@tangle-network/traces 0.11.2 → 0.11.3

package/dist/{chunk-UY3M7XUF.js → chunk-CK5F5TWO.js}

@@ -765,9 +765,9 @@ function serializeSpans(spans) {
 }
 async function writeOtlpFile(spans, outPath) {
   const { mkdtemp: mkdtemp8, writeFile: writeFile10 } = await import("fs/promises");
-  const { tmpdir: tmpdir8 } = await import("os");
-  const { join: join31 } = await import("path");
-  const path = outPath ?? join31(await mkdtemp8(join31(tmpdir8(), "traces-")), "spans.otlp.jsonl");
+  const { tmpdir: tmpdir9 } = await import("os");
+  const { join: join33 } = await import("path");
+  const path = outPath ?? join33(await mkdtemp8(join33(tmpdir9(), "traces-")), "spans.otlp.jsonl");
   await writeFile10(path, serializeSpans(spans), "utf8");
   return path;
 }
@@ -5997,9 +5997,9 @@ function normalizeRemote(url) {
 }
 async function readGit(cwd) {
   await stat13(`${cwd}/.git`);
-  const { execFile } = await import("child_process");
-  const { promisify } = await import("util");
-  const run = promisify(execFile);
+  const { execFile: execFile2 } = await import("child_process");
+  const { promisify: promisify2 } = await import("util");
+  const run = promisify2(execFile2);
   const git = async (args) => {
     try {
       const { stdout } = await run("git", ["-C", cwd, ...args], { timeout: 5e3 });
@@ -6025,9 +6025,9 @@ async function readGit(cwd) {
   };
 }
 async function gitOutput(cwd, args) {
-  const { execFile } = await import("child_process");
-  const { promisify } = await import("util");
-  const run = promisify(execFile);
+  const { execFile: execFile2 } = await import("child_process");
+  const { promisify: promisify2 } = await import("util");
+  const run = promisify2(execFile2);
   try {
     const { stdout } = await run("git", ["-C", cwd, ...args], { timeout: 5e3 });
     const v = stdout.trim();
@@ -7141,6 +7141,1084 @@ async function cmdReplayVerify(argv) {
   );
 }
 
+// src/replay-corpus.ts
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join20 } from "path";
+function parseCorpusFlag(value) {
+  const eq = value.indexOf("=");
+  if (eq <= 0) throw new Error(`--corpus must be name=<labels>::<prepared>, got: ${value}`);
+  const name = value.slice(0, eq);
+  const rest = value.slice(eq + 1);
+  const sep2 = rest.indexOf("::");
+  if (sep2 <= 0 || sep2 === rest.length - 2) {
+    throw new Error(`--corpus must be name=<labels>::<prepared>, got: ${value}`);
+  }
+  return { name, labelsPath: rest.slice(0, sep2), preparedDir: rest.slice(sep2 + 2) };
+}
+var SUBMIT_ACTION_SIGNATURE = "COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT";
+function isSubmitAction(action) {
+  return action.includes(SUBMIT_ACTION_SIGNATURE);
+}
+function readLabelEntries(labelsPath) {
+  const parsed = JSON.parse(readFileSync3(labelsPath, "utf8"));
+  if (!Array.isArray(parsed)) throw new Error(`${labelsPath} is not a JSON array of label entries`);
+  for (const entry of parsed) {
+    if (typeof entry.traj_id !== "string") {
+      throw new Error(`${labelsPath} has an entry without a string traj_id`);
+    }
+  }
+  return parsed;
+}
+function goldIncorrectSteps(entry) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const stage of entry.incorrect_stages ?? []) {
+    for (const id of stage.incorrect_step_ids ?? []) ids.add(id);
+  }
+  return [...ids].sort((a, b) => a - b);
+}
+function findRawTrajFiles(sweRawDir) {
+  if (!existsSync2(sweRawDir)) return [];
+  const entries = readdirSync2(sweRawDir, { recursive: true, encoding: "utf8" });
+  return entries.filter((relative5) => relative5.endsWith(".traj.json")).map((relative5) => join20(sweRawDir, relative5)).sort();
+}
+function cwdFromPwdObservation(steps) {
+  for (const step of steps) {
+    if (step.action.trim() !== "pwd") continue;
+    const line = parseObservationOutput(step.observation).split("\n").map((l) => l.trim()).find((l) => l.startsWith("/"));
+    if (line) return line;
+  }
+  return null;
+}
+function taskStatementOf(preparedDir, trajId, raw) {
+  const taskPath = join20(preparedDir, "normalized", trajId, "task.md");
+  if (existsSync2(taskPath)) {
+    const text2 = readFileSync3(taskPath, "utf8").trim();
+    if (text2.length > 0) return text2;
+  }
+  const userMessage = raw.messages?.find((m) => m.role === "user");
+  if (typeof userMessage?.content === "string" && userMessage.content.trim().length > 0) {
+    return userMessage.content.trim();
+  }
+  return null;
+}
+function resolveCaseResources(corpus, trajId) {
+  const sweRawDir = join20(corpus.preparedDir, "extracted", trajId, "swe_raw");
+  const rawFiles = findRawTrajFiles(sweRawDir);
+  if (rawFiles.length === 0) {
+    return { resolved: false, reason: "no-swe-raw-trajectory", detail: sweRawDir };
+  }
+  if (rawFiles.length > 1) {
+    return { resolved: false, reason: "ambiguous-swe-raw-trajectory", detail: rawFiles.join(", ") };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(rawFiles[0], "utf8"));
+  } catch (err) {
+    return {
+      resolved: false,
+      reason: "unreadable-raw-trajectory",
+      detail: `${rawFiles[0]}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const dockerConfig = raw.info?.docker_config;
+  const image = dockerConfig?.base_image;
+  if (typeof image !== "string" || image.length === 0) {
+    return { resolved: false, reason: "no-docker-image", detail: rawFiles[0] };
+  }
+  const stepsPath = join20(corpus.preparedDir, "normalized", trajId, "steps.json");
+  if (!existsSync2(stepsPath)) {
+    return { resolved: false, reason: "missing-steps-json", detail: stepsPath };
+  }
+  const steps = JSON.parse(readFileSync3(stepsPath, "utf8"));
+  const runConfigCwd = raw.info?.config?.environment?.cwd;
+  const dockerCwd = dockerConfig?.cwd;
+  let cwd;
+  let cwdSource;
+  if (typeof runConfigCwd === "string" && runConfigCwd.length > 0) {
+    cwd = runConfigCwd;
+    cwdSource = "run-config";
+  } else if (typeof dockerCwd === "string" && dockerCwd.length > 0) {
+    cwd = dockerCwd;
+    cwdSource = "docker-config";
+  } else {
+    const observed = cwdFromPwdObservation(steps);
+    if (!observed) return { resolved: false, reason: "cwd-underivable" };
+    cwd = observed;
+    cwdSource = "pwd-observation";
+  }
+  const recordedTimeout = raw.info?.config?.environment?.timeout;
+  return {
+    resolved: true,
+    resources: {
+      corpus: corpus.name,
+      trajId,
+      stepsPath,
+      steps,
+      taskStatement: taskStatementOf(corpus.preparedDir, trajId, raw),
+      image,
+      cwd,
+      cwdSource,
+      recordedStepTimeoutMs: typeof recordedTimeout === "number" && recordedTimeout > 0 ? recordedTimeout * 1e3 : null
+    }
+  };
+}
+function enumerateReplayableCases(corpora) {
+  const replayable = [];
+  const excluded = [];
+  let labelEntryCount = 0;
+  for (const corpus of corpora) {
+    for (const entry of readLabelEntries(corpus.labelsPath)) {
+      labelEntryCount += 1;
+      const trajId = entry.traj_id;
+      const resolution = resolveCaseResources(corpus, trajId);
+      if (!resolution.resolved) {
+        excluded.push({ corpus: corpus.name, trajId, reason: resolution.reason, detail: resolution.detail });
+        continue;
+      }
+      const gold = goldIncorrectSteps(entry);
+      if (gold.length === 0) {
+        excluded.push({ corpus: corpus.name, trajId, reason: "no-gold-incorrect-step" });
+        continue;
+      }
+      const resources = resolution.resources;
+      let submitGoldsSkipped = 0;
+      let target = null;
+      let missingGoldId = null;
+      for (const goldId of gold) {
+        const step = resources.steps.find((s) => s.step_id === goldId);
+        if (!step) {
+          missingGoldId = goldId;
+          break;
+        }
+        if (isSubmitAction(step.action)) {
+          submitGoldsSkipped += 1;
+          continue;
+        }
+        target = step;
+        break;
+      }
+      if (missingGoldId !== null) {
+        excluded.push({
+          corpus: corpus.name,
+          trajId,
+          reason: "gold-step-outside-steps",
+          detail: `k=${missingGoldId}, steps=${resources.steps.length}`
+        });
+        continue;
+      }
+      if (!target) {
+        excluded.push({
+          corpus: corpus.name,
+          trajId,
+          reason: "gold-only-submit-step",
+          detail: `${submitGoldsSkipped} gold step(s), all submit commands`
+        });
+        continue;
+      }
+      replayable.push({
+        ...resources,
+        goldIncorrectSteps: gold,
+        k: target.step_id,
+        submitGoldsSkipped,
+        recordedReturncodeAtK: parseRecordedReturncode(target.observation)
+      });
+    }
+  }
+  return { replayable, excluded, labelEntryCount };
+}
+
+// src/replay-fix.ts
+function zaiChatCaller(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  return {
+    async complete(system, user) {
+      const baseCap = options.maxTokens ?? 16384;
+      let lastError = "empty completion content";
+      for (const cap of [baseCap, baseCap * 2]) {
+        const outcome = await callOnce(cap);
+        if (outcome.succeeded) return outcome;
+        lastError = outcome.error;
+        if (!/finish_reason":"length/.test(outcome.error)) return outcome;
+      }
+      return { succeeded: false, error: lastError };
+      async function callOnce(maxTokens) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 18e4);
+        try {
+          const response = await fetchImpl(`${options.baseUrl.replace(/\/$/, "")}/chat/completions`, {
+            method: "POST",
+            headers: {
+              authorization: `Bearer ${options.apiKey}`,
+              "content-type": "application/json"
+            },
+            body: JSON.stringify({
+              model: options.model,
+              messages: [
+                { role: "system", content: system },
+                { role: "user", content: user }
+              ],
+              temperature: 0,
+              max_tokens: maxTokens
+            }),
+            signal: controller.signal
+          });
+          const bodyText = await response.text();
+          if (!response.ok) {
+            return { succeeded: false, error: `HTTP ${response.status}: ${bodyText.slice(0, 400)}` };
+          }
+          const body = JSON.parse(bodyText);
+          if (body.error) {
+            return { succeeded: false, error: String(body.error.message ?? "provider error") };
+          }
+          const content = body.choices?.[0]?.message?.content;
+          if (typeof content !== "string" || content.length === 0) {
+            return { succeeded: false, error: `empty completion content: ${bodyText.slice(0, 400)}` };
+          }
+          const promptTokens = body.usage?.prompt_tokens;
+          const completionTokens = body.usage?.completion_tokens;
+          const usage = typeof promptTokens === "number" && typeof completionTokens === "number" ? { promptTokens, completionTokens } : null;
+          return { succeeded: true, value: { content, usage } };
+        } catch (err) {
+          return { succeeded: false, error: err instanceof Error ? err.message : String(err) };
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+    }
+  };
+}
+function clip(text2, limit) {
+  if (text2.length <= limit) return text2;
+  const half = Math.floor(limit / 2);
+  return `${text2.slice(0, half)}
+\u2026 [${text2.length - limit} chars elided] \u2026
+${text2.slice(-half)}`;
+}
+function renderStep(step, marker) {
+  const rc = parseRecordedReturncode(step.observation);
+  const output = clip(parseObservationOutput(step.observation).trim(), 1600);
+  return [
+    `### step ${step.step_id}${marker}`,
+    "```sh",
+    clip(step.action, 2e3),
+    "```",
+    `returncode: ${rc ?? "none recorded"}`,
+    output.length > 0 ? `output:
+\`\`\`
+${output}
+\`\`\`` : "output: (empty)"
+  ].join("\n");
+}
+function buildFixPrompt(input) {
+  const radius = input.contextRadius ?? 3;
+  const target = input.steps.find((s) => s.step_id === input.k);
+  if (!target) throw new Error(`replay-fix: no step with step_id ${input.k}`);
+  const context = input.steps.filter(
+    (s) => s.step_id !== input.k && Math.abs(s.step_id - input.k) <= radius
+  );
+  const system = [
+    "You repair one failed shell command from a recorded coding-agent trajectory.",
+    "The trajectory replays inside the original docker image; every command runs as a fresh /bin/sh subshell from a fixed working directory.",
+    "You are given the failing step, its recorded output, surrounding steps, and the task statement.",
+    "Reply with exactly ONE corrected shell command (compound commands with && or pipes are fine) inside a single ```sh fenced block.",
+    "The corrected command must accomplish the failing step's intent and exit 0. No prose outside the fenced block."
+  ].join("\n");
+  const user = [
+    "## Task the agent was solving",
+    input.taskStatement ? clip(input.taskStatement, 4e3) : "(no task statement recorded)",
+    "",
+    "## Surrounding steps",
+    ...context.map((s) => renderStep(s, "")),
+    "",
+    "## Failing step to correct",
+    renderStep(target, " (INCORRECT \u2014 correct this one)"),
+    "",
+    "Output the single corrected replacement for the failing step now."
+  ].join("\n");
+  return { system, user };
+}
+function extractFixCommand(content) {
+  const blocks = [...content.matchAll(/```(?:sh|bash|shell)?\n([\s\S]*?)```/g)];
+  const candidate = blocks.length > 0 ? blocks[blocks.length - 1][1] : content;
+  const command = candidate.trim();
+  if (command.length === 0 || command.includes("```")) return null;
+  return command;
+}
+async function generateFixCommand(caller, input) {
+  const { system, user } = buildFixPrompt(input);
+  const outcome = await caller.complete(system, user);
+  if (!outcome.succeeded) return outcome;
+  const command = extractFixCommand(outcome.value.content);
+  if (command === null) {
+    return {
+      succeeded: false,
+      error: `completion carried no usable command: ${clip(outcome.value.content, 300)}`
+    };
+  }
+  return { succeeded: true, value: { command, usage: outcome.value.usage } };
+}
+
+// src/replay-batch.ts
+import { execFile } from "child_process";
+import { createHash as createHash8 } from "crypto";
+import { appendFileSync, mkdirSync as mkdirSync2, mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join21 } from "path";
+import { promisify } from "util";
+import {
+  InMemoryTraceStore as InMemoryTraceStore3,
+  runCounterfactual as runCounterfactual2
+} from "@tangle-network/agent-eval";
+var execFileAsync = promisify(execFile);
+function derivedImageTag(image, cwd) {
+  const digest = createHash8("sha256").update(`${image}
+${cwd}`).digest("hex").slice(0, 12);
+  return `ctb-replay:${digest}-uid1000`;
+}
+function dockerImagePreparer(options = {}) {
+  const pullTimeoutMs = options.pullTimeoutMs ?? 12e5;
+  const buildTimeoutMs = options.buildTimeoutMs ?? 9e5;
+  const imageExists = async (tag) => {
+    try {
+      await execFileAsync("docker", ["image", "inspect", tag], { maxBuffer: 8 * 1024 * 1024 });
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const errorTail = (err) => {
+    const raw = err && typeof err === "object" && "stderr" in err && typeof err.stderr === "string" && err.stderr.length > 0 ? err.stderr : err instanceof Error ? err.message : String(err);
+    return raw.trim().split("\n").slice(-3).join(" | ").slice(0, 400);
+  };
+  return {
+    async ensure(image, cwd) {
+      if (cwd === "/") {
+        if (await imageExists(image)) {
+          return { succeeded: true, value: { derivedImage: image, pulled: false, built: false } };
+        }
+        try {
+          await execFileAsync("docker", ["pull", image], {
+            timeout: pullTimeoutMs,
+            maxBuffer: 32 * 1024 * 1024
+          });
+        } catch (err) {
+          return { succeeded: false, error: `pull ${image}: ${errorTail(err)}` };
+        }
+        return { succeeded: true, value: { derivedImage: image, pulled: true, built: false } };
+      }
+      const derived = derivedImageTag(image, cwd);
+      if (await imageExists(derived)) {
+        return { succeeded: true, value: { derivedImage: derived, pulled: false, built: false } };
+      }
+      let pulled = false;
+      if (!await imageExists(image)) {
+        try {
+          await execFileAsync("docker", ["pull", image], {
+            timeout: pullTimeoutMs,
+            maxBuffer: 32 * 1024 * 1024
+          });
+          pulled = true;
+        } catch (err) {
+          return { succeeded: false, error: `pull ${image}: ${errorTail(err)}` };
+        }
+      }
+      const contextDir = mkdtempSync(join21(tmpdir3(), "ctb-replay-image-"));
+      const quotedCwd = `'${cwd.replaceAll("'", `'\\''`)}'`;
+      writeFileSync2(
+        join21(contextDir, "Dockerfile"),
+        `FROM ${image}
+RUN chown -R 1000:1000 ${quotedCwd}
+`
+      );
+      try {
+        await execFileAsync("docker", ["build", "-t", derived, contextDir], {
+          timeout: buildTimeoutMs,
+          maxBuffer: 32 * 1024 * 1024
+        });
+      } catch (err) {
+        return { succeeded: false, error: `build ${derived} from ${image}: ${errorTail(err)}` };
+      }
+      return { succeeded: true, value: { derivedImage: derived, pulled, built: true } };
+    }
+  };
+}
+function mulberry32(seed) {
+  let state = seed >>> 0;
+  return () => {
+    state = state + 1831565813 >>> 0;
+    let t = state;
+    t = Math.imul(t ^ t >>> 15, t | 1);
+    t ^= t + Math.imul(t ^ t >>> 7, t | 61);
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  };
+}
+function seededSample(items, size, seed) {
+  const pool = [...items];
+  const random = mulberry32(seed);
+  for (let i = pool.length - 1; i > 0; i--) {
+    const j = Math.floor(random() * (i + 1));
+    [pool[i], pool[j]] = [pool[j], pool[i]];
+  }
+  return new Set(pool.slice(0, size));
+}
+function caseOutDirName(row) {
+  return `${row.corpus}--${row.trajId}`.replaceAll(/[^A-Za-z0-9._-]/g, "_").slice(0, 180);
+}
+async function executeArmB(replayCase, fixCommand, backend, signature, stepTimeoutMs, prefixLimit, onProgress) {
+  const store = new InMemoryTraceStore3();
+  const { runId } = await ingestCodeTraceBenchSteps(store, replayCase.steps, replayCase.trajId);
+  const runner = new SandboxCounterfactualRunner(backend, {
+    cwd: replayCase.cwd,
+    stepTimeoutMs,
+    prefixLimit,
+    onProgress
+  });
+  await runCounterfactual2(
+    store,
+    runId,
+    {
+      kind: "custom",
+      at: replayCase.k - 1,
+      describe: "arm-B corrected step",
+      apply: (step) => ({
+        ...step,
+        span: { ...step.span, args: { command: fixCommand } }
+      })
+    },
+    runner
+  );
+  const exec = runner.lastArm;
+  if (!exec) throw new Error("arm B finished without executing the corrected step");
+  const output = `${exec.stdout}
+${exec.stderr}`;
+  return {
+    exitCode: exec.exitCode,
+    prefixExecuted: runner.lastPrefix?.prefixExecuted ?? 0,
+    prefixDivergences: runner.lastPrefix?.prefixDivergences.length ?? 0,
+    failureVanished: exec.exitCode === 0 && (signature ? !output.includes(signature) : true),
+    stdout: exec.stdout,
+    stderr: exec.stderr
+  };
+}
+function rate(numerator, denominator) {
+  return denominator > 0 ? numerator / denominator : null;
+}
+async function runReplayBatch(options) {
+  const onProgress = options.onProgress ?? (() => {
+  });
+  const enumeration = enumerateReplayableCases(options.corpora);
+  let selected = enumeration.replayable;
+  if (options.caseFilter) {
+    selected = selected.filter((c) => c.trajId.includes(options.caseFilter));
+  }
+  if (options.caseLimit !== void 0) selected = selected.slice(0, options.caseLimit);
+  onProgress(
+    `enumerated ${enumeration.labelEntryCount} label entries \u2192 ${enumeration.replayable.length} replayable, ${enumeration.excluded.length} excluded; executing ${selected.length}`
+  );
+  const preparer = options.preparer ?? dockerImagePreparer();
+  const backendFactory = options.backendFactory ?? ((derivedImage) => sandboxReplayBackend({
+    image: derivedImage,
+    apiKey: requireOption2(options.apiKey, "apiKey"),
+    baseUrl: requireOption2(options.baseUrl, "baseUrl"),
+    maxLifetimeSeconds: options.maxLifetimeSeconds ?? 3600
+  }));
+  mkdirSync2(options.out, { recursive: true });
+  const progressPath = join21(options.out, "cases.jsonl");
+  const rows = [];
+  const pullFailures = [];
+  const verdictByTraj = /* @__PURE__ */ new Map();
+  for (const [index, replayCase] of selected.entries()) {
+    const caseStart = Date.now();
+    const label = `[${index + 1}/${selected.length}] ${replayCase.corpus}/${replayCase.trajId}`;
+    onProgress(`${label}: preparing image ${replayCase.image}`);
+    const preparation = await preparer.ensure(replayCase.image, replayCase.cwd);
+    const base = {
+      corpus: replayCase.corpus,
+      trajId: replayCase.trajId,
+      image: replayCase.image,
+      cwd: replayCase.cwd,
+      cwdSource: replayCase.cwdSource,
+      k: replayCase.k,
+      stepCount: replayCase.steps.length,
+      goldIncorrectSteps: replayCase.goldIncorrectSteps,
+      submitGoldsSkipped: replayCase.submitGoldsSkipped,
+      recordedReturncodeAtK: replayCase.recordedReturncodeAtK
+    };
+    if (!preparation.succeeded) {
+      pullFailures.push({
+        corpus: replayCase.corpus,
+        trajId: replayCase.trajId,
+        image: replayCase.image,
+        error: preparation.error
+      });
+      const row = {
+        ...base,
+        derivedImage: null,
+        signature: null,
+        status: "image-unavailable",
+        error: preparation.error,
+        imagePulled: false,
+        imageBuilt: false,
+        prefixExecuted: null,
+        prefixDivergences: null,
+        prefixDivergencePct: null,
+        armAExit: null,
+        armAReturncodeMatch: false,
+        armASignatureMatch: false,
+        replayed: false,
+        fix: null,
+        wallMs: Date.now() - caseStart
+      };
+      rows.push(row);
+      appendFileSync(progressPath, `${JSON.stringify(row)}
+`);
+      onProgress(`${label}: image unavailable \u2014 ${preparation.error}`);
+      continue;
+    }
+    const { derivedImage, pulled, built } = preparation.value;
+    const stepTimeoutMs = options.stepTimeoutMs ?? replayCase.recordedStepTimeoutMs ?? 12e4;
+    const caseOut = join21(options.out, caseOutDirName(replayCase));
+    onProgress(`${label}: arm A on ${derivedImage} (k=${replayCase.k}, timeout ${stepTimeoutMs}ms)`);
+    try {
+      const verdict = await replayVerify({
+        stepsPath: replayCase.stepsPath,
+        image: derivedImage,
+        at: replayCase.k,
+        cwd: replayCase.cwd,
+        out: caseOut,
+        caseId: replayCase.trajId,
+        stepTimeoutMs,
+        prefixLimit: options.prefixLimit,
+        backend: backendFactory(derivedImage),
+        onProgress: (message) => onProgress(`${label}: ${message}`)
+      });
+      verdictByTraj.set(replayCase.trajId, verdict);
+      const divergencePct = verdict.prefixExecuted > 0 ? verdict.prefixDivergences.length / verdict.prefixExecuted * 100 : 0;
+      const returncodeMatch = verdict.recordedReturncode !== null && verdict.armA.exitCode === verdict.recordedReturncode;
+      const row = {
+        ...base,
+        derivedImage,
+        signature: verdict.signature,
+        status: "ok",
+        error: null,
+        imagePulled: pulled,
+        imageBuilt: built,
+        prefixExecuted: verdict.prefixExecuted,
+        prefixDivergences: verdict.prefixDivergences.length,
+        prefixDivergencePct: Number(divergencePct.toFixed(1)),
+        armAExit: verdict.armA.exitCode,
+        armAReturncodeMatch: returncodeMatch,
+        armASignatureMatch: verdict.armA.failureSignatureMatch,
+        replayed: divergencePct <= 10 && returncodeMatch,
+        fix: null,
+        wallMs: Date.now() - caseStart
+      };
+      rows.push(row);
+      appendFileSync(progressPath, `${JSON.stringify(row)}
+`);
+      onProgress(
+        `${label}: armA exit=${verdict.armA.exitCode} rcMatch=${returncodeMatch} divergences=${verdict.prefixDivergences.length}/${verdict.prefixExecuted}`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const row = {
+        ...base,
+        derivedImage,
+        signature: null,
+        status: "replay-error",
+        error: message.slice(0, 500),
+        imagePulled: pulled,
+        imageBuilt: built,
+        prefixExecuted: null,
+        prefixDivergences: null,
+        prefixDivergencePct: null,
+        armAExit: null,
+        armAReturncodeMatch: false,
+        armASignatureMatch: false,
+        replayed: false,
+        fix: null,
+        wallMs: Date.now() - caseStart
+      };
+      rows.push(row);
+      appendFileSync(progressPath, `${JSON.stringify(row)}
+`);
+      onProgress(`${label}: replay error \u2014 ${message.slice(0, 200)}`);
+    }
+  }
+  let llm = null;
+  if (options.fix === "generate") {
+    const caller = options.fixCaller;
+    if (!caller) throw new Error("replay-verify-batch: fix=generate requires a fixCaller");
+    const maxFixCases = options.maxFixCases ?? 30;
+    const seed = options.seed ?? 17;
+    const eligible = rows.filter((r) => r.status === "ok" && r.replayed);
+    const sampled = eligible.length > maxFixCases ? seededSample(eligible, maxFixCases, seed) : new Set(eligible);
+    if (eligible.length > maxFixCases) {
+      onProgress(
+        `fix phase: ${eligible.length} eligible > cap ${maxFixCases}; seeded sample (seed=${seed})`
+      );
+    }
+    let calls = 0;
+    let failures = 0;
+    let promptTokens = 0;
+    let completionTokens = 0;
+    for (const row of eligible) {
+      const index = rows.indexOf(row);
+      if (!sampled.has(row)) {
+        rows[index] = {
+          ...row,
+          fix: {
+            attempted: false,
+            sampledOut: true,
+            command: null,
+            llmError: null,
+            usage: null,
+            armBExit: null,
+            armBPrefixExecuted: null,
+            armBPrefixDivergences: null,
+            failureVanished: null,
+            armBError: null
+          }
+        };
+        continue;
+      }
+      const replayCase = selected.find((c) => c.trajId === row.trajId && c.corpus === row.corpus);
+      const label = `fix ${row.corpus}/${row.trajId}`;
+      onProgress(`${label}: generating corrected command`);
+      calls += 1;
+      const generated = await generateFixCommand(caller, {
+        taskStatement: replayCase.taskStatement,
+        steps: replayCase.steps,
+        k: replayCase.k
+      });
+      if (!generated.succeeded) {
+        failures += 1;
+        rows[index] = {
+          ...row,
+          fix: {
+            attempted: true,
+            sampledOut: false,
+            command: null,
+            llmError: generated.error,
+            usage: null,
+            armBExit: null,
+            armBPrefixExecuted: null,
+            armBPrefixDivergences: null,
+            failureVanished: null,
+            armBError: null
+          }
+        };
+        onProgress(`${label}: LLM failed \u2014 ${generated.error.slice(0, 200)}`);
+        continue;
+      }
+      promptTokens += generated.value.usage?.promptTokens ?? 0;
+      completionTokens += generated.value.usage?.completionTokens ?? 0;
+      const signature = verdictByTraj.get(row.trajId)?.signature ?? null;
+      const stepTimeoutMs = options.stepTimeoutMs ?? replayCase.recordedStepTimeoutMs ?? 12e4;
+      onProgress(`${label}: arm B \u2014 ${generated.value.command.split("\n")[0].slice(0, 120)}`);
+      try {
+        const armB = await executeArmB(
+          replayCase,
+          generated.value.command,
+          backendFactory(row.derivedImage),
+          signature,
+          stepTimeoutMs,
+          options.prefixLimit,
+          (message) => onProgress(`${label}: ${message}`)
+        );
+        rows[index] = {
+          ...row,
+          fix: {
+            attempted: true,
+            sampledOut: false,
+            command: generated.value.command,
+            llmError: null,
+            usage: generated.value.usage,
+            armBExit: armB.exitCode,
+            armBPrefixExecuted: armB.prefixExecuted,
+            armBPrefixDivergences: armB.prefixDivergences,
+            failureVanished: armB.failureVanished,
+            armBError: null
+          }
+        };
+        const caseOut = join21(options.out, caseOutDirName(row));
+        mkdirSync2(caseOut, { recursive: true });
+        writeFileSync2(
+          join21(caseOut, "armB-result.json"),
+          `${JSON.stringify({ command: generated.value.command, ...armB }, null, 2)}
+`
+        );
+        onProgress(`${label}: armB exit=${armB.exitCode} failureVanished=${armB.failureVanished}`);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        rows[index] = {
+          ...row,
+          fix: {
+            attempted: true,
+            sampledOut: false,
+            command: generated.value.command,
+            llmError: null,
+            usage: generated.value.usage,
+            armBExit: null,
+            armBPrefixExecuted: null,
+            armBPrefixDivergences: null,
+            failureVanished: null,
+            armBError: message.slice(0, 500)
+          }
+        };
+        onProgress(`${label}: arm B error \u2014 ${message.slice(0, 200)}`);
+      }
+    }
+    llm = {
+      model: options.fixModelLabel ?? "unknown",
+      calls,
+      failures,
+      promptTokens,
+      completionTokens
+    };
+  }
+  const executedRows = rows.filter((r) => r.status === "ok");
+  const replayed = executedRows.filter((r) => r.replayed);
+  const signatureStrict = executedRows.filter(
+    (r) => r.replayed && r.armASignatureMatch
+  );
+  const armBExecuted = rows.filter((r) => r.fix?.attempted && r.fix.failureVanished !== null);
+  const flipped = armBExecuted.filter((r) => r.fix.failureVanished === true);
+  const armBNonzeroRc = armBExecuted.filter(
+    (r) => r.recordedReturncodeAtK !== null && r.recordedReturncodeAtK !== 0
+  );
+  const flippedNonzeroRc = armBNonzeroRc.filter((r) => r.fix.failureVanished === true);
+  const excludedByReason = {};
+  for (const excluded of enumeration.excluded) {
+    excludedByReason[excluded.reason] = (excludedByReason[excluded.reason] ?? 0) + 1;
+  }
+  const submitGoldsByCorpus = {};
+  const submitEntry = (corpus) => submitGoldsByCorpus[corpus] ??= { submitOnlyCases: 0, goldsSkippedWithinReplayable: 0 };
+  for (const excluded of enumeration.excluded) {
+    if (excluded.reason === "gold-only-submit-step") submitEntry(excluded.corpus).submitOnlyCases += 1;
+  }
+  for (const replayCase of enumeration.replayable) {
+    if (replayCase.submitGoldsSkipped > 0) {
+      submitEntry(replayCase.corpus).goldsSkippedWithinReplayable += replayCase.submitGoldsSkipped;
+    }
+  }
+  const report = {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    corpora: options.corpora.map((c) => ({
+      name: c.name,
+      labelsPath: c.labelsPath,
+      preparedDir: c.preparedDir
+    })),
+    totals: {
+      labelEntries: enumeration.labelEntryCount,
+      replayable: enumeration.replayable.length,
+      executed: selected.length,
+      excludedByReason,
+      submitGoldsByCorpus
+    },
+    headline: {
+      replayabilityRate: {
+        numerator: replayed.length,
+        denominator: selected.length,
+        value: rate(replayed.length, selected.length)
+      },
+      signatureStrictRate: {
+        numerator: signatureStrict.length,
+        denominator: selected.length,
+        value: rate(signatureStrict.length, selected.length)
+      },
+      fixFlipRate: options.fix === "generate" ? {
+        numerator: flipped.length,
+        denominator: armBExecuted.length,
+        value: rate(flipped.length, armBExecuted.length)
+      } : null,
+      fixFlipRateNonzeroRc: options.fix === "generate" ? {
+        numerator: flippedNonzeroRc.length,
+        denominator: armBNonzeroRc.length,
+        value: rate(flippedNonzeroRc.length, armBNonzeroRc.length)
+      } : null
+    },
+    llm,
+    excluded: enumeration.excluded,
+    pullFailures,
+    cases: rows
+  };
+  writeFileSync2(join21(options.out, "batch-report.json"), `${JSON.stringify(report, null, 2)}
+`);
+  writeFileSync2(join21(options.out, "batch-report.md"), renderBatchReport(report));
+  return report;
+}
+function requireOption2(value, name) {
+  if (value === void 0) throw new Error(`replay-verify-batch: ${name} is required`);
+  return value;
+}
+function pct(value) {
+  return value === null ? "\u2014" : `${(value * 100).toFixed(1)}%`;
+}
+function renderBatchReport(report) {
+  const lines = [];
+  const { headline, totals } = report;
+  lines.push("# Replay-verify batch report");
+  lines.push("");
+  lines.push(`Generated ${report.generatedAt}.`);
+  lines.push("");
+  lines.push("## Headline");
+  lines.push("");
+  lines.push(
+    `- **Replayability rate: ${pct(headline.replayabilityRate.value)}** (${headline.replayabilityRate.numerator}/${headline.replayabilityRate.denominator} replayable cases where the prefix replayed with \u226410% returncode divergence AND arm A reproduced the recorded returncode at the gold step k).`
+  );
+  lines.push(
+    `- Signature-strict rate: ${pct(headline.signatureStrictRate.value)} (${headline.signatureStrictRate.numerator}/${headline.signatureStrictRate.denominator}; additionally requires the recorded error substring in arm A output).`
+  );
+  if (headline.fixFlipRate) {
+    lines.push(
+      `- **Fix-flip rate: ${pct(headline.fixFlipRate.value)}** (${headline.fixFlipRate.numerator}/${headline.fixFlipRate.denominator} arm-B-executed cases where the generated fix made the failure vanish).`
+    );
+  }
+  if (headline.fixFlipRateNonzeroRc) {
+    lines.push(
+      `- Fix-flip rate on recorded-rc\u22600 cases: ${pct(headline.fixFlipRateNonzeroRc.value)} (${headline.fixFlipRateNonzeroRc.numerator}/${headline.fixFlipRateNonzeroRc.denominator}; real recorded failures \u2014 a gold step recorded with rc 0 flips vacuously).`
+    );
+  }
+  lines.push("");
+  lines.push("## Enumeration");
+  lines.push("");
+  lines.push(
+    `${totals.labelEntries} label entries across ${report.corpora.length} corpora \u2192 ${totals.replayable} replayable (SWE-style docker image + \u22651 gold incorrect step), ${totals.executed} executed.`
+  );
+  lines.push("");
+  lines.push("| exclusion reason | count |");
+  lines.push("| --- | --- |");
+  for (const [reason, count2] of Object.entries(totals.excludedByReason).sort((a, b) => b[1] - a[1])) {
+    lines.push(`| ${reason} | ${count2} |`);
+  }
+  const submitEntries = Object.entries(totals.submitGoldsByCorpus);
+  if (submitEntries.length > 0) {
+    lines.push("");
+    lines.push(
+      "Submit-command golds are never counterfactual targets (a gold on the submit step marks a bad submit decision, not a failed command):"
+    );
+    lines.push("");
+    lines.push("| corpus | cases excluded (all golds = submit) | golds skipped within replayable cases |");
+    lines.push("| --- | --- | --- |");
+    for (const [corpus, stats] of submitEntries.sort((a, b) => a[0].localeCompare(b[0]))) {
+      lines.push(`| ${corpus} | ${stats.submitOnlyCases} | ${stats.goldsSkippedWithinReplayable} |`);
+    }
+  }
+  if (report.pullFailures.length > 0) {
+    lines.push("");
+    lines.push("## Image pull/build failures");
+    lines.push("");
+    lines.push("| corpus | trajectory | image | error |");
+    lines.push("| --- | --- | --- | --- |");
+    for (const failure of report.pullFailures) {
+      lines.push(
+        `| ${failure.corpus} | ${failure.trajId} | \`${failure.image}\` | ${failure.error.replaceAll("|", "\\|")} |`
+      );
+    }
+  }
+  lines.push("");
+  lines.push("## Per-case results");
+  lines.push("");
+  lines.push(
+    "| corpus | trajectory | k | rc@k | prefix | div | div% | armA exit | rc match | sig match | replayed | fix | armB exit | vanished | wall s |"
+  );
+  lines.push(
+    "| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |"
+  );
+  for (const row of report.cases) {
+    const fix = row.fix;
+    const fixCell = !fix ? "\u2014" : fix.sampledOut ? "sampled-out" : fix.llmError ? "llm-failed" : fix.armBError ? "armB-error" : "generated";
+    lines.push(
+      [
+        row.corpus,
+        row.trajId.length > 48 ? `${row.trajId.slice(0, 45)}\u2026` : row.trajId,
+        row.k,
+        row.recordedReturncodeAtK ?? "null",
+        row.prefixExecuted ?? "\u2014",
+        row.prefixDivergences ?? "\u2014",
+        row.prefixDivergencePct ?? "\u2014",
+        row.status === "ok" ? row.armAExit : row.status,
+        row.armAReturncodeMatch ? "yes" : "no",
+        row.armASignatureMatch ? "yes" : "no",
+        row.replayed ? "**yes**" : "no",
+        fixCell,
+        fix?.armBExit ?? "\u2014",
+        fix?.failureVanished === null || fix === null ? "\u2014" : fix.failureVanished ? "**yes**" : "no",
+        (row.wallMs / 1e3).toFixed(1)
+      ].join(" | ")
+    );
+  }
+  if (report.llm) {
+    lines.push("");
+    lines.push("## LLM fix generation");
+    lines.push("");
+    lines.push(
+      `Model ${report.llm.model}: ${report.llm.calls} calls (${report.llm.failures} failed), ${report.llm.promptTokens} prompt + ${report.llm.completionTokens} completion tokens.`
+    );
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function parseReplayBatchArgs(argv) {
+  const corpora = [];
+  const values = /* @__PURE__ */ new Map();
+  let enumerateOnly = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") return "help";
+    if (arg === "--enumerate-only") {
+      enumerateOnly = true;
+      continue;
+    }
+    if (!arg.startsWith("--")) throw new Error(`unexpected positional argument: ${arg}`);
+    const value = argv[++i];
+    if (value === void 0) throw new Error(`missing value for ${arg}`);
+    if (arg === "--corpus") corpora.push(parseCorpusFlag(value));
+    else values.set(arg, value);
+  }
+  if (corpora.length === 0) {
+    throw new Error("replay-verify-batch: at least one --corpus name=<labels>::<prepared> is required");
+  }
+  const out = values.get("--out");
+  if (!out && !enumerateOnly) throw new Error("replay-verify-batch: --out is required");
+  const optionalNumber = (flag) => {
+    const v = values.get(flag);
+    if (v === void 0) return void 0;
+    const n = Number(v);
+    if (!Number.isFinite(n)) throw new Error(`replay-verify-batch: ${flag} must be a number, got ${v}`);
+    return n;
+  };
+  const fix = values.get("--fix") ?? "none";
+  if (fix !== "none" && fix !== "generate") {
+    throw new Error(`replay-verify-batch: --fix must be none or generate, got ${fix}`);
+  }
+  return {
+    corpora,
+    out: out ?? ".",
+    fix,
+    fixModel: values.get("--fix-model") ?? "glm-5.2",
+    fixBaseUrl: values.get("--fix-base-url") ?? "https://api.z.ai/api/coding/paas/v4",
+    fixApiKeyEnv: values.get("--fix-api-key-env") ?? "ZAI_GLM_API_KEY",
+    maxFixCases: optionalNumber("--max-fix-cases") ?? 30,
+    seed: optionalNumber("--seed") ?? 17,
+    stepTimeoutMs: optionalNumber("--step-timeout"),
+    prefixLimit: optionalNumber("--prefix-limit"),
+    caseFilter: values.get("--case-filter"),
+    caseLimit: optionalNumber("--case-limit"),
+    baseUrl: values.get("--base-url") ?? process.env.SANDBOX_API_URL ?? "http://127.0.0.1:4097",
+    apiKeyEnv: values.get("--api-key-env") ?? "SANDBOX_API_KEY",
+    maxLifetimeSeconds: optionalNumber("--max-lifetime"),
+    enumerateOnly
+  };
+}
+function replayBatchUsage() {
+  return `traces replay-verify-batch \u2014 measure replayability and fix-flip rates across gold-labeled corpora
+
+Usage:
+  traces replay-verify-batch \\
+      --corpus NAME=<labels.json>::<prepared-dir> [--corpus ...] \\
+      --out DIR [--fix none|generate] [--enumerate-only] \\
+      [--fix-model glm-5.2] [--fix-base-url URL] [--fix-api-key-env ZAI_GLM_API_KEY] \\
+      [--max-fix-cases 30] [--seed 17] [--step-timeout MS] [--prefix-limit N] \\
+      [--case-filter SUBSTRING] [--case-limit N] \\
+      [--base-url URL] [--api-key-env SANDBOX_API_KEY] [--max-lifetime SECONDS]
+
+  Replayable = the raw trajectory carries info.docker_config.base_image AND the
+  labels mark at least one gold incorrect step that is a real mid-trajectory
+  action. k = the first such gold step; golds whose action is the agent's
+  submit command (COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT) are skipped and
+  counted, and cases whose golds are all submit steps are excluded as
+  gold-only-submit-step. Excluded cases and image pull failures are report
+  rows, never skipped silently. --enumerate-only prints the enumeration
+  without touching a sandbox.
+
+  --fix generate runs ONE LLM call per arm-A-reproduced case (cap
+  --max-fix-cases, seeded sample beyond it) and executes the corrected command
+  as arm B in a fresh sandbox.
+
+Outputs batch-report.json, batch-report.md, cases.jsonl (incremental), and one
+directory per case with the full replay-verify artifacts.
+See docs/replay-verify.md for orchestrator setup and honest limits.
+`;
+}
+async function cmdReplayVerifyBatch(argv) {
+  const parsed = parseReplayBatchArgs(argv);
+  if (parsed === "help") {
+    process.stdout.write(replayBatchUsage());
+    return;
+  }
+  if (parsed.enumerateOnly) {
+    const enumeration = enumerateReplayableCases(parsed.corpora);
+    process.stdout.write(
+      `${JSON.stringify(
+        {
+          labelEntries: enumeration.labelEntryCount,
+          replayable: enumeration.replayable.map((c) => ({
+            corpus: c.corpus,
+            trajId: c.trajId,
+            image: c.image,
+            cwd: c.cwd,
+            cwdSource: c.cwdSource,
+            k: c.k,
+            submitGoldsSkipped: c.submitGoldsSkipped,
+            recordedReturncodeAtK: c.recordedReturncodeAtK,
+            goldIncorrectSteps: c.goldIncorrectSteps
+          })),
+          excluded: enumeration.excluded
+        },
+        null,
+        2
+      )}
+`
+    );
+    return;
+  }
+  const apiKey = process.env[parsed.apiKeyEnv];
+  if (!apiKey) {
+    throw new Error(
+      `replay-verify-batch: env var ${parsed.apiKeyEnv} is empty \u2014 pass --api-key-env or export it`
+    );
+  }
+  let fixCaller;
+  if (parsed.fix === "generate") {
+    const fixApiKey = process.env[parsed.fixApiKeyEnv];
+    if (!fixApiKey) {
+      throw new Error(
+        `replay-verify-batch: env var ${parsed.fixApiKeyEnv} is empty \u2014 pass --fix-api-key-env or export it`
+      );
+    }
+    fixCaller = zaiChatCaller({
+      baseUrl: parsed.fixBaseUrl,
+      apiKey: fixApiKey,
+      model: parsed.fixModel
+    });
+  }
+  const report = await runReplayBatch({
+    corpora: parsed.corpora,
+    out: parsed.out,
+    baseUrl: parsed.baseUrl,
+    apiKey,
+    fix: parsed.fix,
+    fixCaller,
+    fixModelLabel: parsed.fixModel,
+    maxFixCases: parsed.maxFixCases,
+    seed: parsed.seed,
+    stepTimeoutMs: parsed.stepTimeoutMs,
+    prefixLimit: parsed.prefixLimit,
+    caseFilter: parsed.caseFilter,
+    caseLimit: parsed.caseLimit,
+    maxLifetimeSeconds: parsed.maxLifetimeSeconds,
+    onProgress: (message) => process.stderr.write(`${message}
+`)
+  });
+  const { replayabilityRate, fixFlipRate } = report.headline;
+  process.stderr.write(
+    `replay-verify-batch: replayability ${replayabilityRate.numerator}/${replayabilityRate.denominator}` + (fixFlipRate ? `, fix-flip ${fixFlipRate.numerator}/${fixFlipRate.denominator}` : "") + ` \u2192 ${parsed.out}
+`
+  );
+}
+
 // src/external.ts
 import { spawn } from "child_process";
 import { readdir as readdir14, readFile as readFile7 } from "fs/promises";
@@ -7902,21 +8980,21 @@ function commandRedactor(spec) {
 }
 
 // src/hodoscope.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, readFile as readFile8, readdir as readdir15, writeFile as writeFile4 } from "fs/promises";
-import { endianness, tmpdir as tmpdir3 } from "os";
-import { join as join20, resolve as resolve5 } from "path";
+import { endianness, tmpdir as tmpdir4 } from "os";
+import { join as join22, resolve as resolve5 } from "path";
 var HODOSCOPE_VERSION = "0.2.4";
 async function writeHodoscopeInput(otlpPath, options = {}) {
   const explicitDirectory = options.directory ? resolve5(options.directory) : void 0;
-  const directory = explicitDirectory ?? await mkdtemp3(join20(tmpdir3(), "traces-hodoscope-input-"));
+  const directory = explicitDirectory ?? await mkdtemp3(join22(tmpdir4(), "traces-hodoscope-input-"));
   if (explicitDirectory) {
     await mkdir3(directory, { recursive: true });
     if ((await readdir15(directory)).length > 0) {
       throw new Error(`Hodoscope explicit directory must be empty: ${directory}`);
     }
   }
-  const samples = join20(directory, "samples");
+  const samples = join22(directory, "samples");
   await mkdir3(samples);
   const rows = [];
   for await (const value of readJsonl(otlpPath)) rows.push(parseOpenInferenceRow(value));
@@ -7941,8 +9019,8 @@ async function writeHodoscopeInput(otlpPath, options = {}) {
       throw new Error(`Hodoscope trace '${traceId}' contains no assistant actions`);
     }
     actionCount += actions;
-    const file = `${createHash8("sha256").update(traceId).digest("hex").slice(0, 24)}.json`;
-    await writeFile4(join20(samples, file), `${JSON.stringify(trajectory, null, 2)}
+    const file = `${createHash9("sha256").update(traceId).digest("hex").slice(0, 24)}.json`;
+    await writeFile4(join22(samples, file), `${JSON.stringify(trajectory, null, 2)}
 `, "utf8");
   }
   return {
@@ -7964,12 +9042,12 @@ function hodoscopeAnalyzer(options = {}) {
   return {
     name: "hodoscope",
     async analyze(otlpPath, runOptions2 = {}) {
-      const outputRoot = options.outputDir ? resolve5(options.outputDir) : tmpdir3();
+      const outputRoot = options.outputDir ? resolve5(options.outputDir) : tmpdir4();
       await mkdir3(outputRoot, { recursive: true });
-      const directory = await mkdtemp3(join20(outputRoot, "traces-hodoscope-"));
-      const input = join20(directory, "input");
-      const analysisFile = join20(directory, "analysis.hodoscope.json");
-      const samplesFile = join20(directory, "samples.json");
+      const directory = await mkdtemp3(join22(outputRoot, "traces-hodoscope-"));
+      const input = join22(directory, "input");
+      const analysisFile = join22(directory, "analysis.hodoscope.json");
+      const samplesFile = join22(directory, "samples.json");
       try {
         const prepared = await writeHodoscopeInput(otlpPath, {
           directory: input,
@@ -8600,9 +9678,19 @@ var CODING_REDACTION_RULES = [
     id: "private-key",
     pattern: /-----BEGIN(?:[A-Z ]+)?PRIVATE KEY-----[\s\S]*?-----END(?:[A-Z ]+)?PRIVATE KEY-----/g
   },
+  // Match the whole identifier because underscores prevent a word boundary before a secret suffix.
   {
     id: "assigned-secret",
-    pattern: /\b(?:api[_-]?key|secret|token|password|passwd|access[_-]?token|client[_-]?secret)\b\s*[:=]\s*["']?[A-Za-z0-9._\-]{12,}["']?/gi
+    pattern: /(?<![A-Za-z0-9_-])(?:[A-Za-z_][A-Za-z0-9_-]*)?(?:api[_-]?key|secret|token|password|passwd|access[_-]?token|client[_-]?secret)(?![A-Za-z0-9_-])\+?=(?:\$\((?:\\.|[^\\\r\n])*\)|\$\{(?:\\.|[^}\\\r\n])*\}|`(?:\\.|[^`\\\r\n])*`|\$?'(?:\\.|[^'\\\r\n])*'|\$?"(?:\\.|[^"\\\r\n])*"|\\[^\r\n]|[^\s;&|<>()"'`\\\r\n])+/gi
+  },
+  // Config-file secrets (YAML/INI line keys, JSON quoted keys) — the coverage the shell
+  // rule above deliberately gave up to spare prose ("Narrative token: x") and type
+  // annotations ("(token: string)"). The line anchor is the discriminator: config keys
+  // start their line, prose colons never do; JSON keys are safe anywhere because both
+  // sides are quoted. Identifiers must END in a secret word, same as the shell rule.
+  {
+    id: "config-secret",
+    pattern: /(?:^[ \t]*["']?(?:[A-Za-z_][A-Za-z0-9_-]*)?(?:api[_-]?key|secret|token|password|passwd|access[_-]?token|client[_-]?secret)(?![A-Za-z0-9_-])["']?[ \t]*[:=][ \t]*|["'](?:[A-Za-z_][A-Za-z0-9_-]*)?(?:api[_-]?key|secret|token|password|passwd|access[_-]?token|client[_-]?secret)["']\s*:\s*)["']?[A-Za-z0-9._\-]{12,}["']?/gim
   },
   // Credentials embedded in URLs — common when a prompt pastes a curl/clone line.
   { id: "url-userinfo", pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@/gi },
@@ -8668,10 +9756,10 @@ async function applyRedactor(spans, redactor) {
 }
 
 // src/file-export.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { mkdtemp as mkdtemp4, readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
-import { tmpdir as tmpdir4 } from "os";
-import { join as join21 } from "path";
+import { tmpdir as tmpdir5 } from "os";
+import { join as join23 } from "path";
 import {
   firstNumberAttr,
   LLM_CACHED_TOKEN_ATTR_KEYS,
@@ -8706,7 +9794,7 @@ function stableJson(value) {
   });
 }
 function hashId(value, chars = 16) {
-  return createHash9("sha256").update(stableJson(value)).digest("hex").slice(0, chars);
+  return createHash10("sha256").update(stableJson(value)).digest("hex").slice(0, chars);
 }
 function isoTime2(value) {
   if (typeof value === "string") {
@@ -9267,15 +10355,15 @@ async function exportTraceEvidenceFile(inputPath, opts = {}) {
 }
 async function writeTraceEvidenceExportFile(inputPath, outPath, opts = {}) {
   const result = await exportTraceEvidenceFile(inputPath, opts);
-  const path = outPath ?? join21(await mkdtemp4(join21(tmpdir4(), "traces-export-")), "spans.openinference.jsonl");
+  const path = outPath ?? join23(await mkdtemp4(join23(tmpdir5(), "traces-export-")), "spans.openinference.jsonl");
   await writeFile5(path, serializeSpans(result.spans), "utf8");
   return { ...result, path };
 }
 
 // src/inspect.ts
 import { mkdtemp as mkdtemp5, readFile as readFile10, writeFile as writeFile6 } from "fs/promises";
-import { tmpdir as tmpdir5 } from "os";
-import { basename as basename13, join as join22 } from "path";
+import { tmpdir as tmpdir6 } from "os";
+import { basename as basename13, join as join24 } from "path";
 var severityRank = {
   high: 0,
   medium: 1,
@@ -9291,7 +10379,7 @@ function sessionLabel(row) {
   const id = row.session.sessionId.length > 12 ? row.session.sessionId.slice(0, 12) : row.session.sessionId;
   return `${row.session.harness}:${id} (${repoLabel(row)})`;
 }
-function pct(value) {
+function pct2(value) {
   return `${(value * 100).toFixed(value >= 0.1 ? 0 : 1)}%`;
 }
 function topToolErrors(row) {
@@ -9370,7 +10458,7 @@ function addSessionFindings(index, findings) {
       area: "session",
       title: `High tool-error count/rate in ${errorSessions.length}/${index.totals.sessions} session(s)`,
       impact: errors,
-      evidence: errorSessions.slice(0, 5).map((row) => `${sessionLabel(row)}: ${row.metrics.erroredToolCallCount}/${row.metrics.toolCallCount} tool errors (${pct(row.metrics.toolErrorRate)}); ${topToolErrors(row)}`),
+      evidence: errorSessions.slice(0, 5).map((row) => `${sessionLabel(row)}: ${row.metrics.erroredToolCallCount}/${row.metrics.toolCallCount} tool errors (${pct2(row.metrics.toolErrorRate)}); ${topToolErrors(row)}`),
       next: "Fix the most common failing command/tool first, then rerun `traces index` to confirm the error count drops.",
       refs: errorSessions.slice(0, 5).map((row) => row.session.path)
     });
@@ -9564,14 +10652,14 @@ async function readSessionIndexFile(path) {
   return parsed;
 }
 async function writeInspectionReportFile(report, outPath) {
-  const path = outPath ?? join22(await mkdtemp5(join22(tmpdir5(), "traces-inspect-")), "inspection-report.md");
+  const path = outPath ?? join24(await mkdtemp5(join24(tmpdir6(), "traces-inspect-")), "inspection-report.md");
   await writeFile6(path, renderInspectionReport(report), "utf8");
   return path;
 }
 
 // src/adoption.ts
 import { readFile as readFile11 } from "fs/promises";
-import { join as join23 } from "path";
+import { join as join25 } from "path";
 function toolName2(s) {
   const n = s.attributes["tool.name"];
   if (typeof n === "string") return n;
@@ -9691,7 +10779,7 @@ async function readLoopRuns(cwds, sessionIds) {
     seenCwds.add(cwd);
     const firstSourceByRun = /* @__PURE__ */ new Map();
     for (const artifactDir of [".agent", ".evolve"]) {
-      const path = join23(cwd, artifactDir, "skill-runs.jsonl");
+      const path = join25(cwd, artifactDir, "skill-runs.jsonl");
       let raw;
       try {
         raw = await readFile11(path, "utf8");
@@ -11102,8 +12190,8 @@ function renderAdoption(ar) {
 
 // src/improvement.ts
 import { access, mkdir as mkdir4, mkdtemp as mkdtemp6, writeFile as writeFile7 } from "fs/promises";
-import { tmpdir as tmpdir6 } from "os";
-import { dirname as dirname7, join as join24, resolve as resolve6 } from "path";
+import { tmpdir as tmpdir7 } from "os";
+import { dirname as dirname7, join as join26, resolve as resolve6 } from "path";
 import { pathToFileURL } from "url";
 import {
   AnalystRegistry,
@@ -11610,13 +12698,13 @@ async function runTraceStoreInvestigation(opts) {
   };
 }
 async function writeTraceImprovementArtifacts(result, outDir) {
-  const directory = outDir ? resolve6(outDir) : await mkdtemp6(join24(tmpdir6(), "traces-improvement-"));
+  const directory = outDir ? resolve6(outDir) : await mkdtemp6(join26(tmpdir7(), "traces-improvement-"));
   await mkdir4(directory, { recursive: true });
   const paths = {
     directory,
-    result: join24(directory, "result.json"),
-    evidence: join24(directory, "evidence.jsonl"),
-    report: join24(directory, "report.md"),
+    result: join26(directory, "result.json"),
+    evidence: join26(directory, "evidence.jsonl"),
+    report: join26(directory, "report.md"),
     traces: result.otlpPath
   };
   const { report, ...machineResult } = result;
@@ -11628,11 +12716,11 @@ async function writeTraceImprovementArtifacts(result, outDir) {
   return paths;
 }
 async function runTraceImprovement(opts) {
-  const directory = opts.outDir ? resolve6(opts.outDir) : await mkdtemp6(join24(tmpdir6(), "traces-improvement-"));
+  const directory = opts.outDir ? resolve6(opts.outDir) : await mkdtemp6(join26(tmpdir7(), "traces-improvement-"));
   await mkdir4(directory, { recursive: true });
   const investigation = await runTraceInvestigation({
     ...opts,
-    otlpOutPath: opts.otlpOutPath ?? join24(directory, "traces.otlp.jsonl")
+    otlpOutPath: opts.otlpOutPath ?? join26(directory, "traces.otlp.jsonl")
   });
   const result = {
     ...investigation,
@@ -11649,7 +12737,7 @@ async function saveReport(path, report) {
 }
 
 // src/live.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 var VERIFY_RE = /\b(test|tests|vitest|jest|pytest|go test|cargo test|tsc|typecheck|lint|biome|eslint|build|check:invariants|preflight)\b/i;
 var CHANGE_RE = /\b(apply_patch|edit|write|create|delete|rename|replace|update|git apply|sed -i|perl -pi|tee\s|cat\s+>)/i;
 var CLAIM_DONE_RE = /\b(done|fixed|complete|completed|implemented|merged|verified|all green|tests pass|ready|works now)\b/i;
@@ -11669,7 +12757,7 @@ var sleep = (ms2, signal) => new Promise((resolve7) => {
   signal?.addEventListener("abort", onAbort, { once: true });
 });
 function hash(parts) {
-  return createHash10("sha256").update(parts.join("\0")).digest("hex").slice(0, 16);
+  return createHash11("sha256").update(parts.join("\0")).digest("hex").slice(0, 16);
 }
 function asString(value) {
   if (typeof value === "string" && value.trim()) return value;
@@ -12075,7 +13163,7 @@ async function streamSessions(opts) {
 
 // src/supervisor-run-context.ts
 import { readFile as readFile12, stat as stat14 } from "fs/promises";
-import { basename as basename14, join as join25 } from "path";
+import { basename as basename14, join as join27 } from "path";
 import { materializeTreeView } from "@tangle-network/agent-runtime/kernel";
 import {
   NO_SOURCE_LIMITS
@@ -12236,10 +13324,10 @@ function parseInstant(v) {
   return Number.isFinite(t) ? t : null;
 }
 async function readFileRunContext(runDir, opts = {}) {
-  const journalText = await readMaybe(join25(runDir, SPAWN_JOURNAL_FILE));
+  const journalText = await readMaybe(join27(runDir, SPAWN_JOURNAL_FILE));
   const journal = readRunContextJournal(journalText);
-  const coordination = readCoordinationLog(await readMaybe(join25(runDir, COORDINATION_LOG_FILE)));
-  const result = await readMaybe(join25(runDir, RESULT_FILE));
+  const coordination = readCoordinationLog(await readMaybe(join27(runDir, COORDINATION_LOG_FILE)));
+  const result = await readMaybe(join27(runDir, RESULT_FILE));
   return {
     runRef: runDir,
     instanceId: opts.instanceId !== void 0 ? opts.instanceId : journal.root,
@@ -12262,7 +13350,7 @@ async function readFileRunContext(runDir, opts = {}) {
     harnessWorkerTokens: null,
     harnessMissingReason: "the file run context journals each child\u2019s own settled spend, so no external harness join is used",
     limits: sourceLimits(journal, coordination),
-    rootTranscriptRef: journal.present ? join25(runDir, SPAWN_JOURNAL_FILE) : null,
+    rootTranscriptRef: journal.present ? join27(runDir, SPAWN_JOURNAL_FILE) : null,
     traceCommand: `traces watch ${runDir}`
   };
 }
@@ -12270,7 +13358,7 @@ function fileRunContextSupervisorRunReader(runDir, opts = {}) {
   return { runRef: runDir, read: () => readFileRunContext(runDir, opts) };
 }
 async function isFileRunContextDir(runDir) {
-  return stat14(join25(runDir, SPAWN_JOURNAL_FILE)).then((s) => s.isFile()).catch(() => false);
+  return stat14(join27(runDir, SPAWN_JOURNAL_FILE)).then((s) => s.isFile()).catch(() => false);
 }
 function flattenJournal(journal) {
   return journal.events.map((event) => {
@@ -12416,9 +13504,9 @@ function mergeRolls(a, b) {
   };
 }
 async function readRunContextSnapshot(runDir) {
-  const journal = readRunContextJournal(await readMaybe(join25(runDir, SPAWN_JOURNAL_FILE)));
-  const coordination = readCoordinationLog(await readMaybe(join25(runDir, COORDINATION_LOG_FILE)));
-  const resultText = await readMaybe(join25(runDir, RESULT_FILE));
+  const journal = readRunContextJournal(await readMaybe(join27(runDir, SPAWN_JOURNAL_FILE)));
+  const coordination = readCoordinationLog(await readMaybe(join27(runDir, COORDINATION_LOG_FILE)));
+  const resultText = await readMaybe(join27(runDir, RESULT_FILE));
   const result = parseResult(resultText);
   const view = safeTreeView(journal.events);
   const nodes = view === null ? [] : orderNodes(view, journal);
@@ -12601,7 +13689,7 @@ function wrap(text2, indent) {
 
 // src/run-span-tree.ts
 import { readdir as readdir16 } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join28 } from "path";
 import {
   firstNumberAttr as firstNumberAttr3,
   LLM_COST_ATTR_KEYS as LLM_COST_ATTR_KEYS2,
@@ -12874,7 +13962,7 @@ async function findSpanSourceFiles(dir) {
   const found = [];
   const entries = await readdir16(dir, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const child = join26(dir, entry.name);
+    const child = join28(dir, entry.name);
     if (entry.isFile()) {
       if (SPAN_FILE_PATTERN.test(entry.name)) found.push(child);
       continue;
@@ -12882,7 +13970,7 @@ async function findSpanSourceFiles(dir) {
     if (!entry.isDirectory()) continue;
     const nested = await readdir16(child, { withFileTypes: true }).catch(() => []);
     for (const inner of nested) {
-      if (inner.isFile() && SPAN_FILE_PATTERN.test(inner.name)) found.push(join26(child, inner.name));
+      if (inner.isFile() && SPAN_FILE_PATTERN.test(inner.name)) found.push(join28(child, inner.name));
     }
   }
   return found.sort();
@@ -12890,7 +13978,7 @@ async function findSpanSourceFiles(dir) {
 
 // src/supervisor-run-watch.ts
 import { readdir as readdir17 } from "fs/promises";
-import { join as join27 } from "path";
+import { join as join29 } from "path";
 function budget(node) {
   const parts = [`${int(node.budget.maxIterations)}it`, `${int(node.budget.maxTokens)}tok`];
   if (node.budget.maxUsd !== void 0) parts.push(`$${node.budget.maxUsd.toFixed(2)}`);
@@ -13034,7 +14122,7 @@ async function resolveRunContextDir(dir) {
   const candidates = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const child = join27(dir, entry.name);
+    const child = join29(dir, entry.name);
     if (await isFileRunContextDir(child)) candidates.push(child);
   }
   if (candidates.length === 1) return candidates[0];
@@ -13485,11 +14573,11 @@ async function collectSessionWorkflow(adapter, seeds, options = {}) {
 }
 
 // src/session-selection.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { createReadStream as createReadStream2 } from "fs";
 async function fileSha256(path, signal) {
   signal?.throwIfAborted();
-  const hash2 = createHash11("sha256");
+  const hash2 = createHash12("sha256");
   try {
     for await (const chunk of createReadStream2(path, { signal })) {
       signal?.throwIfAborted();
@@ -13517,7 +14605,7 @@ async function sourceSnapshot(adapter, ref, signal) {
     signal?.throwIfAborted();
     files.push({ path, sha256: await fileSha256(path, signal) });
   }
-  const sha2562 = files.length === 1 ? files[0].sha256 : createHash11("sha256").update(JSON.stringify(files)).digest("hex");
+  const sha2562 = files.length === 1 ? files[0].sha256 : createHash12("sha256").update(JSON.stringify(files)).digest("hex");
   return { sha256: sha2562, files };
 }
 function summarizeWorkflows(workflows) {
@@ -13613,8 +14701,8 @@ async function collectSessionSelection(groups, options = {}) {
 
 // src/session-index.ts
 import { mkdtemp as mkdtemp7, readdir as readdir18, readFile as readFile13, stat as stat16, writeFile as writeFile8 } from "fs/promises";
-import { tmpdir as tmpdir7 } from "os";
-import { dirname as dirname8, join as join28 } from "path";
+import { tmpdir as tmpdir8 } from "os";
+import { dirname as dirname8, join as join30 } from "path";
 function indexRow(record2) {
   return {
     session: record2.session,
@@ -13687,7 +14775,7 @@ async function findContextRoot(cwd) {
   if (!s) return null;
   if (!s.isDirectory()) current = dirname8(current);
   for (; ; ) {
-    if (await pathStat2(join28(current, ".git")) || await dirExists(join28(current, ".evolve")) || await fileExists(join28(current, "AGENTS.md")) || await fileExists(join28(current, "CLAUDE.md"))) {
+    if (await pathStat2(join30(current, ".git")) || await dirExists(join30(current, ".evolve")) || await fileExists(join30(current, "AGENTS.md")) || await fileExists(join30(current, "CLAUDE.md"))) {
       return current;
     }
     const parent = dirname8(current);
@@ -13755,7 +14843,7 @@ async function walkMarkdown(root, kind, maxFiles = 100) {
     }
     for (const entry of entries) {
       if (out.length >= maxFiles) return;
-      const path = join28(dir, entry.name);
+      const path = join30(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(path);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -13770,20 +14858,20 @@ async function walkMarkdown(root, kind, maxFiles = 100) {
 async function collectContextRoot(root) {
   const files = [];
   for (const name of ["AGENTS.md", "CLAUDE.md", "GEMINI.md"]) {
-    const summary = await summarizeFile(join28(root, name), "instruction-doc");
+    const summary = await summarizeFile(join30(root, name), "instruction-doc");
     if (summary) files.push(summary);
   }
-  const evolve = join28(root, ".evolve");
+  const evolve = join30(root, ".evolve");
   for (const name of ["skill-runs.jsonl", "governor.jsonl", "experiments.jsonl"]) {
-    const summary = await summarizeFile(join28(evolve, name), "evolve-jsonl");
+    const summary = await summarizeFile(join30(evolve, name), "evolve-jsonl");
     if (summary) files.push(summary);
   }
   for (const name of ["scorecard.json"]) {
-    const summary = await summarizeFile(join28(evolve, name), "evolve-json");
+    const summary = await summarizeFile(join30(evolve, name), "evolve-json");
     if (summary) files.push(summary);
   }
-  files.push(...await walkMarkdown(join28(evolve, "reflections"), "reflection"));
-  files.push(...await walkMarkdown(join28(evolve, "handoffs"), "handoff"));
+  files.push(...await walkMarkdown(join30(evolve, "reflections"), "reflection"));
+  files.push(...await walkMarkdown(join30(evolve, "handoffs"), "handoff"));
   return { root, files: files.sort((a, b) => a.path.localeCompare(b.path)) };
 }
 async function collectContextIndex(records) {
@@ -13829,7 +14917,7 @@ function serializeSessionIndex(index) {
 `;
 }
 async function writeSessionIndexFile(index, outPath) {
-  const path = outPath ?? join28(await mkdtemp7(join28(tmpdir7(), "traces-index-")), "session-index.json");
+  const path = outPath ?? join30(await mkdtemp7(join30(tmpdir8(), "traces-index-")), "session-index.json");
   await writeFile8(path, serializeSessionIndex(index), "utf8");
   return path;
 }
@@ -13837,11 +14925,11 @@ async function writeSessionIndexFile(index, outPath) {
 // src/upload-state.ts
 import { mkdir as mkdir5, readFile as readFile14, writeFile as writeFile9 } from "fs/promises";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname9, join as join29 } from "path";
+import { dirname as dirname9, join as join31 } from "path";
 import { contentHash } from "@tangle-network/agent-eval";
 function stateFile() {
-  const base = process.env.XDG_STATE_HOME ?? join29(homedir12(), ".local", "state");
-  return join29(base, "tangle-traces", "uploaded.json");
+  const base = process.env.XDG_STATE_HOME ?? join31(homedir12(), ".local", "state");
+  return join31(base, "tangle-traces", "uploaded.json");
 }
 function uploadKey(harness, sessionId) {
   return `${harness}:${sessionId}`;
@@ -13873,7 +14961,7 @@ function alreadyUploaded(state, harness, sessionId, hash2) {
 import { readFile as readFile15 } from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 import { hostname as hostname2 } from "os";
-import { basename as basename15, join as join30 } from "path";
+import { basename as basename15, join as join32 } from "path";
 import { hostedClientFromEnv } from "@tangle-network/agent-eval/hosted";
 import { REDACTION_VERSION } from "@tangle-network/agent-eval/traces";
 var require2 = createRequire2(import.meta.url);
@@ -13897,7 +14985,7 @@ async function planUpload(opts = {}) {
 async function gitBranch(cwd) {
   if (!cwd) return void 0;
   try {
-    const head = await readFile15(join30(cwd, ".git", "HEAD"), "utf8");
+    const head = await readFile15(join32(cwd, ".git", "HEAD"), "utf8");
     const m = head.match(/^ref:\s*refs\/heads\/(.+)$/m);
     return m?.[1]?.trim();
   } catch {
@@ -14153,6 +15241,25 @@ export {
   parseReplayVerifyArgs,
   replayVerifyUsage,
   cmdReplayVerify,
+  parseCorpusFlag,
+  SUBMIT_ACTION_SIGNATURE,
+  isSubmitAction,
+  readLabelEntries,
+  goldIncorrectSteps,
+  resolveCaseResources,
+  enumerateReplayableCases,
+  zaiChatCaller,
+  buildFixPrompt,
+  extractFixCommand,
+  generateFixCommand,
+  derivedImageTag,
+  dockerImagePreparer,
+  seededSample,
+  runReplayBatch,
+  renderBatchReport,
+  parseReplayBatchArgs,
+  replayBatchUsage,
+  cmdReplayVerifyBatch,
   runCommand,
   commandAnalyzer,
   haloAnalyzer,