fix: address PR review — combine import, add single-session GT guard

Author: jariy17

src/cli/aws/agentcore.ts

@@ -3,10 +3,10 @@ import { getCredentialProvider } from './account';
 import {
   BedrockAgentCoreClient,
   EvaluateCommand,
+  type EvaluationReferenceInput,
   InvokeAgentRuntimeCommand,
   StopRuntimeSessionCommand,
 } from '@aws-sdk/client-bedrock-agentcore';
-import type { EvaluationReferenceInput } from '@aws-sdk/client-bedrock-agentcore';
 import type { HttpRequest } from '@smithy/protocol-http';
 import type { DocumentType } from '@smithy/types';
 

src/cli/operations/eval/__tests__/run-eval.test.ts

@@ -1204,4 +1204,18 @@ describe('handleRunEval', () => {
       expectedTrajectory: ['tool_1', 'tool_2'],
     });
   });
+
+  it('returns error when ground truth flags are used with multiple sessions', async () => {
+    setupDefaultAgent();
+    setupCloudWatchToReturn([makeOtelSpanRow('session-1', 'trace-1'), makeOtelSpanRow('session-2', 'trace-2')]);
+
+    const result = await handleRunEval({
+      evaluator: ['Builtin.GoalSuccessRate'],
+      days: 7,
+      assertions: ['Agent should greet user'],
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('require exactly one session');
+  });
 });

src/cli/operations/eval/run-eval.ts

@@ -606,6 +606,13 @@ export async function handleRunEval(options: RunEvalOptions): Promise<RunEvalRes
     !!options.expectedResponse;
 
   let evaluationReferenceInputs: EvaluationReferenceInput[] | undefined;
+  if (hasRefInputs && sessions.length !== 1) {
+    return {
+      success: false,
+      error:
+        'Ground truth flags (-A, --expected-trajectory, --expected-response) require exactly one session. Use -s/--session-id to target a single session.',
+    };
+  }
   if (hasRefInputs) {
     const refInputs: EvaluationReferenceInput[] = [];
     const firstSession = sessions[0]!;