agent-inspect 6.17.3 → 6.17.5

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, truncateStringForProfile, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, diffRuns, manualTraceEventsToComparableRun } from './chunk-5GGYDIZD.mjs';
+import { createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, truncateStringForProfile, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, diffRuns, manualTraceEventsToComparableRun } from './chunk-GOHYSE7W.mjs';
 import { realpathSync, constants as constants$1, existsSync, readFileSync } from 'fs';
 import path18 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -12,7 +12,7 @@ import { spawn } from 'child_process';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.17.3";
+var version = "6.17.5";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -1540,6 +1540,11 @@ async function followFile(filePath, options, onLine, shouldStop) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new Error(`Failed to stat file: ${filePath} (${msg})`);
     }
+    if (next.size < pos) {
+      pos = 0;
+      carry = "";
+      lineNumber = 0;
+    }
     if (next.size > pos) {
       const fh = await open(filePath, "r");
       try {
@@ -3347,7 +3352,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-IDMCWKRH.mjs');
+    const mod = await import('./src-OYGG7QAZ.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -3820,8 +3825,11 @@ async function reportCommand(runId, options = {}) {
 }
 
 // packages/redact/src/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
   [
@@ -3851,6 +3859,7 @@ function isCredentialSensitiveKey(key, sensitiveKeys) {
   const normalized = normalizeSensitiveKey(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey(sensitive);
     if (!s) continue;
@@ -3859,7 +3868,8 @@ function isCredentialSensitiveKey(key, sensitiveKeys) {
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }
@@ -5138,8 +5148,11 @@ function checkResultToEvidenceJson(result, runIds) {
       status,
       errors: result.summary.errors,
       warnings: result.summary.warnings,
-      findings: result.findings.length
+      findings: result.findings.length,
+      rulesEvaluated: result.summary.rulesEvaluated ?? 0
     })),
+    rulesEvaluated: result.summary.rulesEvaluated ?? 0,
+    evaluatedRuleIds: (result.ruleExecutions ?? []).map((item) => item.ruleId),
     findings: result.findings,
     diagnostics: result.diagnostics
   });
@@ -5764,9 +5777,11 @@ function mergeSafetyExtensions(result, read, options) {
       passed,
       failed,
       warnings,
-      errors: result.summary.errors
+      errors: result.summary.errors,
+      rulesEvaluated: result.summary.rulesEvaluated ?? 0
     },
-    findings
+    findings,
+    ruleExecutions: result.ruleExecutions ?? []
   };
 }
 
@@ -5886,10 +5901,12 @@ function errorResult(code, message, format = "unknown") {
       passed: 0,
       failed: 0,
       warnings: 0,
-      errors: 1
+      errors: 1,
+      rulesEvaluated: 0
     },
     findings: [],
-    diagnostics
+    diagnostics,
+    ruleExecutions: []
   };
 }
 function parseNumber(value, label) {
@@ -5907,36 +5924,329 @@ function asStringArray(value) {
   }
   return value;
 }
-function asConfig(value) {
+var CHECKS_KEYS = /* @__PURE__ */ new Set(["select", "run", "tool", "llm", "structure", "safety"]);
+var RUN_KEYS = /* @__PURE__ */ new Set(["expected", "allowIncomplete", "maxDurationMs", "maxDepth"]);
+var TOOL_KEYS = /* @__PURE__ */ new Set(["required", "forbidden", "allowed", "minCount", "maxCount"]);
+var LLM_KEYS = /* @__PURE__ */ new Set([
+  "allowedModels",
+  "allowedProviders",
+  "finishReasons",
+  "maxCalls",
+  "maxTotalTokens",
+  "maxInputTokens",
+  "maxOutputTokens",
+  "maxCachedTokens"
+]);
+var STRUCTURE_KEYS = /* @__PURE__ */ new Set([
+  "minConfidence",
+  "requireParentBeforeChild",
+  "requireTraceParentSpan",
+  "orphan",
+  "cycle",
+  "maxChildren",
+  "maxConcurrent"
+]);
+var SAFETY_KEYS = /* @__PURE__ */ new Set([
+  "redaction",
+  "rawContent",
+  "secretPattern",
+  "maxStringLength",
+  "maxArrayLength",
+  "maxObjectKeys",
+  "maxSerializedBytes",
+  "maxFindings"
+]);
+var RUN_EXPECTED = /* @__PURE__ */ new Set(["ok", "error", "running"]);
+var CONFIDENCE_VALUES = /* @__PURE__ */ new Set(["exact", "high", "medium", "low", "inferred"]);
+var CheckConfigError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "CheckConfigError";
+    this.code = code;
+  }
+};
+function closestKey(unknown, known) {
+  const lower = unknown.toLowerCase();
+  let best;
+  let bestDistance = Number.POSITIVE_INFINITY;
+  for (const candidate of known) {
+    if (candidate.toLowerCase() === lower) return candidate;
+    let distance = Math.abs(candidate.length - unknown.length);
+    const max = Math.max(candidate.length, unknown.length);
+    for (let i = 0; i < Math.min(candidate.length, unknown.length); i += 1) {
+      if (candidate[i].toLowerCase() !== unknown[i].toLowerCase()) distance += 1;
+    }
+    if (distance < bestDistance && distance <= Math.max(2, Math.floor(max / 3))) {
+      bestDistance = distance;
+      best = candidate;
+    }
+  }
+  return best;
+}
+function rejectUnknownKeys(record, allowed, pathPrefix) {
+  for (const key of Object.keys(record)) {
+    if (allowed.has(key)) continue;
+    const suggestion = closestKey(key, [...allowed]);
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      `Unknown check config key "${pathPrefix}.${key}".${hint}`
+    );
+  }
+}
+function requireObject(value, pathPrefix) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be an object.`
+    );
+  }
+  return value;
+}
+function requireStringArray(value, pathPrefix) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.trim() === "")) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be an array of non-empty strings.`
+    );
+  }
+  return value;
+}
+function requireNonNegativeNumber(value, pathPrefix) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be a finite non-negative number.`
+    );
+  }
+  return value;
+}
+function requireBoolean(value, pathPrefix) {
+  if (typeof value !== "boolean") {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be a boolean.`
+    );
+  }
+  return value;
+}
+function parseRunSection(value) {
+  const record = requireObject(value, "checks.run");
+  rejectUnknownKeys(record, RUN_KEYS, "checks.run");
+  const out = {};
+  if (record.expected !== void 0) {
+    if (typeof record.expected !== "string" || !RUN_EXPECTED.has(record.expected)) {
+      throw new CheckConfigError(
+        "AI_CHECK_CONFIG_INVALID_VALUE",
+        `checks.run.expected must be one of: ok, error, running.`
+      );
+    }
+    out.expected = record.expected;
+  }
+  if (record.allowIncomplete !== void 0) {
+    out.allowIncomplete = requireBoolean(record.allowIncomplete, "checks.run.allowIncomplete");
+  }
+  if (record.maxDurationMs !== void 0) {
+    out.maxDurationMs = requireNonNegativeNumber(record.maxDurationMs, "checks.run.maxDurationMs");
+  }
+  if (record.maxDepth !== void 0) {
+    out.maxDepth = requireNonNegativeNumber(record.maxDepth, "checks.run.maxDepth");
+  }
+  return out;
+}
+function parseToolSection(value) {
+  const record = requireObject(value, "checks.tool");
+  rejectUnknownKeys(record, TOOL_KEYS, "checks.tool");
+  const out = {};
+  if (record.required !== void 0) out.required = requireStringArray(record.required, "checks.tool.required");
+  if (record.forbidden !== void 0) out.forbidden = requireStringArray(record.forbidden, "checks.tool.forbidden");
+  if (record.allowed !== void 0) out.allowed = requireStringArray(record.allowed, "checks.tool.allowed");
+  if (record.minCount !== void 0) out.minCount = requireNonNegativeNumber(record.minCount, "checks.tool.minCount");
+  if (record.maxCount !== void 0) out.maxCount = requireNonNegativeNumber(record.maxCount, "checks.tool.maxCount");
+  return out;
+}
+function parseLlmSection(value) {
+  const record = requireObject(value, "checks.llm");
+  rejectUnknownKeys(record, LLM_KEYS, "checks.llm");
+  const out = {};
+  if (record.allowedModels !== void 0) {
+    out.allowedModels = requireStringArray(record.allowedModels, "checks.llm.allowedModels");
+  }
+  if (record.allowedProviders !== void 0) {
+    out.allowedProviders = requireStringArray(record.allowedProviders, "checks.llm.allowedProviders");
+  }
+  if (record.finishReasons !== void 0) {
+    out.finishReasons = requireStringArray(record.finishReasons, "checks.llm.finishReasons");
+  }
+  if (record.maxCalls !== void 0) out.maxCalls = requireNonNegativeNumber(record.maxCalls, "checks.llm.maxCalls");
+  if (record.maxTotalTokens !== void 0) {
+    out.maxTotalTokens = requireNonNegativeNumber(record.maxTotalTokens, "checks.llm.maxTotalTokens");
+  }
+  if (record.maxInputTokens !== void 0) {
+    out.maxInputTokens = requireNonNegativeNumber(record.maxInputTokens, "checks.llm.maxInputTokens");
+  }
+  if (record.maxOutputTokens !== void 0) {
+    out.maxOutputTokens = requireNonNegativeNumber(record.maxOutputTokens, "checks.llm.maxOutputTokens");
+  }
+  if (record.maxCachedTokens !== void 0) {
+    out.maxCachedTokens = requireNonNegativeNumber(record.maxCachedTokens, "checks.llm.maxCachedTokens");
+  }
+  return out;
+}
+function parseStructureSection(value) {
+  const record = requireObject(value, "checks.structure");
+  rejectUnknownKeys(record, STRUCTURE_KEYS, "checks.structure");
+  const out = {};
+  if (record.minConfidence !== void 0) {
+    if (typeof record.minConfidence !== "string" || !CONFIDENCE_VALUES.has(record.minConfidence)) {
+      throw new CheckConfigError(
+        "AI_CHECK_CONFIG_INVALID_VALUE",
+        `checks.structure.minConfidence must be one of: exact, high, medium, low, inferred.`
+      );
+    }
+    out.minConfidence = record.minConfidence;
+  }
+  if (record.requireParentBeforeChild !== void 0) {
+    out.requireParentBeforeChild = requireBoolean(
+      record.requireParentBeforeChild,
+      "checks.structure.requireParentBeforeChild"
+    );
+  }
+  if (record.requireTraceParentSpan !== void 0) {
+    out.requireTraceParentSpan = requireBoolean(
+      record.requireTraceParentSpan,
+      "checks.structure.requireTraceParentSpan"
+    );
+  }
+  if (record.orphan !== void 0) out.orphan = requireBoolean(record.orphan, "checks.structure.orphan");
+  if (record.cycle !== void 0) out.cycle = requireBoolean(record.cycle, "checks.structure.cycle");
+  if (record.maxChildren !== void 0) {
+    out.maxChildren = requireNonNegativeNumber(record.maxChildren, "checks.structure.maxChildren");
+  }
+  if (record.maxConcurrent !== void 0) {
+    out.maxConcurrent = requireNonNegativeNumber(record.maxConcurrent, "checks.structure.maxConcurrent");
+  }
+  return out;
+}
+function parseSafetySection(value) {
+  const record = requireObject(value, "checks.safety");
+  rejectUnknownKeys(record, SAFETY_KEYS, "checks.safety");
+  const out = {};
+  if (record.redaction !== void 0) out.redaction = requireBoolean(record.redaction, "checks.safety.redaction");
+  if (record.rawContent !== void 0) out.rawContent = requireBoolean(record.rawContent, "checks.safety.rawContent");
+  if (record.secretPattern !== void 0) {
+    out.secretPattern = requireBoolean(record.secretPattern, "checks.safety.secretPattern");
+  }
+  if (record.maxStringLength !== void 0) {
+    out.maxStringLength = requireNonNegativeNumber(record.maxStringLength, "checks.safety.maxStringLength");
+  }
+  if (record.maxArrayLength !== void 0) {
+    out.maxArrayLength = requireNonNegativeNumber(record.maxArrayLength, "checks.safety.maxArrayLength");
+  }
+  if (record.maxObjectKeys !== void 0) {
+    out.maxObjectKeys = requireNonNegativeNumber(record.maxObjectKeys, "checks.safety.maxObjectKeys");
+  }
+  if (record.maxSerializedBytes !== void 0) {
+    out.maxSerializedBytes = requireNonNegativeNumber(
+      record.maxSerializedBytes,
+      "checks.safety.maxSerializedBytes"
+    );
+  }
+  if (record.maxFindings !== void 0) {
+    out.maxFindings = requireNonNegativeNumber(record.maxFindings, "checks.safety.maxFindings");
+  }
+  return out;
+}
+function sectionHasEffect(section) {
+  if (section === void 0) return false;
+  return Object.keys(section).length > 0;
+}
+function checkConfigHasEffect(config) {
+  const checks2 = config.checks;
+  if (checks2 === void 0) return false;
+  if ((checks2.select?.length ?? 0) > 0) return true;
+  if (sectionHasEffect(checks2.run)) return true;
+  if (sectionHasEffect(checks2.tool)) return true;
+  if (sectionHasEffect(checks2.llm)) return true;
+  if (sectionHasEffect(checks2.structure)) return true;
+  if (sectionHasEffect(checks2.safety)) return true;
+  return false;
+}
+function parseCheckConfig(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("Config must export an object.");
+    throw new CheckConfigError("AI_CHECK_CONFIG_INVALID_VALUE", "Config must export an object.");
   }
-  return value;
+  const root = value;
+  if ("contract" in root) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      'Top-level "contract" is not supported by `agent-inspect check --config`. Use the TraceContract TypeScript API (`defineTraceContract` / `evaluateTraceContract` from `agent-inspect/checks`), or express tool/run/llm rules under `checks`.'
+    );
+  }
+  const rootKeys = Object.keys(root);
+  for (const key of rootKeys) {
+    if (key === "checks") continue;
+    const suggestion = closestKey(key, ["checks"]);
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      `Unknown top-level check config key "${key}". Allowed: checks.${hint}`
+    );
+  }
+  if (!("checks" in root)) return {};
+  const checksRecord = requireObject(root.checks, "checks");
+  rejectUnknownKeys(checksRecord, CHECKS_KEYS, "checks");
+  const checks2 = {};
+  if (checksRecord.select !== void 0) {
+    checks2.select = requireStringArray(checksRecord.select, "checks.select");
+  }
+  if (checksRecord.run !== void 0) checks2.run = parseRunSection(checksRecord.run);
+  if (checksRecord.tool !== void 0) checks2.tool = parseToolSection(checksRecord.tool);
+  if (checksRecord.llm !== void 0) checks2.llm = parseLlmSection(checksRecord.llm);
+  if (checksRecord.structure !== void 0) {
+    checks2.structure = parseStructureSection(checksRecord.structure);
+  }
+  if (checksRecord.safety !== void 0) checks2.safety = parseSafetySection(checksRecord.safety);
+  return { checks: checks2 };
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
   const extension = path18.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
-    throw new Error(
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
     );
   }
   if (!CONFIG_EXTENSIONS.has(extension)) {
-    throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
+      "Unsupported check config extension. Use .json, .js, .mjs, or .cjs."
+    );
   }
   const absolute = path18.resolve(configPath);
-  if (extension === ".json") {
-    const raw = await readFile(absolute, "utf-8");
-    return asConfig(JSON.parse(raw));
+  try {
+    if (extension === ".json") {
+      const raw = await readFile(absolute, "utf-8");
+      return parseCheckConfig(JSON.parse(raw));
+    }
+    const mod = await import(pathToFileURL(absolute).href);
+    return parseCheckConfig("default" in mod ? mod.default : mod);
+  } catch (error) {
+    if (error instanceof CheckConfigError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
+      `Failed to load check config: ${message}`
+    );
   }
-  const mod = await import(pathToFileURL(absolute).href);
-  return asConfig("default" in mod ? mod.default : mod);
 }
 function normalizeConfig(config) {
   if (config.checks === void 0) return {};
   if (typeof config.checks !== "object" || Array.isArray(config.checks)) {
-    throw new Error("checks config must be an object.");
+    throw new CheckConfigError("AI_CHECK_CONFIG_INVALID_VALUE", "checks config must be an object.");
   }
   return config.checks;
 }
@@ -6014,7 +6324,7 @@ function buildRules(config, options, presetSelect = []) {
         }
         throw new Error(`unsupported status "${value}"`);
       });
-      rules.push(createObservedOutcomeRule({ failOn: statuses }));
+      rules.push(createObservedOutcomeRule({ failOn: statuses, requireAny: true }));
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
@@ -6086,7 +6396,7 @@ function exitCodeFor(result) {
     return 3;
   }
   if (codes.some(
-    (code) => code === "AI_CHECK_INVALID_ARGUMENTS" || code === "AI_CHECK_INVALID_CONFIG" || code === "AI_CHECK_CONFIG_LOAD_FAILED" || code === "AI_CHECK_RUN_SELECTION_REQUIRED"
+    (code) => code === "AI_CHECK_INVALID_ARGUMENTS" || code === "AI_CHECK_INVALID_CONFIG" || code === "AI_CHECK_CONFIG_LOAD_FAILED" || code === "AI_CHECK_CONFIG_UNKNOWN_KEY" || code === "AI_CHECK_CONFIG_INVALID_VALUE" || code === "AI_CHECK_CONFIG_NO_EFFECTIVE_RULES" || code === "AI_CHECK_NO_RULES_EVALUATED" || code === "AI_CHECK_RUN_SELECTION_REQUIRED"
   )) {
     return 2;
   }
@@ -6153,6 +6463,7 @@ function printHuman(result, options = {}) {
   console.log(
     `Summary: ${result.summary.failed} failed, ${result.summary.warnings} warning(s), ${result.summary.errors} error(s)`
   );
+  console.log(`Rules evaluated: ${result.summary.rulesEvaluated ?? result.ruleExecutions?.length ?? 0}`);
   for (const diagnostic3 of result.diagnostics) {
     console.log(`- ${diagnostic3.code}: ${diagnostic3.message}`);
   }
@@ -6184,6 +6495,16 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
   const useSessionScope = Boolean(sessionId || groupId);
   try {
     let config = await loadConfig(options.config);
+    if (options.config !== void 0 && !checkConfigHasEffect(config)) {
+      result = errorResult(
+        "AI_CHECK_CONFIG_NO_EFFECTIVE_RULES",
+        "Explicit --config has no effective check rules. Configure checks.select, checks.run, checks.tool, checks.llm, checks.structure, or checks.safety."
+      );
+      if (options.json) printJson(result);
+      else printHuman(result, options);
+      process.exitCode = exitCodeFor(result);
+      return;
+    }
     let effectiveOptions = options;
     const resolved = resolvePreset(options.preset, {
       hasToolRules: hasToolRulesConfigured(config, options)
@@ -6303,12 +6624,13 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
     }
   } catch (error) {
     if (phase === "config") {
-      const message = error instanceof Error ? error.message : String(error);
-      const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
-      result = errorResult(
-        code,
-        message
-      );
+      if (error instanceof CheckConfigError) {
+        result = errorResult(error.code, error.message);
+      } else {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
+        result = errorResult(code, message);
+      }
     } else {
       result = readErrorResult(error);
     }
@@ -7230,6 +7552,42 @@ function startViewerServer(options = {}) {
     });
   });
 }
+function openInDefaultBrowser(target) {
+  const platform = process.platform;
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", target] : [target];
+  return new Promise((resolve) => {
+    try {
+      const child = spawn(command, args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: platform === "win32"
+      });
+      child.once("spawn", () => {
+        try {
+          child.unref();
+          resolve({ ok: true });
+        } catch (error) {
+          resolve({
+            ok: false,
+            detail: error instanceof Error ? error.message : String(error)
+          });
+        }
+      });
+      child.once("error", (error) => {
+        resolve({
+          ok: false,
+          detail: error instanceof Error ? error.message : String(error)
+        });
+      });
+    } catch (error) {
+      resolve({
+        ok: false,
+        detail: error instanceof Error ? error.message : String(error)
+      });
+    }
+  });
+}
 
 // packages/cli/src/serve.ts
 function parsePort(value) {
@@ -7259,9 +7617,11 @@ async function serveCommand(options = {}) {
   if (options.open === true && host !== "127.0.0.1" && host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
   } else if (options.open === true) {
-    const openMod = await import('child_process');
-    openMod.exec(`open ${info.url}`, () => {
-    });
+    const opened = await openInDefaultBrowser(info.url);
+    if (!opened.ok) {
+      console.warn("Viewer started, but the browser could not be opened automatically.");
+      console.warn(`Open manually: ${info.url}`);
+    }
   }
   await new Promise(() => {
   });
@@ -7420,9 +7780,11 @@ async function studioCommand(options = {}) {
   if (options.open === true && info.host !== "127.0.0.1" && info.host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
   } else if (options.open === true) {
-    const openMod = await import('child_process');
-    openMod.exec(`open ${info.url}`, () => {
-    });
+    const opened = await openInDefaultBrowser(info.url);
+    if (!opened.ok) {
+      console.warn("Studio started, but the browser could not be opened automatically.");
+      console.warn(`Open manually: ${info.url}`);
+    }
   }
   await new Promise(() => {
   });
@@ -8181,7 +8543,7 @@ function asStringArray2(value, label) {
   }
   return value;
 }
-function asConfig2(value) {
+function asConfig(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) {
     throw new Error("Config must export an object.");
@@ -8202,10 +8564,10 @@ async function loadConfig2(configPath) {
   const absolute = path18.resolve(configPath);
   if (extension === ".json") {
     const raw = await readFile(absolute, "utf-8");
-    return asConfig2(JSON.parse(raw));
+    return asConfig(JSON.parse(raw));
   }
   const mod = await import(pathToFileURL(absolute).href);
-  return asConfig2("default" in mod ? mod.default : mod);
+  return asConfig("default" in mod ? mod.default : mod);
 }
 function normalizeConfig2(config) {
   if (config.eval === void 0) return {};
@@ -9710,33 +10072,6 @@ async function resolveHtmlPath(root) {
     `No evidence.html found under ${root}. Pass a bundle directory or .html path.`
   );
 }
-function openLocalFile(filePath) {
-  const fileUrl = pathToFileURL(filePath).href;
-  const platform = process.platform;
-  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "darwin" ? [filePath] : platform === "win32" ? ["/c", "start", "", filePath] : [filePath];
-  return new Promise((resolve) => {
-    try {
-      const child = spawn(command, args, {
-        detached: true,
-        stdio: "ignore"
-      });
-      child.on("error", (error) => {
-        resolve({
-          ok: false,
-          detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
-        });
-      });
-      child.unref();
-      resolve({ ok: true, detail: fileUrl });
-    } catch (error) {
-      resolve({
-        ok: false,
-        detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
-      });
-    }
-  });
-}
 async function bundleOpenCommand(targetPath, options = {}) {
   const root = path18.resolve(targetPath.trim() || ".");
   try {
@@ -9806,23 +10141,24 @@ async function bundleOpenCommand(targetPath, options = {}) {
     await readFile(path18.join(path18.dirname(htmlPath), "evidence.json"), "utf-8");
   } catch {
   }
-  const opened = await openLocalFile(htmlPath);
+  const fileUrl = pathToFileURL(htmlPath).href;
+  const opened = await openInDefaultBrowser(fileUrl);
   if (options.json) {
     console.log(
       writeJson6({
         ok: opened.ok,
         path: htmlPath,
         opened: opened.ok,
-        detail: opened.detail
+        detail: opened.ok ? fileUrl : `${opened.detail ?? "unknown error"}; open manually: ${fileUrl}`
       }).trimEnd()
     );
   } else if (opened.ok) {
     console.log(`Opened local Evidence: ${htmlPath}`);
-    console.log(`URL: ${opened.detail}`);
+    console.log(`URL: ${fileUrl}`);
   } else {
     console.error(`[AgentInspect] Could not open browser automatically.`);
     console.error(`Open this file locally: ${htmlPath}`);
-    console.error(opened.detail);
+    console.error(`${opened.detail ?? "unknown error"}; open manually: ${fileUrl}`);
   }
   if (!opened.ok) {
     process.exitCode = 0;
@@ -11255,7 +11591,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-IDMCWKRH.mjs');
+    return await import('./src-OYGG7QAZ.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(
@@ -11752,9 +12088,15 @@ function normalizeMetrics(raw) {
   const parsed = parseCohortMetricList(raw);
   if (parsed.length === 0) return void 0;
   const allowed = new Set(COHORT_METRIC_IDS);
-  return parsed.filter(
-    (item) => allowed.has(item)
-  );
+  const invalid = parsed.filter((metric) => !allowed.has(metric));
+  if (invalid.length > 0) {
+    const valueLabel = invalid.length === 1 ? "value" : "values";
+    const invalidList = invalid.map((metric) => `"${metric}"`).join(", ");
+    throw new Error(
+      `Unsupported cohort --metric ${valueLabel}: ${invalidList}. Valid metrics: ${COHORT_METRIC_IDS.join(", ")}.`
+    );
+  }
+  return parsed;
 }
 async function writeArtifacts(result, outputDir) {
   await mkdir(outputDir, { recursive: true });
@@ -11775,6 +12117,7 @@ async function writeArtifacts(result, outputDir) {
 }
 async function cohortCommand(options = {}) {
   try {
+    const metrics = normalizeMetrics(options.metric);
     const traceDir = resolveTraceDir({ dir: options.dir });
     const { runs } = await loadSessionRuns(traceDir);
     const result = await analyzeCohort(runs, {
@@ -11783,7 +12126,7 @@ async function cohortCommand(options = {}) {
       candidate: options.candidate,
       cohortKey: options.cohortKey,
       groupBy: options.groupBy,
-      metrics: normalizeMetrics(options.metric)
+      metrics
     });
     const format = options.format ?? (options.json ? "json" : "markdown");
     let artifacts;