@tangle-network/traces 0.11.4 → 0.11.6

package/dist/cli.js

@@ -1,17 +1,16 @@
 #!/usr/bin/env node
 import {
-  ACTOR_ATTR,
-  ATTR,
-  CORRUPTION_RECEIPT_DISPLAY_LIMIT,
+  DEFAULT_SANDBOX_BASE_URL,
   appendAll,
+  assembleSessionBundle,
   buildPolicyEvidenceRecord,
   buildSessionIndexFromRows,
   cmdReplayVerify,
   cmdReplayVerifyBatch,
+  cmdVerifyFindings,
   collectSessionSelection,
   commandAnalyzer,
   commandRedactor,
-  describeSessionRelationship,
   executeUpload,
   exportTraceEvidenceFile,
   fileRunContextSupervisorRunReader,
@@ -25,13 +24,17 @@ import {
   loadTracesConfig,
   locateSessions,
   mergeTracesConfig,
+  parseCorpusFlag,
   parseSession,
   parseSince,
   planUpload,
+  primeAnalyzer,
+  projectSessionBundle,
   readOtlpInput,
   readSessionIndexFile,
   renderInspectionReport,
   renderValidation,
+  renderVerifiedFindingsSection,
   resolveAdapter,
   resolveRunWatchTarget,
   runTraceImprovement,
@@ -42,11 +45,12 @@ import {
   serializeSessionIndex,
   serializeSpans,
   serializeTraceStreamEvent,
-  sessionIdFromAttributes,
+  sessionReportSource,
   streamSessions,
   totalAgenticFailureMessage,
   traceStreamEventsFromSpans,
   validationExitCode,
+  verifyFindings,
   watchRunTarget,
   watchSessions,
   writeInspectionReportFile,
@@ -54,7 +58,7 @@ import {
   writePolicyEvidenceFile,
   writeSessionIndexFile,
   writeTraceEvidenceExportFile
-} from "./chunk-AGPOIWPQ.js";
+} from "./chunk-MEAEXKUV.js";
 
 // src/cli.ts
 import { readFileSync } from "fs";
@@ -69,6 +73,71 @@ import {
   rollupSupervisorRuns
 } from "@tangle-network/agent-eval/supervisor-run";
 import { createDspyRlmTraceEngine } from "@tangle-network/agent-eval/analyst";
+
+// src/analyst-model-call.ts
+import {
+  callLlm,
+  costReceiptFromLlm,
+  costReceiptFromLlmError,
+  LlmCallError
+} from "@tangle-network/agent-eval";
+var PROVIDER_ERROR_BODY_LIMIT = 2e3;
+function createAnalystModelCall(opts) {
+  const { apiKey, baseUrl } = opts;
+  return async ({ request, callId, signal }) => {
+    try {
+      const req = structuredClone(request);
+      const response = await callLlm(req, {
+        apiKey,
+        baseUrl,
+        signal,
+        idempotencyKey: callId
+      });
+      return {
+        succeeded: true,
+        response,
+        receipt: costReceiptFromLlm(response),
+        execution: {
+          callId,
+          baseUrl,
+          requestedModel: req.model,
+          servedModel: response.servedModel ?? null,
+          finishReason: response.finishReason ?? null,
+          durationMs: response.durationMs
+        }
+      };
+    } catch (error) {
+      const err = error instanceof Error ? error : new Error(String(error));
+      const aborted = signal.aborted;
+      const message = aborted ? `AbortError: ${err.message}` : err.message;
+      const detail = err instanceof LlmCallError ? { status: err.status, body: err.body.slice(0, PROVIDER_ERROR_BODY_LIMIT) } : {};
+      return {
+        succeeded: false,
+        error: message,
+        // costReceiptFromLlmError recovers the provider receipt when the
+        // response completed but violated the contract; otherwise usage and
+        // cost stay explicitly unknown.
+        receipt: costReceiptFromLlmError(err) ?? {
+          model: request.model,
+          inputTokens: 0,
+          outputTokens: 0,
+          costUnknown: true,
+          usageUnknown: true
+        },
+        execution: {
+          callId,
+          baseUrl,
+          requestedModel: request.model,
+          aborted,
+          error: message,
+          ...detail
+        }
+      };
+    }
+  };
+}
+
+// src/cli.ts
 var DEFAULT_ANALYST_MODEL = "gpt-5-mini";
 var TANGLE_ROUTER_BASE_URL = "https://router.tangle.tools/v1";
 function packageVersion() {
@@ -102,7 +171,9 @@ function parseArgs(argv) {
     noSpans: false,
     noFindings: false,
     attrs: [],
-    concurrency: 4
+    concurrency: 4,
+    verifyFindings: false,
+    replayCorpora: []
   };
   for (let i = 1; i < argv.length; i++) {
     const arg = argv[i];
@@ -178,6 +249,9 @@ function parseArgs(argv) {
       case "--mode":
         a.mode = next();
         break;
+      case "--view":
+        a.view = next();
+        break;
       case "--metadata":
         a.metadata = next();
         break;
@@ -222,6 +296,17 @@ function parseArgs(argv) {
         if (v) a.analyzers.push(v);
         break;
       }
+      case "--verify-findings":
+        a.verifyFindings = true;
+        break;
+      case "--replay-corpus": {
+        const v = next();
+        if (v) a.replayCorpora.push(v);
+        break;
+      }
+      case "--verify-out":
+        a.verifyOut = next();
+        break;
       case "--analyzer-prompt":
         a.analyzerPrompt = next();
         break;
@@ -278,6 +363,7 @@ var CURRENT_SESSION_COMMANDS = /* @__PURE__ */ new Set([
   "convert",
   "index",
   "evidence",
+  "bundle",
   "stream"
 ]);
 var WORKFLOW_COMMANDS = /* @__PURE__ */ new Set([
@@ -306,6 +392,12 @@ function applyCurrentSessionSelection(args) {
   if (!sessionId) throw new Error("--current requires CODEX_THREAD_ID from the active Codex session");
   return { ...args, session: sessionId };
 }
+function validateViewSelection(args) {
+  if (args.view === void 0 || args.command === "bundle-view") return args;
+  throw new Error(
+    `--view is not supported by ${args.command}. A view is a projection of an assembled bundle: run \`traces bundle ... --out <dir>\` first, then \`traces bundle-view <dir> --view evidence-only --out <view-dir>\`.`
+  );
+}
 function validateWorkflowSelection(args) {
   if (!args.workflow && !args.latestTurn) return args;
   if (!WORKFLOW_COMMANDS.has(args.command)) {
@@ -404,15 +496,19 @@ function buildAnalysisEngine(model, budgetUsd) {
   const baseUrl = process.env.OPENAI_BASE_URL || (tangleKey ? TANGLE_ROUTER_BASE_URL : "https://api.openai.com/v1");
   const python = process.env.TRACES_PYTHON;
   return createDspyRlmTraceEngine({
-    apiKey,
-    baseUrl,
+    call: createAnalystModelCall({ apiKey, baseUrl }),
+    callRef: `traces-cli:${baseUrl}#${model}`,
+    recordExecution: (observation) => {
+      analystLog(
+        `[analyst] model call ${observation.sequence} ${observation.succeeded ? "ok" : "FAIL"} ${observation.model}`,
+        observation.succeeded ? void 0 : { error: observation.error }
+      );
+    },
     model,
-    // agent-eval 0.139.3's engine defaults are tuned below what real runs
-    // need. maxOutputTokens 4096 is under what current coding models emit for
-    // one findings array: glm-5.2 counts reasoning tokens in
-    // completion_tokens, the first oversized completion breaches its cost
-    // reservation, and the fail-closed ledger then refuses every later call
-    // in the run.
+    // Pinned, not defaulted: one findings array from a current coding model
+    // needs this cap, and glm-5.2 counts reasoning tokens in
+    // completion_tokens — a smaller cap breaches its cost reservation and the
+    // fail-closed ledger then refuses every later call in the run.
     maxOutputTokens: 16384,
     // maxCostUsd defaults to $1 per analyst — a proxy-side ceiling separate
     // from --budget. With the larger token cap the per-call reservation grows
@@ -448,47 +544,6 @@ ${adapter.harness}: ${refs.length} session(s)`);
     }
   }
 }
-function selectedSessionSource(ref, spans, sessionIdOverride) {
-  const root = spans.find((item) => item.parent_span_id === null) ?? spans[0];
-  const prompt = spans.find(
-    (item) => item.name === "user.prompt" && item.attributes[ACTOR_ATTR] === "human"
-  ) ?? spans.find((item) => item.name === "user.prompt") ?? spans.find(
-    (item) => item.attributes["span.type"] === "interaction" && typeof item.attributes.content === "string"
-  );
-  const content = typeof prompt?.attributes.content === "string" ? prompt.attributes.content : "";
-  const firstLine = content.split(/\r?\n/, 1)[0].trim();
-  const subject = firstLine.length > 240 ? `${firstLine.slice(0, 240)}\u2026 [+${firstLine.length - 240} chars]` : firstLine;
-  const role = root?.attributes["traces.session.role"];
-  const parentSessionId = root?.attributes["traces.parent_session_id"];
-  const relationship = describeSessionRelationship(ref, spans);
-  const corruptionDigest = root?.attributes[ATTR.CORRUPTION_DIGEST];
-  const sessionId = [
-    sessionIdOverride,
-    root ? sessionIdFromAttributes(root.attributes) : void 0,
-    root?.trace_id,
-    ref.sessionId
-  ].find((value) => typeof value === "string" && value.length > 0);
-  return {
-    sessionId,
-    path: ref.path,
-    subject,
-    role: role === "operator" || role === "child" ? role : "unknown",
-    ...typeof parentSessionId === "string" ? { parentSessionId } : {},
-    childSessionIds: relationship.childSessionIds,
-    ...relationship.depth !== void 0 ? { depth: relationship.depth } : {},
-    ...relationship.agentNickname ? { agentNickname: relationship.agentNickname } : {},
-    ...relationship.agentRole ? { agentRole: relationship.agentRole } : {},
-    ...relationship.agentPath ? { agentPath: relationship.agentPath } : {},
-    ...relationship.taskScope ? { taskScope: relationship.taskScope } : {},
-    ...relationship.turnId ? { turnId: relationship.turnId } : {},
-    integrity: ref.integrity?.status ?? "complete",
-    ...ref.integrity ? {
-      corruptionCount: ref.integrity.corruptions.length,
-      ...typeof corruptionDigest === "string" ? { corruptionDigest } : {},
-      corruptions: ref.integrity.corruptions.slice(0, CORRUPTION_RECEIPT_DISPLAY_LIMIT)
-    } : {}
-  };
-}
 async function collectOtlpSpans(path) {
   const input = await readOtlpInput(path);
   if (input.spans.length === 0) {
@@ -510,7 +565,7 @@ async function collectOtlpSpans(path) {
     spans: [...input.spans],
     harness: "otlp",
     cwds: [],
-    sources: [...byTrace].map(([traceId, spans]) => selectedSessionSource({
+    sources: [...byTrace].map(([traceId, spans]) => sessionReportSource({
       harness: "otlp",
       sessionId: traceId,
       path: fileByTrace.get(traceId) ?? path,
@@ -540,7 +595,7 @@ async function collectSpans(args) {
   for (const row of selection.rows) {
     harnesses.add(row.adapter.harness);
     appendAll(spans, row.spans);
-    sources.push(selectedSessionSource(row.ref, row.spans));
+    sources.push(sessionReportSource(row.ref, row.spans));
     if (row.ref.cwd) cwds.push(row.ref.cwd);
   }
   return {
@@ -659,6 +714,46 @@ async function cmdIndex(args) {
     process.stdout.write(serializeSessionIndex(index));
   }
 }
+async function cmdBundle(args) {
+  if (!args.session) {
+    throw new Error("bundle needs --session <id|path>; run `traces list` to pick a session ID");
+  }
+  if (!args.out) throw new Error("bundle needs --out <dir> \u2014 a new or empty directory for the bundle");
+  const { adapter, ref } = await resolveSelectedSession(args);
+  const result = await assembleSessionBundle({
+    adapter,
+    ref,
+    outDir: args.out,
+    minLoopOccurrences: args.minLoop,
+    log: analystLog
+  });
+  const { manifest } = result;
+  console.log(
+    `session bundle (${manifest.view} view) \u2192 ${result.directory}  (${manifest.files.length} file(s), ${manifest.ledgerSlices.length} ledger slice(s), ${manifest.absent.length} recorded absent)`
+  );
+}
+var PROJECTABLE_VIEWS = ["evidence-only"];
+async function cmdBundleView(args) {
+  if (!args.input) {
+    throw new Error("bundle-view needs the bundle directory to project; run `traces bundle --out <dir>` first");
+  }
+  if (!args.view) {
+    throw new Error(`bundle-view needs --view <${PROJECTABLE_VIEWS.join("|")}>`);
+  }
+  if (!PROJECTABLE_VIEWS.includes(args.view)) {
+    throw new Error(`unknown view "${args.view}"; projectable views: ${PROJECTABLE_VIEWS.join(", ")}`);
+  }
+  if (!args.out) throw new Error("bundle-view needs --out <dir> \u2014 a new or empty directory for the view");
+  const result = await projectSessionBundle({
+    bundleDir: args.input,
+    outDir: args.out,
+    view: args.view
+  });
+  const { manifest, leakCheck } = result;
+  console.log(
+    `${manifest.view} view \u2192 ${result.directory}  (${manifest.files.length} file(s) carried, ${manifest.excluded.length} excluded, ${leakCheck.matches} session-text match(es) against ${leakCheck.sourceSignatures} signature(s) from ${leakCheck.comparedSources.length} excluded source(s))`
+  );
+}
 async function cmdInspect(args) {
   if (!args.input) throw new Error("inspect needs an index file; run `traces index --out session-index.json` first");
   const index = await readSessionIndexFile(args.input);
@@ -765,16 +860,43 @@ async function loadExportAttributes(args) {
 async function cmdAnalyze(args) {
   if (args.supervisorRunDir) return cmdAnalyzeSupervisorRun(args.supervisorRunDir, args);
   const result = await investigate(args, { loadDefaultConfig: false });
+  let report = result.report;
+  let verifySummary = "";
+  if (args.verifyFindings) {
+    const run = await verifyAnalyzeFindings(args, result);
+    report = `${report}
+${renderVerifiedFindingsSection(run)}`;
+    verifySummary = `, verified: ${run.counts.reproduced} reproduced / ${run.counts["fix-flipped"]} fix-flipped / ${run.counts.divergent} divergent / ${run.counts["not-replayable"]} not-replayable \u2192 ${run.out}`;
+  }
   if (args.out) {
-    await saveReport(args.out, result.report);
+    await saveReport(args.out, report);
     console.log(
-      `report \u2192 ${args.out}  (${result.findings.length} findings, ${result.pipelines.stuckLoops.findings.length} loops, OTLP: ${result.otlpPath})`
+      `report \u2192 ${args.out}  (${result.findings.length} findings, ${result.pipelines.stuckLoops.findings.length} loops, OTLP: ${result.otlpPath}${verifySummary})`
     );
   } else {
-    console.log(result.report);
+    console.log(report);
   }
   assertAgenticAnalystsRan(args, result.agenticPerAnalyst);
 }
+async function verifyAnalyzeFindings(args, result) {
+  if (args.replayCorpora.length === 0) {
+    throw new Error(
+      "analyze --verify-findings needs the executable trajectory source: pass --replay-corpus name=<labels.json>::<preparedDir> (repeatable). Harness sessions carry no docker_config, so findings cannot be replayed from the session store alone."
+    );
+  }
+  if (result.findings.length === 0) {
+    throw new Error("analyze --verify-findings: the analysis produced no findings to verify");
+  }
+  const out = args.verifyOut ?? (args.out ? `${args.out}.verify` : "traces-verify-findings");
+  return verifyFindings(result.findings, {
+    source: { kind: "corpus", corpora: args.replayCorpora.map(parseCorpusFlag) },
+    out,
+    apiKey: process.env.SANDBOX_API_KEY,
+    baseUrl: process.env.SANDBOX_API_URL ?? DEFAULT_SANDBOX_BASE_URL,
+    onProgress: (message) => process.stderr.write(`${message}
+`)
+  });
+}
 async function cmdAnalyzeSupervisorRun(runDir, args) {
   const runContextDirs = await findFileRunContextDirs(runDir);
   const nested = runContextDirs.length > 0 ? [] : await findSupervisorRunDirs(runDir);
@@ -845,7 +967,7 @@ async function collectImportedSpans(args) {
     spans: result.spans,
     harness: result.format,
     cwds: [],
-    sources: [...sessions].map(([sessionId, spans]) => selectedSessionSource({
+    sources: [...sessions].map(([sessionId, spans]) => sessionReportSource({
       harness: result.format,
       sessionId,
       path: args.input,
@@ -863,7 +985,7 @@ function analystLog(msg, fields) {
 }
 function externalAnalyzersFromArgs(args) {
   return args.analyzers.map(
-    (spec) => spec === "halo" ? haloAnalyzer({ defaultPrompt: args.analyzerPrompt, model: args.model }) : spec === "hodoscope" ? hodoscopeAnalyzer({ summarizeModel: args.model }) : commandAnalyzer({ name: spec, command: spec, args: (p, prompt) => prompt ? [p, prompt] : [p] })
+    (spec) => spec === "halo" ? haloAnalyzer({ defaultPrompt: args.analyzerPrompt, model: args.model }) : spec === "hodoscope" ? hodoscopeAnalyzer({ summarizeModel: args.model }) : spec === "prime" ? primeAnalyzer({ defaultPrompt: args.analyzerPrompt, ...args.model ? { model: args.model } : {} }) : commandAnalyzer({ name: spec, command: spec, args: (p, prompt) => prompt ? [p, prompt] : [p] })
   );
 }
 async function cmdInvestigate(args) {
@@ -1267,6 +1389,17 @@ Commands:
   improve   Write findings, evidence, report, and canonical trace artifacts
   convert   Emit OTLP-JSONL only, to --otlp-out (HALO: use analyze --analyzer halo)
   index     Emit a reusable session index JSON for later investigation
+  bundle    Assemble one session's durable evidence directory: transcript +
+            subagents, derived index/report/evidence/OTLP, the repo's .evolve
+            ledger sliced to the session window, git log, and a sha256 manifest
+            (needs --session <id|path> and --out <new-dir>). This is the FULL
+            view: it holds the session's own words, for a reader who cites them
+  bundle-view <bundle-dir>
+            Project an assembled bundle into a narrower view for a consumer that
+            must NOT read the session's own words. --view evidence-only carries
+            the counted artifacts and structured ledger rows, excludes the
+            transcript, the report, the spans and every prose file by name, and
+            refuses to write a view whose text repeats an excluded source
   inspect   Read a session index and print ranked improvement findings
   export    Convert evidence/events files to OpenInference JSONL for HALO
   import-codetracebench
@@ -1277,6 +1410,10 @@ Commands:
   replay-verify-batch
             Measure replayability + fix-flip rates across gold-labeled corpora:
             arm A per replayable case, LLM-generated arm-B fixes (--help for flags)
+  verify-findings
+            Execute recorded analyst findings as sandbox replay proofs: each
+            finding \u2192 reproduced | fix-flipped | divergent | not-replayable,
+            with a receipt directory per finding (--help for flags)
   evidence  Emit compact session-evidence JSONL for downstream policy miners
   stream    Emit JSONL trace stream events for live visualizers or replay
   watch     Online observer: tail active sessions, notify on loops + semantic findings
@@ -1316,6 +1453,9 @@ Options:
   --metadata <json> analyze/export file: attach JSON object fields as span attributes
   --attr <k=v>     analyze/export file: attach one span attribute (repeatable)
   --mode <kind>    stream: visualizer | findings | agent (default visualizer)
+  --view <name>    bundle-view: which projection to write. evidence-only is the
+                   writer's view; the full view is the bundle itself, so there is
+                   nothing to project into it
   --replay, --once stream: scan once and exit (default for positional input / --session)
   --once           watch <target>: print ONE snapshot and exit, for scripts and agents
   --no-spans       stream: omit per-span pulse events
@@ -1329,8 +1469,17 @@ Options:
   --model <id>     Model for --llm, HALO, and Hodoscope (default for --llm: ${DEFAULT_ANALYST_MODEL})
   --config <path>  investigate/improve/stream: JS config with analysts, liveAnalysts, or external analyzers
   --budget <usd>   USD cap for agentic analysts
-  --analyzer <id>  analyze: also run halo, hodoscope, or an installed command (repeatable)
+  --analyzer <id>  analyze: also run halo, hodoscope, prime, or an installed command (repeatable)
+                   prime posts the full span projection to an OpenAI-compatible bridge
+                   (TRACES_PRIME_BRIDGE_URL, default http://localhost:4181;
+                   TRACES_PRIME_MODEL, default prime/zai/glm-5.2; TRACES_PRIME_TIMEOUT_MS)
   --analyzer-prompt <p>  analyze: prompt passed to external analyzers (default: diagnose)
+  --verify-findings analyze: execute the findings as sandbox replay proofs and mark
+                   each VERIFIED (receipt path) or UNVERIFIABLE (reason). Needs
+                   --replay-corpus + a running sandbox (SANDBOX_API_KEY/_URL)
+  --replay-corpus name=<labels.json>::<preparedDir>
+                   trajectory source for --verify-findings (repeatable)
+  --verify-out <dir> receipt root for --verify-findings (default: <--out>.verify)
   --interval <s>   watch/stream: poll interval seconds (sessions 5, run tree 2)
   --window <m>     watch/stream: only sessions active in the last N minutes (default 30)
   --min-loop <n>   Min identical repeated calls to flag a loop (default 3)
@@ -1365,6 +1514,10 @@ async function main() {
     await cmdReplayVerifyBatch(rawArgs.slice(1));
     return;
   }
+  if (rawArgs[0] === "verify-findings") {
+    await cmdVerifyFindings(rawArgs.slice(1));
+    return;
+  }
   const parsedArgs = parseArgs(rawArgs);
   if (parsedArgs.help) {
     if (parsedArgs.command === "import-codetracebench" || parsedArgs.command === "help" && parsedArgs.input === "import-codetracebench") usageImportCodeTraceBench();
@@ -1373,7 +1526,9 @@ async function main() {
     else usage();
     return;
   }
-  const args = validateOtlpSelection(validateWorkflowSelection(applyCurrentSessionSelection(parsedArgs)));
+  const args = validateOtlpSelection(
+    validateViewSelection(validateWorkflowSelection(applyCurrentSessionSelection(parsedArgs)))
+  );
   switch (args.command) {
     case "help":
       if (args.input === "import-codetracebench") usageImportCodeTraceBench();
@@ -1402,6 +1557,12 @@ async function main() {
     case "index":
       await cmdIndex(args);
       break;
+    case "bundle":
+      await cmdBundle(args);
+      break;
+    case "bundle-view":
+      await cmdBundleView(args);
+      break;
     case "inspect":
       await cmdInspect(args);
       break;