agent-inspect 6.31.32 → 6.31.34

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, persistedInspectEventsToRunTrees, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, IDENTITY_CONFLICT_ATTR, DELIVERY_CONFLICT_ATTR, DELIVERY_EVENT_BASE_ATTR, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-PEGM6T2X.mjs';
+import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, persistedInspectEventsToRunTrees, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, IDENTITY_CONFLICT_ATTR, DELIVERY_CONFLICT_ATTR, DELIVERY_EVENT_BASE_ATTR, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-6TXW53UR.mjs';
 import { realpathSync, constants as constants$1, existsSync, readFileSync } from 'fs';
 import path19 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -14,7 +14,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.31.32";
+var version = "6.31.34";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -2188,11 +2188,25 @@ function attemptIdOf(event) {
   }
   return void 0;
 }
+function operationIdOf(event) {
+  const direct = event.attributes?.operationId;
+  if (typeof direct === "string" && direct.trim() !== "") return direct;
+  const meta = event.attributes?.metadata;
+  if (meta && typeof meta === "object" && !Array.isArray(meta)) {
+    const nested = meta.operationId;
+    if (typeof nested === "string" && nested.trim() !== "") return nested;
+  }
+  return void 0;
+}
 function lifecycleKey(event) {
   if (event.kind === "RUN") return `run:${event.runId}`;
   const stepId = stepIdOf(event);
-  if (stepId !== void 0) return `step:${stepId}`;
-  return `event:${event.eventId}`;
+  if (stepId === void 0) return `event:${event.eventId}`;
+  const attemptId = attemptIdOf(event);
+  if (attemptId !== void 0) return `step:${stepId}:attempt:${attemptId}`;
+  const operationId = operationIdOf(event);
+  if (operationId !== void 0) return `step:${stepId}:op:${operationId}`;
+  return `step:${stepId}`;
 }
 function isTerminal(status) {
   return status === "ok" || status === "error";
@@ -2243,6 +2257,12 @@ function joinSiblingGroup(group) {
   const others = group.filter(
     (n) => !isTerminal(n.event.status) && n.event.status !== "running"
   );
+  const operationIds = new Set(
+    group.map((n) => operationIdOf(n.event)).filter((id) => id !== void 0)
+  );
+  if (operationIds.size > 1) {
+    return group;
+  }
   const terminalStatuses = new Set(terminals.map((n) => n.event.status));
   if (terminalStatuses.size > 1) {
     return group;
@@ -2254,19 +2274,22 @@ function joinSiblingGroup(group) {
   const out = [];
   for (const terminal of terminals) {
     const terminalAttempt = attemptIdOf(terminal.event);
+    const terminalOp = operationIdOf(terminal.event);
     const terminalTs = eventTime(terminal.event);
-    const candidate = runnings.find((r) => {
+    const candidates = runnings.filter((r) => {
       if (usedRunning.has(r.event.eventId)) return false;
       if (eventTime(r.event) > terminalTs) return false;
+      const runningOp = operationIdOf(r.event);
+      if (terminalOp !== void 0 && runningOp !== void 0 && terminalOp !== runningOp) {
+        return false;
+      }
       const runningAttempt = attemptIdOf(r.event);
       if (terminalAttempt !== void 0) {
         return runningAttempt === terminalAttempt;
       }
-      if (runningAttempt !== void 0) {
-        return true;
-      }
-      return true;
+      return runningAttempt === void 0;
     });
+    const candidate = candidates.length === 1 ? candidates[0] : void 0;
     if (candidate) {
       usedRunning.add(candidate.event.eventId);
       out.push(joinOnePair(candidate, terminal));
@@ -4243,7 +4266,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-CWUJTMRD.mjs');
+    const mod = await import('./src-GCLC4DIC.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -5117,10 +5140,11 @@ var credentialDetectors = [
     severity: "error"
   }),
   // Stripe secret/restricted keys (underscore form). Keep in sync with
-  // packages/core/src/safety/credential-value-patterns.ts + checks DEFAULT_SECRET_PATTERNS (#520).
+  // packages/core/src/safety/credential-value-patterns.ts + checks DEFAULT_SECRET_PATTERNS (#520/#528).
+  // Non-alnum lookarounds so underscore-adjacent forms (acct_sk_live_…, …_eu) match.
   patternDetector({
     id: "value.stripeSecretKey",
-    pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+    pattern: /(?<![A-Za-z0-9])(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/,
     severity: "error"
   }),
   patternDetector({
@@ -6883,6 +6907,21 @@ function stableJson2(value) {
   return `${JSON.stringify(value, null, 2)}
 `;
 }
+function alignCheckResultsAggregateStatus(checkResultsJson, assessmentStatus) {
+  let parsed;
+  try {
+    parsed = JSON.parse(checkResultsJson);
+  } catch {
+    return stableJson2({
+      aggregateStatus: assessmentStatus,
+      raw: checkResultsJson
+    });
+  }
+  return stableJson2({
+    ...parsed,
+    aggregateStatus: assessmentStatus
+  });
+}
 async function writeLocalEvidence(input3) {
   const profile = input3.redactionProfile ?? "share";
   const format = input3.format ?? "directory";
@@ -6921,6 +6960,10 @@ async function writeLocalEvidence(input3) {
     format: "agent-inspect-jsonl"
   });
   const assessmentStatus = residualStatusToEvidenceSafe(residual.status);
+  const checkResultsJson = alignCheckResultsAggregateStatus(
+    input3.checkResultsJson,
+    assessmentStatus
+  );
   const evidencePackage = buildEvidenceCiPackage({
     generatorVersion: version,
     runIds: input3.runIds,
@@ -6928,7 +6971,7 @@ async function writeLocalEvidence(input3) {
     redactedTraceJsonl: combined,
     redactionProfile: profile,
     assessmentStatus,
-    checkResultsJson: input3.checkResultsJson,
+    checkResultsJson,
     ...input3.summaryText !== void 0 ? { summaryText: input3.summaryText } : {},
     ...input3.contractPackage !== void 0 ? { contractPackage: input3.contractPackage } : {}
   });
@@ -6989,12 +7032,12 @@ async function writeLocalEvidence(input3) {
   return baseDir;
 }
 function checkResultToEvidenceJson(result, runIds) {
-  const status = result.status === "pass" ? "SAFE" : result.status === "fail" ? "UNSAFE" : "UNKNOWN";
   return stableJson2({
-    aggregateStatus: status,
+    aggregateStatus: "UNKNOWN",
+    checkStatus: result.status,
     runs: runIds.map((runId) => ({
       runId,
-      status,
+      checkStatus: result.status,
       errors: result.summary.errors,
       warnings: result.summary.warnings,
       findings: result.findings.length,
@@ -14256,7 +14299,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-CWUJTMRD.mjs');
+    return await import('./src-GCLC4DIC.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(
@@ -15014,10 +15057,12 @@ async function gateCommand(options = {}) {
           runIds: runIds.length > 0 ? runIds : ["gate"],
           sourceContents,
           ...gateOptions.traceDir !== void 0 ? { dir: gateOptions.traceDir } : {},
-          failed,
+          // aggregateStatus is filled from residual assessment before hashing (#529).
+          // Gate pass/fail stays in `gate` / process.exitCode, not aggregateStatus.
           checkResultsJson: `${JSON.stringify(
             {
-              aggregateStatus: failed ? "UNSAFE" : "SAFE",
+              aggregateStatus: "UNKNOWN",
+              gateStatus: failed ? "fail" : "pass",
               gate: result
             },
             null,