agent-inspect 6.4.0 → 6.4.1

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, enrichSessionRunRecord, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, extractMetadata, filterTraces, truncateName, getTraceFilePath, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, openTrace, TraceReadError, filterMetasBySessionScope, runTraceChecks, aggregateSessionCheckResults, createBaselineRegressionRule, resolveBundleRunIds, aggregateBundleSafeStatus, bundleFailsOnSafety, buildPlaceholderArtifact, buildBundleMetadata, buildBundleSummaryMarkdown, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, Redactor, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, normalizeBundleOutputPath, defaultBundleOutputPath, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, escapeMarkdown, escapeHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, resolveRedactionProfile, applyProfileMetadataCaps, flattenTree, safeString, compactAttributes, stableJson, truncateStringForProfile } from './chunk-YS2I722C.mjs';
+import { createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createSafetyOversizedAttributeRule, resolveTraceDir, parseDuration, buildSessionIndex, enrichSessionRunRecord, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, extractMetadata, filterTraces, truncateName, getTraceFilePath, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, openTrace, TraceReadError, filterMetasBySessionScope, runTraceChecks, aggregateSessionCheckResults, createBaselineRegressionRule, resolveBundleRunIds, aggregateBundleSafeStatus, bundleFailsOnSafety, bundleRunAssetRelativePath, buildPlaceholderArtifact, buildBundleMetadata, buildBundleSummaryMarkdown, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, resolveSuiteTemplate, defaultSuiteConfigTemplate, loadSuiteConfig, validateSuiteConfig, runSuite, renderSuiteReport, analyzeCohort, renderCohortReport, gateHasThresholds, runGate, renderGateReport, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, Redactor, TreeBuilder, zeroKinds, validateEvent, traceEventToPersistedInspectEvent, isPersistedInspectEvent, createRunStatusRule, createStructureOrphanRule, createStructureCycleRule, createRunDurationRule, createMaxStepDurationRule, createRequireCompletedRule, createStallDetectionRule, createObservedOutcomeRule, createRunDepthRule, createToolUsageRule, createLlmUsageRule, createStructureRelationshipRule, createStructureParallelWidthRule, normalizeBundleOutputPath, sanitizeBundleRunId, defaultBundleOutputPath, assertBundlePathContained, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, escapeMarkdown, escapeHtml, DEFAULT_SUITE_ARTIFACTS_DIR, parseCohortMetricList, COHORT_METRIC_IDS, parseGateList, nanoid, resolveRedactionProfile, applyProfileMetadataCaps, flattenTree, safeString, compactAttributes, stableJson, truncateStringForProfile } from './chunk-M6PC5KUT.mjs';
 import { realpathSync, constants as constants$1 } from 'fs';
 import path14 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -11,7 +11,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "6.4.0";
+var version = "6.4.1";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -3782,7 +3782,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-FVNE44UA.mjs');
+    const mod = await import('./src-27LC2BB3.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -6203,27 +6203,36 @@ var viewerIndexHtml = `<!DOCTYPE html>
     const params = new URLSearchParams(location.search);
     const mode = params.get("mode") || "traces";
 
+    function escapeHtml(value) {
+      return String(value ?? "")
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+    }
+
     function renderSuite(data) {
       const rows = data.cases.map((c) =>
-        '<tr><td>' + c.id + '</td><td class="' + c.status + '">' + c.status +
-        '</td><td>' + (c.message || '') + '</td><td>' + c.toolPath.join(' \u2192 ') +
-        '</td><td>' + c.observations.map((o) => o.name + ':' + o.status).join(', ') + '</td></tr>'
+        '<tr><td>' + escapeHtml(c.id) + '</td><td class="' + escapeHtml(c.status) + '">' + escapeHtml(c.status) +
+        '</td><td>' + escapeHtml(c.message || '') + '</td><td>' + escapeHtml(c.toolPath.join(' \u2192 ')) +
+        '</td><td>' + escapeHtml(c.observations.map((o) => o.name + ':' + o.status).join(', ')) + '</td></tr>'
       ).join('');
       const failed = data.cases.filter((c) => c.status !== 'pass');
       const detail = failed.map((c) => {
-        let html = '<h3>Case ' + c.id + '</h3><ul>';
-        if (c.failureDiff) html += '<li>Diff errors: ' + c.failureDiff.summary.errors + '</li>';
-        if (c.timeline) html += '<li>Timeline steps: ' + c.timeline.entries.length + '</li>';
-        html += '<li>Diagnostics: ' + c.diagnostics.map((d) => d.message).join('; ') + '</li></ul>';
+        let html = '<h3>Case ' + escapeHtml(c.id) + '</h3><ul>';
+        if (c.failureDiff) html += '<li>Diff errors: ' + escapeHtml(c.failureDiff.summary.errors) + '</li>';
+        if (c.timeline) html += '<li>Timeline steps: ' + escapeHtml(c.timeline.entries.length) + '</li>';
+        html += '<li>Diagnostics: ' + escapeHtml(c.diagnostics.map((d) => d.message).join('; ')) + '</li></ul>';
         return html;
       }).join('');
-      return '<section><h2>Suite: ' + data.suiteName + ' (' + data.status + ')</h2>' +
-        '<p>Passed ' + data.summary.passed + ', failed ' + data.summary.failed + '</p>' +
+      return '<section><h2>Suite: ' + escapeHtml(data.suiteName) + ' (' + escapeHtml(data.status) + ')</h2>' +
+        '<p>Passed ' + escapeHtml(data.summary.passed) + ', failed ' + escapeHtml(data.summary.failed) + '</p>' +
         '<table><thead><tr><th>Case</th><th>Status</th><th>Message</th><th>Tool path</th><th>Observations</th></tr></thead><tbody>' +
         rows + '</tbody></table>' +
         '<section><h2>Failure detail</h2>' + (detail || '<p class="pass">No failures</p>') + '</section>' +
-        '<section><h2>CI artifacts</h2><p>' + (data.ciArtifactsDir || 'n/a') + '</p></section>' +
-        '<section><h2>Bundle export</h2><p>' + data.bundleExportHint + '</p></section>';
+        '<section><h2>CI artifacts</h2><p>' + escapeHtml(data.ciArtifactsDir || 'n/a') + '</p></section>' +
+        '<section><h2>Bundle export</h2><p>' + escapeHtml(data.bundleExportHint) + '</p></section>';
     }
 
     async function load() {
@@ -6239,8 +6248,8 @@ var viewerIndexHtml = `<!DOCTYPE html>
       if (mode === "workspace") {
         nav.innerHTML = '<a href="/api/workspace">/api/workspace</a>';
         const data = await fetch("/api/workspace").then((r) => r.json());
-        content.innerHTML = '<section><h2>Workspace: ' + (data.project || 'workspace') + '</h2>' +
-          '<p>Runs: ' + data.runs.length + '</p><pre>' + JSON.stringify(data, null, 2) + '</pre></section>';
+        content.innerHTML = '<section><h2>Workspace: ' + escapeHtml(data.project || 'workspace') + '</h2>' +
+          '<p>Runs: ' + escapeHtml(data.runs.length) + '</p><pre>' + escapeHtml(JSON.stringify(data, null, 2)) + '</pre></section>';
         return;
       }
       nav.innerHTML = '<a href="/api/traces">/api/traces</a> \xB7 <a href="/api/sessions">/api/sessions</a>';
@@ -8785,7 +8794,7 @@ async function resolveOutputDir(options, runIds, cwd) {
     const manifest = await readWorkspaceManifestFile(location);
     if (manifest.ok && manifest.manifest) {
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
+      const label = runIds.length === 1 ? sanitizeBundleRunId(runIds[0]) : `multi-${runIds.length}`;
       return resolveInsideWorkspace(
         location.workspaceDir,
         path14.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
@@ -8796,14 +8805,14 @@ async function resolveOutputDir(options, runIds, cwd) {
   return defaultBundleOutputPath(runIds);
 }
 async function writeBundleFile(outputDir, relativePath, content, files) {
-  const outPath = path14.join(outputDir, relativePath);
+  const outPath = assertBundlePathContained(outputDir, relativePath);
   await mkdir(path14.dirname(outPath), { recursive: true });
   await writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
 function renderBundleIndexHtml(parts) {
   const links = parts.runIds.map(
-    (runId) => `<li><a href="assets/runs/${escapeHtml3(runId)}.html">${escapeHtml3(runId)}</a></li>`
+    (runId) => `<li><a href="${escapeHtml3(bundleRunAssetRelativePath(runId, ".html"))}">${escapeHtml3(runId)}</a></li>`
   ).join("");
   const sections = parts.runIds.map((runId) => {
     const html = parts.reports.get(runId) ?? "";
@@ -8971,11 +8980,16 @@ async function bundleCommand(runIdArg, options = {}) {
   await mkdir(outputDir, { recursive: true });
   for (const runId of resolveResult.runIds) {
     const jsonl = redactedJsonlByRun.get(runId) ?? "";
-    await writeBundleFile(outputDir, `assets/runs/${runId}.jsonl`, jsonl, files);
+    await writeBundleFile(
+      outputDir,
+      bundleRunAssetRelativePath(runId, ".jsonl"),
+      jsonl,
+      files
+    );
     const html = htmlByRun.get(runId) ?? "";
     await writeBundleFile(
       outputDir,
-      `assets/runs/${runId}.html`,
+      bundleRunAssetRelativePath(runId, ".html"),
       runReportWrap(html, runId),
       files
     );
@@ -9512,7 +9526,7 @@ main().catch((error) => {
       return `import { observe } from "agent-inspect";
 
 class DemoAgent {
-  async run(input: { question: string }) {
+  async run(input) {
     return { answer: \`Echo: \${input.question}\` };
   }
 }
@@ -9933,6 +9947,23 @@ var PLUGIN_NAME_PREFIXES = [
   "agent-inspect-check-",
   "agent-inspect-importer-"
 ];
+var CAPTURE_MODES = /* @__PURE__ */ new Set(["metadata-only", "preview", "full"]);
+function parseStrictBoolean(value, label, errors) {
+  if (value === void 0) return void 0;
+  if (value === true) return true;
+  if (value === false) return false;
+  errors.push(`${label} must be a boolean true or false, not ${JSON.stringify(value)}`);
+  return void 0;
+}
+function parseCaptureMode(value, errors) {
+  if (value === void 0) return void 0;
+  const mode = String(value);
+  if (!CAPTURE_MODES.has(mode)) {
+    errors.push(`privacy.captureMode must be one of: metadata-only, preview, full`);
+    return void 0;
+  }
+  return mode;
+}
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -9981,20 +10012,35 @@ function parsePluginManifest(input3) {
       errors.push("privacy must be an object");
     } else {
       privacy = {};
-      if (input3.privacy.captureMode !== void 0) {
-        privacy.captureMode = String(input3.privacy.captureMode);
-      }
-      if (input3.privacy.networkAllowed !== void 0) {
-        privacy.networkAllowed = Boolean(input3.privacy.networkAllowed);
-      }
-      if (input3.privacy.uploadAllowed !== void 0) {
-        privacy.uploadAllowed = Boolean(input3.privacy.uploadAllowed);
-      }
-      if (input3.privacy.redactionDocumented !== void 0) {
-        privacy.redactionDocumented = Boolean(input3.privacy.redactionDocumented);
+      const captureMode = parseCaptureMode(input3.privacy.captureMode, errors);
+      if (captureMode !== void 0) privacy.captureMode = captureMode;
+      const networkAllowed = parseStrictBoolean(
+        input3.privacy.networkAllowed,
+        "privacy.networkAllowed",
+        errors
+      );
+      if (networkAllowed !== void 0) privacy.networkAllowed = networkAllowed;
+      const uploadAllowed = parseStrictBoolean(
+        input3.privacy.uploadAllowed,
+        "privacy.uploadAllowed",
+        errors
+      );
+      if (uploadAllowed !== void 0) privacy.uploadAllowed = uploadAllowed;
+      const redactionDocumented = parseStrictBoolean(
+        input3.privacy.redactionDocumented,
+        "privacy.redactionDocumented",
+        errors
+      );
+      if (redactionDocumented !== void 0) {
+        privacy.redactionDocumented = redactionDocumented;
       }
-      if (input3.privacy.frameworkDepsPackageScoped !== void 0) {
-        privacy.frameworkDepsPackageScoped = Boolean(input3.privacy.frameworkDepsPackageScoped);
+      const frameworkDepsPackageScoped = parseStrictBoolean(
+        input3.privacy.frameworkDepsPackageScoped,
+        "privacy.frameworkDepsPackageScoped",
+        errors
+      );
+      if (frameworkDepsPackageScoped !== void 0) {
+        privacy.frameworkDepsPackageScoped = frameworkDepsPackageScoped;
       }
       if (privacy.networkAllowed === true || privacy.uploadAllowed === true) {
         warnings.push("plugin declares network or upload \u2014 review before install");
@@ -10314,7 +10360,7 @@ function isModuleNotFound4(e) {
 }
 async function loadIndexSqlite() {
   try {
-    return await import('./src-FVNE44UA.mjs');
+    return await import('./src-27LC2BB3.mjs');
   } catch (e) {
     if (isModuleNotFound4(e)) {
       console.error(
@@ -10898,6 +10944,12 @@ function parseRate(value) {
   if (!Number.isFinite(parsed)) {
     throw new Error(`Invalid --max-error-rate: ${value}`);
   }
+  if (parsed < 0) {
+    throw new Error("--max-error-rate must be a non-negative percentage.");
+  }
+  if (parsed > 100) {
+    throw new Error("--max-error-rate must be at most 100.");
+  }
   return parsed;
 }
 function parseDuration2(value) {