agent-inspect 2.1.0 → 2.3.0

package/packages/cli/dist/index.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { realpathSync, createReadStream } from 'fs';
-import path11 from 'path';
+import path13 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, Option } from 'commander';
 import { AsyncLocalStorage } from 'async_hooks';
@@ -12,7 +12,7 @@ import tty from 'tty';
 import { createInterface } from 'readline';
 
 // package.json
-var version = "2.1.0";
+var version = "2.3.0";
 
 // packages/core/src/correlation-metadata.ts
 var TRACE_CORRELATION_KEYS = [
@@ -744,7 +744,7 @@ function formatDuration(ms) {
 // packages/core/src/utils.ts
 var DEFAULT_TRACE_DIR_NAME = ".agent-inspect";
 var RUNS_DIR_NAME = "runs";
-var FALLBACK_TRACE_DIR = path11.join(
+var FALLBACK_TRACE_DIR = path13.join(
   os.tmpdir(),
   "agent-inspect",
   RUNS_DIR_NAME
@@ -779,7 +779,7 @@ function getDefaultTraceDir() {
     if (typeof home !== "string" || home.trim() === "") {
       return FALLBACK_TRACE_DIR;
     }
-    return path11.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
+    return path13.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
   } catch {
     return FALLBACK_TRACE_DIR;
   }
@@ -787,11 +787,11 @@ function getDefaultTraceDir() {
 function getTraceFilePath(runId, traceDir) {
   const baseDir = traceDir ?? getDefaultTraceDir();
   let safeId = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
-  safeId = path11.basename(safeId);
+  safeId = path13.basename(safeId);
   if (safeId === "" || safeId === "." || safeId === "..") {
     safeId = "run_unknown";
   }
-  return path11.join(baseDir, `${safeId}.jsonl`);
+  return path13.join(baseDir, `${safeId}.jsonl`);
 }
 function formatError(error) {
   if (error instanceof Error) {
@@ -1553,7 +1553,7 @@ var TraceDirectory = class {
     this.#dir = resolveTraceDir(options);
   }
   getPath(filename) {
-    return filename ? path11.join(this.#dir, filename) : this.#dir;
+    return filename ? path13.join(this.#dir, filename) : this.#dir;
   }
   async list() {
     try {
@@ -1580,7 +1580,7 @@ function parseIsoToMs2(value) {
 }
 async function extractMetadata(filePath, _quickScan) {
   const stats = await stat(filePath);
-  let runIdFromFile = path11.basename(filePath);
+  let runIdFromFile = path13.basename(filePath);
   if (runIdFromFile.endsWith(".jsonl")) {
     runIdFromFile = runIdFromFile.slice(0, -".jsonl".length);
   }
@@ -3551,7 +3551,7 @@ function findReaderByFormat(format, readers) {
 }
 async function jsonlFilesInDirectory(dirPath) {
   const entries = await readdir(dirPath, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path11.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path13.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
 }
 async function resolveInput(input3) {
   const cached = resolvedInputCache.get(input3);
@@ -7677,9 +7677,9 @@ Trace directory: ${traceDir}`);
   if (validation !== void 0 && !validation.ok) {
     process.exitCode = 1;
   }
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path11.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await mkdir(path11.dirname(outPath), { recursive: true });
+    await mkdir(path13.dirname(outPath), { recursive: true });
     await writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
     console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
@@ -7856,13 +7856,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path13 = buildPath(segments);
+  const path15 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path13,
+      path: path15,
       left: L.name,
       right: R.name
     });
@@ -7872,7 +7872,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path13,
+      path: path15,
       left: L.type,
       right: R.type
     });
@@ -7882,7 +7882,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path13,
+      path: path15,
       left: L.status,
       right: R.status
     });
@@ -7894,7 +7894,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path13,
+      path: path15,
       left: le || void 0,
       right: re || void 0
     });
@@ -7912,7 +7912,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path13,
+        path: path15,
         left: ld,
         right: rd
       });
@@ -7925,7 +7925,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path13,
+      path: path15,
       left: L.metadata,
       right: R.metadata
     });
@@ -7937,7 +7937,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path13,
+      path: path15,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -8097,11 +8097,11 @@ function diffRuns(left, right, options) {
 }
 
 // packages/core/src/diff/renderer.ts
-function formatPath(path13) {
-  if (path13 === void 0 || path13.path.length === 0) {
+function formatPath(path15) {
+  if (path15 === void 0 || path15.path.length === 0) {
     return "(run)";
   }
-  return path13.path.map((s) => s.name).join(" > ");
+  return path15.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -8532,9 +8532,9 @@ async function reportCommand(runId, options = {}) {
     redactionProfile,
     correlation: !options.noCorrelation
   });
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path11.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await mkdir(path11.dirname(outPath), { recursive: true });
+    await mkdir(path13.dirname(outPath), { recursive: true });
     await writeFile(outPath, result.content, "utf-8");
     console.log(`Wrote ${result.fileExtension} report to ${outPath}`);
   }
@@ -8781,17 +8781,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path13, key) {
+function childPath(path15, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path13 ? `${path13}.${key}` : key;
+    return path15 ? `${path15}.${key}` : key;
   }
-  return `${path13 || "$"}[${JSON.stringify(key)}]`;
+  return `${path15 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path13, index) {
-  return `${path13 || "$"}[${index}]`;
+function indexPath(path15, index) {
+  return `${path15 || "$"}[${index}]`;
 }
-function makeFinding(path13, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path13, detector, action, severity, matchKind } : { path: path13, detector, action, severity, matchKind, preview };
+function makeFinding(path15, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path15, detector, action, severity, matchKind } : { path: path15, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -8860,11 +8860,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path13, depth, state) {
+  #redactValue(value, key, path15, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path13, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path15, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -8873,19 +8873,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path13, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path15, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path13, key, value });
+      const detections = detector.detect({ path: path15, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path13,
+            path15,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -8903,7 +8903,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path13, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path15, index), depth + 1, state);
       });
       return out;
     }
@@ -8915,7 +8915,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path13 === "$" ? "" : path13, entryKey),
+          childPath(path15 === "$" ? "" : path15, entryKey),
           depth + 1,
           state
         );
@@ -9362,14 +9362,14 @@ function uniqueSorted(values) {
   return [...new Set(values)].sort();
 }
 function isWithinDirectory(child, parent) {
-  const relative = path11.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path11.isAbsolute(relative);
+  const relative = path13.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path13.isAbsolute(relative);
 }
 async function resolveOutputPath(inputPath, output2, force) {
   if (output2 === void 0 || output2.trim() === "") return void 0;
-  const inputAbs = path11.resolve(inputPath);
-  const outputAbs = path11.resolve(output2.trim());
-  const inputDir = path11.dirname(inputAbs);
+  const inputAbs = path13.resolve(inputPath);
+  const outputAbs = path13.resolve(output2.trim());
+  const inputDir = path13.dirname(inputAbs);
   if (!isWithinDirectory(outputAbs, inputDir)) {
     throw new Error("Refusing to write migrated output outside the input directory.");
   }
@@ -9490,7 +9490,7 @@ async function migrateCommand(input3, options = {}) {
     process.exitCode = 1;
     return;
   }
-  const inputPath = path11.resolve(input3.trim());
+  const inputPath = path13.resolve(input3.trim());
   const dryRun = options.dryRun === true;
   if (!dryRun && (options.output === void 0 || options.output.trim() === "")) {
     console.error("migrate requires --dry-run or --output <path>.");
@@ -9509,7 +9509,7 @@ async function migrateCommand(input3, options = {}) {
     );
     const result = await buildMigration(inputPath, outputPath);
     if (!dryRun && outputPath !== void 0) {
-      await mkdir(path11.dirname(outputPath), { recursive: true });
+      await mkdir(path13.dirname(outputPath), { recursive: true });
       await writeFile(outputPath, result.content, "utf-8");
     }
     printSummary2(result, dryRun);
@@ -9787,7 +9787,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path13) {
+function eventEvidence(event, path15) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -9797,7 +9797,7 @@ function eventEvidence(event, path13) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path13 ? { path: path13 } : {}
+    ...path15 ? { path: path15 } : {}
   };
 }
 function runEvidence(run) {
@@ -9860,9 +9860,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path13) {
-  const parts = path13.split(".");
-  return parts[parts.length - 1] ?? path13;
+function lastPathSegment(path15) {
+  const parts = path15.split(".");
+  return parts[parts.length - 1] ?? path15;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -9876,12 +9876,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path13, key, depth = 0) {
-  entries.push({ event, path: path13, key, value });
+function pushValueEntries(entries, event, value, path15, key, depth = 0) {
+  entries.push({ event, path: path15, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path13}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path15}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -9891,7 +9891,7 @@ function pushValueEntries(entries, event, value, path13, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path13}.${nestedKey}`,
+      `${path15}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -9972,9 +9972,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path13) => {
-    lines.push(`${path13}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path13}.${index}`));
+  const visit = (node, path15) => {
+    lines.push(`${path15}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path15}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -10023,9 +10023,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path13) {
+function firstEvidenceForKind(context, kind, path15) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path13)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path15)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -10273,13 +10273,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path13 = [];
+        const path15 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path13.slice(existing);
+            const cycle = path15.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -10295,8 +10295,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path13.length);
-          path13.push(current);
+          seenAt.set(current.eventId, path15.length);
+          path15.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -10821,7 +10821,7 @@ function asConfig(value) {
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
-  const extension = path11.extname(configPath);
+  const extension = path13.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
     throw new Error(
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -10830,7 +10830,7 @@ async function loadConfig(configPath) {
   if (!CONFIG_EXTENSIONS.has(extension)) {
     throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path11.resolve(configPath);
+  const absolute = path13.resolve(configPath);
   if (extension === ".json") {
     const raw = await readFile(absolute, "utf-8");
     return asConfig(JSON.parse(raw));
@@ -10952,8 +10952,8 @@ function printHuman(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path13 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path13 ? ` (${path13})` : ""}`);
+    const path15 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path15 ? ` (${path15})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -11175,10 +11175,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path13) {
-  return [{ runId: run.runId, ...path13 !== void 0 ? { path: path13 } : {} }];
+function evidenceForRun(run, path15) {
+  return [{ runId: run.runId, ...path15 !== void 0 ? { path: path15 } : {} }];
 }
-function evidenceForEvent(event, path13) {
+function evidenceForEvent(event, path15) {
   return [
     {
       runId: event.runId,
@@ -11186,7 +11186,7 @@ function evidenceForEvent(event, path13) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path13 !== void 0 ? { path: path13 } : {}
+      ...path15 !== void 0 ? { path: path15 } : {}
     }
   ];
 }
@@ -11344,9 +11344,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path13) {
+function firstEvidence(fields, run, path15) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path13) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path15) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -11723,8 +11723,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path13 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path13 ? ` (${path13})` : ""}`);
+      const path15 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path15 ? ` (${path15})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -11771,7 +11771,7 @@ function asConfig2(value) {
 }
 async function loadConfig2(configPath) {
   if (configPath === void 0) return {};
-  const extension = path11.extname(configPath);
+  const extension = path13.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error(
       "TypeScript eval configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -11780,7 +11780,7 @@ async function loadConfig2(configPath) {
   if (!CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error("Unsupported eval config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path11.resolve(configPath);
+  const absolute = path13.resolve(configPath);
   if (extension === ".json") {
     const raw = await readFile(absolute, "utf-8");
     return asConfig2(JSON.parse(raw));
@@ -11917,8 +11917,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path13 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path13 ? ` (${path13})` : ""}`);
+    const path15 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path15 ? ` (${path15})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -12156,8 +12156,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path13 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path13 ? ` (${path13})` : ""}`);
+    const path15 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path15 ? ` (${path15})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -12276,8 +12276,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path13 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path13})`);
+    const path15 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path15})`);
   }
   for (const diagnostic4 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic4.code}: ${diagnostic4.message}`);
@@ -12355,8 +12355,8 @@ function renderHtml(trace, check, diff) {
 `;
 }
 async function writeArtifact(outputDir, relativePath, content, files) {
-  const outPath = path11.join(outputDir, relativePath);
-  await mkdir(path11.dirname(outPath), { recursive: true });
+  const outPath = path13.join(outputDir, relativePath);
+  await mkdir(path13.dirname(outPath), { recursive: true });
   await writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -12372,7 +12372,7 @@ function manifestStatus(check, diff) {
   return "ok";
 }
 async function artifactsCommand(target, options = {}, stdin = process.stdin) {
-  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path11.resolve(options.outputDir.trim()) : "";
+  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path13.resolve(options.outputDir.trim()) : "";
   if (outputDir === "") {
     console.error("--output-dir is required.");
     process.exitCode = 1;
@@ -12438,8 +12438,8 @@ async function artifactsCommand(target, options = {}, stdin = process.stdin) {
   await writeArtifact(outputDir, "report.html", renderHtml(trace, check, diff), files);
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    await mkdir(path11.dirname(path11.resolve(summaryTarget)), { recursive: true });
-    await appendFile(path11.resolve(summaryTarget), `
+    await mkdir(path13.dirname(path13.resolve(summaryTarget)), { recursive: true });
+    await appendFile(path13.resolve(summaryTarget), `
 ${renderMarkdown(trace, check, diff)}`, "utf-8");
   }
   const manifestFiles = [...files, "manifest.json"].sort((a, b) => a.localeCompare(b));
@@ -12458,10 +12458,10 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
       findings: diff?.findings.length ?? 0,
       diagnostics: diff?.diagnostics.length ?? 0
     },
-    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path11.resolve(summaryTarget) } : {},
+    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path13.resolve(summaryTarget) } : {},
     note: NOTE
   };
-  await writeFile(path11.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
+  await writeFile(path13.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
   if (options.json === true) {
     console.log(writeJson3(manifest).trimEnd());
   } else {
@@ -12472,6 +12472,371 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
     }
   }
 }
+function validateReporterArtifactPath(options) {
+  const outputDir = path13.resolve(options.outputDir);
+  const diagnostics = [];
+  const rawPath = options.relativePath;
+  if (rawPath.length === 0) {
+    diagnostics.push({
+      code: "artifact_path_empty",
+      severity: "error",
+      message: "Reporter artifact path must not be empty."
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  if (rawPath.includes("\0")) {
+    diagnostics.push({
+      code: "invalid_artifact_path",
+      severity: "error",
+      message: "Reporter artifact path must not contain null bytes.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  if (path13.isAbsolute(rawPath) || path13.win32.isAbsolute(rawPath)) {
+    diagnostics.push({
+      code: "artifact_path_absolute",
+      severity: "error",
+      message: "Reporter artifact path must be relative.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  const normalized = path13.posix.normalize(rawPath.replace(/\\/g, "/"));
+  const segments = normalized.split("/");
+  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path must stay under the output directory.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  const absolutePath = path13.resolve(outputDir, normalized);
+  const relFromOutput = path13.relative(outputDir, absolutePath);
+  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path13.isAbsolute(relFromOutput)) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path resolved outside the output directory.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  return {
+    ok: true,
+    outputDir,
+    relativePath: normalized,
+    absolutePath,
+    diagnostics
+  };
+}
+
+// packages/cli/src/ci-summary.ts
+var NOTE2 = "Generated locally by AgentInspect from reporter artifact manifests. Trace contents are not embedded.";
+var MAX_TEXT = 180;
+var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "jest", "manual"]);
+var STATUSES = /* @__PURE__ */ new Set(["passed", "failed", "skipped", "todo"]);
+var ARTIFACT_KINDS = /* @__PURE__ */ new Set(["trace", "report", "eval", "redaction", "summary"]);
+var ARTIFACT_FORMATS = /* @__PURE__ */ new Set(["json", "jsonl", "md", "html"]);
+var REDACTION_PROFILES = /* @__PURE__ */ new Set(["local", "share", "strict"]);
+function stable6(value) {
+  if (Array.isArray(value)) return value.map(stable6);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable6(record[key])])
+  );
+}
+function writeJson4(value) {
+  return `${JSON.stringify(stable6(value), null, 2)}
+`;
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  return safeText(value);
+}
+function readOptionalString(value) {
+  return typeof value === "string" && value.trim() !== "" ? safeText(value) : void 0;
+}
+function readFramework(value) {
+  const framework = readString(value, "manifest.framework");
+  if (!FRAMEWORKS.has(framework)) {
+    throw new Error(`Unsupported reporter framework: ${framework}.`);
+  }
+  return framework;
+}
+function readStatus(value) {
+  const status = readString(value, "result.status");
+  if (!STATUSES.has(status)) {
+    throw new Error(`Unsupported reporter test status: ${status}.`);
+  }
+  return status;
+}
+function readArtifact(value, index) {
+  if (!isObject(value)) throw new Error(`manifest.artifacts[${index}] must be an object.`);
+  const kind = readString(value.kind, `manifest.artifacts[${index}].kind`);
+  const format = readString(value.format, `manifest.artifacts[${index}].format`);
+  const redactionProfile = readString(
+    value.redactionProfile,
+    `manifest.artifacts[${index}].redactionProfile`
+  );
+  if (!ARTIFACT_KINDS.has(kind)) throw new Error(`Unsupported artifact kind: ${kind}.`);
+  if (!ARTIFACT_FORMATS.has(format)) throw new Error(`Unsupported artifact format: ${format}.`);
+  if (!REDACTION_PROFILES.has(redactionProfile)) {
+    throw new Error(`Unsupported artifact redaction profile: ${redactionProfile}.`);
+  }
+  const artifactPath = readString(value.path, `manifest.artifacts[${index}].path`);
+  const pathCheck = validateReporterArtifactPath({
+    outputDir: process.cwd(),
+    relativePath: artifactPath
+  });
+  if (!pathCheck.ok || pathCheck.relativePath === void 0) {
+    throw new Error(`Unsafe reporter artifact path: ${artifactPath}.`);
+  }
+  return {
+    kind,
+    path: pathCheck.relativePath,
+    format,
+    redactionProfile
+  };
+}
+function readArtifacts(value, label) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.map((item, index) => readArtifact(item, index));
+}
+function readDiagnosticsCount(value, label) {
+  if (value === void 0) return 0;
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.length;
+}
+function readResult(value, index) {
+  if (!isObject(value)) throw new Error(`manifest.results[${index}] must be an object.`);
+  const file = readOptionalString(value.file);
+  const tracePath = readOptionalString(value.tracePath);
+  return {
+    testId: readString(value.testId, `manifest.results[${index}].testId`),
+    name: readString(value.name, `manifest.results[${index}].name`),
+    ...file === void 0 ? {} : { file },
+    status: readStatus(value.status),
+    ...tracePath === void 0 ? {} : { tracePath },
+    artifacts: readArtifacts(value.artifacts, `manifest.results[${index}].artifacts`),
+    diagnostics: readDiagnosticsCount(
+      value.diagnostics,
+      `manifest.results[${index}].diagnostics`
+    )
+  };
+}
+function readManifestDocument(value) {
+  if (!isObject(value)) throw new Error("Reporter manifest file must contain a JSON object.");
+  const candidate = isObject(value.manifest) ? value.manifest : value;
+  if (!isObject(candidate)) throw new Error("Reporter manifest must be a JSON object.");
+  const schemaVersion = readString(candidate.schemaVersion, "manifest.schemaVersion");
+  if (schemaVersion !== "0.1") {
+    throw new Error(`Unsupported reporter manifest schemaVersion: ${schemaVersion}.`);
+  }
+  if (!Array.isArray(candidate.results)) {
+    throw new Error("manifest.results must be an array.");
+  }
+  const artifacts = readArtifacts(candidate.artifacts, "manifest.artifacts");
+  const results = candidate.results.map((item, index) => readResult(item, index));
+  const diagnostics = readDiagnosticsCount(candidate.diagnostics, "manifest.diagnostics");
+  const manifest = {
+    framework: readFramework(candidate.framework),
+    generatedAt: readString(candidate.generatedAt, "manifest.generatedAt"),
+    results,
+    artifacts
+  };
+  return {
+    packageName: readOptionalString(value.package),
+    manifest,
+    diagnostics
+  };
+}
+function cwdRelative(filePath) {
+  const relative = path13.relative(process.cwd(), path13.resolve(filePath)).replace(/\\/g, "/");
+  if (relative === "" || relative.startsWith("../") || path13.isAbsolute(relative)) {
+    return path13.basename(filePath);
+  }
+  return relative;
+}
+async function readReporterManifest(filePath) {
+  const absolute = path13.resolve(filePath);
+  const raw = await readFile(absolute, "utf-8");
+  const document = readManifestDocument(JSON.parse(raw));
+  const manifest = document.manifest;
+  const results = manifest.results.map((result) => ({
+    testId: safeText(result.testId),
+    name: safeText(result.name),
+    ...result.file === void 0 ? {} : { file: safeText(path13.basename(result.file)) },
+    status: result.status,
+    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path13.basename(result.tracePath)) },
+    artifacts: result.artifacts,
+    diagnostics: result.diagnostics
+  }));
+  return {
+    ...document.packageName === void 0 ? {} : { packageName: document.packageName },
+    manifestFile: cwdRelative(absolute),
+    framework: manifest.framework,
+    generatedAt: manifest.generatedAt,
+    results,
+    artifacts: manifest.artifacts,
+    diagnostics: document.diagnostics
+  };
+}
+function summarize3(manifests) {
+  const summary = {
+    manifests: manifests.length,
+    tests: 0,
+    failed: 0,
+    passed: 0,
+    skipped: 0,
+    todo: 0,
+    artifacts: 0,
+    diagnostics: 0
+  };
+  for (const manifest of manifests) {
+    summary.artifacts += manifest.artifacts.length;
+    summary.diagnostics += manifest.diagnostics;
+    for (const result of manifest.results) {
+      summary.tests += 1;
+      if (result.status === "failed") summary.failed += 1;
+      else if (result.status === "passed") summary.passed += 1;
+      else if (result.status === "skipped") summary.skipped += 1;
+      else summary.todo += 1;
+      summary.artifacts += result.artifacts.length;
+      summary.diagnostics += result.diagnostics;
+    }
+  }
+  return {
+    status: summary.failed > 0 ? "failed" : summary.diagnostics > 0 ? "warning" : "ok",
+    manifests,
+    summary,
+    note: NOTE2
+  };
+}
+function markdownCell(value) {
+  return safeText(String(value ?? "unknown")).replaceAll("|", "\\|").replace(/\r?\n/g, " ");
+}
+function renderMarkdown2(result) {
+  const lines = [
+    "# AgentInspect CI Summary",
+    "",
+    NOTE2,
+    "",
+    "| Field | Value |",
+    "| --- | --- |",
+    `| Status | ${result.status} |`,
+    `| Manifests | ${result.summary.manifests} |`,
+    `| Tests | ${result.summary.tests} |`,
+    `| Failed | ${result.summary.failed} |`,
+    `| Passed | ${result.summary.passed} |`,
+    `| Skipped | ${result.summary.skipped} |`,
+    `| Todo | ${result.summary.todo} |`,
+    `| Artifacts | ${result.summary.artifacts} |`,
+    `| Diagnostics | ${result.summary.diagnostics} |`,
+    "",
+    "## Tests",
+    "",
+    "| Framework | Status | Test | File | Trace | Artifacts |",
+    "| --- | --- | --- | --- | --- | --- |"
+  ];
+  const rows = result.manifests.flatMap(
+    (manifest) => manifest.results.map((test) => ({
+      framework: manifest.framework,
+      test
+    }))
+  );
+  if (rows.length === 0) {
+    lines.push("| unknown | unknown | No tests found | unknown | unknown | 0 |");
+  } else {
+    for (const row of rows) {
+      lines.push(
+        `| ${markdownCell(row.framework)} | ${markdownCell(row.test.status)} | ${markdownCell(row.test.name)} | ${markdownCell(row.test.file)} | ${markdownCell(row.test.tracePath)} | ${row.test.artifacts.length} |`
+      );
+    }
+  }
+  lines.push("", "## Manifests", "", "| Framework | File | Generated | Artifacts |", "| --- | --- | --- | --- |");
+  for (const manifest of result.manifests) {
+    lines.push(
+      `| ${markdownCell(manifest.framework)} | ${markdownCell(manifest.manifestFile)} | ${markdownCell(manifest.generatedAt)} | ${manifest.artifacts.length} |`
+    );
+  }
+  lines.push("", "## Artifacts", "", "| Framework | Kind | Path | Format | Profile |", "| --- | --- | --- | --- | --- |");
+  const artifacts = result.manifests.flatMap(
+    (manifest) => manifest.artifacts.map((artifact) => ({ framework: manifest.framework, artifact }))
+  );
+  if (artifacts.length === 0) {
+    lines.push("| unknown | unknown | No artifacts found | unknown | unknown |");
+  } else {
+    for (const row of artifacts) {
+      lines.push(
+        `| ${markdownCell(row.framework)} | ${markdownCell(row.artifact.kind)} | ${markdownCell(row.artifact.path)} | ${markdownCell(row.artifact.format)} | ${markdownCell(row.artifact.redactionProfile)} |`
+      );
+    }
+  }
+  lines.push("");
+  return `${lines.join("\n")}
+`;
+}
+function safeText(value) {
+  const compact = value.replace(/\s+/g, " ").trim();
+  const redacted = compact.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(
+    /\b(?:api[_-]?key|authorization|token|secret|password)\s*[:=]\s*[^,\s]+/gi,
+    "$1=[REDACTED]"
+  );
+  if (redacted.length <= MAX_TEXT) return redacted;
+  return `${redacted.slice(0, MAX_TEXT - 12)}...[truncated]`;
+}
+async function ciSummaryCommand(manifestPaths, options = {}) {
+  if (manifestPaths.length === 0) {
+    console.error("At least one reporter manifest path is required.");
+    process.exitCode = 1;
+    return;
+  }
+  let result;
+  try {
+    const manifests = [];
+    for (const manifestPath of manifestPaths) {
+      manifests.push(await readReporterManifest(manifestPath));
+    }
+    manifests.sort((a, b) => a.manifestFile.localeCompare(b.manifestFile));
+    result = summarize3(manifests);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[AgentInspect] ci-summary failed: ${message}`);
+    process.exitCode = 1;
+    return;
+  }
+  const markdown = renderMarkdown2(result);
+  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
+  if (outputPath !== void 0) {
+    await mkdir(path13.dirname(outputPath), { recursive: true });
+    await writeFile(outputPath, markdown, "utf-8");
+  }
+  const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
+  if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
+    const summaryPath = path13.resolve(summaryTarget);
+    await mkdir(path13.dirname(summaryPath), { recursive: true });
+    await appendFile(summaryPath, `
+${markdown}`, "utf-8");
+  }
+  if (options.json === true) {
+    console.log(writeJson4(result).trimEnd());
+  } else if (outputPath !== void 0) {
+    console.log(`Wrote AgentInspect CI summary to ${outputPath}`);
+    console.log(`Status: ${result.status}`);
+  } else {
+    console.log(markdown.trimEnd());
+  }
+}
 
 // packages/cli/src/index.ts
 function runCommand(action) {
@@ -12657,6 +13022,9 @@ function createCliProgram() {
   ).option("--run <run-id>", "select a run when the trace contains multiple runs").option("--baseline <trace-path-or-run-id>", "optional baseline trace for diff artifacts").option("--baseline-run <run-id>", "select a run from the baseline trace").option("--github-summary <path>", "append a safe summary to this file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON manifest").action((target, opts) => {
     runCommand(() => artifactsCommand(target, opts));
   });
+  program.command("ci-summary").description("Summarize local reporter artifact manifests for CI").argument("<manifest...>", "reporter artifact manifest JSON files").option("-o, --output <path>", "write Markdown summary to a local file").option("--github-summary <path>", "append Markdown summary to this local file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON summary").action((manifest, opts) => {
+    runCommand(() => ciSummaryCommand(manifest, opts));
+  });
   program.command("diff").description("Compare two local AgentInspect JSONL traces (read-only)").argument("<left-run-id>", "first run id").argument("<right-run-id>", "second run id").option("--dir <path>", "trace directory").option("--json", "print diff result as JSON").option("--ignore-duration", "omit duration comparisons").option(
     "--duration-threshold <duration>",
     "ignore duration deltas at or below this (e.g. 500ms, 2s, 1m)"
@@ -12749,9 +13117,9 @@ function isPrimaryModule() {
   if (!entry) return false;
   const selfPath = fileURLToPath(import.meta.url);
   try {
-    return realpathSync(path11.resolve(entry)) === realpathSync(path11.resolve(selfPath));
+    return realpathSync(path13.resolve(entry)) === realpathSync(path13.resolve(selfPath));
   } catch {
-    return path11.resolve(entry) === path11.resolve(selfPath);
+    return path13.resolve(entry) === path13.resolve(selfPath);
   }
 }
 if (isPrimaryModule()) {