agent-inspect 6.17.3 → 6.17.5

package/packages/cli/dist/index.cjs

@@ -3565,14 +3565,15 @@ var init_cohort = __esm({
 
 // packages/core/src/sessions/checks.ts
 function emptySummary() {
-  return { passed: 0, failed: 0, warnings: 0, errors: 0 };
+  return { passed: 0, failed: 0, warnings: 0, errors: 0, rulesEvaluated: 0 };
 }
 function mergeSummary(target, source) {
   return {
     passed: target.passed + source.passed,
     failed: target.failed + source.failed,
     warnings: target.warnings + source.warnings,
-    errors: target.errors + source.errors
+    errors: target.errors + source.errors,
+    rulesEvaluated: target.rulesEvaluated + source.rulesEvaluated
   };
 }
 function sessionDiagnostic(code, message) {
@@ -3596,6 +3597,7 @@ function aggregateSessionCheckResults(perRun, scope) {
           `${scope.scopeKind} not found: ${scope.scopeLabel}`
         )
       ],
+      ruleExecutions: [],
       ...scope.sessionWarnings?.length ? { sessionWarnings: [...scope.sessionWarnings] } : {}
     };
   }
@@ -3616,17 +3618,20 @@ function aggregateSessionCheckResults(perRun, scope) {
           `No readable traces in ${scope.scopeKind}: ${scope.scopeLabel}`
         )
       ],
+      ruleExecutions: [],
       ...scope.sessionWarnings?.length ? { sessionWarnings: [...scope.sessionWarnings] } : {}
     };
   }
   let summary = emptySummary();
   const findings = [];
   const diagnostics = [];
+  const ruleExecutions = [];
   const runResults = [];
   for (const result of perRun) {
     summary = mergeSummary(summary, result.summary);
     findings.push(...result.findings);
     diagnostics.push(...result.diagnostics);
+    ruleExecutions.push(...result.ruleExecutions ?? []);
     if (result.runId) {
       runResults.push({ runId: result.runId, status: result.status });
     }
@@ -3639,6 +3644,11 @@ function aggregateSessionCheckResults(perRun, scope) {
     if (runCmp !== 0) return runCmp;
     return a.ruleId.localeCompare(b.ruleId);
   });
+  ruleExecutions.sort((a, b) => {
+    const runCmp = (a.runId ?? "").localeCompare(b.runId ?? "");
+    if (runCmp !== 0) return runCmp;
+    return a.ruleId.localeCompare(b.ruleId);
+  });
   const hasErrors = diagnostics.some((item) => item.severity === "error");
   const status = hasErrors ? "error" : summary.failed > 0 ? "fail" : "pass";
   return {
@@ -3652,6 +3662,7 @@ function aggregateSessionCheckResults(perRun, scope) {
     summary,
     findings,
     diagnostics,
+    ruleExecutions,
     ...scope.sessionWarnings?.length ? { sessionWarnings: [...scope.sessionWarnings] } : {}
   };
 }
@@ -6419,8 +6430,11 @@ var init_programmatic = __esm({
 });
 
 // packages/core/src/safety/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 function isTokenCredentialKey(normalized) {
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
@@ -6433,6 +6447,7 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
   const normalized = normalizeSensitiveKey(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey(sensitive);
     if (!s) continue;
@@ -6441,7 +6456,8 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }
@@ -6852,10 +6868,11 @@ function emptySummary2() {
     passed: 0,
     failed: 0,
     warnings: 0,
-    errors: 0
+    errors: 0,
+    rulesEvaluated: 0
   };
 }
-function errorResult(input3, diagnostics, selectedRun) {
+function errorResult(input3, diagnostics, selectedRun, ruleExecutions = []) {
   return {
     ok: false,
     status: "error",
@@ -6863,10 +6880,12 @@ function errorResult(input3, diagnostics, selectedRun) {
     ...selectedRun ? { runId: selectedRun.runId } : {},
     summary: {
       ...emptySummary2(),
-      errors: diagnostics.filter((item) => item.severity === "error").length
+      errors: diagnostics.filter((item) => item.severity === "error").length,
+      rulesEvaluated: ruleExecutions.length
     },
     findings: [],
-    diagnostics: [...diagnostics]
+    diagnostics: [...diagnostics],
+    ruleExecutions: [...ruleExecutions]
   };
 }
 function flattenNodes(nodes) {
@@ -7022,7 +7041,7 @@ function normalizeFinding(rule, finding) {
     ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
-function summarize(findings, diagnostics) {
+function summarize(findings, diagnostics, rulesEvaluated) {
   return {
     passed: findings.filter((finding) => finding.status === "pass").length,
     failed: findings.filter(
@@ -7031,9 +7050,21 @@ function summarize(findings, diagnostics) {
     warnings: findings.filter(
       (finding) => finding.status === "warning" || finding.severity === "warning"
     ).length,
-    errors: diagnostics.filter((item) => item.severity === "error").length
+    errors: diagnostics.filter((item) => item.severity === "error").length,
+    rulesEvaluated
   };
 }
+function classifyRuleExecution(findings, threw) {
+  if (findings.some((finding) => finding.status === "fail" && finding.severity === "error")) {
+    return "fail";
+  }
+  if (findings.some(
+    (finding) => finding.status === "warning" || finding.severity === "warning"
+  )) {
+    return "warning";
+  }
+  return "pass";
+}
 function stringAttr(event, keys) {
   for (const key of keys) {
     const value = event.attributes?.[key];
@@ -7130,6 +7161,9 @@ function finishedEvents(context, kind) {
     (event) => (kind === void 0 || event.kind === kind) && event.status !== "running"
   );
 }
+function toolInvocationEvents(context) {
+  return semanticEvents(context).filter((event) => event.kind === "TOOL");
+}
 function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -7530,7 +7564,7 @@ function createToolUsageRule(options) {
     category: "tool",
     defaultSeverity: "error",
     evaluate(context) {
-      const tools = finishedEvents(context, "TOOL");
+      const tools = toolInvocationEvents(context);
       const names = tools.map(toolName);
       const nameSet = new Set(names);
       const findings = [];
@@ -8180,12 +8214,24 @@ function createBaselineRegressionRule(options) {
 }
 function createObservedOutcomeRule(options = {}) {
   const failOn = options.failOn ?? ["failed"];
+  const requireAny = options.requireAny === true;
   return {
     id: "outcome.status",
     category: "run",
     defaultSeverity: "error",
     evaluate(context) {
       const outcomes = extractOutcomesFromPersistedEvents(context.events);
+      if (requireAny && outcomes.length === 0) {
+        return [
+          failFinding(
+            "outcome.status",
+            "Expected at least one observed outcome.",
+            runEvidence(context.selectedRun),
+            { requireAny: true, expected: "at least one observed outcome" },
+            { code: "outcome.missing", actual: 0 }
+          )
+        ];
+      }
       const matching = outcomesMatchingStatus(outcomes, failOn);
       if (matching.length === 0) return [];
       return [
@@ -8221,6 +8267,18 @@ function runTraceChecks(input3, options = {}) {
   if (rules.diagnostics.length > 0) {
     return errorResult(input3, rules.diagnostics, selected.run);
   }
+  if (rules.rules.length === 0) {
+    return errorResult(
+      input3,
+      [
+        diagnostic3(
+          "AI_CHECK_NO_RULES_EVALUATED",
+          "No trace check rules were evaluated. Configure at least one rule, contract, or CLI check option."
+        )
+      ],
+      selected.run
+    );
+  }
   const facts = buildFacts2(input3, selected.run);
   const context = {
     ...facts,
@@ -8229,22 +8287,38 @@ function runTraceChecks(input3, options = {}) {
   };
   const diagnostics = [];
   const findings = [];
+  const ruleExecutions = [];
   for (const rule of rules.rules) {
     try {
-      findings.push(...rule.evaluate(context).map((finding) => normalizeFinding(rule, finding)));
+      const ruleFindings = rule.evaluate(context).map((finding) => normalizeFinding(rule, finding));
+      findings.push(...ruleFindings);
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: classifyRuleExecution(ruleFindings, false),
+        findingCount: ruleFindings.length,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
         diagnostic3("AI_CHECK_INTERNAL_ERROR", `Rule ${rule.id} failed: ${message}`, rule.id)
       );
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: "error",
+        findingCount: 0,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     }
   }
   if (diagnostics.length > 0) {
-    return errorResult(input3, diagnostics, selected.run);
+    return errorResult(input3, diagnostics, selected.run, ruleExecutions);
   }
   const eventById = new Map(input3.read.events.map((event) => [event.eventId, event]));
   const sortedFindings = findings.sort(compareFindings(eventById));
-  const summary = summarize(sortedFindings, diagnostics);
+  const summary = summarize(sortedFindings, diagnostics, ruleExecutions.length);
   const status = summary.failed > 0 ? "fail" : "pass";
   return {
     ok: status === "pass",
@@ -8253,7 +8327,8 @@ function runTraceChecks(input3, options = {}) {
     ...selected.run ? { runId: selected.run.runId } : {},
     summary,
     findings: sortedFindings,
-    diagnostics
+    diagnostics,
+    ruleExecutions
   };
 }
 var SEVERITY_RANK, STATUS_RANK, CONFIDENCE_RANK, DEFAULT_SENSITIVE_KEYS, DEFAULT_RAW_CONTENT_KEYS, DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES, SAFE_USAGE_LEAF_KEYS, DEFAULT_SECRET_PATTERNS;
@@ -10702,8 +10777,7 @@ async function runSuiteCase(suiteCase, config, options) {
     status: "pass",
     format: read.format,
     findings: [],
-    diagnostics: []
-  };
+    diagnostics: []};
   const observationResult = validateExpectedObservations(suiteCase, read);
   const diagnostics = [
     ...checkResult.diagnostics.map(
@@ -12506,7 +12580,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.17.3";
+var version = "6.17.5";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -14075,6 +14149,11 @@ async function followFile(filePath, options, onLine, shouldStop) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new Error(`Failed to stat file: ${filePath} (${msg})`);
     }
+    if (next.size < pos) {
+      pos = 0;
+      carry = "";
+      lineNumber = 0;
+    }
     if (next.size > pos) {
       const fh = await promises.open(filePath, "r");
       try {
@@ -16399,8 +16478,11 @@ async function reportCommand(runId, options = {}) {
 init_advanced();
 
 // packages/redact/src/sensitive-key.ts
+function keyHasExplicitSeparator2(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey2(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 var NON_CREDENTIAL_TOKEN_CONFIG_KEYS2 = new Set(
   [
@@ -16430,6 +16512,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
   const normalized = normalizeSensitiveKey2(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS2.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator2(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey2(sensitive);
     if (!s) continue;
@@ -16438,7 +16521,8 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }
@@ -17734,8 +17818,11 @@ function checkResultToEvidenceJson(result, runIds) {
       status,
       errors: result.summary.errors,
       warnings: result.summary.warnings,
-      findings: result.findings.length
+      findings: result.findings.length,
+      rulesEvaluated: result.summary.rulesEvaluated ?? 0
     })),
+    rulesEvaluated: result.summary.rulesEvaluated ?? 0,
+    evaluatedRuleIds: (result.ruleExecutions ?? []).map((item) => item.ruleId),
     findings: result.findings,
     diagnostics: result.diagnostics
   });
@@ -18360,9 +18447,11 @@ function mergeSafetyExtensions(result, read, options) {
       passed,
       failed,
       warnings,
-      errors: result.summary.errors
+      errors: result.summary.errors,
+      rulesEvaluated: result.summary.rulesEvaluated ?? 0
     },
-    findings
+    findings,
+    ruleExecutions: result.ruleExecutions ?? []
   };
 }
 
@@ -18482,10 +18571,12 @@ function errorResult2(code, message, format = "unknown") {
       passed: 0,
       failed: 0,
       warnings: 0,
-      errors: 1
+      errors: 1,
+      rulesEvaluated: 0
     },
     findings: [],
-    diagnostics
+    diagnostics,
+    ruleExecutions: []
   };
 }
 function parseNumber(value, label) {
@@ -18503,36 +18594,329 @@ function asStringArray2(value) {
   }
   return value;
 }
-function asConfig(value) {
+var CHECKS_KEYS = /* @__PURE__ */ new Set(["select", "run", "tool", "llm", "structure", "safety"]);
+var RUN_KEYS = /* @__PURE__ */ new Set(["expected", "allowIncomplete", "maxDurationMs", "maxDepth"]);
+var TOOL_KEYS = /* @__PURE__ */ new Set(["required", "forbidden", "allowed", "minCount", "maxCount"]);
+var LLM_KEYS = /* @__PURE__ */ new Set([
+  "allowedModels",
+  "allowedProviders",
+  "finishReasons",
+  "maxCalls",
+  "maxTotalTokens",
+  "maxInputTokens",
+  "maxOutputTokens",
+  "maxCachedTokens"
+]);
+var STRUCTURE_KEYS = /* @__PURE__ */ new Set([
+  "minConfidence",
+  "requireParentBeforeChild",
+  "requireTraceParentSpan",
+  "orphan",
+  "cycle",
+  "maxChildren",
+  "maxConcurrent"
+]);
+var SAFETY_KEYS = /* @__PURE__ */ new Set([
+  "redaction",
+  "rawContent",
+  "secretPattern",
+  "maxStringLength",
+  "maxArrayLength",
+  "maxObjectKeys",
+  "maxSerializedBytes",
+  "maxFindings"
+]);
+var RUN_EXPECTED = /* @__PURE__ */ new Set(["ok", "error", "running"]);
+var CONFIDENCE_VALUES = /* @__PURE__ */ new Set(["exact", "high", "medium", "low", "inferred"]);
+var CheckConfigError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "CheckConfigError";
+    this.code = code;
+  }
+};
+function closestKey(unknown, known) {
+  const lower = unknown.toLowerCase();
+  let best;
+  let bestDistance = Number.POSITIVE_INFINITY;
+  for (const candidate of known) {
+    if (candidate.toLowerCase() === lower) return candidate;
+    let distance = Math.abs(candidate.length - unknown.length);
+    const max = Math.max(candidate.length, unknown.length);
+    for (let i = 0; i < Math.min(candidate.length, unknown.length); i += 1) {
+      if (candidate[i].toLowerCase() !== unknown[i].toLowerCase()) distance += 1;
+    }
+    if (distance < bestDistance && distance <= Math.max(2, Math.floor(max / 3))) {
+      bestDistance = distance;
+      best = candidate;
+    }
+  }
+  return best;
+}
+function rejectUnknownKeys(record, allowed, pathPrefix) {
+  for (const key of Object.keys(record)) {
+    if (allowed.has(key)) continue;
+    const suggestion = closestKey(key, [...allowed]);
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      `Unknown check config key "${pathPrefix}.${key}".${hint}`
+    );
+  }
+}
+function requireObject(value, pathPrefix) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be an object.`
+    );
+  }
+  return value;
+}
+function requireStringArray(value, pathPrefix) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.trim() === "")) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be an array of non-empty strings.`
+    );
+  }
+  return value;
+}
+function requireNonNegativeNumber(value, pathPrefix) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be a finite non-negative number.`
+    );
+  }
+  return value;
+}
+function requireBoolean(value, pathPrefix) {
+  if (typeof value !== "boolean") {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be a boolean.`
+    );
+  }
+  return value;
+}
+function parseRunSection(value) {
+  const record = requireObject(value, "checks.run");
+  rejectUnknownKeys(record, RUN_KEYS, "checks.run");
+  const out = {};
+  if (record.expected !== void 0) {
+    if (typeof record.expected !== "string" || !RUN_EXPECTED.has(record.expected)) {
+      throw new CheckConfigError(
+        "AI_CHECK_CONFIG_INVALID_VALUE",
+        `checks.run.expected must be one of: ok, error, running.`
+      );
+    }
+    out.expected = record.expected;
+  }
+  if (record.allowIncomplete !== void 0) {
+    out.allowIncomplete = requireBoolean(record.allowIncomplete, "checks.run.allowIncomplete");
+  }
+  if (record.maxDurationMs !== void 0) {
+    out.maxDurationMs = requireNonNegativeNumber(record.maxDurationMs, "checks.run.maxDurationMs");
+  }
+  if (record.maxDepth !== void 0) {
+    out.maxDepth = requireNonNegativeNumber(record.maxDepth, "checks.run.maxDepth");
+  }
+  return out;
+}
+function parseToolSection(value) {
+  const record = requireObject(value, "checks.tool");
+  rejectUnknownKeys(record, TOOL_KEYS, "checks.tool");
+  const out = {};
+  if (record.required !== void 0) out.required = requireStringArray(record.required, "checks.tool.required");
+  if (record.forbidden !== void 0) out.forbidden = requireStringArray(record.forbidden, "checks.tool.forbidden");
+  if (record.allowed !== void 0) out.allowed = requireStringArray(record.allowed, "checks.tool.allowed");
+  if (record.minCount !== void 0) out.minCount = requireNonNegativeNumber(record.minCount, "checks.tool.minCount");
+  if (record.maxCount !== void 0) out.maxCount = requireNonNegativeNumber(record.maxCount, "checks.tool.maxCount");
+  return out;
+}
+function parseLlmSection(value) {
+  const record = requireObject(value, "checks.llm");
+  rejectUnknownKeys(record, LLM_KEYS, "checks.llm");
+  const out = {};
+  if (record.allowedModels !== void 0) {
+    out.allowedModels = requireStringArray(record.allowedModels, "checks.llm.allowedModels");
+  }
+  if (record.allowedProviders !== void 0) {
+    out.allowedProviders = requireStringArray(record.allowedProviders, "checks.llm.allowedProviders");
+  }
+  if (record.finishReasons !== void 0) {
+    out.finishReasons = requireStringArray(record.finishReasons, "checks.llm.finishReasons");
+  }
+  if (record.maxCalls !== void 0) out.maxCalls = requireNonNegativeNumber(record.maxCalls, "checks.llm.maxCalls");
+  if (record.maxTotalTokens !== void 0) {
+    out.maxTotalTokens = requireNonNegativeNumber(record.maxTotalTokens, "checks.llm.maxTotalTokens");
+  }
+  if (record.maxInputTokens !== void 0) {
+    out.maxInputTokens = requireNonNegativeNumber(record.maxInputTokens, "checks.llm.maxInputTokens");
+  }
+  if (record.maxOutputTokens !== void 0) {
+    out.maxOutputTokens = requireNonNegativeNumber(record.maxOutputTokens, "checks.llm.maxOutputTokens");
+  }
+  if (record.maxCachedTokens !== void 0) {
+    out.maxCachedTokens = requireNonNegativeNumber(record.maxCachedTokens, "checks.llm.maxCachedTokens");
+  }
+  return out;
+}
+function parseStructureSection(value) {
+  const record = requireObject(value, "checks.structure");
+  rejectUnknownKeys(record, STRUCTURE_KEYS, "checks.structure");
+  const out = {};
+  if (record.minConfidence !== void 0) {
+    if (typeof record.minConfidence !== "string" || !CONFIDENCE_VALUES.has(record.minConfidence)) {
+      throw new CheckConfigError(
+        "AI_CHECK_CONFIG_INVALID_VALUE",
+        `checks.structure.minConfidence must be one of: exact, high, medium, low, inferred.`
+      );
+    }
+    out.minConfidence = record.minConfidence;
+  }
+  if (record.requireParentBeforeChild !== void 0) {
+    out.requireParentBeforeChild = requireBoolean(
+      record.requireParentBeforeChild,
+      "checks.structure.requireParentBeforeChild"
+    );
+  }
+  if (record.requireTraceParentSpan !== void 0) {
+    out.requireTraceParentSpan = requireBoolean(
+      record.requireTraceParentSpan,
+      "checks.structure.requireTraceParentSpan"
+    );
+  }
+  if (record.orphan !== void 0) out.orphan = requireBoolean(record.orphan, "checks.structure.orphan");
+  if (record.cycle !== void 0) out.cycle = requireBoolean(record.cycle, "checks.structure.cycle");
+  if (record.maxChildren !== void 0) {
+    out.maxChildren = requireNonNegativeNumber(record.maxChildren, "checks.structure.maxChildren");
+  }
+  if (record.maxConcurrent !== void 0) {
+    out.maxConcurrent = requireNonNegativeNumber(record.maxConcurrent, "checks.structure.maxConcurrent");
+  }
+  return out;
+}
+function parseSafetySection(value) {
+  const record = requireObject(value, "checks.safety");
+  rejectUnknownKeys(record, SAFETY_KEYS, "checks.safety");
+  const out = {};
+  if (record.redaction !== void 0) out.redaction = requireBoolean(record.redaction, "checks.safety.redaction");
+  if (record.rawContent !== void 0) out.rawContent = requireBoolean(record.rawContent, "checks.safety.rawContent");
+  if (record.secretPattern !== void 0) {
+    out.secretPattern = requireBoolean(record.secretPattern, "checks.safety.secretPattern");
+  }
+  if (record.maxStringLength !== void 0) {
+    out.maxStringLength = requireNonNegativeNumber(record.maxStringLength, "checks.safety.maxStringLength");
+  }
+  if (record.maxArrayLength !== void 0) {
+    out.maxArrayLength = requireNonNegativeNumber(record.maxArrayLength, "checks.safety.maxArrayLength");
+  }
+  if (record.maxObjectKeys !== void 0) {
+    out.maxObjectKeys = requireNonNegativeNumber(record.maxObjectKeys, "checks.safety.maxObjectKeys");
+  }
+  if (record.maxSerializedBytes !== void 0) {
+    out.maxSerializedBytes = requireNonNegativeNumber(
+      record.maxSerializedBytes,
+      "checks.safety.maxSerializedBytes"
+    );
+  }
+  if (record.maxFindings !== void 0) {
+    out.maxFindings = requireNonNegativeNumber(record.maxFindings, "checks.safety.maxFindings");
+  }
+  return out;
+}
+function sectionHasEffect(section) {
+  if (section === void 0) return false;
+  return Object.keys(section).length > 0;
+}
+function checkConfigHasEffect(config) {
+  const checks2 = config.checks;
+  if (checks2 === void 0) return false;
+  if ((checks2.select?.length ?? 0) > 0) return true;
+  if (sectionHasEffect(checks2.run)) return true;
+  if (sectionHasEffect(checks2.tool)) return true;
+  if (sectionHasEffect(checks2.llm)) return true;
+  if (sectionHasEffect(checks2.structure)) return true;
+  if (sectionHasEffect(checks2.safety)) return true;
+  return false;
+}
+function parseCheckConfig(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("Config must export an object.");
+    throw new CheckConfigError("AI_CHECK_CONFIG_INVALID_VALUE", "Config must export an object.");
   }
-  return value;
+  const root = value;
+  if ("contract" in root) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      'Top-level "contract" is not supported by `agent-inspect check --config`. Use the TraceContract TypeScript API (`defineTraceContract` / `evaluateTraceContract` from `agent-inspect/checks`), or express tool/run/llm rules under `checks`.'
+    );
+  }
+  const rootKeys = Object.keys(root);
+  for (const key of rootKeys) {
+    if (key === "checks") continue;
+    const suggestion = closestKey(key, ["checks"]);
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      `Unknown top-level check config key "${key}". Allowed: checks.${hint}`
+    );
+  }
+  if (!("checks" in root)) return {};
+  const checksRecord = requireObject(root.checks, "checks");
+  rejectUnknownKeys(checksRecord, CHECKS_KEYS, "checks");
+  const checks2 = {};
+  if (checksRecord.select !== void 0) {
+    checks2.select = requireStringArray(checksRecord.select, "checks.select");
+  }
+  if (checksRecord.run !== void 0) checks2.run = parseRunSection(checksRecord.run);
+  if (checksRecord.tool !== void 0) checks2.tool = parseToolSection(checksRecord.tool);
+  if (checksRecord.llm !== void 0) checks2.llm = parseLlmSection(checksRecord.llm);
+  if (checksRecord.structure !== void 0) {
+    checks2.structure = parseStructureSection(checksRecord.structure);
+  }
+  if (checksRecord.safety !== void 0) checks2.safety = parseSafetySection(checksRecord.safety);
+  return { checks: checks2 };
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
   const extension = path32__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
-    throw new Error(
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
     );
   }
   if (!CONFIG_EXTENSIONS2.has(extension)) {
-    throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
+      "Unsupported check config extension. Use .json, .js, .mjs, or .cjs."
+    );
   }
   const absolute = path32__default.default.resolve(configPath);
-  if (extension === ".json") {
-    const raw = await promises.readFile(absolute, "utf-8");
-    return asConfig(JSON.parse(raw));
+  try {
+    if (extension === ".json") {
+      const raw = await promises.readFile(absolute, "utf-8");
+      return parseCheckConfig(JSON.parse(raw));
+    }
+    const mod = await import(url.pathToFileURL(absolute).href);
+    return parseCheckConfig("default" in mod ? mod.default : mod);
+  } catch (error) {
+    if (error instanceof CheckConfigError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
+      `Failed to load check config: ${message}`
+    );
   }
-  const mod = await import(url.pathToFileURL(absolute).href);
-  return asConfig("default" in mod ? mod.default : mod);
 }
 function normalizeConfig(config) {
   if (config.checks === void 0) return {};
   if (typeof config.checks !== "object" || Array.isArray(config.checks)) {
-    throw new Error("checks config must be an object.");
+    throw new CheckConfigError("AI_CHECK_CONFIG_INVALID_VALUE", "checks config must be an object.");
   }
   return config.checks;
 }
@@ -18610,7 +18994,7 @@ function buildRules(config, options, presetSelect = []) {
         }
         throw new Error(`unsupported status "${value}"`);
       });
-      rules.push(createObservedOutcomeRule({ failOn: statuses }));
+      rules.push(createObservedOutcomeRule({ failOn: statuses, requireAny: true }));
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
@@ -18682,7 +19066,7 @@ function exitCodeFor(result) {
     return 3;
   }
   if (codes.some(
-    (code) => code === "AI_CHECK_INVALID_ARGUMENTS" || code === "AI_CHECK_INVALID_CONFIG" || code === "AI_CHECK_CONFIG_LOAD_FAILED" || code === "AI_CHECK_RUN_SELECTION_REQUIRED"
+    (code) => code === "AI_CHECK_INVALID_ARGUMENTS" || code === "AI_CHECK_INVALID_CONFIG" || code === "AI_CHECK_CONFIG_LOAD_FAILED" || code === "AI_CHECK_CONFIG_UNKNOWN_KEY" || code === "AI_CHECK_CONFIG_INVALID_VALUE" || code === "AI_CHECK_CONFIG_NO_EFFECTIVE_RULES" || code === "AI_CHECK_NO_RULES_EVALUATED" || code === "AI_CHECK_RUN_SELECTION_REQUIRED"
   )) {
     return 2;
   }
@@ -18749,6 +19133,7 @@ function printHuman(result, options = {}) {
   console.log(
     `Summary: ${result.summary.failed} failed, ${result.summary.warnings} warning(s), ${result.summary.errors} error(s)`
   );
+  console.log(`Rules evaluated: ${result.summary.rulesEvaluated ?? result.ruleExecutions?.length ?? 0}`);
   for (const diagnostic7 of result.diagnostics) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
@@ -18780,6 +19165,16 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
   const useSessionScope = Boolean(sessionId || groupId);
   try {
     let config = await loadConfig(options.config);
+    if (options.config !== void 0 && !checkConfigHasEffect(config)) {
+      result = errorResult2(
+        "AI_CHECK_CONFIG_NO_EFFECTIVE_RULES",
+        "Explicit --config has no effective check rules. Configure checks.select, checks.run, checks.tool, checks.llm, checks.structure, or checks.safety."
+      );
+      if (options.json) printJson(result);
+      else printHuman(result, options);
+      process.exitCode = exitCodeFor(result);
+      return;
+    }
     let effectiveOptions = options;
     const resolved = resolvePreset(options.preset, {
       hasToolRules: hasToolRulesConfigured(config, options)
@@ -18899,12 +19294,13 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
     }
   } catch (error) {
     if (phase === "config") {
-      const message = error instanceof Error ? error.message : String(error);
-      const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
-      result = errorResult2(
-        code,
-        message
-      );
+      if (error instanceof CheckConfigError) {
+        result = errorResult2(error.code, error.message);
+      } else {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
+        result = errorResult2(code, message);
+      }
     } else {
       result = readErrorResult(error);
     }
@@ -19835,6 +20231,42 @@ function startViewerServer(options = {}) {
     });
   });
 }
+function openInDefaultBrowser(target) {
+  const platform = process.platform;
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", target] : [target];
+  return new Promise((resolve) => {
+    try {
+      const child = child_process.spawn(command, args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: platform === "win32"
+      });
+      child.once("spawn", () => {
+        try {
+          child.unref();
+          resolve({ ok: true });
+        } catch (error) {
+          resolve({
+            ok: false,
+            detail: error instanceof Error ? error.message : String(error)
+          });
+        }
+      });
+      child.once("error", (error) => {
+        resolve({
+          ok: false,
+          detail: error instanceof Error ? error.message : String(error)
+        });
+      });
+    } catch (error) {
+      resolve({
+        ok: false,
+        detail: error instanceof Error ? error.message : String(error)
+      });
+    }
+  });
+}
 
 // packages/cli/src/serve.ts
 function parsePort(value) {
@@ -19864,9 +20296,11 @@ async function serveCommand(options = {}) {
   if (options.open === true && host !== "127.0.0.1" && host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
   } else if (options.open === true) {
-    const openMod = await import('child_process');
-    openMod.exec(`open ${info.url}`, () => {
-    });
+    const opened = await openInDefaultBrowser(info.url);
+    if (!opened.ok) {
+      console.warn("Viewer started, but the browser could not be opened automatically.");
+      console.warn(`Open manually: ${info.url}`);
+    }
   }
   await new Promise(() => {
   });
@@ -20025,9 +20459,11 @@ async function studioCommand(options = {}) {
   if (options.open === true && info.host !== "127.0.0.1" && info.host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
   } else if (options.open === true) {
-    const openMod = await import('child_process');
-    openMod.exec(`open ${info.url}`, () => {
-    });
+    const opened = await openInDefaultBrowser(info.url);
+    if (!opened.ok) {
+      console.warn("Studio started, but the browser could not be opened automatically.");
+      console.warn(`Open manually: ${info.url}`);
+    }
   }
   await new Promise(() => {
   });
@@ -20786,7 +21222,7 @@ function asStringArray3(value, label) {
   }
   return value;
 }
-function asConfig2(value) {
+function asConfig(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) {
     throw new Error("Config must export an object.");
@@ -20807,10 +21243,10 @@ async function loadConfig2(configPath) {
   const absolute = path32__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
-    return asConfig2(JSON.parse(raw));
+    return asConfig(JSON.parse(raw));
   }
   const mod = await import(url.pathToFileURL(absolute).href);
-  return asConfig2("default" in mod ? mod.default : mod);
+  return asConfig("default" in mod ? mod.default : mod);
 }
 function normalizeConfig2(config) {
   if (config.eval === void 0) return {};
@@ -22325,33 +22761,6 @@ async function resolveHtmlPath(root) {
     `No evidence.html found under ${root}. Pass a bundle directory or .html path.`
   );
 }
-function openLocalFile(filePath) {
-  const fileUrl = url.pathToFileURL(filePath).href;
-  const platform = process.platform;
-  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "darwin" ? [filePath] : platform === "win32" ? ["/c", "start", "", filePath] : [filePath];
-  return new Promise((resolve) => {
-    try {
-      const child = child_process.spawn(command, args, {
-        detached: true,
-        stdio: "ignore"
-      });
-      child.on("error", (error) => {
-        resolve({
-          ok: false,
-          detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
-        });
-      });
-      child.unref();
-      resolve({ ok: true, detail: fileUrl });
-    } catch (error) {
-      resolve({
-        ok: false,
-        detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
-      });
-    }
-  });
-}
 async function bundleOpenCommand(targetPath, options = {}) {
   const root = path32__default.default.resolve(targetPath.trim() || ".");
   try {
@@ -22421,23 +22830,24 @@ async function bundleOpenCommand(targetPath, options = {}) {
     await promises.readFile(path32__default.default.join(path32__default.default.dirname(htmlPath), "evidence.json"), "utf-8");
   } catch {
   }
-  const opened = await openLocalFile(htmlPath);
+  const fileUrl = url.pathToFileURL(htmlPath).href;
+  const opened = await openInDefaultBrowser(fileUrl);
   if (options.json) {
     console.log(
       writeJson6({
         ok: opened.ok,
         path: htmlPath,
         opened: opened.ok,
-        detail: opened.detail
+        detail: opened.ok ? fileUrl : `${opened.detail ?? "unknown error"}; open manually: ${fileUrl}`
       }).trimEnd()
     );
   } else if (opened.ok) {
     console.log(`Opened local Evidence: ${htmlPath}`);
-    console.log(`URL: ${opened.detail}`);
+    console.log(`URL: ${fileUrl}`);
   } else {
     console.error(`[AgentInspect] Could not open browser automatically.`);
     console.error(`Open this file locally: ${htmlPath}`);
-    console.error(opened.detail);
+    console.error(`${opened.detail ?? "unknown error"}; open manually: ${fileUrl}`);
   }
   if (!opened.ok) {
     process.exitCode = 0;
@@ -24378,9 +24788,15 @@ function normalizeMetrics2(raw) {
   const parsed = parseCohortMetricList(raw);
   if (parsed.length === 0) return void 0;
   const allowed = new Set(COHORT_METRIC_IDS);
-  return parsed.filter(
-    (item) => allowed.has(item)
-  );
+  const invalid = parsed.filter((metric) => !allowed.has(metric));
+  if (invalid.length > 0) {
+    const valueLabel = invalid.length === 1 ? "value" : "values";
+    const invalidList = invalid.map((metric) => `"${metric}"`).join(", ");
+    throw new Error(
+      `Unsupported cohort --metric ${valueLabel}: ${invalidList}. Valid metrics: ${COHORT_METRIC_IDS.join(", ")}.`
+    );
+  }
+  return parsed;
 }
 async function writeArtifacts(result, outputDir) {
   await promises.mkdir(outputDir, { recursive: true });
@@ -24401,6 +24817,7 @@ async function writeArtifacts(result, outputDir) {
 }
 async function cohortCommand(options = {}) {
   try {
+    const metrics = normalizeMetrics2(options.metric);
     const traceDir = resolveTraceDir({ dir: options.dir });
     const { runs } = await loadSessionRuns(traceDir);
     const result = await analyzeCohort(runs, {
@@ -24409,7 +24826,7 @@ async function cohortCommand(options = {}) {
       candidate: options.candidate,
       cohortKey: options.cohortKey,
       groupBy: options.groupBy,
-      metrics: normalizeMetrics2(options.metric)
+      metrics
     });
     const format = options.format ?? (options.json ? "json" : "markdown");
     let artifacts;