agent-inspect 6.31.16 → 6.31.18

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, persistedInspectEventsToRunTrees, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-ZAYVAHIH.mjs';
+import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, persistedInspectEventsToRunTrees, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-AHARYDFO.mjs';
 import { realpathSync, constants as constants$1, existsSync, readFileSync } from 'fs';
 import path19 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -14,7 +14,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.31.16";
+var version = "6.31.18";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -2609,6 +2609,51 @@ function genAiOperationName(kind) {
       return void 0;
   }
 }
+var STRUCTURAL_IDENTITY_KEYS = [
+  "operationId",
+  "attemptId",
+  "retryOf",
+  "attemptNumber",
+  "attempt"
+];
+function pickBoundedIdentityString(bag, key, maxLen) {
+  if (!bag || typeof bag !== "object") return void 0;
+  const direct = bag[key];
+  if (typeof direct === "string" && direct.trim() !== "") {
+    return direct.trim().slice(0, maxLen);
+  }
+  const nested = bag.metadata && typeof bag.metadata === "object" ? bag.metadata[key] : void 0;
+  if (typeof nested === "string" && nested.trim() !== "") {
+    return nested.trim().slice(0, maxLen);
+  }
+  return void 0;
+}
+function pickBoundedIdentityNumber(bag, key) {
+  if (!bag || typeof bag !== "object") return void 0;
+  const direct = bag[key];
+  if (typeof direct === "number" && Number.isFinite(direct)) return direct;
+  const nested = bag.metadata && typeof bag.metadata === "object" ? bag.metadata[key] : void 0;
+  if (typeof nested === "number" && Number.isFinite(nested)) return nested;
+  return void 0;
+}
+function appendStructuralIdentityAttrs(attrs, meta, maxLen) {
+  const operationId = pickBoundedIdentityString(meta, "operationId", maxLen);
+  if (operationId !== void 0) {
+    attrs.push(stringAttr("agent_inspect.operation_id", operationId));
+  }
+  const attemptId = pickBoundedIdentityString(meta, "attemptId", maxLen);
+  if (attemptId !== void 0) {
+    attrs.push(stringAttr("agent_inspect.attempt_id", attemptId));
+  }
+  const retryOf = pickBoundedIdentityString(meta, "retryOf", maxLen);
+  if (retryOf !== void 0) {
+    attrs.push(stringAttr("agent_inspect.retry_of", retryOf));
+  }
+  const attemptNumber2 = pickBoundedIdentityNumber(meta, "attemptNumber") ?? pickBoundedIdentityNumber(meta, "attempt");
+  if (attemptNumber2 !== void 0) {
+    attrs.push(intAttr("agent_inspect.attempt_number", attemptNumber2));
+  }
+}
 function resolveSpanTimes(ev) {
   const startedAtMs = typeof ev.attributes?.startedAtMs === "number" && Number.isFinite(ev.attributes.startedAtMs) ? ev.attributes.startedAtMs : void 0;
   const endedAtMs = typeof ev.attributes?.endedAtMs === "number" && Number.isFinite(ev.attributes.endedAtMs) ? ev.attributes.endedAtMs : void 0;
@@ -2629,7 +2674,8 @@ function exportOtlpJson(tree, options) {
   const warnings = [
     "OTLP JSON export uses OTel GenAI-aligned attributes where applicable; experimental until verified against specific collectors.",
     "Not OTLP gRPC/protobuf \u2014 JSON mapping only. Generated locally; no network upload.",
-    "Status and span kind use OTLP numeric enums (StatusCode 0/1/2, SpanKind INTERNAL=1)."
+    "Status and span kind use OTLP numeric enums (StatusCode 0/1/2, SpanKind INTERNAL=1).",
+    "When present on source events, operationId/attemptId/retryOf/attemptNumber are emitted as bounded agent_inspect.* identity attributes (not a broad attribute dump)."
   ];
   const traceId = hexFrom2(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
@@ -2677,6 +2723,11 @@ function exportOtlpJson(tree, options) {
       if (typeof inp === "number") attrs.push(intAttr("gen_ai.usage.input_tokens", inp));
       if (typeof outp === "number") attrs.push(intAttr("gen_ai.usage.output_tokens", outp));
     }
+    appendStructuralIdentityAttrs(
+      attrs,
+      meta && typeof meta === "object" ? meta : void 0,
+      maxLen
+    );
     if (includeAttributes && meta && typeof meta === "object") {
       const skipKeys = /* @__PURE__ */ new Set([
         "tokens",
@@ -2685,7 +2736,8 @@ function exportOtlpJson(tree, options) {
         "responseModel",
         "responseModelId",
         "provider",
-        "originalSourceType"
+        "originalSourceType",
+        ...STRUCTURAL_IDENTITY_KEYS
       ]);
       for (const [k, v] of Object.entries(meta)) {
         if (skipKeys.has(k)) continue;
@@ -3988,7 +4040,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-KP4UIFK5.mjs');
+    const mod = await import('./src-YNZZ2KYR.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -4511,7 +4563,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
 }
 
 // packages/redact/src/key-value-secret.ts
-var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED|HASH:(?:[0-9a-f]{8}|unknown))\](?![^\s"'\\&#?]))([^\s"'\\]{8,})`;
 var KEY_VALUE_SECRET_PATTERN = new RegExp(
   KEY_VALUE_SECRET_PATTERN_SOURCE,
   "i"
@@ -4968,8 +5020,8 @@ function isCompleteRedactionMarker(value, replacement = "[REDACTED]") {
   const trimmed = value.trim();
   if (trimmed.length === 0) return false;
   if (trimmed === replacement) return true;
-  if (/^\[HASH:[A-Za-z0-9_-]+\]$/.test(trimmed)) return true;
-  if (/^\[REDACTED:[^\]]*\]$/.test(trimmed)) return true;
+  if (trimmed === "[HASH:unknown]") return true;
+  if (/^\[HASH:[0-9a-f]{8}\]$/.test(trimmed)) return true;
   return false;
 }
 function applyRule(rule, value, replacement) {
@@ -5202,6 +5254,9 @@ function isRecord7(value) {
 }
 function rejectRemotePolicyPath(policyPath) {
   const trimmed = policyPath.trim();
+  if (/^[a-z]:[\\/]/i.test(trimmed)) {
+    return;
+  }
   if (/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) {
     throw new Error(
       `--policy must be a local JSON file path (got a URL-like value). Remote policy fetch is not supported.`
@@ -13967,7 +14022,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-KP4UIFK5.mjs');
+    return await import('./src-YNZZ2KYR.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(