agent-inspect 6.26.0 → 6.28.0

package/packages/core/dist/advanced.mjs

@@ -1,5 +1,5 @@
-import { extractSessionWorkflowMetadata, sessionKeyForRun, runTraceChecks, createRunStatusRule, createToolUsageRule, createRunDurationRule, createLlmUsageRule, createObservedOutcomeRule } from './chunk-LHSXRIYU.mjs';
-export { extractSessionWorkflowMetadata, sessionKeyForRun } from './chunk-LHSXRIYU.mjs';
+import { extractSessionWorkflowMetadata, sessionKeyForRun, defineTraceContract, runTraceChecks, createRunStatusRule, createToolUsageRule, createRunDurationRule, createLlmUsageRule, createObservedOutcomeRule } from './chunk-ME4WXYY3.mjs';
+export { extractSessionWorkflowMetadata, sessionKeyForRun } from './chunk-ME4WXYY3.mjs';
 export { MAX_TERMINAL_DEPTH, MAX_TERMINAL_NAME_LENGTH, TERMINAL_INDENT, TraceDirectory, createInspector, createInspectorRuntime, formatTerminalName, getCurrentContext, getCurrentCorrelationMetadata, getCurrentDepth, getCurrentRunId, getCurrentRunName, getCurrentStepId, getIndent, getParentStepId, getTraceDirFromContext, getTraceSafetyFromContext, hasActiveContext, isAgentInspectEnabled, isSilentContext, maybeInspectRun, printError, printFailedAt, printRunComplete, printRunStart, printStepComplete, printStepStart, renderErrorLine, renderRunSummary, renderStepLine, resolveTraceDir, runWithContext, runWithStepContext } from './chunk-WGDSM37E.mjs';
 import { buildRunTimeline, filterTraces, extractMetadata, buildRunSummary } from './chunk-JBNRJLIV.mjs';
 export { buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildTraceStats, extractMetadata, filterTraces, formatStepLabel, renderRunWhat, renderTimeline, renderTraceStats } from './chunk-JBNRJLIV.mjs';
@@ -22,7 +22,7 @@ import { persistedInspectEventsToTraceEvents } from './chunk-P366CCL2.mjs';
 import './chunk-7TGZLWEE.mjs';
 import { createReadStream } from 'fs';
 import { createInterface } from 'readline';
-import path from 'path';
+import path3 from 'path';
 import { createHash } from 'crypto';
 import { stat, readFile, access, readdir } from 'fs/promises';
 import { pathToFileURL } from 'url';
@@ -1719,7 +1719,7 @@ function buildBundleSummaryMarkdown(parts) {
 }
 function sanitizeBundleRunId(runId) {
   let safe = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
-  safe = path.basename(safe);
+  safe = path3.basename(safe);
   safe = safe.replace(/[^a-zA-Z0-9._-]+/g, "_");
   if (safe === "" || safe === "." || safe === "..") {
     safe = "run_unknown";
@@ -1729,12 +1729,12 @@ function sanitizeBundleRunId(runId) {
 function bundleRunAssetRelativePath(runId, extension) {
   const safe = sanitizeBundleRunId(runId);
   const ext = extension.startsWith(".") ? extension : `.${extension}`;
-  return path.posix.join("assets", "runs", `${safe}${ext}`);
+  return path3.posix.join("assets", "runs", `${safe}${ext}`);
 }
 function assertBundlePathContained(outputDir, relativePath) {
-  const base = path.resolve(outputDir);
-  const resolved = path.resolve(base, relativePath);
-  if (resolved !== base && !resolved.startsWith(base + path.sep)) {
+  const base = path3.resolve(outputDir);
+  const resolved = path3.resolve(base, relativePath);
+  if (resolved !== base && !resolved.startsWith(base + path3.sep)) {
     throw new Error(`Bundle path escapes output directory: ${relativePath}`);
   }
   return resolved;
@@ -1744,7 +1744,7 @@ function normalizeBundleOutputPath(out, options) {
   if (trimmed === "") {
     throw new Error("--out requires a non-empty path.");
   }
-  const resolved = path.resolve(trimmed);
+  const resolved = path3.resolve(trimmed);
   if (options?.preserveZipExtension !== true && resolved.toLowerCase().endsWith(".zip")) {
     return resolved.slice(0, -4);
   }
@@ -1753,13 +1753,14 @@ function normalizeBundleOutputPath(out, options) {
 function defaultBundleOutputPath(runIds) {
   const label = runIds.length === 1 ? sanitizeBundleRunId(runIds[0]) : `multi-${runIds.length}`;
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  return path.resolve(`agent-inspect-bundle-${label}-${stamp}`);
+  return path3.resolve(`agent-inspect-bundle-${label}-${stamp}`);
 }
 
 // packages/core/src/evidence/types.ts
 var EVIDENCE_FORMAT_VERSION = "1.0";
 var EVIDENCE_ASSESSMENT_NOTE = "Best-effort local safety verification only; not a compliance certification.";
 var EVIDENCE_MANIFEST_FILENAME = "evidence.json";
+var EVIDENCE_RESOLVED_CONTRACT_FILENAME = "contract.resolved.json";
 var SHA256_RE = /^[a-f0-9]{64}$/i;
 function sha256Hex(data) {
   const hash = createHash("sha256");
@@ -1791,7 +1792,7 @@ function assertEvidenceRelativePath(relativePath) {
     throw new Error("Evidence file path must be a non-empty relative path.");
   }
   const trimmed = relativePath.trim().replaceAll("\\", "/");
-  if (path.isAbsolute(trimmed) || trimmed.startsWith("/")) {
+  if (path3.isAbsolute(trimmed) || trimmed.startsWith("/")) {
     throw new Error(`Evidence file path must be relative: ${relativePath}`);
   }
   const parts = trimmed.split("/").filter((part) => part !== "");
@@ -1831,6 +1832,9 @@ function inferEvidenceFileRole(relativePath) {
   if (base === "check-results.json") {
     return "checks";
   }
+  if (base === "contract.resolved.json") {
+    return "contract";
+  }
   if (base === "redaction-report.json") {
     return "redaction-report";
   }
@@ -1897,6 +1901,7 @@ function buildEvidenceManifest(parts) {
     },
     assessment,
     ...parts.semantics !== void 0 ? { semantics: { ...parts.semantics } } : {},
+    ...parts.contract !== void 0 ? { contract: { ...parts.contract } } : {},
     files: buildEvidenceFileEntries(parts.files)
   };
 }
@@ -1980,6 +1985,284 @@ function collectTraceSchemaVersions(jsonl) {
   return [...versions].sort((a, b) => a.localeCompare(b));
 }
 
+// packages/core/src/evidence/contract-binding.ts
+var EVIDENCE_CONTRACT_CANONICALIZATION_VERSION = "1";
+var EVIDENCE_CONTRACT_PARTIAL_NOTE = "Custom or programmatic rules are not serializable; Evidence records rule IDs only and does not claim complete reviewer replay.";
+var EVIDENCE_CONTRACT_UNAVAILABLE_NOTE = "No resolved TraceContract or check preset was packaged with this Evidence artifact.";
+var EVIDENCE_CONTRACT_ASSURANCE_NOTE = "Contract binding verifies packaged digest integrity only; it does not prove producer identity, trusted time, source completeness, semantic truth, or external acceptance.";
+function serializeCanonicalJson(value) {
+  return `${JSON.stringify(stableValue(value), null, 2)}
+`;
+}
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (value === null || typeof value !== "object") return value;
+  if (typeof value === "function") return void 0;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).filter((key) => record[key] !== void 0 && typeof record[key] !== "function").sort((a, b) => a.localeCompare(b)).map((key) => [key, stableValue(record[key])])
+  );
+}
+function sortedUniqueStrings(values) {
+  return [...new Set(values.map((item) => item.trim()).filter((item) => item !== ""))].sort(
+    (a, b) => a.localeCompare(b)
+  );
+}
+function resolveSerializableTraceContract(input) {
+  const defined = defineTraceContract(input);
+  const tools = defined.tools ? {
+    ...defined.tools,
+    required: sortedUniqueStrings([
+      ...defined.tools.required ?? [],
+      ...defined.tools.requiredTools ?? []
+    ]),
+    forbidden: sortedUniqueStrings([
+      ...defined.tools.forbidden ?? [],
+      ...defined.tools.forbiddenTools ?? []
+    ]),
+    ...defined.tools.allowed ? { allowed: sortedUniqueStrings(defined.tools.allowed) } : {},
+    ...defined.tools.requiredOrder ? {
+      requiredOrder: [...defined.tools.requiredOrder],
+      requiredOrderMode: defined.tools.requiredOrderMode ?? "first-occurrence"
+    } : {}
+  } : void 0;
+  if (tools) {
+    delete tools.requiredTools;
+    delete tools.forbiddenTools;
+    if (tools.required?.length === 0) delete tools.required;
+    if (tools.forbidden?.length === 0) delete tools.forbidden;
+  }
+  const run = defined.run ? {
+    ...defined.run,
+    // Evaluator default: requireCompleted is true unless explicitly false.
+    requireCompleted: defined.run.requireCompleted !== false
+  } : void 0;
+  return {
+    ...defined,
+    ...run ? { run } : {},
+    ...tools && Object.keys(tools).length > 0 ? { tools } : {}
+  };
+}
+function collectResolvedContractRuleIds(contract) {
+  const ids = [];
+  if (contract.run) {
+    if (contract.run.allowedStatuses?.length) ids.push("contract.run.allowedStatuses");
+    if (contract.run.requireCompleted === true) ids.push("run.requireCompleted");
+    if (contract.run.maxDurationMs !== void 0) ids.push("run.duration");
+  }
+  if (contract.tools) {
+    if ((contract.tools.required?.length ?? 0) > 0 || (contract.tools.forbidden?.length ?? 0) > 0 || contract.tools.allowed || contract.tools.maxCalls !== void 0) {
+      ids.push("tool.usage");
+    }
+    if (contract.tools.requiredOrder?.length) {
+      for (let i = 0; i < contract.tools.requiredOrder.length - 1; i += 1) {
+        ids.push(`contract.tool.order.${i}`);
+      }
+    }
+    if (contract.tools.orderRules?.length) {
+      for (let index = 0; index < contract.tools.orderRules.length; index += 1) {
+        ids.push(`contract.tool.orderRule.${index}`);
+      }
+    }
+    if (contract.tools.arguments?.length) ids.push("contract.tool.arguments");
+  }
+  if (contract.llm) ids.push("llm.usage");
+  if (contract.observations?.required?.length) ids.push("contract.observation.required");
+  if (contract.observations?.failOn?.length) ids.push("outcome.status");
+  if (contract.observations?.requireProvenance) ids.push("contract.observation.provenance");
+  if (contract.controls) ids.push("contract.controls");
+  if (contract.retry) ids.push("contract.retry");
+  if (contract.scope) ids.push("contract.scope.selected");
+  if (contract.alternatives?.anyOf?.length) ids.push("contract.alternatives.anyOf");
+  return sortedUniqueStrings(ids);
+}
+function buildUnavailablePackage(engineVersion, note) {
+  const binding = {
+    status: "unavailable",
+    source: "programmatic",
+    canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+    engineVersion,
+    ruleIds: [],
+    note: note ?? EVIDENCE_CONTRACT_UNAVAILABLE_NOTE
+  };
+  return {
+    binding,
+    checkBinding: {
+      canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+      engineVersion,
+      evaluatedRuleIds: [],
+      bindingStatus: "unavailable"
+    }
+  };
+}
+function buildEvidenceContractPackage(input) {
+  const unsupported = sortedUniqueStrings(input.unsupportedRuleIds ?? []);
+  const hasContract = input.contract !== void 0;
+  const hasPreset = input.preset !== void 0;
+  if (!hasContract && !hasPreset) {
+    return buildUnavailablePackage(input.engineVersion, input.note);
+  }
+  let kind = "trace-contract";
+  let resolved;
+  let ruleIds;
+  if (hasContract) {
+    const normalized = resolveSerializableTraceContract(input.contract);
+    resolved = stableValue(normalized);
+    ruleIds = collectResolvedContractRuleIds(normalized);
+  } else {
+    kind = "check-preset";
+    resolved = stableValue(input.preset.resolved);
+    const select = Array.isArray(input.preset.resolved.select) ? input.preset.resolved.select.filter(
+      (item) => typeof item === "string"
+    ) : [];
+    ruleIds = sortedUniqueStrings(select);
+  }
+  if (input.ruleIds !== void 0) {
+    ruleIds = sortedUniqueStrings(input.ruleIds);
+  }
+  if (unsupported.length > 0) {
+    ruleIds = sortedUniqueStrings([...ruleIds, ...unsupported]);
+  }
+  const document = {
+    canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+    kind,
+    resolved,
+    origin: {
+      source: input.source,
+      ...input.preset?.name ? { preset: input.preset.name } : {},
+      ...input.path !== void 0 && input.path.trim() !== "" ? { path: input.path.trim() } : {}
+    }
+  };
+  const resolvedJson = serializeCanonicalJson(document);
+  const digest = sha256Hex(resolvedJson);
+  const status = unsupported.length > 0 ? "partial" : "complete";
+  const binding = {
+    status,
+    source: input.source,
+    ...input.contractId !== void 0 ? { contractId: input.contractId } : {},
+    ...input.contractVersion !== void 0 ? { contractVersion: input.contractVersion } : {},
+    canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+    engineVersion: input.engineVersion,
+    path: EVIDENCE_RESOLVED_CONTRACT_FILENAME,
+    sha256: digest,
+    ruleIds,
+    ...unsupported.length > 0 ? { unsupportedRuleIds: unsupported } : {},
+    note: input.note ?? (status === "partial" ? EVIDENCE_CONTRACT_PARTIAL_NOTE : EVIDENCE_CONTRACT_ASSURANCE_NOTE)
+  };
+  const checkBinding = {
+    contractDigest: digest,
+    canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+    engineVersion: input.engineVersion,
+    evaluatedRuleIds: ruleIds,
+    bindingStatus: status,
+    ...input.preset?.name ? {
+      origin: {
+        source: input.source,
+        preset: input.preset.name
+      }
+    } : {
+      origin: {
+        source: input.source
+      }
+    },
+    ...unsupported.length > 0 ? { unsupportedRuleIds: unsupported } : {}
+  };
+  return {
+    file: {
+      path: EVIDENCE_RESOLVED_CONTRACT_FILENAME,
+      content: resolvedJson,
+      role: "contract"
+    },
+    binding,
+    checkBinding,
+    resolvedJson
+  };
+}
+function bindCheckResultsToContract(checkResults, checkBinding) {
+  return {
+    ...checkResults,
+    contract: {
+      ...checkBinding
+    }
+  };
+}
+function serializeCheckResultsJson(value) {
+  return serializeCanonicalJson(value);
+}
+function readCheckResultsContractBinding(checkResultsJson) {
+  try {
+    const parsed = JSON.parse(checkResultsJson);
+    if (parsed.contract === null || typeof parsed.contract !== "object" || Array.isArray(parsed.contract)) {
+      return void 0;
+    }
+    return parsed.contract;
+  } catch {
+    return void 0;
+  }
+}
+function verifyEvidenceContractBinding(parts) {
+  const issues = [];
+  const binding = parts.binding;
+  if (binding === void 0) return issues;
+  if (binding.canonicalizationVersion !== EVIDENCE_CONTRACT_CANONICALIZATION_VERSION) {
+    issues.push({
+      code: "contract_binding_invalid",
+      severity: "error",
+      message: `Unsupported contract canonicalizationVersion: ${String(binding.canonicalizationVersion)}`
+    });
+  }
+  if (binding.status === "unavailable") {
+    if (binding.path !== void 0 || binding.sha256 !== void 0) {
+      issues.push({
+        code: "contract_binding_invalid",
+        severity: "error",
+        message: "unavailable contract binding must not reference a packaged contract file."
+      });
+    }
+    return issues;
+  }
+  const expectedPath = binding.path ?? EVIDENCE_RESOLVED_CONTRACT_FILENAME;
+  if (parts.resolvedContractBytes === void 0) {
+    issues.push({
+      code: "contract_file_missing",
+      severity: "error",
+      message: `Referenced contract file missing: ${expectedPath}`,
+      path: expectedPath
+    });
+    return issues;
+  }
+  const actual = sha256Hex(parts.resolvedContractBytes);
+  if (binding.sha256 !== void 0 && !sha256Equals(binding.sha256, actual)) {
+    issues.push({
+      code: "contract_hash_mismatch",
+      severity: "error",
+      message: `SHA-256 mismatch for ${expectedPath}`,
+      path: expectedPath
+    });
+  }
+  if (parts.checkResultsJson !== void 0) {
+    const checkBinding = readCheckResultsContractBinding(parts.checkResultsJson);
+    if (checkBinding?.contractDigest !== void 0 && binding.sha256 !== void 0) {
+      if (!sha256Equals(checkBinding.contractDigest, binding.sha256)) {
+        issues.push({
+          code: "contract_digest_mismatch",
+          severity: "error",
+          message: "check-results.json contractDigest does not match evidence.json contract.sha256.",
+          path: "check-results.json"
+        });
+      }
+    } else if (binding.status === "complete" || binding.status === "partial") {
+      issues.push({
+        code: "contract_digest_mismatch",
+        severity: "error",
+        message: "check-results.json is missing contract.contractDigest for a packaged contract binding.",
+        path: "check-results.json"
+      });
+    }
+  }
+  return issues;
+}
+
 // packages/core/src/evidence/views.ts
 function renderTreeHtml(nodes, ulClass = "tree") {
   if (nodes.length === 0) return "";
@@ -2654,11 +2937,11 @@ async function listFilesRecursive(root) {
   async function walk(dir) {
     const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const abs = path.join(dir, entry.name);
+      const abs = path3.join(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(abs);
       } else if (entry.isFile()) {
-        const rel = path.relative(root, abs).split(path.sep).join("/");
+        const rel = path3.relative(root, abs).split(path3.sep).join("/");
         out.push(rel);
       }
     }
@@ -2668,7 +2951,7 @@ async function listFilesRecursive(root) {
 }
 async function verifyEvidenceDirectory(rootPath, options = {}) {
   const unexpectedMode = options.unexpectedFiles ?? "fail";
-  const root = path.resolve(rootPath);
+  const root = path3.resolve(rootPath);
   const issues = [];
   let rootStat;
   try {
@@ -2698,7 +2981,7 @@ async function verifyEvidenceDirectory(rootPath, options = {}) {
       checkedFiles: 0
     };
   }
-  const manifestPath = path.join(root, EVIDENCE_MANIFEST_FILENAME);
+  const manifestPath = path3.join(root, EVIDENCE_MANIFEST_FILENAME);
   let manifestText;
   try {
     manifestText = await readFile(manifestPath, "utf-8");
@@ -2784,7 +3067,7 @@ async function verifyEvidenceDirectory(rootPath, options = {}) {
       continue;
     }
     listed.add(rel);
-    const abs = path.join(root, ...rel.split("/"));
+    const abs = path3.join(root, ...rel.split("/"));
     let bytes;
     try {
       bytes = await readFile(abs);
@@ -2825,6 +3108,28 @@ async function verifyEvidenceDirectory(rootPath, options = {}) {
       path: rel
     });
   }
+  if (manifest.contract !== void 0) {
+    const contractRel = manifest.contract.path ?? EVIDENCE_RESOLVED_CONTRACT_FILENAME;
+    let resolvedBytes;
+    try {
+      resolvedBytes = await readFile(path3.join(root, ...contractRel.split("/")), "utf-8");
+    } catch {
+      resolvedBytes = void 0;
+    }
+    let checkResultsJson;
+    try {
+      checkResultsJson = await readFile(path3.join(root, "check-results.json"), "utf-8");
+    } catch {
+      checkResultsJson = void 0;
+    }
+    for (const issue of verifyEvidenceContractBinding({
+      binding: manifest.contract,
+      ...resolvedBytes !== void 0 ? { resolvedContractBytes: resolvedBytes } : {},
+      ...checkResultsJson !== void 0 ? { checkResultsJson } : {}
+    })) {
+      issues.push(issue);
+    }
+  }
   const hasError = issues.some((issue) => issue.severity === "error");
   return {
     ok: !hasError,
@@ -2881,10 +3186,33 @@ function buildEvidenceCiPackage(input) {
       }))
     }
   });
+  let checkResultsJson = input.checkResultsJson;
+  let contractBinding;
+  let contractFileContent;
+  if (input.contractPackage !== void 0) {
+    const packaged2 = buildEvidenceContractPackage({
+      ...input.contractPackage,
+      engineVersion: input.contractPackage.engineVersion || input.generatorVersion
+    });
+    contractBinding = packaged2.binding;
+    if (packaged2.resolvedJson !== void 0) {
+      contractFileContent = packaged2.resolvedJson;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(checkResultsJson);
+    } catch {
+      parsed = { raw: checkResultsJson };
+    }
+    checkResultsJson = serializeCheckResultsJson(
+      bindCheckResultsToContract(parsed, packaged2.checkBinding)
+    );
+  }
   const packaged = [
     { path: EVIDENCE_HTML_FILENAME, content: evidenceHtml },
-    { path: "check-results.json", content: input.checkResultsJson },
-    { path: "trace.jsonl", content: input.redactedTraceJsonl }
+    { path: "check-results.json", content: checkResultsJson },
+    { path: "trace.jsonl", content: input.redactedTraceJsonl },
+    ...contractFileContent !== void 0 ? [{ path: EVIDENCE_RESOLVED_CONTRACT_FILENAME, content: contractFileContent }] : []
   ];
   const manifest = buildEvidenceManifest({
     generatorVersion: input.generatorVersion,
@@ -2898,13 +3226,15 @@ function buildEvidenceCiPackage(input) {
     files: packaged,
     createdAt,
     note: EVIDENCE_ASSESSMENT_NOTE,
-    ...input.semantics !== void 0 ? { semantics: input.semantics } : {}
+    ...input.semantics !== void 0 ? { semantics: input.semantics } : {},
+    ...contractBinding !== void 0 ? { contract: contractBinding } : {}
   });
   return {
     "evidence.html": evidenceHtml,
     "evidence.json": serializeEvidenceManifest(manifest),
-    "check-results.json": input.checkResultsJson,
+    "check-results.json": checkResultsJson,
     "trace.jsonl": input.redactedTraceJsonl,
+    ...contractFileContent !== void 0 ? { [EVIDENCE_RESOLVED_CONTRACT_FILENAME]: contractFileContent } : {},
     manifest
   };
 }
@@ -3060,7 +3390,7 @@ function normalizeSuiteConfig(value) {
 }
 async function validateSuiteConfig(config, options) {
   const diagnostics = [];
-  const tracesDir = path.resolve(options.configDir, config.traces);
+  const tracesDir = path3.resolve(options.configDir, config.traces);
   try {
     await access(tracesDir);
   } catch {
@@ -3070,7 +3400,7 @@ async function validateSuiteConfig(config, options) {
   }
   for (const suiteCase of config.cases) {
     if (suiteCase.input !== void 0) {
-      const inputPath = path.resolve(options.configDir, suiteCase.input);
+      const inputPath = path3.resolve(options.configDir, suiteCase.input);
       try {
         await access(inputPath);
       } catch {
@@ -3103,12 +3433,12 @@ async function fileExists(filePath) {
   }
 }
 async function resolveSuiteConfigPath(options = {}) {
-  const cwd = path.resolve(options.cwd ?? process.cwd());
+  const cwd = path3.resolve(options.cwd ?? process.cwd());
   if (options.configPath !== void 0 && options.configPath.trim() !== "") {
-    return path.resolve(cwd, options.configPath.trim());
+    return path3.resolve(cwd, options.configPath.trim());
   }
   for (const name of DEFAULT_SUITE_CONFIG_NAMES) {
-    const candidate = path.join(cwd, name);
+    const candidate = path3.join(cwd, name);
     if (await fileExists(candidate)) return candidate;
   }
   throw new Error(
@@ -3125,7 +3455,7 @@ async function loadSuiteConfig(options = {}) {
       diagnostics: [diagnostic2("AI_SUITE_CONFIG_LOAD_FAILED", message)]
     });
   }
-  const extension = path.extname(configPath);
+  const extension = path3.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
     const message = "TypeScript suite configs require an explicit precompiled JavaScript config or future --config-loader support.";
     throw Object.assign(new Error(message), {
@@ -3150,7 +3480,7 @@ async function loadSuiteConfig(options = {}) {
     return {
       config,
       configPath,
-      configDir: path.dirname(configPath)
+      configDir: path3.dirname(configPath)
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -3191,7 +3521,7 @@ async function exists(filePath) {
 }
 async function resolveSuiteCaseTrace(suiteCase, options) {
   if (suiteCase.trace !== void 0) {
-    const tracePath = path.resolve(options.configDir, suiteCase.trace);
+    const tracePath = path3.resolve(options.configDir, suiteCase.trace);
     if (await exists(tracePath)) {
       return { caseId: suiteCase.id, tracePath, missing: false };
     }
@@ -3207,7 +3537,7 @@ async function resolveSuiteCaseTrace(suiteCase, options) {
   if (await exists(directPath)) {
     return { caseId: suiteCase.id, tracePath: directPath, runId: runKey, missing: false };
   }
-  const nestedPath = path.join(options.tracesDir, `${path.basename(runKey)}.jsonl`);
+  const nestedPath = path3.join(options.tracesDir, `${path3.basename(runKey)}.jsonl`);
   if (await exists(nestedPath)) {
     return { caseId: suiteCase.id, tracePath: nestedPath, runId: runKey, missing: false };
   }
@@ -3385,7 +3715,7 @@ async function runSuiteCase(suiteCase, config, options) {
 async function runSuite(options = {}) {
   const startedAt = new Date(options.nowMs ?? Date.now()).toISOString();
   const { config, configPath, configDir } = await loadSuiteConfig(options);
-  const tracesDir = path.resolve(configDir, config.traces);
+  const tracesDir = path3.resolve(configDir, config.traces);
   const cases = [];
   const diagnostics = [];
   for (const suiteCase of config.cases) {
@@ -4340,7 +4670,7 @@ function validateOptions(options) {
 }
 function isConfigLoadError(error) {
   if (!(error instanceof Error)) return false;
-  const ext = path.extname(error.message);
+  const ext = path3.extname(error.message);
   if (error.message.includes("Unsupported suite config extension")) return true;
   if (error.message.includes("TypeScript suite configs require")) return true;
   if (error.message.includes("No suite config found")) return true;
@@ -4582,6 +4912,6 @@ function createOmittedPayloadCommitment(payload, options = {}) {
   };
 }
 
-export { ADAPTER_CAPTURE_DIAGNOSTIC_CODES, COHORT_METRIC_IDS, DEFAULT_ADAPTER_MAX_PREVIEW_CHARS, DEFAULT_SUITE_ARTIFACTS_DIR, DEFAULT_SUITE_CONFIG_NAMES, EVIDENCE_ASSESSMENT_NOTE, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, EVIDENCE_VIEW_CSS, EVIDENCE_VIEW_IDS, OMITTED_PAYLOAD_MAX_DIGEST_INPUT_BYTES, SESSION_WORKFLOW_KEYS, SUITE_TEMPLATE_IDS, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceFileEntries, buildEvidenceHtmlShell, buildEvidenceHtmlShellFromManifest, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildSessionIndex, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compareCohortAggregates, createAdapterPreviewCapture, createOmittedPayloadCommitment, defaultBundleOutputPath, defaultSuiteConfigTemplate, deriveSessionStatus, encodeEmbeddedEvidenceJson, enrichSessionRunRecord, enrichSessionSummary, filterMetasBySessionScope, findFirstCausalFailure, gateHasThresholds, getSuiteTemplate, groupSessionCohorts, inferEvidenceFileRole, isAgentInspectTrace, isSha256Hex, listSuiteTemplates, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, normalizeBundleOutputPath, normalizeSuiteConfig, omittedPayloadByteLength, parseCohortMetricList, parseDurationFilter, parseEvidenceManifestJson, parseGateList, parseGateNumber, parseGroupBySpec, renderActivitySummaryHuman, renderCohortReport, renderCohortSummaryMarkdown, renderGateGithubAnnotations, renderGateGithubStepSummary, renderGateJUnit, renderGateReport, renderGateSummaryMarkdown, renderSuiteReport, renderSuiteReportMarkdown, resolveAdapterMaxPreviewChars, resolveBundleRunIds, resolveSuiteCaseTrace, resolveSuiteConfigPath, resolveSuiteTemplate, runGate, runSuite, sanitizeBundleRunId, searchTraces, serializeAdapterPreview, serializeEvidenceManifest, sha256Equals, sha256Hex, toMetadataSafeStatus, traceMetasToSessionRunRecords, validateEvidenceManifest, validateSuiteConfig, verifyEvidenceDirectory };
+export { ADAPTER_CAPTURE_DIAGNOSTIC_CODES, COHORT_METRIC_IDS, DEFAULT_ADAPTER_MAX_PREVIEW_CHARS, DEFAULT_SUITE_ARTIFACTS_DIR, DEFAULT_SUITE_CONFIG_NAMES, EVIDENCE_ASSESSMENT_NOTE, EVIDENCE_CONTRACT_ASSURANCE_NOTE, EVIDENCE_CONTRACT_CANONICALIZATION_VERSION, EVIDENCE_CONTRACT_PARTIAL_NOTE, EVIDENCE_CONTRACT_UNAVAILABLE_NOTE, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, EVIDENCE_RESOLVED_CONTRACT_FILENAME, EVIDENCE_VIEW_CSS, EVIDENCE_VIEW_IDS, OMITTED_PAYLOAD_MAX_DIGEST_INPUT_BYTES, SESSION_WORKFLOW_KEYS, SUITE_TEMPLATE_IDS, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, assertBundlePathContained, assertEvidenceRelativePath, bindCheckResultsToContract, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractPackage, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceFileEntries, buildEvidenceHtmlShell, buildEvidenceHtmlShellFromManifest, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildSessionIndex, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectResolvedContractRuleIds, collectTraceSchemaVersions, compareCohortAggregates, createAdapterPreviewCapture, createOmittedPayloadCommitment, defaultBundleOutputPath, defaultSuiteConfigTemplate, deriveSessionStatus, encodeEmbeddedEvidenceJson, enrichSessionRunRecord, enrichSessionSummary, filterMetasBySessionScope, findFirstCausalFailure, gateHasThresholds, getSuiteTemplate, groupSessionCohorts, inferEvidenceFileRole, isAgentInspectTrace, isSha256Hex, listSuiteTemplates, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, normalizeBundleOutputPath, normalizeSuiteConfig, omittedPayloadByteLength, parseCohortMetricList, parseDurationFilter, parseEvidenceManifestJson, parseGateList, parseGateNumber, parseGroupBySpec, readCheckResultsContractBinding, renderActivitySummaryHuman, renderCohortReport, renderCohortSummaryMarkdown, renderGateGithubAnnotations, renderGateGithubStepSummary, renderGateJUnit, renderGateReport, renderGateSummaryMarkdown, renderSuiteReport, renderSuiteReportMarkdown, resolveAdapterMaxPreviewChars, resolveBundleRunIds, resolveSerializableTraceContract, resolveSuiteCaseTrace, resolveSuiteConfigPath, resolveSuiteTemplate, runGate, runSuite, sanitizeBundleRunId, searchTraces, serializeAdapterPreview, serializeCanonicalJson, serializeCheckResultsJson, serializeEvidenceManifest, sha256Equals, sha256Hex, toMetadataSafeStatus, traceMetasToSessionRunRecords, validateEvidenceManifest, validateSuiteConfig, verifyEvidenceContractBinding, verifyEvidenceDirectory };
 //# sourceMappingURL=advanced.mjs.map
 //# sourceMappingURL=advanced.mjs.map