@tangle-network/traces 0.15.4 → 0.16.0

package/dist/{chunk-SKOW5V5U.js → chunk-G5KKIQZ6.js}

@@ -881,8 +881,8 @@ function traceContractBuildId(fromFile = import.meta.url) {
 }
 var buildIdCache = /* @__PURE__ */ new Map();
 function traceContractBuildIdOrNull(fromFile = import.meta.url) {
-  const cached = buildIdCache.get(fromFile);
-  if (cached !== void 0) return cached;
+  const cached2 = buildIdCache.get(fromFile);
+  if (cached2 !== void 0) return cached2;
   let resolved;
   try {
     resolved = traceContractBuildId(fromFile);
@@ -1018,8 +1018,8 @@ function serializeSpans(spans) {
 async function writeOtlpFile(spans, outPath) {
   const { mkdtemp: mkdtemp8, writeFile: writeFile13 } = await import("fs/promises");
   const { tmpdir: tmpdir8 } = await import("os");
-  const { join: join34 } = await import("path");
-  const path = outPath ?? join34(await mkdtemp8(join34(tmpdir8(), "traces-")), "spans.otlp.jsonl");
+  const { join: join35 } = await import("path");
+  const path = outPath ?? join35(await mkdtemp8(join35(tmpdir8(), "traces-")), "spans.otlp.jsonl");
   await writeFile13(path, serializeSpans(spans), "utf8");
   return path;
 }
@@ -3844,9 +3844,9 @@ function itemCountsJson(counts) {
 }
 function placeInnerSpans(pending, windows) {
   return pending.map((entry) => {
-    const { parent, join: join34 } = joinItem(windows, entry.startMs, entry.endMs);
+    const { parent, join: join35 } = joinItem(windows, entry.startMs, entry.endMs);
     if (parent) entry.span.parent_span_id = parent.span_id;
-    entry.span.attributes["traces.codex.item_join"] = join34;
+    entry.span.attributes["traces.codex.item_join"] = join35;
     return entry.span;
   });
 }
@@ -4170,8 +4170,8 @@ var CodexAdapter = class {
     const completedItemKeys = /* @__PURE__ */ new Set();
     const unmodeledItemCounts = /* @__PURE__ */ new Map();
     const droppedItemCounts = /* @__PURE__ */ new Map();
-    const countItem = (counts, label) => {
-      counts.set(label, (counts.get(label) ?? 0) + 1);
+    const countItem = (counts, label2) => {
+      counts.set(label2, (counts.get(label2) ?? 0) + 1);
     };
     let taskIndex = 0;
     const unpairedUserItems = [];
@@ -4681,11 +4681,11 @@ var CodexAdapter = class {
         const input = reportedCount(sessionTotalUsage.input_tokens);
         const output = reportedCount(sessionTotalUsage.output_tokens);
         const reasoning = reportedCount(sessionTotalUsage.reasoning_output_tokens);
-        const cached = reportedCount(sessionTotalUsage.cached_input_tokens);
+        const cached2 = reportedCount(sessionTotalUsage.cached_input_tokens);
         if (input !== void 0) root.attributes[SESSION_TOTAL_INPUT_TOKENS] = input;
         if (output !== void 0) root.attributes[SESSION_TOTAL_OUTPUT_TOKENS] = output;
         if (reasoning !== void 0) root.attributes[SESSION_TOTAL_REASONING_TOKENS] = reasoning;
-        if (cached !== void 0) root.attributes[SESSION_TOTAL_CACHED_INPUT_TOKENS] = cached;
+        if (cached2 !== void 0) root.attributes[SESSION_TOTAL_CACHED_INPUT_TOKENS] = cached2;
       }
     }
     if (inheritedSpansEmitted > 0) root.attributes[INHERITED_SPAN_COUNT_ATTR] = inheritedSpansEmitted;
@@ -4759,14 +4759,14 @@ function earlier(left, right) {
 function later(left, right) {
   return Date.parse(left) >= Date.parse(right) ? left : right;
 }
-function requireObject2(value, sourcePath, label) {
+function requireObject2(value, sourcePath, label2) {
   const object = objectValue(value);
-  if (!object) throw new CodexExecStreamError(sourcePath, `${label} must be an object`);
+  if (!object) throw new CodexExecStreamError(sourcePath, `${label2} must be an object`);
   return object;
 }
-function requireString(value, sourcePath, label) {
+function requireString(value, sourcePath, label2) {
   const string = stringValue(value);
-  if (!string) throw new CodexExecStreamError(sourcePath, `${label} must be a non-empty string`);
+  if (!string) throw new CodexExecStreamError(sourcePath, `${label2} must be a non-empty string`);
   return string;
 }
 function optionalTokenCount(usage, key, sourcePath) {
@@ -6719,7 +6719,7 @@ function extractAbsolutePaths(spans) {
 async function resolveRepoAttrs(cwd) {
   if (!cwd) return {};
   const attrs = { [ATTR.CWD]: cwd };
-  const basename18 = (() => {
+  const basename19 = (() => {
     const trimmed = cwd.replace(/\/+$/g, "");
     const idx = trimmed.lastIndexOf("/");
     const name = idx === -1 ? trimmed : trimmed.slice(idx + 1);
@@ -6741,7 +6741,7 @@ async function resolveRepoAttrs(cwd) {
     if (commit) attrs[ATTR.GIT_COMMIT] = commit;
   } catch {
   }
-  attrs[ATTR.SUBJECT_KEY] = basename18;
+  attrs[ATTR.SUBJECT_KEY] = basename19;
   return attrs;
 }
 async function repoCandidateForPath(path) {
@@ -6797,8 +6797,8 @@ function replaceRepoAttrs(spans, attrs) {
   }
 }
 async function resolutionForWorkdirEvidence(evidence3, cache) {
-  const cached = cache.get(evidence3.path);
-  if (cached !== void 0) return cached;
+  const cached2 = cache.get(evidence3.path);
+  if (cached2 !== void 0) return cached2;
   const cwd = await repoCandidateForPath(evidence3.path);
   if (!cwd) {
     cache.set(evidence3.path, null);
@@ -6902,9 +6902,9 @@ async function locateSessions(adapter, opts = {}) {
   for (const ref of refs) {
     let matched = cwdMatchesSelection(ref.cwd, cwdSelections);
     if (!matched && ref.cwd !== null) {
-      const cached = resolvedMatch.get(ref.cwd);
-      matched = cached ?? await cwdMatchesSelectionResolved(ref.cwd, cwdSelections);
-      if (cached === void 0) resolvedMatch.set(ref.cwd, matched);
+      const cached2 = resolvedMatch.get(ref.cwd);
+      matched = cached2 ?? await cwdMatchesSelectionResolved(ref.cwd, cwdSelections);
+      if (cached2 === void 0) resolvedMatch.set(ref.cwd, matched);
     }
     if (!matched && !(ref.cwd === null && ref.integrity)) continue;
     byKey.set(refKey(ref), ref);
@@ -7534,106 +7534,106 @@ var RESULT_FAILURE_KEYS = /* @__PURE__ */ new Set(["analyzer", "kind", "ok", "ou
 var RESULT_REPORT_KEYS = /* @__PURE__ */ new Set(["analyzer", "kind", "ok", "output"]);
 var RESULT_FINDING_KEYS = /* @__PURE__ */ new Set(["analyzer", "kind", "ok", "output", "findings"]);
 var RESULT_DISCOVERY_KEYS = /* @__PURE__ */ new Set(["analyzer", "kind", "ok", "output", "candidates"]);
-function record(value, label) {
+function record(value, label2) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new TypeError(`${label} must be an object`);
+    throw new TypeError(`${label2} must be an object`);
   }
   return value;
 }
-function assertOnlyKeys(value, allowed, label) {
+function assertOnlyKeys(value, allowed, label2) {
   for (const key of Object.keys(value)) {
-    if (!allowed.has(key)) throw new TypeError(`${label} contains unexpected field '${key}'`);
+    if (!allowed.has(key)) throw new TypeError(`${label2} contains unexpected field '${key}'`);
   }
 }
-function text(value, label) {
-  if (typeof value !== "string") throw new TypeError(`${label} must be a string`);
+function text(value, label2) {
+  if (typeof value !== "string") throw new TypeError(`${label2} must be a string`);
   return value;
 }
-function nonEmptyString3(value, label) {
-  const decoded = text(value, label);
-  if (decoded.length === 0) throw new TypeError(`${label} must be a non-empty string`);
+function nonEmptyString3(value, label2) {
+  const decoded = text(value, label2);
+  if (decoded.length === 0) throw new TypeError(`${label2} must be a non-empty string`);
   return decoded;
 }
-function optionalString(value, label) {
-  return value === void 0 ? void 0 : text(value, label);
+function optionalString(value, label2) {
+  return value === void 0 ? void 0 : text(value, label2);
 }
-function boolean(value, label) {
-  if (typeof value !== "boolean") throw new TypeError(`${label} must be a boolean`);
+function boolean(value, label2) {
+  if (typeof value !== "boolean") throw new TypeError(`${label2} must be a boolean`);
   return value;
 }
-function integer(value, label, minimum) {
+function integer(value, label2, minimum) {
   if (!Number.isSafeInteger(value) || value < minimum) {
-    throw new TypeError(`${label} must be a safe integer >= ${minimum}`);
+    throw new TypeError(`${label2} must be a safe integer >= ${minimum}`);
   }
   return value;
 }
-function optionalRecord(value, label) {
-  return value === void 0 ? void 0 : record(value, label);
+function optionalRecord(value, label2) {
+  return value === void 0 ? void 0 : record(value, label2);
 }
 function spanEvidenceUri(traceId, spanId) {
   return `trace://${encodeURIComponent(traceId)}/span/${encodeURIComponent(spanId)}`;
 }
-function validateSpanEvidence(uri, knownSpanUris, label) {
+function validateSpanEvidence(uri, knownSpanUris, label2) {
   if (knownSpanUris && !knownSpanUris.has(uri)) {
-    throw new TypeError(`${label} references unknown span evidence URI '${uri}'`);
+    throw new TypeError(`${label2} references unknown span evidence URI '${uri}'`);
   }
 }
-function decodeEvidenceRef(value, label, knownSpanUris) {
-  const ref = record(value, label);
-  assertOnlyKeys(ref, EVIDENCE_KEYS, label);
-  const kind = nonEmptyString3(ref.kind, `${label}.kind`);
+function decodeEvidenceRef(value, label2, knownSpanUris) {
+  const ref = record(value, label2);
+  assertOnlyKeys(ref, EVIDENCE_KEYS, label2);
+  const kind = nonEmptyString3(ref.kind, `${label2}.kind`);
   if (!["span", "event", "artifact", "finding", "metric"].includes(kind)) {
-    throw new TypeError(`${label}.kind is unsupported`);
+    throw new TypeError(`${label2}.kind is unsupported`);
   }
-  const uri = nonEmptyString3(ref.uri, `${label}.uri`);
-  if (kind === "span") validateSpanEvidence(uri, knownSpanUris, label);
-  const excerpt = optionalString(ref.excerpt, `${label}.excerpt`);
+  const uri = nonEmptyString3(ref.uri, `${label2}.uri`);
+  if (kind === "span") validateSpanEvidence(uri, knownSpanUris, label2);
+  const excerpt = optionalString(ref.excerpt, `${label2}.excerpt`);
   return {
     kind,
     uri,
     ...excerpt === void 0 ? {} : { excerpt }
   };
 }
-function decodeFinding(value, label, knownSpanUris) {
-  const finding2 = record(value, label);
-  assertOnlyKeys(finding2, FINDING_KEYS, label);
+function decodeFinding(value, label2, knownSpanUris) {
+  const finding2 = record(value, label2);
+  assertOnlyKeys(finding2, FINDING_KEYS, label2);
   if (finding2.schema_version !== "1.0.0") {
-    throw new TypeError(`${label}.schema_version must be '1.0.0'`);
+    throw new TypeError(`${label2}.schema_version must be '1.0.0'`);
   }
-  const findingId = nonEmptyString3(finding2.finding_id, `${label}.finding_id`);
-  const analystId = nonEmptyString3(finding2.analyst_id, `${label}.analyst_id`);
-  const producedAt = nonEmptyString3(finding2.produced_at, `${label}.produced_at`);
+  const findingId = nonEmptyString3(finding2.finding_id, `${label2}.finding_id`);
+  const analystId = nonEmptyString3(finding2.analyst_id, `${label2}.analyst_id`);
+  const producedAt = nonEmptyString3(finding2.produced_at, `${label2}.produced_at`);
   if (!Number.isFinite(Date.parse(producedAt))) {
-    throw new TypeError(`${label}.produced_at must be a valid timestamp`);
+    throw new TypeError(`${label2}.produced_at must be a valid timestamp`);
   }
-  const severity = nonEmptyString3(finding2.severity, `${label}.severity`);
+  const severity = nonEmptyString3(finding2.severity, `${label2}.severity`);
   if (!["critical", "high", "medium", "low", "info"].includes(severity)) {
-    throw new TypeError(`${label}.severity is unsupported`);
+    throw new TypeError(`${label2}.severity is unsupported`);
   }
   if (!Array.isArray(finding2.evidence_refs)) {
-    throw new TypeError(`${label}.evidence_refs must be an array`);
+    throw new TypeError(`${label2}.evidence_refs must be an array`);
   }
   if (typeof finding2.confidence !== "number" || !Number.isFinite(finding2.confidence) || finding2.confidence < 0 || finding2.confidence > 1) {
-    throw new TypeError(`${label}.confidence must be a finite number from 0 to 1`);
+    throw new TypeError(`${label2}.confidence must be a finite number from 0 to 1`);
   }
-  const rationale = optionalString(finding2.rationale, `${label}.rationale`);
+  const rationale = optionalString(finding2.rationale, `${label2}.rationale`);
   const recommendedAction = optionalString(
     finding2.recommended_action,
-    `${label}.recommended_action`
+    `${label2}.recommended_action`
   );
-  const validationPlan = optionalString(finding2.validation_plan, `${label}.validation_plan`);
-  const subject = optionalString(finding2.subject, `${label}.subject`);
-  const derivedFromJudge = finding2.derived_from_judge === void 0 ? void 0 : boolean(finding2.derived_from_judge, `${label}.derived_from_judge`);
-  const metadata = optionalRecord(finding2.metadata, `${label}.metadata`);
+  const validationPlan = optionalString(finding2.validation_plan, `${label2}.validation_plan`);
+  const subject = optionalString(finding2.subject, `${label2}.subject`);
+  const derivedFromJudge = finding2.derived_from_judge === void 0 ? void 0 : boolean(finding2.derived_from_judge, `${label2}.derived_from_judge`);
+  const metadata = optionalRecord(finding2.metadata, `${label2}.metadata`);
   return {
     schema_version: "1.0.0",
     finding_id: findingId,
     analyst_id: analystId,
     produced_at: producedAt,
     severity,
-    area: nonEmptyString3(finding2.area, `${label}.area`),
-    claim: nonEmptyString3(finding2.claim, `${label}.claim`),
-    evidence_refs: finding2.evidence_refs.map((ref, index) => decodeEvidenceRef(ref, `${label}.evidence_refs[${index}]`, knownSpanUris)),
+    area: nonEmptyString3(finding2.area, `${label2}.area`),
+    claim: nonEmptyString3(finding2.claim, `${label2}.claim`),
+    evidence_refs: finding2.evidence_refs.map((ref, index) => decodeEvidenceRef(ref, `${label2}.evidence_refs[${index}]`, knownSpanUris)),
     confidence: finding2.confidence,
     ...rationale === void 0 ? {} : { rationale },
     ...recommendedAction === void 0 ? {} : { recommended_action: recommendedAction },
@@ -7643,32 +7643,32 @@ function decodeFinding(value, label, knownSpanUris) {
     ...metadata === void 0 ? {} : { metadata }
   };
 }
-function decodeCandidate(value, label, knownSpanUris) {
-  const candidate = record(value, label);
-  assertOnlyKeys(candidate, CANDIDATE_KEYS, label);
+function decodeCandidate(value, label2, knownSpanUris) {
+  const candidate = record(value, label2);
+  assertOnlyKeys(candidate, CANDIDATE_KEYS, label2);
   if (candidate.status !== "needs_review") {
-    throw new TypeError(`${label}.status must be 'needs_review'`);
+    throw new TypeError(`${label2}.status must be 'needs_review'`);
   }
-  const traceId = nonEmptyString3(candidate.traceId, `${label}.traceId`);
-  const spanId = nonEmptyString3(candidate.spanId, `${label}.spanId`);
-  const evidenceUri = nonEmptyString3(candidate.evidenceUri, `${label}.evidenceUri`);
+  const traceId = nonEmptyString3(candidate.traceId, `${label2}.traceId`);
+  const spanId = nonEmptyString3(candidate.spanId, `${label2}.spanId`);
+  const evidenceUri = nonEmptyString3(candidate.evidenceUri, `${label2}.evidenceUri`);
   if (evidenceUri !== spanEvidenceUri(traceId, spanId)) {
-    throw new TypeError(`${label}.evidenceUri does not match its traceId and spanId`);
+    throw new TypeError(`${label2}.evidenceUri does not match its traceId and spanId`);
   }
-  validateSpanEvidence(evidenceUri, knownSpanUris, label);
-  const metadata = optionalRecord(candidate.metadata, `${label}.metadata`);
+  validateSpanEvidence(evidenceUri, knownSpanUris, label2);
+  const metadata = optionalRecord(candidate.metadata, `${label2}.metadata`);
   return {
-    engine: nonEmptyString3(candidate.engine, `${label}.engine`),
-    engineVersion: nonEmptyString3(candidate.engineVersion, `${label}.engineVersion`),
+    engine: nonEmptyString3(candidate.engine, `${label2}.engine`),
+    engineVersion: nonEmptyString3(candidate.engineVersion, `${label2}.engineVersion`),
     status: "needs_review",
-    group: nonEmptyString3(candidate.group, `${label}.group`),
-    rank: integer(candidate.rank, `${label}.rank`, 0),
-    groupSize: integer(candidate.groupSize, `${label}.groupSize`, 1),
+    group: nonEmptyString3(candidate.group, `${label2}.group`),
+    rank: integer(candidate.rank, `${label2}.rank`, 0),
+    groupSize: integer(candidate.groupSize, `${label2}.groupSize`, 1),
     traceId,
     spanId,
     evidenceUri,
-    summary: nonEmptyString3(candidate.summary, `${label}.summary`),
-    actionText: nonEmptyString3(candidate.actionText, `${label}.actionText`),
+    summary: nonEmptyString3(candidate.summary, `${label2}.summary`),
+    actionText: nonEmptyString3(candidate.actionText, `${label2}.actionText`),
     ...metadata === void 0 ? {} : { metadata }
   };
 }
@@ -7702,57 +7702,57 @@ function decodeExternalAnalysisPayload(value) {
   throw new TypeError(`external analyzer payload.kind '${kind}' is unsupported`);
 }
 function decodeExternalAnalysisResult(value, analyzerName, knownSpanUris) {
-  const label = `external analyzer '${analyzerName}' result`;
-  const result = record(value, label);
-  const reportedAnalyzer = nonEmptyString3(result.analyzer, `${label}.analyzer`);
+  const label2 = `external analyzer '${analyzerName}' result`;
+  const result = record(value, label2);
+  const reportedAnalyzer = nonEmptyString3(result.analyzer, `${label2}.analyzer`);
   if (reportedAnalyzer !== analyzerName) {
     throw new TypeError(
       `external analyzer '${analyzerName}' reported analyzer '${reportedAnalyzer}'`
     );
   }
-  const kind = nonEmptyString3(result.kind, `${label}.kind`);
+  const kind = nonEmptyString3(result.kind, `${label2}.kind`);
   if (!["report", "findings", "discovery"].includes(kind)) {
-    throw new TypeError(`${label}.kind '${kind}' is unsupported`);
+    throw new TypeError(`${label2}.kind '${kind}' is unsupported`);
   }
-  const ok = boolean(result.ok, `${label}.ok`);
-  const output = text(result.output, `${label}.output`);
+  const ok = boolean(result.ok, `${label2}.ok`);
+  const output = text(result.output, `${label2}.output`);
   if (!ok) {
-    assertOnlyKeys(result, RESULT_FAILURE_KEYS, label);
+    assertOnlyKeys(result, RESULT_FAILURE_KEYS, label2);
     return {
       analyzer: analyzerName,
       kind,
       ok: false,
       output,
-      error: nonEmptyString3(result.error, `${label}.error`)
+      error: nonEmptyString3(result.error, `${label2}.error`)
     };
   }
   if (kind === "report") {
-    assertOnlyKeys(result, RESULT_REPORT_KEYS, label);
+    assertOnlyKeys(result, RESULT_REPORT_KEYS, label2);
     return { analyzer: analyzerName, kind, ok: true, output };
   }
   if (kind === "findings") {
-    assertOnlyKeys(result, RESULT_FINDING_KEYS, label);
+    assertOnlyKeys(result, RESULT_FINDING_KEYS, label2);
     if (!Array.isArray(result.findings)) {
-      throw new TypeError(`${label}.findings must be an array`);
+      throw new TypeError(`${label2}.findings must be an array`);
     }
     return {
       analyzer: analyzerName,
       kind,
       ok: true,
       output,
-      findings: result.findings.map((finding2, index) => decodeFinding(finding2, `${label}.findings[${index}]`, knownSpanUris))
+      findings: result.findings.map((finding2, index) => decodeFinding(finding2, `${label2}.findings[${index}]`, knownSpanUris))
     };
   }
-  assertOnlyKeys(result, RESULT_DISCOVERY_KEYS, label);
+  assertOnlyKeys(result, RESULT_DISCOVERY_KEYS, label2);
   if (!Array.isArray(result.candidates)) {
-    throw new TypeError(`${label}.candidates must be an array`);
+    throw new TypeError(`${label2}.candidates must be an array`);
   }
   return {
     analyzer: analyzerName,
     kind: "discovery",
     ok: true,
     output,
-    candidates: result.candidates.map((candidate, index) => decodeCandidate(candidate, `${label}.candidates[${index}]`, knownSpanUris))
+    candidates: result.candidates.map((candidate, index) => decodeCandidate(candidate, `${label2}.candidates[${index}]`, knownSpanUris))
   };
 }
 
@@ -8535,6 +8535,7 @@ function readPullRequests(spans) {
 
 // src/session-facts.ts
 import { OPENINFERENCE_SPAN_KIND as OPENINFERENCE_SPAN_KIND4, TOOL_NAME as TOOL_NAME5 } from "@tangle-network/agent-eval/trace-attributes";
+import { ingestSpans, rankFirstFailure } from "@tangle-network/agent-eval/diagnosis";
 var SESSION_TOKEN_TOTAL_ATTR = "traces.session.total_tokens";
 var SPAN_SYNTHESIZED_ATTR = "traces.codex.span_synthesized";
 var CORRUPTION_COUNT_ATTR = "traces.session.corruption_count";
@@ -8910,6 +8911,11 @@ function sessionFactsForTrace(traceId, sessionId, unordered) {
     changedFiles: changedFilesFact(files, truncatedInputs, unresolvedPaths),
     firstRecordAt: firstSpan ? { value: firstSpan.start_time, spanIds: [firstSpan.span_id], unavailable: null } : { value: null, spanIds: [], unavailable: "no span of this session's own records carries a parseable start time" },
     lastRecordAt: lastSpan ? { value: lastSpan.end_time, spanIds: [lastSpan.span_id], unavailable: null } : { value: null, spanIds: [], unavailable: "no span of this session's own records carries a parseable end time" },
+    // rankFirstFailure throws on an empty list (distinct from "every span is
+    // UNSET", which it reports as status 'unknown'); a trace whose spans are
+    // all traces.span.subagent — every record folded into subagents' own
+    // reports — legitimately has no records of its own to rank.
+    firstFailure: ownSpans.length === 0 ? { status: "unknown", traceId, unsetCount: 0, reason: "no span of this session's own records" } : rankFirstFailure(ingestSpans(ownSpans, { contentIncluded: true }).spans),
     tokenTotal: tokenSpan ? {
       value: tokenSpan.attributes[SESSION_TOKEN_TOTAL_ATTR],
       spanIds: [tokenSpan.span_id],
@@ -8931,10 +8937,10 @@ function buildSessionFactsReport(spans, options = {}) {
     sessions: computeSessionFacts(spans)
   };
 }
-function factLine(label, fact, rendered) {
-  if (fact.value === null) return `  ${label}: unavailable \u2014 ${fact.unavailable}`;
+function factLine(label2, fact, rendered) {
+  if (fact.value === null) return `  ${label2}: unavailable \u2014 ${fact.unavailable}`;
   const partial = fact.partial ? ` (partial: ${fact.partial})` : "";
-  return `  ${label}: ${rendered}${partial}`;
+  return `  ${label2}: ${rendered}${partial}`;
 }
 function renderSessionFacts(report) {
   const lines = [
@@ -8978,6 +8984,7 @@ function renderSessionFacts(report) {
     lines.push(factLine("first record", facts.firstRecordAt, String(facts.firstRecordAt.value)));
     lines.push(factLine("last record", facts.lastRecordAt, String(facts.lastRecordAt.value)));
     lines.push(factLine("token total", facts.tokenTotal, String(facts.tokenTotal.value)));
+    lines.push(`  first failure: ${renderFirstFailure(facts.firstFailure)}`);
     if ((facts.unreadRecords.value ?? 0) > 0) {
       lines.push(`  unread records: ${facts.unreadRecords.value} (the facts above are computed from the rest)`);
     }
@@ -8988,6 +8995,15 @@ function renderSessionFacts(report) {
   return `${lines.join("\n")}
 `;
 }
+function renderFirstFailure(failure2) {
+  if (failure2.status === "unknown") return `unknown \u2014 not recorded whether this run failed (${failure2.reason})`;
+  if (failure2.status === "none") return `none recorded (${failure2.reason})`;
+  if (failure2.status === "ambiguous") {
+    return `ambiguous ${failure2.stage}: ${failure2.reason} (${failure2.candidates.join(", ")})`;
+  }
+  const message = failure2.message ? ` \u2014 ${failure2.message.split("\n")[0]?.slice(0, 160)}` : "";
+  return `${failure2.stage} ${failure2.kind} "${failure2.name}" [${failure2.spanId}], blame ${failure2.blame}${message}`;
+}
 var PREPARED_CONTEXT_BYTE_CEILING = 3e4;
 function renderSessionFactsContext(report, options = {}) {
   const ceiling = options.byteCeiling ?? PREPARED_CONTEXT_BYTE_CEILING;
@@ -9135,7 +9151,26 @@ function compactFacts(facts) {
     },
     first_record_at: factJson(facts.firstRecordAt),
     last_record_at: factJson(facts.lastRecordAt),
-    token_total: factJson(facts.tokenTotal)
+    token_total: factJson(facts.tokenTotal),
+    first_failure: compactFirstFailure(facts.firstFailure)
+  };
+}
+function compactFirstFailure(failure2) {
+  if (failure2.status === "unknown") {
+    return { status: "unknown", reason: failure2.reason, unset_count: failure2.unsetCount };
+  }
+  if (failure2.status === "none") return { status: "none", reason: failure2.reason };
+  if (failure2.status === "ambiguous") {
+    return { status: "ambiguous", stage: failure2.stage, reason: failure2.reason, span_ids: failure2.candidates };
+  }
+  return {
+    status: "found",
+    stage: failure2.stage,
+    span_id: failure2.spanId,
+    name: failure2.name,
+    kind: failure2.kind,
+    blame: failure2.blame,
+    message: failure2.message
   };
 }
 function sessionFactsContext(spans, options = {}) {
@@ -9146,7 +9181,7 @@ function sessionFactsContext(spans, options = {}) {
   if (report.sessions.length === 0) return void 0;
   return renderSessionFactsContext(report, options);
 }
-var SESSION_FACTS_VERSION_SUFFIX = "session-facts.1";
+var SESSION_FACTS_VERSION_SUFFIX = "session-facts.2";
 function withSessionFactsContext(definitions, spans, options = {}) {
   const sheet = sessionFactsContext(spans, options);
   if (sheet === void 0) return [...definitions];
@@ -9180,7 +9215,6 @@ import { dirname as dirname8, isAbsolute as isAbsolute4, join as join20, relativ
 
 // src/bundle.ts
 import { createHash as createHash8 } from "crypto";
-import { readFileSync as readFileSync2 } from "fs";
 import { copyFile, cp, lstat, mkdir as mkdir2, readdir as readdir16, readFile as readFile7, stat as stat14, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname7, join as join19, relative as relative4, resolve as resolve6, sep } from "path";
 
@@ -9207,34 +9241,13 @@ var SEVERITY_BADGE = {
   info: "\u2139\uFE0F  INFO"
 };
 var CAPABILITY_ANALYSES = {
-  "token-accounting": {
-    analysis: "execution facts \u2192 Direct model usage (input/output/reasoning/cache token totals)",
-    built: true
-  },
-  "cost-attribution": {
-    analysis: "execution facts \u2192 Cost coverage (observed vs estimated USD)",
-    built: true
-  },
-  "tool-usage": {
-    analysis: "tool-usage table + per-tool duplicate/retry/error rates + stuck-loop detection",
-    built: true
-  },
-  "loop-convergence": {
-    analysis: "round-over-round convergence (did round N+1 improve on N)",
-    built: true
-  },
-  "tree-comparison": {
-    analysis: "arm-vs-arm comparison across branches of one run \u2014 NOT YET IMPLEMENTED in this package",
-    built: false
-  },
-  "steering-chain": {
-    analysis: "steering chain (which verdict caused which retry)",
-    built: true
-  },
-  "latency-analysis": {
-    analysis: "latency + critical-path timing distributions",
-    built: true
-  }
+  "token-accounting": "execution facts \u2192 Direct model usage (input/output/reasoning/cache token totals)",
+  "cost-attribution": "execution facts \u2192 Cost coverage (observed vs estimated USD)",
+  "tool-usage": "tool-usage table + per-tool duplicate/retry/error rates + stuck-loop detection",
+  "loop-convergence": "round-over-round convergence (did round N+1 improve on N)",
+  "tree-comparison": "arm-vs-arm comparison: `traces diff <file>#branch=<a> <file>#branch=<b>` marks where two arms first diverge",
+  "steering-chain": "steering chain (which verdict caused which retry)",
+  "latency-analysis": "latency + critical-path timing distributions"
 };
 function unavailableCapabilities(validation) {
   return new Map(
@@ -9311,13 +9324,10 @@ function conformanceOfSpans(spans) {
 function skippedAnalyses(validation) {
   return validation.capabilities.filter((capability) => !capability.available).map((capability) => ({
     capability: capability.name,
-    analysis: CAPABILITY_ANALYSES[capability.name]?.analysis ?? "analyses keyed off this capability",
+    analysis: CAPABILITY_ANALYSES[capability.name] ?? "analyses keyed off this capability",
     reason: capability.reason ?? "no reason recorded"
   }));
 }
-function unbuiltAnalyses(validation) {
-  return validation.capabilities.filter((capability) => capability.available && CAPABILITY_ANALYSES[capability.name]?.built === false).map((capability) => capability.name);
-}
 function tableCell(value) {
   return value.replace(/\s+/g, " ").replaceAll("|", "\\|").trim();
 }
@@ -9328,12 +9338,8 @@ function spanIdSample(finding2) {
   return ids.length > SPAN_ID_SAMPLE ? `${shown} +${ids.length - SPAN_ID_SAMPLE} more` : shown;
 }
 function capabilityRow(capability) {
-  const entry = CAPABILITY_ANALYSES[capability.name];
-  const analysis = entry?.analysis ?? "\u2014";
-  if (!capability.available) {
-    return `| \`${capability.name}\` | \u274C unavailable | ${tableCell(analysis)} | ${tableCell(capability.reason ?? "no reason recorded")} |`;
-  }
-  return entry?.built === false ? `| \`${capability.name}\` | \u26A0\uFE0F available, unused | ${tableCell(analysis)} | the trace supports it; this package has no analysis for it yet |` : `| \`${capability.name}\` | \u2705 available | ${tableCell(analysis)} | \u2014 |`;
+  const analysis = CAPABILITY_ANALYSES[capability.name] ?? "\u2014";
+  return capability.available ? `| \`${capability.name}\` | \u2705 available | ${tableCell(analysis)} | \u2014 |` : `| \`${capability.name}\` | \u274C unavailable | ${tableCell(analysis)} | ${tableCell(capability.reason ?? "no reason recorded")} |`;
 }
 function renderInheritedLoss(lines, unreadable) {
   if (unreadable === void 0 || unreadable.inherited === 0) return;
@@ -9456,26 +9462,17 @@ function conformanceBody(validation, opts) {
   for (const capability of validation.capabilities) lines.push(capabilityRow(capability));
   lines.push("");
   const skipped = skippedAnalyses(validation);
-  const unbuilt = unbuiltAnalyses(validation);
-  if (skipped.length > 0 || unbuilt.length > 0) {
+  if (skipped.length > 0) {
     lines.push(`${heading}# analyses skipped, and why`);
     lines.push("");
-    if (skipped.length > 0) {
-      lines.push(
-        "These reported nothing because the trace never carried what they read \u2014 not because the run was uneventful. Every section they feed is marked at the table, not only here."
-      );
-      lines.push("");
-      for (const entry of skipped) {
-        lines.push(`- **${entry.analysis}** \u2014 skipped: ${entry.reason} (\`${entry.capability}\`).`);
-      }
-      lines.push("");
-    }
-    if (unbuilt.length > 0) {
-      lines.push(
-        `These are supported by the trace and **not yet implemented here**: ${unbuilt.map((name) => `\`${name}\``).join(", ")}. The spans carry what they need; the analysis does not exist, so nothing about them appears below.`
-      );
-      lines.push("");
+    lines.push(
+      "These reported nothing because the trace never carried what they read \u2014 not because the run was uneventful. Every section they feed is marked at the table, not only here."
+    );
+    lines.push("");
+    for (const entry of skipped) {
+      lines.push(`- **${entry.analysis}** \u2014 skipped: ${entry.reason} (\`${entry.capability}\`).`);
     }
+    lines.push("");
   }
   return lines.join("\n");
 }
@@ -9840,10 +9837,10 @@ async function readLinuxProcProcessTable() {
   const rows = await Promise.all(
     entries.filter((entry) => entry.isDirectory() && /^\d+$/.test(entry.name)).map(async (entry) => {
       try {
-        const stat18 = await readFile5(`/proc/${entry.name}/stat`, "utf8");
-        const commandEnd = stat18.lastIndexOf(")");
+        const stat19 = await readFile5(`/proc/${entry.name}/stat`, "utf8");
+        const commandEnd = stat19.lastIndexOf(")");
         if (commandEnd < 0) return void 0;
-        const fields = stat18.slice(commandEnd + 1).trim().split(/\s+/);
+        const fields = stat19.slice(commandEnd + 1).trim().split(/\s+/);
         const pid = Number(entry.name);
         const parentPid = Number(fields[1]);
         if (!Number.isSafeInteger(pid) || pid < 1 || !Number.isSafeInteger(parentPid) || parentPid < 0) {
@@ -10062,16 +10059,16 @@ async function spanUrisFromArtifact(otlpPath, signal) {
   const uris = /* @__PURE__ */ new Set();
   let index = 0;
   for await (const value of readJsonl(otlpPath, { signal })) {
-    const label = `${otlpPath}:${index + 1}`;
+    const label2 = `${otlpPath}:${index + 1}`;
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
-      throw new TypeError(`${label} must contain an object`);
+      throw new TypeError(`${label2} must contain an object`);
     }
     const row = value;
     if (typeof row.trace_id !== "string" || row.trace_id.trim().length === 0) {
-      throw new TypeError(`${label}.trace_id must be a non-empty string`);
+      throw new TypeError(`${label2}.trace_id must be a non-empty string`);
     }
     if (typeof row.span_id !== "string" || row.span_id.trim().length === 0) {
-      throw new TypeError(`${label}.span_id must be a non-empty string`);
+      throw new TypeError(`${label2}.span_id must be a non-empty string`);
     }
     uris.add(spanEvidenceUri(row.trace_id, row.span_id));
     index += 1;
@@ -10444,10 +10441,10 @@ function decimal(value, digits = 1) {
 function measured(value, render) {
   return value === null ? "not captured" : render(value);
 }
-function distributionRow(label, distribution, unit = "") {
-  if (distribution.n === 0) return `| ${label} | 0 | not captured | not captured | not captured | not captured | not captured |`;
+function distributionRow(label2, distribution, unit = "") {
+  if (distribution.n === 0) return `| ${label2} | 0 | not captured | not captured | not captured | not captured | not captured |`;
   const value = (number) => measured(number, (captured) => `${decimal(captured)}${unit}`);
-  return `| ${label} | ${count(distribution.n)} | ${value(distribution.min)} | ${value(distribution.mean)} | ${value(distribution.p50)} | ${value(distribution.p95)} | ${value(distribution.max)} |`;
+  return `| ${label2} | ${count(distribution.n)} | ${value(distribution.min)} | ${value(distribution.mean)} | ${value(distribution.p50)} | ${value(distribution.p95)} | ${value(distribution.max)} |`;
 }
 function tokenRows(usage) {
   const rows = [
@@ -10458,7 +10455,7 @@ function tokenRows(usage) {
     ["Cache write", usage.totals.cacheWrite, usage.cacheWrite]
   ];
   return rows.map(
-    ([label, total, values]) => `| ${label} | ${count(total)} | ${count(values.n)} | ${measured(values.mean, decimal)} | ${measured(values.p50, decimal)} | ${measured(values.p95, decimal)} | ${measured(values.max, count)} |`
+    ([label2, total, values]) => `| ${label2} | ${count(total)} | ${count(values.n)} | ${measured(values.mean, decimal)} | ${measured(values.p50, decimal)} | ${measured(values.p95, decimal)} | ${measured(values.max, count)} |`
   );
 }
 function analysisCost(result) {
@@ -10951,9 +10948,9 @@ function renderAdoption(ar) {
     "- **Prompt, tools, MCP, hooks, and full agent profile:** not assessed; no baseline profile was supplied."
   );
   if (ar.skillPenetration === null) {
-    const label = ar.skillTelemetryStatus === "unsupported" ? "uncaptured/unsupported" : "uncaptured/unknown";
+    const label2 = ar.skillTelemetryStatus === "unsupported" ? "uncaptured/unsupported" : "uncaptured/unknown";
     lines.push(
-      `- **Explicit skill invocation rate:** ${label} (${ar.skillTelemetrySessions}/${ar.executionGroupCount} observed group(s) expose a dedicated Skill event)`
+      `- **Explicit skill invocation rate:** ${label2} (${ar.skillTelemetrySessions}/${ar.executionGroupCount} observed group(s) expose a dedicated Skill event)`
     );
   } else {
     const excluded = ar.executionGroupCount - ar.skillTelemetrySessions;
@@ -12257,6 +12254,17 @@ async function collectSessionSelection(groups, options = {}) {
   return { rows, ...workflow ? { workflow } : {} };
 }
 
+// src/version.ts
+import { readFileSync as readFileSync2 } from "fs";
+var cached;
+function tracesVersion() {
+  if (cached) return cached;
+  const pkg = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+  if (typeof pkg.version !== "string" || !pkg.version) throw new Error("package.json is missing version");
+  cached = pkg.version;
+  return cached;
+}
+
 // src/bundle.ts
 var SESSION_WINDOW_PAD_MS = 15 * 60 * 1e3;
 var KNOWN_LIMITS = [
@@ -12549,7 +12557,7 @@ async function assembleSessionBundle(opts) {
       transcriptPath: resolve6(ref.path),
       transcriptSha256,
       contextRoot,
-      tracesVersion: tracesPackageVersion(),
+      tracesVersion: tracesVersion(),
       sessionWindow: { firstSpanAt, lastSpanAt, padMs: SESSION_WINDOW_PAD_MS }
     },
     files,
@@ -12693,16 +12701,6 @@ async function verifySessionBundle(bundleDir) {
     ...source ? { source } : {}
   };
 }
-var cachedVersion;
-function tracesPackageVersion() {
-  if (cachedVersion) return cachedVersion;
-  const pkg = JSON.parse(
-    readFileSync2(new URL("../package.json", import.meta.url), "utf8")
-  );
-  if (typeof pkg.version !== "string" || !pkg.version) throw new Error("package.json is missing version");
-  cachedVersion = pkg.version;
-  return cachedVersion;
-}
 
 // src/bundle-source.ts
 var SHA256 = /^[a-f0-9]{64}$/;
@@ -13330,9 +13328,9 @@ async function containedDirectory(path) {
   }
   return canonical;
 }
-async function containedFile(root, candidate, label) {
+async function containedFile(root, candidate, label2) {
   const path = await optionalContainedFile(root, candidate);
-  if (!path) throw new Error(`${label} is missing`);
+  if (!path) throw new Error(`${label2} is missing`);
   return path;
 }
 async function optionalContainedFile(root, candidate) {
@@ -13564,49 +13562,49 @@ function parseSteps(text2, row) {
     );
   }
   return parsed.map((value, index) => {
-    const label = `${row.trajId}/steps.json[${index}]`;
-    if (!isObject3(value)) throw new TypeError(`${label} must be an object`);
-    const stepId = positiveInteger2(value.step_id, `${label}.step_id`);
+    const label2 = `${row.trajId}/steps.json[${index}]`;
+    if (!isObject3(value)) throw new TypeError(`${label2} must be an object`);
+    const stepId = positiveInteger2(value.step_id, `${label2}.step_id`);
     if (stepId !== index + 1) {
-      throw new Error(`${label}.step_id is ${stepId}; expected ${index + 1}`);
+      throw new Error(`${label2}.step_id is ${stepId}; expected ${index + 1}`);
     }
     if (!Object.hasOwn(value, "observation")) {
-      throw new TypeError(`${label}.observation is required and may be null`);
+      throw new TypeError(`${label2}.observation is required and may be null`);
     }
     const observation = value.observation;
     if (observation !== null && typeof observation !== "string") {
-      throw new TypeError(`${label}.observation must be a string or null`);
+      throw new TypeError(`${label2}.observation must be a string or null`);
     }
     return {
       step_id: stepId,
-      action: requiredString(value.action, `${label}.action`),
+      action: requiredString(value.action, `${label2}.action`),
       observation,
-      ...value.thinking === void 0 ? {} : { thinking: requiredString(value.thinking, `${label}.thinking`) },
+      ...value.thinking === void 0 ? {} : { thinking: requiredString(value.thinking, `${label2}.thinking`) },
       ...value.parallel_group === void 0 ? {} : {
         parallel_group: nonNegativeInteger(
           value.parallel_group,
-          `${label}.parallel_group`
+          `${label2}.parallel_group`
         )
       },
-      ...value.tool_type === void 0 ? {} : { tool_type: requiredString(value.tool_type, `${label}.tool_type`) },
-      action_ref: fileRef(value.action_ref, `${label}.action_ref`),
-      observation_ref: fileRef(value.observation_ref, `${label}.observation_ref`)
+      ...value.tool_type === void 0 ? {} : { tool_type: requiredString(value.tool_type, `${label2}.tool_type`) },
+      action_ref: fileRef(value.action_ref, `${label2}.action_ref`),
+      observation_ref: fileRef(value.observation_ref, `${label2}.observation_ref`)
     };
   });
 }
-function fileRef(value, label) {
+function fileRef(value, label2) {
   if (value === null) return null;
-  if (!isObject3(value)) throw new TypeError(`${label} must be an object or null`);
-  const lineStart = positiveInteger2(value.line_start, `${label}.line_start`);
-  const lineEnd = positiveInteger2(value.line_end, `${label}.line_end`);
+  if (!isObject3(value)) throw new TypeError(`${label2} must be an object or null`);
+  const lineStart = positiveInteger2(value.line_start, `${label2}.line_start`);
+  const lineEnd = positiveInteger2(value.line_end, `${label2}.line_end`);
   if (lineEnd < lineStart) {
-    throw new RangeError(`${label}.line_end must not precede line_start`);
+    throw new RangeError(`${label2}.line_end must not precede line_start`);
   }
   return {
-    path: requiredString(value.path, `${label}.path`),
+    path: requiredString(value.path, `${label2}.path`),
     line_start: lineStart,
     line_end: lineEnd,
-    content: stringField(value.content, `${label}.content`)
+    content: stringField(value.content, `${label2}.content`)
   };
 }
 async function readOptionalTask(trajectoryDirectory, caseDirectory, row, signal) {
@@ -13663,26 +13661,26 @@ function normalizedLabels(value) {
 function compact(value) {
   return value.replace(/\s+/g, "");
 }
-function positiveInteger2(value, label) {
+function positiveInteger2(value, label2) {
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) {
-    throw new TypeError(`${label} must be a positive integer`);
+    throw new TypeError(`${label2} must be a positive integer`);
   }
   return value;
 }
-function nonNegativeInteger(value, label) {
+function nonNegativeInteger(value, label2) {
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
-    throw new TypeError(`${label} must be a non-negative integer`);
+    throw new TypeError(`${label2} must be a non-negative integer`);
   }
   return value;
 }
-function requiredString(value, label) {
+function requiredString(value, label2) {
   if (typeof value !== "string" || !value.trim()) {
-    throw new TypeError(`${label} must be a non-empty string`);
+    throw new TypeError(`${label2} must be a non-empty string`);
   }
   return value.trim();
 }
-function stringField(value, label) {
-  if (typeof value !== "string") throw new TypeError(`${label} must be a string`);
+function stringField(value, label2) {
+  if (typeof value !== "string") throw new TypeError(`${label2} must be a string`);
   return value;
 }
 function errorMessage(error) {
@@ -15026,16 +15024,16 @@ async function projectArtifact(otlpPath, maxInlineChars, perAttributeCharCap, si
   const spanTraces = /* @__PURE__ */ new Map();
   let index = 0;
   for await (const value of readJsonl(otlpPath, { signal })) {
-    const label = `${otlpPath}:${index + 1}`;
+    const label2 = `${otlpPath}:${index + 1}`;
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
-      throw new TypeError(`${label} must contain an object`);
+      throw new TypeError(`${label2} must contain an object`);
     }
     const row = value;
     if (typeof row.trace_id !== "string" || row.trace_id.length === 0) {
-      throw new TypeError(`${label}.trace_id must be a non-empty string`);
+      throw new TypeError(`${label2}.trace_id must be a non-empty string`);
     }
     if (typeof row.span_id !== "string" || row.span_id.length === 0) {
-      throw new TypeError(`${label}.span_id must be a non-empty string`);
+      throw new TypeError(`${label2}.span_id must be a non-empty string`);
     }
     rows.push(row);
     const traces = spanTraces.get(row.span_id) ?? /* @__PURE__ */ new Set();
@@ -15377,53 +15375,55 @@ function primeAnalyzer(opts = {}) {
 }
 
 // src/redact.ts
-import { DEFAULT_REDACTION_RULES, redactValue } from "@tangle-network/agent-eval/traces";
-var CODING_REDACTION_RULES = [
-  { id: "github-token", pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,})\b/g },
-  { id: "aws-akid", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
-  { id: "slack-token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
-  { id: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
-  { id: "bearer", pattern: /\bBearer\s+[A-Za-z0-9._-]{16,}/gi },
-  {
-    id: "private-key",
-    pattern: /-----BEGIN(?:[A-Z ]+)?PRIVATE KEY-----[\s\S]*?-----END(?:[A-Z ]+)?PRIVATE KEY-----/g
-  },
-  // Match the whole identifier because underscores prevent a word boundary before a secret suffix.
-  {
-    id: "assigned-secret",
-    pattern: /(?<![A-Za-z0-9_-])(?:[A-Za-z_][A-Za-z0-9_-]*)?(?:api[_-]?key|secret|token|password|passwd|access[_-]?token|client[_-]?secret)(?![A-Za-z0-9_-])\+?=(?:\$\((?:\\.|[^\\\r\n])*\)|\$\{(?:\\.|[^}\\\r\n])*\}|`(?:\\.|[^`\\\r\n])*`|\$?'(?:\\.|[^'\\\r\n])*'|\$?"(?:\\.|[^"\\\r\n])*"|\\[^\r\n]|[^\s;&|<>()"'`\\\r\n])+/gi
-  },
-  // Config-file secrets (YAML/INI line keys, JSON quoted keys) — the coverage the shell
-  // rule above deliberately gave up to spare prose ("Narrative token: x") and type
-  // annotations ("(token: string)"). The line anchor is the discriminator: config keys
-  // start their line, prose colons never do; JSON keys are safe anywhere because both
-  // sides are quoted. Identifiers must END in a secret word, same as the shell rule.
-  {
-    id: "config-secret",
-    pattern: /(?:^[ \t]*["']?(?:[A-Za-z_][A-Za-z0-9_-]*)?(?:api[_-]?key|secret|token|password|passwd|access[_-]?token|client[_-]?secret)(?![A-Za-z0-9_-])["']?[ \t]*[:=][ \t]*|["'](?:[A-Za-z_][A-Za-z0-9_-]*)?(?:api[_-]?key|secret|token|password|passwd|access[_-]?token|client[_-]?secret)["']\s*:\s*)["']?[A-Za-z0-9._\-]{12,}["']?/gim
-  },
-  // Credentials embedded in URLs — common when a prompt pastes a curl/clone line.
-  { id: "url-userinfo", pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@/gi },
-  {
-    id: "url-secret-param",
-    pattern: /[?&](?:access[_-]?token|api[_-]?key|apikey|auth|token|secret|password|sig|signature)=[^&\s"'#)]+/gi
-  }
-];
-var TRACES_REDACTION_RULES = [...DEFAULT_REDACTION_RULES, ...CODING_REDACTION_RULES];
-function redactSpans(spans, rules = TRACES_REDACTION_RULES) {
-  const report = { redactionCount: 0, byRule: {} };
-  const out = spans.map((s) => {
-    const attributes2 = redactValue(stripSourceAttributes(s.attributes), rules, report).value;
-    normalizeToolIoAttributes(attributes2);
-    let status = s.status;
-    if (status.message) {
-      const m = redactValue(status.message, rules, report).value;
-      if (typeof m === "string" && m !== status.message) status = { ...status, message: m };
-    }
-    return { ...s, attributes: attributes2, status };
+import {
+  assessShareSafety,
+  combineVerdicts,
+  redact
+} from "@tangle-network/agent-eval/traces";
+function redactSpans(spans, options = {}) {
+  const parts = spans.map((span2) => ({
+    name: span2.name,
+    attributes: stripSourceAttributes(span2.attributes),
+    message: span2.status.message,
+    links: span2.links?.map((link2) => ({
+      ...link2,
+      ...link2.attributes ? { attributes: stripSourceAttributes(link2.attributes) } : {}
+    }))
+  }));
+  const { value, report } = redact(parts, options);
+  const out = spans.map((span2, index) => {
+    const part = value[index];
+    normalizeToolIoAttributes(part.attributes);
+    const status = part.message !== void 0 && part.message !== span2.status.message ? { ...span2.status, message: part.message } : span2.status;
+    return {
+      ...span2,
+      name: part.name,
+      attributes: part.attributes,
+      status,
+      ...part.links ? { links: part.links } : {}
+    };
   });
   return { spans: out, report };
 }
+function assessSpans(spans, profile = "default") {
+  return combineVerdicts(
+    profile,
+    spans.map((span2) => {
+      const verdict = assessShareSafety(
+        { name: span2.name, attributes: span2.attributes, status: span2.status, links: span2.links },
+        { profile }
+      );
+      return {
+        ...verdict,
+        findings: verdict.findings.map((finding2) => ({
+          ...finding2,
+          paths: finding2.paths.map((path) => `span:${span2.span_id}${path}`)
+        })),
+        unreadable: verdict.unreadable.map((entry) => `span:${span2.span_id}${entry}`)
+      };
+    })
+  );
+}
 async function applyRedactor(spans, redactor) {
   const capturedKeys = ["content", ...TOOL_IO_VALUE_KEYS];
   const fields = [];
@@ -16089,7 +16089,7 @@ function exportTraceEvidenceRows(rows, opts = {}, wrapper) {
     format,
     spans: validated,
     redactionCount: redacted.report.redactionCount,
-    redactionsByRule: redacted.report.byRule
+    redactionsByDetector: redacted.report.byDetector
   };
 }
 function exportTraceEvidenceText(text2, opts = {}) {
@@ -16102,7 +16102,7 @@ async function exportTraceEvidenceFile(inputPath, opts = {}) {
     const spans = [];
     const sandboxRows = [];
     let redactionCount = 0;
-    const redactionsByRule = {};
+    const redactionsByDetector = {};
     for await (const row of readJsonl(inputPath)) {
       format ??= detectFormat([row], opts.format ?? "auto");
       if (format === "sandbox-events") {
@@ -16116,8 +16116,8 @@ async function exportTraceEvidenceFile(inputPath, opts = {}) {
       });
       appendAll(spans, converted.spans);
       redactionCount += converted.redactionCount;
-      for (const [rule, count2] of Object.entries(converted.redactionsByRule)) {
-        redactionsByRule[rule] = (redactionsByRule[rule] ?? 0) + count2;
+      for (const [rule, count2] of Object.entries(converted.redactionsByDetector)) {
+        redactionsByDetector[rule] = (redactionsByDetector[rule] ?? 0) + count2;
       }
     }
     if (!format) throw new Error("input file is empty");
@@ -16132,7 +16132,7 @@ async function exportTraceEvidenceFile(inputPath, opts = {}) {
       format,
       spans: validateOtlpSpans(spans, `${format} file export`),
       redactionCount,
-      redactionsByRule
+      redactionsByDetector
     };
   }
   const text2 = await readFile12(inputPath, "utf8");
@@ -16550,8 +16550,8 @@ function sessionFrom(spans, opts) {
     ...opts.session?.path ? { path: opts.session.path } : {}
   };
 }
-function evidence2(kind, label, value, spanIds) {
-  return { kind, label, value, ...spanIds && spanIds.length > 0 ? { spanIds } : {} };
+function evidence2(kind, label2, value, spanIds) {
+  return { kind, label: label2, value, ...spanIds && spanIds.length > 0 ? { spanIds } : {} };
 }
 function finding(input) {
   const fingerprint = hash([input.ruleId, ...input.signature]);
@@ -17428,8 +17428,8 @@ function buildSpanRunTree(spans, source) {
   for (const root of childrenOf.get(null) ?? []) walk(root, null, null, 0);
   const subtotal = /* @__PURE__ */ new Map();
   const subtotalOf = (key) => {
-    const cached = subtotal.get(key);
-    if (cached !== void 0) return cached;
+    const cached2 = subtotal.get(key);
+    if (cached2 !== void 0) return cached2;
     const node = building.get(key);
     if (node === void 0) return ZERO_ROLL;
     subtotal.set(key, ZERO_ROLL);
@@ -18967,6 +18967,169 @@ async function projectSessionBundle(opts) {
   return { directory: outDir, manifestPath, manifest, leakCheck };
 }
 
+// src/diff.ts
+import { stat as stat18 } from "fs/promises";
+import { ATTR as ATTR5 } from "@tangle-network/agent-trace-contract";
+import { ingestSpans as ingestSpans2 } from "@tangle-network/agent-eval/diagnosis";
+import { diffSteps, diffStepsFromSpans } from "@tangle-network/agent-eval/pipelines";
+async function readSpans(path) {
+  const otlp = await readOtlpInput(path);
+  if (otlp.spans.length > 0) return [...otlp.spans];
+  if (!(await stat18(path)).isFile()) {
+    throw new Error(`${path}: no OTLP spans found (${otlp.issues.length} unusable row(s))`);
+  }
+  return (await exportTraceEvidenceFile(path)).spans;
+}
+function branchSpans(spans, branch) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const span2 of spans) byId.set(span2.span_id, span2);
+  const children = /* @__PURE__ */ new Map();
+  for (const span2 of spans) {
+    if (!span2.parent_span_id) continue;
+    const list = children.get(span2.parent_span_id);
+    if (list) list.push(span2);
+    else children.set(span2.parent_span_id, [span2]);
+  }
+  const matched = spans.filter(
+    (span2) => span2.attributes[ATTR5.branchId] === branch || span2.attributes[ATTR5.branchArm] === branch
+  );
+  const matchedIds = new Set(matched.map((span2) => span2.span_id));
+  const hasMatchedAncestor = (span2) => {
+    let current = span2;
+    while (current.parent_span_id) {
+      const parent = byId.get(current.parent_span_id);
+      if (!parent) return false;
+      if (matchedIds.has(parent.span_id)) return true;
+      current = parent;
+    }
+    return false;
+  };
+  const roots = matched.filter((span2) => !hasMatchedAncestor(span2));
+  if (roots.length > 1) {
+    const named = roots.map((span2) => `${span2.span_id} (${ATTR5.branchId}=${JSON.stringify(span2.attributes[ATTR5.branchId] ?? null)})`).join(", ");
+    throw new Error(
+      `"${branch}" matches ${roots.length} separate subtrees, not one arm: ${named} \u2014 sibling arms can share a branch id; select by span id, or narrow the input to one arm first`
+    );
+  }
+  const selected = /* @__PURE__ */ new Set();
+  const stack = [...matched];
+  while (stack.length > 0) {
+    const span2 = stack.pop();
+    if (selected.has(span2)) continue;
+    selected.add(span2);
+    stack.push(...children.get(span2.span_id) ?? []);
+  }
+  return spans.filter((span2) => selected.has(span2));
+}
+async function readRunSide(ref, options = {}) {
+  const hash2 = ref.lastIndexOf("#");
+  const path = hash2 > 0 ? ref.slice(0, hash2) : ref;
+  const selector = hash2 > 0 ? ref.slice(hash2 + 1) : void 0;
+  const branch = selector?.startsWith("branch=") ? selector.slice("branch=".length) : void 0;
+  const all = await readSpans(path);
+  let spans;
+  let traceId;
+  if (branch !== void 0) {
+    spans = branchSpans(all, branch);
+    if (spans.length === 0) throw new Error(`${path} holds no span with ${ATTR5.branchId} or ${ATTR5.branchArm} "${branch}"`);
+    const traces = new Set(spans.map((span2) => span2.trace_id));
+    if (traces.size !== 1) throw new Error(`${path}: branch "${branch}" appears in ${traces.size} runs; export one run per file first`);
+    traceId = [...traces][0];
+  } else {
+    const byTrace = /* @__PURE__ */ new Map();
+    for (const span2 of all) {
+      const list = byTrace.get(span2.trace_id);
+      if (list) list.push(span2);
+      else byTrace.set(span2.trace_id, [span2]);
+    }
+    if (selector === void 0 && byTrace.size !== 1) {
+      throw new Error(
+        `${path} holds ${byTrace.size} runs; pick one with ${path}#<trace id>: ${[...byTrace.keys()].slice(0, 10).join(", ")}`
+      );
+    }
+    traceId = selector ?? [...byTrace.keys()][0];
+    const picked = byTrace.get(traceId);
+    if (!picked) throw new Error(`${path} holds no run with trace id ${traceId}`);
+    spans = picked;
+  }
+  const { spans: ingested } = ingestSpans2(spans, { contentIncluded: false });
+  const kinds = options.kinds?.length ? new Set(options.kinds.map((kind) => kind.toUpperCase())) : null;
+  const steps = diffStepsFromSpans(ingested).filter((step) => kinds === null || kinds.has(step.kind));
+  return { path, traceId, ...branch === void 0 ? {} : { branch }, spans: spans.length, steps };
+}
+function hasDefiniteStatus(steps) {
+  return steps.some((step) => step.fields.status === "OK" || step.fields.status === "ERROR");
+}
+function hasToolStep(steps) {
+  return steps.some((step) => step.kind === "TOOL");
+}
+function agreementCaveat(a, b) {
+  const reasons = [];
+  if (!hasDefiniteStatus(a) && !hasDefiniteStatus(b)) {
+    reasons.push("no step on either side carries a definitive OK or ERROR status (all UNSET)");
+  }
+  if (!hasToolStep(a) && !hasToolStep(b)) {
+    reasons.push("no TOOL step on either side");
+  }
+  return reasons.length > 0 ? reasons.join("; ") : void 0;
+}
+async function diffRuns(a, b, options = {}) {
+  const [left, right] = await Promise.all([readRunSide(a, options), readRunSide(b, options)]);
+  const diff = diffSteps(left.steps, right.steps);
+  const caveat = diff.firstDivergence ? void 0 : agreementCaveat(left.steps, right.steps);
+  return {
+    kind: "traces.run_diff",
+    ...options.kinds?.length ? { kinds: options.kinds.map((kind) => kind.toUpperCase()) } : {},
+    a: left,
+    b: right,
+    diff,
+    ...caveat ? { caveat } : {}
+  };
+}
+var TEXT_STEP_LIMIT = 40;
+function sideLabel(side) {
+  const branch = side.branch === void 0 ? "" : `, branch ${side.branch}`;
+  return `${side.path} (trace ${side.traceId}${branch}, ${side.steps.length} steps)`;
+}
+function label(step) {
+  const status = step.fields.status;
+  return `${step.kind} ${JSON.stringify(step.name)}${status === "ERROR" ? " ERROR" : ""}`;
+}
+function renderRunDiff(report) {
+  const { a, b, diff } = report;
+  const byPairing = { id: 0, position: 0, name: 0 };
+  for (const pair of diff.pairs) byPairing[pair.pairedBy] += 1;
+  const lines = [
+    ...report.kinds ? [`steps limited to kind ${report.kinds.join(", ")}`] : [],
+    `A: ${sideLabel(a)}`,
+    `B: ${sideLabel(b)}`,
+    `paired ${diff.pairs.length} (by id ${byPairing.id}, position ${byPairing.position}, name ${byPairing.name}), only in A ${diff.onlyInA.length}, only in B ${diff.onlyInB.length}, common prefix ${diff.commonPrefixLen}`
+  ];
+  const first = diff.firstDivergence;
+  if (!first) {
+    lines.push(
+      report.caveat ? `same steps, same order \u2014 but this is not agreement on outcome: ${report.caveat}` : "no divergence: the runs agree step for step"
+    );
+    return `${lines.join("\n")}
+`;
+  }
+  lines.push(`first divergence [${first.kind}] at step ${first.index}: ${first.reason}`);
+  const details = [];
+  for (const pair of diff.pairs) {
+    if (pair.differences.length === 0) continue;
+    const changes = pair.differences.map((d) => `${d.field} ${String(d.a)} -> ${String(d.b)}`).join("; ");
+    details.push(`  changed    A[${pair.a}]~B[${pair.b}] ${label(a.steps[pair.a])}: ${changes}`);
+  }
+  for (const index of diff.onlyInA) details.push(`  only in A  A[${index}] ${label(a.steps[index])}`);
+  for (const index of diff.onlyInB) details.push(`  only in B  B[${index}] ${label(b.steps[index])}`);
+  lines.push(...details.slice(0, TEXT_STEP_LIMIT));
+  if (details.length > TEXT_STEP_LIMIT) {
+    lines.push(`  \u2026 ${details.length - TEXT_STEP_LIMIT} more (use --format json for all)`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+
 // src/upload-state.ts
 import { mkdir as mkdir8, readFile as readFile17, writeFile as writeFile12 } from "fs/promises";
 import { homedir as homedir12 } from "os";
@@ -19008,7 +19171,7 @@ import { createRequire as createRequire2 } from "module";
 import { hostname as hostname2 } from "os";
 import { basename as basename17, join as join33 } from "path";
 import { hostedClientFromEnv } from "@tangle-network/agent-eval/hosted";
-import { REDACTION_VERSION } from "@tangle-network/agent-eval/traces";
+import { assessShareSafety as assessShareSafety2, REDACTION_VERSION, redact as redact2, shareAllowed } from "@tangle-network/agent-eval/traces";
 var require2 = createRequire2(import.meta.url);
 var TRACES_VERSION = require2("../package.json").version;
 async function planUpload(opts = {}) {
@@ -19049,7 +19212,7 @@ async function sessionMeta(item) {
   if (item.ref.cwd) meta[ATTR.CWD] = item.ref.cwd;
   const branch = await gitBranch(item.ref.cwd);
   if (branch) meta[ATTR.GIT_BRANCH] = branch;
-  return meta;
+  return redact2(meta).value;
 }
 var msToNano = (epochMs2) => (BigInt(epochMs2) * 1000000n).toString();
 function toTraceSpanEvents(spans, rootMeta) {
@@ -19115,6 +19278,7 @@ async function prepareOutbound(plan, opts, uploadedAt) {
     redactionVersion: REDACTION_VERSION
   };
   const items = [];
+  const refused = [];
   for (const item of candidates) {
     const key = uploadKey(item.ref.harness, item.ref.sessionId);
     const previous = plan.state[key];
@@ -19129,13 +19293,18 @@ async function prepareOutbound(plan, opts, uploadedAt) {
       events = eventsAt(eventTimestamp2);
       hash2 = outboundHash(events, identity2);
     }
+    const verdict = assessShareSafety2(events);
+    if (!shareAllowed(verdict)) {
+      refused.push({ harness: item.ref.harness, sessionId: item.ref.sessionId, verdict });
+      continue;
+    }
     items.push({ item, events, hash: hash2 });
   }
-  return { items, skipped: plan.items.length - items.length };
+  return { items, skipped: plan.items.length - items.length - refused.length, refused };
 }
 async function executeUpload(plan, opts = {}) {
   const uploadedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const { items, skipped } = await prepareOutbound(plan, opts, uploadedAt);
+  const { items, skipped, refused } = await prepareOutbound(plan, opts, uploadedAt);
   const redactionCount = items.reduce((n, { item }) => n + item.redaction.redactionCount, 0);
   if (opts.dryRun) {
     const allSpans = items.flatMap(({ item }) => item.spans);
@@ -19146,7 +19315,8 @@ async function executeUpload(plan, opts = {}) {
       acceptedSpans: 0,
       redactionCount,
       dryRun: true,
-      otlpPath: path
+      otlpPath: path,
+      refused
     };
   }
   if (items.length === 0) {
@@ -19155,7 +19325,8 @@ async function executeUpload(plan, opts = {}) {
       skippedSessions: skipped,
       acceptedSpans: 0,
       redactionCount,
-      dryRun: false
+      dryRun: false,
+      refused
     };
   }
   const client = opts.backend ?? hostedClientFromEnv();
@@ -19191,12 +19362,128 @@ async function executeUpload(plan, opts = {}) {
     skippedSessions: skipped,
     acceptedSpans,
     redactionCount,
-    dryRun: false
+    dryRun: false,
+    refused
   };
 }
 
+// src/verify-safe.ts
+import { lstat as lstat4, readdir as readdir21, readFile as readFile19 } from "fs/promises";
+import { basename as basename18, extname, join as join34, relative as relative7 } from "path";
+import {
+  assessShareSafety as assessShareSafety3,
+  combineVerdicts as combineVerdicts2
+} from "@tangle-network/agent-eval/traces";
+var JSON_LINES = /* @__PURE__ */ new Set([".jsonl", ".ndjson"]);
+async function verifySafe(target, options = {}) {
+  const profile = options.profile ?? "share";
+  const assess = { profile, knownSecrets: options.knownSecrets };
+  const verdicts = [];
+  const unreadable = [];
+  const files = await listFiles(target, unreadable);
+  for (const file of files) {
+    const label2 = relative7(target, file) || basename18(file);
+    let bytes;
+    try {
+      bytes = await readFile19(file);
+    } catch (error) {
+      unreadable.push(`${label2}: ${error instanceof Error ? error.message : String(error)}`);
+      continue;
+    }
+    const text2 = decodeUtf8(bytes);
+    if (text2 === void 0) {
+      unreadable.push(`${label2}: not UTF-8 text`);
+      continue;
+    }
+    const extension = extname(file).toLowerCase();
+    if (JSON_LINES.has(extension)) {
+      text2.split("\n").forEach((line, index) => {
+        if (!line.trim()) return;
+        const parsed = parseJson(line);
+        if (parsed === void 0) unreadable.push(`${label2}:${index + 1}: not JSON`);
+        else verdicts.push(located(assessShareSafety3(parsed.value, assess), `${label2}:${index + 1}`));
+      });
+    } else if (extension === ".json") {
+      const parsed = parseJson(text2);
+      if (parsed === void 0) unreadable.push(`${label2}: not JSON`);
+      else verdicts.push(located(assessShareSafety3(parsed.value, assess), label2));
+    } else {
+      verdicts.push(located(assessShareSafety3(text2, assess), label2));
+    }
+  }
+  if (files.length === 0 && unreadable.length === 0) unreadable.push(`${target}: no files to check`);
+  return { ...combineVerdicts2(profile, verdicts, unreadable), target, files: files.length };
+}
+async function listFiles(target, unreadable) {
+  let stat19;
+  try {
+    stat19 = await lstat4(target);
+  } catch (error) {
+    unreadable.push(`${target}: ${error instanceof Error ? error.message : String(error)}`);
+    return [];
+  }
+  if (stat19.isFile()) return [target];
+  if (!stat19.isDirectory()) {
+    unreadable.push(`${target}: not a regular file or directory`);
+    return [];
+  }
+  const out = [];
+  const walk = async (dir) => {
+    for (const entry of (await readdir21(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+      const path = join34(dir, entry.name);
+      if (entry.isDirectory()) await walk(path);
+      else if (entry.isFile()) out.push(path);
+      else unreadable.push(`${relative7(target, path)}: not a regular file`);
+    }
+  };
+  await walk(target);
+  return out;
+}
+function decodeUtf8(bytes) {
+  if (bytes.includes(0)) return void 0;
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return void 0;
+  }
+}
+function parseJson(text2) {
+  try {
+    return { value: JSON.parse(text2) };
+  } catch {
+    return void 0;
+  }
+}
+function located(verdict, where) {
+  return {
+    ...verdict,
+    findings: verdict.findings.map((finding2) => ({
+      ...finding2,
+      paths: finding2.paths.map((path) => `${where}#${path}`)
+    })),
+    unreadable: verdict.unreadable.map((entry) => `${where}#${entry}`)
+  };
+}
+function verdictExitCode(verdict) {
+  if (verdict.status === "UNKNOWN") return 2;
+  return verdict.status === "UNSAFE" ? 1 : 0;
+}
+function formatVerdict(result) {
+  const lines = [`${result.status}  ${result.target} (${result.files} file(s), profile ${result.profile})`];
+  for (const finding2 of result.findings) {
+    lines.push(
+      `  ${finding2.severity.padEnd(7)} ${finding2.category}/${finding2.detector} x${finding2.count}  ${finding2.paths.join(", ")}`
+    );
+  }
+  for (const entry of result.unreadable) lines.push(`  unread  ${entry}`);
+  if (result.status === "UNSAFE") lines.push("Refuse to share. Redact with the same profile, then run verify-safe again.");
+  if (result.status === "UNKNOWN") lines.push("Refuse to share: part of the input could not be read, so its safety is unknown.");
+  return lines.join("\n");
+}
+
 export {
   SOURCE_ATTRIBUTE_PREFIX,
+  toolArgumentsFromAttributes,
   SYNTHESIZED_SPAN_ATTR,
   SYNTHESIZED_SOURCE_ATTR,
   INHERITED_SPAN_ATTR,
@@ -19290,6 +19577,8 @@ export {
   analyzeAdoption,
   planTraceAgenticRoute,
   traceAgenticKinds,
+  writeAnalysisTraceFile,
+  openAgenticTraceStore,
   CITATION_NORMALIZATION_VERSION,
   normalizeAnalystCitations,
   MAX_SHELL_DEPTH,
@@ -19353,6 +19642,7 @@ export {
   collectSessionWorkflow,
   fileSha256,
   collectSessionSelection,
+  tracesVersion,
   listSessionBundleFiles,
   assembleSessionBundle,
   hashSessionBundleFiles,
@@ -19377,9 +19667,8 @@ export {
   hodoscopeAnalyzer,
   httpJsonTransport,
   primeAnalyzer,
-  CODING_REDACTION_RULES,
-  TRACES_REDACTION_RULES,
   redactSpans,
+  assessSpans,
   applyRedactor,
   exportTraceEvidenceRows,
   exportTraceEvidenceText,
@@ -19456,6 +19745,9 @@ export {
   findSessionTextLeaks,
   classifyEvidenceOnlyPath,
   projectSessionBundle,
+  readRunSide,
+  diffRuns,
+  renderRunDiff,
   uploadKey,
   sessionHash,
   outboundHash,
@@ -19465,5 +19757,8 @@ export {
   planUpload,
   toTraceSpanEvents,
   PartialUploadError,
-  executeUpload
+  executeUpload,
+  verifySafe,
+  verdictExitCode,
+  formatVerdict
 };