stacktrace-cli 0.2.1__py3-none-any.whl → 0.2.3__py3-none-any.whl

stacktrace_cli/__init__.py

@@ -1,3 +1,3 @@
 """The `stacktrace` command-line interface — detection and response for AI agents."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.3"

stacktrace_cli/cli.py

@@ -224,15 +224,17 @@ def sessions(
 )
 @click.option(
     "--escalate/--no-escalate",
-    default=True,
+    default=False,
     show_default=True,
-    help="Send flagged sessions to the agent's own CLI for semantic analysis. On "
-    "by default, capped by --budget. It is the only stage that sends anything "
-    "session-derived off this machine, and it spends the developer's own "
-    "provider quota, so --no-escalate turns it off and the cap keeps a noisy "
-    "day bounded. It does not make the run offline: correlation runs first "
-    "either way and matches advisories by sending the package coordinates of "
-    "the components a session invoked to osv.dev.",
+    help="Send flagged sessions to the agent's own CLI for semantic analysis. Off "
+    "by default: it is the only stage that sends anything session-derived off "
+    "this machine, and it spends the developer's own provider quota, so a run "
+    "that does neither is the one to reach for first. --escalate turns it on "
+    "and --budget caps a noisy day. Leaving it off does not make the run "
+    "offline: correlation runs first either way and matches advisories by "
+    "sending the package coordinates of the components a session invoked to "
+    "osv.dev. Sessions that qualified are still counted, and named in "
+    "--format json, so the run says what it did not do.",
 )
 @click.option(
     "--budget",
@@ -295,18 +297,20 @@ def detect(
     families carry their own severity ladders, because a stalled loop and a
     leaked credential cannot share one (ADR-0010).
 
-    Two stages need no model or credential. The third sends flagged sessions to
-    the agent's own CLI: on by default and capped by --budget, with
-    --no-escalate to turn it off.
+    Two stages need no model or credential, and they are the two that run by
+    default. The third sends flagged sessions to the agent's own CLI:
+    --escalate turns it on, capped by --budget. Sessions that qualified for it
+    are counted either way, and named in --format json, so a run without it
+    says so rather than reading as a clean one.
 
     That third stage is the one that sends session content off this machine:
     the agent's own CLI hands the prompts, arguments and results a rule needs
     to the provider it is already authenticated against (ADR-0004 -- provider
     affinity, so a transcript goes back to the vendor that produced it, and
-    there is no fallback to any other). --no-escalate leaves the two stages
-    that send nothing.
+    there is no fallback to any other). Without --escalate the run is the two
+    stages that send nothing.
 
-    One network call happens before any of them regardless of --no-escalate:
+    One network call happens before any of them, with or without --escalate:
     correlation matches advisories by sending the package coordinates of the
     components a session invoked to osv.dev. Coordinates only -- never a
     prompt, an argument or a result.
@@ -324,9 +328,13 @@ def detect(
             escalate=escalate,
             budget=budget,
             sample_budget=sample_budget,
-            # Only ever consulted when stage 3 runs: there is nothing to reuse
-            # otherwise, and opening a directory to discover that is waste.
-            cache=VerdictCache(default_directory()) if cache and escalate else None,
+            # Not gated on `escalate`. A verdict already paid for is an
+            # answer this run has, and `escalate` governs whether new ones may
+            # be commissioned, not whether old ones may be read -- the rule
+            # `run_detector` states at its cache pass. Gating it here made a
+            # session read as graded or ungraded depending on a flag that
+            # spent nothing either way.
+            cache=VerdictCache(default_directory()) if cache else None,
         )
     except ValueError as error:
         raise click.ClickException(str(error)) from error

stacktrace_cli/correlate/acquire.py

@@ -16,13 +16,23 @@ answer naming a component that was never involved.
 
 from __future__ import annotations
 
+import base64
+import hashlib
 import json
+import os
 import subprocess
+import sys
 import tempfile
 from collections.abc import Callable, Sequence
 from collections.abc import Set as AbstractSet
 from dataclasses import dataclass
 from datetime import UTC, datetime
+from importlib.metadata import (
+    Distribution,
+    PackageNotFoundError,
+    PackagePath,
+    distribution,
+)
 from pathlib import Path
 from typing import Any
 
@@ -36,6 +46,140 @@ from stacktrace_cli.correlate.composition import (
 
 _AGENT_KIND_PROPERTY = "openaca:agent_kind"
 
+#: The name OpenACA publishes its console script under. `.exe` on Windows
+#: because that is the launcher installers write there, and this package claims
+#: `Operating System :: OS Independent`.
+_SCRIPT = "openaca.exe" if os.name == "nt" else "openaca"
+
+
+def _openaca() -> str:
+    """The OpenACA console script this package pins, addressed by path.
+
+    The bare string `"openaca"` is a `PATH` lookup, and `PATH` is not where the
+    pinned copy lives: `uv tool install stacktrace-cli` links only the
+    `stacktrace` entry point out of the tool environment, so the OpenACA that
+    `[project.dependencies]` resolved sits in `bin/` reachable but unnamed. A
+    bare name therefore selects whichever global, `pipx` or `--user` copy the
+    machine carries — a stale one silently does the work and its version need
+    not be the one this package depends on — or, on a machine with none,
+    nothing at all. This is the rule `docs/specs/cli-composition.md` states for
+    the mounted commands, applied to the one path that reaches OpenACA as a
+    subprocess.
+
+    **The path is the one the pinned distribution's own install recorded, not a
+    guess from this interpreter's location.** Python defines separate prefix,
+    virtual-environment, user and home installation schemes, and only the first
+    two put console scripts beside the interpreter: `pip install --user
+    stacktrace-cli` puts them under `site.USER_BASE` while `sys.executable`
+    stays the base interpreter. Deriving the path from `sys.executable` alone
+    therefore names a file that does not exist under a supported install, and
+    `detect` dies at process launch before it can build anything.
+    `importlib.metadata` answers instead: it resolves the OpenACA on *this*
+    interpreter's `sys.path` — the pinned one, by construction — and that
+    install's `RECORD` names the script file it wrote, wherever its scheme put
+    it.
+
+    **The only thing run is a file that install recorded writing, still holding
+    the contents it recorded.** Nothing is run for being named `openaca` in a
+    directory the distribution merely shares: an installation scheme pairs a
+    library directory with a scripts directory, but that scripts directory holds
+    the launchers of *every* distribution installed into the scheme and records
+    nothing about which one wrote any of them, so co-location establishes where
+    installers put scripts in general and never that this distribution put this
+    one there. Nor does a recorded path settle it on its own, because a record
+    describes what an install wrote rather than reserving where it wrote it: the
+    scripts directory stays shared afterwards, so a later install of another
+    distribution can overwrite that very file while the record still names it.
+    A stale, global, independently managed or overwritten launcher of that name
+    reintroduces exactly the version skew this addressing exists to remove, and
+    it does so invisibly — a wrong-version OpenACA can return a structurally
+    valid BOM. Where ownership cannot be established the answer is a
+    `RuntimeError` naming why, which `_build` renders as a legible CLI error.
+
+    Still the published console script, so the ADR-0007 seam is unchanged: this
+    module imports no OpenACA internals and `tests/test_seam_boundary.py` holds
+    that line.
+    """
+    try:
+        installed = distribution("openaca")
+    except PackageNotFoundError as error:
+        raise RuntimeError(
+            "the OpenACA this package pins is not installed on "
+            f"{sys.executable}'s import path, so no {_SCRIPT!r} on this machine "
+            "can be known to be it; reinstalling stacktrace-cli restores it"
+        ) from error
+    recorded = _recorded_script(installed)
+    if recorded is not None:
+        return str(recorded)
+    raise RuntimeError(
+        f"the pinned OpenACA installed at {installed.locate_file('')} records no "
+        f"{_SCRIPT!r} console script of its own that still holds the contents it "
+        "recorded; a copy found by name alone — by sharing a directory with that "
+        "install, or by having replaced a file it wrote — need not be the version "
+        "this package depends on, so none is run; reinstalling stacktrace-cli "
+        "restores it"
+    )
+
+
+def _recorded_script(installed: Distribution) -> Path | None:
+    """The console script the pinned OpenACA's install recorded, if it did.
+
+    A `RECORD` entry says the distribution `[project.dependencies]` resolved
+    wrote a file of these contents at this path — which is more than a directory
+    a scheme suggested can say, and less than the path alone would suggest,
+    because the two halves age differently: the path stays shared, the contents
+    do not. Scripts live outside `site-packages` and are recorded relative to
+    it, so the entry resolves correctly under every scheme.
+
+    Absent when the install enumerated no files: `importlib.metadata` answers
+    `None` when the metadata that lists them is missing — `RECORD` for a
+    `dist-info` install — and an `egg-info` install lists the sources it was
+    built from rather than the scripts it wrote. That is a distribution that
+    cannot name its own launcher, not licence to run someone else's: the only
+    other thing available about such an install is where it sits, and a
+    directory is shared by everything installed alongside it.
+
+    Absent, too, when the file at the recorded path is not the file that was
+    recorded there. Every candidate is authenticated against its own recorded
+    digest, because the two halves of an entry answer different questions: the
+    path says where the install wrote a launcher, and the digest says what it
+    wrote. Only the second survives another install overwriting the shared
+    scripts directory afterwards.
+    """
+    for recorded in installed.files or ():
+        if recorded.name == _SCRIPT:
+            candidate = Path(str(installed.locate_file(recorded))).resolve()
+            if _holds_recorded_contents(recorded, candidate):
+                return candidate
+    return None
+
+
+def _holds_recorded_contents(recorded: PackagePath, candidate: Path) -> bool:
+    """Whether the file now at a recorded path hashes to what was recorded for it.
+
+    Fails closed on every reason the question cannot be answered — no digest,
+    a digest naming an algorithm this interpreter does not implement, an
+    unreadable file — because "we could not check" and "it matches" differ by
+    exactly the guarantee this locator exists to give, and the unchecked case
+    fails invisibly: a wrong-version OpenACA returns a structurally valid BOM.
+    The digest field is optional in a `RECORD` row, so an install can decline
+    to say what it wrote; that install cannot then be shown to own the file
+    sitting at the path it names, and a reinstall is what restores the
+    evidence.
+
+    Digests are base64url without padding, so the padding is stripped from
+    both sides rather than assumed absent from either.
+    """
+    digest = recorded.hash
+    if digest is None:
+        return False
+    try:
+        computed = hashlib.new(digest.mode, candidate.read_bytes()).digest()
+    except (ValueError, TypeError, OSError):
+        return False
+    encoded = base64.urlsafe_b64encode(computed).decode("ascii")
+    return encoded.rstrip("=") == digest.value.rstrip("=")
+
 
 def load_bom(path: Path) -> tuple[str, Built]:
     """Read a supplied Agent BOM, or say why it cannot be used.
@@ -95,7 +239,7 @@ def build_bom(
     with tempfile.TemporaryDirectory() as scratch:
         directory = Path(scratch)
         argv = [
-            "openaca",
+            _openaca(),
             "bom",
             "endpoint",
             "--kind",
@@ -291,8 +435,16 @@ def _scan(
     array, and a family we do not read is a fact about the scan rather than a
     fault in it.
     """
+    try:
+        openaca = _openaca()
+    except RuntimeError:
+        # The same answer as an unreadable response, for the same reason: with no
+        # OpenACA that can be known to be the pinned one, this scan did not run.
+        # A `--bom` run reaches here without having built anything, so this is
+        # the first place that can be discovered — and `{}` would say we looked.
+        return None
     result = subprocess.run(
-        ["openaca", "scan", "bom", "--input", str(bom_path), "--format", "json"],
+        [openaca, "scan", "bom", "--input", str(bom_path), "--format", "json"],
         capture_output=True,
         text=True,
         check=False,

stacktrace_cli/detector/render.py

@@ -220,14 +220,11 @@ def render_text(result: DetectorRun, detail: bool = False) -> str:
 
     lines.extend(_rollup_lines(result))
 
-    if result.unknowns:
-        lines.append("Could not settle:")
-        counts: dict[str, int] = {}
-        for unknown in result.unknowns:
-            counts[unknown.reason] = counts.get(unknown.reason, 0) + 1
-        for reason, count in sorted(counts.items(), key=lambda kv: (-kv[1], kv[0])):
-            lines.append(f"        {count:>4}  {reason}")
-        lines.append("")
+    # The per-reason breakdown of what went unsettled is no longer printed by
+    # default. The count still travels in the summary line, `--json` still
+    # carries every `Unknown` whole, and the reasoning stage still names its
+    # own outcomes below, so nothing is dropped from the record -- only from
+    # the default terminal view.
 
     lines.extend(_reasoning_lines(result))
 
@@ -256,7 +253,7 @@ def render_text(result: DetectorRun, detail: bool = False) -> str:
 #: session-level row, whether or not it also has unanswered questions.
 _REASONING_OUTCOMES: dict[str, str] = {
     "budget_exhausted": "deferred: the run's --budget was reached",
-    "reasoning_not_requested": "not requested: --no-escalate",
+    "reasoning_not_requested": "not requested: re-run with --escalate to analyse them",
     "analyzer_unavailable": "no analyzer available for the agent kind",
     "session_too_large": "too large for the analyzer's context window",
     "insufficient_context": "compaction removed the turns a rule needed",
@@ -270,9 +267,9 @@ _REASONING_OUTCOMES: dict[str, str] = {
 def _reasoning_lines(result: DetectorRun) -> list[str]:
     """What the third stage actually spent, and where every escalation went.
 
-    Stated as accounting rather than as one number, because with escalation on
-    by default (ADR-0004, amended) the question a reader has is no longer *did
-    it run* but *what did this run cost me*. Three outcomes are not the same
+    Stated as accounting rather than as one number. With the stage opt-in the
+    reader has both questions -- *did it run* and, when it did, *what did this
+    run cost me* -- and one number answers neither. Three outcomes are not the same
     fact: a model call spends seconds and money, a cache hit settles the same
     question for free, and a deferred escalation spends nothing and leaves the
     concern open.

stacktrace_cli/monitor/render.py

@@ -176,6 +176,12 @@ def _banners(analysis: Analysis) -> list[str]:
     A blank column and a clean run render identically, which is the one
     confusion this page refuses: a reader who cannot tell "nothing happened"
     from "nothing could be read" has been told nothing.
+
+    Both banners are about a *reader* that came back with nothing. A kind with
+    no composition is not one of those and no longer appears: the calls it
+    accounts for are read, and the page shows what it can place them to.
+    `view.without_composition` is still reported by `stacktrace correlate`,
+    where the record rather than the console is the subject.
     """
     banners: list[str] = []
     for failure in analysis.run.collection_failures:
@@ -183,8 +189,6 @@ def _banners(analysis: Analysis) -> list[str]:
     anonymous = len(analysis.view.kind_anonymous)
     if anonymous:
         banners.append(f"{anonymous} session(s) skipped: no agent kind to attribute them to")
-    for kind in analysis.view.without_composition:
-        banners.append(f"{kind}: no composition, so every call reads as unresolved")
     return banners
 
 

stacktrace_cli/monitor/site/app.js

@@ -145,16 +145,20 @@ function renderBanners(banners) {
 
 function renderCounts(state) {
   const summary = state.summary || {};
-  /* Coverage is a fraction, never a bare percentage: 1 of 1 and 400 of 400 are
-   * both "100%" and say very different things about how much this page knows.
-   * And it is `null` until correlation has run, which is the first second or
-   * so — said as "placing…" rather than shown as 0/0, which would read as
-   * "nothing placed" instead of "not counted yet". */
-  const coverage = summary.coverage;
+  /* Sessions and actions, and no coverage fraction. `6,867/7,055 placed` is
+   * the count of what this page leaves off, stated: the gap between the two
+   * numbers is exactly the unplaceable rows, so the header reinstated by
+   * arithmetic what the rows below had stopped saying. The snapshot still
+   * carries it — `stacktrace correlate` is where coverage is the subject.
+   *
+   * Actions are counted off the rows this page keeps rather than read from
+   * `summary.actions`, which is the server's total over every call in the
+   * window. Read straight through, the header claimed more actions than the
+   * feed below it could account for. */
+  const actions = eventsFrom(state.sessions || []).length;
   text(el("live-counts"),
     " — " + plural(summary.sessions || 0, "session") +
-    " · " + plural(summary.actions || 0, "action") +
-    " · " + (coverage ? coverage.resolved + "/" + coverage.total + " placed" : "placing…"));
+    " · " + plural(actions, "action"));
 }
 
 /* --- the demo's vocabulary ----------------------------------------------- */
@@ -209,7 +213,6 @@ const RULE_PLAIN = {
   "stacktrace-credential-egress": "A password or token was sent to an outside service.",
   "stacktrace-capability-crossing": "Private data was read, then sent outside.",
   "stacktrace-intent-drift": "It acted on something nobody asked about.",
-  "stacktrace-unsanctioned-mcp-tool-use": "A tool ran that isn't in your installed set.",
   "stacktrace-guardrail-modification": "A session changed the agent's own rules or settings.",
   "stacktrace-injection-marker": "Injected-instruction markers were found in what the agent read.",
   "stacktrace-destructive-action": "A destructive action was taken (deleting or overwriting).",
@@ -227,20 +230,32 @@ const KIND_TAG = {
   subagent: ["sub-agent", "kt-sub"],
   mcp: ["mcp", "kt-conn"],
   command: ["command", "kt-cmd"],
-  unresolved: ["⚠ unresolved", "kt-warn"],
 };
 
 /* Plural, because every one of these labels a count. */
 const KIND_LABEL = {
   mcp: "MCP servers", skill: "Skills", command: "Commands",
-  subagent: "Sub-agents", tool: "Built-in tools", unresolved: "Unresolved",
+  subagent: "Sub-agents", tool: "Built-in tools",
 };
 
 /* Most consequential first, rather than by count: sorted by count the
  * built-ins win every window and push the MCP servers — the only category
  * describing a call that left the machine — under a number three orders of
  * magnitude larger. */
-const KIND_ORDER = ["mcp", "skill", "command", "subagent", "tool", "unresolved"];
+const KIND_ORDER = ["mcp", "skill", "command", "subagent", "tool"];
+
+/* The category the correlator gives a call it could not place. Every surface
+ * on this page drops these rows: an unplaceable call names no component, so
+ * the row could only say that something happened and nothing here claims it,
+ * which is not a thing a reader can act on. The count is still computed
+ * server-side and still reaches the detector — this is a decision about the
+ * page, not about the record. */
+const UNPLACEABLE = "unresolved";
+
+/* Whether the snapshot row is one of those. */
+function unplaceable(row) {
+  return row.category === UNPLACEABLE;
+}
 const TOP_PER_KIND = 3;
 
 const SEVERITY_WORD = { critical: "Serious", high: "High", medium: "Medium", low: "Low" };
@@ -294,10 +309,13 @@ function evParts(e) {
       provenance: "a link to an outside service",
     };
   }
+  /* A category this build has never heard of. Named as itself rather than
+   * described: anything else this function said about it would be invented,
+   * and the one category it used to describe no longer reaches the page. */
   return {
     name: e.name,
-    action: "used a tool nothing here claims",
-    provenance: "no component on this machine declares it",
+    action: "used " + (e.tool || "a tool"),
+    provenance: e.kind ? "category " + e.kind : "",
   };
 }
 
@@ -321,6 +339,7 @@ function eventsFrom(sessions) {
     const activity = session.activity || [];
     for (let index = 0; index < activity.length; index += 1) {
       const row = activity[index];
+      if (unplaceable(row)) continue;
       events.push({
         id: row.span,
         kind: row.category,
@@ -336,11 +355,6 @@ function eventsFrom(sessions) {
          * the skills a reader had just run sat under MCP calls from half a day
          * earlier. Named for what it is, because it is not the start. */
         at: session.last_active || session.started_at,
-        /* Both worth a reader's attention; only the first is a claim about
-         * attribution. Correlation keeps a refused call's resolution, so the
-         * row beside the label names the component it would have reached. */
-        unplaced: row.category === "unresolved",
-        refused: row.status === "denied",
         order: index,
       });
     }
@@ -356,7 +370,8 @@ function compositionOf(sessions) {
   const seen = new Set();
   for (const session of sessions) {
     for (const row of session.activity || []) {
-      const type = row.component_type || (row.category === "unresolved" ? null : row.category);
+      if (unplaceable(row)) continue;
+      const type = row.component_type || row.category;
       const key = type + "\n" + (row.component_identity || row.component_name || row.tool_name);
       if (!type || seen.has(key)) continue;
       seen.add(key);
@@ -372,6 +387,7 @@ function activitySummaryOf(sessions) {
   const named = {};
   for (const session of sessions) {
     for (const row of session.activity || []) {
+      if (unplaceable(row)) continue;
       byKind[row.category] = (byKind[row.category] || 0) + 1;
       if (!named[row.category]) named[row.category] = new Map();
       const label = entryLabel(row);
@@ -531,9 +547,9 @@ let revealTimer = null;
  * Routine built-ins (Bash, Read, Edit) are the constant background of every
  * session: 5,795 of one window's 7,065 calls. They collapse **per project**
  * into one counting row for the agent. Notable events — skills, MCP servers,
- * sub-agents, commands, and anything unresolved — are rare and important, so
- * each gets its own row, keyed by span and never coalesced: two runs of
- * `superpowers:brainstorming` are two things that happened.
+ * sub-agents and commands — are rare and important, so each gets its own row,
+ * keyed by span and never coalesced: two runs of `superpowers:brainstorming`
+ * are two things that happened.
  *
  * Grouping by tool name instead gave `Bash ×38 / Read ×16 / Bash ×3 / Edit
  * ×20` per session, with every skill and connector buried under it. */
@@ -609,14 +625,6 @@ function countAgain(entry, e) {
       entry.timeEl.textContent = fmtRange(entry.first, entry.last);
     }
   }
-  /* A refusal is worth seeing and was not worth a row of its own: `Bash ×3
-   * denied` beside `Bash ×38` was half the noise. It rides the row instead. */
-  if (e.refused) {
-    entry.refused += 1;
-    entry.node.classList.add("warn");
-    entry.warnEl.hidden = false;
-    entry.warnEl.textContent = "⚠ " + plural(entry.refused, "refusal");
-  }
   /* Animated where it sits, never hoisted. Hoisting the most recently counted
    * row would rank a busy week-old session above a quiet one from this
    * morning: during a backfill, "counted just now" is a fact about the drain
@@ -656,14 +664,19 @@ function place(entry) {
 
 function newRow(e, signature) {
   const parts = evParts(e);
-  const kind = KIND_TAG[e.kind] || KIND_TAG.unresolved;
+  /* A category this build has never heard of takes its own name and the
+   * neutral tag: nothing on this page knows enough about it to warn. */
+  const kind = KIND_TAG[e.kind] || [e.kind || "", "kt-tool"];
   /* The placeholder goes as soon as there is a real row — otherwise it rides
    * the list and counts against the trim. */
   if (!feedOrder.length) activityFeed.innerHTML = "";
 
+  /* No row this feed builds is reddened. The two sources of it were a call
+   * the correlator could not place — which no longer reaches the feed — and a
+   * refusal, which `outcome.py` is explicit is a guardrail working as
+   * intended: painting it red reports the permission prompt as the incident. */
   const node = document.createElement("div");
   node.className = "ev fresh";
-  if (e.unplaced || e.refused) node.classList.add("warn");
 
   const countEl = element("span", "evcount", "");
   countEl.hidden = true;
@@ -674,16 +687,6 @@ function newRow(e, signature) {
   first.appendChild(element("span", "evact", parts.action));
   first.appendChild(countEl);
 
-  const warnEl = element("span", "ev-warn", "");
-  warnEl.hidden = true;
-  if (e.unplaced) {
-    warnEl.hidden = false;
-    warnEl.textContent = "unplaced";
-  } else if (e.refused) {
-    warnEl.hidden = false;
-    warnEl.textContent = e.kind === "tool" ? "⚠ 1 refusal" : "refused";
-  }
-
   const lastEl = element("span", "evlast", "");
   const timeEl = element("span", "ev-time", fmtAgo(e.at));
 
@@ -692,15 +695,14 @@ function newRow(e, signature) {
   second.appendChild(element("span", "ev-prov", parts.provenance));
   second.appendChild(lastEl);
   second.appendChild(timeEl);
-  second.appendChild(warnEl);
 
   node.appendChild(first);
   node.appendChild(second);
 
   const started = Date.parse(e.at);
   const entry = {
-    node: node, countEl: countEl, warnEl: warnEl, lastEl: lastEl, timeEl: timeEl,
-    count: 1, refused: e.refused ? 1 : 0, key: keyOf(e), signature: signature,
+    node: node, countEl: countEl, lastEl: lastEl, timeEl: timeEl,
+    count: 1, key: keyOf(e), signature: signature,
     first: Number.isNaN(started) ? Infinity : started,
     last: Number.isNaN(started) ? -Infinity : started,
   };

stacktrace_cli/monitor/site/index.html

@@ -72,17 +72,11 @@
     <span class="panel-note">read from this machine's own transcripts</span>
   </div>
 
-  <div class="legend" id="live-legend">
-    <span><b class="lg-conn">MCP</b> = a link to an outside service</span>
-    <span><b class="lg-ok">&#10003;</b> resolved to something you installed</span>
-    <span><b class="lg-warn">&#9888;</b> unresolved &mdash; nothing on this machine claims it</span>
-  </div>
-
   <div class="logs">
     <section class="logcol">
       <header class="logcol-head">
         <span class="logcol-dot"></span>
-        <h3>Agent Session Log Trace</h3>
+        <h3>Agent Session Trace</h3>
         <span class="logcol-sub">every tool, skill &amp; connector your sessions used</span>
       </header>
       <div class="feed" id="activity"><div class="feed-empty">Watching for agent activity&hellip;</div></div>

stacktrace_cli/monitor/site/styles.css

@@ -294,11 +294,6 @@ body.watch-mode .hero, body.watch-mode .band, body.watch-mode .status, body.watc
 .comp-chip.hot { border-color:var(--coral); color:var(--coral-d); background:color-mix(in srgb,var(--coral) 6%,var(--paper)); }
 .comp-chip.hot b { color:var(--coral-d); }
 
-.legend { display:flex; gap:1.4rem; flex-wrap:wrap; margin:1rem 0 1.2rem; padding:0.6rem 0.9rem;
-  background:var(--panel); border:1px solid var(--line); border-radius:4px; font-size:0.74rem; color:var(--ink-dim); }
-.legend b { font-weight:700; }
-.lg-conn { color:var(--coral-d); } .lg-ok { color:var(--ok); } .lg-warn { color:var(--coral-d); }
-
 /* two continuous logs */
 .logs { display:grid; grid-template-columns:minmax(0,1.5fr) minmax(0,1fr); gap:1.2rem; align-items:start; }
 @media (max-width:860px){ .logs { grid-template-columns:1fr; } }

stacktrace_cli/remote/cli.py

@@ -354,10 +354,9 @@ def _mask_token(token: str) -> str:
     default=False,
     show_default=True,
     help="Send flagged sessions to the agent's own CLI for semantic analysis. "
-    "Off by default here, the inverse of `stacktrace detect`: stage 3 spends "
-    "the developer's own provider quota and is the one stage that sends "
-    "session content off this machine, and an unattended run is the wrong "
-    "place for either to be implicit.",
+    "Off by default: stage 3 spends the developer's own provider quota and is "
+    "the one stage that sends session content off this machine, and an "
+    "unattended run is the wrong place for either to be implicit.",
 )
 @click.option(
     "--budget",

stacktrace_cli/remote/sync_detect.py

@@ -154,7 +154,13 @@ def _collect_detect_run(
             escalate=escalate,
             budget=budget,
             sample_budget=sample_budget,
-            cache=VerdictCache(default_directory()) if cache and escalate else None,
+            # Not gated on `escalate`. A verdict already paid for is an answer
+            # this run has, and `escalate` governs whether new ones may be
+            # commissioned, not whether old ones may be read -- the rule
+            # `run_detector` states at its cache pass. Gating it here made a
+            # scheduled run call a session ungraded that `stacktrace detect`
+            # calls graded, off the same cache and with neither one spending.
+            cache=VerdictCache(default_directory()) if cache else None,
         )
     except ValueError as error:
         raise SyncError(str(error)) from error

{stacktrace_cli-0.2.1.dist-info → stacktrace_cli-0.2.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.2.1
+Version: 0.2.3
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -126,9 +126,10 @@ because it is installed.
 ## What leaves your machine
 
 Two of `detect`'s three stages run entirely locally and need no model or
-credential. The third sends flagged sessions to the agent's *own* CLI — the
-provider that produced the transcript, never a different one — capped by
-`--budget`; `--no-escalate` turns it off and leaves the two local stages.
+credential, and they are the two a bare `detect` runs. The third sends flagged
+sessions to the agent's *own* CLI — the provider that produced the transcript,
+never a different one — and runs only when you pass `--escalate`, capped by
+`--budget`.
 
 `sessions` omits prompts, tool arguments and results unless you pass
 `--include-content`. `monitor` binds to loopback only, refuses a non-loopback

{stacktrace_cli-0.2.1.dist-info → stacktrace_cli-0.2.3.dist-info}/RECORD

@@ -1,9 +1,9 @@
-stacktrace_cli/__init__.py,sha256=wEqCraAEngRIhaLrRbqpgR5EHnxQ-vG2K3YDaP-Lrgc,111
+stacktrace_cli/__init__.py,sha256=78vR-YqB8AYVsKnA_cC7awuK3Q18MU2oWvRKBnQd8mc,111
 stacktrace_cli/__main__.py,sha256=F_tqj3PRzeBtY-uvBs923H8oc-s9bebhIh6UnAUwNYc,448
 stacktrace_cli/analysis.py,sha256=PECyhd_398fDVjg3K78HVzB4xHYS7sfLNXpASRXNRsY,15303
-stacktrace_cli/cli.py,sha256=tJjGtGlaI6OB4bdlgX3q63VffZxRIjwiCwH54kzxRAo,17032
+stacktrace_cli/cli.py,sha256=88FXhQxvOhmd6zHveNUfbuZ-k3xRHVPfLbO0rKtN8Kc,17617
 stacktrace_cli/correlate/__init__.py,sha256=SexF0pF83OGfBW_569yoyKG94-tb-jGr_ih1q4fHFgE,81
-stacktrace_cli/correlate/acquire.py,sha256=09Yxb9u0MLe-j6gGPoG8wPXUb7bLXcyVrnH_EJIBIEY,16289
+stacktrace_cli/correlate/acquire.py,sha256=gqXx_CIZ4hw5GeYfI1f6f5uUFMfA1CO2JdMD8LpEZOc,24249
 stacktrace_cli/correlate/composition.py,sha256=ZFP3qPOjZvrGVexGWaH7Iq0lIyQLEY-1YxOZ3iMZIbk,20503
 stacktrace_cli/correlate/join.py,sha256=iyjjmAQoMz6tcISzovQZAqnWA3kZO-Wfbo0ZrmYfquo,17187
 stacktrace_cli/correlate/observed.py,sha256=MCF3b_oCjebHtTb63KQR7w1sO0-jun78CJ00QAUSsXo,86294
@@ -19,7 +19,7 @@ stacktrace_cli/detector/finding.py,sha256=Nshe6w26VyumGXnyzrh48WWmJ-zpR08J3Lo3z-
 stacktrace_cli/detector/markers.py,sha256=PUmNitbX4H6l29v-x1FiXohrf2UIPvGs0VnbcHF5E-U,7017
 stacktrace_cli/detector/priors.py,sha256=sRF7kLr_q-Tma9RG96xwSaV_CpDLFEVmqUMo_LUtVrg,22180
 stacktrace_cli/detector/reasoning.py,sha256=6E36BtWoWpSEAXtCr7Tv3h3HghytghWEDeKkdAk0dMA,54792
-stacktrace_cli/detector/render.py,sha256=Wl-8Ji5DkRI4pCVWqJoHM6eFFl1NB6fM5gCAKQOIN5g,16250
+stacktrace_cli/detector/render.py,sha256=_P5r399R6skopx5cF2DYyUNufHi-IMoX2Q-UT5WBuUE,16240
 stacktrace_cli/detector/rules.py,sha256=xU2mXP9BTEknwvwVAPJOF7szWAi2w4R57txCuhSIWdM,6046
 stacktrace_cli/detector/run.py,sha256=BMp9FpEBpciZGPzHHabk5nXSR_ecp4z44v9P7fd4yH0,37832
 stacktrace_cli/detector/secrets.py,sha256=x1pMUkTjT213TGvaBruRW3Tzvt_wShEjGBGjxgCdMO4,9092
@@ -32,20 +32,20 @@ stacktrace_cli/detector/prompts/v1/stacktrace-injected-instruction-followed.md,s
 stacktrace_cli/detector/prompts/v1/stacktrace-intent-drift.md,sha256=1dI4bUIonwm6t2x32GnV-yGNfb1jGibeBo6Wli62WZI,455
 stacktrace_cli/monitor/__init__.py,sha256=akhxzlSGyvbG-3WyC-5Ch5nuYP1E6xga8rzkJ6Tn-AU,469
 stacktrace_cli/monitor/escalate.py,sha256=tpkp88xKyHX0BRVFow8b9_8YswduAAofidMiZBpRix4,7398
-stacktrace_cli/monitor/render.py,sha256=0Wb3Q6y6VRo6GCkULuyqvC7huzCdOejyjeMInxz1DTg,9835
+stacktrace_cli/monitor/render.py,sha256=oR3Sr2Tlk2_NtpVmJfLnU_IH-bkXIs7p4a27OZgn4mY,10064
 stacktrace_cli/monitor/server.py,sha256=ZTKUy3Ct-7rfsErN3Cpr5PaaZ5SX_OMw-ExFe6FKL9w,19683
 stacktrace_cli/monitor/state.py,sha256=UVTLpAecypsLTBs5IdWlY55dyJTf-2jI8lDAWoH9PP4,4157
 stacktrace_cli/monitor/verdicts.py,sha256=V6IK2C9eVxZ2RXjWkfDdmfvN8f-Ol67U-N5c1kXx8rQ,2275
 stacktrace_cli/monitor/watch.py,sha256=LrbS6RnZg322tbESQ4u2rTVxhkxsNI5UwdhpTEO3GgE,15546
-stacktrace_cli/monitor/site/app.js,sha256=zk_dVPLp174NTaHcBi0SEQGkGxl4fiOIf4Y77MHnKKc,43668
-stacktrace_cli/monitor/site/index.html,sha256=7zOdxjo6GkfaG56kwvP8Zm66ITyO-Wadn6kO99qVpDM,4169
-stacktrace_cli/monitor/site/styles.css,sha256=ol_sSrn2Jwk5xAtz9Avq2itUp9r1Z-nv6sf7KSwNSlU,35603
+stacktrace_cli/monitor/site/app.js,sha256=CM28lPaxuy-oourHb85jw35NDhqnFpYxc0bKgQsLrX0,43898
+stacktrace_cli/monitor/site/index.html,sha256=eLjoYpbXy4cg8hl6l5NdRRWgIVN7UaWUN5-KF94zvM8,3856
+stacktrace_cli/monitor/site/styles.css,sha256=3V7lXe3H0qda5rIWo_95SkQaK1Tlbzb92dk-YaTqDrc,35257
 stacktrace_cli/monitor/site/fonts/OFL.txt,sha256=3eGN4fg4dKG6QBHOpLJobIeUAs3eQnmZBiykH5b-TGY,9975
 stacktrace_cli/monitor/site/fonts/dm-mono-400-latin.woff2,sha256=_XUh81MaXM_GVbJcTyLphx3z7BQa15uyf94g0N80e20,8688
 stacktrace_cli/monitor/site/fonts/dm-mono-500-latin.woff2,sha256=DiY9tSeXCG52NnnFT4Te2MwSSYebwn3KK9XdRG9tnzY,8724
 stacktrace_cli/monitor/site/fonts/dm-sans-latin.woff2,sha256=qlMHFrDTUYZq99v6Pu5BIPs28tBxuv-MI0GFFBhlx_8,62556
 stacktrace_cli/remote/__init__.py,sha256=Ba5yZEovOFNDWfgj0ycJkvglUTLN3C47RUQyX-r4opI,82
-stacktrace_cli/remote/cli.py,sha256=OooYzF0eQNs_OSsJhA3g2uXFFeYLZx3f5vgnMATOJ9U,17113
+stacktrace_cli/remote/cli.py,sha256=0yeCj9vJTXSYb41AMJ0Tciic8yu6r5WHyuXRy2mW1Xg,17065
 stacktrace_cli/remote/client.py,sha256=Az1a_CsTvNx9V38iGWKt-fGHN23P1HAgNofrXBQzDFE,13602
 stacktrace_cli/remote/config.py,sha256=xBTLYfY2OX_JieeIYe3ZCrQqzk2-xKZ8MJfJDXDRlxY,4256
 stacktrace_cli/remote/detect_payload.py,sha256=5glNKigGWiozh5VviS_fxat-_njDYUlpGJSDQnGteqI,14902
@@ -54,14 +54,14 @@ stacktrace_cli/remote/policy.py,sha256=0pDZcPavCTXvul1Zs6oi7-J3K0YoXPNFa3j1aOJG3
 stacktrace_cli/remote/redact.py,sha256=cgCMcb2f7Pd7Xt7Ofo6QxFX-fh1Nph-Rb_iiP9UlLjw,29354
 stacktrace_cli/remote/spool.py,sha256=AI3EVrVk-cIbZ8_JgCTZe0yhdBxoUQ1qvwhXOgsADeo,20823
 stacktrace_cli/remote/sync.py,sha256=YmOJiWa8rjrbDLJkQ6cZpC6DF1amv83a8_DhnXUB368,25891
-stacktrace_cli/remote/sync_detect.py,sha256=dcrdlfF1vbE0BskzjK0idCWLsovBy6SUJ-Yx5ugBbVM,18565
+stacktrace_cli/remote/sync_detect.py,sha256=eLkK5dBEJXi8D_1fGOQvHxfB7Nd1itOE9QsYXJB8Kvo,19011
 stacktrace_cli/remote/upload_contract.py,sha256=Jz5icyBHXlImbXTetmQhhXbsma0VCKTLpnlKOe6HDLU,44945
 stacktrace_cli/sessions/__init__.py,sha256=mWb3Z42sN_UqxFQCPpXpsa7Nqe8J9Vd3jspItXqtTmI,76
 stacktrace_cli/sessions/access.py,sha256=mpKMdRufPGTZNJCVPa2MoKWdM8eOYzaYMDsGqob0De0,3401
 stacktrace_cli/sessions/outcome.py,sha256=IQUrOoigPAFHnoA26LlOjSSB8hnSQUIJ8E5tQ0LdUJk,2632
 stacktrace_cli/sessions/protocols.py,sha256=rvQsVd77AekNGhp73masMa61-DbG62QF8Y6hDSwQ9bU,6630
 stacktrace_cli/sessions/render.py,sha256=SCu9Fx-7hWQWOsy3O7zbYzJqCNomaMp_19V7NQTkSm0,14001
-stacktrace_cli-0.2.1.dist-info/METADATA,sha256=vBb-yx_T0sV9KWDkoqQo-NDg7uwQBqC8yMZo32WIoyo,5459
-stacktrace_cli-0.2.1.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-stacktrace_cli-0.2.1.dist-info/entry_points.txt,sha256=OYDmb2CtEjd8TV78zxiGB1XVrLrC6vvayAPXa79_tJ0,60
-stacktrace_cli-0.2.1.dist-info/RECORD,,
+stacktrace_cli-0.2.3.dist-info/METADATA,sha256=U3fPKJ8R63wyoqnLfUIcqjU8QdluSlnqnApmv6ccaAU,5482
+stacktrace_cli-0.2.3.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+stacktrace_cli-0.2.3.dist-info/entry_points.txt,sha256=OYDmb2CtEjd8TV78zxiGB1XVrLrC6vvayAPXa79_tJ0,60
+stacktrace_cli-0.2.3.dist-info/RECORD,,