evals 2.4.0 → 2.6.0

package/start.ps1

@@ -26,13 +26,30 @@ $ErrorActionPreference = 'Stop'
 # files over HTTP, so it's fetchable even though the source repo is private.
 # Override with $env:ARIZE_PROMPT_URL if needed.
 $PromptUrl = if ($env:ARIZE_PROMPT_URL) { $env:ARIZE_PROMPT_URL } else { 'https://cdn.jsdelivr.net/npm/evals/onboarding-prompt.md' }
+# Where the bundled harness wheels live, same package. Override for testing.
+$VendorUrl = if ($env:ARIZE_VENDOR_URL) { $env:ARIZE_VENDOR_URL } else { 'https://cdn.jsdelivr.net/npm/evals/vendor' }
 
 # Prefer the richer, bundled-prompt `npx evals` experience when Node is present.
 # This script is the no-npm fallback; if npx exists, hand off to it.
 # Set $env:ARIZE_SKIP_NPX=1 to force this shell path even when npx is available.
+#
+# Only hand off on Node 20+, which is what the Ink UI needs (see bin.js). Handing
+# an older Node to npx would swap a working flow for a hard failure — this script
+# needs no Node at all, so stay here instead. Keep the floor in step with bin.js.
 if (-not $env:ARIZE_SKIP_NPX -and (Get-Command npx -ErrorAction SilentlyContinue)) {
-  npx --yes evals
-  exit $LASTEXITCODE
+  $nodeMajor = 0
+  $nodeVersion = $null
+  if (Get-Command node -ErrorAction SilentlyContinue) {
+    $nodeVersion = (& node --version 2>$null)
+    if ($nodeVersion -match '^v?(\d+)') { $nodeMajor = [int]$Matches[1] }
+  }
+  if ($nodeMajor -ge 20) {
+    npx --yes evals
+    exit $LASTEXITCODE
+  }
+  $shown = if ($nodeVersion) { $nodeVersion } else { 'not found' }
+  Write-Host "Node $shown is too old for the npx UI — continuing without it."
+  Write-Host ""
 }
 
 # Supported agents: id -> label, install URL, and whether the REPL is seeded with `-i`.
@@ -94,35 +111,144 @@ Write-Host ""
 $chosen = Resolve-Agent
 if (-not $chosen) { exit 1 }
 
-# Download the prompt to a temp file (rename the .tmp to .md rather than
-# leaving both behind).
-$tmp = New-TemporaryFile
-$promptFile = [System.IO.Path]::ChangeExtension($tmp.FullName, 'md')
-Rename-Item -Path $tmp.FullName -NewName (Split-Path $promptFile -Leaf)
-try {
-  Write-Host "Fetching the onboarding prompt..."
+# A directory, not a bare temp file: Step 4A looks for the offline bundle *beside*
+# the prompt, so the prompt needs a directory of its own.
+#
+# ~/.arize/onboarding, not a temp path: the agent is asked to read a file outside
+# its workspace, and a named path is an approval a human can grant with confidence.
+# Sits beside Step 4A's own ~/.arize/harness install, which we must never touch.
+#
+# GetFolderPath('UserProfile') rather than $HOME: on Windows PowerShell 5.1 $HOME
+# comes from HOMEDRIVE+HOMEPATH, which for domain users can point at a redirected
+# network share that is slow or offline. This returns USERPROFILE on Windows and
+# $HOME under PowerShell Core on macOS/Linux — one expression for both.
+function Clear-BundleDir($dir) {
+  # Delete only what we stage, by name. Wheel filenames carry a version we can't
+  # know, so those go by extension, non-recursively, in this directory only.
+  Get-ChildItem -LiteralPath $dir -File -Filter '*.whl' -ErrorAction SilentlyContinue |
+    Remove-Item -Force -ErrorAction SilentlyContinue
+  foreach ($name in @('harness-install.sh', 'harness-install.bat', 'LICENSE-coding-harness-tracing', 'MANIFEST')) {
+    Remove-Item -LiteralPath (Join-Path $dir $name) -Force -ErrorAction SilentlyContinue
+  }
+  # No -Recurse anywhere: a non-empty directory fails here rather than taking
+  # something we didn't put there with it, and Remove-Item's habit of recursing
+  # through a directory junction can't bite us.
+  Remove-Item -LiteralPath $dir -Force -ErrorAction SilentlyContinue
+  return -not (Test-Path -LiteralPath $dir)
+}
+
+# -LiteralPath throughout: a home path containing [ or ] is a real wildcard
+# footgun for the non-literal forms. Keep this list in step with cli.js
+# OFFLINE_FILES and start.sh.
+function Clear-PromptDir($dir) {
+  if (-not (Test-Path -LiteralPath $dir)) { return $true }
+  foreach ($sub in Get-ChildItem -LiteralPath $dir -Directory -Force -ErrorAction SilentlyContinue) {
+    $ours = ($sub.Name -eq 'arize-offline') -or $sub.Name.StartsWith('.staging')
+    if (-not $ours) { return $false }
+    if (-not (Clear-BundleDir $sub.FullName)) { return $false }
+  }
+  foreach ($name in @('onboarding-prompt.md', 'harness.env')) {
+    Remove-Item -LiteralPath (Join-Path $dir $name) -Force -ErrorAction SilentlyContinue
+  }
+  # Anything left is not ours.
+  return -not (Get-ChildItem -LiteralPath $dir -Force -ErrorAction SilentlyContinue)
+}
+
+$candidate = if ($env:ARIZE_ONBOARDING_DIR) {
+  $env:ARIZE_ONBOARDING_DIR
+} else {
+  $profileDir = [Environment]::GetFolderPath('UserProfile')
+  if (-not $profileDir) { $profileDir = $HOME }
+  if ($profileDir) { Join-Path (Join-Path $profileDir '.arize') 'onboarding' } else { $null }
+}
+
+# Try the work and degrade, rather than probing for writability — a probe races
+# and can't see a full disk. Covers a read-only home, a directory owned by another
+# user, an offline redirected profile, and a file in there we refuse to delete.
+$promptDir = $null
+if ($candidate -and (Clear-PromptDir $candidate)) {
   try {
-    Invoke-RestMethod -Uri $PromptUrl -OutFile $promptFile
+    New-Item -ItemType Directory -Path $candidate -Force -ErrorAction Stop | Out-Null
+    $promptDir = $candidate
   } catch {
-    Write-Host "Failed to download the onboarding prompt from $PromptUrl" -ForegroundColor Red
-    Write-Host "Check your connection and try again."
-    exit 1
+    $promptDir = $null
   }
+}
+if (-not $promptDir) {
+  $promptDir = Join-Path ([System.IO.Path]::GetTempPath()) ("arize-onboarding-" + [System.Guid]::NewGuid().ToString('N').Substring(0, 8))
+  New-Item -ItemType Directory -Path $promptDir -Force | Out-Null
+  if ($candidate) {
+    Write-Host "Couldn't use $candidate — staging in $promptDir instead."
+    Write-Host "Instrumenting an app still works; tracing this coding agent (Step 4A) needs a writable home directory."
+  }
+}
+$promptFile = Join-Path $promptDir 'onboarding-prompt.md'
 
-  $seed = "Read the file $promptFile and follow it to set up Arize AX tracing in this project, walking me through each step and asking me questions as needed."
-
-  Write-Host ("Launching {0}..." -f $Agents[$chosen].Label)
-  Write-Host ""
+Write-Host "Fetching the onboarding prompt..."
+try {
+  Invoke-RestMethod -Uri $PromptUrl -OutFile $promptFile
+} catch {
+  Write-Host "Failed to download the onboarding prompt from $PromptUrl" -ForegroundColor Red
+  Write-Host "Check your connection and try again."
+  exit 1
+}
 
-  # Launch interactive + seeded. No skip-permissions — the agent's approval
-  # model and the prompt's own approval gate must stay intact. External commands
-  # attach to the console, so the agent gets a real terminal.
-  $flag = $Agents[$chosen].Flag
-  if ($flag) {
-    & $chosen $flag $seed
-  } else {
-    & $chosen $seed
+# Fetch the bundled tracing harness so Step 4A can install it without piping a
+# downloaded script into a shell — the thing auto-approval permission
+# classifiers refuse. `npx evals` ships these files; this path pulls them from
+# the CDN, using vendor/MANIFEST because a launcher cannot glob a CDN and must
+# not hardcode versioned wheel names.
+#
+# Best-effort throughout. Any failure leaves no arize-offline directory and the
+# prompt takes its documented network path instead. Staged under a temp name and
+# renamed, so the directory Step 4A keys off only ever appears complete.
+Write-Host "Fetching the tracing harness..."
+$staging = Join-Path $promptDir '.staging'
+try {
+  New-Item -ItemType Directory -Path $staging -Force | Out-Null
+  $manifestPath = Join-Path $staging 'MANIFEST'
+  Invoke-RestMethod -Uri "$VendorUrl/MANIFEST" -OutFile $manifestPath
+
+  foreach ($line in Get-Content $manifestPath) {
+    if (-not $line.Trim()) { continue }
+    # MANIFEST is `shasum -a 256` format: "<sha256>  <filename>".
+    $parts = $line -split '\s+', 2
+    $expected = $parts[0]
+    $name = $parts[1].Trim()
+    $dest = Join-Path $staging $name
+    Invoke-RestMethod -Uri "$VendorUrl/$name" -OutFile $dest
+    $actual = (Get-FileHash -Path $dest -Algorithm SHA256).Hash.ToLower()
+    if ($actual -ne $expected.ToLower()) {
+      throw "checksum mismatch for $name"
+    }
   }
-} finally {
-  Remove-Item $promptFile -ErrorAction SilentlyContinue
+
+  Move-Item -LiteralPath $staging -Destination (Join-Path $promptDir 'arize-offline')
+} catch {
+  Clear-BundleDir $staging | Out-Null
+  Write-Host "  (not available — Step 4A will download the installer instead)"
+}
+
+# Single quotes around the path: the home directory is likelier to contain a space
+# than the old temp path was, and single quotes survive the console handoff below
+# where embedded double quotes would not.
+# No "in this project": this may well be run from a home directory, and Step 4 is
+# what scopes the work. Keep this wording in step with cli.js and start.sh.
+$seed = "Read the file '$promptFile' and follow it to set up Arize AX tracing, walking me through each step and asking me questions as needed."
+
+Write-Host ("Launching {0}..." -f $Agents[$chosen].Label)
+Write-Host ""
+
+# Launch interactive + seeded. No skip-permissions — the agent's approval
+# model and the prompt's own approval gate must stay intact. External commands
+# attach to the console, so the agent gets a real terminal.
+#
+# No try/finally around this any more: the staging directory persists so the agent
+# can still reach the prompt in a session that outlives this script. It is cleared
+# at the start of the next launch instead.
+$flag = $Agents[$chosen].Flag
+if ($flag) {
+  & $chosen $flag $seed
+} else {
+  & $chosen $seed
 }

package/start.sh

@@ -22,12 +22,29 @@ set -euo pipefail
 # files over HTTP, so it's fetchable even though the source repo is private.
 # Override with ARIZE_PROMPT_URL if needed.
 PROMPT_URL="${ARIZE_PROMPT_URL:-https://cdn.jsdelivr.net/npm/evals/onboarding-prompt.md}"
+# Where the bundled harness wheels live, same package. Override for testing.
+VENDOR_URL="${ARIZE_VENDOR_URL:-https://cdn.jsdelivr.net/npm/evals/vendor}"
 
 # Prefer the richer, bundled-prompt `npx evals` experience when Node is present.
 # This shell script is the no-npm fallback; if npx exists, hand off to it.
 # Set ARIZE_SKIP_NPX=1 to force this shell path even when npx is available.
+#
+# Only hand off on Node 20+, which is what the Ink UI needs (see bin.js). Handing
+# an older Node to npx would swap a working flow for a hard failure — this script
+# needs no Node at all, so stay here instead. Keep the floor in step with bin.js.
+node_major() {
+  command -v node >/dev/null 2>&1 || return 1
+  v="$(node --version 2>/dev/null)" || return 1
+  v="${v#v}"
+  echo "${v%%.*}"
+}
 if [ -z "${ARIZE_SKIP_NPX:-}" ] && command -v npx >/dev/null 2>&1; then
-  exec npx --yes evals
+  major="$(node_major || echo 0)"
+  if [ "${major:-0}" -ge 20 ] 2>/dev/null; then
+    exec npx --yes evals
+  fi
+  echo "Node $(node --version 2>/dev/null || echo 'not found') is too old for the npx UI — continuing without it."
+  echo
 fi
 
 # Supported agents: id | display label | argv to start the REPL seeded with a prompt.
@@ -133,41 +150,134 @@ choose_agent() {
 
 CHOSEN="$(choose_agent)" || exit 1
 
-# Download the prompt to a temp file. (mktemp templates must end in X's on
-# macOS, so add the .md extension afterwards.)
-PROMPT_FILE="$(mktemp "${TMPDIR:-/tmp}/arize-onboarding-XXXXXX")"
-mv "$PROMPT_FILE" "$PROMPT_FILE.md"
-PROMPT_FILE="$PROMPT_FILE.md"
-cleanup() { rm -f "$PROMPT_FILE"; }
-trap cleanup EXIT
+# A directory, not a bare temp file: Step 4A looks for the offline bundle *beside*
+# the prompt, so the prompt needs a directory of its own.
+#
+# ~/.arize/onboarding, not a temp path: the agent is asked to read a file outside
+# its workspace, and that approval is one a human can grant with confidence for a
+# named path but not for /tmp/arize-onboarding-8fJ2x1. Sits beside Step 4A's own
+# ~/.arize/harness install, which we must never touch.
+#
+# Cleared at launch and left in place afterwards — no EXIT trap — so the agent can
+# still reach the prompt in a session that outlives this script, and so we can
+# exec rather than waiting on a child just to clean up.
+clear_bundle_dir() {
+  # Delete only what we stage, by name. Wheel filenames carry a version we can't
+  # know, so those go by extension, non-recursively, in this directory only.
+  rm -f "$1"/*.whl
+  rm -f "$1/harness-install.sh" "$1/harness-install.bat" \
+        "$1/LICENSE-coding-harness-tracing" "$1/MANIFEST"
+  # rmdir, never rm -r: a non-empty directory fails here instead of taking
+  # something we didn't put there down with it.
+  rmdir "$1" 2>/dev/null
+}
 
-echo "Fetching the onboarding prompt…"
-download_failed() {
-  echo "Failed to download the onboarding prompt from $PROMPT_URL" >&2
-  echo "Check your connection and try again." >&2
-  exit 1
+# Never a recursive delete. Worst case on a bad path is unlinking a few names that
+# don't exist. Keep this list in step with cli.js OFFLINE_FILES and start.ps1.
+clear_prompt_dir() {
+  [ -d "$1" ] || return 0
+  for sub in "$1"/arize-offline "$1"/.staging*; do
+    [ -d "$sub" ] && clear_bundle_dir "$sub"
+  done
+  rm -f "$1/onboarding-prompt.md" "$1/harness.env"
+  # Anything left is not ours: bail out and let the caller fall back.
+  rmdir "$1" 2>/dev/null || { [ -z "$(ls -A "$1" 2>/dev/null)" ]; return $?; }
 }
+
+# $HOME unset (containers, cron, some CI) must degrade, never abort — hence
+# ${HOME:-} and not ${HOME:?}. Same for a read-only home, a directory owned by a
+# past `sudo`, or a full disk: try the work, fall back to a temp dir on failure.
+PROMPT_DIR=""
+if [ -n "${ARIZE_ONBOARDING_DIR:-}" ]; then
+  CANDIDATE="$ARIZE_ONBOARDING_DIR"
+elif [ -n "${HOME:-}" ]; then
+  CANDIDATE="$HOME/.arize/onboarding"
+else
+  CANDIDATE=""
+fi
+
+if [ -n "$CANDIDATE" ] && clear_prompt_dir "$CANDIDATE" \
+  && mkdir -p "$CANDIDATE" 2>/dev/null && chmod 700 "$CANDIDATE" 2>/dev/null; then
+  PROMPT_DIR="$CANDIDATE"
+else
+  PROMPT_DIR="$(mktemp -d "${TMPDIR:-/tmp}/arize-onboarding-XXXXXX")"
+  if [ -n "$CANDIDATE" ]; then
+    echo "Couldn't use $CANDIDATE — staging in $PROMPT_DIR instead."
+    echo "Instrumenting an app still works; tracing this coding agent (Step 4A) needs a writable home directory."
+  fi
+fi
+PROMPT_FILE="$PROMPT_DIR/onboarding-prompt.md"
+
 if command -v curl >/dev/null 2>&1; then
-  curl -fsSL "$PROMPT_URL" -o "$PROMPT_FILE" || download_failed
+  fetch() { curl -fsSL "$1" -o "$2"; }
 elif command -v wget >/dev/null 2>&1; then
-  wget -qO "$PROMPT_FILE" "$PROMPT_URL" || download_failed
+  fetch() { wget -qO "$2" "$1"; }
 else
   echo "Need curl or wget to download the prompt." >&2
   exit 1
 fi
 
-SEED="Read the file $PROMPT_FILE and follow it to set up Arize AX tracing in this project, walking me through each step and asking me questions as needed."
+echo "Fetching the onboarding prompt…"
+if ! fetch "$PROMPT_URL" "$PROMPT_FILE"; then
+  echo "Failed to download the onboarding prompt from $PROMPT_URL" >&2
+  echo "Check your connection and try again." >&2
+  exit 1
+fi
+
+# Fetch the bundled tracing harness so Step 4A can install it without piping a
+# downloaded script into a shell — the thing auto-approval permission classifiers
+# refuse. `npx evals` ships these files in the package; this path has to pull them
+# from the CDN, which is why the build writes vendor/MANIFEST: a launcher cannot
+# glob a CDN and must not hardcode versioned wheel names.
+#
+# Entirely best-effort. Any failure leaves no arize-offline/ directory, and the
+# prompt then takes its documented network path. Staged under a temp name and
+# renamed, so the directory Step 4A keys off only ever appears complete.
+stage_offline_bundle() {
+  local staging="$PROMPT_DIR/.staging" line file
+  mkdir -p "$staging" || return 1
+  fetch "$VENDOR_URL/MANIFEST" "$staging/MANIFEST" 2>/dev/null || return 1
+
+  while IFS= read -r line; do
+    file="${line#*  }"
+    [ -n "$file" ] || continue
+    fetch "$VENDOR_URL/$file" "$staging/$file" 2>/dev/null || return 1
+  done < "$staging/MANIFEST"
+
+  # MANIFEST is standard `shasum -a 256` output, so the check is the standard
+  # tool. A truncated CDN response would otherwise surface as a confusing pip
+  # error much later. Skipped, not fatal, when neither tool exists.
+  if command -v shasum >/dev/null 2>&1; then
+    ( cd "$staging" && shasum -a 256 -c MANIFEST >/dev/null 2>&1 ) || return 1
+  elif command -v sha256sum >/dev/null 2>&1; then
+    ( cd "$staging" && sha256sum -c MANIFEST >/dev/null 2>&1 ) || return 1
+  fi
+
+  chmod +x "$staging/harness-install.sh" 2>/dev/null || true
+  mv "$staging" "$PROMPT_DIR/arize-offline"
+}
+
+echo "Fetching the tracing harness…"
+if ! stage_offline_bundle; then
+  rm -rf "$PROMPT_DIR/.staging"
+  echo "  (not available — Step 4A will download the installer instead)"
+fi
+
+# No "in this project": this may well be run from a home directory, and Step 4 is
+# what scopes the work. Keep this wording in step with cli.js and start.ps1.
+SEED="Read the file '$PROMPT_FILE' and follow it to set up Arize AX tracing, walking me through each step and asking me questions as needed."
 
 echo "Launching $(agent_label "$CHOSEN")…"
 echo
 
 # Launch interactive + seeded, on the real terminal. No skip-permissions —
 # the agent's approval model and the prompt's own approval gate must stay intact.
-# Run as a child (not exec) so the EXIT trap cleans up the temp prompt file.
+# exec, now that the staging directory persists and there is no EXIT trap to run:
+# the agent replaces this shell, so signals and the exit code reach it directly.
 run_agent() {
   case "$CHOSEN" in
-    copilot|gemini) "$CHOSEN" -i "$SEED" ;;
-    *)              "$CHOSEN" "$SEED" ;;
+    copilot|gemini) exec "$CHOSEN" -i "$SEED" ;;
+    *)              exec "$CHOSEN" "$SEED" ;;
   esac
 }
 

package/vendor/LICENSE-coding-harness-tracing

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Arize AI
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/vendor/MANIFEST

@@ -0,0 +1,6 @@
+a9cede65f98d3415b13e1c6a437d0fdee27286bfff0186dd72bb65d9869b7864  LICENSE-coding-harness-tracing
+62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775  certifi-2026.7.22-py3-none-any.whl
+c41daa85c05f38eabd63fd0c7a2c021ffc0ecb7483485f7dd1b8a637f983b778  coding_harness_tracing-0.1.0-py3-none-any.whl
+aca14e09ca99c253d2a142e2d5c5c38c8c7cf90840d3cb10b241c29929871fa4  harness-install.bat
+a7ba18a98280e236b20ab4cb9f8a4006068b454586a2af50bf23fb0dbe70583d  harness-install.sh
+b81ee9561e9ca4004139c6cbba3a238c32b03e4894671e181b671e8cb8425d61  python_dotenv-1.2.1-py3-none-any.whl