agent-inspect 6.17.4 → 6.17.6

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, truncateStringForProfile, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, diffRuns, manualTraceEventsToComparableRun } from './chunk-YX6RFLV5.mjs';
+import { createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, truncateStringForProfile, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, diffRuns, manualTraceEventsToComparableRun } from './chunk-GOHYSE7W.mjs';
 import { realpathSync, constants as constants$1, existsSync, readFileSync } from 'fs';
 import path18 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -7,12 +7,13 @@ import { Command, Option } from 'commander';
 import { readFile, stat, mkdir, writeFile, unlink, appendFile, access, rm, open, readdir, constants } from 'fs/promises';
 import process2, { stdin, stdout } from 'process';
 import crypto, { createHash } from 'crypto';
+import { execFile, spawn } from 'child_process';
+import { promisify } from 'util';
 import { createServer } from 'http';
-import { spawn } from 'child_process';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.17.4";
+var version = "6.17.6";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -1540,6 +1541,11 @@ async function followFile(filePath, options, onLine, shouldStop) {
       const msg = e instanceof Error ? e.message : String(e);
       throw new Error(`Failed to stat file: ${filePath} (${msg})`);
     }
+    if (next.size < pos) {
+      pos = 0;
+      carry = "";
+      lineNumber = 0;
+    }
     if (next.size > pos) {
       const fh = await open(filePath, "r");
       try {
@@ -3347,7 +3353,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-X6SLMBNH.mjs');
+    const mod = await import('./src-OYGG7QAZ.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -5143,8 +5149,11 @@ function checkResultToEvidenceJson(result, runIds) {
       status,
       errors: result.summary.errors,
       warnings: result.summary.warnings,
-      findings: result.findings.length
+      findings: result.findings.length,
+      rulesEvaluated: result.summary.rulesEvaluated ?? 0
     })),
+    rulesEvaluated: result.summary.rulesEvaluated ?? 0,
+    evaluatedRuleIds: (result.ruleExecutions ?? []).map((item) => item.ruleId),
     findings: result.findings,
     diagnostics: result.diagnostics
   });
@@ -5769,13 +5778,16 @@ function mergeSafetyExtensions(result, read, options) {
       passed,
       failed,
       warnings,
-      errors: result.summary.errors
+      errors: result.summary.errors,
+      rulesEvaluated: result.summary.rulesEvaluated ?? 0
     },
-    findings
+    findings,
+    ruleExecutions: result.ruleExecutions ?? []
   };
 }
 
 // packages/cli/src/check.ts
+var execFileAsync = promisify(execFile);
 var DEFAULT_SELECT = ["run.status"];
 function uniqueSelectIds(ids) {
   const seen = /* @__PURE__ */ new Set();
@@ -5891,10 +5903,12 @@ function errorResult(code, message, format = "unknown") {
       passed: 0,
       failed: 0,
       warnings: 0,
-      errors: 1
+      errors: 1,
+      rulesEvaluated: 0
     },
     findings: [],
-    diagnostics
+    diagnostics,
+    ruleExecutions: []
   };
 }
 function parseNumber(value, label) {
@@ -5912,36 +5926,368 @@ function asStringArray(value) {
   }
   return value;
 }
-function asConfig(value) {
+var CHECKS_KEYS = /* @__PURE__ */ new Set(["select", "run", "tool", "llm", "structure", "safety"]);
+var RUN_KEYS = /* @__PURE__ */ new Set(["expected", "allowIncomplete", "maxDurationMs", "maxDepth"]);
+var TOOL_KEYS = /* @__PURE__ */ new Set(["required", "forbidden", "allowed", "minCount", "maxCount"]);
+var LLM_KEYS = /* @__PURE__ */ new Set([
+  "allowedModels",
+  "allowedProviders",
+  "finishReasons",
+  "maxCalls",
+  "maxTotalTokens",
+  "maxInputTokens",
+  "maxOutputTokens",
+  "maxCachedTokens"
+]);
+var STRUCTURE_KEYS = /* @__PURE__ */ new Set([
+  "minConfidence",
+  "requireParentBeforeChild",
+  "requireTraceParentSpan",
+  "orphan",
+  "cycle",
+  "maxChildren",
+  "maxConcurrent"
+]);
+var SAFETY_KEYS = /* @__PURE__ */ new Set([
+  "redaction",
+  "rawContent",
+  "secretPattern",
+  "maxStringLength",
+  "maxArrayLength",
+  "maxObjectKeys",
+  "maxSerializedBytes",
+  "maxFindings"
+]);
+var RUN_EXPECTED = /* @__PURE__ */ new Set(["ok", "error", "running"]);
+var CONFIDENCE_VALUES = /* @__PURE__ */ new Set(["exact", "high", "medium", "low", "inferred"]);
+var CheckConfigError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "CheckConfigError";
+    this.code = code;
+  }
+};
+function closestKey(unknown, known) {
+  const lower = unknown.toLowerCase();
+  let best;
+  let bestDistance = Number.POSITIVE_INFINITY;
+  for (const candidate of known) {
+    if (candidate.toLowerCase() === lower) return candidate;
+    let distance = Math.abs(candidate.length - unknown.length);
+    const max = Math.max(candidate.length, unknown.length);
+    for (let i = 0; i < Math.min(candidate.length, unknown.length); i += 1) {
+      if (candidate[i].toLowerCase() !== unknown[i].toLowerCase()) distance += 1;
+    }
+    if (distance < bestDistance && distance <= Math.max(2, Math.floor(max / 3))) {
+      bestDistance = distance;
+      best = candidate;
+    }
+  }
+  return best;
+}
+function rejectUnknownKeys(record, allowed, pathPrefix) {
+  for (const key of Object.keys(record)) {
+    if (allowed.has(key)) continue;
+    const suggestion = closestKey(key, [...allowed]);
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      `Unknown check config key "${pathPrefix}.${key}".${hint}`
+    );
+  }
+}
+function requireObject(value, pathPrefix) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be an object.`
+    );
+  }
+  return value;
+}
+function requireStringArray(value, pathPrefix) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.trim() === "")) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be an array of non-empty strings.`
+    );
+  }
+  return value;
+}
+function requireNonNegativeNumber(value, pathPrefix) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be a finite non-negative number.`
+    );
+  }
+  return value;
+}
+function requireBoolean(value, pathPrefix) {
+  if (typeof value !== "boolean") {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_INVALID_VALUE",
+      `${pathPrefix} must be a boolean.`
+    );
+  }
+  return value;
+}
+function parseRunSection(value) {
+  const record = requireObject(value, "checks.run");
+  rejectUnknownKeys(record, RUN_KEYS, "checks.run");
+  const out = {};
+  if (record.expected !== void 0) {
+    if (typeof record.expected !== "string" || !RUN_EXPECTED.has(record.expected)) {
+      throw new CheckConfigError(
+        "AI_CHECK_CONFIG_INVALID_VALUE",
+        `checks.run.expected must be one of: ok, error, running.`
+      );
+    }
+    out.expected = record.expected;
+  }
+  if (record.allowIncomplete !== void 0) {
+    out.allowIncomplete = requireBoolean(record.allowIncomplete, "checks.run.allowIncomplete");
+  }
+  if (record.maxDurationMs !== void 0) {
+    out.maxDurationMs = requireNonNegativeNumber(record.maxDurationMs, "checks.run.maxDurationMs");
+  }
+  if (record.maxDepth !== void 0) {
+    out.maxDepth = requireNonNegativeNumber(record.maxDepth, "checks.run.maxDepth");
+  }
+  return out;
+}
+function parseToolSection(value) {
+  const record = requireObject(value, "checks.tool");
+  rejectUnknownKeys(record, TOOL_KEYS, "checks.tool");
+  const out = {};
+  if (record.required !== void 0) out.required = requireStringArray(record.required, "checks.tool.required");
+  if (record.forbidden !== void 0) out.forbidden = requireStringArray(record.forbidden, "checks.tool.forbidden");
+  if (record.allowed !== void 0) out.allowed = requireStringArray(record.allowed, "checks.tool.allowed");
+  if (record.minCount !== void 0) out.minCount = requireNonNegativeNumber(record.minCount, "checks.tool.minCount");
+  if (record.maxCount !== void 0) out.maxCount = requireNonNegativeNumber(record.maxCount, "checks.tool.maxCount");
+  return out;
+}
+function parseLlmSection(value) {
+  const record = requireObject(value, "checks.llm");
+  rejectUnknownKeys(record, LLM_KEYS, "checks.llm");
+  const out = {};
+  if (record.allowedModels !== void 0) {
+    out.allowedModels = requireStringArray(record.allowedModels, "checks.llm.allowedModels");
+  }
+  if (record.allowedProviders !== void 0) {
+    out.allowedProviders = requireStringArray(record.allowedProviders, "checks.llm.allowedProviders");
+  }
+  if (record.finishReasons !== void 0) {
+    out.finishReasons = requireStringArray(record.finishReasons, "checks.llm.finishReasons");
+  }
+  if (record.maxCalls !== void 0) out.maxCalls = requireNonNegativeNumber(record.maxCalls, "checks.llm.maxCalls");
+  if (record.maxTotalTokens !== void 0) {
+    out.maxTotalTokens = requireNonNegativeNumber(record.maxTotalTokens, "checks.llm.maxTotalTokens");
+  }
+  if (record.maxInputTokens !== void 0) {
+    out.maxInputTokens = requireNonNegativeNumber(record.maxInputTokens, "checks.llm.maxInputTokens");
+  }
+  if (record.maxOutputTokens !== void 0) {
+    out.maxOutputTokens = requireNonNegativeNumber(record.maxOutputTokens, "checks.llm.maxOutputTokens");
+  }
+  if (record.maxCachedTokens !== void 0) {
+    out.maxCachedTokens = requireNonNegativeNumber(record.maxCachedTokens, "checks.llm.maxCachedTokens");
+  }
+  return out;
+}
+function parseStructureSection(value) {
+  const record = requireObject(value, "checks.structure");
+  rejectUnknownKeys(record, STRUCTURE_KEYS, "checks.structure");
+  const out = {};
+  if (record.minConfidence !== void 0) {
+    if (typeof record.minConfidence !== "string" || !CONFIDENCE_VALUES.has(record.minConfidence)) {
+      throw new CheckConfigError(
+        "AI_CHECK_CONFIG_INVALID_VALUE",
+        `checks.structure.minConfidence must be one of: exact, high, medium, low, inferred.`
+      );
+    }
+    out.minConfidence = record.minConfidence;
+  }
+  if (record.requireParentBeforeChild !== void 0) {
+    out.requireParentBeforeChild = requireBoolean(
+      record.requireParentBeforeChild,
+      "checks.structure.requireParentBeforeChild"
+    );
+  }
+  if (record.requireTraceParentSpan !== void 0) {
+    out.requireTraceParentSpan = requireBoolean(
+      record.requireTraceParentSpan,
+      "checks.structure.requireTraceParentSpan"
+    );
+  }
+  if (record.orphan !== void 0) out.orphan = requireBoolean(record.orphan, "checks.structure.orphan");
+  if (record.cycle !== void 0) out.cycle = requireBoolean(record.cycle, "checks.structure.cycle");
+  if (record.maxChildren !== void 0) {
+    out.maxChildren = requireNonNegativeNumber(record.maxChildren, "checks.structure.maxChildren");
+  }
+  if (record.maxConcurrent !== void 0) {
+    out.maxConcurrent = requireNonNegativeNumber(record.maxConcurrent, "checks.structure.maxConcurrent");
+  }
+  return out;
+}
+function parseSafetySection(value) {
+  const record = requireObject(value, "checks.safety");
+  rejectUnknownKeys(record, SAFETY_KEYS, "checks.safety");
+  const out = {};
+  if (record.redaction !== void 0) out.redaction = requireBoolean(record.redaction, "checks.safety.redaction");
+  if (record.rawContent !== void 0) out.rawContent = requireBoolean(record.rawContent, "checks.safety.rawContent");
+  if (record.secretPattern !== void 0) {
+    out.secretPattern = requireBoolean(record.secretPattern, "checks.safety.secretPattern");
+  }
+  if (record.maxStringLength !== void 0) {
+    out.maxStringLength = requireNonNegativeNumber(record.maxStringLength, "checks.safety.maxStringLength");
+  }
+  if (record.maxArrayLength !== void 0) {
+    out.maxArrayLength = requireNonNegativeNumber(record.maxArrayLength, "checks.safety.maxArrayLength");
+  }
+  if (record.maxObjectKeys !== void 0) {
+    out.maxObjectKeys = requireNonNegativeNumber(record.maxObjectKeys, "checks.safety.maxObjectKeys");
+  }
+  if (record.maxSerializedBytes !== void 0) {
+    out.maxSerializedBytes = requireNonNegativeNumber(
+      record.maxSerializedBytes,
+      "checks.safety.maxSerializedBytes"
+    );
+  }
+  if (record.maxFindings !== void 0) {
+    out.maxFindings = requireNonNegativeNumber(record.maxFindings, "checks.safety.maxFindings");
+  }
+  return out;
+}
+function sectionHasEffect(section) {
+  if (section === void 0) return false;
+  return Object.keys(section).length > 0;
+}
+function checkConfigHasEffect(config) {
+  const checks2 = config.checks;
+  if (checks2 === void 0) return false;
+  if ((checks2.select?.length ?? 0) > 0) return true;
+  if (sectionHasEffect(checks2.run)) return true;
+  if (sectionHasEffect(checks2.tool)) return true;
+  if (sectionHasEffect(checks2.llm)) return true;
+  if (sectionHasEffect(checks2.structure)) return true;
+  if (sectionHasEffect(checks2.safety)) return true;
+  return false;
+}
+function parseCheckConfig(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("Config must export an object.");
+    throw new CheckConfigError("AI_CHECK_CONFIG_INVALID_VALUE", "Config must export an object.");
   }
-  return value;
+  const root = value;
+  if ("contract" in root) {
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      'Top-level "contract" is not supported by `agent-inspect check --config`. Use the TraceContract TypeScript API (`defineTraceContract` / `evaluateTraceContract` from `agent-inspect/checks`), or express tool/run/llm rules under `checks`.'
+    );
+  }
+  const rootKeys = Object.keys(root);
+  for (const key of rootKeys) {
+    if (key === "checks") continue;
+    const suggestion = closestKey(key, ["checks"]);
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_UNKNOWN_KEY",
+      `Unknown top-level check config key "${key}". Allowed: checks.${hint}`
+    );
+  }
+  if (!("checks" in root)) return {};
+  const checksRecord = requireObject(root.checks, "checks");
+  rejectUnknownKeys(checksRecord, CHECKS_KEYS, "checks");
+  const checks2 = {};
+  if (checksRecord.select !== void 0) {
+    checks2.select = requireStringArray(checksRecord.select, "checks.select");
+  }
+  if (checksRecord.run !== void 0) checks2.run = parseRunSection(checksRecord.run);
+  if (checksRecord.tool !== void 0) checks2.tool = parseToolSection(checksRecord.tool);
+  if (checksRecord.llm !== void 0) checks2.llm = parseLlmSection(checksRecord.llm);
+  if (checksRecord.structure !== void 0) {
+    checks2.structure = parseStructureSection(checksRecord.structure);
+  }
+  if (checksRecord.safety !== void 0) checks2.safety = parseSafetySection(checksRecord.safety);
+  return { checks: checks2 };
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
   const extension = path18.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
-    throw new Error(
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
     );
   }
   if (!CONFIG_EXTENSIONS.has(extension)) {
-    throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
+      "Unsupported check config extension. Use .json, .js, .mjs, or .cjs."
+    );
   }
   const absolute = path18.resolve(configPath);
-  if (extension === ".json") {
-    const raw = await readFile(absolute, "utf-8");
-    return asConfig(JSON.parse(raw));
+  try {
+    if (extension === ".json") {
+      const raw = await readFile(absolute, "utf-8");
+      return parseCheckConfig(JSON.parse(raw));
+    }
+    return parseCheckConfig(await importJsCheckConfig(absolute));
+  } catch (error) {
+    if (error instanceof CheckConfigError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CheckConfigError(
+      "AI_CHECK_CONFIG_LOAD_FAILED",
+      `Failed to load check config: ${message}`
+    );
+  }
+}
+async function importJsCheckConfig(absolute) {
+  const href = pathToFileURL(absolute).href;
+  if (!process.env.VITEST) {
+    const mod = await import(
+      /* @vite-ignore */
+      href
+    );
+    return "default" in mod ? mod.default : mod;
+  }
+  const script = `
+const mod = await import(${JSON.stringify(href)});
+const value = "default" in mod ? mod.default : mod;
+process.stdout.write(JSON.stringify({ ok: true, value }));
+`;
+  const env = { ...process.env };
+  delete env.NODE_OPTIONS;
+  delete env.VITEST;
+  delete env.VITEST_WORKER_ID;
+  const { stdout, stderr } = await execFileAsync(
+    process.execPath,
+    ["--input-type=module", "--eval", script],
+    {
+      encoding: "utf8",
+      maxBuffer: 4 * 1024 * 1024,
+      env
+    }
+  );
+  try {
+    const parsed = JSON.parse(stdout);
+    if (parsed.ok !== true) {
+      throw new Error(stderr.trim() || "Check config module did not return a value");
+    }
+    return parsed.value;
+  } catch (error) {
+    if (stderr.trim()) {
+      throw new Error(stderr.trim());
+    }
+    throw error instanceof Error ? error : new Error(String(error));
   }
-  const mod = await import(pathToFileURL(absolute).href);
-  return asConfig("default" in mod ? mod.default : mod);
 }
 function normalizeConfig(config) {
   if (config.checks === void 0) return {};
   if (typeof config.checks !== "object" || Array.isArray(config.checks)) {
-    throw new Error("checks config must be an object.");
+    throw new CheckConfigError("AI_CHECK_CONFIG_INVALID_VALUE", "checks config must be an object.");
   }
   return config.checks;
 }
@@ -6019,7 +6365,7 @@ function buildRules(config, options, presetSelect = []) {
         }
         throw new Error(`unsupported status "${value}"`);
       });
-      rules.push(createObservedOutcomeRule({ failOn: statuses }));
+      rules.push(createObservedOutcomeRule({ failOn: statuses, requireAny: true }));
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
@@ -6091,7 +6437,7 @@ function exitCodeFor(result) {
     return 3;
   }
   if (codes.some(
-    (code) => code === "AI_CHECK_INVALID_ARGUMENTS" || code === "AI_CHECK_INVALID_CONFIG" || code === "AI_CHECK_CONFIG_LOAD_FAILED" || code === "AI_CHECK_RUN_SELECTION_REQUIRED"
+    (code) => code === "AI_CHECK_INVALID_ARGUMENTS" || code === "AI_CHECK_INVALID_CONFIG" || code === "AI_CHECK_CONFIG_LOAD_FAILED" || code === "AI_CHECK_CONFIG_UNKNOWN_KEY" || code === "AI_CHECK_CONFIG_INVALID_VALUE" || code === "AI_CHECK_CONFIG_NO_EFFECTIVE_RULES" || code === "AI_CHECK_NO_RULES_EVALUATED" || code === "AI_CHECK_RUN_SELECTION_REQUIRED"
   )) {
     return 2;
   }
@@ -6158,6 +6504,7 @@ function printHuman(result, options = {}) {
   console.log(
     `Summary: ${result.summary.failed} failed, ${result.summary.warnings} warning(s), ${result.summary.errors} error(s)`
   );
+  console.log(`Rules evaluated: ${result.summary.rulesEvaluated ?? result.ruleExecutions?.length ?? 0}`);
   for (const diagnostic3 of result.diagnostics) {
     console.log(`- ${diagnostic3.code}: ${diagnostic3.message}`);
   }
@@ -6189,6 +6536,16 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
   const useSessionScope = Boolean(sessionId || groupId);
   try {
     let config = await loadConfig(options.config);
+    if (options.config !== void 0 && !checkConfigHasEffect(config)) {
+      result = errorResult(
+        "AI_CHECK_CONFIG_NO_EFFECTIVE_RULES",
+        "Explicit --config has no effective check rules. Configure checks.select, checks.run, checks.tool, checks.llm, checks.structure, or checks.safety."
+      );
+      if (options.json) printJson(result);
+      else printHuman(result, options);
+      process.exitCode = exitCodeFor(result);
+      return;
+    }
     let effectiveOptions = options;
     const resolved = resolvePreset(options.preset, {
       hasToolRules: hasToolRulesConfigured(config, options)
@@ -6308,12 +6665,13 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
     }
   } catch (error) {
     if (phase === "config") {
-      const message = error instanceof Error ? error.message : String(error);
-      const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
-      result = errorResult(
-        code,
-        message
-      );
+      if (error instanceof CheckConfigError) {
+        result = errorResult(error.code, error.message);
+      } else {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
+        result = errorResult(code, message);
+      }
     } else {
       result = readErrorResult(error);
     }
@@ -7235,6 +7593,42 @@ function startViewerServer(options = {}) {
     });
   });
 }
+function openInDefaultBrowser(target) {
+  const platform = process.platform;
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", target] : [target];
+  return new Promise((resolve) => {
+    try {
+      const child = spawn(command, args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: platform === "win32"
+      });
+      child.once("spawn", () => {
+        try {
+          child.unref();
+          resolve({ ok: true });
+        } catch (error) {
+          resolve({
+            ok: false,
+            detail: error instanceof Error ? error.message : String(error)
+          });
+        }
+      });
+      child.once("error", (error) => {
+        resolve({
+          ok: false,
+          detail: error instanceof Error ? error.message : String(error)
+        });
+      });
+    } catch (error) {
+      resolve({
+        ok: false,
+        detail: error instanceof Error ? error.message : String(error)
+      });
+    }
+  });
+}
 
 // packages/cli/src/serve.ts
 function parsePort(value) {
@@ -7264,9 +7658,11 @@ async function serveCommand(options = {}) {
   if (options.open === true && host !== "127.0.0.1" && host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
   } else if (options.open === true) {
-    const openMod = await import('child_process');
-    openMod.exec(`open ${info.url}`, () => {
-    });
+    const opened = await openInDefaultBrowser(info.url);
+    if (!opened.ok) {
+      console.warn("Viewer started, but the browser could not be opened automatically.");
+      console.warn(`Open manually: ${info.url}`);
+    }
   }
   await new Promise(() => {
   });
@@ -7425,9 +7821,11 @@ async function studioCommand(options = {}) {
   if (options.open === true && info.host !== "127.0.0.1" && info.host !== "localhost") {
     console.warn("Skipping browser open for non-local host binding.");
   } else if (options.open === true) {
-    const openMod = await import('child_process');
-    openMod.exec(`open ${info.url}`, () => {
-    });
+    const opened = await openInDefaultBrowser(info.url);
+    if (!opened.ok) {
+      console.warn("Studio started, but the browser could not be opened automatically.");
+      console.warn(`Open manually: ${info.url}`);
+    }
   }
   await new Promise(() => {
   });
@@ -8186,7 +8584,7 @@ function asStringArray2(value, label) {
   }
   return value;
 }
-function asConfig2(value) {
+function asConfig(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) {
     throw new Error("Config must export an object.");
@@ -8207,10 +8605,10 @@ async function loadConfig2(configPath) {
   const absolute = path18.resolve(configPath);
   if (extension === ".json") {
     const raw = await readFile(absolute, "utf-8");
-    return asConfig2(JSON.parse(raw));
+    return asConfig(JSON.parse(raw));
   }
   const mod = await import(pathToFileURL(absolute).href);
-  return asConfig2("default" in mod ? mod.default : mod);
+  return asConfig("default" in mod ? mod.default : mod);
 }
 function normalizeConfig2(config) {
   if (config.eval === void 0) return {};
@@ -9715,33 +10113,6 @@ async function resolveHtmlPath(root) {
     `No evidence.html found under ${root}. Pass a bundle directory or .html path.`
   );
 }
-function openLocalFile(filePath) {
-  const fileUrl = pathToFileURL(filePath).href;
-  const platform = process.platform;
-  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "darwin" ? [filePath] : platform === "win32" ? ["/c", "start", "", filePath] : [filePath];
-  return new Promise((resolve) => {
-    try {
-      const child = spawn(command, args, {
-        detached: true,
-        stdio: "ignore"
-      });
-      child.on("error", (error) => {
-        resolve({
-          ok: false,
-          detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
-        });
-      });
-      child.unref();
-      resolve({ ok: true, detail: fileUrl });
-    } catch (error) {
-      resolve({
-        ok: false,
-        detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
-      });
-    }
-  });
-}
 async function bundleOpenCommand(targetPath, options = {}) {
   const root = path18.resolve(targetPath.trim() || ".");
   try {
@@ -9811,23 +10182,24 @@ async function bundleOpenCommand(targetPath, options = {}) {
     await readFile(path18.join(path18.dirname(htmlPath), "evidence.json"), "utf-8");
   } catch {
   }
-  const opened = await openLocalFile(htmlPath);
+  const fileUrl = pathToFileURL(htmlPath).href;
+  const opened = await openInDefaultBrowser(fileUrl);
   if (options.json) {
     console.log(
       writeJson6({
         ok: opened.ok,
         path: htmlPath,
         opened: opened.ok,
-        detail: opened.detail
+        detail: opened.ok ? fileUrl : `${opened.detail ?? "unknown error"}; open manually: ${fileUrl}`
       }).trimEnd()
     );
   } else if (opened.ok) {
     console.log(`Opened local Evidence: ${htmlPath}`);
-    console.log(`URL: ${opened.detail}`);
+    console.log(`URL: ${fileUrl}`);
   } else {
     console.error(`[AgentInspect] Could not open browser automatically.`);
     console.error(`Open this file locally: ${htmlPath}`);
-    console.error(opened.detail);
+    console.error(`${opened.detail ?? "unknown error"}; open manually: ${fileUrl}`);
   }
   if (!opened.ok) {
     process.exitCode = 0;
@@ -11260,7 +11632,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-X6SLMBNH.mjs');
+    return await import('./src-OYGG7QAZ.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(