agent-inspect 3.5.4 → 4.0.0

package/packages/cli/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { realpathSync, createReadStream } from 'fs';
+import { realpathSync, createReadStream, constants as constants$1 } from 'fs';
 import path14 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, Option } from 'commander';
@@ -14,7 +14,7 @@ import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "3.5.4";
+var version = "4.0.0";
 
 // packages/core/src/correlation-metadata.ts
 var TRACE_CORRELATION_KEYS = [
@@ -3060,12 +3060,12 @@ function buildCriticalPath(runs, handoffs) {
     handoffs.filter((edge) => edge.confidence === "explicit").map((edge) => edge.from)
   );
   const ordered = [...runs].sort(compareRuns);
-  const path19 = [];
+  const path20 = [];
   const visited = /* @__PURE__ */ new Set();
   const pushRun = (run, confidence, source) => {
     if (visited.has(run.runId)) return;
     visited.add(run.runId);
-    path19.push({
+    path20.push({
       runId: run.runId,
       name: run.name,
       startedAt: run.startedAt,
@@ -3090,7 +3090,7 @@ function buildCriticalPath(runs, handoffs) {
     const confidence = explicitTargets.has(run.runId) || explicitSources.has(run.runId) ? "explicit" : "correlated";
     pushRun(run, confidence, confidence === "explicit" ? "manual" : "inferred");
   }
-  return path19;
+  return path20;
 }
 function metaRunIdMatches(run, token, runById) {
   const meta = extractSessionWorkflowMetadata(run.metadata);
@@ -3326,8 +3326,7 @@ async function list(options = {}) {
     const filtered = filterTraces(metas, {
       status: options.status,
       name: options.name,
-      since: options.since,
-      limit
+      since: options.since
     });
     const shown = filtered.slice(0, limit);
     if (options.json) {
@@ -8101,7 +8100,10 @@ function buildRunReport(events, options) {
     '<section class="tree">',
     "</section>"
   );
-  const errorsSection = treeHtml.content.includes("<h2>Errors</h2>") ? extractHtmlFragment(treeHtml.content, "<h2>Errors</h2>", "<footer>") : "";
+  const errorsSectionEnd = treeHtml.content.includes(
+    "<h2>Attributes (bounded)</h2>"
+  ) ? "<h2>Attributes (bounded)</h2>" : "<footer>";
+  const errorsSection = treeHtml.content.includes("<h2>Errors</h2>") ? extractHtmlFragment(treeHtml.content, "<h2>Errors</h2>", errorsSectionEnd) : "";
   const attrsSection = treeHtml.content.includes("<h2>Attributes (bounded)</h2>") ? extractHtmlFragment(
     treeHtml.content,
     "<h2>Attributes (bounded)</h2>",
@@ -8391,13 +8393,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path19 = buildPath(segments);
+  const path20 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path19,
+      path: path20,
       left: L.name,
       right: R.name
     });
@@ -8407,7 +8409,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path19,
+      path: path20,
       left: L.type,
       right: R.type
     });
@@ -8417,7 +8419,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path19,
+      path: path20,
       left: L.status,
       right: R.status
     });
@@ -8429,7 +8431,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path19,
+      path: path20,
       left: le || void 0,
       right: re || void 0
     });
@@ -8447,20 +8449,20 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path19,
+        path: path20,
         left: ld,
         right: rd
       });
     }
   }
   const lm = stableJson(L.metadata ?? {});
-  const rm2 = stableJson(R.metadata ?? {});
-  if (lm !== rm2) {
+  const rm3 = stableJson(R.metadata ?? {});
+  if (lm !== rm3) {
     out.push({
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path19,
+      path: path20,
       left: L.metadata,
       right: R.metadata
     });
@@ -8472,7 +8474,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path19,
+      path: path20,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -8632,11 +8634,11 @@ function diffRuns(left, right, options) {
 }
 
 // packages/core/src/diff/renderer.ts
-function formatPath(path19) {
-  if (path19 === void 0 || path19.path.length === 0) {
+function formatPath(path20) {
+  if (path20 === void 0 || path20.path.length === 0) {
     return "(run)";
   }
-  return path19.path.map((s) => s.name).join(" > ");
+  return path20.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -9518,17 +9520,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path19, key) {
+function childPath(path20, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path19 ? `${path19}.${key}` : key;
+    return path20 ? `${path20}.${key}` : key;
   }
-  return `${path19 || "$"}[${JSON.stringify(key)}]`;
+  return `${path20 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path19, index) {
-  return `${path19 || "$"}[${index}]`;
+function indexPath(path20, index) {
+  return `${path20 || "$"}[${index}]`;
 }
-function makeFinding(path19, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path19, detector, action, severity, matchKind } : { path: path19, detector, action, severity, matchKind, preview };
+function makeFinding(path20, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path20, detector, action, severity, matchKind } : { path: path20, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -9597,11 +9599,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path19, depth, state) {
+  #redactValue(value, key, path20, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path19, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path20, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -9610,19 +9612,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path19, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path20, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path19, key, value });
+      const detections = detector.detect({ path: path20, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path19,
+            path20,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -9640,7 +9642,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path19, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path20, index), depth + 1, state);
       });
       return out;
     }
@@ -9652,7 +9654,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path19 === "$" ? "" : path19, entryKey),
+          childPath(path20 === "$" ? "" : path20, entryKey),
           depth + 1,
           state
         );
@@ -10524,7 +10526,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path19) {
+function eventEvidence(event, path20) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -10534,7 +10536,7 @@ function eventEvidence(event, path19) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path19 ? { path: path19 } : {}
+    ...path20 ? { path: path20 } : {}
   };
 }
 function runEvidence(run) {
@@ -10597,9 +10599,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path19) {
-  const parts = path19.split(".");
-  return parts[parts.length - 1] ?? path19;
+function lastPathSegment(path20) {
+  const parts = path20.split(".");
+  return parts[parts.length - 1] ?? path20;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -10613,12 +10615,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path19, key, depth = 0) {
-  entries.push({ event, path: path19, key, value });
+function pushValueEntries(entries, event, value, path20, key, depth = 0) {
+  entries.push({ event, path: path20, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path19}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path20}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -10628,7 +10630,7 @@ function pushValueEntries(entries, event, value, path19, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path19}.${nestedKey}`,
+      `${path20}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -10709,9 +10711,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path19) => {
-    lines.push(`${path19}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path19}.${index}`));
+  const visit = (node, path20) => {
+    lines.push(`${path20}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path20}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -10760,9 +10762,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path19) {
+function firstEvidenceForKind(context, kind, path20) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path19)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path20)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -11112,13 +11114,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path19 = [];
+        const path20 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path19.slice(existing);
+            const cycle = path20.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -11134,8 +11136,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path19.length);
-          path19.push(current);
+          seenAt.set(current.eventId, path20.length);
+          path20.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -11932,23 +11934,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path19, evidence) {
+function validateSchemaField(value, field, path20, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path19, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path20, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path19, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path20, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path19}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path20}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -12433,10 +12435,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path19 = finding.evidence[0]?.path;
+    const path20 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path20 ? ` (${path20})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -12974,10 +12976,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path19) {
-  return [{ runId: run.runId, ...path19 !== void 0 ? { path: path19 } : {} }];
+function evidenceForRun(run, path20) {
+  return [{ runId: run.runId, ...path20 !== void 0 ? { path: path20 } : {} }];
 }
-function evidenceForEvent(event, path19) {
+function evidenceForEvent(event, path20) {
   return [
     {
       runId: event.runId,
@@ -12985,7 +12987,7 @@ function evidenceForEvent(event, path19) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path19 !== void 0 ? { path: path19 } : {}
+      ...path20 !== void 0 ? { path: path20 } : {}
     }
   ];
 }
@@ -13143,9 +13145,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path19) {
+function firstEvidence(fields, run, path20) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path19) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path20) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -13522,8 +13524,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path19 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
+      const path20 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path20 ? ` (${path20})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -13716,8 +13718,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path19 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
+    const path20 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path20 ? ` (${path20})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -13955,8 +13957,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path19 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
+    const path20 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path20 ? ` (${path20})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -14075,8 +14077,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path19 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path19})`);
+    const path20 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path20})`);
   }
   for (const diagnostic4 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic4.code}: ${diagnostic4.message}`);
@@ -15246,6 +15248,608 @@ async function indexCleanCommand(options = {}) {
   }
 }
 
+// packages/core/src/workspace/types.ts
+var WORKSPACE_SCHEMA_VERSION = "1.0";
+var WORKSPACE_DIR_NAME = ".agent-inspect";
+var WORKSPACE_MANIFEST_FILENAME = "workspace.json";
+
+// packages/core/src/workspace/manifest.ts
+var DEFAULT_WORKSPACE_LAYOUT = {
+  traceDirs: ["runs"],
+  reportsDir: "reports",
+  artifactsDir: "artifacts",
+  bundlesDir: "bundles",
+  notesDir: "notes"
+};
+var DEFAULT_REDACTION_PROFILE = "share";
+var REDACTION_PROFILES2 = [
+  "local",
+  "share",
+  "strict"
+];
+var INDEX_TYPES = ["none", "sqlite", "custom"];
+var MAX_WORKSPACE_MANIFEST_BYTES = 64 * 1024;
+function createDefaultWorkspaceManifest(options) {
+  const project = typeof options.project === "string" ? options.project.trim() : "";
+  const index = {
+    enabled: options.index?.enabled ?? false,
+    type: options.index?.type ?? "none",
+    ...options.index?.path !== void 0 ? { path: options.index.path } : {}
+  };
+  return {
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    project,
+    createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    traceDirs: options.traceDirs ? [...options.traceDirs] : [...DEFAULT_WORKSPACE_LAYOUT.traceDirs],
+    reportsDir: options.reportsDir ?? DEFAULT_WORKSPACE_LAYOUT.reportsDir,
+    artifactsDir: options.artifactsDir ?? DEFAULT_WORKSPACE_LAYOUT.artifactsDir,
+    bundlesDir: options.bundlesDir ?? DEFAULT_WORKSPACE_LAYOUT.bundlesDir,
+    notesDir: options.notesDir ?? DEFAULT_WORKSPACE_LAYOUT.notesDir,
+    redactionProfile: options.redactionProfile ?? DEFAULT_REDACTION_PROFILE,
+    index
+  };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeRelativeWorkspacePath(p) {
+  if (typeof p !== "string") return false;
+  const trimmed = p.trim();
+  if (trimmed === "") return false;
+  if (trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
+  if (/^[a-zA-Z]:/.test(trimmed)) return false;
+  const segments = trimmed.split(/[/\\]+/);
+  return !segments.some((seg) => seg === "..");
+}
+function validateDirField(value, field, errors) {
+  if (typeof value !== "string" || value.trim() === "") {
+    errors.push(`${field} must be a non-empty string`);
+    return;
+  }
+  if (!isSafeRelativeWorkspacePath(value)) {
+    errors.push(
+      `${field} must be a relative path inside the workspace (no absolute paths or ".." traversal)`
+    );
+  }
+}
+function validateIndex(value, errors) {
+  if (!isPlainObject(value)) {
+    errors.push("index must be an object");
+    return void 0;
+  }
+  if (typeof value.enabled !== "boolean") {
+    errors.push("index.enabled must be a boolean");
+  }
+  if (!INDEX_TYPES.includes(value.type)) {
+    errors.push(`index.type must be one of: ${INDEX_TYPES.join(", ")}`);
+  }
+  if (value.path !== void 0 && !isSafeRelativeWorkspacePath(value.path)) {
+    errors.push(
+      'index.path must be a relative path inside the workspace (no absolute paths or ".." traversal)'
+    );
+  }
+  if (errors.length > 0) return void 0;
+  return {
+    enabled: value.enabled,
+    type: value.type,
+    ...value.path !== void 0 ? { path: value.path } : {}
+  };
+}
+function validateWorkspaceManifest(input3) {
+  const errors = [];
+  const warnings = [];
+  if (!isPlainObject(input3)) {
+    return { ok: false, errors: ["manifest must be an object"], warnings };
+  }
+  if (input3.schemaVersion !== WORKSPACE_SCHEMA_VERSION) {
+    errors.push(
+      `schemaVersion must be "${WORKSPACE_SCHEMA_VERSION}" (received ${JSON.stringify(
+        input3.schemaVersion
+      )})`
+    );
+  }
+  if (typeof input3.project !== "string" || input3.project.trim() === "") {
+    errors.push("project must be a non-empty string");
+  }
+  if (typeof input3.createdAt !== "string" || input3.createdAt.trim() === "") {
+    errors.push("createdAt must be a non-empty ISO-8601 string");
+  } else if (Number.isNaN(Date.parse(input3.createdAt))) {
+    errors.push("createdAt must be a valid ISO-8601 date string");
+  }
+  if (!Array.isArray(input3.traceDirs) || input3.traceDirs.length === 0) {
+    errors.push("traceDirs must be a non-empty array");
+  } else {
+    input3.traceDirs.forEach((dir, i) => {
+      if (typeof dir !== "string" || dir.trim() === "") {
+        errors.push(`traceDirs[${i}] must be a non-empty string`);
+      } else if (!isSafeRelativeWorkspacePath(dir)) {
+        errors.push(
+          `traceDirs[${i}] must be a relative path inside the workspace (no absolute paths or ".." traversal)`
+        );
+      }
+    });
+  }
+  validateDirField(input3.reportsDir, "reportsDir", errors);
+  validateDirField(input3.artifactsDir, "artifactsDir", errors);
+  validateDirField(input3.bundlesDir, "bundlesDir", errors);
+  validateDirField(input3.notesDir, "notesDir", errors);
+  if (!REDACTION_PROFILES2.includes(input3.redactionProfile)) {
+    errors.push(`redactionProfile must be one of: ${REDACTION_PROFILES2.join(", ")}`);
+  }
+  const indexErrors = [];
+  const index = validateIndex(input3.index, indexErrors);
+  errors.push(...indexErrors);
+  if (index && index.type !== "none" && !index.enabled) {
+    warnings.push(`index.type is "${index.type}" but index.enabled is false`);
+  }
+  if (errors.length > 0 || index === void 0) {
+    return { ok: false, errors, warnings };
+  }
+  const manifest = {
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    project: input3.project.trim(),
+    createdAt: input3.createdAt,
+    traceDirs: input3.traceDirs.map((d) => d.trim()),
+    reportsDir: input3.reportsDir.trim(),
+    artifactsDir: input3.artifactsDir.trim(),
+    bundlesDir: input3.bundlesDir.trim(),
+    notesDir: input3.notesDir.trim(),
+    redactionProfile: input3.redactionProfile,
+    index
+  };
+  return { ok: true, manifest, errors, warnings };
+}
+function parseWorkspaceManifest(json) {
+  const warnings = [];
+  if (typeof json !== "string") {
+    return { ok: false, errors: ["manifest input must be a string"], warnings };
+  }
+  if (json.length > MAX_WORKSPACE_MANIFEST_BYTES) {
+    return {
+      ok: false,
+      errors: [
+        `manifest exceeds maximum size of ${MAX_WORKSPACE_MANIFEST_BYTES} bytes`
+      ],
+      warnings
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return { ok: false, errors: ["manifest is not valid JSON"], warnings };
+  }
+  return validateWorkspaceManifest(parsed);
+}
+function serializeWorkspaceManifest(manifest) {
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+var INDEX_DIR_NAME = "index";
+function resolveWorkspaceLocation(cwd = process.cwd()) {
+  const projectRoot = path14.resolve(cwd);
+  const workspaceDir = path14.join(projectRoot, WORKSPACE_DIR_NAME);
+  return {
+    projectRoot,
+    workspaceDir,
+    manifestPath: path14.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
+  };
+}
+function resolveInsideWorkspace(workspaceDir, relative) {
+  const base = path14.resolve(workspaceDir);
+  const resolved = path14.resolve(base, relative);
+  const rel = path14.relative(base, resolved);
+  if (rel === "" || rel === "." || !rel.startsWith("..") && !path14.isAbsolute(rel)) {
+    return resolved;
+  }
+  throw new Error(
+    `Workspace path "${relative}" resolves outside the workspace directory`
+  );
+}
+async function pathExists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isWritable(p) {
+  try {
+    await access(p, constants$1.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function listJsonl(dir) {
+  try {
+    const entries = await readdir(dir);
+    return entries.filter((f) => f.endsWith(".jsonl"));
+  } catch {
+    return [];
+  }
+}
+async function countFiles(dir) {
+  try {
+    const entries = await readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => e.isFile()).length;
+  } catch {
+    return 0;
+  }
+}
+async function readWorkspaceManifestFile(location) {
+  let raw;
+  try {
+    raw = await readFile(location.manifestPath, "utf-8");
+  } catch {
+    return { exists: false, ok: false, errors: ["workspace.json not found"], warnings: [] };
+  }
+  const parsed = parseWorkspaceManifest(raw);
+  return {
+    exists: true,
+    ok: parsed.ok,
+    ...parsed.manifest ? { manifest: parsed.manifest } : {},
+    errors: parsed.errors,
+    warnings: parsed.warnings
+  };
+}
+async function createWorkspace(options = {}) {
+  const location = resolveWorkspaceLocation(options.cwd);
+  const dryRun = options.dryRun === true;
+  const existing = await readWorkspaceManifestFile(location);
+  const topLevelTraces = await listJsonl(location.workspaceDir);
+  const detectedExistingTraces = topLevelTraces.length > 0;
+  let manifest;
+  let created;
+  let adopted;
+  if (existing.exists && existing.ok && existing.manifest) {
+    manifest = existing.manifest;
+    created = false;
+    adopted = true;
+  } else {
+    const project = options.project?.trim() || path14.basename(location.projectRoot) || "workspace";
+    const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
+    manifest = createDefaultWorkspaceManifest({
+      project,
+      traceDirs,
+      ...options.redactionProfile ? { redactionProfile: options.redactionProfile } : {}
+    });
+    created = true;
+    adopted = detectedExistingTraces || existing.exists && !existing.ok;
+  }
+  const relDirs = uniqueDirs([
+    ...manifest.traceDirs.filter((d) => d !== "."),
+    manifest.reportsDir,
+    manifest.artifactsDir,
+    manifest.bundlesDir,
+    manifest.notesDir,
+    INDEX_DIR_NAME
+  ]);
+  const createdDirs = [];
+  for (const rel of relDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    if (await pathExists(abs)) continue;
+    createdDirs.push(rel);
+    if (!dryRun) await mkdir(abs, { recursive: true });
+  }
+  if (!dryRun && created) {
+    await mkdir(location.workspaceDir, { recursive: true });
+    await writeFile(location.manifestPath, serializeWorkspaceManifest(manifest), "utf-8");
+  }
+  return {
+    location,
+    manifest,
+    created,
+    adopted,
+    createdDirs,
+    detectedExistingTraces,
+    dryRun
+  };
+}
+function uniqueDirs(dirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const d of dirs) {
+    const t = d.trim();
+    if (t === "" || t === "." || seen.has(t)) continue;
+    seen.add(t);
+    out.push(t);
+  }
+  return out;
+}
+async function getWorkspaceStatus(location, manifest) {
+  let traceFiles = 0;
+  for (const rel of manifest.traceDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    traceFiles += (await listJsonl(abs)).length;
+  }
+  const reports = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.reportsDir)
+  );
+  const artifacts = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.artifactsDir)
+  );
+  const bundles = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.bundlesDir)
+  );
+  const notes = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.notesDir)
+  );
+  const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
+  return {
+    project: manifest.project,
+    traceFiles,
+    reports,
+    artifacts,
+    bundles,
+    notes,
+    index: {
+      enabled: manifest.index.enabled,
+      type: manifest.index.type,
+      exists: await pathExists(indexPath2)
+    }
+  };
+}
+async function doctorWorkspace(location) {
+  const checks2 = [];
+  const manifestResult = await readWorkspaceManifestFile(location);
+  if (!manifestResult.exists) {
+    checks2.push({
+      id: "manifest",
+      status: "fail",
+      message: "workspace.json not found (run `agent-inspect workspace init`)"
+    });
+    return { ok: false, checks: checks2 };
+  }
+  if (!manifestResult.ok || !manifestResult.manifest) {
+    checks2.push({
+      id: "manifest",
+      status: "fail",
+      message: `workspace.json is invalid: ${manifestResult.errors.join("; ")}`
+    });
+    return { ok: false, checks: checks2 };
+  }
+  const manifest = manifestResult.manifest;
+  checks2.push({ id: "manifest", status: "pass", message: "workspace.json is valid" });
+  for (const warning of manifestResult.warnings) {
+    checks2.push({ id: "manifest-warning", status: "warn", message: warning });
+  }
+  const dirFields = [
+    ...manifest.traceDirs.filter((d) => d !== ".").map((d, i) => [`traceDir[${i}]`, d]),
+    ["reportsDir", manifest.reportsDir],
+    ["artifactsDir", manifest.artifactsDir],
+    ["bundlesDir", manifest.bundlesDir],
+    ["notesDir", manifest.notesDir]
+  ];
+  for (const [id, rel] of dirFields) {
+    let abs;
+    try {
+      abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    } catch (error) {
+      checks2.push({
+        id,
+        status: "fail",
+        message: error instanceof Error ? error.message : String(error)
+      });
+      continue;
+    }
+    if (!await pathExists(abs)) {
+      checks2.push({ id, status: "warn", message: `${rel}/ does not exist yet` });
+    } else if (!await isWritable(abs)) {
+      checks2.push({ id, status: "fail", message: `${rel}/ is not writable` });
+    } else {
+      checks2.push({ id, status: "pass", message: `${rel}/ is present and writable` });
+    }
+  }
+  let newestTraceMtime = 0;
+  for (const rel of manifest.traceDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    for (const file of await listJsonl(abs)) {
+      try {
+        const s = await stat(path14.join(abs, file));
+        newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
+      } catch {
+        checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
+      }
+    }
+  }
+  if (manifest.index.enabled) {
+    const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
+    if (!await pathExists(indexPath2)) {
+      checks2.push({ id: "index", status: "warn", message: "index enabled but not built" });
+    } else {
+      try {
+        const s = await stat(indexPath2);
+        if (newestTraceMtime > s.mtimeMs) {
+          checks2.push({ id: "index", status: "warn", message: "index is stale (traces are newer)" });
+        } else {
+          checks2.push({ id: "index", status: "pass", message: "index is present" });
+        }
+      } catch {
+        checks2.push({ id: "index", status: "warn", message: "cannot stat index" });
+      }
+    }
+  }
+  const ok = !checks2.some((c) => c.status === "fail");
+  return { ok, checks: checks2 };
+}
+async function cleanWorkspace(location, manifest, options = {}) {
+  const dryRun = options.confirm !== true;
+  const targets = uniqueDirs([
+    manifest.reportsDir,
+    manifest.artifactsDir,
+    manifest.bundlesDir,
+    manifest.index.path ?? INDEX_DIR_NAME
+  ]);
+  const removed = [];
+  for (const rel of targets) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    let entries;
+    try {
+      entries = await readdir(abs);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const relPath = `${rel}/${entry}`;
+      removed.push(relPath);
+      if (!dryRun) {
+        await rm(path14.join(abs, entry), { recursive: true, force: true });
+      }
+    }
+  }
+  return { dryRun, removed };
+}
+
+// packages/cli/src/workspace.ts
+function printJson4(payload) {
+  console.log(JSON.stringify(payload, null, 2));
+}
+function fail3(json, message) {
+  if (json) {
+    printJson4({ ok: false, error: message });
+  } else {
+    console.error(`[AgentInspect] workspace: ${message}`);
+  }
+  process.exitCode = 1;
+}
+async function workspaceInitCommand(options = {}) {
+  try {
+    const result = await createWorkspace({
+      ...options.cwd ? { cwd: options.cwd } : {},
+      ...options.project ? { project: options.project } : {},
+      ...options.redactionProfile ? { redactionProfile: options.redactionProfile } : {},
+      dryRun: options.dryRun === true
+    });
+    if (options.json) {
+      printJson4({
+        ok: true,
+        version,
+        dryRun: result.dryRun,
+        created: result.created,
+        adopted: result.adopted,
+        detectedExistingTraces: result.detectedExistingTraces,
+        workspaceDir: result.location.workspaceDir,
+        manifestPath: result.location.manifestPath,
+        createdDirs: result.createdDirs,
+        project: result.manifest.project
+      });
+      return;
+    }
+    console.log("AgentInspect workspace");
+    console.log(`Project: ${result.manifest.project}`);
+    console.log(`Directory: ${result.location.workspaceDir}`);
+    if (result.dryRun) {
+      console.log("Dry run \u2014 would create:");
+      for (const dir of result.createdDirs) console.log(`- ${dir}/`);
+      if (result.created) console.log(`- ${result.location.manifestPath}`);
+      return;
+    }
+    if (result.adopted && !result.created) {
+      console.log("Adopted existing workspace.json (left unchanged).");
+    } else if (result.created) {
+      console.log("Created workspace.json");
+    }
+    if (result.detectedExistingTraces) {
+      console.log("Detected existing traces \u2014 preserved without changes.");
+    }
+    for (const dir of result.createdDirs) console.log(`Created ${dir}/`);
+    console.log("\nNext: `agent-inspect workspace status`");
+  } catch (error) {
+    fail3(options.json, error instanceof Error ? error.message : String(error));
+  }
+}
+async function workspaceStatusCommand(options = {}) {
+  const location = resolveWorkspaceLocation(options.cwd);
+  const manifestResult = await readWorkspaceManifestFile(location);
+  if (!manifestResult.ok || !manifestResult.manifest) {
+    fail3(
+      options.json,
+      manifestResult.exists ? `invalid workspace.json: ${manifestResult.errors.join("; ")}` : "no workspace found (run `agent-inspect workspace init`)"
+    );
+    return;
+  }
+  try {
+    const status = await getWorkspaceStatus(location, manifestResult.manifest);
+    if (options.json) {
+      printJson4({ ok: true, ...status });
+      return;
+    }
+    console.log(`Project: ${status.project}`);
+    console.log(`Traces:    ${status.traceFiles}`);
+    console.log(`Reports:   ${status.reports}`);
+    console.log(`Artifacts: ${status.artifacts}`);
+    console.log(`Bundles:   ${status.bundles}`);
+    console.log(`Notes:     ${status.notes}`);
+    console.log(
+      `Index:     ${status.index.enabled ? status.index.type : "disabled"}${status.index.exists ? " (present)" : ""}`
+    );
+  } catch (error) {
+    fail3(options.json, error instanceof Error ? error.message : String(error));
+  }
+}
+async function workspaceDoctorCommand(options = {}) {
+  const location = resolveWorkspaceLocation(options.cwd);
+  const result = await doctorWorkspace(location);
+  if (options.json) {
+    printJson4({ ok: result.ok, checks: result.checks });
+  } else {
+    console.log("AgentInspect workspace doctor");
+    for (const check of result.checks) {
+      const mark = check.status === "pass" ? "\u2713" : check.status === "warn" ? "!" : "\u2717";
+      console.log(`${mark} ${check.id}: ${check.message}`);
+    }
+    console.log(result.ok ? "\nWorkspace looks healthy." : "\nWorkspace has problems.");
+  }
+  if (!result.ok) process.exitCode = 1;
+}
+async function workspaceCleanCommand(options = {}) {
+  const location = resolveWorkspaceLocation(options.cwd);
+  const manifestResult = await readWorkspaceManifestFile(location);
+  if (!manifestResult.ok || !manifestResult.manifest) {
+    fail3(
+      options.json,
+      manifestResult.exists ? `invalid workspace.json: ${manifestResult.errors.join("; ")}` : "no workspace found (run `agent-inspect workspace init`)"
+    );
+    return;
+  }
+  try {
+    const result = await cleanWorkspace(location, manifestResult.manifest, {
+      confirm: options.yes === true
+    });
+    if (options.json) {
+      printJson4({ ok: true, dryRun: result.dryRun, removed: result.removed });
+      return;
+    }
+    if (result.dryRun) {
+      console.log("Dry run \u2014 would remove (traces are never deleted):");
+      if (result.removed.length === 0) console.log("- (nothing)");
+      for (const item of result.removed) console.log(`- ${item}`);
+      console.log("\nRe-run with --yes to delete.");
+      return;
+    }
+    console.log("Removed generated workspace content (traces preserved):");
+    if (result.removed.length === 0) console.log("- (nothing)");
+    for (const item of result.removed) console.log(`- ${item}`);
+  } catch (error) {
+    fail3(options.json, error instanceof Error ? error.message : String(error));
+  }
+}
+async function workspacePathCommand(options = {}) {
+  const location = resolveWorkspaceLocation(options.cwd);
+  if (options.json) {
+    printJson4({
+      ok: true,
+      projectRoot: location.projectRoot,
+      workspaceDir: location.workspaceDir,
+      manifestPath: location.manifestPath
+    });
+    return;
+  }
+  console.log(location.workspaceDir);
+}
+
 // packages/cli/src/index.ts
 function runCommand(action) {
   void action().catch((error) => {
@@ -15577,6 +16181,28 @@ function createCliProgram() {
   indexCmd.command("clean").description("Remove the local index file").option("--dir <path>", "trace directory").option("--json", "print JSON result").action((opts) => {
     runCommand(() => indexCleanCommand(opts));
   });
+  const workspaceCmd = program.command("workspace").description("Manage a project-local AgentInspect workspace (.agent-inspect)");
+  workspaceCmd.command("init").description("Create or adopt a local workspace (never deletes traces)").option("--project <name>", "project name (default: directory name)").addOption(
+    new Option("--redaction-profile <profile>", "default redaction posture").choices([
+      "local",
+      "share",
+      "strict"
+    ])
+  ).option("--dry-run", "print planned changes without writing").option("--json", "print deterministic JSON result").action((opts) => {
+    runCommand(() => workspaceInitCommand(opts));
+  });
+  workspaceCmd.command("status").description("Show workspace counts and index status (read-only)").option("--json", "print deterministic JSON result").action((opts) => {
+    runCommand(() => workspaceStatusCommand(opts));
+  });
+  workspaceCmd.command("doctor").description("Validate workspace config, permissions, and index freshness").option("--json", "print deterministic JSON result").action((opts) => {
+    runCommand(() => workspaceDoctorCommand(opts));
+  });
+  workspaceCmd.command("clean").description("Remove generated content (reports/artifacts/bundles/index); traces are never deleted").option("--yes", "actually delete (default is a dry-run)").option("--json", "print deterministic JSON result").action((opts) => {
+    runCommand(() => workspaceCleanCommand(opts));
+  });
+  workspaceCmd.command("path").description("Print resolved workspace paths").option("--json", "print deterministic JSON result").action((opts) => {
+    runCommand(() => workspacePathCommand(opts));
+  });
   return program;
 }
 function isPrimaryModule() {