agent-inspect 6.31.12 → 6.31.13

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, persistedInspectEventsToRunTrees, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-GBAGZVUX.mjs';
+import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, persistedInspectEventsToRunTrees, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-ZAYVAHIH.mjs';
 import { realpathSync, constants as constants$1, existsSync, readFileSync } from 'fs';
 import path19 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -14,7 +14,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.31.12";
+var version = "6.31.13";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -2752,7 +2752,14 @@ function exportOtlpJson(tree, options) {
 
 // packages/core/src/exporters/validation.ts
 var EXPERIMENTAL = "Experimental compatibility export \u2014 verify against your target tooling before relying on it.";
+var UINT64_MAX = 18446744073709551615n;
+var INT64_MIN = -9223372036854775808n;
+var INT64_MAX = 9223372036854775807n;
+var MAX_ANYVALUE_DEPTH = 8;
+var MAX_ANYVALUE_ELEMENTS = 256;
+var MAX_DIAGNOSTIC_ERRORS = 64;
 function pushPath(errors, path30, message) {
+  if (errors.length >= MAX_DIAGNOSTIC_ERRORS) return;
   errors.push(`${path30}: ${message}`);
 }
 function isRecord5(value) {
@@ -2761,7 +2768,59 @@ function isRecord5(value) {
 function isHexId(value, byteLen) {
   return typeof value === "string" && new RegExp(`^[0-9a-fA-F]{${byteLen * 2}}$`).test(value);
 }
-function validateAnyValue(errors, path30, value) {
+function parseDecimalIntegerString(value) {
+  if (typeof value !== "string" || !/^-?\d+$/.test(value)) {
+    return { ok: false, reason: "must be a decimal integer string" };
+  }
+  try {
+    return { ok: true, n: BigInt(value) };
+  } catch {
+    return { ok: false, reason: "out of integer range" };
+  }
+}
+function validateUint64String(errors, path30, value, label) {
+  const parsed = parseDecimalIntegerString(value);
+  if (!parsed.ok) {
+    pushPath(errors, path30, `${label} ${parsed.reason}`);
+    return;
+  }
+  if (parsed.n < 0n || parsed.n > UINT64_MAX) {
+    pushPath(
+      errors,
+      path30,
+      `${label} must be an unsigned 64-bit integer (0..${UINT64_MAX.toString()})`
+    );
+  }
+}
+function validateInt64String(errors, path30, value) {
+  const parsed = parseDecimalIntegerString(value);
+  if (!parsed.ok) {
+    pushPath(errors, path30, parsed.reason);
+    return;
+  }
+  if (parsed.n < INT64_MIN || parsed.n > INT64_MAX) {
+    pushPath(
+      errors,
+      path30,
+      `must be a signed 64-bit integer (${INT64_MIN.toString()}..${INT64_MAX.toString()})`
+    );
+  }
+}
+function validateAnyValue(errors, path30, value, depth = 0, counters = { elements: 0 }) {
+  if (errors.length >= MAX_DIAGNOSTIC_ERRORS) return;
+  if (depth > MAX_ANYVALUE_DEPTH) {
+    pushPath(errors, path30, `AnyValue nesting exceeds depth ${MAX_ANYVALUE_DEPTH}`);
+    return;
+  }
+  counters.elements += 1;
+  if (counters.elements > MAX_ANYVALUE_ELEMENTS) {
+    pushPath(
+      errors,
+      path30,
+      `AnyValue element count exceeds ${MAX_ANYVALUE_ELEMENTS}`
+    );
+    return;
+  }
   if (!isRecord5(value)) {
     pushPath(errors, path30, "must be an AnyValue object");
     return;
@@ -2781,13 +2840,99 @@ function validateAnyValue(errors, path30, value) {
       path30,
       `AnyValue must set exactly one variant (found ${variants.length}: ${variants.join(",")})`
     );
+    return;
   }
-  if (value.intValue !== void 0) {
-    if (typeof value.intValue !== "string" || !/^-?\d+$/.test(value.intValue)) {
-      pushPath(errors, `${path30}.intValue`, "must be a decimal integer string");
+  const arm = variants[0];
+  switch (arm) {
+    case "stringValue":
+      if (typeof value.stringValue !== "string") {
+        pushPath(errors, `${path30}.stringValue`, "must be a string");
+      }
+      break;
+    case "boolValue":
+      if (typeof value.boolValue !== "boolean") {
+        pushPath(errors, `${path30}.boolValue`, "must be a boolean");
+      }
+      break;
+    case "intValue":
+      validateInt64String(errors, `${path30}.intValue`, value.intValue);
+      break;
+    case "doubleValue":
+      if (typeof value.doubleValue !== "number" || !Number.isFinite(value.doubleValue)) {
+        pushPath(errors, `${path30}.doubleValue`, "must be a finite number");
+      }
+      break;
+    case "bytesValue":
+      if (typeof value.bytesValue !== "string") {
+        pushPath(errors, `${path30}.bytesValue`, "must be a base64 string");
+      }
+      break;
+    case "arrayValue": {
+      if (!isRecord5(value.arrayValue)) {
+        pushPath(errors, `${path30}.arrayValue`, "must be an object");
+        break;
+      }
+      const values = value.arrayValue.values;
+      if (values === void 0) break;
+      if (!Array.isArray(values)) {
+        pushPath(errors, `${path30}.arrayValue.values`, "must be an array");
+        break;
+      }
+      values.forEach((item, i) => {
+        validateAnyValue(
+          errors,
+          `${path30}.arrayValue.values[${i}]`,
+          item,
+          depth + 1,
+          counters
+        );
+      });
+      break;
+    }
+    case "kvlistValue": {
+      if (!isRecord5(value.kvlistValue)) {
+        pushPath(errors, `${path30}.kvlistValue`, "must be an object");
+        break;
+      }
+      const values = value.kvlistValue.values;
+      if (values === void 0) break;
+      if (!Array.isArray(values)) {
+        pushPath(errors, `${path30}.kvlistValue.values`, "must be an array");
+        break;
+      }
+      values.forEach((item, i) => {
+        const itemPath = `${path30}.kvlistValue.values[${i}]`;
+        if (!isRecord5(item)) {
+          pushPath(errors, itemPath, "must be a KeyValue object");
+          return;
+        }
+        if (typeof item.key !== "string") {
+          pushPath(errors, `${itemPath}.key`, "must be a string");
+        }
+        validateAnyValue(errors, `${itemPath}.value`, item.value, depth + 1, counters);
+      });
+      break;
     }
   }
 }
+function validateKeyValueList(errors, path30, attrs) {
+  if (attrs === void 0) return;
+  if (!Array.isArray(attrs)) {
+    pushPath(errors, path30, "must be an array");
+    return;
+  }
+  attrs.forEach((attr, ai) => {
+    const attrPath = `${path30}[${ai}]`;
+    if (!isRecord5(attr)) {
+      pushPath(errors, attrPath, "must be an object");
+      return;
+    }
+    if (typeof attr.key !== "string") {
+      pushPath(errors, `${attrPath}.key`, "must be a string");
+    }
+    validateAnyValue(errors, `${attrPath}.value`, attr.value);
+  });
+}
 function validateOtlpJson(content) {
   const errors = [];
   const warnings = [
@@ -2816,6 +2961,13 @@ function validateOtlpJson(content) {
       pushPath(errors, rsPath, "must be an object");
       return;
     }
+    if (isRecord5(resourceSpan.resource)) {
+      validateKeyValueList(
+        errors,
+        `${rsPath}.resource.attributes`,
+        resourceSpan.resource.attributes
+      );
+    }
     if (!Array.isArray(resourceSpan.scopeSpans)) {
       pushPath(errors, `${rsPath}.scopeSpans`, "must be an array");
       return;
@@ -2826,6 +2978,13 @@ function validateOtlpJson(content) {
         pushPath(errors, ssPath, "must be an object");
         return;
       }
+      if (isRecord5(scopeSpan.scope)) {
+        validateKeyValueList(
+          errors,
+          `${ssPath}.scope.attributes`,
+          scopeSpan.scope.attributes
+        );
+      }
       if (!Array.isArray(scopeSpan.spans)) {
         pushPath(errors, `${ssPath}.spans`, "must be an array");
         return;
@@ -2860,44 +3019,58 @@ function validateOtlpJson(content) {
         if (typeof span.name !== "string") {
           pushPath(errors, `${spanPath}.name`, "must be a string");
         }
-        if (typeof span.startTimeUnixNano !== "string" || !/^\d+$/.test(span.startTimeUnixNano)) {
-          pushPath(
-            errors,
-            `${spanPath}.startTimeUnixNano`,
-            "must be a decimal-string 64-bit integer"
-          );
-        }
-        if (span.endTimeUnixNano !== void 0 && (typeof span.endTimeUnixNano !== "string" || !/^\d+$/.test(span.endTimeUnixNano))) {
-          pushPath(
+        validateUint64String(
+          errors,
+          `${spanPath}.startTimeUnixNano`,
+          span.startTimeUnixNano,
+          "startTimeUnixNano"
+        );
+        if (span.endTimeUnixNano !== void 0) {
+          validateUint64String(
             errors,
             `${spanPath}.endTimeUnixNano`,
-            "must be a decimal-string 64-bit integer when present"
+            span.endTimeUnixNano,
+            "endTimeUnixNano"
           );
         }
-        if (typeof span.startTimeUnixNano === "string" && /^\d+$/.test(span.startTimeUnixNano) && typeof span.endTimeUnixNano === "string" && /^\d+$/.test(span.endTimeUnixNano)) {
-          try {
-            if (BigInt(span.endTimeUnixNano) < BigInt(span.startTimeUnixNano)) {
-              pushPath(
+        if (typeof span.startTimeUnixNano === "string" && typeof span.endTimeUnixNano === "string") {
+          const start = parseDecimalIntegerString(span.startTimeUnixNano);
+          const end = parseDecimalIntegerString(span.endTimeUnixNano);
+          if (start.ok && end.ok && end.n < start.n) {
+            pushPath(
+              errors,
+              `${spanPath}.endTimeUnixNano`,
+              "must be >= startTimeUnixNano"
+            );
+          }
+        }
+        validateKeyValueList(errors, `${spanPath}.attributes`, span.attributes);
+        if (Array.isArray(span.events)) {
+          span.events.forEach((event, ei) => {
+            const eventPath = `${spanPath}.events[${ei}]`;
+            if (!isRecord5(event)) {
+              pushPath(errors, eventPath, "must be an object");
+              return;
+            }
+            if (event.timeUnixNano !== void 0) {
+              validateUint64String(
                 errors,
-                `${spanPath}.endTimeUnixNano`,
-                "must be >= startTimeUnixNano"
+                `${eventPath}.timeUnixNano`,
+                event.timeUnixNano,
+                "timeUnixNano"
               );
             }
-          } catch {
-            pushPath(errors, `${spanPath}.endTimeUnixNano`, "out of integer range");
-          }
+            validateKeyValueList(errors, `${eventPath}.attributes`, event.attributes);
+          });
         }
-        if (Array.isArray(span.attributes)) {
-          span.attributes.forEach((attr, ai) => {
-            const attrPath = `${spanPath}.attributes[${ai}]`;
-            if (!isRecord5(attr)) {
-              pushPath(errors, attrPath, "must be an object");
+        if (Array.isArray(span.links)) {
+          span.links.forEach((link, li) => {
+            const linkPath = `${spanPath}.links[${li}]`;
+            if (!isRecord5(link)) {
+              pushPath(errors, linkPath, "must be an object");
               return;
             }
-            if (typeof attr.key !== "string") {
-              pushPath(errors, `${attrPath}.key`, "must be a string");
-            }
-            validateAnyValue(errors, `${attrPath}.value`, attr.value);
+            validateKeyValueList(errors, `${linkPath}.attributes`, link.attributes);
           });
         }
         if (typeof span.kind === "number") {
@@ -3815,7 +3988,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-F44EQY4S.mjs');
+    const mod = await import('./src-KP4UIFK5.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -13794,7 +13967,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-F44EQY4S.mjs');
+    return await import('./src-KP4UIFK5.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(