agent-inspect 6.29.4 → 6.29.5

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, truncateStringForProfile, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, diffRuns, manualTraceEventsToComparableRun } from './chunk-FJRUJSST.mjs';
+import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, truncateStringForProfile, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, diffRuns, manualTraceEventsToComparableRun } from './chunk-XWQEHKGB.mjs';
 import { realpathSync, constants as constants$1, existsSync, readFileSync } from 'fs';
 import path19 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -13,7 +13,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.29.4";
+var version = "6.29.5";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -3397,7 +3397,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-GZQVDREP.mjs');
+    const mod = await import('./src-XNC4EUN3.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -5959,12 +5959,22 @@ function open2(ruleId, message, evidence, severity = "error") {
   };
 }
 function isToolEvent(event) {
+  const kind = typeof event.kind === "string" ? event.kind.toLowerCase() : "";
+  if (kind === "tool") return true;
+  if (kind === "llm" || kind === "run" || kind === "agent" || kind === "logic" || kind === "log" || kind === "outcome" || kind === "chain" || kind === "retriever" || kind === "decision" || kind === "result" || kind === "error") {
+    return false;
+  }
   const name = event.name.toLowerCase();
-  return event.kind === "tool" || name.startsWith("tool:") || name.startsWith("function:") || name.includes(".tool.") || name.startsWith("mcp:");
+  return name.startsWith("tool:") || name.startsWith("function:") || name.includes(".tool.") || name.startsWith("mcp:");
 }
 function isLlmEvent(event) {
+  const kind = typeof event.kind === "string" ? event.kind.toLowerCase() : "";
+  if (kind === "llm") return true;
+  if (kind === "tool" || kind === "run" || kind === "agent" || kind === "logic" || kind === "log" || kind === "outcome" || kind === "chain" || kind === "retriever" || kind === "decision" || kind === "result" || kind === "error") {
+    return false;
+  }
   const name = event.name.toLowerCase();
-  return event.kind === "llm" || name.startsWith("llm:") || name.includes(".llm.") || name.includes("generation");
+  return name.startsWith("llm:") || name.includes(".llm.") || name.includes("generation");
 }
 function toolLabel(event) {
   const attrs = event.attributes ?? {};
@@ -6409,6 +6419,14 @@ var CIRCUIT_ALIASES = {
   "runaway-llm-loop": "circuit.runaway-llm-loop",
   "excessive-branch-width": "circuit.excessive-branch-width"
 };
+var KNOWN_CIRCUIT_RULES = /* @__PURE__ */ new Set([
+  ...Object.values(CIRCUIT_ALIASES),
+  ...ALL_RULES
+]);
+var KNOWN_GUARDRAIL_RULES = /* @__PURE__ */ new Set([
+  ...Object.values(GUARDRAIL_ALIASES),
+  ...ALL_RULES2
+]);
 function parseGuardrailRules(values) {
   if (!values?.length) return void 0;
   return values.map((value) => {
@@ -6471,16 +6489,21 @@ function eventToCircuit(event) {
     status: event.status
   };
 }
-function collectGuardrailInputs(read) {
+function scopedEvents(read, runId) {
+  if (runId === void 0) return [...read.events];
+  return read.events.filter((event) => event.runId === runId);
+}
+function collectGuardrailInputs(events) {
   const inputs = [];
-  for (const event of read.events) {
+  for (const event of events) {
     const attrs = event.attributes ?? {};
     for (const key of ["output", "answer", "text", "content", "message"]) {
       const value = attrs[key];
       if (typeof value === "string") inputs.push({ text: value });
       else if (value !== void 0) inputs.push({ value });
     }
-    if (event.kind === "TOOL" || event.name.startsWith("tool:")) {
+    const kind = typeof event.kind === "string" ? event.kind.toLowerCase() : "";
+    if (kind === "tool" || event.name.startsWith("tool:")) {
       inputs.push({
         toolName: String(attrs.toolName ?? attrs.tool ?? event.name),
         toolArgs: attrs.arguments ?? attrs.args ?? attrs.input
@@ -6489,6 +6512,21 @@ function collectGuardrailInputs(read) {
   }
   return inputs;
 }
+function classifyExtensionExecution(findings, errored) {
+  if (errored) return "error";
+  if (findings.some((finding) => finding.status === "fail")) return "fail";
+  if (findings.some((finding) => finding.status === "warning")) return "warning";
+  return "pass";
+}
+function extensionExecution(ruleId, findings, options) {
+  return {
+    ruleId,
+    category: "safety",
+    status: classifyExtensionExecution(findings, options.errored === true),
+    findingCount: findings.length,
+    ...options.runId !== void 0 ? { runId: options.runId } : {}
+  };
+}
 var DEFAULT_GUARDRAIL_OPTIONS = {
   bannedPhrase: { phrases: ["delete all data", "ignore all instructions"] },
   promptInjection: {},
@@ -6505,53 +6543,116 @@ var DEFAULT_CIRCUIT_OPTIONS = {
 };
 function mergeSafetyExtensions(result, read, options) {
   const findings = [...result.findings];
+  const ruleExecutions = [...result.ruleExecutions ?? []];
   let failed = result.summary.failed;
   let warnings = result.summary.warnings;
   let passed = result.summary.passed;
+  let errors = result.summary.errors;
+  const events = scopedEvents(read, options.runId);
+  const runId = options.runId;
   const guardrailRules = parseGuardrailRules(options.guardrails);
   if (guardrailRules) {
-    for (const input3 of collectGuardrailInputs(read)) {
-      const run = runGuardrails(input3, {
-        ...DEFAULT_GUARDRAIL_OPTIONS,
-        rules: guardrailRules
-      });
-      for (const item of run.results) {
-        const finding = guardrailFinding(item);
+    const inputs = collectGuardrailInputs(events);
+    for (const ruleId of guardrailRules) {
+      if (!KNOWN_GUARDRAIL_RULES.has(ruleId)) {
+        const finding = {
+          ruleId,
+          severity: "error",
+          status: "fail",
+          message: `Unknown guardrail rule: ${ruleId}.`,
+          evidence: []
+        };
         findings.push(finding);
-        if (finding.status === "fail") failed += 1;
-        else if (finding.status === "warning") warnings += 1;
-        else passed += 1;
+        failed += 1;
+        ruleExecutions.push(extensionExecution(ruleId, [finding], { runId, errored: true }));
+        errors += 1;
+        continue;
+      }
+      const ruleFindings = [];
+      if (inputs.length === 0) {
+        ruleExecutions.push(extensionExecution(ruleId, [], { runId }));
+        continue;
       }
+      for (const input3 of inputs) {
+        const run = runGuardrails(input3, {
+          ...DEFAULT_GUARDRAIL_OPTIONS,
+          rules: [ruleId]
+        });
+        for (const item of run.results) {
+          const finding = guardrailFinding(item);
+          ruleFindings.push(finding);
+          findings.push(finding);
+          if (finding.status === "fail") failed += 1;
+          else if (finding.status === "warning") warnings += 1;
+          else passed += 1;
+        }
+      }
+      ruleExecutions.push(extensionExecution(ruleId, ruleFindings, { runId }));
     }
   }
   const circuitRules = parseCircuitRules(options.circuits);
   if (circuitRules) {
-    const circuitRun = runCircuits(
-      read.events.map(eventToCircuit),
-      { ...DEFAULT_CIRCUIT_OPTIONS, rules: circuitRules }
-    );
-    for (const item of circuitRun.results) {
-      const finding = circuitFinding(item);
-      findings.push(finding);
-      if (finding.status === "fail") failed += 1;
-      else if (finding.status === "warning") warnings += 1;
-      else passed += 1;
+    const projected = projectLogicalEvents(events);
+    const circuitEvents = projected.logicalEvents.map(eventToCircuit);
+    for (const ruleId of circuitRules) {
+      if (!KNOWN_CIRCUIT_RULES.has(ruleId)) {
+        const finding = {
+          ruleId,
+          severity: "error",
+          status: "fail",
+          message: `Unknown circuit rule: ${ruleId}.`,
+          evidence: []
+        };
+        findings.push(finding);
+        failed += 1;
+        errors += 1;
+        ruleExecutions.push(extensionExecution(ruleId, [finding], { runId, errored: true }));
+        continue;
+      }
+      const circuitRun = runCircuits(circuitEvents, {
+        ...DEFAULT_CIRCUIT_OPTIONS,
+        rules: [ruleId]
+      });
+      if (circuitRun.results.length === 0) {
+        const finding = {
+          ruleId,
+          severity: "error",
+          status: "fail",
+          message: `Circuit rule ${ruleId} produced no evaluation result.`,
+          evidence: []
+        };
+        findings.push(finding);
+        failed += 1;
+        errors += 1;
+        ruleExecutions.push(extensionExecution(ruleId, [finding], { runId, errored: true }));
+        continue;
+      }
+      const ruleFindings = [];
+      for (const item of circuitRun.results) {
+        const finding = circuitFinding(item);
+        ruleFindings.push(finding);
+        findings.push(finding);
+        if (finding.status === "fail") failed += 1;
+        else if (finding.status === "warning") warnings += 1;
+        else passed += 1;
+      }
+      ruleExecutions.push(extensionExecution(ruleId, ruleFindings, { runId }));
     }
   }
-  const ok = failed === 0 && result.summary.errors === 0;
+  const status = result.status === "error" || errors > 0 ? "error" : failed > 0 ? "fail" : result.status;
   return {
     ...result,
-    ok,
-    status: failed > 0 ? "fail" : result.status,
+    ok: status === "pass",
+    status,
     summary: {
       passed,
       failed,
       warnings,
-      errors: result.summary.errors,
-      rulesEvaluated: result.summary.rulesEvaluated ?? 0
+      errors,
+      rulesEvaluated: ruleExecutions.length
     },
     findings,
-    ruleExecutions: result.ruleExecutions ?? []
+    ruleExecutions
   };
 }
 
@@ -6755,7 +6856,7 @@ var SAFETY_KEYS = /* @__PURE__ */ new Set([
   "maxFindings"
 ]);
 var RUN_EXPECTED = /* @__PURE__ */ new Set(["ok", "error", "running"]);
-var CONFIDENCE_VALUES = /* @__PURE__ */ new Set(["exact", "high", "medium", "low", "inferred"]);
+var CONFIDENCE_LIST = ATTRIBUTION_CONFIDENCES.join(", ");
 var CheckConfigError = class extends Error {
   code;
   constructor(code, message) {
@@ -6897,10 +6998,10 @@ function parseStructureSection(value) {
   rejectUnknownKeys(record, STRUCTURE_KEYS, "checks.structure");
   const out = {};
   if (record.minConfidence !== void 0) {
-    if (typeof record.minConfidence !== "string" || !CONFIDENCE_VALUES.has(record.minConfidence)) {
+    if (!isAttributionConfidence(record.minConfidence)) {
       throw new CheckConfigError(
         "AI_CHECK_CONFIG_INVALID_VALUE",
-        `checks.structure.minConfidence must be one of: exact, high, medium, low, inferred.`
+        `checks.structure.minConfidence must be one of: ${CONFIDENCE_LIST}.`
       );
     }
     out.minConfidence = record.minConfidence;
@@ -7410,7 +7511,8 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
             read,
             {
               ...options.guardrails ? { guardrails: options.guardrails } : {},
-              ...options.circuit ? { circuits: options.circuit } : {}
+              ...options.circuit ? { circuits: options.circuit } : {},
+              runId: meta.runId
             }
           )
         );
@@ -7463,7 +7565,8 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
         read,
         {
           ...options.guardrails ? { guardrails: options.guardrails } : {},
-          ...options.circuit ? { circuits: options.circuit } : {}
+          ...options.circuit ? { circuits: options.circuit } : {},
+          ...options.run !== void 0 ? { runId: options.run } : {}
         }
       );
     }
@@ -9632,10 +9735,10 @@ function selectRun4(read, runId) {
 }
 function summarizeTrace(read, run) {
   const runId = run?.runId;
-  const scopedEvents = runId === void 0 ? read.events : read.events.filter((event) => event.runId === runId);
+  const scopedEvents2 = runId === void 0 ? read.events : read.events.filter((event) => event.runId === runId);
   const eventsByKind = {};
   const eventsByStatus = {};
-  for (const event of scopedEvents) {
+  for (const event of scopedEvents2) {
     increment(eventsByKind, event.kind);
     increment(eventsByStatus, event.status);
   }
@@ -9645,7 +9748,7 @@ function summarizeTrace(read, run) {
     ...run?.status !== void 0 ? { runStatus: run.status } : {},
     ...run?.durationMs !== void 0 ? { runDurationMs: run.durationMs } : {},
     runCount: read.runs.length,
-    eventCount: scopedEvents.length,
+    eventCount: scopedEvents2.length,
     eventsByKind: Object.fromEntries(Object.entries(eventsByKind).sort()),
     eventsByStatus: Object.fromEntries(Object.entries(eventsByStatus).sort()),
     readerWarnings: read.warnings.length,
@@ -12070,7 +12173,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-GZQVDREP.mjs');
+    return await import('./src-XNC4EUN3.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(