agent-inspect 6.31.5 → 6.31.7

package/packages/cli/dist/index.cjs

@@ -261,7 +261,7 @@ function stringContainsHighConfidenceCredential(value) {
 var KEY_VALUE_SECRET_PATTERN, HIGH_CONFIDENCE_CREDENTIAL_PATTERNS;
 var init_credential_value_patterns = __esm({
   "packages/core/src/safety/credential-value-patterns.ts"() {
-    KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i;
+    KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i;
     HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
       /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
       /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
@@ -2690,16 +2690,51 @@ function buildRunTimeline(events, options = {}) {
   const computeDepth = (stepId) => {
     const cached2 = depthCache.get(stepId);
     if (cached2 !== void 0) return cached2;
-    const node = steps.get(stepId);
-    if (!node) return 0;
-    const parent = node.parentId;
-    if (typeof parent !== "string" || parent.trim() === "" || !steps.has(parent)) {
-      depthCache.set(stepId, 0);
-      return 0;
+    const ancestry = [];
+    const ancestryIndexes = /* @__PURE__ */ new Map();
+    let currentStepId = stepId;
+    let resolvedDepth;
+    while (resolvedDepth === void 0) {
+      const cachedDepth = depthCache.get(currentStepId);
+      if (cachedDepth !== void 0) {
+        resolvedDepth = cachedDepth;
+        continue;
+      }
+      const cycleStart = ancestryIndexes.get(currentStepId);
+      if (cycleStart !== void 0) {
+        const cycleStepIds = ancestry.splice(cycleStart);
+        for (const cycleStepId of cycleStepIds) {
+          depthCache.set(cycleStepId, ROOT_TIMELINE_DEPTH);
+        }
+        resolvedDepth = ROOT_TIMELINE_DEPTH;
+        continue;
+      }
+      const currentStep = steps.get(currentStepId);
+      if (!currentStep) {
+        resolvedDepth = ROOT_TIMELINE_DEPTH;
+        continue;
+      }
+      ancestryIndexes.set(currentStepId, ancestry.length);
+      ancestry.push(currentStepId);
+      const parentId = currentStep.parentId;
+      if (typeof parentId !== "string" || parentId.trim() === "" || !steps.has(parentId)) {
+        ancestry.pop();
+        depthCache.set(currentStepId, ROOT_TIMELINE_DEPTH);
+        resolvedDepth = ROOT_TIMELINE_DEPTH;
+        continue;
+      }
+      currentStepId = parentId;
+    }
+    ancestry.reverse();
+    for (const ancestorStepId of ancestry) {
+      resolvedDepth = Math.min(MAX_TIMELINE_DEPTH, resolvedDepth + 1);
+      depthCache.set(ancestorStepId, resolvedDepth);
+    }
+    const resolvedStepDepth = depthCache.get(stepId);
+    if (resolvedStepDepth === void 0) {
+      throw new Error(`Failed to resolve timeline depth for step "${stepId}"`);
     }
-    const d = Math.min(1e3, computeDepth(parent) + 1);
-    depthCache.set(stepId, d);
-    return d;
+    return resolvedStepDepth;
   };
   const entries = [];
   for (const [stepId, s] of steps.entries()) {
@@ -2787,10 +2822,13 @@ function renderTimeline(timeline, options = {}) {
   }
   return lines.join("\n");
 }
+var ROOT_TIMELINE_DEPTH, MAX_TIMELINE_DEPTH;
 var init_timeline = __esm({
   "packages/core/src/timeline.ts"() {
     init_stats();
     init_utils();
+    ROOT_TIMELINE_DEPTH = 0;
+    MAX_TIMELINE_DEPTH = 1e3;
   }
 });
 
@@ -5848,9 +5886,6 @@ function limitFindings(findings, maxFindings) {
   if (maxFindings === void 0 || findings.length <= maxFindings) return findings;
   return findings.slice(0, Math.max(0, maxFindings));
 }
-function hasRedactionMarker(value, markers) {
-  return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
-}
 function isFullyRedactedValue(value, markers = ["[REDACTED]", "[REDACTED:"]) {
   if (typeof value !== "string") return false;
   const trimmed = value.trim();
@@ -6837,7 +6872,7 @@ function createSafetyRedactionRule(options = {}) {
       for (const event of context.events) {
         for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
           if (!isSensitiveKey(entry.key ?? lastPathSegment(entry.path), sensitiveKeys)) continue;
-          if (typeof entry.value === "string" && hasRedactionMarker(entry.value, markers)) continue;
+          if (isFullyRedactedValue(entry.value, markers)) continue;
           findings.push(
             failFinding(
               "safety.redaction",
@@ -7362,7 +7397,7 @@ var init_checks2 = __esm({
       // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
       {
         id: "key-value-secret",
-        pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i
+        pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i
       }
     ];
   }
@@ -12543,6 +12578,23 @@ function persistedInspectEventToInspectEvent(event) {
   if (event.durationMs !== void 0 && Number.isFinite(event.durationMs) && event.durationMs >= 0) {
     out.durationMs = event.durationMs;
   }
+  if (event.startedAt !== void 0) {
+    const started = parseIsoToMs3(event.startedAt);
+    if (!started.invalidTimestamp) {
+      attrs.startedAtMs = started.ms;
+      out.timestamp = started.ms;
+    }
+  }
+  if (event.endedAt !== void 0) {
+    const ended = parseIsoToMs3(event.endedAt);
+    if (!ended.invalidTimestamp) {
+      attrs.endedAtMs = ended.ms;
+      if (out.durationMs === void 0 && typeof attrs.startedAtMs === "number" && ended.ms >= attrs.startedAtMs) {
+        out.durationMs = ended.ms - attrs.startedAtMs;
+      }
+    }
+  }
+  out.attributes = compactAttributes3(attrs);
   return out;
 }
 function persistedInspectEventsToInspectEvents(events, options) {
@@ -13464,20 +13516,38 @@ function extractOtlpDocument(root) {
 function mapOtlpStatus(status) {
   if (!isRecord11(status)) return void 0;
   const rawCode = status.code;
-  if (typeof rawCode !== "string") return void 0;
-  switch (rawCode.toUpperCase()) {
-    case "STATUS_CODE_OK":
-    case "OK":
-      return "ok";
-    case "STATUS_CODE_ERROR":
-    case "ERROR":
-      return "error";
-    case "STATUS_CODE_UNSET":
-    case "UNSET":
-      return "unknown";
-    default:
-      return "unknown";
+  if (typeof rawCode === "number" && Number.isFinite(rawCode)) {
+    switch (rawCode) {
+      case 0:
+        return "unknown";
+      case 1:
+        return "ok";
+      case 2:
+        return "error";
+      default:
+        return "unknown";
+    }
+  }
+  if (typeof rawCode === "string") {
+    const trimmed = rawCode.trim();
+    if (/^\d+$/.test(trimmed)) {
+      return mapOtlpStatus({ code: Number(trimmed) });
+    }
+    switch (trimmed.toUpperCase()) {
+      case "STATUS_CODE_OK":
+      case "OK":
+        return "ok";
+      case "STATUS_CODE_ERROR":
+      case "ERROR":
+        return "error";
+      case "STATUS_CODE_UNSET":
+      case "UNSET":
+        return "unknown";
+      default:
+        return "unknown";
+    }
   }
+  return void 0;
 }
 function readOtlpKind(attributes, pathPrefix) {
   const warnings = [];
@@ -16165,7 +16235,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.31.5";
+var version = "6.31.7";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -16514,7 +16584,7 @@ function mapReaderFormat(format) {
 function isMissingFileError(error) {
   return error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT";
 }
-async function readRunTraceEvents(runId, traceDir) {
+async function readRunPersistedEvents(runId, traceDir) {
   const filePath = getTraceFilePath(runId, traceDir);
   try {
     await promises.access(filePath);
@@ -16522,16 +16592,24 @@ async function readRunTraceEvents(runId, traceDir) {
       { type: "file", path: filePath },
       { format: "agent-inspect-jsonl" }
     );
-    const events = persistedInspectEventsToTraceEvents(result.events);
     return {
-      events,
-      format: events.length > 0 ? mapReaderFormat(result.format) : "empty"
+      events: result.events,
+      format: result.events.length > 0 ? mapReaderFormat(result.format) : "empty"
     };
   } catch (error) {
     if (isMissingFileError(error)) return void 0;
     throw error;
   }
 }
+async function readRunTraceEvents(runId, traceDir) {
+  const persisted = await readRunPersistedEvents(runId, traceDir);
+  if (persisted === void 0) return void 0;
+  const events = persistedInspectEventsToTraceEvents(persisted.events);
+  return {
+    events,
+    format: events.length > 0 ? persisted.format : "empty"
+  };
+}
 
 // packages/cli/src/view.ts
 function isModuleNotFound(e) {
@@ -17975,6 +18053,8 @@ var CONNECTION_PROTOCOLS = /* @__PURE__ */ new Set([
   "amqps:"
 ]);
 var CONNECTION_URI = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s]+$/i;
+var CONNECTION_USERINFO = /^(postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/([^@/?#]+)@(.+)$/i;
+var CONNECTION_HAS_USERINFO = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^@/?#]+@/i;
 var UUID_SEGMENT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HEX_SEGMENT = /^[0-9a-f]{12,}$/i;
 var NUMERIC_SEGMENT = /^\d{5,}$/;
@@ -17998,6 +18078,28 @@ function parseRedactableUrl(value) {
     return void 0;
   }
 }
+function redactConnectionUserinfoFallback(value, replacement) {
+  const trimmed = value.trim();
+  const match = CONNECTION_USERINFO.exec(trimmed);
+  if (match) {
+    const [, scheme, , rest] = match;
+    if (scheme && rest && rest.length > 0) {
+      return {
+        value: `${scheme}://${rest}`,
+        credentialRedacted: true,
+        identifiersMasked: false
+      };
+    }
+  }
+  if (looksLikeConnectionUri(trimmed) && CONNECTION_HAS_USERINFO.test(trimmed)) {
+    return {
+      value: replacement,
+      credentialRedacted: true,
+      identifiersMasked: false
+    };
+  }
+  return void 0;
+}
 function isHttpProtocol(protocol) {
   return protocol === "http:" || protocol === "https:";
 }
@@ -18039,9 +18141,11 @@ function redactUrlString(value, options) {
     identifiersMasked: false
   };
   if (!looksLikeUrlForRedaction(value)) return unchanged;
-  const url = parseRedactableUrl(value);
-  if (!url) return unchanged;
   const replacement = options.replacement ?? "[REDACTED]";
+  const url = parseRedactableUrl(value);
+  if (!url) {
+    return redactConnectionUserinfoFallback(value, replacement) ?? unchanged;
+  }
   const idPlaceholder = options.idPlaceholder ?? "[id]";
   const http = isHttpProtocol(url.protocol);
   let credentialRedacted = url.username.length > 0 || url.password.length > 0;
@@ -18737,6 +18841,10 @@ function exportOpenInference(tree, options) {
 
 // packages/core/src/exporters/otlp-json-exporter.ts
 init_helpers();
+var OTLP_STATUS_CODE_UNSET = 0;
+var OTLP_STATUS_CODE_OK = 1;
+var OTLP_STATUS_CODE_ERROR = 2;
+var OTLP_SPAN_KIND_INTERNAL = 1;
 function hexFrom2(seed, byteLen) {
   return crypto__default.default.createHash("sha256").update(seed, "utf8").digest("hex").slice(0, byteLen * 2);
 }
@@ -18749,7 +18857,19 @@ function stringAttr2(key, value) {
   return { key, value: { stringValue: value } };
 }
 function intAttr(key, value) {
-  return { key, value: { intValue: String(value) } };
+  return { key, value: { intValue: String(Math.trunc(value)) } };
+}
+function doubleAttr(key, value) {
+  return { key, value: { doubleValue: value } };
+}
+function boolAttr(key, value) {
+  return { key, value: { boolValue: value } };
+}
+function numberAttr(key, value) {
+  if (Number.isFinite(value) && !Number.isInteger(value)) {
+    return doubleAttr(key, value);
+  }
+  return intAttr(key, value);
 }
 function genAiOperationName(kind) {
   switch (kind) {
@@ -18763,10 +18883,27 @@ function genAiOperationName(kind) {
       return void 0;
   }
 }
+function resolveSpanTimes(ev) {
+  const startedAtMs = typeof ev.attributes?.startedAtMs === "number" && Number.isFinite(ev.attributes.startedAtMs) ? ev.attributes.startedAtMs : void 0;
+  const endedAtMs = typeof ev.attributes?.endedAtMs === "number" && Number.isFinite(ev.attributes.endedAtMs) ? ev.attributes.endedAtMs : void 0;
+  const startMs = startedAtMs ?? ev.timestamp;
+  const startNs = String(unixNano2(startMs));
+  if (endedAtMs !== void 0) {
+    return { startNs, endNs: String(unixNano2(endedAtMs)) };
+  }
+  if (ev.durationMs !== void 0 && Number.isFinite(ev.durationMs)) {
+    return {
+      startNs,
+      endNs: String(unixNano2(startMs) + unixNano2(ev.durationMs))
+    };
+  }
+  return { startNs };
+}
 function exportOtlpJson(tree, options) {
   const warnings = [
     "OTLP JSON export uses OTel GenAI-aligned attributes where applicable; experimental until verified against specific collectors.",
-    "Not OTLP gRPC/protobuf \u2014 JSON mapping only. Generated locally; no network upload."
+    "Not OTLP gRPC/protobuf \u2014 JSON mapping only. Generated locally; no network upload.",
+    "Status and span kind use OTLP numeric enums (StatusCode 0/1/2, SpanKind INTERNAL=1)."
   ];
   const traceId = hexFrom2(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
@@ -18778,11 +18915,7 @@ function exportOtlpJson(tree, options) {
     const ev = n.event;
     const spanId = hexFrom2(`${tree.runId}:${ev.eventId}`, 8);
     const parentSpanId = ev.parentId ? hexFrom2(`${tree.runId}:${ev.parentId}`, 8) : void 0;
-    const startNs = String(unixNano2(ev.timestamp));
-    let endNs;
-    if (ev.durationMs !== void 0 && Number.isFinite(ev.durationMs)) {
-      endNs = String(unixNano2(ev.timestamp) + unixNano2(ev.durationMs));
-    }
+    const { startNs, endNs } = resolveSpanTimes(ev);
     const attrs = [
       stringAttr2("agent_inspect.kind", ev.kind),
       stringAttr2("agent_inspect.confidence", ev.confidence),
@@ -18812,29 +18945,28 @@ function exportOtlpJson(tree, options) {
     if (includeAttributes && meta2 && typeof meta2 === "object") {
       for (const [k, v] of Object.entries(meta2)) {
         if (k === "tokens" || k === "model") continue;
-        if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
-          attrs.push(
-            stringAttr2(
-              `agent_inspect.preview.${k}`,
-              typeof v === "string" ? v.slice(0, maxLen) : String(v)
-            )
-          );
+        if (typeof v === "string") {
+          attrs.push(stringAttr2(`agent_inspect.preview.${k}`, v.slice(0, maxLen)));
+        } else if (typeof v === "number" && Number.isFinite(v)) {
+          attrs.push(numberAttr(`agent_inspect.preview.${k}`, v));
+        } else if (typeof v === "boolean") {
+          attrs.push(boolAttr(`agent_inspect.preview.${k}`, v));
         }
       }
     }
-    let statusCode = "STATUS_CODE_UNSET";
+    let statusCode = OTLP_STATUS_CODE_UNSET;
     let statusMessage;
     if (ev.status === "error") {
-      statusCode = "STATUS_CODE_ERROR";
+      statusCode = OTLP_STATUS_CODE_ERROR;
       statusMessage = meta2 && typeof meta2.error === "object" && meta2.error !== null ? String(meta2.error.message ?? "error").slice(0, maxLen) : "error";
     } else if (ev.status === "ok") {
-      statusCode = "STATUS_CODE_OK";
+      statusCode = OTLP_STATUS_CODE_OK;
     }
     const spanJson = {
       traceId,
       spanId,
       name: ev.name,
-      kind: "SPAN_KIND_INTERNAL",
+      kind: OTLP_SPAN_KIND_INTERNAL,
       startTimeUnixNano: startNs,
       attributes: attrs,
       status: {
@@ -18876,6 +19008,136 @@ function exportOtlpJson(tree, options) {
 
 // packages/core/src/exporters/validation.ts
 var EXPERIMENTAL = "Experimental compatibility export \u2014 verify against your target tooling before relying on it.";
+function pushPath(errors, path44, message) {
+  errors.push(`${path44}: ${message}`);
+}
+function isRecord16(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateOtlpJson(content) {
+  const errors = [];
+  const warnings = [
+    EXPERIMENTAL,
+    "OTLP JSON mapping uses OTel GenAI-aligned attributes where applicable; collectors may require transformation.",
+    "protocol-valid \u2260 profile-complete \u2260 fixture-complete \u2014 nested path diagnostics report protocol shape only."
+  ];
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    pushPath(errors, "$", "OTLP JSON export is not valid JSON");
+    return { ok: false, format: "otlp-json", errors, warnings };
+  }
+  if (!isRecord16(parsed)) {
+    pushPath(errors, "$", "OTLP JSON export must be an object");
+    return { ok: false, format: "otlp-json", errors, warnings };
+  }
+  if (!Array.isArray(parsed.resourceSpans)) {
+    pushPath(errors, "$.resourceSpans", "must be an array");
+    return { ok: false, format: "otlp-json", errors, warnings };
+  }
+  parsed.resourceSpans.forEach((resourceSpan, rsi) => {
+    const rsPath = `$.resourceSpans[${rsi}]`;
+    if (!isRecord16(resourceSpan)) {
+      pushPath(errors, rsPath, "must be an object");
+      return;
+    }
+    if (!Array.isArray(resourceSpan.scopeSpans)) {
+      pushPath(errors, `${rsPath}.scopeSpans`, "must be an array");
+      return;
+    }
+    resourceSpan.scopeSpans.forEach((scopeSpan, ssi) => {
+      const ssPath = `${rsPath}.scopeSpans[${ssi}]`;
+      if (!isRecord16(scopeSpan)) {
+        pushPath(errors, ssPath, "must be an object");
+        return;
+      }
+      if (!Array.isArray(scopeSpan.spans)) {
+        pushPath(errors, `${ssPath}.spans`, "must be an array");
+        return;
+      }
+      scopeSpan.spans.forEach((span, spi) => {
+        const spanPath = `${ssPath}.spans[${spi}]`;
+        if (!isRecord16(span)) {
+          pushPath(errors, spanPath, "must be an object");
+          return;
+        }
+        if (typeof span.traceId !== "string" || span.traceId.length === 0) {
+          pushPath(errors, `${spanPath}.traceId`, "must be a non-empty string");
+        }
+        if (typeof span.spanId !== "string" || span.spanId.length === 0) {
+          pushPath(errors, `${spanPath}.spanId`, "must be a non-empty string");
+        }
+        if (typeof span.name !== "string") {
+          pushPath(errors, `${spanPath}.name`, "must be a string");
+        }
+        if (typeof span.startTimeUnixNano !== "string" || !/^\d+$/.test(span.startTimeUnixNano)) {
+          pushPath(
+            errors,
+            `${spanPath}.startTimeUnixNano`,
+            "must be a decimal-string 64-bit integer"
+          );
+        }
+        if (span.endTimeUnixNano !== void 0 && (typeof span.endTimeUnixNano !== "string" || !/^\d+$/.test(span.endTimeUnixNano))) {
+          pushPath(
+            errors,
+            `${spanPath}.endTimeUnixNano`,
+            "must be a decimal-string 64-bit integer when present"
+          );
+        }
+        if (typeof span.kind === "number") {
+          if (!Number.isInteger(span.kind)) {
+            pushPath(errors, `${spanPath}.kind`, "must be an integer SpanKind enum");
+          }
+        } else if (typeof span.kind === "string") {
+          warnings.push(
+            `${spanPath}.kind: string SpanKind enum is legacy; prefer numeric (INTERNAL=1)`
+          );
+        } else if (span.kind !== void 0) {
+          pushPath(
+            errors,
+            `${spanPath}.kind`,
+            "must be numeric SpanKind or historical string enum"
+          );
+        }
+        if (!isRecord16(span.status)) {
+          pushPath(errors, `${spanPath}.status`, "must be an object");
+        } else {
+          const code = span.status.code;
+          if (typeof code === "number") {
+            if (![0, 1, 2].includes(code)) {
+              pushPath(
+                errors,
+                `${spanPath}.status.code`,
+                "must be numeric StatusCode 0 (UNSET), 1 (OK), or 2 (ERROR)"
+              );
+            }
+          } else if (typeof code === "string") {
+            const upper = code.toUpperCase();
+            if (upper !== "STATUS_CODE_UNSET" && upper !== "STATUS_CODE_OK" && upper !== "STATUS_CODE_ERROR" && upper !== "UNSET" && upper !== "OK" && upper !== "ERROR" && !/^[012]$/.test(code.trim())) {
+              pushPath(
+                errors,
+                `${spanPath}.status.code`,
+                "unrecognized StatusCode string"
+              );
+            } else {
+              warnings.push(
+                `${spanPath}.status.code: string StatusCode is legacy; prefer numeric 0/1/2`
+              );
+            }
+          } else {
+            pushPath(
+              errors,
+              `${spanPath}.status.code`,
+              "must be numeric StatusCode 0/1/2 or historical string enum"
+            );
+          }
+        }
+      });
+    });
+  });
+  return { ok: errors.length === 0, format: "otlp-json", errors, warnings };
+}
 function validateExportContent(format, content) {
   const errors = [];
   const warnings = [EXPERIMENTAL];
@@ -18921,25 +19183,7 @@ function validateExportContent(format, content) {
     return { ok: errors.length === 0, format, errors, warnings };
   }
   if (format === "otlp-json") {
-    let parsed;
-    try {
-      parsed = JSON.parse(content);
-    } catch {
-      errors.push("OTLP JSON export is not valid JSON");
-      return { ok: false, format, errors, warnings };
-    }
-    if (!parsed || typeof parsed !== "object") {
-      errors.push("OTLP JSON export must be an object");
-      return { ok: false, format, errors, warnings };
-    }
-    const o = parsed;
-    if (!Array.isArray(o.resourceSpans)) {
-      errors.push("OTLP JSON export must include resourceSpans array");
-    }
-    warnings.push(
-      "OTLP JSON mapping uses OTel GenAI-aligned attributes where applicable; collectors may require transformation."
-    );
-    return { ok: errors.length === 0, format, errors, warnings };
+    return validateOtlpJson(content);
   }
   errors.push(`Unsupported export format`);
   return { ok: false, format, errors, warnings };
@@ -19343,7 +19587,7 @@ async function exportCommand(runId, options = {}) {
   const traceDir = resolveTraceDir({ dir: options.dir });
   let events;
   try {
-    const result2 = await readRunTraceEvents(id, traceDir);
+    const result2 = await readRunPersistedEvents(id, traceDir);
     events = result2?.events ?? [];
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
@@ -19359,7 +19603,11 @@ Trace directory: ${traceDir}`);
   }
   let tree;
   try {
-    tree = manualTraceEventsToRunTree(events);
+    const trees = persistedInspectEventsToRunTrees(events);
+    tree = trees.find((candidate) => candidate.runId === id) ?? trees[0];
+    if (tree === void 0) {
+      throw new Error("No run tree could be built from persisted events");
+    }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     console.error(`[AgentInspect] export failed: ${msg}`);
@@ -19387,7 +19635,9 @@ Trace directory: ${traceDir}`);
     await promises.mkdir(path33__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
-    console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
+    console.error(
+      `Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`
+    );
     if (validation !== void 0 && !validation.ok) {
       console.error("Validation errors:", validation.errors.join("; "));
     }
@@ -19400,7 +19650,9 @@ Trace directory: ${traceDir}`);
       warnings: [...result.warnings, ...validation?.warnings ?? []],
       validation
     };
-    if (outPath === void 0) {
+    if (outPath !== void 0) {
+      payload.out = outPath;
+    } else {
       payload.content = result.content;
     }
     console.log(JSON.stringify(payload, null, 2));
@@ -20302,7 +20554,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
 }
 
 // packages/redact/src/key-value-secret.ts
-var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})`;
 var KEY_VALUE_SECRET_PATTERN2 = new RegExp(
   KEY_VALUE_SECRET_PATTERN_SOURCE,
   "i"
@@ -20327,6 +20579,8 @@ var CONNECTION_PROTOCOLS2 = /* @__PURE__ */ new Set([
   "amqps:"
 ]);
 var CONNECTION_URI2 = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s]+$/i;
+var CONNECTION_USERINFO2 = /^(postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/([^@/?#]+)@(.+)$/i;
+var CONNECTION_HAS_USERINFO2 = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^@/?#]+@/i;
 var UUID_SEGMENT2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HEX_SEGMENT2 = /^[0-9a-f]{12,}$/i;
 var NUMERIC_SEGMENT2 = /^\d{5,}$/;
@@ -20350,6 +20604,28 @@ function parseRedactableUrl2(value) {
     return void 0;
   }
 }
+function redactConnectionUserinfoFallback2(value, replacement) {
+  const trimmed = value.trim();
+  const match = CONNECTION_USERINFO2.exec(trimmed);
+  if (match) {
+    const [, scheme, , rest] = match;
+    if (scheme && rest && rest.length > 0) {
+      return {
+        value: `${scheme}://${rest}`,
+        credentialRedacted: true,
+        identifiersMasked: false
+      };
+    }
+  }
+  if (looksLikeConnectionUri2(trimmed) && CONNECTION_HAS_USERINFO2.test(trimmed)) {
+    return {
+      value: replacement,
+      credentialRedacted: true,
+      identifiersMasked: false
+    };
+  }
+  return void 0;
+}
 function isHttpProtocol2(protocol) {
   return protocol === "http:" || protocol === "https:";
 }
@@ -20391,9 +20667,11 @@ function redactUrlString2(value, options) {
     identifiersMasked: false
   };
   if (!looksLikeUrlForRedaction2(value)) return unchanged;
-  const url = parseRedactableUrl2(value);
-  if (!url) return unchanged;
   const replacement = options.replacement ?? "[REDACTED]";
+  const url = parseRedactableUrl2(value);
+  if (!url) {
+    return redactConnectionUserinfoFallback2(value, replacement) ?? unchanged;
+  }
   const idPlaceholder = options.idPlaceholder ?? "[id]";
   const http = isHttpProtocol2(url.protocol);
   let credentialRedacted = url.username.length > 0 || url.password.length > 0;
@@ -20486,7 +20764,7 @@ var STRICT_PROFILE_EXTRA_KEYS2 = [
   "retrieval",
   "query"
 ];
-function isRecord16(value) {
+function isRecord17(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toKey2(key) {
@@ -20915,7 +21193,7 @@ var Redactor2 = class {
       });
       return out;
     }
-    if (isRecord16(value)) {
+    if (isRecord17(value)) {
       if (state.seen.has(value)) return state.seen.get(value);
       const out = {};
       state.seen.set(value, out);
@@ -20950,7 +21228,7 @@ var REDACTION_POLICY_LIMITS = {
 };
 var ALLOWED_TOP_LEVEL = /* @__PURE__ */ new Set(["version", "extraKeys", "patterns"]);
 var ALLOWED_PATTERN_FIELDS = /* @__PURE__ */ new Set(["id", "type", "value", "severity"]);
-function isRecord17(value) {
+function isRecord18(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function rejectRemotePolicyPath(policyPath) {
@@ -20990,7 +21268,7 @@ function rejectUnknownFields(record, allowed, label) {
 }
 function compilePatternDetector(input3, index) {
   const label = `patterns[${index}]`;
-  if (!isRecord17(input3)) throw new Error(`${label} must be an object.`);
+  if (!isRecord18(input3)) throw new Error(`${label} must be an object.`);
   const typeEarly = input3.type;
   if (typeEarly === "typed") {
     throw new Error(
@@ -21045,7 +21323,7 @@ function compilePatternDetector(input3, index) {
   };
 }
 function compileRedactionPolicy(raw, policyPath) {
-  if (!isRecord17(raw)) {
+  if (!isRecord18(raw)) {
     throw new Error(`Redaction policy must be a JSON object (${policyPath}).`);
   }
   rejectUnknownFields(raw, ALLOWED_TOP_LEVEL, "Redaction policy");
@@ -22081,7 +22359,7 @@ async function openCommand(input3, options = {}, stdin = process.stdin) {
 
 // packages/cli/src/migrate.ts
 init_advanced();
-function isRecord18(value) {
+function isRecord19(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseTarget(value) {
@@ -22090,7 +22368,7 @@ function parseTarget(value) {
   throw new Error('Unsupported migration target. Use "--to 1.0".');
 }
 function formatOf(value) {
-  if (!isRecord18(value)) return "unknown";
+  if (!isRecord19(value)) return "unknown";
   if (value.schemaVersion === "0.1") return "0.1";
   if (value.schemaVersion === "0.2") return "0.2";
   if (value.schemaVersion === "1.0") return "1.0";
@@ -28614,16 +28892,120 @@ function demoTemplate(framework) {
   switch (framework) {
     case "ai-sdk":
       return `/**
- * AI SDK starter \u2014 metadata-only telemetry (no real model calls in this demo).
- * Install: npm install agent-inspect @agent-inspect/ai-sdk ai
+ * AI SDK starter \u2014 keyless MockLanguageModelV3 + @agent-inspect/ai-sdk telemetry.
+ * Install: npm install agent-inspect @agent-inspect/ai-sdk ai@6.0.210 zod
  */
-import { inspectRun, step } from "agent-inspect";
+import { generateText, stepCountIs, tool } from "ai";
+import { MockLanguageModelV3 } from "ai/test";
+import { agentInspect } from "@agent-inspect/ai-sdk";
+import { z } from "zod";
+import { readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+const TRACE_DIR = ".agent-inspect";
+const ANSWER = "You have 2 orders";
+const CORRECT_RUN = "ai-sdk-demo-correct";
+const WRONG_RUN = "ai-sdk-demo-wrong";
+
+const usage = {
+  inputTokens: { total: 4, noCache: 4, cacheRead: 0, cacheWrite: 0 },
+  outputTokens: { total: 3, text: 3, reasoning: 0 },
+};
+
+const lookupOrders = tool({
+  description: "Look up orders for a user",
+  inputSchema: z.object({ userId: z.string() }),
+  execute: async () => ({ orders: 2 }),
+});
+
+const deleteOrders = tool({
+  description: "Delete orders for a user (wrong path)",
+  inputSchema: z.object({ userId: z.string() }),
+  execute: async () => ({ orders: 2 }),
+});
+
+async function runPath(runName, toolName) {
+  const integration = agentInspect({
+    traceDir: TRACE_DIR,
+    runName,
+    capture: "metadata-only",
+  });
+  let step = 0;
+  try {
+    const result = await generateText({
+      model: new MockLanguageModelV3({
+        provider: "fixture-provider",
+        modelId: "fixture-tools",
+        doGenerate: async () => {
+          step += 1;
+          if (step === 1) {
+            return {
+              content: [
+                {
+                  type: "tool-call",
+                  toolCallId: \`call-\${toolName}\`,
+                  toolName,
+                  input: { userId: "u1" },
+                },
+              ],
+              finishReason: { unified: "tool-calls", raw: "tool-calls" },
+              usage,
+              warnings: [],
+            };
+          }
+          return {
+            content: [{ type: "text", text: ANSWER }],
+            finishReason: { unified: "stop", raw: "stop" },
+            usage,
+            warnings: [],
+          };
+        },
+      }),
+      tools: { lookup_orders: lookupOrders, delete_orders: deleteOrders },
+      prompt: "How many orders do I have?",
+      stopWhen: stepCountIs(5),
+      experimental_telemetry: {
+        isEnabled: true,
+        recordInputs: false,
+        recordOutputs: false,
+        integrations: [integration],
+      },
+    });
+    if (result.text !== ANSWER) {
+      throw new Error(\`unexpected answer for \${runName}: \${result.text}\`);
+    }
+  } finally {
+    await integration.flush();
+    await integration.close();
+  }
+}
+
+function selectRunIdByName(runName) {
+  const files = readdirSync(TRACE_DIR).filter((f) => f.endsWith(".jsonl"));
+  const matches = [];
+  for (const file of files) {
+    const text = readFileSync(path.join(TRACE_DIR, file), "utf8");
+    if (text.includes(\`"name":"\${runName}"\`) || text.includes(\`"name": "\${runName}"\`)) {
+      matches.push(file.replace(/\\.jsonl$/, ""));
+    }
+  }
+  if (matches.length !== 1) {
+    throw new Error(
+      \`expected exactly one run named \${runName}, found \${matches.length}\`,
+    );
+  }
+  return matches[0];
+}
 
 async function main() {
-  await inspectRun("ai-sdk-demo", async () => {
-    await step.tool("mock-generate", async () => ({ text: "ok" }));
-  }, { traceDir: ".agent-inspect", silent: true });
+  await runPath(CORRECT_RUN, "lookup_orders");
+  await runPath(WRONG_RUN, "delete_orders");
+  const correctId = selectRunIdByName(CORRECT_RUN);
+  const wrongId = selectRunIdByName(WRONG_RUN);
   console.log("Trace written to .agent-inspect/");
+  console.log(\`Correct path runId: \${correctId}\`);
+  console.log(\`Wrong path runId:   \${wrongId}\`);
+  console.log(\`Next: npx agent-inspect check \${correctId} --required-tool lookup_orders\`);
 }
 
 main().catch((error) => {