	off	Strip rendered prompts and provider completions before upload.
`--cache-path <PATH>`	XDG cache dir	Custom history database location.

What it does

Loads the run summary from the local cache database (the same store kanros diff reads from).
If --anonymize is set, redacts free-form text fields. Cell outcomes, assertion results, latency, and provider ids are preserved; only prompts and completions are stripped.
POSTs the (possibly anonymised) summary to <endpoint>/api/runs as JSON, with Authorization: Bearer <token> if a token is configured.
Prints the shareable URL to stdout. Exit code 0 on success; a non-zero code (2) on any failure — no endpoint configured, the local run cannot be resolved, or the upload fails.

Examples

Share the most recent run, with the endpoint set once in the environment:

export KANROS_SHARE_ENDPOINT=https://share.example.com
kanros share latest
# https://share.example.com/r/8c2c5c9e-…

Share a specific run anonymously:

kanros share 8c2c5c9e-… --anonymize --endpoint https://share.example.com

Log in once and let the keyring hold the token. Sign in to the web console, create a personal API token under Account → API tokens (<endpoint>/app#/account), then paste it when prompted — input is hidden on a terminal:

kanros share login --endpoint https://cloud.example.com
# Create an API token at https://cloud.example.com/app#/account (Account → API tokens), then paste it:
# Token:
kanros share whoami --endpoint https://cloud.example.com
# you@example.com (user 3f1c…, via API token 9a2e…)

login validates the token with GET /api/auth/me before storing it in the system keyring (service kanros, account share-token); an invalid, expired or revoked token is rejected and nothing is stored. For scripts and CI, skip the prompt with --token kp_… / KANROS_SHARE_TOKEN, or pipe the token on stdin. kanros share logout deletes the stored token.

Use an explicit token (avoid in shell history when possible):

kanros share latest --token "$(cat ~/.kanros/share-token)"

Where runs go

Shared runs are stored by Kanros Cloud, the hosted service for teams (run history, dashboards, red-team campaigns). Kanros Cloud is not generally available yet — join the design-partner waitlist. Point clients at your Cloud endpoint:

kanros share latest --endpoint https://app.kanros.dev

The upload is a single HTTPS POST with a JSON body; --anonymize (below) strips prompts and completions before anything leaves your machine.

What `--anonymize` redacts

The anonymiser walks the run summary and clears these fields on every cell:

rendered_prompt
completion_response.content
Any provider_error strings that may contain request bodies

It preserves:

provider_id (the family + model, e.g. openai:gpt-4o-mini)
The full assertion list and per-assertion outcomes
latency_ms, cost_usd, token usage
tags: on the test case

Use --anonymize when sharing a run with someone who should see the shape of the regression but not the underlying prompts or completions (customer support tickets, public bug reports, gist threads).

Run identifiers

Identical to kanros diff:

A UUID printed by kanros run.
latest — most recent run.
latest~N — the run made N runs before the most recent.

Notes

Sharing is opt-in per invocation. There is no automatic upload; the client never contacts the share endpoint unless you run kanros share.
The shareable URL is intentionally long and non-guessable. Treat it as a capability — anyone with the URL can view the run.
The share endpoint speaks plain HTTPS with a JSON body; the client is the kanros-share crate.
The --cache-path flag matters in CI: if you ran the original eval with a custom cache path, share needs the same path to find the run.