@uipath/guardrails-tool 1.203.0-preview.205 → 1.204.0-preview.206

package/dist/tool.js

@@ -2101,7 +2101,7 @@ var package_default = {
   name: "@uipath/guardrails-tool",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.203.0-preview.205",
+  version: "1.204.0-preview.206",
   description: "CLI plugin for UiPath AI Trust Layer guardrail configurations.",
   private: false,
   repository: {
@@ -2125,6 +2125,7 @@ var package_default = {
   ],
   scripts: {
     build: "bun ../../../tools/build-tool.ts",
+    typecheck: "tsc --noEmit",
     lint: "biome check .",
     "lint:fix": "biome check --write .",
     test: "vitest run",
@@ -2135,7 +2136,7 @@ var package_default = {
     "@uipath/auth": "workspace:*",
     "@uipath/common": "workspace:*",
     commander: "^14.0.3",
-    typescript: "^6.0.2"
+    typescript: "^7.0.2"
   }
 };
 
@@ -2906,6 +2907,57 @@ function settlePromiseLike(thenable) {
   return Promise.resolve(thenable).then((data) => [undefined, data]).catch((error) => [toError(error), undefined]);
 }
 
+// ../../common/src/error-graph.ts
+function* walkErrorGraph(error) {
+  const queue = [error];
+  const seen = new Set;
+  for (let steps = 0;queue.length > 0 && steps < 32; steps++) {
+    const current = queue.shift();
+    if (current === null || typeof current !== "object")
+      continue;
+    if (seen.has(current))
+      continue;
+    seen.add(current);
+    const cur = current;
+    yield cur;
+    if (cur.cause !== undefined)
+      queue.push(cur.cause);
+    if (Array.isArray(cur.errors))
+      queue.push(...cur.errors);
+  }
+  return;
+}
+function parseHttpStatusFromMessage(message) {
+  const match = /^HTTP\s+(\d{3})(?::|\s|-|$)/i.exec(message.trim());
+  if (!match)
+    return;
+  const status = Number(match[1]);
+  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : undefined;
+}
+function findHttpStatusInGraph(error) {
+  for (const node of walkErrorGraph(error)) {
+    const response = node.response;
+    const explicit = typeof node.status === "number" ? node.status : response?.status;
+    if (typeof explicit === "number" && explicit >= 400 && explicit <= 599) {
+      return explicit;
+    }
+    if (typeof node.message === "string") {
+      const parsed = parseHttpStatusFromMessage(node.message);
+      if (parsed !== undefined && parsed >= 400) {
+        return parsed;
+      }
+    }
+  }
+  return;
+}
+
+// ../../common/src/local-permission-codes.ts
+var LOCAL_PERMISSION_ERROR_CODES = new Set([
+  "EACCES",
+  "EPERM",
+  "EROFS"
+]);
+
 // ../../common/src/error-handler.ts
 var NETWORK_ERROR_CODES = new Set([
   "ECONNREFUSED",
@@ -2930,7 +2982,7 @@ var TLS_ERROR_CODES = new Set([
 ]);
 var TLS_INSTRUCTIONS = "The server's TLS certificate could not be verified. Most often a " + "corporate proxy/firewall re-signs HTTPS with a root CA that Node does " + "not trust — set NODE_EXTRA_CA_CERTS to that CA's PEM file (and HTTPS_PROXY " + "if you connect through a proxy). If the certificate is instead expired or " + "its hostname does not match, fix the endpoint URL or the system clock. " + "Then retry.";
 var NETWORK_INSTRUCTIONS = "Could not reach the UiPath service. Check your network connection and " + "VPN, confirm any HTTP_PROXY/HTTPS_PROXY/NO_PROXY settings are correct, " + "then retry.";
-var LOCAL_PERMISSION_ERROR_CODES = new Set(["EACCES", "EPERM", "EROFS"]);
+var LOCAL_PERMISSION_MESSAGE_PATTERN = new RegExp(`\\b(${[...LOCAL_PERMISSION_ERROR_CODES].join("|")})\\b`);
 // ../../common/src/exit-code.ts
 function setExitCode(code) {
   process.exitCode = code;
@@ -3189,12 +3241,162 @@ function getOutputFilter() {
   return filterSlot.get();
 }
 
+// ../../common/src/telemetry/telemetry-dimensions.ts
+var BaseDimensions = {
+  ApplicationName: "ApplicationName",
+  ProductVersion: "ProductVersion",
+  InstallationId: "InstallationId",
+  CloudUserId: "CloudUserId",
+  CloudTenantId: "CloudTenantId",
+  CloudOrganizationId: "CloudOrganizationId",
+  IsInternalUser: "IsInternalUser",
+  Environment: "Environment",
+  BaseUrl: "BaseUrl",
+  Region: "Region",
+  Agent: "Agent",
+  AgentVersion: "AgentVersion",
+  AgentModel: "AgentModel",
+  ToolName: "ToolName",
+  ToolVersion: "ToolVersion",
+  ExecutionContext: "ExecutionContext",
+  CiProvider: "CiProvider",
+  SessionIdSource: "SessionIdSource",
+  SessionId: "SessionId"
+};
+var CommandDimensions = {
+  IsCommand: "IsCommand",
+  IsReexec: "IsReexec",
+  CommandName: "CommandName",
+  ExitCode: "ExitCode",
+  TerminalOutcome: "TerminalOutcome",
+  ErrorClass: "ErrorClass",
+  TerminalSignal: "TerminalSignal",
+  ErrorMessage: "ErrorMessage",
+  SkillName: "SkillName",
+  ProductArea: "ProductArea",
+  Mode: "Mode"
+};
+var ShipDimensions = {
+  ShipKind: "ShipKind",
+  Target: "Target",
+  ProjectType: "ProjectType",
+  ProjectTypes: "ProjectTypes",
+  ArtifactCorrelationKey: "ArtifactCorrelationKey",
+  PackageName: "PackageName",
+  PackageVersion: "PackageVersion",
+  PackageVersionKey: "PackageVersionKey",
+  DeploymentKey: "DeploymentKey",
+  SolutionId: "SolutionId",
+  FolderKey: "FolderKey",
+  FeedId: "FeedId"
+};
+var ErrorDimensions = {
+  Result: "Result",
+  ErrorCode: "ErrorCode",
+  Retry: "Retry",
+  ErrorMessage: "ErrorMessage"
+};
+var AuthDimensions = {
+  AuthenticationMethod: "AuthenticationMethod",
+  Success: "Success",
+  Reason: "Reason"
+};
+var SkillsDimensions = {
+  SchemaVersion: "SchemaVersion",
+  AgentType: "AgentType",
+  SkillsVersion: "SkillsVersion",
+  UipSubcommand: "UipSubcommand",
+  FileExtension: "FileExtension",
+  SubagentModel: "SubagentModel",
+  SubagentType: "SubagentType",
+  PermissionMode: "PermissionMode",
+  EffortLevel: "EffortLevel",
+  SessionSource: "SessionSource",
+  Outcome: "Outcome",
+  DurationMs: "DurationMs",
+  Source: "Source"
+};
+var PackagerDimensions = {
+  ProjectId: "ProjectId",
+  ProjectType: "ProjectType",
+  SolutionId: "SolutionId"
+};
+var ScopeDimensions = {
+  FolderId: "FolderId"
+};
+var ID_DIMENSIONS = new Set([
+  BaseDimensions.CloudUserId,
+  BaseDimensions.CloudTenantId,
+  BaseDimensions.CloudOrganizationId,
+  BaseDimensions.InstallationId,
+  ShipDimensions.ArtifactCorrelationKey,
+  ShipDimensions.PackageVersionKey,
+  ShipDimensions.DeploymentKey,
+  ShipDimensions.SolutionId,
+  ShipDimensions.FolderKey,
+  ShipDimensions.FeedId,
+  PackagerDimensions.ProjectId
+]);
+var NON_IDENTIFIER_PLACEHOLDER_PATTERN = /^(?:\[[A-Z_]+\]|<[^>]+>)$/;
+var RESERVED_DIMENSION_NAMES = new Set([
+  ...Object.values(BaseDimensions),
+  ...Object.values(CommandDimensions),
+  ...Object.values(ShipDimensions),
+  ...Object.values(ErrorDimensions),
+  ...Object.values(AuthDimensions),
+  ...Object.values(SkillsDimensions),
+  ...Object.values(PackagerDimensions),
+  ...Object.values(ScopeDimensions)
+]);
+var CURATED_DIMENSIONS = new Set([
+  BaseDimensions.ApplicationName,
+  BaseDimensions.ProductVersion,
+  BaseDimensions.InstallationId,
+  BaseDimensions.CloudUserId,
+  BaseDimensions.CloudTenantId,
+  BaseDimensions.CloudOrganizationId,
+  BaseDimensions.IsInternalUser,
+  BaseDimensions.Environment,
+  BaseDimensions.BaseUrl,
+  BaseDimensions.Region,
+  BaseDimensions.Agent,
+  BaseDimensions.AgentVersion,
+  BaseDimensions.ToolVersion,
+  BaseDimensions.ExecutionContext,
+  BaseDimensions.CiProvider,
+  BaseDimensions.SessionIdSource,
+  BaseDimensions.SessionId,
+  ...Object.values(CommandDimensions),
+  ...Object.values(ShipDimensions)
+]);
+function lowercaseIdDimensionValues(properties) {
+  let changed = false;
+  const result = {
+    ...properties
+  };
+  for (const key of Object.keys(result)) {
+    const value = result[key];
+    if (!ID_DIMENSIONS.has(key) || typeof value !== "string" || NON_IDENTIFIER_PLACEHOLDER_PATTERN.test(value)) {
+      continue;
+    }
+    const lowered = value.toLowerCase();
+    if (lowered !== value) {
+      result[key] = lowered;
+      changed = true;
+    }
+  }
+  return changed ? result : properties;
+}
+
 // ../../common/src/telemetry/command-terminal.ts
 var recordedFailureSlot = singleton("CommandTelemetryFailure");
 var AUTH_ERROR_CODES = new Set([
   "authentication_required",
   "permission_denied"
 ]);
+var LOCAL_PERMISSION_CLI_ERROR_CODES = new Set([
+  "local_permission_denied"
+]);
 var VALIDATION_ERROR_CODES = new Set(["invalid_argument"]);
 var NETWORK_HTTP_ERROR_CODES = new Set([
   "network_error",
@@ -3335,6 +3537,9 @@ function classifyFromErrorCode(errorCode) {
   if (AUTH_ERROR_CODES.has(errorCode)) {
     return "auth";
   }
+  if (LOCAL_PERMISSION_CLI_ERROR_CODES.has(errorCode)) {
+    return "local_permission";
+  }
   if (VALIDATION_ERROR_CODES.has(errorCode)) {
     return "validation";
   }
@@ -3346,6 +3551,15 @@ function classifyFromErrorCode(errorCode) {
   }
   return;
 }
+function hasLocalPermissionCode(error) {
+  for (const node of walkErrorGraph(error)) {
+    const code = node.code;
+    if (typeof code === "string" && LOCAL_PERMISSION_ERROR_CODES.has(code)) {
+      return true;
+    }
+  }
+  return false;
+}
 function classifyFromError(error) {
   const code = findCodeInCauseChain(error);
   if (code) {
@@ -3362,6 +3576,9 @@ function classifyFromError(error) {
       return "missing_dependency";
     }
   }
+  if (hasLocalPermissionCode(error)) {
+    return "local_permission";
+  }
   const message = stringField(error, "message");
   if (message?.includes("fetch failed") === true) {
     return "network_http";
@@ -3377,7 +3594,7 @@ function classifyError(input) {
   if (recorded?.errorClass) {
     return recorded.errorClass;
   }
-  const status = recorded?.context?.httpStatus;
+  const status = recorded?.context?.httpStatus ?? findHttpStatusInGraph(input.error);
   if (status !== undefined) {
     return classifyHttpStatus(status);
   }
@@ -3400,17 +3617,18 @@ function buildCommandTerminalTelemetryProperties(input) {
   const errorClass = outcome === "success" || outcome === "no_op" ? undefined : outcome === "cancelled" ? "user_cancelled" : classifyError(input);
   const terminalSignal = terminalSignalFor(input, outcome);
   return {
-    exit_code: input.exitCode,
-    terminal_outcome: outcome,
-    ...errorClass ? { error_class: errorClass } : {},
-    ...terminalSignal ? { terminal_signal: terminalSignal } : {}
+    [CommandDimensions.ExitCode]: input.exitCode,
+    [CommandDimensions.TerminalOutcome]: outcome,
+    ...errorClass ? { [CommandDimensions.ErrorClass]: errorClass } : {},
+    ...terminalSignal ? { [CommandDimensions.TerminalSignal]: terminalSignal } : {}
   };
 }
 
 // ../../common/src/telemetry/telemetry-events.ts
 var CommonTelemetryEvents = {
-  Error: "uip.error",
-  ShipSucceeded: "uip.ship.succeeded"
+  Start: "Application.Start",
+  Error: "Application.Error",
+  ShipSucceeded: "Cli.ShipSucceeded"
 };
 
 // ../../common/src/registry.ts
@@ -3618,8 +3836,8 @@ function detectExecutionContext(options = {}) {
 function getExecutionContextTelemetryProperties() {
   const detected = detectExecutionContext();
   return {
-    execution_context: detected.executionContext,
-    ...detected.ciProvider ? { ci_provider: detected.ciProvider } : {}
+    [BaseDimensions.ExecutionContext]: detected.executionContext,
+    ...detected.ciProvider ? { [BaseDimensions.CiProvider]: detected.ciProvider } : {}
   };
 }
 // ../../common/src/telemetry/node-context-storage.ts
@@ -3662,7 +3880,7 @@ function getInboundTraceContext() {
 var TELEMETRY_SESSION_ID_ENV = "UIPATH_SESSION_ID";
 var SESSION_ID_MAX_LENGTH = 64;
 var RANDOM_SESSION_ID_LENGTH = 32;
-var TELEMETRY_SESSION_SOURCE_PROPERTY = "session_id_source";
+var TELEMETRY_SESSION_SOURCE_PROPERTY = "SessionIdSource";
 var CONTROL_CHARACTERS = /\p{Cc}/gu;
 var INHERITED_SESSION_SOURCES = [
   { envVar: "CLAUDE_CODE_SESSION_ID", source: "claude-code" },
@@ -3714,6 +3932,9 @@ function resolveTelemetrySession() {
   telemetrySessionSlot.set(resolved);
   return resolved;
 }
+function getTelemetrySessionId() {
+  return resolveTelemetrySession().id;
+}
 function getTelemetrySessionSource() {
   return resolveTelemetrySession().source;
 }
@@ -3794,7 +4015,10 @@ class TelemetryService {
     } catch (error) {
       const durationMs = clock.elapsedMs();
       const err = error instanceof Error ? error : new Error(String(error));
-      await this.telemetryProvider.trackRequest(this.spanFor(name, durationMs, false, { ...properties, errorMessage: err.message }, context));
+      await this.telemetryProvider.trackRequest(this.spanFor(name, durationMs, false, {
+        ...properties,
+        [CommandDimensions.ErrorMessage]: err.message
+      }, context));
       throw error;
     }
   }
@@ -3865,7 +4089,10 @@ class TelemetryService {
       const durationMs = clock.elapsedMs();
       const err = error instanceof Error ? error : new Error(String(error));
       await this.telemetryProvider.trackDependency({
-        ...this.spanFor(name, durationMs, false, { ...properties, errorMessage: err.message }, childContext),
+        ...this.spanFor(name, durationMs, false, {
+          ...properties,
+          [CommandDimensions.ErrorMessage]: err.message
+        }, childContext),
         type
       });
       throw error;
@@ -3900,9 +4127,10 @@ class TelemetryService {
       ...globalProperties,
       ...this.defaultProperties,
       ...redactProperties(properties ?? {}),
-      [TELEMETRY_SESSION_SOURCE_PROPERTY]: getTelemetrySessionSource()
+      [TELEMETRY_SESSION_SOURCE_PROPERTY]: getTelemetrySessionSource(),
+      [BaseDimensions.SessionId]: this.telemetryProvider.getSessionId?.() ?? getTelemetrySessionId()
     };
-    return enriched;
+    return lowercaseIdDimensionValues(enriched);
   }
   generateId() {
     const bytes = new Uint8Array(8);
@@ -4663,7 +4891,165 @@ class FilterImplicitLimitError extends Error {
     this.instructions = "Pass --limit <n> to choose how many records the filter applies to. " + "To filter over all records, pass the command's maximum accepted --limit (see the option's description in --help).";
   }
 }
-function applyFilter(data, filter) {
+function countRecords(data) {
+  if (Array.isArray(data))
+    return data.length;
+  return data == null ? 0 : 1;
+}
+function availableFields(data) {
+  const records = Array.isArray(data) ? data : [data];
+  const keys = new Set;
+  for (const record of records) {
+    if (record && typeof record === "object" && !Array.isArray(record)) {
+      for (const key of Object.keys(record))
+        keys.add(key);
+    }
+  }
+  return [...keys];
+}
+function decodeQuotedIdentifier(whole, inner) {
+  const [error, decoded] = catchError(() => JSON.parse(whole));
+  if (!error && typeof decoded === "string")
+    return decoded;
+  return inner.replace(/\\(.)/g, "$1");
+}
+function referencedFields(filter) {
+  const top = new Set;
+  const nested = new Set;
+  const withoutValueLiterals = filter.replace(/'(?:\\.|[^'\\])*'/g, " ").replace(/`(?:\\.|[^`\\])*`/g, " ");
+  const isPathTail = (text, index) => text[index - 1] === "." && /[A-Za-z0-9_"]/.test(text[index - 2] ?? "");
+  const quoted = [];
+  const withoutLiterals = withoutValueLiterals.replace(/"((?:\\.|[^"\\])*)"/g, (whole, name, index) => {
+    const isAlias = /^\s*:/.test(withoutValueLiterals.slice(index + whole.length));
+    if (!isAlias) {
+      quoted.push({
+        name: decodeQuotedIdentifier(whole, name),
+        index,
+        tail: isPathTail(withoutValueLiterals, index)
+      });
+    }
+    return `"${" ".repeat(whole.length - 2)}"`;
+  });
+  const descent = /[A-Za-z0-9_"]\s*[.[]/.exec(withoutLiterals);
+  const rootEnd = descent ? descent.index + 1 : Number.POSITIVE_INFINITY;
+  const place = (name, index, tail) => {
+    if (tail || index >= rootEnd)
+      nested.add(name);
+    else
+      top.add(name);
+  };
+  for (const entry of quoted)
+    place(entry.name, entry.index, entry.tail);
+  const identifiers = withoutLiterals.matchAll(/([A-Za-z_][A-Za-z0-9_]*)(\s*[:(])?/g);
+  const reserved = new Set(["true", "false", "null", "and", "or", "not"]);
+  for (const match of identifiers) {
+    const [, name, trailing] = match;
+    if (trailing || reserved.has(name))
+      continue;
+    place(name, match.index, isPathTail(withoutLiterals, match.index));
+  }
+  return {
+    top: [...top],
+    nested: [...nested].filter((name) => !top.has(name)),
+    hasPredicate: /\[\s*\?/.test(withoutValueLiterals)
+  };
+}
+function appearsBelowTopLevel(data, name) {
+  let budget = 2000;
+  const visit = (value, depth) => {
+    if (budget-- <= 0 || depth > 4)
+      return false;
+    if (value === null || typeof value !== "object")
+      return false;
+    if (Array.isArray(value))
+      return value.some((entry) => visit(entry, depth));
+    const record = value;
+    if (depth > 0 && Object.hasOwn(record, name))
+      return true;
+    return Object.values(record).some((entry) => visit(entry, depth + 1));
+  };
+  return visit(data, 0);
+}
+function alwaysNullKeys(records) {
+  const objects = records.filter((r) => r != null && typeof r === "object" && !Array.isArray(r));
+  if (objects.length === 0 || objects.length !== records.length)
+    return [];
+  const keys = [...new Set(objects.flatMap((o) => Object.keys(o)))];
+  if (keys.length === 0)
+    return [];
+  const nullKeys = keys.filter((key) => objects.every((record) => record[key] === null));
+  return nullKeys.length === keys.length ? nullKeys : [];
+}
+function carriesOnlyNulls(value) {
+  if (value === null)
+    return true;
+  if (Array.isArray(value)) {
+    return value.length > 0 && value.every(carriesOnlyNulls);
+  }
+  if (typeof value === "object" && value !== undefined) {
+    const values = Object.values(value);
+    return values.length > 0 && values.every(carriesOnlyNulls);
+  }
+  return false;
+}
+function nameList(names, cap2 = 12) {
+  const shown = names.slice(0, cap2).map((n) => `\`${n}\``);
+  const rest = names.length - shown.length;
+  return shown.join(", ") + (rest > 0 ? `, and ${rest} more` : "");
+}
+function buildFilterWarning(filter, data, outcome) {
+  const present = availableFields(data);
+  const refs = referencedFields(filter);
+  const unknown = refs.top.filter((name) => !present.includes(name) && !appearsBelowTopLevel(data, name));
+  const unchecked = refs.nested.filter((name) => !present.includes(name));
+  const count = countRecords(data);
+  const scope = `${count} record(s)`;
+  const isNotAField = (names) => `${nameList(names)} ${names.length === 1 ? "is not a field" : "are not fields"} on the ${scope} it read`;
+  const soundness = unchecked.length > 0 ? `${nameList(unchecked)} ${unchecked.length === 1 ? "reads" : "read"} below the top level, so ${unchecked.length === 1 ? "it was" : "they were"} not checked against the record keys` : refs.top.length > 0 ? "every field it names exists" : "";
+  const withSoundness = (base) => soundness ? `${base}, and ${soundness}` : base;
+  let detail;
+  let lede;
+  if (outcome.kind === "null-elements") {
+    lede = "returned only null values";
+    const projected = `all ${outcome.count} of the elements it projected are null`;
+    if (unknown.length > 0) {
+      detail = `${projected}, because ${isNotAField(unknown)}`;
+    } else if (unchecked.length > 0) {
+      detail = withSoundness(projected);
+    } else {
+      detail = `${projected}, and every field it names exists — a multi-select list ` + `(\`[A, B]\`) reads each entry against \`Data\` itself, so on a list ` + `result use \`[].[A, B]\` or \`[].{a: A, b: B}\` to read the records`;
+    }
+  } else if (outcome.kind === "null-rows") {
+    lede = "returned only null values";
+    const projected = `every value it projected is null on all ${outcome.count} row(s)`;
+    detail = unknown.length > 0 ? `${projected}, because ${isNotAField(unknown)}` : withSoundness(projected);
+  } else if (outcome.kind === "null-values") {
+    lede = "returned only null values";
+    const projected = `every key it projected (${nameList(outcome.keys)}) is null`;
+    const sameSet = unknown.length === outcome.keys.length && outcome.keys.every((k) => unknown.includes(k));
+    if (sameSet) {
+      detail = `${isNotAField(outcome.keys)}, so every key it projected is null`;
+    } else if (unknown.length > 0) {
+      detail = `${projected}, because ${isNotAField(unknown)}`;
+    } else {
+      detail = withSoundness(`${projected} on all ${scope}`);
+    }
+  } else {
+    lede = "returned nothing";
+    if (unknown.length > 0) {
+      detail = isNotAField(unknown);
+    } else {
+      const selection = refs.hasPredicate ? "no record matched" : "the expression resolved to no value";
+      detail = withSoundness(`${selection} — it read ${scope}`);
+    }
+  }
+  const fields = present.length > 0 ? ` Available fields: ${nameList(present)}.` : "";
+  return `--output-filter ${JSON.stringify(filter)} ${lede}: ${detail}.${fields}`;
+}
+function appendWarning(existing, note) {
+  return existing ? `${existing} ${note}` : note;
+}
+function applyFilter(data, filter, onWarning) {
   const codec = requireJmespath();
   let result;
   try {
@@ -4671,9 +5057,34 @@ function applyFilter(data, filter) {
   } catch (err) {
     throw new FilterEvaluationError(filter, err);
   }
-  if (result == null)
+  const inputCount = countRecords(data);
+  const warn = (outcome) => {
+    if (inputCount === 0)
+      return;
+    const note = buildFilterWarning(filter, data, outcome);
+    getOutputSink().writeErr(`[WARN] ${note}
+`);
+    onWarning?.(note);
+  };
+  const warnIfAllNull = (records) => {
+    const keys = alwaysNullKeys(records);
+    if (keys.length > 0)
+      warn({ kind: "null-values", keys });
+  };
+  if (result == null) {
+    warn({ kind: "empty" });
     return [];
+  }
   if (Array.isArray(result)) {
+    if (result.length === 0) {
+      warn({ kind: "empty" });
+    } else if (result.every((entry) => entry === null)) {
+      warn({ kind: "null-elements", count: result.length });
+    } else if (result.every((entry) => Array.isArray(entry)) && carriesOnlyNulls(result)) {
+      warn({ kind: "null-rows", count: result.length });
+    } else {
+      warnIfAllNull(result);
+    }
     if (result.length > 0 && typeof result[0] !== "object") {
       const fieldMatch = filter.match(/\.(\w+)$/);
       const key = fieldMatch ? fieldMatch[1] : "Value";
@@ -4681,10 +5092,30 @@ function applyFilter(data, filter) {
     }
     return result;
   }
-  if (typeof result === "object")
+  if (typeof result === "object") {
+    warnIfAllNull([result]);
     return result;
+  }
   return { Value: result };
 }
+function filterFailureData(envelope) {
+  const filter = getOutputFilter();
+  const data = envelope.Data;
+  if (!filter || data == null)
+    return;
+  let note;
+  const [filterError, filtered] = catchError(() => applyFilter(data, filter, (n) => {
+    note = n;
+  }));
+  if (filterError) {
+    envelope.Warning = appendWarning(envelope.Warning, `--output-filter was not applied, so Data is shown in full: ${filterError.message}`);
+    return;
+  }
+  envelope.Data = filtered;
+  if (note) {
+    envelope.Warning = appendWarning(envelope.Warning, note);
+  }
+}
 function defaultErrorCodeForResult(result) {
   switch (result) {
     case RESULTS.AuthenticationError:
@@ -4699,7 +5130,7 @@ function defaultErrorCodeForResult(result) {
       return "unknown_error";
   }
 }
-function parseHttpStatusFromMessage(message) {
+function parseHttpStatusFromMessage2(message) {
   const match = /^HTTP\s+(\d{3})(?::|\s|-|$)/i.exec(message.trim());
   if (!match)
     return;
@@ -4728,10 +5159,10 @@ function defaultErrorCodeForHttpStatus(status) {
     return "server_error";
   return;
 }
-var LOCAL_PERMISSION_TEXT_PATTERN = /(?:\b|\()(?:EACCES|EPERM|EROFS)(?::\s|\))/;
+var LOCAL_PERMISSION_TEXT_PATTERN = new RegExp(`(?:\\b|\\()(?:${[...LOCAL_PERMISSION_ERROR_CODES].join("|")})(?::\\s|\\))`);
 function defaultErrorCodeForFailure(data) {
   if (data.Result === RESULTS.Failure) {
-    const status = data.Context?.httpStatus ?? parseHttpStatusFromMessage(data.Message);
+    const status = data.Context?.httpStatus ?? parseHttpStatusFromMessage2(data.Message);
     const errorCode = defaultErrorCodeForHttpStatus(status);
     if (errorCode)
       return errorCode;
@@ -4767,8 +5198,14 @@ var OutputFormatter;
     }
     const filter = getOutputFilter();
     if (filter) {
-      const filtered = applyFilter(data.Data, filter);
+      let note;
+      const filtered = applyFilter(data.Data, filter, (n) => {
+        note = n;
+      });
       data.Data = normalize ? normalizeDataKeys(filtered, verbatim, subtrees && { refs: subtrees.refs, mode: "skip" }) : filtered;
+      if (note) {
+        data.Warning = appendWarning(data.Warning, note);
+      }
     }
     logOutput(normalizeOutputKeys(data), getOutputFormat(), options?.tableRowStyle);
   }
@@ -4796,12 +5233,13 @@ var OutputFormatter;
     delete envelope.TelemetryErrorClass;
     delete envelope.TelemetryTerminalOutcome;
     delete envelope.TelemetryTerminalSignal;
+    filterFailureData(envelope);
     if (!suppressTelemetry) {
       telemetry.trackEvent(CommonTelemetryEvents.Error, {
-        result: data.Result,
-        errorCode: data.ErrorCode,
-        retry: data.Retry,
-        message: data.Message
+        [ErrorDimensions.Result]: data.Result,
+        [ErrorDimensions.ErrorCode]: data.ErrorCode,
+        [ErrorDimensions.Retry]: data.Retry,
+        [ErrorDimensions.ErrorMessage]: data.Message
       });
     }
     logOutput(normalizeOutputKeys(envelope), getOutputFormat());
@@ -4844,13 +5282,20 @@ var OutputFormatter;
   OutputFormatter.log = log;
   function formatToString(data) {
     const filter = getOutputFilter();
+    const envelope = data;
     if ("Data" in data && data.Data != null) {
       data.Data = normalizeDataKeys(data.Data);
       if (filter) {
-        data.Data = normalizeDataKeys(applyFilter(data.Data, filter));
+        let note;
+        data.Data = normalizeDataKeys(applyFilter(data.Data, filter, (n) => {
+          note = n;
+        }));
+        if (note) {
+          envelope.Warning = appendWarning(envelope.Warning, note);
+        }
       }
     }
-    const output = normalizeOutputKeys(data);
+    const output = normalizeOutputKeys(envelope);
     const lines = [];
     const sink = getOutputSink();
     printOutput(output, getOutputFormat(), (msg) => {
@@ -4900,7 +5345,7 @@ var LEGACY_SKILL_NAMESPACE = "uipath:";
 var MAX_SKILL_NAME_LENGTH = 80;
 var SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 function productMode(productArea, mode) {
-  return { product_area: productArea, mode };
+  return { ProductArea: productArea, Mode: mode };
 }
 function attributionRecord(groups) {
   const record = {};
@@ -4958,6 +5403,7 @@ var COMMAND_ATTRIBUTION = commandAttribution([
   ["rpa", "build", ["uip.rpa-legacy"]],
   ["conversational", "operate", ["uip.conversational"]],
   ["agents", "build", ["uip.codedagent", "uip.agent"]],
+  ["coding-agents", "build", ["uip.coder"]],
   ["agenthub", "build", ["uip.agenthub"]],
   ["coded-apps", "build", ["uip.codedapp"]],
   ["functions", "build", ["uip.function", "uip.functions"]],
@@ -5043,32 +5489,64 @@ function normalizeSkillName(value) {
 function buildCommandTelemetryAttribution(commandPath, skillSource) {
   const skillName = normalizeSkillName(skillSource);
   return {
-    ...skillName ? { skill_name: skillName } : {},
+    ...skillName ? { SkillName: skillName } : {},
     ...getCommandProductModeAttribution(commandPath)
   };
 }
+var AGENT_SESSION_ENV = {
+  [BaseDimensions.AgentModel]: "UIPATH_AGENT_MODEL",
+  [SkillsDimensions.PermissionMode]: "UIPATH_PERMISSION_MODE",
+  [SkillsDimensions.EffortLevel]: "UIPATH_EFFORT_LEVEL",
+  [SkillsDimensions.SkillsVersion]: "UIPATH_SKILLS_VERSION"
+};
+var MAX_TELEMETRY_TOKEN_LENGTH = 120;
+function sanitizeTelemetryToken(value) {
+  return value.replace(/[^A-Za-z0-9:._/ -]/g, "_").slice(0, MAX_TELEMETRY_TOKEN_LENGTH);
+}
+function buildAgentSessionTelemetry(env) {
+  const dimensions = {};
+  for (const [key, variable] of Object.entries(AGENT_SESSION_ENV)) {
+    const value = env[variable]?.trim();
+    if (value) {
+      dimensions[key] = sanitizeTelemetryToken(value);
+    }
+  }
+  return dimensions;
+}
 
 // ../../common/src/telemetry/command-name.ts
-var TELEMETRY_COMMAND_ROOT = "uip";
+var TELEMETRY_NAME_ROOT = "Cli";
+var CLI_COMMAND_ROOT = "uip";
+var TELEMETRY_NAME_BARE_ACTION = "Invoke";
 function commandTelemetryName(parts) {
+  const action = vetCommandTokens(parts).map(pascalizeToken).join("");
+  return `${TELEMETRY_NAME_ROOT}.${action || TELEMETRY_NAME_BARE_ACTION}`;
+}
+function commandInvocationPath(parts) {
+  return [CLI_COMMAND_ROOT, ...vetCommandTokens(parts)].join(" ");
+}
+function vetCommandTokens(parts) {
   const tokens = [];
   for (const part of parts) {
-    const pieces = String(part ?? "").split(/\s+/).filter((token) => token && !token.startsWith("-") && token !== TELEMETRY_COMMAND_ROOT);
+    const pieces = String(part ?? "").split(/\s+/).filter((token) => token && !token.startsWith("-") && token !== CLI_COMMAND_ROOT);
     if (pieces.every(isCommandToken)) {
       tokens.push(...pieces);
       continue;
     }
     tokens.push(UNKNOWN_TOKEN);
   }
-  return [TELEMETRY_COMMAND_ROOT, ...tokens].join(".");
+  return tokens;
+}
+function pascalizeToken(token) {
+  return token.split("-").filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
 }
-var COMMAND_TOKEN_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+var COMMAND_TOKEN_PATTERN = /^[a-z][a-z0-9-]*$/;
 var MAX_COMMAND_TOKEN_LENGTH = 32;
 var GUID_TOKEN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function isCommandToken(token) {
-  return token.length <= MAX_COMMAND_TOKEN_LENGTH && COMMAND_TOKEN_PATTERN.test(token) && !GUID_TOKEN.test(token) && !/^\d+$/.test(token);
+  return token.length <= MAX_COMMAND_TOKEN_LENGTH && COMMAND_TOKEN_PATTERN.test(token) && !GUID_TOKEN.test(token);
 }
-var UNKNOWN_TOKEN = "<unknown>";
+var UNKNOWN_TOKEN = "unknown";
 
 // ../../common/src/telemetry/invocation-request.ts
 var requestContextSlot = singleton("TelemetryInvocationRequestContext");
@@ -5173,7 +5651,7 @@ function withheldArgumentValues(cmd) {
   });
   return values;
 }
-function deriveCommandPath(cmd) {
+function deriveCommandParts(cmd) {
   const parts = [];
   let current = cmd;
   while (current) {
@@ -5186,14 +5664,13 @@ function deriveCommandPath(cmd) {
   if (parts.length > 1) {
     parts.shift();
   }
-  return commandTelemetryName(parts);
+  return parts;
 }
 function isErrorContext(value) {
   return value !== null && typeof value === "object";
 }
 function commandHelpHint(commandPath) {
-  const command = commandPath.replace(/\./g, " ");
-  return `An unexpected error occurred. Run '${command} --help' to verify command syntax, or run with --log-level debug for details.`;
+  return `An unexpected error occurred. Run '${commandPath} --help' to verify command syntax, or run with --log-level debug for details.`;
 }
 function isPromptCancellation(error) {
   return error instanceof Error && error.name === "ExitPromptError";
@@ -5218,7 +5695,9 @@ Command.prototype.trackedAction = function(context, fn, properties) {
       yaml: getOutputFormat() === "yaml",
       filter: getOutputFilter() !== undefined
     });
-    const telemetryName = deriveCommandPath(command);
+    const commandParts = deriveCommandParts(command);
+    const telemetryName = commandTelemetryName(commandParts);
+    const commandPath = commandInvocationPath(commandParts);
     const props = typeof properties === "function" ? properties(...args) : properties;
     markCommandStart();
     const supplied = recordSuppliedArgumentValues(withheldArgumentValues(command));
@@ -5253,7 +5732,7 @@ Command.prototype.trackedAction = function(context, fn, properties) {
           Result: finalResult,
           ...customErrorCode ? { ErrorCode: customErrorCode } : {},
           Message: errorMessage,
-          Instructions: customInstructions ?? commandHelpHint(telemetryName),
+          Instructions: customInstructions ?? commandHelpHint(commandPath),
           ...customRetry ? { Retry: customRetry } : {},
           ...customContext ? { Context: customContext } : {}
         });
@@ -5270,8 +5749,8 @@ Command.prototype.trackedAction = function(context, fn, properties) {
         recordedFailure,
         pollSignal: context.pollSignal
       });
-      if (terminalTelemetry.error_class === "internal" && error) {
-        telemetry.trackException(error instanceof Error ? error : new Error(String(error)), { command_name: telemetryName }, getInvocationRequestContext());
+      if (terminalTelemetry[CommandDimensions.ErrorClass] === "internal" && error) {
+        telemetry.trackException(error instanceof Error ? error : new Error(String(error)), { [CommandDimensions.CommandName]: commandPath }, getInvocationRequestContext());
       }
       const commandParams = extractCommandParams(command);
       if (props) {
@@ -5282,10 +5761,12 @@ Command.prototype.trackedAction = function(context, fn, properties) {
       const baseProperties = redactProperties({
         ...commandParams,
         ...props,
-        ...buildCommandTelemetryAttribution(telemetryName, process.env.UIPATH_SKILL),
-        command: "true",
+        ...buildCommandTelemetryAttribution(commandPath, process.env.UIPATH_SKILL),
+        ...buildAgentSessionTelemetry(process.env),
+        [CommandDimensions.CommandName]: commandPath,
+        [CommandDimensions.IsCommand]: "true",
         ...terminalTelemetry,
-        ...errorMessage ? { errorMessage } : {}
+        ...errorMessage ? { [CommandDimensions.ErrorMessage]: errorMessage } : {}
       });
       emitInvocationRequest(telemetryName, success, baseProperties);
     } finally {
@@ -5516,6 +5997,40 @@ var BOOLEAN_FLAGS = new Set(HOST_GLOBAL_FLAGS);
 // ../../common/src/interactivity-context.ts
 var modeSlot = singleton("InteractivityMode");
 var interactiveFlagSlot = singleton("InteractiveFlag");
+// ../../common/src/mime-types.ts
+var MIME_TYPES_BY_EXTENSION = Object.freeze({
+  pdf: "application/pdf",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp",
+  tif: "image/tiff",
+  tiff: "image/tiff",
+  svg: "image/svg+xml",
+  txt: "text/plain",
+  log: "text/plain",
+  md: "text/markdown",
+  csv: "text/csv",
+  tsv: "text/tab-separated-values",
+  json: "application/json",
+  xml: "application/xml",
+  html: "text/html",
+  htm: "text/html",
+  yaml: "application/yaml",
+  yml: "application/yaml",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  zip: "application/zip",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  mp4: "video/mp4"
+});
 // ../../common/src/polling/types.ts
 var PollOutcome = {
   Completed: "completed",
@@ -5561,6 +6076,7 @@ var ScreenLogger;
 })(ScreenLogger ||= {});
 // ../../common/src/sdk-user-agent.ts
 var USER_AGENT_HEADER = "User-Agent";
+var AGENT_PROPERTY = BaseDimensions.Agent;
 var sdkUserAgentHostToken = singleton("SdkUserAgentHostToken");
 function splitUserAgentTokens(value) {
   return value?.trim().split(/\s+/).filter(Boolean) ?? [];
@@ -5907,6 +6423,11 @@ var pickName = (claims) => {
   const username = asString(claims?.preferred_username);
   return asString(claims?.name) ?? (looksLikeEmail(username) ? undefined : username);
 };
+var pickScopes = (claims) => {
+  const raw = claims?.scope;
+  const scopes = Array.isArray(raw) ? raw.filter((entry) => asString(entry) !== undefined) : typeof raw === "string" ? raw.split(/\s+/).filter(Boolean) : [];
+  return scopes.length > 0 ? scopes : undefined;
+};
 var resolveSessionIdentity = (accessToken, authFlow) => {
   const claims = accessToken ? decodeClaims(accessToken) : undefined;
   const email = pickEmail(claims);
@@ -5932,6 +6453,7 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
     identity.clientId = clientId;
   return identity;
 };
+var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
 
 // ../../auth/src/envAuth.ts
 var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
@@ -6004,6 +6526,7 @@ var readAuthFromEnv = () => {
   const expiration = getTokenExpiration(accessToken);
   const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
   const identity = resolveSessionIdentity(accessToken);
+  const scopes = readTokenScopes(accessToken);
   return {
     loginStatus,
     accessToken,
@@ -6014,7 +6537,8 @@ var readAuthFromEnv = () => {
     tenantId,
     expiration,
     source: "env-vars" /* EnvironmentVariables */,
-    ...identity ? { identity } : {}
+    ...identity ? { identity } : {},
+    ...scopes ? { scopes } : {}
   };
 };
 
@@ -6652,10 +7176,15 @@ async function buildFileStatus(tokens, credentials, globalHint) {
 }
 function identityFields(accessToken, credentials) {
   const identity = resolveSessionIdentity(accessToken, parseAuthFlow(credentials[AUTH_FLOW_ENV_VAR]));
-  return identity ? { identity } : {};
+  const scopes = readTokenScopes(accessToken);
+  return {
+    ...identity ? { identity } : {},
+    ...scopes ? { scopes } : {}
+  };
 }
 function buildRobotStatus(robotCreds) {
   const identity = resolveSessionIdentity(robotCreds.accessToken);
+  const scopes = readTokenScopes(robotCreds.accessToken);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -6667,7 +7196,8 @@ function buildRobotStatus(robotCreds) {
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
     source: "robot" /* Robot */,
-    ...identity ? { identity } : {}
+    ...identity ? { identity } : {},
+    ...scopes ? { scopes } : {}
   };
 }
 var isFileNotFoundError = (error) => {
@@ -6934,7 +7464,8 @@ var getAuthContext = async (options = {}) => {
     organizationId: status.organizationId,
     organizationName: status.organizationName,
     tenantId: status.tenantId,
-    tenantName
+    tenantName,
+    identity: status.identity
   };
 };
 // ../../auth/src/tenantSelection.ts
@@ -7451,4 +7982,4 @@ export {
   registerCommands
 };
 
-//# debugId=BDAA1950C22776A264756E2164756E21
+//# debugId=DB96097981B119C764756E2164756E21

package/package.json

@@ -2,7 +2,7 @@
     "name": "@uipath/guardrails-tool",
     "author": "UiPath",
     "license": "SEE LICENSE IN LICENSE.txt",
-    "version": "1.203.0-preview.205",
+    "version": "1.204.0-preview.206",
     "description": "CLI plugin for UiPath AI Trust Layer guardrail configurations.",
     "private": false,
     "repository": {
@@ -24,5 +24,5 @@
     "files": [
         "dist"
     ],
-    "gitHead": "d8d19829030cc590c630bebfc60a9d9fc7fa8c31"
+    "gitHead": "ea7fd32a02acccf14e8e83522e69101430627b83"
 }