agent-inspect 6.31.30 → 6.31.32

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, persistedInspectEventsToRunTrees, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, IDENTITY_CONFLICT_ATTR, DELIVERY_CONFLICT_ATTR, DELIVERY_EVENT_BASE_ATTR, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-4GTOJ3G2.mjs';
+import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, persistedInspectEventsToRunTrees, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, IDENTITY_CONFLICT_ATTR, DELIVERY_CONFLICT_ATTR, DELIVERY_EVENT_BASE_ATTR, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-PEGM6T2X.mjs';
 import { realpathSync, constants as constants$1, existsSync, readFileSync } from 'fs';
 import path19 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -14,7 +14,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.31.30";
+var version = "6.31.32";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -2178,6 +2178,16 @@ function stepIdOf(event) {
   const value = event.attributes?.stepId;
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
+function attemptIdOf(event) {
+  const direct = event.attributes?.attemptId;
+  if (typeof direct === "string" && direct.trim() !== "") return direct;
+  const meta = event.attributes?.metadata;
+  if (meta && typeof meta === "object" && !Array.isArray(meta)) {
+    const nested = meta.attemptId;
+    if (typeof nested === "string" && nested.trim() !== "") return nested;
+  }
+  return void 0;
+}
 function lifecycleKey(event) {
   if (event.kind === "RUN") return `run:${event.runId}`;
   const stepId = stepIdOf(event);
@@ -2187,6 +2197,9 @@ function lifecycleKey(event) {
 function isTerminal(status) {
   return status === "ok" || status === "error";
 }
+function eventTime(event) {
+  return typeof event.timestamp === "number" ? event.timestamp : 0;
+}
 function cloneNode(node) {
   return {
     event: {
@@ -2197,37 +2210,87 @@ function cloneNode(node) {
     depth: node.depth
   };
 }
+function joinOnePair(start, terminal) {
+  const childMap = /* @__PURE__ */ new Map();
+  if (start) {
+    for (const child of start.children) {
+      childMap.set(child.event.eventId, child);
+    }
+  }
+  for (const child of terminal.children) {
+    childMap.set(child.event.eventId, child);
+  }
+  return {
+    event: {
+      ...terminal.event,
+      name: start?.event.name ?? terminal.event.name,
+      kind: start?.event.kind ?? terminal.event.kind,
+      ...start && attemptIdOf(terminal.event) === void 0 && attemptIdOf(start.event) ? {
+        attributes: {
+          ...terminal.event.attributes,
+          attemptId: attemptIdOf(start.event)
+        }
+      } : {}
+    },
+    children: presentSiblingNodes([...childMap.values()]),
+    depth: terminal.depth
+  };
+}
 function joinSiblingGroup(group) {
   if (group.length <= 1) return group;
-  const terminals = group.filter((n) => isTerminal(n.event.status));
-  const runnings = group.filter((n) => n.event.status === "running");
+  const terminals = group.filter((n) => isTerminal(n.event.status)).sort((a, b) => eventTime(a.event) - eventTime(b.event));
+  const runnings = group.filter((n) => n.event.status === "running").sort((a, b) => eventTime(a.event) - eventTime(b.event));
+  const others = group.filter(
+    (n) => !isTerminal(n.event.status) && n.event.status !== "running"
+  );
   const terminalStatuses = new Set(terminals.map((n) => n.event.status));
   if (terminalStatuses.size > 1) {
     return group;
   }
-  if (terminals.length >= 1) {
-    const terminal = terminals[terminals.length - 1];
-    const start = runnings[0];
-    const childMap = /* @__PURE__ */ new Map();
-    for (const n of group) {
-      for (const child of n.children) {
-        childMap.set(child.event.eventId, child);
-      }
+  if (terminals.length > 1 && terminals.every((t) => attemptIdOf(t.event) === void 0) && runnings.every((r) => attemptIdOf(r.event) === void 0)) {
+    return group;
+  }
+  const usedRunning = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const terminal of terminals) {
+    const terminalAttempt = attemptIdOf(terminal.event);
+    const terminalTs = eventTime(terminal.event);
+    const candidate = runnings.find((r) => {
+      if (usedRunning.has(r.event.eventId)) return false;
+      if (eventTime(r.event) > terminalTs) return false;
+      const runningAttempt = attemptIdOf(r.event);
+      if (terminalAttempt !== void 0) {
+        return runningAttempt === terminalAttempt;
+      }
+      if (runningAttempt !== void 0) {
+        return true;
+      }
+      return true;
+    });
+    if (candidate) {
+      usedRunning.add(candidate.event.eventId);
+      out.push(joinOnePair(candidate, terminal));
+    } else {
+      out.push({
+        ...terminal,
+        children: presentSiblingNodes(terminal.children)
+      });
     }
-    return [
-      {
-        event: {
-          ...terminal.event,
-          name: start?.event.name ?? terminal.event.name,
-          kind: start?.event.kind ?? terminal.event.kind,
-          ...start?.event.timestamp !== void 0 && terminal.event.durationMs === void 0 ? {} : {}
-        },
-        children: presentSiblingNodes([...childMap.values()]),
-        depth: terminal.depth
-      }
-    ];
   }
-  return group;
+  for (const running of runnings) {
+    if (usedRunning.has(running.event.eventId)) continue;
+    out.push({
+      ...running,
+      children: presentSiblingNodes(running.children)
+    });
+  }
+  for (const other of others) {
+    out.push({
+      ...other,
+      children: presentSiblingNodes(other.children)
+    });
+  }
+  return out;
 }
 function presentSiblingNodes(nodes) {
   const prepared = nodes.map((n) => ({
@@ -4180,7 +4243,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-BF74ZVDF.mjs');
+    const mod = await import('./src-CWUJTMRD.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -5053,6 +5116,18 @@ var credentialDetectors = [
     pattern: /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
     severity: "error"
   }),
+  // Stripe secret/restricted keys (underscore form). Keep in sync with
+  // packages/core/src/safety/credential-value-patterns.ts + checks DEFAULT_SECRET_PATTERNS (#520).
+  patternDetector({
+    id: "value.stripeSecretKey",
+    pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.slackToken",
+    pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/,
+    severity: "error"
+  }),
   patternDetector({
     id: "value.githubToken",
     pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
@@ -6800,8 +6875,9 @@ function parseEvidenceFormat(value) {
     `Unsupported --evidence-format "${value}". Use directory, html, or zip.`
   );
 }
-function toAssessmentStatus(failed) {
-  return failed ? "UNSAFE" : "SAFE";
+function residualStatusToEvidenceSafe(status) {
+  if (status === "SAFE_WITH_WARNINGS") return "SAFE WITH WARNINGS";
+  return status;
 }
 function stableJson2(value) {
   return `${JSON.stringify(value, null, 2)}
@@ -6841,7 +6917,10 @@ async function writeLocalEvidence(input3) {
     combined += redacted.content.endsWith("\n") ? redacted.content : `${redacted.content}
 `;
   }
-  const assessmentStatus = toAssessmentStatus(input3.failed);
+  const residual = await assessResidualFromContent(combined, {
+    format: "agent-inspect-jsonl"
+  });
+  const assessmentStatus = residualStatusToEvidenceSafe(residual.status);
   const evidencePackage = buildEvidenceCiPackage({
     generatorVersion: version,
     runIds: input3.runIds,
@@ -14177,7 +14256,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-BF74ZVDF.mjs');
+    return await import('./src-CWUJTMRD.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(