agent-inspect 6.31.5 → 6.31.7

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, diffRuns, manualTraceEventsToComparableRun } from './chunk-LKEPABND.mjs';
+import { ATTRIBUTION_CONFIDENCES, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, resolveBundleRunIds, getTraceFilePath, openTrace, sha256Hex, collectTraceSchemaVersions, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceHtmlShell, buildEvidenceProvenanceViewHtml, EVIDENCE_FORMAT_VERSION, inferEvidenceFileRole, buildEvidenceSafetyViewHtml, buildEvidenceDiffViewHtml, buildEvidenceCircuitViewHtml, buildEvidenceOutcomesViewHtml, buildEvidenceContractsViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceCausalFailureViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceTreeViewHtml, buildEvidenceManifest, serializeEvidenceManifest, buildZipArchive, assertBundlePathContained, enrichSessionRunRecord, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, runTraceChecks, assertEvidenceRelativePath, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, TraceReadError, resolveRedactionProfile, applyProfileMetadataCaps, Redactor, flattenTree, escapeHtml, safeString, compactAttributes, stableJson, escapeMarkdown, DEFAULT_REDACT_KEYS, truncateStringForProfile, stringContainsHighConfidenceCredential, isCredentialSensitiveKey, extractMetadata, filterTraces, truncateName, buildRunSummary, formatDuration, formatTimestamp, renderErrorLine, isAgentInspectTrace, persistedInspectEventsToRunTrees, defineTraceContract, filterMetasBySessionScope, evaluateTraceContract, aggregateSessionCheckResults, createBaselineRegressionRule, summarizeSemanticParity, buildEvidenceCiPackage, verifyEvidenceDirectory, diffTraceEvents, renderRunDiff, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, formatStepLabel, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, getIndent, TreeBuilder, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, projectLogicalEvents, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, isAttributionConfidence, zeroKinds, diffRuns, manualTraceEventsToComparableRun } from './chunk-QV73NM25.mjs';
 import { realpathSync, constants as constants$1, existsSync, readFileSync } from 'fs';
 import path19 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -14,7 +14,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.31.5";
+var version = "6.31.7";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -333,7 +333,7 @@ function mapReaderFormat(format) {
 function isMissingFileError(error) {
   return error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT";
 }
-async function readRunTraceEvents(runId, traceDir) {
+async function readRunPersistedEvents(runId, traceDir) {
   const filePath = getTraceFilePath(runId, traceDir);
   try {
     await access(filePath);
@@ -341,16 +341,24 @@ async function readRunTraceEvents(runId, traceDir) {
       { type: "file", path: filePath },
       { format: "agent-inspect-jsonl" }
     );
-    const events = persistedInspectEventsToTraceEvents(result.events);
     return {
-      events,
-      format: events.length > 0 ? mapReaderFormat(result.format) : "empty"
+      events: result.events,
+      format: result.events.length > 0 ? mapReaderFormat(result.format) : "empty"
     };
   } catch (error) {
     if (isMissingFileError(error)) return void 0;
     throw error;
   }
 }
+async function readRunTraceEvents(runId, traceDir) {
+  const persisted = await readRunPersistedEvents(runId, traceDir);
+  if (persisted === void 0) return void 0;
+  const events = persistedInspectEventsToTraceEvents(persisted.events);
+  return {
+    events,
+    format: events.length > 0 ? persisted.format : "empty"
+  };
+}
 
 // packages/cli/src/view.ts
 function isModuleNotFound(e) {
@@ -1775,6 +1783,8 @@ var CONNECTION_PROTOCOLS = /* @__PURE__ */ new Set([
   "amqps:"
 ]);
 var CONNECTION_URI = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s]+$/i;
+var CONNECTION_USERINFO = /^(postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/([^@/?#]+)@(.+)$/i;
+var CONNECTION_HAS_USERINFO = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^@/?#]+@/i;
 var UUID_SEGMENT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HEX_SEGMENT = /^[0-9a-f]{12,}$/i;
 var NUMERIC_SEGMENT = /^\d{5,}$/;
@@ -1798,6 +1808,28 @@ function parseRedactableUrl(value) {
     return void 0;
   }
 }
+function redactConnectionUserinfoFallback(value, replacement) {
+  const trimmed = value.trim();
+  const match = CONNECTION_USERINFO.exec(trimmed);
+  if (match) {
+    const [, scheme, , rest] = match;
+    if (scheme && rest && rest.length > 0) {
+      return {
+        value: `${scheme}://${rest}`,
+        credentialRedacted: true,
+        identifiersMasked: false
+      };
+    }
+  }
+  if (looksLikeConnectionUri(trimmed) && CONNECTION_HAS_USERINFO.test(trimmed)) {
+    return {
+      value: replacement,
+      credentialRedacted: true,
+      identifiersMasked: false
+    };
+  }
+  return void 0;
+}
 function isHttpProtocol(protocol) {
   return protocol === "http:" || protocol === "https:";
 }
@@ -1839,9 +1871,11 @@ function redactUrlString(value, options) {
     identifiersMasked: false
   };
   if (!looksLikeUrlForRedaction(value)) return unchanged;
-  const url = parseRedactableUrl(value);
-  if (!url) return unchanged;
   const replacement = options.replacement ?? "[REDACTED]";
+  const url = parseRedactableUrl(value);
+  if (!url) {
+    return redactConnectionUserinfoFallback(value, replacement) ?? unchanged;
+  }
   const idPlaceholder = options.idPlaceholder ?? "[id]";
   const http = isHttpProtocol(url.protocol);
   let credentialRedacted = url.username.length > 0 || url.password.length > 0;
@@ -2530,6 +2564,10 @@ function exportOpenInference(tree, options) {
     warnings
   };
 }
+var OTLP_STATUS_CODE_UNSET = 0;
+var OTLP_STATUS_CODE_OK = 1;
+var OTLP_STATUS_CODE_ERROR = 2;
+var OTLP_SPAN_KIND_INTERNAL = 1;
 function hexFrom2(seed, byteLen) {
   return crypto.createHash("sha256").update(seed, "utf8").digest("hex").slice(0, byteLen * 2);
 }
@@ -2542,7 +2580,19 @@ function stringAttr(key, value) {
   return { key, value: { stringValue: value } };
 }
 function intAttr(key, value) {
-  return { key, value: { intValue: String(value) } };
+  return { key, value: { intValue: String(Math.trunc(value)) } };
+}
+function doubleAttr(key, value) {
+  return { key, value: { doubleValue: value } };
+}
+function boolAttr(key, value) {
+  return { key, value: { boolValue: value } };
+}
+function numberAttr(key, value) {
+  if (Number.isFinite(value) && !Number.isInteger(value)) {
+    return doubleAttr(key, value);
+  }
+  return intAttr(key, value);
 }
 function genAiOperationName(kind) {
   switch (kind) {
@@ -2556,10 +2606,27 @@ function genAiOperationName(kind) {
       return void 0;
   }
 }
+function resolveSpanTimes(ev) {
+  const startedAtMs = typeof ev.attributes?.startedAtMs === "number" && Number.isFinite(ev.attributes.startedAtMs) ? ev.attributes.startedAtMs : void 0;
+  const endedAtMs = typeof ev.attributes?.endedAtMs === "number" && Number.isFinite(ev.attributes.endedAtMs) ? ev.attributes.endedAtMs : void 0;
+  const startMs = startedAtMs ?? ev.timestamp;
+  const startNs = String(unixNano2(startMs));
+  if (endedAtMs !== void 0) {
+    return { startNs, endNs: String(unixNano2(endedAtMs)) };
+  }
+  if (ev.durationMs !== void 0 && Number.isFinite(ev.durationMs)) {
+    return {
+      startNs,
+      endNs: String(unixNano2(startMs) + unixNano2(ev.durationMs))
+    };
+  }
+  return { startNs };
+}
 function exportOtlpJson(tree, options) {
   const warnings = [
     "OTLP JSON export uses OTel GenAI-aligned attributes where applicable; experimental until verified against specific collectors.",
-    "Not OTLP gRPC/protobuf \u2014 JSON mapping only. Generated locally; no network upload."
+    "Not OTLP gRPC/protobuf \u2014 JSON mapping only. Generated locally; no network upload.",
+    "Status and span kind use OTLP numeric enums (StatusCode 0/1/2, SpanKind INTERNAL=1)."
   ];
   const traceId = hexFrom2(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
@@ -2571,11 +2638,7 @@ function exportOtlpJson(tree, options) {
     const ev = n.event;
     const spanId = hexFrom2(`${tree.runId}:${ev.eventId}`, 8);
     const parentSpanId = ev.parentId ? hexFrom2(`${tree.runId}:${ev.parentId}`, 8) : void 0;
-    const startNs = String(unixNano2(ev.timestamp));
-    let endNs;
-    if (ev.durationMs !== void 0 && Number.isFinite(ev.durationMs)) {
-      endNs = String(unixNano2(ev.timestamp) + unixNano2(ev.durationMs));
-    }
+    const { startNs, endNs } = resolveSpanTimes(ev);
     const attrs = [
       stringAttr("agent_inspect.kind", ev.kind),
       stringAttr("agent_inspect.confidence", ev.confidence),
@@ -2605,29 +2668,28 @@ function exportOtlpJson(tree, options) {
     if (includeAttributes && meta && typeof meta === "object") {
       for (const [k, v] of Object.entries(meta)) {
         if (k === "tokens" || k === "model") continue;
-        if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
-          attrs.push(
-            stringAttr(
-              `agent_inspect.preview.${k}`,
-              typeof v === "string" ? v.slice(0, maxLen) : String(v)
-            )
-          );
+        if (typeof v === "string") {
+          attrs.push(stringAttr(`agent_inspect.preview.${k}`, v.slice(0, maxLen)));
+        } else if (typeof v === "number" && Number.isFinite(v)) {
+          attrs.push(numberAttr(`agent_inspect.preview.${k}`, v));
+        } else if (typeof v === "boolean") {
+          attrs.push(boolAttr(`agent_inspect.preview.${k}`, v));
         }
       }
     }
-    let statusCode = "STATUS_CODE_UNSET";
+    let statusCode = OTLP_STATUS_CODE_UNSET;
     let statusMessage;
     if (ev.status === "error") {
-      statusCode = "STATUS_CODE_ERROR";
+      statusCode = OTLP_STATUS_CODE_ERROR;
       statusMessage = meta && typeof meta.error === "object" && meta.error !== null ? String(meta.error.message ?? "error").slice(0, maxLen) : "error";
     } else if (ev.status === "ok") {
-      statusCode = "STATUS_CODE_OK";
+      statusCode = OTLP_STATUS_CODE_OK;
     }
     const spanJson = {
       traceId,
       spanId,
       name: ev.name,
-      kind: "SPAN_KIND_INTERNAL",
+      kind: OTLP_SPAN_KIND_INTERNAL,
       startTimeUnixNano: startNs,
       attributes: attrs,
       status: {
@@ -2669,6 +2731,136 @@ function exportOtlpJson(tree, options) {
 
 // packages/core/src/exporters/validation.ts
 var EXPERIMENTAL = "Experimental compatibility export \u2014 verify against your target tooling before relying on it.";
+function pushPath(errors, path30, message) {
+  errors.push(`${path30}: ${message}`);
+}
+function isRecord5(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateOtlpJson(content) {
+  const errors = [];
+  const warnings = [
+    EXPERIMENTAL,
+    "OTLP JSON mapping uses OTel GenAI-aligned attributes where applicable; collectors may require transformation.",
+    "protocol-valid \u2260 profile-complete \u2260 fixture-complete \u2014 nested path diagnostics report protocol shape only."
+  ];
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    pushPath(errors, "$", "OTLP JSON export is not valid JSON");
+    return { ok: false, format: "otlp-json", errors, warnings };
+  }
+  if (!isRecord5(parsed)) {
+    pushPath(errors, "$", "OTLP JSON export must be an object");
+    return { ok: false, format: "otlp-json", errors, warnings };
+  }
+  if (!Array.isArray(parsed.resourceSpans)) {
+    pushPath(errors, "$.resourceSpans", "must be an array");
+    return { ok: false, format: "otlp-json", errors, warnings };
+  }
+  parsed.resourceSpans.forEach((resourceSpan, rsi) => {
+    const rsPath = `$.resourceSpans[${rsi}]`;
+    if (!isRecord5(resourceSpan)) {
+      pushPath(errors, rsPath, "must be an object");
+      return;
+    }
+    if (!Array.isArray(resourceSpan.scopeSpans)) {
+      pushPath(errors, `${rsPath}.scopeSpans`, "must be an array");
+      return;
+    }
+    resourceSpan.scopeSpans.forEach((scopeSpan, ssi) => {
+      const ssPath = `${rsPath}.scopeSpans[${ssi}]`;
+      if (!isRecord5(scopeSpan)) {
+        pushPath(errors, ssPath, "must be an object");
+        return;
+      }
+      if (!Array.isArray(scopeSpan.spans)) {
+        pushPath(errors, `${ssPath}.spans`, "must be an array");
+        return;
+      }
+      scopeSpan.spans.forEach((span, spi) => {
+        const spanPath = `${ssPath}.spans[${spi}]`;
+        if (!isRecord5(span)) {
+          pushPath(errors, spanPath, "must be an object");
+          return;
+        }
+        if (typeof span.traceId !== "string" || span.traceId.length === 0) {
+          pushPath(errors, `${spanPath}.traceId`, "must be a non-empty string");
+        }
+        if (typeof span.spanId !== "string" || span.spanId.length === 0) {
+          pushPath(errors, `${spanPath}.spanId`, "must be a non-empty string");
+        }
+        if (typeof span.name !== "string") {
+          pushPath(errors, `${spanPath}.name`, "must be a string");
+        }
+        if (typeof span.startTimeUnixNano !== "string" || !/^\d+$/.test(span.startTimeUnixNano)) {
+          pushPath(
+            errors,
+            `${spanPath}.startTimeUnixNano`,
+            "must be a decimal-string 64-bit integer"
+          );
+        }
+        if (span.endTimeUnixNano !== void 0 && (typeof span.endTimeUnixNano !== "string" || !/^\d+$/.test(span.endTimeUnixNano))) {
+          pushPath(
+            errors,
+            `${spanPath}.endTimeUnixNano`,
+            "must be a decimal-string 64-bit integer when present"
+          );
+        }
+        if (typeof span.kind === "number") {
+          if (!Number.isInteger(span.kind)) {
+            pushPath(errors, `${spanPath}.kind`, "must be an integer SpanKind enum");
+          }
+        } else if (typeof span.kind === "string") {
+          warnings.push(
+            `${spanPath}.kind: string SpanKind enum is legacy; prefer numeric (INTERNAL=1)`
+          );
+        } else if (span.kind !== void 0) {
+          pushPath(
+            errors,
+            `${spanPath}.kind`,
+            "must be numeric SpanKind or historical string enum"
+          );
+        }
+        if (!isRecord5(span.status)) {
+          pushPath(errors, `${spanPath}.status`, "must be an object");
+        } else {
+          const code = span.status.code;
+          if (typeof code === "number") {
+            if (![0, 1, 2].includes(code)) {
+              pushPath(
+                errors,
+                `${spanPath}.status.code`,
+                "must be numeric StatusCode 0 (UNSET), 1 (OK), or 2 (ERROR)"
+              );
+            }
+          } else if (typeof code === "string") {
+            const upper = code.toUpperCase();
+            if (upper !== "STATUS_CODE_UNSET" && upper !== "STATUS_CODE_OK" && upper !== "STATUS_CODE_ERROR" && upper !== "UNSET" && upper !== "OK" && upper !== "ERROR" && !/^[012]$/.test(code.trim())) {
+              pushPath(
+                errors,
+                `${spanPath}.status.code`,
+                "unrecognized StatusCode string"
+              );
+            } else {
+              warnings.push(
+                `${spanPath}.status.code: string StatusCode is legacy; prefer numeric 0/1/2`
+              );
+            }
+          } else {
+            pushPath(
+              errors,
+              `${spanPath}.status.code`,
+              "must be numeric StatusCode 0/1/2 or historical string enum"
+            );
+          }
+        }
+      });
+    });
+  });
+  return { ok: errors.length === 0, format: "otlp-json", errors, warnings };
+}
 function validateExportContent(format, content) {
   const errors = [];
   const warnings = [EXPERIMENTAL];
@@ -2714,25 +2906,7 @@ function validateExportContent(format, content) {
     return { ok: errors.length === 0, format, errors, warnings };
   }
   if (format === "otlp-json") {
-    let parsed;
-    try {
-      parsed = JSON.parse(content);
-    } catch {
-      errors.push("OTLP JSON export is not valid JSON");
-      return { ok: false, format, errors, warnings };
-    }
-    if (!parsed || typeof parsed !== "object") {
-      errors.push("OTLP JSON export must be an object");
-      return { ok: false, format, errors, warnings };
-    }
-    const o = parsed;
-    if (!Array.isArray(o.resourceSpans)) {
-      errors.push("OTLP JSON export must include resourceSpans array");
-    }
-    warnings.push(
-      "OTLP JSON mapping uses OTel GenAI-aligned attributes where applicable; collectors may require transformation."
-    );
-    return { ok: errors.length === 0, format, errors, warnings };
+    return validateOtlpJson(content);
   }
   errors.push(`Unsupported export format`);
   return { ok: false, format, errors, warnings };
@@ -3125,7 +3299,7 @@ async function exportCommand(runId, options = {}) {
   const traceDir = resolveTraceDir({ dir: options.dir });
   let events;
   try {
-    const result2 = await readRunTraceEvents(id, traceDir);
+    const result2 = await readRunPersistedEvents(id, traceDir);
     events = result2?.events ?? [];
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
@@ -3141,7 +3315,11 @@ Trace directory: ${traceDir}`);
   }
   let tree;
   try {
-    tree = manualTraceEventsToRunTree(events);
+    const trees = persistedInspectEventsToRunTrees(events);
+    tree = trees.find((candidate) => candidate.runId === id) ?? trees[0];
+    if (tree === void 0) {
+      throw new Error("No run tree could be built from persisted events");
+    }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     console.error(`[AgentInspect] export failed: ${msg}`);
@@ -3169,7 +3347,9 @@ Trace directory: ${traceDir}`);
     await mkdir(path19.dirname(outPath), { recursive: true });
     await writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
-    console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
+    console.error(
+      `Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`
+    );
     if (validation !== void 0 && !validation.ok) {
       console.error("Validation errors:", validation.errors.join("; "));
     }
@@ -3182,7 +3362,9 @@ Trace directory: ${traceDir}`);
       warnings: [...result.warnings, ...validation?.warnings ?? []],
       validation
     };
-    if (outPath === void 0) {
+    if (outPath !== void 0) {
+      payload.out = outPath;
+    } else {
       payload.content = result.content;
     }
     console.log(JSON.stringify(payload, null, 2));
@@ -3539,7 +3721,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-4WYF5RFI.mjs');
+    const mod = await import('./src-KFOBXFPN.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -4062,7 +4244,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
 }
 
 // packages/redact/src/key-value-secret.ts
-var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})`;
 var KEY_VALUE_SECRET_PATTERN = new RegExp(
   KEY_VALUE_SECRET_PATTERN_SOURCE,
   "i"
@@ -4087,6 +4269,8 @@ var CONNECTION_PROTOCOLS2 = /* @__PURE__ */ new Set([
   "amqps:"
 ]);
 var CONNECTION_URI2 = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s]+$/i;
+var CONNECTION_USERINFO2 = /^(postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/([^@/?#]+)@(.+)$/i;
+var CONNECTION_HAS_USERINFO2 = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^@/?#]+@/i;
 var UUID_SEGMENT2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HEX_SEGMENT2 = /^[0-9a-f]{12,}$/i;
 var NUMERIC_SEGMENT2 = /^\d{5,}$/;
@@ -4110,6 +4294,28 @@ function parseRedactableUrl2(value) {
     return void 0;
   }
 }
+function redactConnectionUserinfoFallback2(value, replacement) {
+  const trimmed = value.trim();
+  const match = CONNECTION_USERINFO2.exec(trimmed);
+  if (match) {
+    const [, scheme, , rest] = match;
+    if (scheme && rest && rest.length > 0) {
+      return {
+        value: `${scheme}://${rest}`,
+        credentialRedacted: true,
+        identifiersMasked: false
+      };
+    }
+  }
+  if (looksLikeConnectionUri2(trimmed) && CONNECTION_HAS_USERINFO2.test(trimmed)) {
+    return {
+      value: replacement,
+      credentialRedacted: true,
+      identifiersMasked: false
+    };
+  }
+  return void 0;
+}
 function isHttpProtocol2(protocol) {
   return protocol === "http:" || protocol === "https:";
 }
@@ -4151,9 +4357,11 @@ function redactUrlString2(value, options) {
     identifiersMasked: false
   };
   if (!looksLikeUrlForRedaction2(value)) return unchanged;
-  const url = parseRedactableUrl2(value);
-  if (!url) return unchanged;
   const replacement = options.replacement ?? "[REDACTED]";
+  const url = parseRedactableUrl2(value);
+  if (!url) {
+    return redactConnectionUserinfoFallback2(value, replacement) ?? unchanged;
+  }
   const idPlaceholder = options.idPlaceholder ?? "[id]";
   const http = isHttpProtocol2(url.protocol);
   let credentialRedacted = url.username.length > 0 || url.password.length > 0;
@@ -4246,7 +4454,7 @@ var STRICT_PROFILE_EXTRA_KEYS = [
   "retrieval",
   "query"
 ];
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toKey(key) {
@@ -4675,7 +4883,7 @@ var Redactor2 = class {
       });
       return out;
     }
-    if (isRecord5(value)) {
+    if (isRecord6(value)) {
       if (state.seen.has(value)) return state.seen.get(value);
       const out = {};
       state.seen.set(value, out);
@@ -4710,7 +4918,7 @@ var REDACTION_POLICY_LIMITS = {
 };
 var ALLOWED_TOP_LEVEL = /* @__PURE__ */ new Set(["version", "extraKeys", "patterns"]);
 var ALLOWED_PATTERN_FIELDS = /* @__PURE__ */ new Set(["id", "type", "value", "severity"]);
-function isRecord6(value) {
+function isRecord7(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function rejectRemotePolicyPath(policyPath) {
@@ -4750,7 +4958,7 @@ function rejectUnknownFields(record, allowed, label) {
 }
 function compilePatternDetector(input3, index) {
   const label = `patterns[${index}]`;
-  if (!isRecord6(input3)) throw new Error(`${label} must be an object.`);
+  if (!isRecord7(input3)) throw new Error(`${label} must be an object.`);
   const typeEarly = input3.type;
   if (typeEarly === "typed") {
     throw new Error(
@@ -4805,7 +5013,7 @@ function compilePatternDetector(input3, index) {
   };
 }
 function compileRedactionPolicy(raw, policyPath) {
-  if (!isRecord6(raw)) {
+  if (!isRecord7(raw)) {
     throw new Error(`Redaction policy must be a JSON object (${policyPath}).`);
   }
   rejectUnknownFields(raw, ALLOWED_TOP_LEVEL, "Redaction policy");
@@ -5827,7 +6035,7 @@ async function openCommand(input3, options = {}, stdin = process.stdin) {
     }
   }
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseTarget(value) {
@@ -5836,7 +6044,7 @@ function parseTarget(value) {
   throw new Error('Unsupported migration target. Use "--to 1.0".');
 }
 function formatOf(value) {
-  if (!isRecord7(value)) return "unknown";
+  if (!isRecord8(value)) return "unknown";
   if (value.schemaVersion === "0.1") return "0.1";
   if (value.schemaVersion === "0.2") return "0.2";
   if (value.schemaVersion === "1.0") return "1.0";
@@ -12337,16 +12545,120 @@ function demoTemplate(framework) {
   switch (framework) {
     case "ai-sdk":
       return `/**
- * AI SDK starter \u2014 metadata-only telemetry (no real model calls in this demo).
- * Install: npm install agent-inspect @agent-inspect/ai-sdk ai
+ * AI SDK starter \u2014 keyless MockLanguageModelV3 + @agent-inspect/ai-sdk telemetry.
+ * Install: npm install agent-inspect @agent-inspect/ai-sdk ai@6.0.210 zod
  */
-import { inspectRun, step } from "agent-inspect";
+import { generateText, stepCountIs, tool } from "ai";
+import { MockLanguageModelV3 } from "ai/test";
+import { agentInspect } from "@agent-inspect/ai-sdk";
+import { z } from "zod";
+import { readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+const TRACE_DIR = ".agent-inspect";
+const ANSWER = "You have 2 orders";
+const CORRECT_RUN = "ai-sdk-demo-correct";
+const WRONG_RUN = "ai-sdk-demo-wrong";
+
+const usage = {
+  inputTokens: { total: 4, noCache: 4, cacheRead: 0, cacheWrite: 0 },
+  outputTokens: { total: 3, text: 3, reasoning: 0 },
+};
+
+const lookupOrders = tool({
+  description: "Look up orders for a user",
+  inputSchema: z.object({ userId: z.string() }),
+  execute: async () => ({ orders: 2 }),
+});
+
+const deleteOrders = tool({
+  description: "Delete orders for a user (wrong path)",
+  inputSchema: z.object({ userId: z.string() }),
+  execute: async () => ({ orders: 2 }),
+});
+
+async function runPath(runName, toolName) {
+  const integration = agentInspect({
+    traceDir: TRACE_DIR,
+    runName,
+    capture: "metadata-only",
+  });
+  let step = 0;
+  try {
+    const result = await generateText({
+      model: new MockLanguageModelV3({
+        provider: "fixture-provider",
+        modelId: "fixture-tools",
+        doGenerate: async () => {
+          step += 1;
+          if (step === 1) {
+            return {
+              content: [
+                {
+                  type: "tool-call",
+                  toolCallId: \`call-\${toolName}\`,
+                  toolName,
+                  input: { userId: "u1" },
+                },
+              ],
+              finishReason: { unified: "tool-calls", raw: "tool-calls" },
+              usage,
+              warnings: [],
+            };
+          }
+          return {
+            content: [{ type: "text", text: ANSWER }],
+            finishReason: { unified: "stop", raw: "stop" },
+            usage,
+            warnings: [],
+          };
+        },
+      }),
+      tools: { lookup_orders: lookupOrders, delete_orders: deleteOrders },
+      prompt: "How many orders do I have?",
+      stopWhen: stepCountIs(5),
+      experimental_telemetry: {
+        isEnabled: true,
+        recordInputs: false,
+        recordOutputs: false,
+        integrations: [integration],
+      },
+    });
+    if (result.text !== ANSWER) {
+      throw new Error(\`unexpected answer for \${runName}: \${result.text}\`);
+    }
+  } finally {
+    await integration.flush();
+    await integration.close();
+  }
+}
+
+function selectRunIdByName(runName) {
+  const files = readdirSync(TRACE_DIR).filter((f) => f.endsWith(".jsonl"));
+  const matches = [];
+  for (const file of files) {
+    const text = readFileSync(path.join(TRACE_DIR, file), "utf8");
+    if (text.includes(\`"name":"\${runName}"\`) || text.includes(\`"name": "\${runName}"\`)) {
+      matches.push(file.replace(/\\.jsonl$/, ""));
+    }
+  }
+  if (matches.length !== 1) {
+    throw new Error(
+      \`expected exactly one run named \${runName}, found \${matches.length}\`,
+    );
+  }
+  return matches[0];
+}
 
 async function main() {
-  await inspectRun("ai-sdk-demo", async () => {
-    await step.tool("mock-generate", async () => ({ text: "ok" }));
-  }, { traceDir: ".agent-inspect", silent: true });
+  await runPath(CORRECT_RUN, "lookup_orders");
+  await runPath(WRONG_RUN, "delete_orders");
+  const correctId = selectRunIdByName(CORRECT_RUN);
+  const wrongId = selectRunIdByName(WRONG_RUN);
   console.log("Trace written to .agent-inspect/");
+  console.log(\`Correct path runId: \${correctId}\`);
+  console.log(\`Wrong path runId:   \${wrongId}\`);
+  console.log(\`Next: npx agent-inspect check \${correctId} --required-tool lookup_orders\`);
 }
 
 main().catch((error) => {
@@ -13339,7 +13651,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-4WYF5RFI.mjs');
+    return await import('./src-KFOBXFPN.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(