@hawkeyexl/manni 4.5.0 → 4.6.0

package/dist/{chunk-3R5Y3XOL.js → chunk-APKH2T6E.js}

@@ -3,573 +3,26 @@ import {
   configDir
 } from "./chunk-4TSWU2SU.js";
 import {
-  TracevalsError
-} from "./chunk-UKZNLVJW.js";
-import {
-  EXECUTION_GRANTS,
-  configuredGrants,
-  isExecutionGrant,
-  unknownGrantsMessage
-} from "./chunk-YNHZHSSM.js";
+  MANIFEST_VERSION
+} from "./chunk-CU57HT2E.js";
 import {
   metaProvenanceEntries
-} from "./chunk-3YHAYXBC.js";
+} from "./chunk-GREQKO6M.js";
 import {
   __default4 as __default,
   extractFrontmatter
-} from "./chunk-527HHQPS.js";
-import {
-  FAMILY_CONFIG_NAMES,
-  assertKnownProvider,
-  findConfigFileSync,
-  readConfigFileSync
-} from "./chunk-Q35YIDBV.js";
-import {
-  errorMessage
-} from "./chunk-G3T47CFV.js";
-
-// src/tracevals/calibrate/labels.ts
-import { readFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
-import { Ajv2020 } from "ajv/dist/2020.js";
-import { parse as parseYaml } from "yaml";
-
-// src/tracevals/calibrate/labels-schema.json
-var labels_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "manni:tracevals:calibration-labels",
-  title: "manni tracevals calibration labels",
-  description: "Ground truth for `manni tracevals calibrate`: what a human decided a given eval should have produced on a given trace. A sidecar rather than an eval field, because a label belongs to a corpus and a reviewer, not to the artifact \u2014 and because the eval vocabulary is docmeta's, vendored byte-identical, with `inlineEval` closed to additions (ADR 01010).",
-  type: "object",
-  additionalProperties: false,
-  required: ["version", "labels"],
-  properties: {
-    version: {
-      const: 1,
-      description: "Format version. Pinned so a future shape change is an explicit migration rather than a silently-reinterpreted file."
-    },
-    labels: {
-      type: "array",
-      minItems: 1,
-      description: "One entry per (trace, artifact, eval) you have judged by hand.",
-      items: {
-        type: "object",
-        additionalProperties: false,
-        required: ["trace", "artifact", "eval", "expected"],
-        properties: {
-          trace: {
-            type: "string",
-            minLength: 1,
-            description: "Path to the trace file, resolved against this file's own directory \u2014 not the working directory."
-          },
-          artifact: {
-            type: "string",
-            minLength: 1,
-            description: "Artifact name as the report shows it: a skill name, a subagent_type, or a project-rules filename such as CLAUDE.md."
-          },
-          type: {
-            enum: ["skill", "agent", "project-rules", "slash-command"],
-            description: "Optional disambiguator, needed when one name resolves to two kinds of artifact \u2014 a skill and an agent, or a skill and the slash command that types it. Every `ArtifactType` the resolver can produce belongs here: a label whose type this rejects has no way to name the artifact it means."
-          },
-          eval: {
-            type: "string",
-            minLength: 1,
-            description: "The eval's id. Shorthand entries with no declared id get a positional one (eval-1, eval-2, ...), so labelling those is only as stable as the order they are written in."
-          },
-          expected: {
-            enum: ["pass", "fail", "needs-review"],
-            description: "What you decided. `needs-review` means you found it genuinely ambiguous and want the tool to defer too."
-          },
-          note: {
-            type: "string",
-            description: "Why you decided that. Carried into the disagreement report, where it is the whole reason a disagreement is actionable."
-          }
-        }
-      }
-    }
-  }
-};
-
-// src/tracevals/calibrate/labels.ts
-var labelsSchema = labels_schema_default;
-var DEFAULT_LABELS_FILE = "tracevals/labels.yaml";
-var ajv = new Ajv2020({ allErrors: true });
-var validate = ajv.compile(labelsSchema);
-var labelKey = (traceFile, artifact, evalName, type) => `${traceFile}\0${type ?? ""}\0${artifact}\0${evalName}`;
-function parseLabels(text, file) {
-  let raw;
-  try {
-    raw = parseYaml(text);
-  } catch (err) {
-    throw new TracevalsError(
-      `could not parse ${file}: ${errorMessage(err)}`
-    );
-  }
-  if (raw === null || raw === void 0) {
-    throw new TracevalsError(`invalid labels file ${file}: it is empty`);
-  }
-  if (!validate(raw)) {
-    const detail = (validate.errors ?? []).map((e) => `${e.instancePath || "/"} ${e.message ?? "invalid"}`).join("; ");
-    const empty2 = (validate.errors ?? []).some(
-      (e) => e.instancePath === "/labels" && e.keyword === "minItems"
-    );
-    throw new TracevalsError(
-      empty2 ? `invalid labels file ${file}: it must carry at least one label \u2014 an empty one measures nothing` : `invalid labels file ${file}: ${detail}`
-    );
-  }
-  const base = dirname(resolve(file));
-  const labels = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const entry of raw.labels) {
-    const traceFile = resolve(base, entry.trace);
-    const type = entry.type;
-    const key = labelKey(
-      traceFile,
-      entry.artifact,
-      entry.eval,
-      type
-    );
-    if (seen.has(key)) {
-      throw new TracevalsError(
-        `invalid labels file ${file}: duplicate label for ${entry.artifact ?? "?"} \u203A ${entry.eval ?? "?"} on ${entry.trace ?? "?"}`
-      );
-    }
-    seen.add(key);
-    labels.push({
-      trace: entry.trace,
-      traceFile,
-      artifact: entry.artifact,
-      ...type !== void 0 ? { type } : {},
-      eval: entry.eval,
-      expected: entry.expected,
-      ...entry.note !== void 0 ? { note: entry.note } : {}
-    });
-  }
-  return labels;
-}
-async function loadLabels(file) {
-  let text;
-  try {
-    text = await readFile(file, "utf-8");
-  } catch (err) {
-    throw new TracevalsError(
-      `could not read labels file ${file}: ${errorMessage(err)}`
-    );
-  }
-  return parseLabels(text, file);
-}
-
-// src/tracevals/core/config.ts
-import { Ajv2020 as Ajv20202 } from "ajv/dist/2020.js";
-
-// src/tracevals/core/config-schema.json
-var config_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "manni:tracevals:config",
-  title: "tracevals section of manni.config.yaml",
-  description: "Settings for manni tracevals, held under the `tracevals` key of the config file shared by the manni family of tools. Sibling keys belong to other tools and are not validated here.",
-  type: "object",
-  additionalProperties: false,
-  properties: {
-    provider: {
-      type: "string",
-      minLength: 1,
-      description: "Which provider judges: auto, anthropic, openai, claude-cli, or llama-cpp. Overrides the family's top-level `providers.provider` for tracevals only. Connection settings \u2014 an endpoint, an API key's environment variable, the Claude CLI command \u2014 live in that top-level `providers:` map, never here."
-    },
-    model: {
-      type: "string",
-      minLength: 1,
-      description: "The model within `provider`, which must be named at this level. Unset, the inference library's default for the winning provider is used; manni pins no model id of its own."
-    },
-    judge: {
-      type: "object",
-      additionalProperties: false,
-      properties: {
-        ensembleRuns: { type: "integer", minimum: 1 },
-        temperature: { type: "number", minimum: 0, maximum: 2 },
-        zones: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
-            autoPass: { type: "number", minimum: 0, maximum: 1 },
-            autoFail: { type: "number", minimum: 0, maximum: 1 }
-          }
-        },
-        cacheDir: { type: "string" },
-        maxTurns: { type: "integer", minimum: 1, description: "Stop after this many ensemble runs. A cached ensemble spends none. Unset means unbounded; the remaining evals report `skipped` with the reason `turn budget` rather than aborting the run." },
-        redact: {
-          type: "array",
-          description: "Extra regular expressions scrubbed from the session digest before it is sent to a judge provider. Applied on top of the built-in secret shapes, never instead of them; each source is compiled with the `g` flag, and a match is replaced with `[redacted]`. Pattern matching is best-effort \u2014 --deterministic-only is the only setting that guarantees nothing leaves the machine.",
-          items: { type: "string", minLength: 1 }
-        }
-      }
-    },
-    execution: {
-      type: "object",
-      additionalProperties: false,
-      description: "Operator grant for executing content-authored code.",
-      properties: {
-        allow: {
-          type: "array",
-          items: { enum: ["frontmatter-commands"] },
-          default: ["frontmatter-commands"],
-          description: "Which content-authored code a run may execute. Absent, every grant holds; list fewer to narrow it, or write [] to run none. frontmatter-commands lets `command` evals declared in an artifact's front matter run; without it they report `skipped` with a reason, never `pass`."
-        }
-      }
-    },
-    render: {
-      type: "object",
-      additionalProperties: false,
-      properties: {
-        maxBlockChars: { type: "integer", minimum: 100 },
-        maxTotalChars: {
-          type: "integer",
-          minimum: 1e3,
-          description: "Upper bound on the rendered digest, in characters. The timeline always keeps at least 200 characters, so a very long header can push the digest past this bound by up to 200."
-        }
-      }
-    },
-    history: {
-      type: "object",
-      additionalProperties: false,
-      properties: {
-        file: { type: "string" }
-      }
-    },
-    capture: {
-      type: "object",
-      additionalProperties: false,
-      description: "Session manifests \u2014 sha256 of every instruction artifact plus the git SHA, recorded at session start by `manni tracevals capture` and read back by `run` to make staleness exact instead of an mtime guess. See ADR 01024.",
-      properties: {
-        dir: {
-          type: "string",
-          minLength: 1,
-          description: "Directory manifests are written to and looked for, resolved against the project root. `run` also accepts one placed beside the trace as `<trace>.manifest.json`, and --manifest names one outright."
-        }
-      }
-    },
-    fill: {
-      type: "object",
-      additionalProperties: false,
-      properties: {
-        confidenceThreshold: { type: "number", minimum: 0, maximum: 1 },
-        maxEvalsPerArtifact: { type: "integer", minimum: 1 },
-        temperature: { type: "number", minimum: 0, maximum: 2 },
-        cacheDir: { type: "string" },
-        maxTurns: { type: "integer", minimum: 1, description: "Stop after this many inference calls, one per artifact filled. A cached artifact spends none. Unset means unbounded." }
-      }
-    },
-    calibrate: {
-      type: "object",
-      additionalProperties: false,
-      description: "Settings for `manni tracevals calibrate` \u2014 measuring the tool's verdicts against a human's answers. See ADR 01022.",
-      properties: {
-        labels: {
-          type: "string",
-          minLength: 1,
-          description: "Default labels sidecar, resolved against this config file's directory. Overridden by --labels."
-        },
-        maxFalsePass: {
-          type: "integer",
-          minimum: 0,
-          description: "Fail the calibration run (exit 1) above this many false passes \u2014 labelled fail, judged pass. Unset by default: a calibration run is a measurement, not a gate."
-        },
-        maxFalseFail: {
-          type: "integer",
-          minimum: 0,
-          description: "Fail the calibration run above this many false fails \u2014 labelled pass, judged fail."
-        },
-        maxReview: {
-          type: "integer",
-          minimum: 0,
-          description: "Fail the calibration run above this many needs-review outcomes across the whole corpus."
-        },
-        sweep: {
-          type: "object",
-          additionalProperties: false,
-          description: "Values --sweep tries on each axis, one axis at a time with the others held at their configured value. The corpus is judged once at the largest ensembleRuns here and every cell is re-scored from those cached runs, so the grid costs nothing beyond that one run.",
-          properties: {
-            ensembleRuns: {
-              type: "array",
-              minItems: 1,
-              items: { type: "integer", minimum: 1 }
-            },
-            autoPass: {
-              type: "array",
-              minItems: 1,
-              items: { type: "number", minimum: 0, maximum: 1 }
-            },
-            autoFail: {
-              type: "array",
-              minItems: 1,
-              items: { type: "number", minimum: 0, maximum: 1 }
-            }
-          }
-        }
-      }
-    },
-    failOnReview: { type: "boolean" },
-    plugins: {
-      type: "array",
-      description: "Modules imported before evals are planned, so one calling registerGrader() can add a grader kind the built-ins do not cover. A relative or absolute path resolves against this file's directory, not the working directory; a bare package name resolves the way an import from this file's directory would. Load order is significant: a later entry wins a colliding kind.",
-      items: { type: "string", minLength: 1 }
-    },
-    reportUnusedArtifacts: {
-      type: "boolean",
-      description: "List every skill and agent the session was offered and never used, rather than only counting them. Off by default: a real roster runs to hundreds of skills."
-    }
-  }
-};
-
-// src/tracevals/judge/redact.ts
-var SECRET_NAME = "(?:(?:[A-Za-z0-9]+[_\\-.])*(?:api[_\\-.]?key|access[_\\-.]?key|secret[_\\-.]?key|auth[_\\-.]?token|access[_\\-.]?token|refresh[_\\-.]?token|client[_\\-.]?secret|session[_\\-.]?token|key|token|secret|password|passwd|passphrase|credentials?|authorization)|AWS_[A-Za-z0-9_]+)";
-var REDACTION_PATTERNS = [
-  {
-    label: "private-key",
-    pattern: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
-    replacement: "[redacted:private-key]"
-  },
-  {
-    // `sk-`, `sk-ant-…`, `pk-`, `rk-`: the OpenAI/Anthropic/Stripe family.
-    label: "api-key",
-    pattern: /\b[sprk]k-(?:[A-Za-z0-9]+-)*[A-Za-z0-9_-]{16,}/g,
-    replacement: "[redacted:api-key]"
-  },
-  {
-    label: "aws-access-key-id",
-    pattern: /\b(?:AKIA|ASIA|AROA|AIDA)[0-9A-Z]{16}\b/g,
-    replacement: "[redacted:aws-access-key-id]"
-  },
-  {
-    label: "github-token",
-    pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g,
-    replacement: "[redacted:github-token]"
-  },
-  {
-    label: "slack-token",
-    pattern: /\bxox[abeoprs]-[A-Za-z0-9-]{10,}/g,
-    replacement: "[redacted:slack-token]"
-  },
-  {
-    label: "google-api-key",
-    pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
-    replacement: "[redacted:google-api-key]"
-  },
-  {
-    label: "jwt",
-    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
-    replacement: "[redacted:jwt]"
-  },
-  {
-    // `Authorization: Bearer …`, `Basic …`, `Token …`. The scheme is kept so
-    // the judge can still see that authentication happened.
-    //
-    // Deliberately *not* case-insensitive as a whole: `basic` and `token` are
-    // ordinary English words, and `/i` would redact "basic configuration" as an
-    // auth header. `bearer` is not, so it gets both spellings.
-    label: "auth-token",
-    pattern: /\b([Bb]earer|Basic|Token)\s+[A-Za-z0-9\-._~+/]{12,}={0,2}/g,
-    replacement: "$1 [redacted:auth-token]"
-  },
-  {
-    // JSON member — the shape a tool input renders as.
-    label: "secret-member",
-    pattern: new RegExp(`("${SECRET_NAME}"\\s*:\\s*)"[^"]*"`, "gi"),
-    replacement: '$1"[redacted:secret-value]"'
-  },
-  {
-    // Shell / `.env` assignment. The variable name is kept: knowing that a
-    // secret was set, and which one, is often the adherence question.
-    label: "secret-assignment",
-    pattern: new RegExp(
-      `\\b(${SECRET_NAME})(\\s*=\\s*)(?:"[^"\\n]*"|'[^'\\n]*'|[^\\s"'\\n]+)`,
-      "gi"
-    ),
-    replacement: "$1$2[redacted:secret-value]"
-  }
-];
-var CUSTOM_PLACEHOLDER = "[redacted]";
-function makeRedactor(extra = []) {
-  const custom = compileRedactPatterns(extra).map(
-    (pattern) => [pattern, CUSTOM_PLACEHOLDER]
-  );
-  const all = [
-    ...REDACTION_PATTERNS.map(
-      ({ pattern, replacement }) => [pattern, replacement]
-    ),
-    ...custom
-  ];
-  return (text) => {
-    let out = text;
-    for (const [pattern, replacement] of all) {
-      out = out.replace(pattern, replacement);
-    }
-    return out;
-  };
-}
-function compileRedactPatterns(sources) {
-  return sources.map((source) => {
-    try {
-      return new RegExp(source, "g");
-    } catch (err) {
-      throw new TracevalsError(
-        `invalid config: judge.redact pattern ${JSON.stringify(source)} is not a valid regular expression: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  });
-}
-
-// src/tracevals/capture/types.ts
-var MANIFEST_VERSION = 1;
-var DEFAULT_CAPTURE_DIR = ".manni/tracevals/sessions";
-
-// src/tracevals/core/config.ts
-var configSchema = config_schema_default;
-var DEFAULT_CONFIG_FILENAME = FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml";
-var CONFIG_SECTION_KEY = "tracevals";
-var CONFIG_SECTION_KEY_PATH = `/${CONFIG_SECTION_KEY}`;
-var CONFIG_FILE = {
-  section: CONFIG_SECTION_KEY,
-  legacyNames: [],
-  toError: (message) => new TracevalsError(message)
-};
-var ajv2 = new Ajv20202({ allErrors: true, verbose: true });
-var validate2 = ajv2.compile(configSchema);
-function camelCaseHint(key, parentSchema) {
-  const camel = key.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
-  if (camel === key || parentSchema === null || typeof parentSchema !== "object") {
-    return "";
-  }
-  const properties = parentSchema.properties;
-  return properties !== null && typeof properties === "object" && Object.hasOwn(properties, camel) ? `; did you mean "${camel}"?` : "";
-}
-function movedProviderHint(instancePath, keyword) {
-  return instancePath === "/provider" && keyword === "type" ? `; "provider" is now a provider name; per-provider settings moved to the top-level providers: map` : "";
-}
-function parseConfig(raw, file = {}) {
-  const source = file.source ?? DEFAULT_CONFIG_FILENAME;
-  const unknownGrants = configuredGrants(raw).filter((g) => !isExecutionGrant(g));
-  if (unknownGrants.length > 0) {
-    throw new TracevalsError(`${source}: ${unknownGrantsMessage(unknownGrants)}`);
-  }
-  if (!validate2(raw)) {
-    const detail = (validate2.errors ?? []).map((e) => {
-      const extra = e.keyword === "additionalProperties" ? e.params.additionalProperty : void 0;
-      return extra !== void 0 ? `unknown key "${extra}"${camelCaseHint(extra, e.parentSchema)}` : `${CONFIG_SECTION_KEY_PATH}${e.instancePath} ${e.message ?? "is invalid"}` + movedProviderHint(e.instancePath, e.keyword);
-    }).join("; ");
-    throw new TracevalsError(`${source}: ${detail}`);
-  }
-  const r = raw;
-  const provider = r.provider ?? null;
-  if (provider !== null) {
-    assertKnownProvider(provider, (message) => new TracevalsError(message));
-  }
-  const config = {
-    provider,
-    model: r.model ?? null,
-    providers: file.providers ?? {},
-    configSource: source,
-    judge: {
-      ensembleRuns: r.judge?.ensembleRuns ?? 3,
-      temperature: r.judge?.temperature ?? 0,
-      zones: {
-        autoPass: r.judge?.zones?.autoPass ?? 0.8,
-        autoFail: r.judge?.zones?.autoFail ?? 0.8
-      },
-      cacheDir: r.judge?.cacheDir ?? ".manni/tracevals/cache",
-      // `null`, not a number: unbounded is a state, and any number here would
-      // be a ceiling nobody asked for.
-      maxTurns: r.judge?.maxTurns ?? null,
-      // Always a list: the render site concatenates nothing onto it, but a
-      // hole here would be a special case in every consumer.
-      redact: [...r.judge?.redact ?? []]
-    },
-    render: {
-      maxBlockChars: r.render?.maxBlockChars ?? 2e3,
-      maxTotalChars: r.render?.maxTotalChars ?? 15e4
-    },
-    execution: { allow: [...r.execution?.allow ?? EXECUTION_GRANTS] },
-    history: {
-      file: r.history?.file ?? ".manni/tracevals/history.jsonl"
-    },
-    capture: {
-      // Beside the judge cache, under the state directory that already travels
-      // with the project — which is what puts a manifest next to its trace in
-      // the CI patterns the docs describe.
-      dir: r.capture?.dir ?? DEFAULT_CAPTURE_DIR
-    },
-    fill: {
-      // 0.7 matches the manuscript's calibration bar for judged agreement.
-      confidenceThreshold: r.fill?.confidenceThreshold ?? 0.7,
-      maxEvalsPerArtifact: r.fill?.maxEvalsPerArtifact ?? 8,
-      temperature: r.fill?.temperature ?? 0,
-      // Separate from the judge cache: different key scheme and value shape.
-      cacheDir: r.fill?.cacheDir ?? ".manni/tracevals/cache/fill",
-      maxTurns: r.fill?.maxTurns ?? null
-    },
-    calibrate: {
-      labels: r.calibrate?.labels ?? DEFAULT_LABELS_FILE,
-      sweep: {
-        // Spans the range rather than filling it: the first sweep judges the
-        // corpus at the largest value here, so a wide grid is the one part of
-        // calibration that does cost money.
-        ensembleRuns: [...r.calibrate?.sweep?.ensembleRuns ?? [1, 3, 5]],
-        autoPass: [
-          ...r.calibrate?.sweep?.autoPass ?? [0.5, 0.6, 0.7, 0.8, 0.9, 0.95]
-        ],
-        autoFail: [
-          ...r.calibrate?.sweep?.autoFail ?? [0.5, 0.6, 0.7, 0.8, 0.9, 0.95]
-        ]
-      }
-    },
-    failOnReview: r.failOnReview ?? true,
-    // Always a list, never undefined: the read site concatenates `--require`
-    // onto it, and a hole there would be a special case in every caller.
-    plugins: [...r.plugins ?? []],
-    // An observation, not a gate: listing it is opt-in because a real roster
-    // runs to hundreds of skills (ADR 01016).
-    reportUnusedArtifacts: r.reportUnusedArtifacts ?? false
-  };
-  compileRedactPatterns(config.judge.redact);
-  for (const key of ["maxFalsePass", "maxFalseFail", "maxReview"]) {
-    if (typeof r.calibrate?.[key] === "number") {
-      config.calibrate[key] = r.calibrate[key];
-    }
-  }
-  return config;
-}
-async function discoverConfig(dir = process.cwd(), lookup = {}) {
-  if (lookup.noConfig === true) {
-    return { config: parseConfig({}), dir, collections: [] };
-  }
-  const file = await Promise.resolve().then(
-    () => lookup.configPath === void 0 ? findConfigFileSync(dir, CONFIG_FILE) : readConfigFileSync(lookup.configPath, dir, CONFIG_FILE)
-  );
-  if (file === null) return { config: parseConfig({}), dir, collections: [] };
-  return {
-    config: parseConfig(file.value ?? {}, {
-      source: file.source,
-      ...file.providers !== void 0 ? { providers: file.providers } : {}
-    }),
-    dir: file.dir,
-    collections: file.collections,
-    path: file.path
-  };
-}
-async function loadConfig(dir = process.cwd(), lookup = {}) {
-  return (await discoverConfig(dir, lookup)).config;
-}
+} from "./chunk-KCOFEWV5.js";
 
 // src/tracevals/capture/manifest.ts
 import { createHash } from "node:crypto";
-import { mkdir, readFile as readFile2, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import {
-  dirname as dirname2,
+  dirname,
   extname,
   isAbsolute,
   join,
   relative,
-  resolve as resolve2,
+  resolve,
   sep
 } from "node:path";
 function sha256Hex(data) {
@@ -577,13 +30,13 @@ function sha256Hex(data) {
 }
 async function hashFile(path) {
   try {
-    return sha256Hex(await readFile2(path));
+    return sha256Hex(await readFile(path));
   } catch {
     return null;
   }
 }
 function relPosix(root, path) {
-  const rel = relative(resolve2(root), resolve2(path));
+  const rel = relative(resolve(root), resolve(path));
   if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) return null;
   return rel.split(sep).join("/");
 }
@@ -600,7 +53,7 @@ function siblingManifestPath(tracePath) {
   return `${stem}.manifest.json`;
 }
 async function writeManifest(path, manifest) {
-  await mkdir(dirname2(resolve2(path)), { recursive: true });
+  await mkdir(dirname(resolve(path)), { recursive: true });
   await writeFile(path, `${JSON.stringify(manifest, null, 2)}
 `, "utf-8");
 }
@@ -614,7 +67,7 @@ function isManifestArtifact(value) {
 async function readManifest(path) {
   let raw;
   try {
-    raw = await readFile2(path, "utf-8");
+    raw = await readFile(path, "utf-8");
   } catch {
     return null;
   }
@@ -648,11 +101,11 @@ async function findManifest(options) {
     if (options.sessionId !== void 0) {
       candidates.push(
         manifestPathFor(
-          resolve2(dirname2(options.tracePath), options.captureDir),
+          resolve(dirname(options.tracePath), options.captureDir),
           options.sessionId
         ),
         manifestPathFor(
-          resolve2(options.projectDir, options.captureDir),
+          resolve(options.projectDir, options.captureDir),
           options.sessionId
         )
       );
@@ -993,8 +446,8 @@ function firstLine(description) {
 }
 
 // src/tracevals/artifacts/fs.ts
-import { access, readdir, readFile as readFile3, stat } from "node:fs/promises";
-import { dirname as dirname3, join as join2, resolve as resolve3, sep as sep2 } from "node:path";
+import { access, readdir, readFile as readFile2, stat } from "node:fs/promises";
+import { dirname as dirname2, join as join2, resolve as resolve2, sep as sep2 } from "node:path";
 function segments(path) {
   return path.split(sep2).join("/").split("/");
 }
@@ -1010,14 +463,14 @@ var PRUNED_DIRS = /* @__PURE__ */ new Set([
   ".venv"
 ]);
 async function findGitRoot(start) {
-  let current = resolve3(start);
+  let current = resolve2(start);
   for (let depth = 0; depth < 64; depth += 1) {
     try {
       await access(join2(current, ".git"));
       return current;
     } catch {
     }
-    const parent = dirname3(current);
+    const parent = dirname2(current);
     if (parent === current) return null;
     current = parent;
   }
@@ -1025,7 +478,7 @@ async function findGitRoot(start) {
 }
 async function safeRead(path) {
   try {
-    return await readFile3(path, "utf-8");
+    return await readFile2(path, "utf-8");
   } catch {
     return null;
   }
@@ -1074,12 +527,12 @@ async function listInTree(root, match, options = {}) {
       }
     }
   }
-  await walk(resolve3(root), 0);
+  await walk(resolve2(root), 0);
   return found.sort();
 }
 
 // src/tracevals/artifacts/resolve.ts
-import { basename, dirname as dirname4, join as join3, resolve as resolve4 } from "node:path";
+import { basename, dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
 var PROJECT_RULES_FILENAMES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -1094,9 +547,9 @@ var BUILTIN_AGENTS = /* @__PURE__ */ new Set([
   "fork"
 ]);
 async function resolveArtifacts(trace, options = {}) {
-  const projectDir = resolve4(options.projectDir ?? trace.cwd);
+  const projectDir = resolve3(options.projectDir ?? trace.cwd);
   const userDir = configDir(options.env);
-  const projectRoot = resolve4(
+  const projectRoot = resolve3(
     options.projectRoot ?? await findGitRoot(projectDir) ?? projectDir
   );
   const artifacts = [];
@@ -1375,7 +828,7 @@ async function resolveSkill(name, projectDir, userDir) {
   tried.push(join3(pluginRoot, "**", "skills", shortName, "SKILL.md"));
   const found = await findInTree(
     pluginRoot,
-    (path) => basename(path) === "SKILL.md" && basename(dirname4(path)) === shortName && (pluginName === null || hasPathSegment(path, pluginName))
+    (path) => basename(path) === "SKILL.md" && basename(dirname3(path)) === shortName && (pluginName === null || hasPathSegment(path, pluginName))
   );
   if (found) {
     const content = await safeRead(found);
@@ -1472,7 +925,7 @@ async function resolveProjectRules(projectDir, projectRoot) {
   for (let depth = 0; depth < 32; depth += 1) {
     dirs.push(current);
     if (current === projectRoot) break;
-    const parent = dirname4(current);
+    const parent = dirname3(current);
     if (parent === current) break;
     current = parent;
   }
@@ -1497,12 +950,12 @@ async function resolveProjectRules(projectDir, projectRoot) {
 }
 
 // src/tracevals/evals/schema.ts
-import { Ajv2020 as Ajv20203 } from "ajv/dist/2020.js";
+import { Ajv2020 } from "ajv/dist/2020.js";
 var artifactEvalsSchema = __default;
 var ARTIFACT_EVALS_SCHEMA_ID = __default.$id;
-var ajv3 = new Ajv20203({ allErrors: true, allowUnionTypes: true });
-ajv3.addKeyword({ keyword: "x-manni-location" });
-var validateArtifact = ajv3.compile(artifactEvalsSchema);
+var ajv = new Ajv2020({ allErrors: true, allowUnionTypes: true });
+ajv.addKeyword({ keyword: "x-manni-location" });
+var validateArtifact = ajv.compile(artifactEvalsSchema);
 function subjectOf(e) {
   switch (e.keyword) {
     case "required":
@@ -1684,21 +1137,6 @@ function anchorList(raw) {
 }
 
 export {
-  REDACTION_PATTERNS,
-  CUSTOM_PLACEHOLDER,
-  makeRedactor,
-  compileRedactPatterns,
-  MANIFEST_VERSION,
-  DEFAULT_CAPTURE_DIR,
-  DEFAULT_LABELS_FILE,
-  labelKey,
-  parseLabels,
-  loadLabels,
-  DEFAULT_CONFIG_FILENAME,
-  CONFIG_SECTION_KEY,
-  parseConfig,
-  discoverConfig,
-  loadConfig,
   newAvailability,
   availableAt,
   offeredNames,
@@ -1730,4 +1168,4 @@ export {
   ARTIFACT_EVALS_SCHEMA_ID,
   extractEvals
 };
-//# sourceMappingURL=chunk-3R5Y3XOL.js.map
+//# sourceMappingURL=chunk-APKH2T6E.js.map