agent-inspect 6.14.0 → 6.14.2

package/packages/core/dist/advanced.d.cts

@@ -1,15 +1,15 @@
-export { C as CreateInspectorOptions, D as DEFAULT_MAX_EVENT_BYTES, f as DEFAULT_MAX_METADATA_VALUE_LENGTH, h as DEFAULT_MAX_PREVIEW_LENGTH, I as Inspector, a as InspectorCaptureOptions, b as InspectorObserveOptions, c as InspectorRunOptions, i as InspectorRuntime, j as InspectorRuntimeContext, k as InspectorRuntimeDiagnostics, l as InspectorRuntimeOptions, d as InspectorStepOptions, T as TraceSafetyOptions, e as createInspector, n as createInspectorRuntime, o as getCurrentContext, g as getCurrentCorrelationMetadata, p as getCurrentDepth, q as getCurrentRunId, r as getCurrentRunName, s as getCurrentStepId, t as getParentStepId, u as getTraceDirFromContext, v as getTraceSafetyFromContext, w as hasActiveContext, x as isAgentInspectEnabled, y as isSilentContext, m as maybeInspectRun, z as prepareMetadataForDisk, A as prepareTraceEventForDisk, B as resolveTraceSafetyOptions, E as runWithContext, F as runWithStepContext } from './context-BHAgRjOe.cjs';
-import { R as RedactionProfile, h as TraceEvent, E as ErrorInfo, b as RunStatus, e as StepStatus, j as RunSummary, k as TraceMetadata, l as TraceMetadataStatus, f as StepType, g as TraceCorrelationMetadata } from './types-BLX3tiOW.cjs';
-export { A as ActiveStepContext, i as ExecutionContext, I as InspectRunOptions, O as ObserveOptions, a as Run, m as RunCompletedEvent, n as RunStartedEvent, c as Step, o as StepCompletedEvent, d as StepMetadata, S as StepOptions, p as StepStartedEvent, T as TokenMetadata, q as TraceEventBase, r as TraceSchemaVersion, s as isStepStatus, t as isStepType, u as isTraceEvent } from './types-BLX3tiOW.cjs';
-import { a as InspectRunTree } from './inspect-event-DVg84S4v.cjs';
-export { A as AttributionConfidence, E as EventSource, c as InspectEvent, I as InspectKind, b as InspectNode } from './inspect-event-DVg84S4v.cjs';
-import { P as PersistedInspectEvent } from './persisted-inspect-event-d-mSP8kd.cjs';
+export { C as CreateInspectorOptions, D as DEFAULT_MAX_EVENT_BYTES, f as DEFAULT_MAX_METADATA_VALUE_LENGTH, h as DEFAULT_MAX_PREVIEW_LENGTH, I as Inspector, a as InspectorCaptureOptions, b as InspectorObserveOptions, c as InspectorRunOptions, i as InspectorRuntime, j as InspectorRuntimeContext, k as InspectorRuntimeDiagnostics, l as InspectorRuntimeOptions, d as InspectorStepOptions, T as TraceSafetyOptions, e as createInspector, n as createInspectorRuntime, o as getCurrentContext, g as getCurrentCorrelationMetadata, p as getCurrentDepth, q as getCurrentRunId, r as getCurrentRunName, s as getCurrentStepId, t as getParentStepId, u as getTraceDirFromContext, v as getTraceSafetyFromContext, w as hasActiveContext, x as isAgentInspectEnabled, y as isSilentContext, m as maybeInspectRun, z as prepareMetadataForDisk, A as prepareTraceEventForDisk, B as resolveTraceSafetyOptions, E as runWithContext, F as runWithStepContext } from './context-Ca5yK8Cs.cjs';
+import { R as RedactionProfile, h as TraceEvent, E as ErrorInfo, b as RunStatus, e as StepStatus, j as RunSummary, k as TraceMetadata, l as TraceMetadataStatus, f as StepType, g as TraceCorrelationMetadata } from './types-UnrNaTo2.cjs';
+export { A as ActiveStepContext, i as ExecutionContext, I as InspectRunOptions, O as ObserveOptions, a as Run, m as RunCompletedEvent, n as RunStartedEvent, c as Step, o as StepCompletedEvent, d as StepMetadata, S as StepOptions, p as StepStartedEvent, T as TokenMetadata, q as TraceEventBase, r as TraceSchemaVersion, s as isStepStatus, t as isStepType, u as isTraceEvent } from './types-UnrNaTo2.cjs';
+import { a as InspectRunTree } from './inspect-event-DRthdZlf.cjs';
+export { A as AttributionConfidence, E as EventSource, c as InspectEvent, I as InspectKind, b as InspectNode } from './inspect-event-DRthdZlf.cjs';
+import { P as PersistedInspectEvent } from './persisted-inspect-event-CVZWZldL.cjs';
 import { Stats } from 'node:fs';
 import { b as ObservedOutcome } from './types-B562HgN_.cjs';
 export { O as ObservedOutcomeStatus } from './types-B562HgN_.cjs';
-import { b as TraceCheckResult, J as TraceCheckStatus } from './index-CmXMS-MF.cjs';
+import { b as TraceCheckResult, J as TraceCheckStatus } from './index-BY6XZ5aG.cjs';
 import './writers.cjs';
-import './log-config-BG1WmWf2.cjs';
+import './log-config-CFlIJHTf.cjs';
 import './readers.cjs';
 
 interface ResolvedRedactionProfile {
@@ -398,6 +398,14 @@ interface TraceStatsOptions {
     slowStepLimit?: number;
 }
 declare function buildTraceStats(metas: TraceMetadata[], options: TraceStatsOptions): Promise<TraceStats>;
+/**
+ * Formats a step label for display. `step.tool`/`step.llm` already store the
+ * name with its type prefix (e.g. "tool:lookup"), while plain `step()` stores a
+ * bare name, so prefixing unconditionally would double the prefix. Add the type
+ * prefix only when the name does not already carry it, matching what list/view
+ * show for the same step.
+ */
+declare function formatStepLabel(stepType: string, stepName: string): string;
 declare function renderTraceStats(stats: TraceStats): string;
 
 interface TraceSearchOptions {
@@ -1435,4 +1443,4 @@ declare function renderGateGithubStepSummary(result: GateResult): string;
 declare function renderGateJUnit(result: GateResult): string;
 declare function renderGateReport(result: GateResult, options?: RenderGateReportOptions): string;
 
-export { type ActivityEntry, type ActivitySummary, type AnalyzeCohortOptions, type BuildActivitySummaryOptions, type BuildSessionIndexOptions, type BundleCheckResults, type BundleCheckRunResult, type BundleMetadata, type BundlePlaceholderArtifact, type BundleRedactionProfile, type BundleRedactionReport, type BundleRedactionReportRun, type BundleResolveOptions, type BundleResolveResult, type BundleSafeStatus, type BundleSafeStatusMetadata, COHORT_METRIC_IDS, type CausalContractFindingInput, type CausalFailureKind, type CohortAggregateMetrics, type CohortAnalysisResult, type CohortMetricComparison, type CohortMetricId, type CohortRunMetrics, type CriticalPathStep, DEFAULT_SUITE_ARTIFACTS_DIR, DEFAULT_SUITE_CONFIG_NAMES, DEFAULT_TRACE_DIR_NAME, type DurationStats, EVIDENCE_ASSESSMENT_NOTE, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, EVIDENCE_VIEW_CSS, EVIDENCE_VIEW_IDS, type EnrichSessionSummaryOptions, ErrorInfo, type EvidenceCheckFindingSummary, type EvidenceCiPackageFiles, type EvidenceCiPackageInput, type EvidenceContractsViewInput, type EvidenceFileEntry, type EvidenceFileRole, type EvidenceFormatVersion, type EvidenceHtmlShellInput, type EvidenceManifest, type EvidencePackagedFile, type EvidenceProvenanceViewInput, type EvidenceRedactionProfile, type EvidenceSafeStatus, type EvidenceSafetyViewInput, type EvidenceSourceHash, type EvidenceVerificationPolicy, type EvidenceVerifyIssue, type EvidenceVerifyOptions, type EvidenceVerifyResult, type EvidenceVerifyStatus, type EvidenceViewId, type ExplainFact, type ExplainInference, type ExplainMode, type ExplainOptions, type ExplainResult, FALLBACK_TRACE_DIR, type FindFirstCausalFailureOptions, type FirstCausalFailure, type GateCheckId, type GateCheckResult, type GateExitCode, type GateResult, type GroupSessionCohortsOptions, type HandoffEdge, InspectRunTree, type LoadSuiteConfigOptions, MAX_NAME_LENGTH, MAX_TERMINAL_DEPTH, MAX_TERMINAL_NAME_LENGTH, ObservedOutcome, type ParseTraceJsonlOptions, type ParseTraceJsonlResult, type ParsedDurationFilter, RUNS_DIR_NAME, RedactionProfile, type RenderCohortReportOptions, type RenderGateReportOptions, type RenderSuiteReportOptions, type RenderTimelineOptions, type RenderWhatOptions, type ResolvedRedactionProfile, type ResolvedSuiteCase, type RetryLink, type RunGateOptions, RunStatus, type RunSuiteOptions, RunSummary, type RunTimeline, type RunWhatSummary, SESSION_WORKFLOW_KEYS, SUITE_TEMPLATE_IDS, type SessionCheckSummary, type SessionCohort, type SessionCohortKind, type SessionConfidence, type SessionEdgeSource, type SessionGroup, type SessionIndex, type SessionLastError, type SessionRunRecord, type SessionScopeOptions, type SessionScopeResult, type SessionStatus, type SessionSummary, type SessionWarning, type SessionWorkflowKey, type SessionWorkflowMetadata, StepStatus, StepType, type SuiteArtifactsConfig, type SuiteCaseConfig, type SuiteCaseResult, type SuiteCaseStatus, type SuiteChecksConfig, type SuiteConfig, type SuiteDiagnostic, type SuiteDiagnosticCode, type SuiteEvalConfig, type SuiteRunResult, type SuiteRunSummary, type SuiteTemplateId, TERMINAL_INDENT, type TimelineEntry, type TimelineFocus, type TimelineOptions, TraceCorrelationMetadata, TraceDirectory, type TraceDirectoryOptions, TraceEvent, type TraceFilterOptions, type TraceJsonlFormat, TraceMetadata, TraceMetadataStatus, type TraceSearchOptions, type TraceSearchResult, type TraceSessionCheckResult, type TraceStats, type TraceStatsOptions, type TraceStatsRankedRun, type TraceStatsRankedStep, type ValidateSuiteConfigResult, type ZipEntry, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceFileEntries, buildEvidenceHtmlShell, buildEvidenceHtmlShellFromManifest, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compareCohortAggregates, createRunId, createStepId, defaultBundleOutputPath, defaultSuiteConfigTemplate, deriveSessionStatus, encodeEmbeddedEvidenceJson, enrichSessionRunRecord, enrichSessionSummary, ensureTraceDir, extractMetadata, extractOutcomesFromPersistedEvents, extractOutcomesFromTraceEvents, extractSessionWorkflowMetadata, filterMetasBySessionScope, filterTraces, findFirstCausalFailure, formatDuration, formatError, formatTerminalName, formatTimestamp, gateHasThresholds, getDefaultTraceDir, getIndent, getRunIdFromTraceFileName, getSuiteTemplate, getTraceFilePath, groupSessionCohorts, inferEvidenceFileRole, initializeTraceFile, isAgentInspectTrace, isSha256Hex, listSuiteTemplates, listTraceFiles, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, normalizeBundleOutputPath, normalizeSuiteConfig, parseCohortMetricList, parseDuration, parseDurationFilter, parseEvidenceManifestJson, parseGateList, parseGateNumber, parseGroupBySpec, parseTraceJsonl, printError, printFailedAt, printRunComplete, printRunStart, printStepComplete, printStepStart, readTraceEvents, readTraceFile, renderActivitySummaryHuman, renderCohortReport, renderCohortSummaryMarkdown, renderErrorLine, renderGateGithubStepSummary, renderGateJUnit, renderGateReport, renderGateSummaryMarkdown, renderRunSummary, renderRunWhat, renderStepLine, renderSuiteReport, renderSuiteReportMarkdown, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteCaseTrace, resolveSuiteConfigPath, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, sanitizeBundleRunId, searchTraces, serializeEvent, serializeEvidenceManifest, sessionKeyForRun, sha256Equals, sha256Hex, toMetadataSafeStatus, traceMetasToSessionRunRecords, truncateName, unknownTraceFormatMessage, validateEvent, validateEvidenceManifest, validateSuiteConfig, verifyEvidenceDirectory, warn, writeTraceEvent };
+export { type ActivityEntry, type ActivitySummary, type AnalyzeCohortOptions, type BuildActivitySummaryOptions, type BuildSessionIndexOptions, type BundleCheckResults, type BundleCheckRunResult, type BundleMetadata, type BundlePlaceholderArtifact, type BundleRedactionProfile, type BundleRedactionReport, type BundleRedactionReportRun, type BundleResolveOptions, type BundleResolveResult, type BundleSafeStatus, type BundleSafeStatusMetadata, COHORT_METRIC_IDS, type CausalContractFindingInput, type CausalFailureKind, type CohortAggregateMetrics, type CohortAnalysisResult, type CohortMetricComparison, type CohortMetricId, type CohortRunMetrics, type CriticalPathStep, DEFAULT_SUITE_ARTIFACTS_DIR, DEFAULT_SUITE_CONFIG_NAMES, DEFAULT_TRACE_DIR_NAME, type DurationStats, EVIDENCE_ASSESSMENT_NOTE, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, EVIDENCE_VIEW_CSS, EVIDENCE_VIEW_IDS, type EnrichSessionSummaryOptions, ErrorInfo, type EvidenceCheckFindingSummary, type EvidenceCiPackageFiles, type EvidenceCiPackageInput, type EvidenceContractsViewInput, type EvidenceFileEntry, type EvidenceFileRole, type EvidenceFormatVersion, type EvidenceHtmlShellInput, type EvidenceManifest, type EvidencePackagedFile, type EvidenceProvenanceViewInput, type EvidenceRedactionProfile, type EvidenceSafeStatus, type EvidenceSafetyViewInput, type EvidenceSourceHash, type EvidenceVerificationPolicy, type EvidenceVerifyIssue, type EvidenceVerifyOptions, type EvidenceVerifyResult, type EvidenceVerifyStatus, type EvidenceViewId, type ExplainFact, type ExplainInference, type ExplainMode, type ExplainOptions, type ExplainResult, FALLBACK_TRACE_DIR, type FindFirstCausalFailureOptions, type FirstCausalFailure, type GateCheckId, type GateCheckResult, type GateExitCode, type GateResult, type GroupSessionCohortsOptions, type HandoffEdge, InspectRunTree, type LoadSuiteConfigOptions, MAX_NAME_LENGTH, MAX_TERMINAL_DEPTH, MAX_TERMINAL_NAME_LENGTH, ObservedOutcome, type ParseTraceJsonlOptions, type ParseTraceJsonlResult, type ParsedDurationFilter, RUNS_DIR_NAME, RedactionProfile, type RenderCohortReportOptions, type RenderGateReportOptions, type RenderSuiteReportOptions, type RenderTimelineOptions, type RenderWhatOptions, type ResolvedRedactionProfile, type ResolvedSuiteCase, type RetryLink, type RunGateOptions, RunStatus, type RunSuiteOptions, RunSummary, type RunTimeline, type RunWhatSummary, SESSION_WORKFLOW_KEYS, SUITE_TEMPLATE_IDS, type SessionCheckSummary, type SessionCohort, type SessionCohortKind, type SessionConfidence, type SessionEdgeSource, type SessionGroup, type SessionIndex, type SessionLastError, type SessionRunRecord, type SessionScopeOptions, type SessionScopeResult, type SessionStatus, type SessionSummary, type SessionWarning, type SessionWorkflowKey, type SessionWorkflowMetadata, StepStatus, StepType, type SuiteArtifactsConfig, type SuiteCaseConfig, type SuiteCaseResult, type SuiteCaseStatus, type SuiteChecksConfig, type SuiteConfig, type SuiteDiagnostic, type SuiteDiagnosticCode, type SuiteEvalConfig, type SuiteRunResult, type SuiteRunSummary, type SuiteTemplateId, TERMINAL_INDENT, type TimelineEntry, type TimelineFocus, type TimelineOptions, TraceCorrelationMetadata, TraceDirectory, type TraceDirectoryOptions, TraceEvent, type TraceFilterOptions, type TraceJsonlFormat, TraceMetadata, TraceMetadataStatus, type TraceSearchOptions, type TraceSearchResult, type TraceSessionCheckResult, type TraceStats, type TraceStatsOptions, type TraceStatsRankedRun, type TraceStatsRankedStep, type ValidateSuiteConfigResult, type ZipEntry, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceFileEntries, buildEvidenceHtmlShell, buildEvidenceHtmlShellFromManifest, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compareCohortAggregates, createRunId, createStepId, defaultBundleOutputPath, defaultSuiteConfigTemplate, deriveSessionStatus, encodeEmbeddedEvidenceJson, enrichSessionRunRecord, enrichSessionSummary, ensureTraceDir, extractMetadata, extractOutcomesFromPersistedEvents, extractOutcomesFromTraceEvents, extractSessionWorkflowMetadata, filterMetasBySessionScope, filterTraces, findFirstCausalFailure, formatDuration, formatError, formatStepLabel, formatTerminalName, formatTimestamp, gateHasThresholds, getDefaultTraceDir, getIndent, getRunIdFromTraceFileName, getSuiteTemplate, getTraceFilePath, groupSessionCohorts, inferEvidenceFileRole, initializeTraceFile, isAgentInspectTrace, isSha256Hex, listSuiteTemplates, listTraceFiles, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, normalizeBundleOutputPath, normalizeSuiteConfig, parseCohortMetricList, parseDuration, parseDurationFilter, parseEvidenceManifestJson, parseGateList, parseGateNumber, parseGroupBySpec, parseTraceJsonl, printError, printFailedAt, printRunComplete, printRunStart, printStepComplete, printStepStart, readTraceEvents, readTraceFile, renderActivitySummaryHuman, renderCohortReport, renderCohortSummaryMarkdown, renderErrorLine, renderGateGithubStepSummary, renderGateJUnit, renderGateReport, renderGateSummaryMarkdown, renderRunSummary, renderRunWhat, renderStepLine, renderSuiteReport, renderSuiteReportMarkdown, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteCaseTrace, resolveSuiteConfigPath, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, sanitizeBundleRunId, searchTraces, serializeEvent, serializeEvidenceManifest, sessionKeyForRun, sha256Equals, sha256Hex, toMetadataSafeStatus, traceMetasToSessionRunRecords, truncateName, unknownTraceFormatMessage, validateEvent, validateEvidenceManifest, validateSuiteConfig, verifyEvidenceDirectory, warn, writeTraceEvent };

package/packages/core/dist/advanced.d.ts

@@ -1,15 +1,15 @@
-export { C as CreateInspectorOptions, D as DEFAULT_MAX_EVENT_BYTES, f as DEFAULT_MAX_METADATA_VALUE_LENGTH, h as DEFAULT_MAX_PREVIEW_LENGTH, I as Inspector, a as InspectorCaptureOptions, b as InspectorObserveOptions, c as InspectorRunOptions, i as InspectorRuntime, j as InspectorRuntimeContext, k as InspectorRuntimeDiagnostics, l as InspectorRuntimeOptions, d as InspectorStepOptions, T as TraceSafetyOptions, e as createInspector, n as createInspectorRuntime, o as getCurrentContext, g as getCurrentCorrelationMetadata, p as getCurrentDepth, q as getCurrentRunId, r as getCurrentRunName, s as getCurrentStepId, t as getParentStepId, u as getTraceDirFromContext, v as getTraceSafetyFromContext, w as hasActiveContext, x as isAgentInspectEnabled, y as isSilentContext, m as maybeInspectRun, z as prepareMetadataForDisk, A as prepareTraceEventForDisk, B as resolveTraceSafetyOptions, E as runWithContext, F as runWithStepContext } from './context-Blyjb5my.js';
-import { R as RedactionProfile, h as TraceEvent, E as ErrorInfo, b as RunStatus, e as StepStatus, j as RunSummary, k as TraceMetadata, l as TraceMetadataStatus, f as StepType, g as TraceCorrelationMetadata } from './types-MuwXSJ4b.js';
-export { A as ActiveStepContext, i as ExecutionContext, I as InspectRunOptions, O as ObserveOptions, a as Run, m as RunCompletedEvent, n as RunStartedEvent, c as Step, o as StepCompletedEvent, d as StepMetadata, S as StepOptions, p as StepStartedEvent, T as TokenMetadata, q as TraceEventBase, r as TraceSchemaVersion, s as isStepStatus, t as isStepType, u as isTraceEvent } from './types-MuwXSJ4b.js';
-import { a as InspectRunTree } from './inspect-event-DVg84S4v.js';
-export { A as AttributionConfidence, E as EventSource, c as InspectEvent, I as InspectKind, b as InspectNode } from './inspect-event-DVg84S4v.js';
-import { P as PersistedInspectEvent } from './persisted-inspect-event-ChE7pGb7.js';
+export { C as CreateInspectorOptions, D as DEFAULT_MAX_EVENT_BYTES, f as DEFAULT_MAX_METADATA_VALUE_LENGTH, h as DEFAULT_MAX_PREVIEW_LENGTH, I as Inspector, a as InspectorCaptureOptions, b as InspectorObserveOptions, c as InspectorRunOptions, i as InspectorRuntime, j as InspectorRuntimeContext, k as InspectorRuntimeDiagnostics, l as InspectorRuntimeOptions, d as InspectorStepOptions, T as TraceSafetyOptions, e as createInspector, n as createInspectorRuntime, o as getCurrentContext, g as getCurrentCorrelationMetadata, p as getCurrentDepth, q as getCurrentRunId, r as getCurrentRunName, s as getCurrentStepId, t as getParentStepId, u as getTraceDirFromContext, v as getTraceSafetyFromContext, w as hasActiveContext, x as isAgentInspectEnabled, y as isSilentContext, m as maybeInspectRun, z as prepareMetadataForDisk, A as prepareTraceEventForDisk, B as resolveTraceSafetyOptions, E as runWithContext, F as runWithStepContext } from './context-D6cS4XIL.js';
+import { R as RedactionProfile, h as TraceEvent, E as ErrorInfo, b as RunStatus, e as StepStatus, j as RunSummary, k as TraceMetadata, l as TraceMetadataStatus, f as StepType, g as TraceCorrelationMetadata } from './types--ainI31J.js';
+export { A as ActiveStepContext, i as ExecutionContext, I as InspectRunOptions, O as ObserveOptions, a as Run, m as RunCompletedEvent, n as RunStartedEvent, c as Step, o as StepCompletedEvent, d as StepMetadata, S as StepOptions, p as StepStartedEvent, T as TokenMetadata, q as TraceEventBase, r as TraceSchemaVersion, s as isStepStatus, t as isStepType, u as isTraceEvent } from './types--ainI31J.js';
+import { a as InspectRunTree } from './inspect-event-DRthdZlf.js';
+export { A as AttributionConfidence, E as EventSource, c as InspectEvent, I as InspectKind, b as InspectNode } from './inspect-event-DRthdZlf.js';
+import { P as PersistedInspectEvent } from './persisted-inspect-event-BVucFVrP.js';
 import { Stats } from 'node:fs';
 import { b as ObservedOutcome } from './types-B562HgN_.js';
 export { O as ObservedOutcomeStatus } from './types-B562HgN_.js';
-import { b as TraceCheckResult, J as TraceCheckStatus } from './index-Bu_vOjql.js';
+import { b as TraceCheckResult, J as TraceCheckStatus } from './index-D9HBequ_.js';
 import './writers.js';
-import './log-config-Ck0aT_Ou.js';
+import './log-config-OZRfpHED.js';
 import './readers.js';
 
 interface ResolvedRedactionProfile {
@@ -398,6 +398,14 @@ interface TraceStatsOptions {
     slowStepLimit?: number;
 }
 declare function buildTraceStats(metas: TraceMetadata[], options: TraceStatsOptions): Promise<TraceStats>;
+/**
+ * Formats a step label for display. `step.tool`/`step.llm` already store the
+ * name with its type prefix (e.g. "tool:lookup"), while plain `step()` stores a
+ * bare name, so prefixing unconditionally would double the prefix. Add the type
+ * prefix only when the name does not already carry it, matching what list/view
+ * show for the same step.
+ */
+declare function formatStepLabel(stepType: string, stepName: string): string;
 declare function renderTraceStats(stats: TraceStats): string;
 
 interface TraceSearchOptions {
@@ -1435,4 +1443,4 @@ declare function renderGateGithubStepSummary(result: GateResult): string;
 declare function renderGateJUnit(result: GateResult): string;
 declare function renderGateReport(result: GateResult, options?: RenderGateReportOptions): string;
 
-export { type ActivityEntry, type ActivitySummary, type AnalyzeCohortOptions, type BuildActivitySummaryOptions, type BuildSessionIndexOptions, type BundleCheckResults, type BundleCheckRunResult, type BundleMetadata, type BundlePlaceholderArtifact, type BundleRedactionProfile, type BundleRedactionReport, type BundleRedactionReportRun, type BundleResolveOptions, type BundleResolveResult, type BundleSafeStatus, type BundleSafeStatusMetadata, COHORT_METRIC_IDS, type CausalContractFindingInput, type CausalFailureKind, type CohortAggregateMetrics, type CohortAnalysisResult, type CohortMetricComparison, type CohortMetricId, type CohortRunMetrics, type CriticalPathStep, DEFAULT_SUITE_ARTIFACTS_DIR, DEFAULT_SUITE_CONFIG_NAMES, DEFAULT_TRACE_DIR_NAME, type DurationStats, EVIDENCE_ASSESSMENT_NOTE, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, EVIDENCE_VIEW_CSS, EVIDENCE_VIEW_IDS, type EnrichSessionSummaryOptions, ErrorInfo, type EvidenceCheckFindingSummary, type EvidenceCiPackageFiles, type EvidenceCiPackageInput, type EvidenceContractsViewInput, type EvidenceFileEntry, type EvidenceFileRole, type EvidenceFormatVersion, type EvidenceHtmlShellInput, type EvidenceManifest, type EvidencePackagedFile, type EvidenceProvenanceViewInput, type EvidenceRedactionProfile, type EvidenceSafeStatus, type EvidenceSafetyViewInput, type EvidenceSourceHash, type EvidenceVerificationPolicy, type EvidenceVerifyIssue, type EvidenceVerifyOptions, type EvidenceVerifyResult, type EvidenceVerifyStatus, type EvidenceViewId, type ExplainFact, type ExplainInference, type ExplainMode, type ExplainOptions, type ExplainResult, FALLBACK_TRACE_DIR, type FindFirstCausalFailureOptions, type FirstCausalFailure, type GateCheckId, type GateCheckResult, type GateExitCode, type GateResult, type GroupSessionCohortsOptions, type HandoffEdge, InspectRunTree, type LoadSuiteConfigOptions, MAX_NAME_LENGTH, MAX_TERMINAL_DEPTH, MAX_TERMINAL_NAME_LENGTH, ObservedOutcome, type ParseTraceJsonlOptions, type ParseTraceJsonlResult, type ParsedDurationFilter, RUNS_DIR_NAME, RedactionProfile, type RenderCohortReportOptions, type RenderGateReportOptions, type RenderSuiteReportOptions, type RenderTimelineOptions, type RenderWhatOptions, type ResolvedRedactionProfile, type ResolvedSuiteCase, type RetryLink, type RunGateOptions, RunStatus, type RunSuiteOptions, RunSummary, type RunTimeline, type RunWhatSummary, SESSION_WORKFLOW_KEYS, SUITE_TEMPLATE_IDS, type SessionCheckSummary, type SessionCohort, type SessionCohortKind, type SessionConfidence, type SessionEdgeSource, type SessionGroup, type SessionIndex, type SessionLastError, type SessionRunRecord, type SessionScopeOptions, type SessionScopeResult, type SessionStatus, type SessionSummary, type SessionWarning, type SessionWorkflowKey, type SessionWorkflowMetadata, StepStatus, StepType, type SuiteArtifactsConfig, type SuiteCaseConfig, type SuiteCaseResult, type SuiteCaseStatus, type SuiteChecksConfig, type SuiteConfig, type SuiteDiagnostic, type SuiteDiagnosticCode, type SuiteEvalConfig, type SuiteRunResult, type SuiteRunSummary, type SuiteTemplateId, TERMINAL_INDENT, type TimelineEntry, type TimelineFocus, type TimelineOptions, TraceCorrelationMetadata, TraceDirectory, type TraceDirectoryOptions, TraceEvent, type TraceFilterOptions, type TraceJsonlFormat, TraceMetadata, TraceMetadataStatus, type TraceSearchOptions, type TraceSearchResult, type TraceSessionCheckResult, type TraceStats, type TraceStatsOptions, type TraceStatsRankedRun, type TraceStatsRankedStep, type ValidateSuiteConfigResult, type ZipEntry, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceFileEntries, buildEvidenceHtmlShell, buildEvidenceHtmlShellFromManifest, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compareCohortAggregates, createRunId, createStepId, defaultBundleOutputPath, defaultSuiteConfigTemplate, deriveSessionStatus, encodeEmbeddedEvidenceJson, enrichSessionRunRecord, enrichSessionSummary, ensureTraceDir, extractMetadata, extractOutcomesFromPersistedEvents, extractOutcomesFromTraceEvents, extractSessionWorkflowMetadata, filterMetasBySessionScope, filterTraces, findFirstCausalFailure, formatDuration, formatError, formatTerminalName, formatTimestamp, gateHasThresholds, getDefaultTraceDir, getIndent, getRunIdFromTraceFileName, getSuiteTemplate, getTraceFilePath, groupSessionCohorts, inferEvidenceFileRole, initializeTraceFile, isAgentInspectTrace, isSha256Hex, listSuiteTemplates, listTraceFiles, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, normalizeBundleOutputPath, normalizeSuiteConfig, parseCohortMetricList, parseDuration, parseDurationFilter, parseEvidenceManifestJson, parseGateList, parseGateNumber, parseGroupBySpec, parseTraceJsonl, printError, printFailedAt, printRunComplete, printRunStart, printStepComplete, printStepStart, readTraceEvents, readTraceFile, renderActivitySummaryHuman, renderCohortReport, renderCohortSummaryMarkdown, renderErrorLine, renderGateGithubStepSummary, renderGateJUnit, renderGateReport, renderGateSummaryMarkdown, renderRunSummary, renderRunWhat, renderStepLine, renderSuiteReport, renderSuiteReportMarkdown, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteCaseTrace, resolveSuiteConfigPath, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, sanitizeBundleRunId, searchTraces, serializeEvent, serializeEvidenceManifest, sessionKeyForRun, sha256Equals, sha256Hex, toMetadataSafeStatus, traceMetasToSessionRunRecords, truncateName, unknownTraceFormatMessage, validateEvent, validateEvidenceManifest, validateSuiteConfig, verifyEvidenceDirectory, warn, writeTraceEvent };
+export { type ActivityEntry, type ActivitySummary, type AnalyzeCohortOptions, type BuildActivitySummaryOptions, type BuildSessionIndexOptions, type BundleCheckResults, type BundleCheckRunResult, type BundleMetadata, type BundlePlaceholderArtifact, type BundleRedactionProfile, type BundleRedactionReport, type BundleRedactionReportRun, type BundleResolveOptions, type BundleResolveResult, type BundleSafeStatus, type BundleSafeStatusMetadata, COHORT_METRIC_IDS, type CausalContractFindingInput, type CausalFailureKind, type CohortAggregateMetrics, type CohortAnalysisResult, type CohortMetricComparison, type CohortMetricId, type CohortRunMetrics, type CriticalPathStep, DEFAULT_SUITE_ARTIFACTS_DIR, DEFAULT_SUITE_CONFIG_NAMES, DEFAULT_TRACE_DIR_NAME, type DurationStats, EVIDENCE_ASSESSMENT_NOTE, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, EVIDENCE_VIEW_CSS, EVIDENCE_VIEW_IDS, type EnrichSessionSummaryOptions, ErrorInfo, type EvidenceCheckFindingSummary, type EvidenceCiPackageFiles, type EvidenceCiPackageInput, type EvidenceContractsViewInput, type EvidenceFileEntry, type EvidenceFileRole, type EvidenceFormatVersion, type EvidenceHtmlShellInput, type EvidenceManifest, type EvidencePackagedFile, type EvidenceProvenanceViewInput, type EvidenceRedactionProfile, type EvidenceSafeStatus, type EvidenceSafetyViewInput, type EvidenceSourceHash, type EvidenceVerificationPolicy, type EvidenceVerifyIssue, type EvidenceVerifyOptions, type EvidenceVerifyResult, type EvidenceVerifyStatus, type EvidenceViewId, type ExplainFact, type ExplainInference, type ExplainMode, type ExplainOptions, type ExplainResult, FALLBACK_TRACE_DIR, type FindFirstCausalFailureOptions, type FirstCausalFailure, type GateCheckId, type GateCheckResult, type GateExitCode, type GateResult, type GroupSessionCohortsOptions, type HandoffEdge, InspectRunTree, type LoadSuiteConfigOptions, MAX_NAME_LENGTH, MAX_TERMINAL_DEPTH, MAX_TERMINAL_NAME_LENGTH, ObservedOutcome, type ParseTraceJsonlOptions, type ParseTraceJsonlResult, type ParsedDurationFilter, RUNS_DIR_NAME, RedactionProfile, type RenderCohortReportOptions, type RenderGateReportOptions, type RenderSuiteReportOptions, type RenderTimelineOptions, type RenderWhatOptions, type ResolvedRedactionProfile, type ResolvedSuiteCase, type RetryLink, type RunGateOptions, RunStatus, type RunSuiteOptions, RunSummary, type RunTimeline, type RunWhatSummary, SESSION_WORKFLOW_KEYS, SUITE_TEMPLATE_IDS, type SessionCheckSummary, type SessionCohort, type SessionCohortKind, type SessionConfidence, type SessionEdgeSource, type SessionGroup, type SessionIndex, type SessionLastError, type SessionRunRecord, type SessionScopeOptions, type SessionScopeResult, type SessionStatus, type SessionSummary, type SessionWarning, type SessionWorkflowKey, type SessionWorkflowMetadata, StepStatus, StepType, type SuiteArtifactsConfig, type SuiteCaseConfig, type SuiteCaseResult, type SuiteCaseStatus, type SuiteChecksConfig, type SuiteConfig, type SuiteDiagnostic, type SuiteDiagnosticCode, type SuiteEvalConfig, type SuiteRunResult, type SuiteRunSummary, type SuiteTemplateId, TERMINAL_INDENT, type TimelineEntry, type TimelineFocus, type TimelineOptions, TraceCorrelationMetadata, TraceDirectory, type TraceDirectoryOptions, TraceEvent, type TraceFilterOptions, type TraceJsonlFormat, TraceMetadata, TraceMetadataStatus, type TraceSearchOptions, type TraceSearchResult, type TraceSessionCheckResult, type TraceStats, type TraceStatsOptions, type TraceStatsRankedRun, type TraceStatsRankedStep, type ValidateSuiteConfigResult, type ZipEntry, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceFileEntries, buildEvidenceHtmlShell, buildEvidenceHtmlShellFromManifest, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compareCohortAggregates, createRunId, createStepId, defaultBundleOutputPath, defaultSuiteConfigTemplate, deriveSessionStatus, encodeEmbeddedEvidenceJson, enrichSessionRunRecord, enrichSessionSummary, ensureTraceDir, extractMetadata, extractOutcomesFromPersistedEvents, extractOutcomesFromTraceEvents, extractSessionWorkflowMetadata, filterMetasBySessionScope, filterTraces, findFirstCausalFailure, formatDuration, formatError, formatStepLabel, formatTerminalName, formatTimestamp, gateHasThresholds, getDefaultTraceDir, getIndent, getRunIdFromTraceFileName, getSuiteTemplate, getTraceFilePath, groupSessionCohorts, inferEvidenceFileRole, initializeTraceFile, isAgentInspectTrace, isSha256Hex, listSuiteTemplates, listTraceFiles, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, normalizeBundleOutputPath, normalizeSuiteConfig, parseCohortMetricList, parseDuration, parseDurationFilter, parseEvidenceManifestJson, parseGateList, parseGateNumber, parseGroupBySpec, parseTraceJsonl, printError, printFailedAt, printRunComplete, printRunStart, printStepComplete, printStepStart, readTraceEvents, readTraceFile, renderActivitySummaryHuman, renderCohortReport, renderCohortSummaryMarkdown, renderErrorLine, renderGateGithubStepSummary, renderGateJUnit, renderGateReport, renderGateSummaryMarkdown, renderRunSummary, renderRunWhat, renderStepLine, renderSuiteReport, renderSuiteReportMarkdown, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteCaseTrace, resolveSuiteConfigPath, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, sanitizeBundleRunId, searchTraces, serializeEvent, serializeEvidenceManifest, sessionKeyForRun, sha256Equals, sha256Hex, toMetadataSafeStatus, traceMetasToSessionRunRecords, truncateName, unknownTraceFormatMessage, validateEvent, validateEvidenceManifest, validateSuiteConfig, verifyEvidenceDirectory, warn, writeTraceEvent };

package/packages/core/dist/advanced.mjs

@@ -1,7 +1,7 @@
-import { runTraceChecks, createRunStatusRule, createToolUsageRule, createRunDurationRule, createLlmUsageRule, createObservedOutcomeRule } from './chunk-BS2QCAJX.mjs';
+import { runTraceChecks, createRunStatusRule, createToolUsageRule, createRunDurationRule, createLlmUsageRule, createObservedOutcomeRule } from './chunk-BHMXLDLK.mjs';
 export { MAX_TERMINAL_DEPTH, MAX_TERMINAL_NAME_LENGTH, TERMINAL_INDENT, TraceDirectory, createInspector, createInspectorRuntime, formatTerminalName, getCurrentContext, getCurrentCorrelationMetadata, getCurrentDepth, getCurrentRunId, getCurrentRunName, getCurrentStepId, getIndent, getParentStepId, getTraceDirFromContext, getTraceSafetyFromContext, hasActiveContext, isAgentInspectEnabled, isSilentContext, maybeInspectRun, printError, printFailedAt, printRunComplete, printRunStart, printStepComplete, printStepStart, renderErrorLine, renderRunSummary, renderStepLine, resolveTraceDir, runWithContext, runWithStepContext } from './chunk-ZWA5RWMV.mjs';
-import { buildRunTimeline, filterTraces, extractMetadata, buildRunSummary } from './chunk-LFWZEO2L.mjs';
-export { buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildTraceStats, extractMetadata, filterTraces, renderRunWhat, renderTimeline, renderTraceStats } from './chunk-LFWZEO2L.mjs';
+import { buildRunTimeline, filterTraces, extractMetadata, buildRunSummary } from './chunk-SGL4JGCD.mjs';
+export { buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildTraceStats, extractMetadata, filterTraces, formatStepLabel, renderRunWhat, renderTimeline, renderTraceStats } from './chunk-SGL4JGCD.mjs';
 import { extractOutcomesFromTraceEvents, parseObservationFilter, summarizeObservedOutcomes, extractOutcomesFromPersistedEvents, renderObservedOutcomesHtml } from './chunk-VFO76UH3.mjs';
 export { extractOutcomesFromPersistedEvents, extractOutcomesFromTraceEvents } from './chunk-VFO76UH3.mjs';
 import { diffTraceEvents, renderRunDiff } from './chunk-F7STQ5JF.mjs';
@@ -10,10 +10,10 @@ import { escapeHtml, flattenTree } from './chunk-CAWPF22J.mjs';
 import { resolveRedactionProfile, readTraceEventsFromFile } from './chunk-ULCGIRTC.mjs';
 export { DEFAULT_MAX_EVENT_BYTES, DEFAULT_MAX_METADATA_VALUE_LENGTH, DEFAULT_MAX_PREVIEW_LENGTH, getRunIdFromTraceFileName, initializeTraceFile, listTraceFiles, prepareMetadataForDisk, prepareTraceEventForDisk, readTraceEvents, readTraceFile, resolveRedactionProfile, resolveTraceSafetyOptions, serializeEvent, validateEvent, writeTraceEvent } from './chunk-ULCGIRTC.mjs';
 import { Redactor } from './chunk-VU6O5QAH.mjs';
-import { openTrace } from './chunk-CTA6XNDP.mjs';
-import './chunk-UOPVGCOB.mjs';
+import { openTrace } from './chunk-5N2OBM7S.mjs';
+import './chunk-NXQF73EC.mjs';
 import './chunk-S4YWKV4G.mjs';
-import './chunk-T5MASTIW.mjs';
+import './chunk-AK5EN4U2.mjs';
 import { parseDuration, isTraceEvent, getTraceFilePath } from './chunk-WRE4CNPF.mjs';
 export { DEFAULT_TRACE_DIR_NAME, FALLBACK_TRACE_DIR, MAX_NAME_LENGTH, RUNS_DIR_NAME, createRunId, createStepId, ensureTraceDir, formatDuration, formatError, formatTimestamp, getDefaultTraceDir, getTraceFilePath, isStepStatus, isStepType, isTraceEvent, parseDuration, parseTraceJsonl, truncateName, unknownTraceFormatMessage, warn } from './chunk-WRE4CNPF.mjs';
 import { persistedInspectEventsToTraceEvents } from './chunk-P366CCL2.mjs';

package/packages/core/dist/checks.cjs

@@ -64,6 +64,73 @@ function outcomesMatchingStatus(outcomes, statuses) {
   return outcomes.filter((outcome) => set.has(outcome.status));
 }
 
+// packages/core/src/safety/sensitive-key.ts
+function normalizeSensitiveKey(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+}
+var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
+  [
+    "tokens",
+    "max_tokens",
+    "min_tokens",
+    "ls_max_tokens",
+    "token_count",
+    "token_limit",
+    "token_budget",
+    "input_tokens",
+    "output_tokens",
+    "total_tokens",
+    "cached_tokens",
+    "prompt_tokens",
+    "completion_tokens"
+  ].map(normalizeSensitiveKey)
+);
+var DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
+  "authorization",
+  "cookie",
+  "token",
+  "access_token",
+  "accesstoken",
+  "auth_token",
+  "authtoken",
+  "refresh_token",
+  "refreshtoken",
+  "id_token",
+  "idtoken",
+  "bearer_token",
+  "bearertoken",
+  "api_token",
+  "apitoken",
+  "apikey",
+  "api_key",
+  "password",
+  "secret",
+  "email"
+];
+function isTokenCredentialKey(normalized) {
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  if (normalized === "token") return true;
+  if (normalized.endsWith("tokens")) return false;
+  return normalized.endsWith("token");
+}
+function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
+  if (!key) return false;
+  const normalized = normalizeSensitiveKey(key);
+  if (!normalized) return false;
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  for (const sensitive of sensitiveKeys) {
+    const s = normalizeSensitiveKey(sensitive);
+    if (!s) continue;
+    if (s === "token") {
+      if (isTokenCredentialKey(normalized)) return true;
+      continue;
+    }
+    if (normalized === s) return true;
+    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+  }
+  return false;
+}
+
 // packages/core/src/checks/logical-events.ts
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -259,6 +326,23 @@ function projectLogicalEvents(events) {
       }
     }
     if (!remapped) {
+      if (originalParentId === event.eventId) {
+        diagnostics.push({
+          code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+          message: `Removed self-parent edge on ${event.eventId}.`,
+          eventIds: [event.eventId]
+        });
+        const { parentId: _drop, ...rest } = event;
+        normalized.push({
+          ...rest,
+          projection: {
+            ...event.projection,
+            parentNormalized: true,
+            originalParentId
+          }
+        });
+        continue;
+      }
       if (!logicalById.has(originalParentId) && !logicalByRawId.has(originalParentId)) {
         const mapping = event.attributes?.parentMapping;
         const unresolved = mapping === "unresolved" || event.attributes?.parentUnresolved === true || event.attributes?.unresolvedParent === true || // LangGraph/framework scaffolding sentinel labels are not event ids.
@@ -274,6 +358,23 @@ function projectLogicalEvents(events) {
       normalized.push(event);
       continue;
     }
+    if (nextParent === event.eventId) {
+      diagnostics.push({
+        code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+        message: `Removed self-parent edge on ${event.eventId} (was ${originalParentId}).`,
+        eventIds: [event.eventId]
+      });
+      const { parentId: _drop, ...rest } = event;
+      normalized.push({
+        ...rest,
+        projection: {
+          ...event.projection,
+          parentNormalized: true,
+          originalParentId
+        }
+      });
+      continue;
+    }
     diagnostics.push({
       code: "AI_LOGICAL_PARENT_REMAPPED",
       message: `Remapped parent ${originalParentId} \u2192 ${nextParent} for ${event.eventId}.`,
@@ -569,16 +670,7 @@ var CONFIDENCE_RANK = {
   correlated: 2,
   explicit: 3
 };
-var DEFAULT_SENSITIVE_KEYS = [
-  "authorization",
-  "cookie",
-  "token",
-  "apikey",
-  "api_key",
-  "password",
-  "secret",
-  "email"
-];
+var DEFAULT_SENSITIVE_KEYS = DEFAULT_CREDENTIAL_SENSITIVE_KEYS;
 var DEFAULT_RAW_CONTENT_KEYS = [
   "body",
   "headers",
@@ -1011,9 +1103,7 @@ function hasRedactionMarker(value, markers) {
   return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
 }
 function isSensitiveKey(key, sensitiveKeys) {
-  if (!key) return false;
-  const normalized = normalizedKey(key);
-  return sensitiveKeys.some((sensitive) => normalized.includes(normalizedKey(sensitive)));
+  return isCredentialSensitiveKey(key, sensitiveKeys);
 }
 function isRawContentKey(key, forbiddenKeys) {
   if (!key) return false;
@@ -1372,7 +1462,7 @@ function createToolUsageRule(options) {
         }
       }
       const forbidden = new Set(options.forbidden ?? []);
-      const allowed = options.allowed ? new Set(options.allowed) : void 0;
+      const allowed = options.allowed?.length ? new Set(options.allowed) : void 0;
       for (const event of tools) {
         const name = toolName(event);
         if (forbidden.has(name)) {
@@ -1472,9 +1562,9 @@ function createLlmUsageRule(options) {
     evaluate(context) {
       const llms = finishedEvents(context, "LLM");
       const findings = [];
-      const allowedModels = options.allowedModels ? new Set(options.allowedModels) : void 0;
-      const allowedProviders = options.allowedProviders ? new Set(options.allowedProviders) : void 0;
-      const finishReasons = options.finishReasons ? new Set(options.finishReasons) : void 0;
+      const allowedModels = options.allowedModels?.length ? new Set(options.allowedModels) : void 0;
+      const allowedProviders = options.allowedProviders?.length ? new Set(options.allowedProviders) : void 0;
+      const finishReasons = options.finishReasons?.length ? new Set(options.finishReasons) : void 0;
       if (options.maxCalls !== void 0 && llms.length > options.maxCalls) {
         findings.push(
           failFinding(
@@ -1815,7 +1905,7 @@ function createSignalRule(ruleId, label, options, selectEvents, nameForEvent) {
         }
       }
       const forbidden = new Set(options.forbidden ?? []);
-      const allowed = options.allowed ? new Set(options.allowed) : void 0;
+      const allowed = options.allowed?.length ? new Set(options.allowed) : void 0;
       for (const event of events) {
         const name = nameForEvent(event);
         if (forbidden.has(name)) {