agent-inspect 6.17.4 → 6.17.6

package/packages/cli/dist/index.cjs

@@ -13,8 +13,9 @@ var readline = require('readline');
 var url = require('url');
 var module$1 = require('module');
 var commander = require('commander');
-var http = require('http');
 var child_process = require('child_process');
+var util = require('util');
+var http = require('http');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -3565,14 +3566,15 @@ var init_cohort = __esm({
 
 // packages/core/src/sessions/checks.ts
 function emptySummary() {
-  return { passed: 0, failed: 0, warnings: 0, errors: 0 };
+  return { passed: 0, failed: 0, warnings: 0, errors: 0, rulesEvaluated: 0 };
 }
 function mergeSummary(target, source) {
   return {
     passed: target.passed + source.passed,
     failed: target.failed + source.failed,
     warnings: target.warnings + source.warnings,
-    errors: target.errors + source.errors
+    errors: target.errors + source.errors,
+    rulesEvaluated: target.rulesEvaluated + source.rulesEvaluated
   };
 }
 function sessionDiagnostic(code, message) {
@@ -3596,6 +3598,7 @@ function aggregateSessionCheckResults(perRun, scope) {
           `${scope.scopeKind} not found: ${scope.scopeLabel}`
         )
       ],
+      ruleExecutions: [],
       ...scope.sessionWarnings?.length ? { sessionWarnings: [...scope.sessionWarnings] } : {}
     };
   }
@@ -3616,17 +3619,20 @@ function aggregateSessionCheckResults(perRun, scope) {
           `No readable traces in ${scope.scopeKind}: ${scope.scopeLabel}`
         )
       ],
+      ruleExecutions: [],
       ...scope.sessionWarnings?.length ? { sessionWarnings: [...scope.sessionWarnings] } : {}
     };
   }
   let summary = emptySummary();
   const findings = [];
   const diagnostics = [];
+  const ruleExecutions = [];
   const runResults = [];
   for (const result of perRun) {
     summary = mergeSummary(summary, result.summary);
     findings.push(...result.findings);
     diagnostics.push(...result.diagnostics);
+    ruleExecutions.push(...result.ruleExecutions ?? []);
     if (result.runId) {
       runResults.push({ runId: result.runId, status: result.status });
     }
@@ -3639,6 +3645,11 @@ function aggregateSessionCheckResults(perRun, scope) {
     if (runCmp !== 0) return runCmp;
     return a.ruleId.localeCompare(b.ruleId);
   });
+  ruleExecutions.sort((a, b) => {
+    const runCmp = (a.runId ?? "").localeCompare(b.runId ?? "");
+    if (runCmp !== 0) return runCmp;
+    return a.ruleId.localeCompare(b.ruleId);
+  });
   const hasErrors = diagnostics.some((item) => item.severity === "error");
   const status = hasErrors ? "error" : summary.failed > 0 ? "fail" : "pass";
   return {
@@ -3652,6 +3663,7 @@ function aggregateSessionCheckResults(perRun, scope) {
     summary,
     findings,
     diagnostics,
+    ruleExecutions,
     ...scope.sessionWarnings?.length ? { sessionWarnings: [...scope.sessionWarnings] } : {}
   };
 }
@@ -6857,10 +6869,11 @@ function emptySummary2() {
     passed: 0,
     failed: 0,
     warnings: 0,
-    errors: 0
+    errors: 0,
+    rulesEvaluated: 0
   };
 }
-function errorResult(input3, diagnostics, selectedRun) {
+function errorResult(input3, diagnostics, selectedRun, ruleExecutions = []) {
   return {
     ok: false,
     status: "error",
@@ -6868,10 +6881,12 @@ function errorResult(input3, diagnostics, selectedRun) {
     ...selectedRun ? { runId: selectedRun.runId } : {},
     summary: {
       ...emptySummary2(),
-      errors: diagnostics.filter((item) => item.severity === "error").length
+      errors: diagnostics.filter((item) => item.severity === "error").length,
+      rulesEvaluated: ruleExecutions.length
     },
     findings: [],
-    diagnostics: [...diagnostics]
+    diagnostics: [...diagnostics],
+    ruleExecutions: [...ruleExecutions]
   };
 }
 function flattenNodes(nodes) {
@@ -7027,7 +7042,7 @@ function normalizeFinding(rule, finding) {
     ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
-function summarize(findings, diagnostics) {
+function summarize(findings, diagnostics, rulesEvaluated) {
   return {
     passed: findings.filter((finding) => finding.status === "pass").length,
     failed: findings.filter(
@@ -7036,9 +7051,21 @@ function summarize(findings, diagnostics) {
     warnings: findings.filter(
       (finding) => finding.status === "warning" || finding.severity === "warning"
     ).length,
-    errors: diagnostics.filter((item) => item.severity === "error").length
+    errors: diagnostics.filter((item) => item.severity === "error").length,
+    rulesEvaluated
   };
 }
+function classifyRuleExecution(findings, threw) {
+  if (findings.some((finding) => finding.status === "fail" && finding.severity === "error")) {
+    return "fail";
+  }
+  if (findings.some(
+    (finding) => finding.status === "warning" || finding.severity === "warning"
+  )) {
+    return "warning";
+  }
+  return "pass";
+}
 function stringAttr(event, keys) {
   for (const key of keys) {
     const value = event.attributes?.[key];
@@ -7135,6 +7162,9 @@ function finishedEvents(context, kind) {
     (event) => (kind === void 0 || event.kind === kind) && event.status !== "running"
   );
 }
+function toolInvocationEvents(context) {
+  return semanticEvents(context).filter((event) => event.kind === "TOOL");
+}
 function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -7535,7 +7565,7 @@ function createToolUsageRule(options) {
     category: "tool",
     defaultSeverity: "error",
     evaluate(context) {
-      const tools = finishedEvents(context, "TOOL");
+      const tools = toolInvocationEvents(context);
       const names = tools.map(toolName);
       const nameSet = new Set(names);
       const findings = [];
@@ -8185,12 +8215,24 @@ function createBaselineRegressionRule(options) {
 }
 function createObservedOutcomeRule(options = {}) {
   const failOn = options.failOn ?? ["failed"];
+  const requireAny = options.requireAny === true;
   return {
     id: "outcome.status",
     category: "run",
     defaultSeverity: "error",
     evaluate(context) {
       const outcomes = extractOutcomesFromPersistedEvents(context.events);
+      if (requireAny && outcomes.length === 0) {
+        return [
+          failFinding(
+            "outcome.status",
+            "Expected at least one observed outcome.",
+            runEvidence(context.selectedRun),
+            { requireAny: true, expected: "at least one observed outcome" },
+            { code: "outcome.missing", actual: 0 }
+          )
+        ];
+      }
       const matching = outcomesMatchingStatus(outcomes, failOn);
       if (matching.length === 0) return [];
       return [
@@ -8226,6 +8268,18 @@ function runTraceChecks(input3, options = {}) {
   if (rules.diagnostics.length > 0) {
     return errorResult(input3, rules.diagnostics, selected.run);
   }
+  if (rules.rules.length === 0) {
+    return errorResult(
+      input3,
+      [
+        diagnostic3(
+          "AI_CHECK_NO_RULES_EVALUATED",
+          "No trace check rules were evaluated. Configure at least one rule, contract, or CLI check option."
+        )
+      ],
+      selected.run
+    );
+  }
   const facts = buildFacts2(input3, selected.run);
   const context = {
     ...facts,
@@ -8234,22 +8288,38 @@ function runTraceChecks(input3, options = {}) {
   };
   const diagnostics = [];
   const findings = [];
+  const ruleExecutions = [];
   for (const rule of rules.rules) {
     try {
-      findings.push(...rule.evaluate(context).map((finding) => normalizeFinding(rule, finding)));
+      const ruleFindings = rule.evaluate(context).map((finding) => normalizeFinding(rule, finding));
+      findings.push(...ruleFindings);
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: classifyRuleExecution(ruleFindings, false),
+        findingCount: ruleFindings.length,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
         diagnostic3("AI_CHECK_INTERNAL_ERROR", `Rule ${rule.id} failed: ${message}`, rule.id)
       );
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: "error",
+        findingCount: 0,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     }
   }
   if (diagnostics.length > 0) {
-    return errorResult(input3, diagnostics, selected.run);
+    return errorResult(input3, diagnostics, selected.run, ruleExecutions);
   }
   const eventById = new Map(input3.read.events.map((event) => [event.eventId, event]));
   const sortedFindings = findings.sort(compareFindings(eventById));
-  const summary = summarize(sortedFindings, diagnostics);
+  const summary = summarize(sortedFindings, diagnostics, ruleExecutions.length);
   const status = summary.failed > 0 ? "fail" : "pass";
   return {
     ok: status === "pass",
@@ -8258,7 +8328,8 @@ function runTraceChecks(input3, options = {}) {
     ...selected.run ? { runId: selected.run.runId } : {},
     summary,
     findings: sortedFindings,
-    diagnostics
+    diagnostics,
+    ruleExecutions
   };
 }
 var SEVERITY_RANK, STATUS_RANK, CONFIDENCE_RANK, DEFAULT_SENSITIVE_KEYS, DEFAULT_RAW_CONTENT_KEYS, DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES, SAFE_USAGE_LEAF_KEYS, DEFAULT_SECRET_PATTERNS;
@@ -10707,8 +10778,7 @@ async function runSuiteCase(suiteCase, config, options) {
     status: "pass",
     format: read.format,
     findings: [],
-    diagnostics: []
-  };
+    diagnostics: []};
   const observationResult = validateExpectedObservations(suiteCase, read);
   const diagnostics = [
     ...checkResult.diagnostics.map(
@@ -12511,7 +12581,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.17.4";
+var version = "6.17.6";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -14080,6 +14150,11 @@ async function followFile(filePath, options, onLine, shouldStop) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new Error(`Failed to stat file: ${filePath} (${msg})`);
     }
+    if (next.size < pos) {
+      pos = 0;
+      carry = "";
+      lineNumber = 0;
+    }
     if (next.size > pos) {
       const fh = await promises.open(filePath, "r");
       try {
@@ -17744,8 +17819,11 @@ function checkResultToEvidenceJson(result, runIds) {
       status,
       errors: result.summary.errors,
       warnings: result.summary.warnings,
-      findings: result.findings.length
+      findings: result.findings.length,
+      rulesEvaluated: result.summary.rulesEvaluated ?? 0
     })),
+    rulesEvaluated: result.summary.rulesEvaluated ?? 0,
+    evaluatedRuleIds: (result.ruleExecutions ?? []).map((item) => item.ruleId),
     findings: result.findings,
     diagnostics: result.diagnostics
   });
@@ -18370,13 +18448,16 @@ function mergeSafetyExtensions(result, read, options) {
       passed,
       failed,
       warnings,
-      errors: result.summary.errors
+      errors: result.summary.errors,
+      rulesEvaluated: result.summary.rulesEvaluated ?? 0
     },
-    findings
+    findings,
+    ruleExecutions: result.ruleExecutions ?? []
   };
 }
 
 // packages/cli/src/check.ts
+var execFileAsync = util.promisify(child_process.execFile);
 var DEFAULT_SELECT = ["run.status"];
 function uniqueSelectIds(ids) {
   const seen = /* @__PURE__ */ new Set();
@@ -18492,10 +18573,12 @@ function errorResult2(code, message, format = "unknown") {
       passed: 0,
       failed: 0,
       warnings: 0,
-      errors: 1
+      errors: 1,
+      rulesEvaluated: 0
     },
     findings: [],
-    diagnostics
+    diagnostics,
+    ruleExecutions: []
   };
 }
 function parseNumber(value, label) {
@@ -18513,36 +18596,368 @@ function asStringArray2(value) {
   }
   return value;
 }
-function asConfig(value) {
+var CHECKS_KEYS = /* @__PURE__ */ new Set(["select", "run", "tool", "llm", "structure", "safety"]);
+var RUN_KEYS = /* @__PURE__ */ new Set(["expected", "allowIncomplete", "maxDurationMs", "maxDepth"]);
+var TOOL_KEYS = /* @__PURE__ */ new Set(["required", "forbidden", "allowed", "minCount", "maxCount"]);
+var LLM_KEYS = /* @__PURE__ */ new Set([
+  "allowedModels",
+  "allowedProviders",
+  "finishReasons",
+  "maxCalls",
+  "maxTotalTokens",
+  "maxInputTokens",
+  "maxOutputTokens",
+  "maxCachedTokens"
+]);
+var STRUCTURE_KEYS = /* @__PURE__ */ new Set([
+  "minConfidence",
+  "requireParentBeforeChild",
+  "requireTraceParentSpan",
+  "orphan",
+  "cycle",
+  "maxChildren",
+  "maxConcurrent"
+]);
+var SAFETY_KEYS = /* @__PURE__ */ new Set([
+  "redaction",
+  "rawContent",
+  "secretPattern",
+  "maxStringLength",
+  "maxArrayLength",
+  "maxObjectKeys",
+  "maxSerializedBytes",
+  "maxFindings"
+]);
+var RUN_EXPECTED = /* @__PURE__ */ new Set(["ok", "error", "running"]);
+var CONFIDENCE_VALUES = /* @__PURE__ */ new Set(["exact", "high", "medium", "low", "inferred"]);
+var CheckConfigError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "CheckConfigError";
+    this.code = code;
+  }
+};
+function closestKey(unknown, known) {
+  const lower = unknown.toLowerCase();
+  let best;
+  let bestDistance = Number.POSITIVE_INFINITY;
+  for (const candidate of known) {
+    if (candidate.toLowerCase() === lower) return candidate;
+    let distance = Math.abs(candidate.length - unknown.length);
+    const max = Math.max(candidate.length, unknown.length);
+    for (let i = 0; i < Math.min(candidate.length, unknown.length); i += 1) {
+      if (candidate[i].toLowerCase() !== unknown[i].toLowerCase()) distance += 1;
+    }
+    if (distance < bestDistance && distance <= Math.max(2, Math.floor(max / 3))) {
+      bestDistance = distance;
+      best = candidate;
+    }
+  }
+  return best;
+}
+function rejectUnknownKeys(record, allowed, pathPrefix) {
+  for (const key of Object.keys(record)) {
+    if (allowed.has(key)) continue;
+    const suggestion = closestKey(key, [...allowed]);
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      `Unknown check config key "${pathPrefix}.${key}".${hint}`
+    );
+  }
+}
+function requireObject(value, pathPrefix) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be an object.`
+    );
+  }
+  return value;
+}
+function requireStringArray(value, pathPrefix) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.trim() === "")) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be an array of non-empty strings.`
+    );
+  }
+  return value;
+}
+function requireNonNegativeNumber(value, pathPrefix) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be a finite non-negative number.`
+    );
+  }
+  return value;
+}
+function requireBoolean(value, pathPrefix) {
+  if (typeof value !== "boolean") {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be a boolean.`
+    );
+  }
+  return value;
+}
+function parseRunSection(value) {
+  const record = requireObject(value, "checks.run");
+  rejectUnknownKeys(record, RUN_KEYS, "checks.run");
+  const out = {};
+  if (record.expected !== void 0) {
+    if (typeof record.expected !== "string" || !RUN_EXPECTED.has(record.expected)) {
+      throw new CheckConfigError(
+        "AI_CHECK_CONFIG_INVALID_VALUE",
+        `checks.run.expected must be one of: ok, error, running.`
+      );
+    }
+    out.expected = record.expected;
+  }
+  if (record.allowIncomplete !== void 0) {
+    out.allowIncomplete = requireBoolean(record.allowIncomplete, "checks.run.allowIncomplete");
+  }
+  if (record.maxDurationMs !== void 0) {
+    out.maxDurationMs = requireNonNegativeNumber(record.maxDurationMs, "checks.run.maxDurationMs");
+  }
+  if (record.maxDepth !== void 0) {
+    out.maxDepth = requireNonNegativeNumber(record.maxDepth, "checks.run.maxDepth");
+  }
+  return out;
+}
+function parseToolSection(value) {
+  const record = requireObject(value, "checks.tool");
+  rejectUnknownKeys(record, TOOL_KEYS, "checks.tool");
+  const out = {};
+  if (record.required !== void 0) out.required = requireStringArray(record.required, "checks.tool.required");
+  if (record.forbidden !== void 0) out.forbidden = requireStringArray(record.forbidden, "checks.tool.forbidden");
+  if (record.allowed !== void 0) out.allowed = requireStringArray(record.allowed, "checks.tool.allowed");
+  if (record.minCount !== void 0) out.minCount = requireNonNegativeNumber(record.minCount, "checks.tool.minCount");
+  if (record.maxCount !== void 0) out.maxCount = requireNonNegativeNumber(record.maxCount, "checks.tool.maxCount");
+  return out;
+}
+function parseLlmSection(value) {
+  const record = requireObject(value, "checks.llm");
+  rejectUnknownKeys(record, LLM_KEYS, "checks.llm");
+  const out = {};
+  if (record.allowedModels !== void 0) {
+    out.allowedModels = requireStringArray(record.allowedModels, "checks.llm.allowedModels");
+  }
+  if (record.allowedProviders !== void 0) {
+    out.allowedProviders = requireStringArray(record.allowedProviders, "checks.llm.allowedProviders");
+  }
+  if (record.finishReasons !== void 0) {
+    out.finishReasons = requireStringArray(record.finishReasons, "checks.llm.finishReasons");
+  }
+  if (record.maxCalls !== void 0) out.maxCalls = requireNonNegativeNumber(record.maxCalls, "checks.llm.maxCalls");
+  if (record.maxTotalTokens !== void 0) {
+    out.maxTotalTokens = requireNonNegativeNumber(record.maxTotalTokens, "checks.llm.maxTotalTokens");
+  }
+  if (record.maxInputTokens !== void 0) {
+    out.maxInputTokens = requireNonNegativeNumber(record.maxInputTokens, "checks.llm.maxInputTokens");
+  }
+  if (record.maxOutputTokens !== void 0) {
+    out.maxOutputTokens = requireNonNegativeNumber(record.maxOutputTokens, "checks.llm.maxOutputTokens");
+  }
+  if (record.maxCachedTokens !== void 0) {
+    out.maxCachedTokens = requireNonNegativeNumber(record.maxCachedTokens, "checks.llm.maxCachedTokens");
+  }
+  return out;
+}
+function parseStructureSection(value) {
+  const record = requireObject(value, "checks.structure");
+  rejectUnknownKeys(record, STRUCTURE_KEYS, "checks.structure");
+  const out = {};
+  if (record.minConfidence !== void 0) {
+    if (typeof record.minConfidence !== "string" || !CONFIDENCE_VALUES.has(record.minConfidence)) {
+      throw new CheckConfigError(
+        "AI_CHECK_CONFIG_INVALID_VALUE",
+        `checks.structure.minConfidence must be one of: exact, high, medium, low, inferred.`
+      );
+    }
+    out.minConfidence = record.minConfidence;
+  }
+  if (record.requireParentBeforeChild !== void 0) {
+    out.requireParentBeforeChild = requireBoolean(
+      record.requireParentBeforeChild,
+      "checks.structure.requireParentBeforeChild"
+    );
+  }
+  if (record.requireTraceParentSpan !== void 0) {
+    out.requireTraceParentSpan = requireBoolean(
+      record.requireTraceParentSpan,
+      "checks.structure.requireTraceParentSpan"
+    );
+  }
+  if (record.orphan !== void 0) out.orphan = requireBoolean(record.orphan, "checks.structure.orphan");
+  if (record.cycle !== void 0) out.cycle = requireBoolean(record.cycle, "checks.structure.cycle");
+  if (record.maxChildren !== void 0) {
+    out.maxChildren = requireNonNegativeNumber(record.maxChildren, "checks.structure.maxChildren");
+  }
+  if (record.maxConcurrent !== void 0) {
+    out.maxConcurrent = requireNonNegativeNumber(record.maxConcurrent, "checks.structure.maxConcurrent");
+  }
+  return out;
+}
+function parseSafetySection(value) {
+  const record = requireObject(value, "checks.safety");
+  rejectUnknownKeys(record, SAFETY_KEYS, "checks.safety");
+  const out = {};
+  if (record.redaction !== void 0) out.redaction = requireBoolean(record.redaction, "checks.safety.redaction");
+  if (record.rawContent !== void 0) out.rawContent = requireBoolean(record.rawContent, "checks.safety.rawContent");
+  if (record.secretPattern !== void 0) {
+    out.secretPattern = requireBoolean(record.secretPattern, "checks.safety.secretPattern");
+  }
+  if (record.maxStringLength !== void 0) {
+    out.maxStringLength = requireNonNegativeNumber(record.maxStringLength, "checks.safety.maxStringLength");
+  }
+  if (record.maxArrayLength !== void 0) {
+    out.maxArrayLength = requireNonNegativeNumber(record.maxArrayLength, "checks.safety.maxArrayLength");
+  }
+  if (record.maxObjectKeys !== void 0) {
+    out.maxObjectKeys = requireNonNegativeNumber(record.maxObjectKeys, "checks.safety.maxObjectKeys");
+  }
+  if (record.maxSerializedBytes !== void 0) {
+    out.maxSerializedBytes = requireNonNegativeNumber(
+      record.maxSerializedBytes,
+      "checks.safety.maxSerializedBytes"
+    );
+  }
+  if (record.maxFindings !== void 0) {
+    out.maxFindings = requireNonNegativeNumber(record.maxFindings, "checks.safety.maxFindings");
+  }
+  return out;
+}
+function sectionHasEffect(section) {
+  if (section === void 0) return false;
+  return Object.keys(section).length > 0;
+}
+function checkConfigHasEffect(config) {
+  const checks2 = config.checks;
+  if (checks2 === void 0) return false;
+  if ((checks2.select?.length ?? 0) > 0) return true;
+  if (sectionHasEffect(checks2.run)) return true;
+  if (sectionHasEffect(checks2.tool)) return true;
+  if (sectionHasEffect(checks2.llm)) return true;
+  if (sectionHasEffect(checks2.structure)) return true;
+  if (sectionHasEffect(checks2.safety)) return true;
+  return false;
+}
+function parseCheckConfig(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("Config must export an object.");
+    throw new CheckConfigError("AI_CHECK_CONFIG_INVALID_VALUE", "Config must export an object.");
   }
-  return value;
+  const root = value;
+  if ("contract" in root) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      'Top-level "contract" is not supported by `agent-inspect check --config`. Use the TraceContract TypeScript API (`defineTraceContract` / `evaluateTraceContract` from `agent-inspect/checks`), or express tool/run/llm rules under `checks`.'
+    );
+  }
+  const rootKeys = Object.keys(root);
+  for (const key of rootKeys) {
+    if (key === "checks") continue;
+    const suggestion = closestKey(key, ["checks"]);
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      `Unknown top-level check config key "${key}". Allowed: checks.${hint}`
+    );
+  }
+  if (!("checks" in root)) return {};
+  const checksRecord = requireObject(root.checks, "checks");
+  rejectUnknownKeys(checksRecord, CHECKS_KEYS, "checks");
+  const checks2 = {};
+  if (checksRecord.select !== void 0) {
+    checks2.select = requireStringArray(checksRecord.select, "checks.select");
+  }
+  if (checksRecord.run !== void 0) checks2.run = parseRunSection(checksRecord.run);
+  if (checksRecord.tool !== void 0) checks2.tool = parseToolSection(checksRecord.tool);
+  if (checksRecord.llm !== void 0) checks2.llm = parseLlmSection(checksRecord.llm);
+  if (checksRecord.structure !== void 0) {
+    checks2.structure = parseStructureSection(checksRecord.structure);
+  }
+  if (checksRecord.safety !== void 0) checks2.safety = parseSafetySection(checksRecord.safety);
+  return { checks: checks2 };
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
   const extension = path32__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
-    throw new Error(
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
     );
   }
   if (!CONFIG_EXTENSIONS2.has(extension)) {
-    throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
+      "Unsupported check config extension. Use .json, .js, .mjs, or .cjs."
+    );
   }
   const absolute = path32__default.default.resolve(configPath);
-  if (extension === ".json") {
-    const raw = await promises.readFile(absolute, "utf-8");
-    return asConfig(JSON.parse(raw));
+  try {
+    if (extension === ".json") {
+      const raw = await promises.readFile(absolute, "utf-8");
+      return parseCheckConfig(JSON.parse(raw));
+    }
+    return parseCheckConfig(await importJsCheckConfig(absolute));
+  } catch (error) {
+    if (error instanceof CheckConfigError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
+      `Failed to load check config: ${message}`
+    );
+  }
+}
+async function importJsCheckConfig(absolute) {
+  const href = url.pathToFileURL(absolute).href;
+  if (!process.env.VITEST) {
+    const mod = await import(
+      /* @vite-ignore */
+      href
+    );
+    return "default" in mod ? mod.default : mod;
+  }
+  const script = `
+const mod = await import(${JSON.stringify(href)});
+const value = "default" in mod ? mod.default : mod;
+process.stdout.write(JSON.stringify({ ok: true, value }));
+`;
+  const env2 = { ...process.env };
+  delete env2.NODE_OPTIONS;
+  delete env2.VITEST;
+  delete env2.VITEST_WORKER_ID;
+  const { stdout, stderr } = await execFileAsync(
+    process.execPath,
+    ["--input-type=module", "--eval", script],
+    {
+      encoding: "utf8",
+      maxBuffer: 4 * 1024 * 1024,
+      env: env2
+    }
+  );
+  try {
+    const parsed = JSON.parse(stdout);
+    if (parsed.ok !== true) {
+      throw new Error(stderr.trim() || "Check config module did not return a value");
+    }
+    return parsed.value;
+  } catch (error) {
+    if (stderr.trim()) {
+      throw new Error(stderr.trim());
+    }
+    throw error instanceof Error ? error : new Error(String(error));
   }
-  const mod = await import(url.pathToFileURL(absolute).href);
-  return asConfig("default" in mod ? mod.default : mod);
 }
 function normalizeConfig(config) {
   if (config.checks === void 0) return {};
   if (typeof config.checks !== "object" || Array.isArray(config.checks)) {
-    throw new Error("checks config must be an object.");
+    throw new CheckConfigError("AI_CHECK_CONFIG_INVALID_VALUE", "checks config must be an object.");
   }
   return config.checks;
 }
@@ -18620,7 +19035,7 @@ function buildRules(config, options, presetSelect = []) {
         }
         throw new Error(`unsupported status "${value}"`);
       });
-      rules.push(createObservedOutcomeRule({ failOn: statuses }));
+      rules.push(createObservedOutcomeRule({ failOn: statuses, requireAny: true }));
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
@@ -18692,7 +19107,7 @@ function exitCodeFor(result) {
     return 3;
   }
   if (codes.some(
-    (code) => code === "AI_CHECK_INVALID_ARGUMENTS" || code === "AI_CHECK_INVALID_CONFIG" || code === "AI_CHECK_CONFIG_LOAD_FAILED" || code === "AI_CHECK_RUN_SELECTION_REQUIRED"
+    (code) => code === "AI_CHECK_INVALID_ARGUMENTS" || code === "AI_CHECK_INVALID_CONFIG" || code === "AI_CHECK_CONFIG_LOAD_FAILED" || code === "AI_CHECK_CONFIG_UNKNOWN_KEY" || code === "AI_CHECK_CONFIG_INVALID_VALUE" || code === "AI_CHECK_CONFIG_NO_EFFECTIVE_RULES" || code === "AI_CHECK_NO_RULES_EVALUATED" || code === "AI_CHECK_RUN_SELECTION_REQUIRED"
   )) {
     return 2;
   }
@@ -18759,6 +19174,7 @@ function printHuman(result, options = {}) {
   console.log(
     `Summary: ${result.summary.failed} failed, ${result.summary.warnings} warning(s), ${result.summary.errors} error(s)`
   );
+  console.log(`Rules evaluated: ${result.summary.rulesEvaluated ?? result.ruleExecutions?.length ?? 0}`);
   for (const diagnostic7 of result.diagnostics) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
@@ -18790,6 +19206,16 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
   const useSessionScope = Boolean(sessionId || groupId);
   try {
     let config = await loadConfig(options.config);
+    if (options.config !== void 0 && !checkConfigHasEffect(config)) {
+      result = errorResult2(
+        "AI_CHECK_CONFIG_NO_EFFECTIVE_RULES",
+        "Explicit --config has no effective check rules. Configure checks.select, checks.run, checks.tool, checks.llm, checks.structure, or checks.safety."
+      );
+      if (options.json) printJson(result);
+      else printHuman(result, options);
+      process.exitCode = exitCodeFor(result);
+      return;
+    }
     let effectiveOptions = options;
     const resolved = resolvePreset(options.preset, {
       hasToolRules: hasToolRulesConfigured(config, options)
@@ -18909,12 +19335,13 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
     }
   } catch (error) {
     if (phase === "config") {
-      const message = error instanceof Error ? error.message : String(error);
-      const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
-      result = errorResult2(
-        code,
-        message
-      );
+      if (error instanceof CheckConfigError) {
+        result = errorResult2(error.code, error.message);
+      } else {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
+        result = errorResult2(code, message);
+      }
     } else {
       result = readErrorResult(error);
     }
@@ -19845,6 +20272,42 @@ function startViewerServer(options = {}) {
     });
   });
 }
+function openInDefaultBrowser(target) {
+  const platform = process.platform;
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", target] : [target];
+  return new Promise((resolve) => {
+    try {
+      const child = child_process.spawn(command, args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: platform === "win32"
+      });
+      child.once("spawn", () => {
+        try {
+          child.unref();
+          resolve({ ok: true });
+        } catch (error) {
+          resolve({
+            ok: false,
+            detail: error instanceof Error ? error.message : String(error)
+          });
+        }
+      });
+      child.once("error", (error) => {
+        resolve({
+          ok: false,
+          detail: error instanceof Error ? error.message : String(error)
+        });
+      });
+    } catch (error) {
+      resolve({
+        ok: false,
+        detail: error instanceof Error ? error.message : String(error)
+      });
+    }
+  });
+}
 
 // packages/cli/src/serve.ts
 function parsePort(value) {
@@ -19874,9 +20337,11 @@ async function serveCommand(options = {}) {
   if (options.open === true && host !== "127.0.0.1" && host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
   } else if (options.open === true) {
-    const openMod = await import('child_process');
-    openMod.exec(`open ${info.url}`, () => {
-    });
+    const opened = await openInDefaultBrowser(info.url);
+    if (!opened.ok) {
+      console.warn("Viewer started, but the browser could not be opened automatically.");
+      console.warn(`Open manually: ${info.url}`);
+    }
   }
   await new Promise(() => {
   });
@@ -20035,9 +20500,11 @@ async function studioCommand(options = {}) {
   if (options.open === true && info.host !== "127.0.0.1" && info.host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
   } else if (options.open === true) {
-    const openMod = await import('child_process');
-    openMod.exec(`open ${info.url}`, () => {
-    });
+    const opened = await openInDefaultBrowser(info.url);
+    if (!opened.ok) {
+      console.warn("Studio started, but the browser could not be opened automatically.");
+      console.warn(`Open manually: ${info.url}`);
+    }
   }
   await new Promise(() => {
   });
@@ -20796,7 +21263,7 @@ function asStringArray3(value, label) {
   }
   return value;
 }
-function asConfig2(value) {
+function asConfig(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) {
     throw new Error("Config must export an object.");
@@ -20817,10 +21284,10 @@ async function loadConfig2(configPath) {
   const absolute = path32__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
-    return asConfig2(JSON.parse(raw));
+    return asConfig(JSON.parse(raw));
   }
   const mod = await import(url.pathToFileURL(absolute).href);
-  return asConfig2("default" in mod ? mod.default : mod);
+  return asConfig("default" in mod ? mod.default : mod);
 }
 function normalizeConfig2(config) {
   if (config.eval === void 0) return {};
@@ -22335,33 +22802,6 @@ async function resolveHtmlPath(root) {
     `No evidence.html found under ${root}. Pass a bundle directory or .html path.`
   );
 }
-function openLocalFile(filePath) {
-  const fileUrl = url.pathToFileURL(filePath).href;
-  const platform = process.platform;
-  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "darwin" ? [filePath] : platform === "win32" ? ["/c", "start", "", filePath] : [filePath];
-  return new Promise((resolve) => {
-    try {
-      const child = child_process.spawn(command, args, {
-        detached: true,
-        stdio: "ignore"
-      });
-      child.on("error", (error) => {
-        resolve({
-          ok: false,
-          detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
-        });
-      });
-      child.unref();
-      resolve({ ok: true, detail: fileUrl });
-    } catch (error) {
-      resolve({
-        ok: false,
-        detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
-      });
-    }
-  });
-}
 async function bundleOpenCommand(targetPath, options = {}) {
   const root = path32__default.default.resolve(targetPath.trim() || ".");
   try {
@@ -22431,23 +22871,24 @@ async function bundleOpenCommand(targetPath, options = {}) {
     await promises.readFile(path32__default.default.join(path32__default.default.dirname(htmlPath), "evidence.json"), "utf-8");
   } catch {
   }
-  const opened = await openLocalFile(htmlPath);
+  const fileUrl = url.pathToFileURL(htmlPath).href;
+  const opened = await openInDefaultBrowser(fileUrl);
   if (options.json) {
     console.log(
       writeJson6({
         ok: opened.ok,
         path: htmlPath,
         opened: opened.ok,
-        detail: opened.detail
+        detail: opened.ok ? fileUrl : `${opened.detail ?? "unknown error"}; open manually: ${fileUrl}`
       }).trimEnd()
     );
   } else if (opened.ok) {
     console.log(`Opened local Evidence: ${htmlPath}`);
-    console.log(`URL: ${opened.detail}`);
+    console.log(`URL: ${fileUrl}`);
   } else {
     console.error(`[AgentInspect] Could not open browser automatically.`);
     console.error(`Open this file locally: ${htmlPath}`);
-    console.error(opened.detail);
+    console.error(`${opened.detail ?? "unknown error"}; open manually: ${fileUrl}`);
   }
   if (!opened.ok) {
     process.exitCode = 0;