agent-inspect 6.3.0 → 6.4.1

package/packages/cli/dist/index.cjs

@@ -4142,6 +4142,28 @@ var init_summary = __esm({
   "packages/core/src/bundle/summary.ts"() {
   }
 });
+function sanitizeBundleRunId(runId) {
+  let safe = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
+  safe = path26__default.default.basename(safe);
+  safe = safe.replace(/[^a-zA-Z0-9._-]+/g, "_");
+  if (safe === "" || safe === "." || safe === "..") {
+    safe = "run_unknown";
+  }
+  return safe;
+}
+function bundleRunAssetRelativePath(runId, extension) {
+  const safe = sanitizeBundleRunId(runId);
+  const ext = extension.startsWith(".") ? extension : `.${extension}`;
+  return path26__default.default.posix.join("assets", "runs", `${safe}${ext}`);
+}
+function assertBundlePathContained(outputDir, relativePath) {
+  const base = path26__default.default.resolve(outputDir);
+  const resolved = path26__default.default.resolve(base, relativePath);
+  if (resolved !== base && !resolved.startsWith(base + path26__default.default.sep)) {
+    throw new Error(`Bundle path escapes output directory: ${relativePath}`);
+  }
+  return resolved;
+}
 function normalizeBundleOutputPath(out) {
   const trimmed = out.trim();
   if (trimmed === "") {
@@ -4154,7 +4176,7 @@ function normalizeBundleOutputPath(out) {
   return resolved;
 }
 function defaultBundleOutputPath(runIds) {
-  const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
+  const label = runIds.length === 1 ? sanitizeBundleRunId(runIds[0]) : `multi-${runIds.length}`;
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   return path26__default.default.resolve(`agent-inspect-bundle-${label}-${stamp}`);
 }
@@ -4503,6 +4525,14 @@ var init_resolve2 = __esm({
   }
 });
 
+// packages/core/src/checks/contract.ts
+var init_contract = __esm({
+  "packages/core/src/checks/contract.ts"() {
+    init_checks2();
+    init_outcomes();
+  }
+});
+
 // packages/core/src/checks/index.ts
 function compareStrings(a, b) {
   return (a ?? "").localeCompare(b ?? "");
@@ -5842,6 +5872,7 @@ var SEVERITY_RANK, STATUS_RANK, CONFIDENCE_RANK, DEFAULT_SENSITIVE_KEYS, DEFAULT
 var init_checks2 = __esm({
   "packages/core/src/checks/index.ts"() {
     init_outcomes();
+    init_contract();
     SEVERITY_RANK = {
       error: 0,
       warning: 1,
@@ -8185,8 +8216,9 @@ async function runSuite(options = {}) {
     skipped: cases.filter((item) => item.status === "skipped").length
   };
   const finishedAt = new Date(options.nowMs ?? Date.now()).toISOString();
-  const ok = summary.failed === 0 && summary.errors === 0;
-  const status = summary.errors > 0 ? "error" : summary.failed > 0 || !ok ? "fail" : "pass";
+  const allSkipped = cases.length > 0 && summary.skipped === cases.length;
+  const ok = summary.failed === 0 && summary.errors === 0 && !allSkipped;
+  const status = summary.errors > 0 ? "error" : allSkipped ? "fail" : summary.failed > 0 || !ok ? "fail" : "pass";
   return {
     ok,
     status,
@@ -8411,10 +8443,14 @@ var init_types5 = __esm({
 });
 
 // packages/core/src/cohort/compare.ts
-function compareNumber(metric, label, baseline, candidate, higherIsWorse = true) {
+function compareNumber(metric, label, baseline, candidate, higherIsWorse = true, maxRelativeDelta) {
   if (baseline === void 0 && candidate === void 0) return void 0;
   const delta = baseline !== void 0 && candidate !== void 0 ? candidate - baseline : void 0;
-  const regression = delta !== void 0 && (higherIsWorse && delta > 0 || !higherIsWorse && delta < 0);
+  let regression = delta !== void 0 && (higherIsWorse && delta > 0 || !higherIsWorse && delta < 0);
+  if (regression && maxRelativeDelta !== void 0 && baseline !== void 0 && baseline !== 0 && delta !== void 0) {
+    const relative = Math.abs(delta / baseline);
+    if (relative <= maxRelativeDelta) regression = false;
+  }
   return {
     metric,
     baseline,
@@ -8433,6 +8469,7 @@ function compareCohortAggregates(groups, options) {
   const baselineAgg = pickAggregate(groups, options.baseline, options.groupKey);
   const candidateAgg = pickAggregate(groups, options.candidate, options.groupKey);
   const comparisons = [];
+  const tolerance = options.maxRelativeDelta;
   for (const metric of options.metrics) {
     switch (metric) {
       case "errorRate": {
@@ -8440,7 +8477,9 @@ function compareCohortAggregates(groups, options) {
           metric,
           "Error rate",
           baselineAgg?.errorRate,
-          candidateAgg?.errorRate
+          candidateAgg?.errorRate,
+          true,
+          tolerance
         );
         if (item) comparisons.push(item);
         break;
@@ -8804,13 +8843,27 @@ async function analyzeCohort(runsInput, options) {
       ...new Set(groups.map((group) => group.groupKey))
     ].sort((a, b) => a.localeCompare(b));
     const items = [];
+    const minSample = options.tolerance?.minSampleSize ?? 1;
     for (const groupKey of groupKeys) {
+      const baselineGroup = groups.find(
+        (group) => group.groupKey === groupKey && group.cohortLabel === options.baseline
+      );
+      const candidateGroup = groups.find(
+        (group) => group.groupKey === groupKey && group.cohortLabel === options.candidate
+      );
+      if (baselineGroup && baselineGroup.runCount < minSample || candidateGroup && candidateGroup.runCount < minSample) {
+        warnings.push(
+          `Insufficient sample for group ${groupKey}: need at least ${minSample} run(s) per cohort.`
+        );
+        continue;
+      }
       items.push(
         ...compareCohortAggregates(groups, {
           baseline: options.baseline,
           candidate: options.candidate,
           metrics,
-          groupKey
+          groupKey,
+          maxRelativeDelta: options.tolerance?.maxRelativeDelta
         })
       );
     }
@@ -9259,6 +9312,9 @@ function validateOptions(options) {
   if (options.maxErrorRate !== void 0 && options.maxErrorRate < 0) {
     errors.push("--max-error-rate must be a non-negative percentage.");
   }
+  if (options.maxErrorRate !== void 0 && options.maxErrorRate > 100) {
+    errors.push("--max-error-rate must be at most 100.");
+  }
   if (options.maxP95DurationMs !== void 0 && options.maxP95DurationMs < 0) {
     errors.push("--max-p95-duration must be a non-negative millisecond value.");
   }
@@ -10620,15 +10676,18 @@ function indexStatus(dbPath) {
   try {
     const runs = db.prepare(`SELECT COUNT(*) AS c FROM runs`).get().c;
     const steps = db.prepare(`SELECT COUNT(*) AS c FROM steps`).get().c;
+    const builtAt = meta(db, META_KEYS.builtAt);
+    const refreshStatus = runs === 0 ? "fallback-scan" : builtAt ? "complete" : "partial";
     return {
       dbPath,
       exists: true,
       healthy: true,
-      builtAt: meta(db, META_KEYS.builtAt),
+      builtAt,
       sourceDir: meta(db, META_KEYS.sourceDir),
       schemaVersion: meta(db, META_KEYS.schemaVersion),
       runs,
-      steps
+      steps,
+      refreshStatus
     };
   } finally {
     db.close();
@@ -10729,7 +10788,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.3.0";
+var version = "6.4.1";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -17021,27 +17080,36 @@ var viewerIndexHtml = `<!DOCTYPE html>
     const params = new URLSearchParams(location.search);
     const mode = params.get("mode") || "traces";
 
+    function escapeHtml(value) {
+      return String(value ?? "")
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+    }
+
     function renderSuite(data) {
       const rows = data.cases.map((c) =>
-        '<tr><td>' + c.id + '</td><td class="' + c.status + '">' + c.status +
-        '</td><td>' + (c.message || '') + '</td><td>' + c.toolPath.join(' \u2192 ') +
-        '</td><td>' + c.observations.map((o) => o.name + ':' + o.status).join(', ') + '</td></tr>'
+        '<tr><td>' + escapeHtml(c.id) + '</td><td class="' + escapeHtml(c.status) + '">' + escapeHtml(c.status) +
+        '</td><td>' + escapeHtml(c.message || '') + '</td><td>' + escapeHtml(c.toolPath.join(' \u2192 ')) +
+        '</td><td>' + escapeHtml(c.observations.map((o) => o.name + ':' + o.status).join(', ')) + '</td></tr>'
       ).join('');
       const failed = data.cases.filter((c) => c.status !== 'pass');
       const detail = failed.map((c) => {
-        let html = '<h3>Case ' + c.id + '</h3><ul>';
-        if (c.failureDiff) html += '<li>Diff errors: ' + c.failureDiff.summary.errors + '</li>';
-        if (c.timeline) html += '<li>Timeline steps: ' + c.timeline.entries.length + '</li>';
-        html += '<li>Diagnostics: ' + c.diagnostics.map((d) => d.message).join('; ') + '</li></ul>';
+        let html = '<h3>Case ' + escapeHtml(c.id) + '</h3><ul>';
+        if (c.failureDiff) html += '<li>Diff errors: ' + escapeHtml(c.failureDiff.summary.errors) + '</li>';
+        if (c.timeline) html += '<li>Timeline steps: ' + escapeHtml(c.timeline.entries.length) + '</li>';
+        html += '<li>Diagnostics: ' + escapeHtml(c.diagnostics.map((d) => d.message).join('; ')) + '</li></ul>';
         return html;
       }).join('');
-      return '<section><h2>Suite: ' + data.suiteName + ' (' + data.status + ')</h2>' +
-        '<p>Passed ' + data.summary.passed + ', failed ' + data.summary.failed + '</p>' +
+      return '<section><h2>Suite: ' + escapeHtml(data.suiteName) + ' (' + escapeHtml(data.status) + ')</h2>' +
+        '<p>Passed ' + escapeHtml(data.summary.passed) + ', failed ' + escapeHtml(data.summary.failed) + '</p>' +
         '<table><thead><tr><th>Case</th><th>Status</th><th>Message</th><th>Tool path</th><th>Observations</th></tr></thead><tbody>' +
         rows + '</tbody></table>' +
         '<section><h2>Failure detail</h2>' + (detail || '<p class="pass">No failures</p>') + '</section>' +
-        '<section><h2>CI artifacts</h2><p>' + (data.ciArtifactsDir || 'n/a') + '</p></section>' +
-        '<section><h2>Bundle export</h2><p>' + data.bundleExportHint + '</p></section>';
+        '<section><h2>CI artifacts</h2><p>' + escapeHtml(data.ciArtifactsDir || 'n/a') + '</p></section>' +
+        '<section><h2>Bundle export</h2><p>' + escapeHtml(data.bundleExportHint) + '</p></section>';
     }
 
     async function load() {
@@ -17057,8 +17125,8 @@ var viewerIndexHtml = `<!DOCTYPE html>
       if (mode === "workspace") {
         nav.innerHTML = '<a href="/api/workspace">/api/workspace</a>';
         const data = await fetch("/api/workspace").then((r) => r.json());
-        content.innerHTML = '<section><h2>Workspace: ' + (data.project || 'workspace') + '</h2>' +
-          '<p>Runs: ' + data.runs.length + '</p><pre>' + JSON.stringify(data, null, 2) + '</pre></section>';
+        content.innerHTML = '<section><h2>Workspace: ' + escapeHtml(data.project || 'workspace') + '</h2>' +
+          '<p>Runs: ' + escapeHtml(data.runs.length) + '</p><pre>' + escapeHtml(JSON.stringify(data, null, 2)) + '</pre></section>';
         return;
       }
       nav.innerHTML = '<a href="/api/traces">/api/traces</a> \xB7 <a href="/api/sessions">/api/sessions</a>';
@@ -19612,7 +19680,7 @@ async function resolveOutputDir(options, runIds, cwd) {
     const manifest = await readWorkspaceManifestFile(location);
     if (manifest.ok && manifest.manifest) {
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
+      const label = runIds.length === 1 ? sanitizeBundleRunId(runIds[0]) : `multi-${runIds.length}`;
       return resolveInsideWorkspace(
         location.workspaceDir,
         path26__default.default.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
@@ -19623,14 +19691,14 @@ async function resolveOutputDir(options, runIds, cwd) {
   return defaultBundleOutputPath(runIds);
 }
 async function writeBundleFile(outputDir, relativePath, content, files) {
-  const outPath = path26__default.default.join(outputDir, relativePath);
+  const outPath = assertBundlePathContained(outputDir, relativePath);
   await promises.mkdir(path26__default.default.dirname(outPath), { recursive: true });
   await promises.writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
 function renderBundleIndexHtml(parts) {
   const links = parts.runIds.map(
-    (runId) => `<li><a href="assets/runs/${escapeHtml3(runId)}.html">${escapeHtml3(runId)}</a></li>`
+    (runId) => `<li><a href="${escapeHtml3(bundleRunAssetRelativePath(runId, ".html"))}">${escapeHtml3(runId)}</a></li>`
   ).join("");
   const sections = parts.runIds.map((runId) => {
     const html = parts.reports.get(runId) ?? "";
@@ -19798,11 +19866,16 @@ async function bundleCommand(runIdArg, options = {}) {
   await promises.mkdir(outputDir, { recursive: true });
   for (const runId of resolveResult.runIds) {
     const jsonl = redactedJsonlByRun.get(runId) ?? "";
-    await writeBundleFile(outputDir, `assets/runs/${runId}.jsonl`, jsonl, files);
+    await writeBundleFile(
+      outputDir,
+      bundleRunAssetRelativePath(runId, ".jsonl"),
+      jsonl,
+      files
+    );
     const html = htmlByRun.get(runId) ?? "";
     await writeBundleFile(
       outputDir,
-      `assets/runs/${runId}.html`,
+      bundleRunAssetRelativePath(runId, ".html"),
       runReportWrap(html, runId),
       files
     );
@@ -20339,7 +20412,7 @@ main().catch((error) => {
       return `import { observe } from "agent-inspect";
 
 class DemoAgent {
-  async run(input: { question: string }) {
+  async run(input) {
     return { answer: \`Echo: \${input.question}\` };
   }
 }
@@ -20760,6 +20833,23 @@ var PLUGIN_NAME_PREFIXES = [
   "agent-inspect-check-",
   "agent-inspect-importer-"
 ];
+var CAPTURE_MODES = /* @__PURE__ */ new Set(["metadata-only", "preview", "full"]);
+function parseStrictBoolean(value, label, errors) {
+  if (value === void 0) return void 0;
+  if (value === true) return true;
+  if (value === false) return false;
+  errors.push(`${label} must be a boolean true or false, not ${JSON.stringify(value)}`);
+  return void 0;
+}
+function parseCaptureMode(value, errors) {
+  if (value === void 0) return void 0;
+  const mode = String(value);
+  if (!CAPTURE_MODES.has(mode)) {
+    errors.push(`privacy.captureMode must be one of: metadata-only, preview, full`);
+    return void 0;
+  }
+  return mode;
+}
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -20808,20 +20898,35 @@ function parsePluginManifest(input3) {
       errors.push("privacy must be an object");
     } else {
       privacy = {};
-      if (input3.privacy.captureMode !== void 0) {
-        privacy.captureMode = String(input3.privacy.captureMode);
-      }
-      if (input3.privacy.networkAllowed !== void 0) {
-        privacy.networkAllowed = Boolean(input3.privacy.networkAllowed);
-      }
-      if (input3.privacy.uploadAllowed !== void 0) {
-        privacy.uploadAllowed = Boolean(input3.privacy.uploadAllowed);
-      }
-      if (input3.privacy.redactionDocumented !== void 0) {
-        privacy.redactionDocumented = Boolean(input3.privacy.redactionDocumented);
+      const captureMode = parseCaptureMode(input3.privacy.captureMode, errors);
+      if (captureMode !== void 0) privacy.captureMode = captureMode;
+      const networkAllowed = parseStrictBoolean(
+        input3.privacy.networkAllowed,
+        "privacy.networkAllowed",
+        errors
+      );
+      if (networkAllowed !== void 0) privacy.networkAllowed = networkAllowed;
+      const uploadAllowed = parseStrictBoolean(
+        input3.privacy.uploadAllowed,
+        "privacy.uploadAllowed",
+        errors
+      );
+      if (uploadAllowed !== void 0) privacy.uploadAllowed = uploadAllowed;
+      const redactionDocumented = parseStrictBoolean(
+        input3.privacy.redactionDocumented,
+        "privacy.redactionDocumented",
+        errors
+      );
+      if (redactionDocumented !== void 0) {
+        privacy.redactionDocumented = redactionDocumented;
       }
-      if (input3.privacy.frameworkDepsPackageScoped !== void 0) {
-        privacy.frameworkDepsPackageScoped = Boolean(input3.privacy.frameworkDepsPackageScoped);
+      const frameworkDepsPackageScoped = parseStrictBoolean(
+        input3.privacy.frameworkDepsPackageScoped,
+        "privacy.frameworkDepsPackageScoped",
+        errors
+      );
+      if (frameworkDepsPackageScoped !== void 0) {
+        privacy.frameworkDepsPackageScoped = frameworkDepsPackageScoped;
       }
       if (privacy.networkAllowed === true || privacy.uploadAllowed === true) {
         warnings.push("plugin declares network or upload \u2014 review before install");
@@ -21739,6 +21844,12 @@ function parseRate(value) {
   if (!Number.isFinite(parsed)) {
     throw new Error(`Invalid --max-error-rate: ${value}`);
   }
+  if (parsed < 0) {
+    throw new Error("--max-error-rate must be a non-negative percentage.");
+  }
+  if (parsed > 100) {
+    throw new Error("--max-error-rate must be at most 100.");
+  }
   return parsed;
 }
 function parseDuration2(value) {