agenticreplay 0.1.0 → 0.1.2

package/packages/cli/src/commands/attach.ts

@@ -1,441 +0,0 @@
-import { once } from 'node:events';
-import { TraceReader, TraceWriter, ensureRunsDir, resolveRunSelector } from '@agenticreplay/core';
-import {
-  createProxy,
-  type RecordedExchange,
-  type RunCa,
-  type NetRequest,
-  type NetExchange,
-} from '@agenticreplay/proxy';
-import { defaultAdapters } from '@agenticreplay/adapters';
-import type { ParsedArgs } from '../args.js';
-import type { Output } from '../out.js';
-import { advertisedUrl, attachExports, attachInstructions } from '../attach.js';
-import { ExchangeEventDeriver, appendDerivedEvents } from '../exchange-events.js';
-import { SerialQueue } from '../serial.js';
-import {
-  planTlsCapture,
-  recordedTlsHosts,
-  setupTlsCapture,
-  persistNetRequestStart,
-  persistNetExchange,
-} from '../tls-capture.js';
-import { loadExchanges } from './replay.js';
-import { upstreamPlan } from '../upstream.js';
-import { AGENTICREPLAY_VERSION } from '../version.js';
-
-/**
- * `agenticreplay attach` — record an agent this machine did not start.
- *
- * Everything else here launches the agent: an adapter builds an environment, agenticreplay spawns the
- * process, and capture follows from that. It is a good design with one boundary it cannot cross —
- * an agent that is not on this machine. A bot on a VPS, an agent inside a dev container or a cloud
- * sandbox, a harness in someone else's CI: there is no process to spawn, so there is no
- * environment to build and no way to say `agenticreplay record` at all.
- *
- * So this inverts it. AgenticReplay holds the proxy open, prints exactly what to export on the far side,
- * and records whatever arrives until it is stopped. The recording that comes out is not a lesser
- * one: same matcher, same events, same `agenticreplay replay`.
- *
- * The adapters are still what produce the variables — `--for claude` prints what the Claude Code
- * adapter would have set, pointed at the advertised address instead of a loopback one. That keeps
- * one source of truth for "which variable does this harness read", so a sandbox recording cannot
- * drift from a local one.
- */
-
-export interface AttachResult {
-  runId: string;
-  runDir: string;
-  modelExchanges: number;
-  events: number;
-  proxyUrl: string;
-  /** Replay sessions only: recorded exchanges served back, and requests nothing matched. */
-  reused: number;
-  unmatched: number;
-  /**
-   * Non-zero when replay cannot answer a request or recording coverage is incomplete.
-   * An operator stopping the session is normal; missing transport evidence still returns exit 2.
-   */
-  exitCode: number;
-}
-
-export interface AttachOptions {
-  /**
-   * Resolves when the session should stop. Defaults to SIGINT — the operator pressing ctrl-C,
-   * which is how a session with no child process to wait on ends.
-   */
-  until?: Promise<void>;
-  /** Called once the proxy is listening, with the address a remote agent should use. */
-  onReady?: (info: { proxyUrl: string; runId: string }) => void;
-}
-
-export async function attachCommand(
-  args: ParsedArgs,
-  out: Output,
-  cwd = process.cwd(),
-  options: AttachOptions = {},
-): Promise<AttachResult> {
-  const minted: RunCa[] = [];
-  try {
-    return await runAttached(args, out, cwd, options, minted);
-  } catch (err) {
-    for (const ca of minted) await ca.dispose().catch(() => undefined);
-    throw err;
-  }
-}
-
-async function runAttached(
-  args: ParsedArgs,
-  out: Output,
-  cwd: string,
-  options: AttachOptions,
-  minted: RunCa[],
-): Promise<AttachResult> {
-  const registry = defaultAdapters();
-  const bind = args.str('bind') ?? '127.0.0.1';
-  const advertise = args.str('advertise');
-  const requestedPort = args.num('port') ?? 0;
-
-  // Resolved before the run directory is made, so an invocation that cannot work — a wildcard bind
-  // with nothing to advertise — leaves nothing behind to clean up. The port is not known yet when
-  // agenticreplay is choosing one, and does not need to be: only the host can make this fail.
-  advertisedUrl({
-    bind,
-    port: requestedPort === 0 ? 1 : requestedPort,
-    ...(advertise === undefined ? {} : { advertise }),
-  });
-
-  /**
-   * Serving a recording back instead of recording a new one.
-   *
-   * `agenticreplay replay` launches the agent, which is right for a run agenticreplay recorded by launching it and
-   * impossible for one that came from a sandbox — the agent may not exist on this machine at all.
-   * So replay attaches too: same proxy, same matcher, same blocked egress, and the operator points
-   * the same remote agent at it.
-   */
-  // The parser turns a flag with no value into `true`, so a bare `--replay` — or `--replay
-  // --tls-intercept`, where the next token is itself a flag — would read as absent and start a
-  // *recording* session against the live provider. That is the worst direction to fail in.
-  if (args.has('replay') && args.str('replay') === undefined) {
-    throw new Error(
-      '--replay needs the run to serve: agenticreplay attach --replay <run>, or --replay last',
-    );
-  }
-  const replaySelector = args.str('replay');
-  const replaying = replaySelector
-    ? await (async () => {
-        const runDir = (await resolveRunSelector(cwd, replaySelector)).dir;
-        const reader = await TraceReader.open(runDir);
-        return {
-          exchanges: await loadExchanges(reader),
-          hosts: recordedTlsHosts(await reader.events()),
-          // Which harness made the recording. It will be the one connecting again, so it is the
-          // right default for the block the operator pastes.
-          adapter: reader.manifest().adapter?.id,
-        };
-      })()
-    : undefined;
-
-  /**
-   * `exec` is the honest default for a fresh session: agenticreplay does not know what will connect, and
-   * detecting an agent from this directory would be a guess about a machine it cannot see. For a
-   * replay it is the wrong default and a useless one — `exec` sets no variables, so the block the
-   * operator is meant to paste comes out empty. The recording names the harness, so use it.
-   */
-  const adapterName = args.str('for') ?? replaying?.adapter ?? 'exec';
-  const adapter = registry.get(adapterName);
-
-  // The last thing that can refuse the run, and it runs before the trace exists: a writer created
-  // first and abandoned by a throw leaves an unsealed run directory behind, which then wins `last`
-  // — so the next command someone types operates on the session that never happened. Awaited
-  // since it grew the one refusal that needs the disk, an `AGENTICREPLAY_TLS_UPSTREAM_CA` that cannot be
-  // read; the guarantee here is unchanged, it just covers one more way to fail.
-  await planTlsCapture(args, replaying?.hosts);
-
-  // Before the run directory exists, because this refuses an upstream that is not an origin: resolved after it, a
-  // typo in `--upstream-*` left an empty run behind for `agenticreplay list` to show. It depends on nothing
-  // but the arguments and the environment, so there is no reason for it to run any later.
-  const plan = await upstreamPlan(args);
-
-  const dir = await ensureRunsDir(cwd);
-  const writer = await TraceWriter.create(dir, {
-    adapter: {
-      id: adapter.id,
-      version: AGENTICREPLAY_VERSION,
-      harness_version: adapter.harnessVersions,
-    },
-    argv: [adapterName],
-    cwd,
-    agenticreplayVersion: AGENTICREPLAY_VERSION,
-  });
-
-  let modelExchanges = 0;
-  let turn = 0;
-  let unmatched = 0;
-
-  const writes = new SerialQueue();
-  const attempts = new Map<string, number>();
-  let terminalAttempts = 0;
-  async function start(request: NetRequest): Promise<void> {
-    attempts.set(request.requestId, ++turn);
-    await persistNetRequestStart(writer, turn, request);
-  }
-  function finish(exchange: NetExchange): void {
-    terminalAttempts++;
-    const at = attempts.get(exchange.requestId);
-    if (at === undefined) writer.markCaptureIncomplete('missing_request_correlation');
-    writes.push(() => persistNetExchange(writer, at ?? 0, exchange));
-  }
-  const tls = await setupTlsCapture({
-    args,
-    out,
-    ...(replaying ? { recordedHosts: replaying.hosts } : {}),
-    writer,
-    writes,
-    // Out-of-band traffic belongs to whichever turn was in progress when it happened, exactly as in
-    // a launched recording. A fixed 0 filed every net.* event against the start of the session.
-    turn: () => turn,
-    onRequestStart: start,
-    onNetExchange: finish,
-  });
-  if (tls.ca) minted.push(tls.ca);
-  // Read before the proxy closes: `stats()` is a snapshot of a live object, and the teardown in
-  // `finally` is the last moment it is still meaningful.
-  let stats = {
-    matchedExact: 0,
-    matchedInexact: 0,
-    unmatched: 0,
-  } as ReturnType<Awaited<ReturnType<typeof createProxy>>['stats']>;
-  const deriver = new ExchangeEventDeriver();
-
-  // BEFORE THE PROXY, NOT AFTER: `createProxy` is listening by the time it returns, and the first
-  // thing a remote agent sends becomes an event. `attach` wrote no run.start at all, so every
-  // session it recorded opened on `model.request` and the gateway refused the push — "0 run.start
-  // and 1 run.end events". The proxy URL that `record`'s run.start carries is not known yet and is
-  // not read by anything; the adapter and the cwd are what a reader needs.
-  await writer.append({
-    type: 'run.start',
-    actor: 'agenticreplay',
-    turn: 0,
-    attrs: { adapter: adapter.id, cwd, attached: true },
-  });
-
-  const proxy = await createProxy({
-    // A replay session serves the recording and blocks egress, exactly as `agenticreplay replay` does. The
-    // only difference is which side starts the agent, and that is not a difference the proxy has.
-    mode: replaying ? 'replay' : 'record',
-    ...(replaying ? { exchanges: replaying.exchanges, loose: args.bool('loose') } : {}),
-    host: bind,
-    port: requestedPort,
-    upstream: plan.upstream,
-    upstreamHeaders: plan.headers,
-    upstreamHeadersOrigin: plan.headersOrigin,
-    ...tls.proxyOptions,
-    onRequestStart: start,
-    onNetExchange: finish,
-    onUnmatched: () => {
-      unmatched += 1;
-    },
-    onExchange: (exchange: RecordedExchange) => {
-      modelExchanges += 1;
-      const at = exchange.requestId ? (attempts.get(exchange.requestId) ?? 0) : 0;
-      writes.push(() => appendDerivedEvents(writer, deriver, exchange, at));
-    },
-  });
-
-  const advertised = advertisedUrl({
-    bind,
-    port: proxy.port,
-    ...(advertise === undefined ? {} : { advertise }),
-  });
-
-  try {
-    const proxyUrl = advertised;
-
-    // What the adapter would have put into a child's environment, pointed at the reachable
-    // address rather than a loopback one. `runDir` is this machine's, and is only ever used by
-    // adapters that write a scratch file — none of which a remote agent would read, which is why
-    // `--for` is documented as the variables rather than as full instrumentation.
-    const launch = await adapter.prepare({
-      runId: writer.runId,
-      cwd,
-      runDir: writer.runDir,
-      proxyUrl,
-      userArgs: ['<your agent>'],
-      env: process.env,
-    });
-
-    const remoteCaPath = args.str('remote-ca-path') ?? '/tmp/agenticreplay-ca.crt';
-    const instructions = attachInstructions({
-      proxyUrl,
-      adapterEnv: launch.env,
-      ...(proxy.tls
-        ? {
-            ca: { certPath: proxy.tls.caCertPath, bundlePath: proxy.tls.caBundlePath },
-            remoteCaPath,
-          }
-        : {}),
-    });
-
-    out.phase('attached', {
-      run: writer.runId,
-      proxy: proxyUrl,
-      for: adapter.id,
-      ...(replaying
-        ? {
-            serving: replaySelector,
-            exchanges: replaying.exchanges.length,
-            // Same flag, same reason as `agenticreplay replay`: attach takes `--loose` too and passes it
-            // to the same proxy, so the label has to come from it rather than be assumed.
-            egress: args.bool('loose') ? 'live-on-unmatched' : 'blocked',
-          }
-        : {}),
-    });
-    if (proxy.tls) {
-      out.warn('tls.intercepting', {
-        hosts: proxy.tls.hosts,
-        ca_sha256: proxy.tls.fingerprint,
-      });
-      await writer.append({
-        type: 'note',
-        actor: 'agenticreplay',
-        turn: 0,
-        attrs: {
-          rule: 'tls_intercept',
-          hosts: proxy.tls.hosts,
-          ca_sha256: proxy.tls.fingerprint,
-        },
-      });
-    }
-    /**
-     * An instruction the operator cannot act on is worse than none: the block pastes cleanly, the
-     * session waits, and nothing ever connects. Both shapes of that are visible from here.
-     */
-    const exported = attachExports({
-      proxyUrl,
-      adapterEnv: launch.env,
-      ...(proxy.tls
-        ? {
-            ca: { certPath: proxy.tls.caCertPath, bundlePath: proxy.tls.caBundlePath },
-            remoteCaPath,
-          }
-        : {}),
-    });
-    if (Object.keys(exported).length === 0) {
-      out.warn('attach.nothing_to_set', {
-        for: adapter.id,
-        cause: `${adapter.id} redirects nothing, and this session is not intercepting`,
-        next: 'name the harness with --for <agent>, or add --tls-intercept',
-      });
-    }
-    // A path under the run directory exists on this machine and nowhere else. The fetch hook is
-    // the live example: `--for node` names a preload agenticreplay just wrote here, so the block would
-    // instrument nothing over there while looking exactly as though it had.
-    const local = Object.entries(exported)
-      .filter(([, value]) => value.includes(writer.runDir))
-      .map(([name]) => name);
-    if (local.length > 0) {
-      out.warn('attach.local_path', {
-        vars: local.join(','),
-        cause: `${adapter.id} instruments by writing a file here and naming it in the environment`,
-        effect: 'those paths do not exist in the sandbox, so that half of the capture will not run',
-        next: 'copy the named files across, or use --tls-intercept instead',
-      });
-    }
-
-    out.plain('');
-    for (const line of instructions) out.plain(`  ${line}`);
-    out.plain('');
-    out.plain(
-      replaying
-        ? '  Serving the recording. Press ctrl-C when the agent is done.'
-        : '  Recording. Press ctrl-C when the agent is done.',
-    );
-
-    options.onReady?.({ proxyUrl, runId: writer.runId });
-    await (options.until ?? firstInterrupt());
-  } finally {
-    stats = proxy.stats();
-    await proxy.close();
-    await writes.drain().catch(() => writer.markCaptureIncomplete('storage_failure'));
-    await tls.ca?.dispose();
-  }
-
-  /**
-   * The same warning a launched run gets, and it matters more here. A remote agent that was never
-   * given the block — or was given it in a shell that had already started the agent — produces a
-   * session that ends cleanly and records nothing, and there is no exit code to hint at it.
-   */
-  if (modelExchanges === 0 && !replaying) {
-    out.warn('capture.empty', {
-      exchanges: 0,
-      cause: 'nothing connected to the proxy while the session was open',
-      next: 'check the sandbox can reach the advertised address, and that the exports were set',
-    });
-  }
-
-  if (!replaying)
-    writer.setCaptureSummary({
-      status:
-        terminalAttempts > 0 && terminalAttempts === attempts.size ? 'complete' : 'incomplete',
-      issues:
-        terminalAttempts === 0
-          ? ['no_requests_observed']
-          : terminalAttempts !== attempts.size
-            ? ['unfinalized_request']
-            : [],
-      requests: attempts.size,
-      responses: terminalAttempts,
-    });
-  // The other half of the bracket. `close` seals the manifest; it does not write the event.
-  await writer.append({
-    type: 'run.end',
-    actor: 'agenticreplay',
-    turn,
-    attrs: { exchanges: modelExchanges },
-  });
-  const manifest = await writer.close(0);
-  // A replay session did not record a run, and saying it did would send someone looking for turns
-  // in a trace that holds none. It reports what it actually did: how much of the recording the
-  // agent asked for, and what it asked for that the recording could not answer.
-  if (replaying) {
-    out.info('served', {
-      serving: replaySelector,
-      reused: `${stats.matchedExact + stats.matchedInexact}/${replaying.exchanges.length}`,
-      unmatched: stats.unmatched,
-    });
-  } else {
-    out.info('recorded', {
-      run: writer.runId,
-      events: manifest.counts?.events ?? 0,
-      exchanges: modelExchanges,
-      dir: writer.runDir,
-    });
-  }
-
-  return {
-    runId: writer.runId,
-    runDir: writer.runDir,
-    modelExchanges,
-    events: manifest.counts?.events ?? 0,
-    // The address the agent should use, not the one agenticreplay bound — a caller reading this from
-    // `--json` needs something it can connect to, which a wildcard bind is not.
-    proxyUrl: advertised,
-    // Exact plus inexact: both were served from the recording, which is what "reused" means here.
-    // The distinction between them is a divergence, and divergences are reported on their own.
-    reused: replaying ? stats.matchedExact + stats.matchedInexact : 0,
-    unmatched: replaying ? stats.unmatched : unmatched,
-    exitCode: replaying
-      ? stats.unmatched > 0
-        ? 1
-        : 0
-      : manifest.capture?.status === 'incomplete'
-        ? 2
-        : 0,
-  };
-}
-
-/** Ctrl-C, which is the only way an operator ends a session with no child process to wait on. */
-async function firstInterrupt(): Promise<void> {
-  await once(process, 'SIGINT');
-}

package/packages/cli/src/commands/compare.ts

@@ -1,218 +0,0 @@
-import { TraceReader, deriveCheckpoints, resolveRunSelector } from '@agenticreplay/core';
-import { priceFor } from '@agenticreplay/providers';
-import { parseArgs, type ParsedArgs } from '../args.js';
-import type { Output } from '../out.js';
-import { writeFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import { renderCompareCard } from '../share-card.js';
-import { cardTarget, svgToPng } from '../rasterize.js';
-import { replayCommand } from './replay.js';
-import { readConfig } from '../config.js';
-
-/** Run the verdict command inside the fork's worktree. Shell so `npm test -- auth` just works. */
-async function runVerify(command: string, cwd: string): Promise<number> {
-  const { spawn } = await import('node:child_process');
-  return new Promise((resolve) => {
-    const child = spawn(command, { cwd, shell: true, stdio: 'ignore' });
-    // A verify command that cannot even start is a failed verdict, not a crashed comparison.
-    child.on('error', () => resolve(127));
-    child.on('close', (code) => resolve(code ?? 1));
-  });
-}
-
-/** Each fork is a fresh argv, so upstream overrides have to be forwarded explicitly. */
-function upstreamFlags(args: ParsedArgs): string[] {
-  const out: string[] = [];
-  const a = args.str('upstream-anthropic');
-  const o = args.str('upstream-openai');
-  if (a) out.push('--upstream-anthropic', a);
-  if (o) out.push('--upstream-openai', o);
-  return out;
-}
-
-export interface CompareRow {
-  /** Exit code of --verify, when one was given. This, not the agent's exit code, is the verdict. */
-  verifyExitCode?: number;
-  model: string;
-  verdict: 'pass' | 'fail';
-  exitCode: number;
-  divergences: number;
-  inputTokens: number;
-  outputTokens: number;
-  cost: number | null;
-  wallMs: number;
-  forkRunId?: string;
-  error?: string;
-}
-
-/**
- * `agenticreplay compare <run> --models a,b,c`
- *
- * N forks from one checkpoint. The comparison only means anything because every branch starts
- * from an identical filesystem tree and conversation prefix — the model is the only variable, so
- * the difference in outcome is attributable to it rather than to drift.
- */
-export async function compareCommand(
-  args: ParsedArgs,
-  out: Output,
-  cwd = process.cwd(),
-): Promise<CompareRow[]> {
-  // Fall back to what `agenticreplay setup` recorded, so the common case needs no flags at all. An explicit
-  // --models still wins: the config is a default, not a policy.
-  const models =
-    args.list('models').length > 0 ? args.list('models') : ((await readConfig()).models ?? []);
-  if (models.length === 0) {
-    throw new Error(
-      'compare needs models to compare\n' +
-        // Not two example ids: they are gateway-specific — OrcaRouter namespaces by provider,
-        // a direct provider does not — so a copyable pair here fails against half of them.
-        '  agenticreplay models to see what your gateway serves, then: agenticreplay compare last --models a,b\n' +
-        '  or run agenticreplay setup once — it stores your explicit gateway and a model list',
-    );
-  }
-
-  const selector = args.positionals[0] ?? 'last';
-  const runDir = (await resolveRunSelector(cwd, selector)).dir;
-  const reader = await TraceReader.open(runDir);
-  const events = await reader.events();
-  const checkpoints = deriveCheckpoints(events);
-  if (checkpoints.length === 0) {
-    throw new Error('this run has no checkpoints, so there is nothing to fork from');
-  }
-
-  const from = args.num('from') ?? checkpoints[checkpoints.length - 1]!.seq;
-  const runId = reader.manifest().run_id;
-
-  out.phase('compare', { run: runId, from, models: models.join(',') });
-
-  const rows: CompareRow[] = [];
-  // Sequential rather than parallel: each fork spawns a real agent against a real worktree, and
-  // running four of those concurrently on one machine measures the machine, not the models.
-  for (const model of models) {
-    const startedAt = Date.now();
-    try {
-      const forkArgs = parseArgs([
-        'replay',
-        // The concrete run id, never the caller's selector. "last" is re-resolved on every fork,
-        // so after the first branch it would point at the child we just created — which has no
-        // checkpoints — and every later model would fail for a reason that is not about the model.
-        runId,
-        '--from',
-        String(from),
-        '--model',
-        model,
-        ...(args.bool('loose') ? ['--loose'] : []),
-        // The same silent-no-op this list already warns about twice. `--no-fs` is what a run
-        // fetched with `agenticreplay pull` needs — it has no snapshots to restore from — and dropping it
-        // here would accept the flag and then fork with the restore still on, which is the one
-        // thing it was passed to prevent.
-        ...(args.bool('fs', true) ? [] : ['--no-fs']),
-        // Every fork this makes runs a live agent, so interception has to reach them: accepting
-        // the flag here and dropping it before the fork is exactly the silent-no-op the flag was
-        // fixed for one layer up.
-        ...(args.bool('tls-intercept') ? ['--tls-intercept'] : []),
-        // Same reasoning, and the same silent-no-op if dropped: every fork launches a live agent,
-        // and under --json agenticreplay's stdout is the result document. A fork that inherits it prints
-        // the agent's output into the middle of the JSON.
-        ...(args.bool('json') ? ['--json'] : []),
-        ...(args.list('tls-hosts').flatMap((h) => ['--tls-hosts', h]) as string[]),
-        ...upstreamFlags(args),
-      ]);
-      const result = await replayCommand(forkArgs, out, cwd);
-
-      // The agent exiting 0 only means it did not crash. "Did the task actually get done" needs
-      // a command that answers it — otherwise the verdict column is a number nobody should act on.
-      const verify = args.str('verify');
-      const verifyExitCode =
-        verify && result.worktree ? await runVerify(verify, result.worktree) : undefined;
-      const failed = verifyExitCode === undefined ? result.exitCode !== 0 : verifyExitCode !== 0;
-      const usage = result.forkRunId
-        ? await usageOf(cwd, result.forkRunId)
-        : { input: 0, output: 0 };
-      const money = priceFor({ input_tokens: usage.input, output_tokens: usage.output }, model);
-      rows.push({
-        model,
-        verdict: failed ? 'fail' : 'pass',
-        verifyExitCode,
-        exitCode: result.exitCode,
-        divergences: result.divergences,
-        inputTokens: usage.input,
-        outputTokens: usage.output,
-        cost: money ? money.amount : null,
-        wallMs: Date.now() - startedAt,
-        forkRunId: result.forkRunId,
-      });
-    } catch (err) {
-      rows.push({
-        model,
-        verdict: 'fail',
-        exitCode: -1,
-        divergences: 0,
-        inputTokens: 0,
-        outputTokens: 0,
-        cost: null,
-        wallMs: Date.now() - startedAt,
-        error: err instanceof Error ? err.message.split('\n')[0] : String(err),
-      });
-    }
-  }
-
-  out.plain('');
-  out.table(
-    ['MODEL', 'VERDICT', 'TOKENS', 'COST', 'WALL', 'RUN'],
-    rows.map((r) => [
-      r.model,
-      r.verdict,
-      `${r.inputTokens}/${r.outputTokens}`,
-      // An unknown model prices as a dash, never as $0.00 — a confidently wrong cost is worse
-      // than an absent one when it lands in a table someone decides from. And a real cost too
-      // small for four decimals still gets shown: "cheaper" is the whole reason for this column.
-      formatCost(r.cost),
-      `${(r.wallMs / 1000).toFixed(1)}s`,
-      r.forkRunId ?? r.error ?? '',
-    ]),
-  );
-
-  if (args.has('share')) {
-    const picked = cardTarget(args.str('share') ?? 'compare.svg', '--share');
-    if (picked.format === 'gif') {
-      throw new Error('--share draws one table, so it has no animation. Use .svg or .png.');
-    }
-    const target = resolve(cwd, picked.path);
-    const svg = renderCompareCard(rows, {
-      runId,
-      forkPoint: from,
-      verify: args.str('verify'),
-    });
-    const body = picked.format === 'png' ? await svgToPng(svg) : svg;
-    await writeFile(target, body, { mode: 0o644 });
-    out.phase('shared', {
-      path: target,
-      bytes: typeof body === 'string' ? Buffer.byteLength(body) : body.length,
-      format: picked.format,
-    });
-  }
-
-  return rows;
-}
-
-/** Dash for unknown. Otherwise enough precision that a genuinely cheap model does not read $0. */
-export function formatCost(amount: number | null): string {
-  if (amount === null) return '—';
-  if (amount === 0) return '$0';
-  if (amount < 0.0001) return `$${amount.toExponential(2)}`;
-  if (amount < 0.01) return `$${amount.toFixed(6)}`;
-  return `$${amount.toFixed(4)}`;
-}
-
-async function usageOf(cwd: string, runId: string): Promise<{ input: number; output: number }> {
-  const reader = await TraceReader.open((await resolveRunSelector(cwd, runId)).dir);
-  let input = 0;
-  let output = 0;
-  for (const e of await reader.events()) {
-    if (e.type !== 'model.response') continue;
-    input += Number(e.attrs?.input_tokens ?? 0);
-    output += Number(e.attrs?.output_tokens ?? 0);
-  }
-  return { input, output };
-}