agent-inspect 4.1.0 → 4.3.0

package/packages/cli/dist/index.mjs

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { resolveTraceDir, TraceDirectory, parseDuration, extractMetadata, filterTraces, truncateName, getTraceFilePath, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, loadTraceMetadataList, loadSessionRunRecords, filterMetasBySessionScope, aggregateSessionCheckResults, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, Redactor, validateEvent, isPersistedInspectEvent, buildSessionIndex, nanoid, resolveRedactionProfile, applyProfileMetadataCaps, extractCorrelationMetadata, truncateStringForProfile, parseTraceJsonl } from './chunk-MT5G7JFO.mjs';
+import { resolveTraceDir, parseDuration, buildSessionIndex, enrichSessionRunRecord, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, extractMetadata, filterTraces, truncateName, getTraceFilePath, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, resolveBundleRunIds, aggregateBundleSafeStatus, bundleFailsOnSafety, buildPlaceholderArtifact, buildBundleMetadata, buildBundleSummaryMarkdown, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, Redactor, validateEvent, isPersistedInspectEvent, normalizeBundleOutputPath, defaultBundleOutputPath, nanoid, resolveRedactionProfile, applyProfileMetadataCaps, extractCorrelationMetadata, truncateStringForProfile, parseTraceJsonl } from './chunk-BS5LSKZ3.mjs';
 import { realpathSync, constants as constants$1 } from 'fs';
-import path10 from 'path';
+import path13 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, Option } from 'commander';
-import { unlink, stat, mkdir, writeFile, appendFile, rm, access, readFile, open, readdir, constants } from 'fs/promises';
+import { unlink, stat, mkdir, writeFile, appendFile, readFile, rm, access, open, readdir, constants } from 'fs/promises';
 import process2, { stdin, stdout } from 'process';
 import crypto, { createHash } from 'crypto';
 import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "4.1.0";
+var version = "4.3.0";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -895,7 +895,7 @@ function findReaderByFormat(format, readers) {
 }
 async function jsonlFilesInDirectory(dirPath) {
   const entries = await readdir(dirPath, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path10.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path13.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
 }
 async function resolveInput(input3) {
   const cached = resolvedInputCache.get(input3);
@@ -4361,7 +4361,8 @@ function exportOpenInference(tree, options) {
   ];
   const traceId = hexFrom(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
-  const maxLen = options?.maxAttributeLength;
+  const maxLen = options?.maxAttributeLength ?? 500;
+  const pretty = options?.pretty ?? true;
   const spans = [];
   for (const n of flattenTree(tree)) {
     const ev = n.event;
@@ -4435,7 +4436,7 @@ function exportOpenInference(tree, options) {
   };
   return {
     format: "openinference",
-    content: JSON.stringify(payload, null, 2 ),
+    content: JSON.stringify(payload, null, pretty ? 2 : void 0),
     contentType: "application/json",
     fileExtension: ".openinference.json",
     warnings
@@ -4469,7 +4470,8 @@ function exportOtlpJson(tree, options) {
   ];
   const traceId = hexFrom2(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
-  const maxLen = options?.maxAttributeLength;
+  const maxLen = options?.maxAttributeLength ?? 500;
+  const pretty = options?.pretty ?? true;
   const flat = flattenTree(tree);
   const spans = [];
   for (const n of flat) {
@@ -4565,7 +4567,7 @@ function exportOtlpJson(tree, options) {
   };
   return {
     format: "otlp-json",
-    content: JSON.stringify(payload, null, 2 ),
+    content: JSON.stringify(payload, null, pretty ? 2 : void 0),
     contentType: "application/json",
     fileExtension: ".otlp.json",
     warnings
@@ -4788,9 +4790,9 @@ function mergeExportDefaults(options) {
     includeMetadata: options.includeMetadata ?? true,
     includeAttributes: options.includeAttributes ?? false,
     includeErrors: options.includeErrors ?? true,
-    pretty: options.pretty,
-    redacted: options.redacted,
-    maxAttributeLength: options.maxAttributeLength,
+    pretty: options.pretty ?? true,
+    redacted: options.redacted ?? true,
+    maxAttributeLength: options.maxAttributeLength ?? 500,
     redactionProfile: options.redactionProfile ?? "local"
   };
 }
@@ -5024,9 +5026,9 @@ Trace directory: ${traceDir}`);
   if (validation !== void 0 && !validation.ok) {
     process.exitCode = 1;
   }
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path10.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await mkdir(path10.dirname(outPath), { recursive: true });
+    await mkdir(path13.dirname(outPath), { recursive: true });
     await writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
     console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
@@ -5203,13 +5205,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path17 = buildPath(segments);
+  const path19 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path17,
+      path: path19,
       left: L.name,
       right: R.name
     });
@@ -5219,7 +5221,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path17,
+      path: path19,
       left: L.type,
       right: R.type
     });
@@ -5229,7 +5231,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path17,
+      path: path19,
       left: L.status,
       right: R.status
     });
@@ -5241,7 +5243,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path17,
+      path: path19,
       left: le || void 0,
       right: re || void 0
     });
@@ -5259,7 +5261,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path17,
+        path: path19,
         left: ld,
         right: rd
       });
@@ -5272,7 +5274,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path17,
+      path: path19,
       left: L.metadata,
       right: R.metadata
     });
@@ -5284,7 +5286,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path17,
+      path: path19,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -5444,11 +5446,11 @@ function diffRuns(left, right, options) {
 }
 
 // packages/core/src/diff/renderer.ts
-function formatPath(path17) {
-  if (path17 === void 0 || path17.path.length === 0) {
+function formatPath(path19) {
+  if (path19 === void 0 || path19.path.length === 0) {
     return "(run)";
   }
-  return path17.path.map((s) => s.name).join(" > ");
+  return path19.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -5810,9 +5812,28 @@ async function searchCommand(options = {}) {
     process.exitCode = 1;
   }
 }
-
-// packages/cli/src/sessions.ts
-async function loadSessionIndex(traceDir, correlateGroup) {
+function isModuleNotFound2(e) {
+  return e !== null && typeof e === "object" && "code" in e && (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND");
+}
+function toStatus(raw) {
+  if (raw === "success" || raw === "error" || raw === "running") return raw;
+  return "unknown";
+}
+function indexedToMetadata(row, traceDir) {
+  return {
+    runId: row.runId,
+    name: row.name ?? void 0,
+    status: toStatus(row.status),
+    startedAt: row.startedAt ?? void 0,
+    endedAt: row.endedAt ?? void 0,
+    durationMs: row.durationMs ?? void 0,
+    eventCount: 0,
+    filePath: path13.join(traceDir, row.file),
+    fileSize: 0,
+    createdAt: new Date(row.mtimeMs)
+  };
+}
+async function loadFromScan(traceDir) {
   const td = new TraceDirectory({ dir: traceDir });
   const files = await td.list();
   const metas = await loadTraceMetadataList(
@@ -5820,12 +5841,77 @@ async function loadSessionIndex(traceDir, correlateGroup) {
     files,
     (fileName) => td.getPath(fileName)
   );
-  const runs = await loadSessionRunRecords(metas);
-  return buildSessionIndex(runs, { correlateByGroupId: correlateGroup === true });
+  return loadSessionRunRecords(metas);
+}
+async function newestTraceMtimeMs(traceDir) {
+  const td = new TraceDirectory({ dir: traceDir });
+  let newest = 0;
+  for (const file of await td.list()) {
+    try {
+      const stats = await td.getFileStats(file);
+      if (stats.mtimeMs > newest) newest = stats.mtimeMs;
+    } catch {
+    }
+  }
+  return newest;
+}
+async function loadSessionRuns(traceDir) {
+  try {
+    const mod = await import('./src-YFMPWEIS.mjs');
+    const dbPath = mod.resolveIndexDbPath(traceDir);
+    const status = mod.indexStatus(dbPath);
+    if (!status.healthy) {
+      return { runs: await loadFromScan(traceDir), source: "scan" };
+    }
+    const newest = await newestTraceMtimeMs(traceDir);
+    if (mod.isIndexStale(dbPath, newest)) {
+      return { runs: await loadFromScan(traceDir), source: "scan" };
+    }
+    const indexed = mod.queryRuns(dbPath, { limit: 1e4 });
+    if (indexed.length === 0) {
+      return { runs: await loadFromScan(traceDir), source: "scan" };
+    }
+    const runs = [];
+    for (const row of indexed) {
+      runs.push(await enrichSessionRunRecord(indexedToMetadata(row, traceDir)));
+    }
+    runs.sort((a, b) => (a.startedAt ?? 0) - (b.startedAt ?? 0));
+    return { runs, source: "index" };
+  } catch (e) {
+    if (!isModuleNotFound2(e)) ;
+    return { runs: await loadFromScan(traceDir), source: "scan" };
+  }
+}
+
+// packages/cli/src/sessions.ts
+async function loadSessionIndex(traceDir, options = {}) {
+  const { runs } = await loadSessionRuns(traceDir);
+  const staleThresholdMs = options.staleAfter && options.staleAfter.trim() !== "" ? parseDuration(options.staleAfter.trim()) : void 0;
+  return buildSessionIndex(runs, {
+    correlateByGroupId: options.correlateGroup === true,
+    staleThresholdMs
+  });
 }
 function findSession(index, sessionId) {
   return index.sessions.find((session) => session.sessionId === sessionId);
 }
+function latestSession(index) {
+  if (index.sessions.length === 0) return void 0;
+  return [...index.sessions].sort(
+    (a, b) => Date.parse(b.lastActivity) - Date.parse(a.lastActivity)
+  )[0];
+}
+function parseSinceCutoff(since) {
+  if (!since || since.trim() === "") return void 0;
+  return Date.now() - parseDuration(since.trim());
+}
+function sessionsInSinceWindow(index, since) {
+  const cutoff = parseSinceCutoff(since);
+  if (cutoff === void 0) return index.sessions;
+  return index.sessions.filter(
+    (session) => Date.parse(session.lastActivity) >= cutoff
+  );
+}
 function renderSessionsHuman(index, traceDir) {
   if (index.sessions.length === 0) {
     console.log("No sessions found");
@@ -5839,13 +5925,9 @@ function renderSessionsHuman(index, traceDir) {
   }
   console.log("Sessions:");
   for (const session of index.sessions) {
-    const firstRun = index.runs.find(
-      (run) => session.runIds.includes(run.runId)
-    );
-    const workflowName = firstRun?.metadata && typeof firstRun.metadata.workflowName === "string" ? firstRun.metadata.workflowName : void 0;
-    const suffix = workflowName ? ` workflow=${workflowName}` : "";
+    const suffix = session.workflowId ? ` workflow=${session.workflowId}` : "";
     console.log(
-      `  ${session.sessionId} (${session.runIds.length} run${session.runIds.length === 1 ? "" : "s"})${suffix}`
+      `  ${session.sessionId} [${session.status}] (${session.runIds.length} run${session.runIds.length === 1 ? "" : "s"})${suffix}`
     );
   }
   if (index.unscopedRunIds.length > 0) {
@@ -5857,7 +5939,14 @@ function renderSessionsHuman(index, traceDir) {
 }
 function renderSessionHuman(session, index, options) {
   console.log(`Session: ${session.sessionId}`);
+  console.log(`Status: ${session.status}`);
   console.log(`Runs: ${session.runIds.join(", ")}`);
+  if (session.lastActivity) console.log(`Last activity: ${session.lastActivity}`);
+  if (session.lastError) {
+    console.log(
+      `Last error: ${session.lastError.message} (run ${session.lastError.runId})`
+    );
+  }
   if (session.handoffs.length > 0) {
     console.log("");
     console.log("Handoffs:");
@@ -5902,10 +5991,29 @@ function renderSessionHuman(session, index, options) {
     }
   }
 }
+function collectHandoffs(index, sessionId) {
+  const sessions = sessionId ? index.sessions.filter((s) => s.sessionId === sessionId) : index.sessions;
+  const out = [];
+  for (const session of sessions) {
+    for (const edge of session.handoffs) {
+      out.push({ ...edge, sessionId: session.sessionId });
+    }
+  }
+  return out.sort((a, b) => {
+    const session = a.sessionId.localeCompare(b.sessionId);
+    if (session !== 0) return session;
+    const from = a.from.localeCompare(b.from);
+    if (from !== 0) return from;
+    return a.to.localeCompare(b.to);
+  });
+}
 async function sessionsCommand(options = {}) {
   try {
     const traceDir = resolveTraceDir({ dir: options.dir });
-    const index = await loadSessionIndex(traceDir, options.correlateGroup);
+    const index = await loadSessionIndex(traceDir, {
+      correlateGroup: options.correlateGroup,
+      staleAfter: options.staleAfter
+    });
     if (options.json) {
       console.log(
         JSON.stringify(
@@ -5928,6 +6036,121 @@ async function sessionsCommand(options = {}) {
     process.exitCode = 1;
   }
 }
+async function sessionsLatestCommand(options = {}) {
+  try {
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const index = await loadSessionIndex(traceDir, {
+      correlateGroup: options.correlateGroup,
+      staleAfter: options.staleAfter
+    });
+    const latest = latestSession(index);
+    if (!latest) {
+      if (options.json) {
+        console.log(JSON.stringify({ ok: false, traceDir, reason: "no-sessions" }, null, 2));
+      } else {
+        console.log("No sessions found");
+        console.log(`Trace directory: ${traceDir}`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true, traceDir, session: latest }, null, 2));
+      return;
+    }
+    console.log(`Latest session: ${latest.sessionId}`);
+    console.log(`Status: ${latest.status}`);
+    console.log(`Last activity: ${latest.lastActivity}`);
+    console.log(`Runs: ${latest.runIds.join(", ")}`);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] sessions latest failed: ${msg}`);
+    process.exitCode = 1;
+  }
+}
+async function sessionsActivityCommand(options = {}) {
+  try {
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const index = await loadSessionIndex(traceDir, {
+      correlateGroup: options.correlateGroup,
+      staleAfter: options.staleAfter
+    });
+    const summary = buildActivitySummary(index, { since: options.since });
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true, traceDir, ...summary }, null, 2));
+      return;
+    }
+    console.log(renderActivitySummaryHuman(summary));
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] sessions activity failed: ${msg}`);
+    process.exitCode = 1;
+  }
+}
+async function sessionsHandoffsCommand(options = {}) {
+  try {
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const index = await loadSessionIndex(traceDir, {
+      correlateGroup: options.correlateGroup
+    });
+    const handoffs = collectHandoffs(index, options.session);
+    if (options.json) {
+      console.log(
+        JSON.stringify({ ok: true, traceDir, count: handoffs.length, handoffs }, null, 2)
+      );
+      return;
+    }
+    if (handoffs.length === 0) {
+      console.log("No handoffs found");
+      return;
+    }
+    for (const edge of handoffs) {
+      console.log(
+        `${edge.sessionId}: ${edge.from} -> ${edge.to} (${edge.confidence})`
+      );
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] sessions handoffs failed: ${msg}`);
+    process.exitCode = 1;
+  }
+}
+async function sessionsErrorsCommand(options = {}) {
+  try {
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const index = await loadSessionIndex(traceDir, {
+      correlateGroup: options.correlateGroup,
+      staleAfter: options.staleAfter
+    });
+    const scoped = sessionsInSinceWindow(index, options.since);
+    const errors = scoped.filter((session) => session.status === "error");
+    if (options.json) {
+      console.log(
+        JSON.stringify(
+          { ok: true, traceDir, count: errors.length, sessions: errors },
+          null,
+          2
+        )
+      );
+      return;
+    }
+    if (errors.length === 0) {
+      console.log("No error sessions found");
+      return;
+    }
+    for (const session of errors) {
+      const detail = session.lastError?.message ?? "error";
+      console.log(`${session.sessionId}  ${detail}  (${session.runIds.length} runs)`);
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] sessions errors failed: ${msg}`);
+    process.exitCode = 1;
+  }
+}
+async function sessionsShowCommand(sessionId, options = {}) {
+  await sessionCommand(sessionId, options);
+}
 async function sessionCommand(sessionId, options = {}) {
   const id = typeof sessionId === "string" && sessionId.trim() !== "" ? sessionId.trim() : "";
   if (id === "") {
@@ -6081,9 +6304,9 @@ async function reportCommand(runId, options = {}) {
     redactionProfile,
     correlation: !options.noCorrelation
   });
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path10.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await mkdir(path10.dirname(outPath), { recursive: true });
+    await mkdir(path13.dirname(outPath), { recursive: true });
     await writeFile(outPath, result.content, "utf-8");
     console.log(`Wrote ${result.fileExtension} report to ${outPath}`);
   }
@@ -6330,17 +6553,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path17, key) {
+function childPath(path19, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path17 ? `${path17}.${key}` : key;
+    return path19 ? `${path19}.${key}` : key;
   }
-  return `${path17 || "$"}[${JSON.stringify(key)}]`;
+  return `${path19 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path17, index) {
-  return `${path17 || "$"}[${index}]`;
+function indexPath(path19, index) {
+  return `${path19 || "$"}[${index}]`;
 }
-function makeFinding(path17, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path17, detector, action, severity, matchKind } : { path: path17, detector, action, severity, matchKind, preview };
+function makeFinding(path19, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path19, detector, action, severity, matchKind } : { path: path19, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -6409,11 +6632,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path17, depth, state) {
+  #redactValue(value, key, path19, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path17, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path19, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -6422,19 +6645,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path17, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path19, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path17, key, value });
+      const detections = detector.detect({ path: path19, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path17,
+            path19,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -6452,7 +6675,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path17, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path19, index), depth + 1, state);
       });
       return out;
     }
@@ -6464,7 +6687,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path17 === "$" ? "" : path17, entryKey),
+          childPath(path19 === "$" ? "" : path19, entryKey),
           depth + 1,
           state
         );
@@ -6590,6 +6813,9 @@ function redactDocument(content, profile) {
     return redactJsonlText(content, profile);
   }
 }
+function redactTraceContent(content, profile) {
+  return redactDocument(content, profile);
+}
 async function redactCommand(target, options = {}, stdin = process.stdin) {
   const profile = parseRedactionProfile3(options.profile);
   const source = await contentFromTarget(target, options, stdin);
@@ -6911,14 +7137,14 @@ function uniqueSorted(values) {
   return [...new Set(values)].sort();
 }
 function isWithinDirectory(child, parent) {
-  const relative = path10.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path10.isAbsolute(relative);
+  const relative = path13.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path13.isAbsolute(relative);
 }
 async function resolveOutputPath(inputPath, output2, force) {
   if (output2 === void 0 || output2.trim() === "") return void 0;
-  const inputAbs = path10.resolve(inputPath);
-  const outputAbs = path10.resolve(output2.trim());
-  const inputDir = path10.dirname(inputAbs);
+  const inputAbs = path13.resolve(inputPath);
+  const outputAbs = path13.resolve(output2.trim());
+  const inputDir = path13.dirname(inputAbs);
   if (!isWithinDirectory(outputAbs, inputDir)) {
     throw new Error("Refusing to write migrated output outside the input directory.");
   }
@@ -7039,7 +7265,7 @@ async function migrateCommand(input3, options = {}) {
     process.exitCode = 1;
     return;
   }
-  const inputPath = path10.resolve(input3.trim());
+  const inputPath = path13.resolve(input3.trim());
   const dryRun = options.dryRun === true;
   if (!dryRun && (options.output === void 0 || options.output.trim() === "")) {
     console.error("migrate requires --dry-run or --output <path>.");
@@ -7058,7 +7284,7 @@ async function migrateCommand(input3, options = {}) {
     );
     const result = await buildMigration(inputPath, outputPath);
     if (!dryRun && outputPath !== void 0) {
-      await mkdir(path10.dirname(outputPath), { recursive: true });
+      await mkdir(path13.dirname(outputPath), { recursive: true });
       await writeFile(outputPath, result.content, "utf-8");
     }
     printSummary2(result, dryRun);
@@ -7336,7 +7562,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path17) {
+function eventEvidence(event, path19) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -7346,7 +7572,7 @@ function eventEvidence(event, path17) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path17 ? { path: path17 } : {}
+    ...path19 ? { path: path19 } : {}
   };
 }
 function runEvidence(run) {
@@ -7409,9 +7635,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path17) {
-  const parts = path17.split(".");
-  return parts[parts.length - 1] ?? path17;
+function lastPathSegment(path19) {
+  const parts = path19.split(".");
+  return parts[parts.length - 1] ?? path19;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -7425,12 +7651,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path17, key, depth = 0) {
-  entries.push({ event, path: path17, key, value });
+function pushValueEntries(entries, event, value, path19, key, depth = 0) {
+  entries.push({ event, path: path19, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path17}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path19}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -7440,7 +7666,7 @@ function pushValueEntries(entries, event, value, path17, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path17}.${nestedKey}`,
+      `${path19}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -7521,9 +7747,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path17) => {
-    lines.push(`${path17}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path17}.${index}`));
+  const visit = (node, path19) => {
+    lines.push(`${path19}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path19}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -7572,9 +7798,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path17) {
+function firstEvidenceForKind(context, kind, path19) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path17)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path19)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -7924,13 +8150,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path17 = [];
+        const path19 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path17.slice(existing);
+            const cycle = path19.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -7946,8 +8172,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path17.length);
-          path17.push(current);
+          seenAt.set(current.eventId, path19.length);
+          path19.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -8744,23 +8970,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path17, evidence) {
+function validateSchemaField(value, field, path19, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path17, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path19, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path17, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path19, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path17}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path19}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -9087,7 +9313,7 @@ function asConfig(value) {
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
-  const extension = path10.extname(configPath);
+  const extension = path13.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
     throw new Error(
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -9096,7 +9322,7 @@ async function loadConfig(configPath) {
   if (!CONFIG_EXTENSIONS.has(extension)) {
     throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path10.resolve(configPath);
+  const absolute = path13.resolve(configPath);
   if (extension === ".json") {
     const raw = await readFile(absolute, "utf-8");
     return asConfig(JSON.parse(raw));
@@ -9245,10 +9471,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path17 = finding.evidence[0]?.path;
+    const path19 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path17 ? ` (${path17})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -9448,7 +9674,7 @@ function createViewerServer(options = {}) {
         return sendJson(res, 200, {
           ok: true,
           readOnly: true,
-          traceDir: path10.resolve(traceDir)
+          traceDir: path13.resolve(traceDir)
         });
       }
       const td = new TraceDirectory({ dir: traceDir });
@@ -9466,7 +9692,7 @@ function createViewerServer(options = {}) {
             runId: meta.runId,
             name: meta.name,
             status: meta.status,
-            file: path10.basename(meta.filePath),
+            file: path13.basename(meta.filePath),
             startedAt: meta.startedAt,
             durationMs: meta.durationMs
           }))
@@ -9581,7 +9807,7 @@ function startViewerServer(options = {}) {
       resolve({
         host,
         port: resolvedPort,
-        traceDir: path10.resolve(traceDir),
+        traceDir: path13.resolve(traceDir),
         url: `http://${host}:${resolvedPort}`
       });
     });
@@ -9786,10 +10012,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path17) {
-  return [{ runId: run.runId, ...path17 !== void 0 ? { path: path17 } : {} }];
+function evidenceForRun(run, path19) {
+  return [{ runId: run.runId, ...path19 !== void 0 ? { path: path19 } : {} }];
 }
-function evidenceForEvent(event, path17) {
+function evidenceForEvent(event, path19) {
   return [
     {
       runId: event.runId,
@@ -9797,7 +10023,7 @@ function evidenceForEvent(event, path17) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path17 !== void 0 ? { path: path17 } : {}
+      ...path19 !== void 0 ? { path: path19 } : {}
     }
   ];
 }
@@ -9955,9 +10181,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path17) {
+function firstEvidence(fields, run, path19) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path17) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path19) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -10334,8 +10560,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path17 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path17 ? ` (${path17})` : ""}`);
+      const path19 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -10382,7 +10608,7 @@ function asConfig2(value) {
 }
 async function loadConfig2(configPath) {
   if (configPath === void 0) return {};
-  const extension = path10.extname(configPath);
+  const extension = path13.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error(
       "TypeScript eval configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -10391,7 +10617,7 @@ async function loadConfig2(configPath) {
   if (!CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error("Unsupported eval config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path10.resolve(configPath);
+  const absolute = path13.resolve(configPath);
   if (extension === ".json") {
     const raw = await readFile(absolute, "utf-8");
     return asConfig2(JSON.parse(raw));
@@ -10528,8 +10754,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path17 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path17 ? ` (${path17})` : ""}`);
+    const path19 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -10767,8 +10993,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path17 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path17 ? ` (${path17})` : ""}`);
+    const path19 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -10814,6 +11040,38 @@ function scanCommand(target, options = {}, stdin = process.stdin) {
 function verifySafeCommand(target, options = {}, stdin = process.stdin) {
   return safetyCommand("verify-safe", target, options, stdin);
 }
+function assessOpenedTrace(read, options = {}) {
+  try {
+    const rules = buildSafetyRules(options);
+    const checkResult = runTraceChecks(
+      { read },
+      {
+        rules,
+        ...options.runId !== void 0 ? { runId: options.runId } : {},
+        ...options.run !== void 0 ? { runId: options.run } : {}
+      }
+    );
+    const detectorFindings = checkResult.diagnostics.length === 0 ? redactionDetectorFindings(read, checkResult.runId) : [];
+    return resultFromParts({
+      command: "verify-safe",
+      format: checkResult.format,
+      runId: checkResult.runId,
+      findings: [...checkResult.findings, ...detectorFindings],
+      diagnostics: [
+        ...checkResult.diagnostics.map(diagnosticFromCheck),
+        ...warningDiagnostics(read.warnings, read.unsupportedFields)
+      ],
+      warnings: read.warnings,
+      unsupportedFields: read.unsupportedFields
+    });
+  } catch (error) {
+    return messageStartsWithDash(error) ? invalidArgumentResult("verify-safe", error) : readErrorResult3("verify-safe", error);
+  }
+}
+function messageStartsWithDash(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.startsWith("--");
+}
 var NOTE = "Generated locally by AgentInspect. Artifacts are best-effort summaries, not compliance or security certification.";
 var SAFETY_RULES = [
   createSafetyRawContentRule(),
@@ -10887,8 +11145,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path17 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path17})`);
+    const path19 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path19})`);
   }
   for (const diagnostic4 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic4.code}: ${diagnostic4.message}`);
@@ -10966,8 +11224,8 @@ function renderHtml(trace, check, diff) {
 `;
 }
 async function writeArtifact(outputDir, relativePath, content, files) {
-  const outPath = path10.join(outputDir, relativePath);
-  await mkdir(path10.dirname(outPath), { recursive: true });
+  const outPath = path13.join(outputDir, relativePath);
+  await mkdir(path13.dirname(outPath), { recursive: true });
   await writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -10983,7 +11241,7 @@ function manifestStatus(check, diff) {
   return "ok";
 }
 async function artifactsCommand(target, options = {}, stdin = process.stdin) {
-  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path10.resolve(options.outputDir.trim()) : "";
+  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path13.resolve(options.outputDir.trim()) : "";
   if (outputDir === "") {
     console.error("--output-dir is required.");
     process.exitCode = 1;
@@ -11049,8 +11307,8 @@ async function artifactsCommand(target, options = {}, stdin = process.stdin) {
   await writeArtifact(outputDir, "report.html", renderHtml(trace, check, diff), files);
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    await mkdir(path10.dirname(path10.resolve(summaryTarget)), { recursive: true });
-    await appendFile(path10.resolve(summaryTarget), `
+    await mkdir(path13.dirname(path13.resolve(summaryTarget)), { recursive: true });
+    await appendFile(path13.resolve(summaryTarget), `
 ${renderMarkdown(trace, check, diff)}`, "utf-8");
   }
   const manifestFiles = [...files, "manifest.json"].sort((a, b) => a.localeCompare(b));
@@ -11069,10 +11327,10 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
       findings: diff?.findings.length ?? 0,
       diagnostics: diff?.diagnostics.length ?? 0
     },
-    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path10.resolve(summaryTarget) } : {},
+    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path13.resolve(summaryTarget) } : {},
     note: NOTE
   };
-  await writeFile(path10.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
+  await writeFile(path13.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
   if (options.json === true) {
     console.log(writeJson3(manifest).trimEnd());
   } else {
@@ -11083,1568 +11341,1893 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
     }
   }
 }
-function validateReporterArtifactPath(options) {
-  const outputDir = path10.resolve(options.outputDir);
-  const diagnostics = [];
-  const rawPath = options.relativePath;
-  if (rawPath.length === 0) {
-    diagnostics.push({
-      code: "artifact_path_empty",
-      severity: "error",
-      message: "Reporter artifact path must not be empty."
-    });
-    return { ok: false, outputDir, diagnostics };
+
+// packages/core/src/workspace/types.ts
+var WORKSPACE_SCHEMA_VERSION = "1.0";
+var WORKSPACE_DIR_NAME = ".agent-inspect";
+var WORKSPACE_MANIFEST_FILENAME = "workspace.json";
+
+// packages/core/src/workspace/manifest.ts
+var DEFAULT_WORKSPACE_LAYOUT = {
+  traceDirs: ["runs"],
+  reportsDir: "reports",
+  artifactsDir: "artifacts",
+  bundlesDir: "bundles",
+  notesDir: "notes"
+};
+var DEFAULT_REDACTION_PROFILE = "share";
+var REDACTION_PROFILES = [
+  "local",
+  "share",
+  "strict"
+];
+var INDEX_TYPES = ["none", "sqlite", "custom"];
+var MAX_WORKSPACE_MANIFEST_BYTES = 64 * 1024;
+function createDefaultWorkspaceManifest(options) {
+  const project = typeof options.project === "string" ? options.project.trim() : "";
+  const index = {
+    enabled: options.index?.enabled ?? false,
+    type: options.index?.type ?? "none",
+    ...options.index?.path !== void 0 ? { path: options.index.path } : {}
+  };
+  return {
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    project,
+    createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    traceDirs: options.traceDirs ? [...options.traceDirs] : [...DEFAULT_WORKSPACE_LAYOUT.traceDirs],
+    reportsDir: options.reportsDir ?? DEFAULT_WORKSPACE_LAYOUT.reportsDir,
+    artifactsDir: options.artifactsDir ?? DEFAULT_WORKSPACE_LAYOUT.artifactsDir,
+    bundlesDir: options.bundlesDir ?? DEFAULT_WORKSPACE_LAYOUT.bundlesDir,
+    notesDir: options.notesDir ?? DEFAULT_WORKSPACE_LAYOUT.notesDir,
+    redactionProfile: options.redactionProfile ?? DEFAULT_REDACTION_PROFILE,
+    index
+  };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeRelativeWorkspacePath(p) {
+  if (typeof p !== "string") return false;
+  const trimmed = p.trim();
+  if (trimmed === "") return false;
+  if (trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
+  if (/^[a-zA-Z]:/.test(trimmed)) return false;
+  const segments = trimmed.split(/[/\\]+/);
+  return !segments.some((seg) => seg === "..");
+}
+function validateDirField(value, field, errors) {
+  if (typeof value !== "string" || value.trim() === "") {
+    errors.push(`${field} must be a non-empty string`);
+    return;
   }
-  if (rawPath.includes("\0")) {
-    diagnostics.push({
-      code: "invalid_artifact_path",
-      severity: "error",
-      message: "Reporter artifact path must not contain null bytes.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
+  if (!isSafeRelativeWorkspacePath(value)) {
+    errors.push(
+      `${field} must be a relative path inside the workspace (no absolute paths or ".." traversal)`
+    );
   }
-  if (path10.isAbsolute(rawPath) || path10.win32.isAbsolute(rawPath)) {
-    diagnostics.push({
-      code: "artifact_path_absolute",
-      severity: "error",
-      message: "Reporter artifact path must be relative.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
+}
+function validateIndex(value, errors) {
+  if (!isPlainObject(value)) {
+    errors.push("index must be an object");
+    return void 0;
   }
-  const normalized = path10.posix.normalize(rawPath.replace(/\\/g, "/"));
-  const segments = normalized.split("/");
-  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
-    diagnostics.push({
-      code: "artifact_path_escape",
-      severity: "error",
-      message: "Reporter artifact path must stay under the output directory.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
+  if (typeof value.enabled !== "boolean") {
+    errors.push("index.enabled must be a boolean");
   }
-  const absolutePath = path10.resolve(outputDir, normalized);
-  const relFromOutput = path10.relative(outputDir, absolutePath);
-  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path10.isAbsolute(relFromOutput)) {
-    diagnostics.push({
-      code: "artifact_path_escape",
-      severity: "error",
-      message: "Reporter artifact path resolved outside the output directory.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
+  if (!INDEX_TYPES.includes(value.type)) {
+    errors.push(`index.type must be one of: ${INDEX_TYPES.join(", ")}`);
   }
+  if (value.path !== void 0 && !isSafeRelativeWorkspacePath(value.path)) {
+    errors.push(
+      'index.path must be a relative path inside the workspace (no absolute paths or ".." traversal)'
+    );
+  }
+  if (errors.length > 0) return void 0;
   return {
-    ok: true,
-    outputDir,
-    relativePath: normalized,
-    absolutePath,
-    diagnostics
+    enabled: value.enabled,
+    type: value.type,
+    ...value.path !== void 0 ? { path: value.path } : {}
   };
 }
-
-// packages/cli/src/ci-summary.ts
-var NOTE2 = "Generated locally by AgentInspect from reporter artifact manifests. Trace contents are not embedded.";
-var MAX_TEXT = 180;
-var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "jest", "manual"]);
-var STATUSES = /* @__PURE__ */ new Set(["passed", "failed", "skipped", "todo"]);
-var ARTIFACT_KINDS = /* @__PURE__ */ new Set(["trace", "report", "eval", "redaction", "summary"]);
-var ARTIFACT_FORMATS = /* @__PURE__ */ new Set(["json", "jsonl", "md", "html"]);
-var REDACTION_PROFILES = /* @__PURE__ */ new Set(["local", "share", "strict"]);
-function stable6(value) {
-  if (Array.isArray(value)) return value.map(stable6);
-  if (value === null || typeof value !== "object") return value;
-  const record = value;
-  return Object.fromEntries(
-    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable6(record[key])])
-  );
-}
-function writeJson4(value) {
-  return `${JSON.stringify(stable6(value), null, 2)}
-`;
-}
-function isObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function readString(value, label) {
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`${label} must be a non-empty string.`);
+function validateWorkspaceManifest(input3) {
+  const errors = [];
+  const warnings = [];
+  if (!isPlainObject(input3)) {
+    return { ok: false, errors: ["manifest must be an object"], warnings };
   }
-  return safeText(value);
-}
-function readOptionalString(value) {
-  return typeof value === "string" && value.trim() !== "" ? safeText(value) : void 0;
-}
-function readFramework(value) {
-  const framework = readString(value, "manifest.framework");
-  if (!FRAMEWORKS.has(framework)) {
-    throw new Error(`Unsupported reporter framework: ${framework}.`);
+  if (input3.schemaVersion !== WORKSPACE_SCHEMA_VERSION) {
+    errors.push(
+      `schemaVersion must be "${WORKSPACE_SCHEMA_VERSION}" (received ${JSON.stringify(
+        input3.schemaVersion
+      )})`
+    );
   }
-  return framework;
-}
-function readStatus(value) {
-  const status = readString(value, "result.status");
-  if (!STATUSES.has(status)) {
-    throw new Error(`Unsupported reporter test status: ${status}.`);
+  if (typeof input3.project !== "string" || input3.project.trim() === "") {
+    errors.push("project must be a non-empty string");
   }
-  return status;
-}
-function readArtifact(value, index) {
-  if (!isObject(value)) throw new Error(`manifest.artifacts[${index}] must be an object.`);
-  const kind = readString(value.kind, `manifest.artifacts[${index}].kind`);
-  const format = readString(value.format, `manifest.artifacts[${index}].format`);
-  const redactionProfile = readString(
-    value.redactionProfile,
-    `manifest.artifacts[${index}].redactionProfile`
-  );
-  if (!ARTIFACT_KINDS.has(kind)) throw new Error(`Unsupported artifact kind: ${kind}.`);
-  if (!ARTIFACT_FORMATS.has(format)) throw new Error(`Unsupported artifact format: ${format}.`);
-  if (!REDACTION_PROFILES.has(redactionProfile)) {
-    throw new Error(`Unsupported artifact redaction profile: ${redactionProfile}.`);
+  if (typeof input3.createdAt !== "string" || input3.createdAt.trim() === "") {
+    errors.push("createdAt must be a non-empty ISO-8601 string");
+  } else if (Number.isNaN(Date.parse(input3.createdAt))) {
+    errors.push("createdAt must be a valid ISO-8601 date string");
   }
-  const artifactPath = readString(value.path, `manifest.artifacts[${index}].path`);
-  const pathCheck = validateReporterArtifactPath({
-    outputDir: process.cwd(),
-    relativePath: artifactPath
-  });
-  if (!pathCheck.ok || pathCheck.relativePath === void 0) {
-    throw new Error(`Unsafe reporter artifact path: ${artifactPath}.`);
+  if (!Array.isArray(input3.traceDirs) || input3.traceDirs.length === 0) {
+    errors.push("traceDirs must be a non-empty array");
+  } else {
+    input3.traceDirs.forEach((dir, i) => {
+      if (typeof dir !== "string" || dir.trim() === "") {
+        errors.push(`traceDirs[${i}] must be a non-empty string`);
+      } else if (!isSafeRelativeWorkspacePath(dir)) {
+        errors.push(
+          `traceDirs[${i}] must be a relative path inside the workspace (no absolute paths or ".." traversal)`
+        );
+      }
+    });
   }
-  return {
-    kind,
-    path: pathCheck.relativePath,
-    format,
-    redactionProfile
+  validateDirField(input3.reportsDir, "reportsDir", errors);
+  validateDirField(input3.artifactsDir, "artifactsDir", errors);
+  validateDirField(input3.bundlesDir, "bundlesDir", errors);
+  validateDirField(input3.notesDir, "notesDir", errors);
+  if (!REDACTION_PROFILES.includes(input3.redactionProfile)) {
+    errors.push(`redactionProfile must be one of: ${REDACTION_PROFILES.join(", ")}`);
+  }
+  const indexErrors = [];
+  const index = validateIndex(input3.index, indexErrors);
+  errors.push(...indexErrors);
+  if (index && index.type !== "none" && !index.enabled) {
+    warnings.push(`index.type is "${index.type}" but index.enabled is false`);
+  }
+  if (errors.length > 0 || index === void 0) {
+    return { ok: false, errors, warnings };
+  }
+  const manifest = {
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    project: input3.project.trim(),
+    createdAt: input3.createdAt,
+    traceDirs: input3.traceDirs.map((d) => d.trim()),
+    reportsDir: input3.reportsDir.trim(),
+    artifactsDir: input3.artifactsDir.trim(),
+    bundlesDir: input3.bundlesDir.trim(),
+    notesDir: input3.notesDir.trim(),
+    redactionProfile: input3.redactionProfile,
+    index
   };
+  return { ok: true, manifest, errors, warnings };
 }
-function readArtifacts(value, label) {
-  if (value === void 0) return [];
-  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
-  return value.map((item, index) => readArtifact(item, index));
+function parseWorkspaceManifest(json) {
+  const warnings = [];
+  if (typeof json !== "string") {
+    return { ok: false, errors: ["manifest input must be a string"], warnings };
+  }
+  if (json.length > MAX_WORKSPACE_MANIFEST_BYTES) {
+    return {
+      ok: false,
+      errors: [
+        `manifest exceeds maximum size of ${MAX_WORKSPACE_MANIFEST_BYTES} bytes`
+      ],
+      warnings
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return { ok: false, errors: ["manifest is not valid JSON"], warnings };
+  }
+  return validateWorkspaceManifest(parsed);
 }
-function readDiagnosticsCount(value, label) {
-  if (value === void 0) return 0;
-  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
-  return value.length;
+function serializeWorkspaceManifest(manifest) {
+  return `${JSON.stringify(manifest, null, 2)}
+`;
 }
-function readResult(value, index) {
-  if (!isObject(value)) throw new Error(`manifest.results[${index}] must be an object.`);
-  const file = readOptionalString(value.file);
-  const tracePath = readOptionalString(value.tracePath);
+var INDEX_DIR_NAME = "index";
+function resolveWorkspaceLocation(cwd = process.cwd()) {
+  const projectRoot = path13.resolve(cwd);
+  const workspaceDir = path13.join(projectRoot, WORKSPACE_DIR_NAME);
   return {
-    testId: readString(value.testId, `manifest.results[${index}].testId`),
-    name: readString(value.name, `manifest.results[${index}].name`),
-    ...file === void 0 ? {} : { file },
-    status: readStatus(value.status),
-    ...tracePath === void 0 ? {} : { tracePath },
-    artifacts: readArtifacts(value.artifacts, `manifest.results[${index}].artifacts`),
-    diagnostics: readDiagnosticsCount(
-      value.diagnostics,
-      `manifest.results[${index}].diagnostics`
-    )
+    projectRoot,
+    workspaceDir,
+    manifestPath: path13.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
   };
 }
-function readManifestDocument(value) {
-  if (!isObject(value)) throw new Error("Reporter manifest file must contain a JSON object.");
-  const candidate = isObject(value.manifest) ? value.manifest : value;
-  if (!isObject(candidate)) throw new Error("Reporter manifest must be a JSON object.");
-  const schemaVersion = readString(candidate.schemaVersion, "manifest.schemaVersion");
-  if (schemaVersion !== "0.1") {
-    throw new Error(`Unsupported reporter manifest schemaVersion: ${schemaVersion}.`);
+function resolveInsideWorkspace(workspaceDir, relative) {
+  const base = path13.resolve(workspaceDir);
+  const resolved = path13.resolve(base, relative);
+  const rel = path13.relative(base, resolved);
+  if (rel === "" || rel === "." || !rel.startsWith("..") && !path13.isAbsolute(rel)) {
+    return resolved;
   }
-  if (!Array.isArray(candidate.results)) {
-    throw new Error("manifest.results must be an array.");
+  throw new Error(
+    `Workspace path "${relative}" resolves outside the workspace directory`
+  );
+}
+async function pathExists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
   }
-  const artifacts = readArtifacts(candidate.artifacts, "manifest.artifacts");
-  const results = candidate.results.map((item, index) => readResult(item, index));
-  const diagnostics = readDiagnosticsCount(candidate.diagnostics, "manifest.diagnostics");
-  const manifest = {
-    framework: readFramework(candidate.framework),
-    generatedAt: readString(candidate.generatedAt, "manifest.generatedAt"),
-    results,
-    artifacts
-  };
-  return {
-    packageName: readOptionalString(value.package),
-    manifest,
-    diagnostics
-  };
 }
-function cwdRelative(filePath) {
-  const relative = path10.relative(process.cwd(), path10.resolve(filePath)).replace(/\\/g, "/");
-  if (relative === "" || relative.startsWith("../") || path10.isAbsolute(relative)) {
-    return path10.basename(filePath);
+async function isWritable(p) {
+  try {
+    await access(p, constants$1.W_OK);
+    return true;
+  } catch {
+    return false;
   }
-  return relative;
 }
-async function readReporterManifest(filePath) {
-  const absolute = path10.resolve(filePath);
-  const raw = await readFile(absolute, "utf-8");
-  const document = readManifestDocument(JSON.parse(raw));
-  const manifest = document.manifest;
-  const results = manifest.results.map((result) => ({
-    testId: safeText(result.testId),
-    name: safeText(result.name),
-    ...result.file === void 0 ? {} : { file: safeText(path10.basename(result.file)) },
-    status: result.status,
-    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path10.basename(result.tracePath)) },
-    artifacts: result.artifacts,
-    diagnostics: result.diagnostics
-  }));
-  return {
-    ...document.packageName === void 0 ? {} : { packageName: document.packageName },
-    manifestFile: cwdRelative(absolute),
-    framework: manifest.framework,
-    generatedAt: manifest.generatedAt,
-    results,
-    artifacts: manifest.artifacts,
-    diagnostics: document.diagnostics
-  };
+async function listJsonl(dir) {
+  try {
+    const entries = await readdir(dir);
+    return entries.filter((f) => f.endsWith(".jsonl"));
+  } catch {
+    return [];
+  }
 }
-function summarize3(manifests) {
-  const summary = {
-    manifests: manifests.length,
-    tests: 0,
-    failed: 0,
-    passed: 0,
-    skipped: 0,
-    todo: 0,
-    artifacts: 0,
-    diagnostics: 0
-  };
-  for (const manifest of manifests) {
-    summary.artifacts += manifest.artifacts.length;
-    summary.diagnostics += manifest.diagnostics;
-    for (const result of manifest.results) {
-      summary.tests += 1;
-      if (result.status === "failed") summary.failed += 1;
-      else if (result.status === "passed") summary.passed += 1;
-      else if (result.status === "skipped") summary.skipped += 1;
-      else summary.todo += 1;
-      summary.artifacts += result.artifacts.length;
-      summary.diagnostics += result.diagnostics;
-    }
+async function countFiles(dir) {
+  try {
+    const entries = await readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => e.isFile()).length;
+  } catch {
+    return 0;
+  }
+}
+async function readWorkspaceManifestFile(location) {
+  let raw;
+  try {
+    raw = await readFile(location.manifestPath, "utf-8");
+  } catch {
+    return { exists: false, ok: false, errors: ["workspace.json not found"], warnings: [] };
   }
+  const parsed = parseWorkspaceManifest(raw);
   return {
-    status: summary.failed > 0 ? "failed" : summary.diagnostics > 0 ? "warning" : "ok",
-    manifests,
-    summary,
-    note: NOTE2
+    exists: true,
+    ok: parsed.ok,
+    ...parsed.manifest ? { manifest: parsed.manifest } : {},
+    errors: parsed.errors,
+    warnings: parsed.warnings
   };
 }
-function markdownCell(value) {
-  return safeText(String(value ?? "unknown")).replaceAll("|", "\\|").replace(/\r?\n/g, " ");
-}
-function renderMarkdown2(result) {
-  const lines = [
-    "# AgentInspect CI Summary",
-    "",
-    NOTE2,
-    "",
-    "| Field | Value |",
-    "| --- | --- |",
-    `| Status | ${result.status} |`,
-    `| Manifests | ${result.summary.manifests} |`,
-    `| Tests | ${result.summary.tests} |`,
-    `| Failed | ${result.summary.failed} |`,
-    `| Passed | ${result.summary.passed} |`,
-    `| Skipped | ${result.summary.skipped} |`,
-    `| Todo | ${result.summary.todo} |`,
-    `| Artifacts | ${result.summary.artifacts} |`,
-    `| Diagnostics | ${result.summary.diagnostics} |`,
-    "",
-    "## Tests",
-    "",
-    "| Framework | Status | Test | File | Trace | Artifacts |",
-    "| --- | --- | --- | --- | --- | --- |"
-  ];
-  const rows = result.manifests.flatMap(
-    (manifest) => manifest.results.map((test) => ({
-      framework: manifest.framework,
-      test
-    }))
-  );
-  if (rows.length === 0) {
-    lines.push("| unknown | unknown | No tests found | unknown | unknown | 0 |");
+async function createWorkspace(options = {}) {
+  const location = resolveWorkspaceLocation(options.cwd);
+  const dryRun = options.dryRun === true;
+  const existing = await readWorkspaceManifestFile(location);
+  const topLevelTraces = await listJsonl(location.workspaceDir);
+  const detectedExistingTraces = topLevelTraces.length > 0;
+  let manifest;
+  let created;
+  let adopted;
+  if (existing.exists && existing.ok && existing.manifest) {
+    manifest = existing.manifest;
+    created = false;
+    adopted = true;
   } else {
-    for (const row of rows) {
-      lines.push(
-        `| ${markdownCell(row.framework)} | ${markdownCell(row.test.status)} | ${markdownCell(row.test.name)} | ${markdownCell(row.test.file)} | ${markdownCell(row.test.tracePath)} | ${row.test.artifacts.length} |`
-      );
-    }
+    const project = options.project?.trim() || path13.basename(location.projectRoot) || "workspace";
+    const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
+    manifest = createDefaultWorkspaceManifest({
+      project,
+      traceDirs,
+      ...options.redactionProfile ? { redactionProfile: options.redactionProfile } : {}
+    });
+    created = true;
+    adopted = detectedExistingTraces || existing.exists && !existing.ok;
   }
-  lines.push("", "## Manifests", "", "| Framework | File | Generated | Artifacts |", "| --- | --- | --- | --- |");
-  for (const manifest of result.manifests) {
-    lines.push(
-      `| ${markdownCell(manifest.framework)} | ${markdownCell(manifest.manifestFile)} | ${markdownCell(manifest.generatedAt)} | ${manifest.artifacts.length} |`
-    );
+  const relDirs = uniqueDirs([
+    ...manifest.traceDirs.filter((d) => d !== "."),
+    manifest.reportsDir,
+    manifest.artifactsDir,
+    manifest.bundlesDir,
+    manifest.notesDir,
+    INDEX_DIR_NAME
+  ]);
+  const createdDirs = [];
+  for (const rel of relDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    if (await pathExists(abs)) continue;
+    createdDirs.push(rel);
+    if (!dryRun) await mkdir(abs, { recursive: true });
   }
-  lines.push("", "## Artifacts", "", "| Framework | Kind | Path | Format | Profile |", "| --- | --- | --- | --- | --- |");
-  const artifacts = result.manifests.flatMap(
-    (manifest) => manifest.artifacts.map((artifact) => ({ framework: manifest.framework, artifact }))
-  );
-  if (artifacts.length === 0) {
-    lines.push("| unknown | unknown | No artifacts found | unknown | unknown |");
-  } else {
-    for (const row of artifacts) {
-      lines.push(
-        `| ${markdownCell(row.framework)} | ${markdownCell(row.artifact.kind)} | ${markdownCell(row.artifact.path)} | ${markdownCell(row.artifact.format)} | ${markdownCell(row.artifact.redactionProfile)} |`
-      );
-    }
+  if (!dryRun && created) {
+    await mkdir(location.workspaceDir, { recursive: true });
+    await writeFile(location.manifestPath, serializeWorkspaceManifest(manifest), "utf-8");
   }
-  lines.push("");
-  return `${lines.join("\n")}
-`;
+  return {
+    location,
+    manifest,
+    created,
+    adopted,
+    createdDirs,
+    detectedExistingTraces,
+    dryRun
+  };
 }
-function safeText(value) {
-  const compact = value.replace(/\s+/g, " ").trim();
-  const redacted = compact.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(
-    /\b(?:api[_-]?key|authorization|token|secret|password)\s*[:=]\s*[^,\s]+/gi,
-    "$1=[REDACTED]"
-  );
-  if (redacted.length <= MAX_TEXT) return redacted;
-  return `${redacted.slice(0, MAX_TEXT - 12)}...[truncated]`;
+function uniqueDirs(dirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const d of dirs) {
+    const t = d.trim();
+    if (t === "" || t === "." || seen.has(t)) continue;
+    seen.add(t);
+    out.push(t);
+  }
+  return out;
 }
-async function ciSummaryCommand(manifestPaths, options = {}) {
-  if (manifestPaths.length === 0) {
-    console.error("At least one reporter manifest path is required.");
-    process.exitCode = 1;
-    return;
+async function getWorkspaceStatus(location, manifest) {
+  let traceFiles = 0;
+  for (const rel of manifest.traceDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    traceFiles += (await listJsonl(abs)).length;
   }
-  let result;
-  try {
-    const manifests = [];
-    for (const manifestPath of manifestPaths) {
-      manifests.push(await readReporterManifest(manifestPath));
+  const reports = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.reportsDir)
+  );
+  const artifacts = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.artifactsDir)
+  );
+  const bundles = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.bundlesDir)
+  );
+  const notes = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.notesDir)
+  );
+  const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
+  return {
+    project: manifest.project,
+    traceFiles,
+    reports,
+    artifacts,
+    bundles,
+    notes,
+    index: {
+      enabled: manifest.index.enabled,
+      type: manifest.index.type,
+      exists: await pathExists(indexPath2)
     }
-    manifests.sort((a, b) => a.manifestFile.localeCompare(b.manifestFile));
-    result = summarize3(manifests);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error(`[AgentInspect] ci-summary failed: ${message}`);
-    process.exitCode = 1;
-    return;
-  }
-  const markdown = renderMarkdown2(result);
-  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path10.resolve(options.output.trim()) : void 0;
-  if (outputPath !== void 0) {
-    await mkdir(path10.dirname(outputPath), { recursive: true });
-    await writeFile(outputPath, markdown, "utf-8");
-  }
-  const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
-  if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    const summaryPath = path10.resolve(summaryTarget);
-    await mkdir(path10.dirname(summaryPath), { recursive: true });
-    await appendFile(summaryPath, `
-${markdown}`, "utf-8");
+  };
+}
+async function doctorWorkspace(location) {
+  const checks2 = [];
+  const manifestResult = await readWorkspaceManifestFile(location);
+  if (!manifestResult.exists) {
+    checks2.push({
+      id: "manifest",
+      status: "fail",
+      message: "workspace.json not found (run `agent-inspect workspace init`)"
+    });
+    return { ok: false, checks: checks2 };
   }
-  if (options.json === true) {
-    console.log(writeJson4(result).trimEnd());
-  } else if (outputPath !== void 0) {
-    console.log(`Wrote AgentInspect CI summary to ${outputPath}`);
-    console.log(`Status: ${result.status}`);
-  } else {
-    console.log(markdown.trimEnd());
+  if (!manifestResult.ok || !manifestResult.manifest) {
+    checks2.push({
+      id: "manifest",
+      status: "fail",
+      message: `workspace.json is invalid: ${manifestResult.errors.join("; ")}`
+    });
+    return { ok: false, checks: checks2 };
   }
-}
-var CONFIG_FILE = "agent-inspect.config.ts";
-var TRACE_DIR = ".agent-inspect";
-var GITKEEP = ".agent-inspect/.gitkeep";
-function normalizeFramework(value) {
-  const raw = (value ?? "custom").trim();
-  if (raw === "ai-sdk" || raw === "openai-agents" || raw === "langchain" || raw === "custom") {
-    return raw;
+  const manifest = manifestResult.manifest;
+  checks2.push({ id: "manifest", status: "pass", message: "workspace.json is valid" });
+  for (const warning of manifestResult.warnings) {
+    checks2.push({ id: "manifest-warning", status: "warn", message: warning });
   }
-  throw new Error(
-    "Unsupported --framework value. Use ai-sdk, openai-agents, langchain, or custom."
-  );
-}
-function configTemplate(framework) {
-  const base = `/**
- * AgentInspect local config (metadata-only capture by default).
- * See https://github.com/rajudandigam/agent-inspect/blob/main/docs/SAFE-TRACE-SHARING.md
- */
-export const agentInspectConfig = {
-  traceDir: ".agent-inspect",
-  enabled: process.env.AGENT_INSPECT !== "0",
-  redactionProfile: "local" as const,
-};
-`;
-  if (framework === "custom") return base;
-  return `${base}
-export const framework = "${framework}" as const;
-`;
+  const dirFields = [
+    ...manifest.traceDirs.filter((d) => d !== ".").map((d, i) => [`traceDir[${i}]`, d]),
+    ["reportsDir", manifest.reportsDir],
+    ["artifactsDir", manifest.artifactsDir],
+    ["bundlesDir", manifest.bundlesDir],
+    ["notesDir", manifest.notesDir]
+  ];
+  for (const [id, rel] of dirFields) {
+    let abs;
+    try {
+      abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    } catch (error) {
+      checks2.push({
+        id,
+        status: "fail",
+        message: error instanceof Error ? error.message : String(error)
+      });
+      continue;
+    }
+    if (!await pathExists(abs)) {
+      checks2.push({ id, status: "warn", message: `${rel}/ does not exist yet` });
+    } else if (!await isWritable(abs)) {
+      checks2.push({ id, status: "fail", message: `${rel}/ is not writable` });
+    } else {
+      checks2.push({ id, status: "pass", message: `${rel}/ is present and writable` });
+    }
+  }
+  let newestTraceMtime = 0;
+  for (const rel of manifest.traceDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    for (const file of await listJsonl(abs)) {
+      try {
+        const s = await stat(path13.join(abs, file));
+        newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
+      } catch {
+        checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
+      }
+    }
+  }
+  if (manifest.index.enabled) {
+    const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
+    if (!await pathExists(indexPath2)) {
+      checks2.push({ id: "index", status: "warn", message: "index enabled but not built" });
+    } else {
+      try {
+        const s = await stat(indexPath2);
+        if (newestTraceMtime > s.mtimeMs) {
+          checks2.push({ id: "index", status: "warn", message: "index is stale (traces are newer)" });
+        } else {
+          checks2.push({ id: "index", status: "pass", message: "index is present" });
+        }
+      } catch {
+        checks2.push({ id: "index", status: "warn", message: "cannot stat index" });
+      }
+    }
+  }
+  const ok = !checks2.some((c) => c.status === "fail");
+  return { ok, checks: checks2 };
 }
-function demoTemplate(framework) {
-  switch (framework) {
-    case "ai-sdk":
-      return `/**
- * AI SDK starter \u2014 metadata-only telemetry (no real model calls in this demo).
- * Install: npm install agent-inspect @agent-inspect/ai-sdk ai
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("ai-sdk-demo", async () => {
-    await step.tool("mock-generate", async () => ({ text: "ok" }));
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
+async function cleanWorkspace(location, manifest, options = {}) {
+  const dryRun = options.confirm !== true;
+  const targets = uniqueDirs([
+    manifest.reportsDir,
+    manifest.artifactsDir,
+    manifest.bundlesDir,
+    manifest.index.path ?? INDEX_DIR_NAME
+  ]);
+  const removed = [];
+  for (const rel of targets) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    let entries;
+    try {
+      entries = await readdir(abs);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const relPath = `${rel}/${entry}`;
+      removed.push(relPath);
+      if (!dryRun) {
+        await rm(path13.join(abs, entry), { recursive: true, force: true });
+      }
+    }
+  }
+  return { dryRun, removed };
 }
 
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
-`;
-    case "openai-agents":
-      return `/**
- * OpenAI Agents starter \u2014 use @agent-inspect/openai-agents for local-only processors.
- * This demo uses manual steps (no API keys).
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("openai-agents-demo", async () => {
-    await step.tool("mock-agent-run", async () => "ok");
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
+// packages/cli/src/bundle.ts
+var BUNDLE_NOTE = "Generated locally by AgentInspect. Bundles are derived copies for review \u2014 not compliance or security certification.";
+function stable6(value) {
+  if (Array.isArray(value)) return value.map(stable6);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable6(record[key])])
+  );
 }
-
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
+function writeJson4(value) {
+  return `${JSON.stringify(stable6(value), null, 2)}
 `;
-    case "langchain":
-      return `/**
- * LangChain starter \u2014 wire @agent-inspect/langchain callbacks in your app.
- * This demo uses manual steps (no API keys).
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("langchain-demo", async () => {
-    await step.tool("mock-chain", async () => "ok");
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
 }
-
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
-`;
-    default:
-      return `import { observe } from "agent-inspect";
-
-class DemoAgent {
-  async run(input: { question: string }) {
-    return { answer: \`Echo: \${input.question}\` };
+function parseBundleProfile(value) {
+  if (value === void 0 || value === "local" || value === "share" || value === "strict") {
+    return value ?? "share";
   }
+  throw new Error(`Unsupported --profile "${value}". Use local, share, or strict.`);
 }
-
-const agent = observe(new DemoAgent(), {
-  traceDir: ".agent-inspect",
-  silent: true,
-});
-
-await agent.run({ question: "hello" });
-console.log("Trace written to .agent-inspect/");
-`;
-  }
+function toReportProfile(profile) {
+  return profile;
 }
-function githubWorkflowTemplate() {
-  return `name: AgentInspect artifacts
-
-on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-
-jobs:
-  trace-artifacts:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-      - run: npm ci
-      - run: npm test
-      - name: Upload AgentInspect traces
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: agent-inspect-traces
-          path: .agent-inspect/**/*.jsonl
-          if-no-files-found: ignore
-`;
+function escapeHtml3(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
-async function planInit(options = {}) {
-  const framework = normalizeFramework(options.framework);
-  const cwd = path10.resolve(options.cwd ?? process.cwd());
-  const demoPath = framework === "custom" ? path10.join("examples", "agent-inspect-demo.mjs") : path10.join("examples", `agent-inspect-${framework}-demo.mjs`);
-  const candidates = [
-    { rel: CONFIG_FILE, content: configTemplate(framework) },
-    { rel: GITKEEP, content: "" },
-    { rel: demoPath, content: demoTemplate(framework) }
-  ];
-  if (options.ci === "github") {
-    candidates.push({
-      rel: ".github/workflows/agent-inspect-artifacts.yml",
-      content: githubWorkflowTemplate()
-    });
+function safetyStatusFromAssess(status) {
+  if (status === "SAFE" || status === "SAFE WITH WARNINGS" || status === "UNSAFE" || status === "UNKNOWN") {
+    return status;
   }
-  const files = [];
-  for (const candidate of candidates) {
-    const abs = path10.join(cwd, candidate.rel);
+  return "UNKNOWN";
+}
+async function resolveOutputDir(options, runIds, cwd) {
+  if (options.out !== void 0 && options.out.trim() !== "") {
+    const normalized = normalizeBundleOutputPath(options.out);
     try {
-      await access(abs);
-      files.push({
-        path: candidate.rel,
-        action: "skip",
-        reason: "file already exists"
-      });
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      files.push({ path: candidate.rel, action: "create" });
+      const location = resolveWorkspaceLocation(cwd);
+      const manifest = await readWorkspaceManifestFile(location);
+      if (manifest.ok && manifest.manifest) {
+        const rel = path13.relative(location.workspaceDir, normalized);
+        if (!rel.startsWith("..") && !path13.isAbsolute(rel)) {
+          return resolveInsideWorkspace(location.workspaceDir, rel);
+        }
+      }
+    } catch {
     }
+    return normalized;
   }
-  return { framework, ...options.ci ? { ci: options.ci } : {}, files };
-}
-async function writePlannedFiles(plan, cwd, options) {
-  const written = [];
-  for (const entry of plan.files) {
-    if (entry.action === "skip") {
-      continue;
-    }
-    const abs = path10.join(cwd, entry.path);
-    if (options.dryRun) {
-      written.push(entry.path);
-      continue;
+  try {
+    const location = resolveWorkspaceLocation(cwd);
+    const manifest = await readWorkspaceManifestFile(location);
+    if (manifest.ok && manifest.manifest) {
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
+      return resolveInsideWorkspace(
+        location.workspaceDir,
+        path13.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
+      );
     }
-    await mkdir(path10.dirname(abs), { recursive: true });
-    const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
-    await writeFile(abs, content, "utf-8");
-    written.push(entry.path);
+  } catch {
   }
-  return written;
+  return defaultBundleOutputPath(runIds);
 }
-async function initCommand(options = {}) {
-  const cwd = path10.resolve(options.cwd ?? process.cwd());
-  try {
-    const plan = await planInit({ ...options, cwd });
-    const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
-    const skipped = plan.files.filter((file) => file.action === "skip");
+async function writeBundleFile(outputDir, relativePath, content, files) {
+  const outPath = path13.join(outputDir, relativePath);
+  await mkdir(path13.dirname(outPath), { recursive: true });
+  await writeFile(outPath, content, "utf-8");
+  files.push(relativePath);
+}
+function renderBundleIndexHtml(parts) {
+  const links = parts.runIds.map(
+    (runId) => `<li><a href="assets/runs/${escapeHtml3(runId)}.html">${escapeHtml3(runId)}</a></li>`
+  ).join("");
+  const sections = parts.runIds.map((runId) => {
+    const html = parts.reports.get(runId) ?? "";
+    return `<section id="run-${escapeHtml3(runId)}"><h2>${escapeHtml3(runId)}</h2>${html}</section>`;
+  }).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>AgentInspect Bundle</title>
+<style>
+body{font-family:system-ui,sans-serif;line-height:1.5;margin:1.5rem;max-width:960px;color:#111}
+a{color:#0366d6}
+section{border-top:1px solid #ddd;margin-top:1.5rem;padding-top:1rem}
+</style>
+</head>
+<body>
+<h1>AgentInspect trace bundle</h1>
+<p>${escapeHtml3(BUNDLE_NOTE)}</p>
+<h2>Runs</h2>
+<ul>${links}</ul>
+${sections}
+</body>
+</html>
+`;
+}
+function extractHtmlBody(content) {
+  const match = content.match(/<body[^>]*>([\s\S]*)<\/body>/i);
+  return match?.[1]?.trim() ?? content;
+}
+async function bundleCommand(runIdArg, options = {}) {
+  const profile = parseBundleProfile(options.profile);
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const cwd = process.cwd();
+  let resolveResult;
+  try {
+    const { runs } = await loadSessionRuns(traceDir);
+    const staleThresholdMs = options.staleAfter && options.staleAfter.trim() !== "" ? parseDuration(options.staleAfter.trim()) : void 0;
+    const index = buildSessionIndex(runs, {
+      correlateByGroupId: options.correlateGroup === true,
+      staleThresholdMs
+    });
+    resolveResult = resolveBundleRunIds(index, runs, {
+      ...runIdArg !== void 0 && runIdArg.trim() !== "" ? { runId: runIdArg.trim() } : {},
+      ...options.session ? { sessionId: options.session } : {},
+      ...options.since ? { since: options.since } : {}
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
     if (options.json) {
-      const payload = {
-        ok: true,
-        version,
-        framework: plan.framework,
-        ci: plan.ci ?? null,
-        dryRun: options.dryRun === true,
-        planned: plan.files,
-        wouldWrite: options.dryRun ? toWrite : void 0
-      };
-      console.log(JSON.stringify(payload, null, 2));
-      if (options.dryRun) return;
+      console.log(writeJson4({ ok: false, error: message }).trimEnd());
+    } else {
+      console.error(`[AgentInspect] bundle failed: ${message}`);
     }
-    const written = await writePlannedFiles(plan, cwd, options);
-    if (!options.json) {
-      console.log("AgentInspect init");
-      console.log(`Framework: ${plan.framework}`);
-      console.log(`Trace directory: ${TRACE_DIR}/`);
-      if (options.dryRun) {
-        console.log("Dry run \u2014 would create:");
-        for (const file of toWrite) console.log(`- ${file}`);
-        for (const file of skipped) {
-          console.log(`- ${file.path} (skip: ${file.reason ?? "exists"})`);
-        }
-        return;
+    process.exitCode = 1;
+    return;
+  }
+  const outputDir = await resolveOutputDir(options, resolveResult.runIds, cwd);
+  const files = [];
+  const checkRuns = [];
+  const redactionRuns = [];
+  const htmlByRun = /* @__PURE__ */ new Map();
+  const redactedJsonlByRun = /* @__PURE__ */ new Map();
+  let combinedJsonl = "";
+  for (const runId of resolveResult.runIds) {
+    const tracePath = getTraceFilePath(runId, traceDir);
+    let rawContent;
+    let sourceMtimeMs;
+    try {
+      rawContent = await readFile(tracePath, "utf-8");
+      sourceMtimeMs = (await stat(tracePath)).mtimeMs;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message, runId }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
       }
-      console.log("Created:");
-      for (const file of written) console.log(`- ${file}`);
-      for (const file of skipped) {
-        console.log(`- ${file.path} (skipped: ${file.reason ?? "exists"})`);
+      process.exitCode = 1;
+      return;
+    }
+    let read;
+    try {
+      read = await openTrace(
+        { type: "file", path: tracePath },
+        { format: "agent-inspect-jsonl" }
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message, runId }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
       }
-      console.log("\nNext: run your demo, then `npx agent-inspect list --dir .agent-inspect`");
-      console.log("No dependencies were installed. Add packages manually when ready.");
+      process.exitCode = 1;
+      return;
     }
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
+    const safety = assessOpenedTrace(read, { run: runId });
+    const status = safetyStatusFromAssess(safety.status);
+    checkRuns.push({
+      runId,
+      status,
+      errors: safety.summary.errors,
+      warnings: safety.summary.warnings,
+      findings: safety.summary.findings
+    });
+    const redacted = redactTraceContent(rawContent, toReportProfile(profile));
+    redactedJsonlByRun.set(runId, redacted.content);
+    combinedJsonl += redacted.content.endsWith("\n") ? redacted.content : `${redacted.content}
+`;
+    const detectors = [
+      ...new Set(redacted.findings.map((finding) => finding.detector))
+    ].sort((a, b) => a.localeCompare(b));
+    redactionRuns.push({
+      runId,
+      findings: redacted.findings.length,
+      detectors
+    });
+    const selected = read.runs.find((run) => run.runId === runId);
+    const runReport = exportRunTree(selected ?? read.runs[0], {
+      format: "html",
+      redacted: true,
+      redactionProfile: toReportProfile(profile)
+    });
+    htmlByRun.set(runId, extractHtmlBody(runReport.content));
+    const afterMtime = (await stat(tracePath)).mtimeMs;
+    if (afterMtime !== sourceMtimeMs) {
+      const message = `Source trace "${runId}" was modified during bundle creation.`;
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const checks2 = {
+    aggregateStatus: aggregateBundleSafeStatus(checkRuns.map((run) => run.status)),
+    runs: checkRuns
+  };
+  if (bundleFailsOnSafety(checks2.aggregateStatus, options.allowUnsafe === true)) {
     if (options.json) {
-      console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+      console.log(
+        writeJson4({
+          ok: false,
+          error: `Bundle safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`,
+          checks: checks2
+        }).trimEnd()
+      );
     } else {
-      console.error(`[AgentInspect] init failed: ${msg}`);
+      console.error(
+        `[AgentInspect] bundle refused: safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`
+      );
     }
     process.exitCode = 1;
+    return;
   }
-}
-var OPTIONAL_PACKAGES = {
-  custom: [],
-  "ai-sdk": ["@agent-inspect/ai-sdk"],
-  "openai-agents": ["@agent-inspect/openai-agents"],
-  langchain: ["@agent-inspect/langchain"]
-};
-function nodeVersionCheck() {
-  const major = Number(process2.versions.node.split(".")[0]);
-  if (Number.isNaN(major) || major < 20) {
-    return {
-      id: "node-version",
-      status: "fail",
-      message: `Node ${process2.versions.node} is below the supported minimum (20).`,
-      remediation: "Upgrade to Node 20 LTS or newer.",
-      evidence: process2.versions.node
-    };
-  }
-  return {
-    id: "node-version",
-    status: "pass",
-    message: `Node ${process2.versions.node} meets the minimum (>=20).`,
-    evidence: process2.versions.node
+  const redactionReport = {
+    profile,
+    totalFindings: redactionRuns.reduce((sum, run) => sum + run.findings, 0),
+    runs: redactionRuns
   };
-}
-function envCheck(name, optional = true) {
-  const value = process2.env[name];
-  if (value === void 0 || value.trim() === "") {
-    return {
-      id: `env-${name.toLowerCase()}`,
-      status: optional ? "skipped" : "warn",
-      message: `${name} is not set.`,
-      remediation: optional ? void 0 : `Set ${name}=1 to enable tracing.`
-    };
+  await mkdir(outputDir, { recursive: true });
+  for (const runId of resolveResult.runIds) {
+    const jsonl = redactedJsonlByRun.get(runId) ?? "";
+    await writeBundleFile(outputDir, `assets/runs/${runId}.jsonl`, jsonl, files);
+    const html = htmlByRun.get(runId) ?? "";
+    await writeBundleFile(
+      outputDir,
+      `assets/runs/${runId}.html`,
+      runReportWrap(html, runId),
+      files
+    );
   }
-  return {
-    id: `env-${name.toLowerCase()}`,
-    status: "pass",
-    message: `${name} is set.`,
-    evidence: value
-  };
-}
-async function traceDirWritable(traceDir) {
-  const resolved = path10.resolve(traceDir);
-  try {
-    await mkdir(resolved, { recursive: true });
-    await access(resolved, constants.W_OK);
-    return {
-      id: "trace-dir-writable",
-      status: "pass",
-      message: `Trace directory is writable: ${resolved}`,
-      evidence: resolved
-    };
-  } catch (error) {
-    return {
-      id: "trace-dir-writable",
-      status: "fail",
-      message: `Trace directory is not writable: ${resolved}`,
-      remediation: "Create the directory or set AGENT_INSPECT_TRACE_DIR to a writable path.",
-      evidence: error instanceof Error ? error.message : String(error)
-    };
+  const primaryRunId = resolveResult.runIds[0];
+  const traceHtml = resolveResult.runIds.length === 1 ? runReportWrap(htmlByRun.get(primaryRunId) ?? "", primaryRunId) : renderBundleIndexHtml({ runIds: resolveResult.runIds, reports: htmlByRun });
+  await writeBundleFile(outputDir, "trace.jsonl", combinedJsonl, files);
+  await writeBundleFile(outputDir, "trace.html", traceHtml, files);
+  await writeBundleFile(
+    outputDir,
+    "check-results.json",
+    writeJson4(checks2),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "eval-results.json",
+    writeJson4(buildPlaceholderArtifact()),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "redaction-report.json",
+    writeJson4(redactionReport),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "performance-summary.json",
+    writeJson4(buildPlaceholderArtifact()),
+    files
+  );
+  const metadata = buildBundleMetadata({
+    agentInspectVersion: version,
+    profile,
+    resolve: resolveResult,
+    checks: checks2,
+    files: [...files]
+  });
+  await writeBundleFile(outputDir, "metadata.json", writeJson4(metadata), files);
+  await writeBundleFile(
+    outputDir,
+    "summary.md",
+    buildBundleSummaryMarkdown({ metadata, checks: checks2, redaction: redactionReport }),
+    files
+  );
+  metadata.files = [...files].sort((a, b) => a.localeCompare(b));
+  await writeFile(path13.join(outputDir, "metadata.json"), writeJson4(metadata), "utf-8");
+  if (options.json) {
+    console.log(
+      writeJson4({
+        ok: true,
+        outputDir,
+        metadata,
+        checks: checks2,
+        redaction: redactionReport
+      }).trimEnd()
+    );
+    return;
   }
+  console.log(`Bundle written to ${outputDir}`);
+  console.log(`Safe status: ${metadata.safeStatus}`);
+  console.log(`Runs: ${resolveResult.runIds.join(", ")}`);
+  console.log(`Files: ${metadata.files.length}`);
 }
-function resolvePackage(cwd, name) {
-  const require2 = createRequire(path10.join(cwd, "package.json"));
-  try {
-    const pkgPath = require2.resolve(`${name}/package.json`);
-    const pkg = require2(pkgPath);
-    return { ok: true, version: pkg.version };
-  } catch {
-    return { ok: false };
-  }
+function runReportWrap(body, runId) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>AgentInspect \u2014 ${escapeHtml3(runId)}</title>
+<style>body{font-family:system-ui,sans-serif;line-height:1.5;margin:1.5rem;max-width:960px;color:#111}</style>
+</head>
+<body>
+${body}
+</body>
+</html>
+`;
 }
-function importSmoke(cwd) {
-  const results = [];
-  const require2 = createRequire(path10.join(cwd, "package.json"));
-  try {
-    require2.resolve("agent-inspect");
-    results.push({
-      id: "import-agent-inspect",
-      status: "pass",
-      message: "agent-inspect resolves from the current project."
-    });
-  } catch {
-    results.push({
-      id: "import-agent-inspect",
-      status: "warn",
-      message: "agent-inspect is not installed in the current project.",
-      remediation: "Run npm install agent-inspect (or pnpm add agent-inspect)."
+function validateReporterArtifactPath(options) {
+  const outputDir = path13.resolve(options.outputDir);
+  const diagnostics = [];
+  const rawPath = options.relativePath;
+  if (rawPath.length === 0) {
+    diagnostics.push({
+      code: "artifact_path_empty",
+      severity: "error",
+      message: "Reporter artifact path must not be empty."
     });
+    return { ok: false, outputDir, diagnostics };
   }
-  try {
-    require2.resolve("agent-inspect/package.json");
-    results.push({
-      id: "import-agent-inspect-cjs",
-      status: "pass",
-      message: "CJS resolution for agent-inspect succeeded."
+  if (rawPath.includes("\0")) {
+    diagnostics.push({
+      code: "invalid_artifact_path",
+      severity: "error",
+      message: "Reporter artifact path must not contain null bytes.",
+      target: rawPath
     });
-  } catch {
-    results.push({
-      id: "import-agent-inspect-cjs",
-      status: "skipped",
-      message: "CJS resolution check skipped (package not installed locally)."
+    return { ok: false, outputDir, diagnostics };
+  }
+  if (path13.isAbsolute(rawPath) || path13.win32.isAbsolute(rawPath)) {
+    diagnostics.push({
+      code: "artifact_path_absolute",
+      severity: "error",
+      message: "Reporter artifact path must be relative.",
+      target: rawPath
     });
+    return { ok: false, outputDir, diagnostics };
   }
-  return results;
-}
-function optionalPackageChecks(cwd, framework) {
-  const packages = framework !== void 0 ? OPTIONAL_PACKAGES[framework] : [
-    "@agent-inspect/ai-sdk",
-    "@agent-inspect/openai-agents",
-    "@agent-inspect/langchain",
-    "@agent-inspect/redact",
-    "@agent-inspect/eval"
-  ];
-  return packages.map((name) => {
-    const resolved = resolvePackage(cwd, name);
-    if (!resolved.ok) {
-      return {
-        id: `optional-package-${name}`,
-        status: framework !== void 0 ? "warn" : "skipped",
-        message: `${name} is not installed.`,
-        remediation: framework !== void 0 ? `npm install ${name}` : void 0
-      };
-    }
-    return {
-      id: `optional-package-${name}`,
-      status: "pass",
-      message: `${name} is available.`,
-      evidence: resolved.version
-    };
-  });
-}
-function versionMismatchCheck(cwd) {
-  const root = resolvePackage(cwd, "agent-inspect");
-  if (!root.ok || root.version === void 0) {
-    return {
-      id: "version-alignment",
-      status: "skipped",
-      message: "Skipped version alignment \u2014 agent-inspect not installed locally."
-    };
+  const normalized = path13.posix.normalize(rawPath.replace(/\\/g, "/"));
+  const segments = normalized.split("/");
+  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path must stay under the output directory.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
   }
-  if (root.version !== version) {
-    return {
-      id: "version-alignment",
-      status: "warn",
-      message: `CLI version ${version} differs from local agent-inspect@${root.version}.`,
-      remediation: "Align versions with npm install agent-inspect@latest",
-      evidence: `cli=${version};local=${root.version}`
-    };
+  const absolutePath = path13.resolve(outputDir, normalized);
+  const relFromOutput = path13.relative(outputDir, absolutePath);
+  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path13.isAbsolute(relFromOutput)) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path resolved outside the output directory.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
   }
   return {
-    id: "version-alignment",
-    status: "pass",
-    message: `CLI and local agent-inspect are aligned at ${version}.`
+    ok: true,
+    outputDir,
+    relativePath: normalized,
+    absolutePath,
+    diagnostics
   };
 }
-async function runDoctorChecks(options = {}) {
-  const cwd = path10.resolve(options.cwd ?? process2.cwd());
-  const traceDir = options.traceDir?.trim() || process2.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
-  const checks2 = [
-    nodeVersionCheck(),
-    {
-      id: "cli-version",
-      status: "pass",
-      message: `agent-inspect CLI ${version}`,
-      evidence: version
-    },
-    await traceDirWritable(traceDir),
-    envCheck("AGENT_INSPECT"),
-    envCheck("AGENT_INSPECT_TRACE_DIR"),
-    versionMismatchCheck(cwd)
-  ];
-  if (options.checkImports !== false) {
-    checks2.push(...importSmoke(cwd));
-  }
-  checks2.push(...optionalPackageChecks(cwd, options.framework));
-  return checks2.sort((a, b) => a.id.localeCompare(b.id));
+
+// packages/cli/src/ci-summary.ts
+var NOTE2 = "Generated locally by AgentInspect from reporter artifact manifests. Trace contents are not embedded.";
+var MAX_TEXT = 180;
+var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "jest", "manual"]);
+var STATUSES = /* @__PURE__ */ new Set(["passed", "failed", "skipped", "todo"]);
+var ARTIFACT_KINDS = /* @__PURE__ */ new Set(["trace", "report", "eval", "redaction", "summary"]);
+var ARTIFACT_FORMATS = /* @__PURE__ */ new Set(["json", "jsonl", "md", "html"]);
+var REDACTION_PROFILES2 = /* @__PURE__ */ new Set(["local", "share", "strict"]);
+function stable7(value) {
+  if (Array.isArray(value)) return value.map(stable7);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable7(record[key])])
+  );
 }
-async function doctorCommand(options = {}) {
-  const checks2 = await runDoctorChecks(options);
-  const failed = checks2.filter((check) => check.status === "fail").length;
-  const warned = checks2.filter((check) => check.status === "warn").length;
-  if (options.json) {
-    console.log(
-      JSON.stringify(
-        {
-          ok: failed === 0,
-          version,
-          summary: { pass: checks2.filter((c) => c.status === "pass").length, warn: warned, fail: failed },
-          checks: checks2
-        },
-        null,
-        2
-      )
-    );
-    if (failed > 0) process2.exitCode = 1;
-    return;
-  }
-  console.log("AgentInspect doctor");
-  for (const check of checks2) {
-    const tag = check.status.toUpperCase();
-    console.log(`[${tag}] ${check.id}: ${check.message}`);
-    if (check.remediation) console.log(`  \u2192 ${check.remediation}`);
-  }
-  console.log(`
-Summary: ${failed} failed, ${warned} warnings`);
-  if (failed > 0) process2.exitCode = 1;
+function writeJson5(value) {
+  return `${JSON.stringify(stable7(value), null, 2)}
+`;
 }
-
-// packages/adapter-sdk/src/indexer.ts
-function defineIndexer(indexer) {
-  if (!indexer.id.trim()) throw new Error("indexer id is required");
-  return indexer;
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function indexIsStale(snapshot, traceDir) {
-  const builtMs = Date.parse(snapshot.builtAt);
-  if (Number.isNaN(builtMs)) return true;
-  const td = new TraceDirectory({ dir: traceDir });
-  const files = await td.list();
-  for (const file of files) {
-    const stats = await td.getFileStats(file);
-    if (stats.mtimeMs > builtMs) return true;
+function readString(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`${label} must be a non-empty string.`);
   }
-  return false;
-}
-function createTraceDirectoryIndexer() {
-  return defineIndexer({
-    id: "trace-directory-metadata",
-    async rebuild(traceDir, options = {}) {
-      const warnings = [];
-      const td = new TraceDirectory({ dir: traceDir });
-      const files = await td.list();
-      const maxEntries = options.maxEntries ?? 1e4;
-      if (files.length > maxEntries) {
-        warnings.push(
-          `indexer.truncated: trace directory has ${files.length} files; indexing first ${maxEntries}`
-        );
-      }
-      const slice = files.slice(0, maxEntries);
-      const metas = await loadTraceMetadataList(
-        traceDir,
-        slice,
-        (fileName) => td.getPath(fileName)
-      );
-      const entries = metas.map((meta) => ({
-        runId: meta.runId,
-        path: meta.filePath,
-        name: meta.name,
-        startedAt: meta.startedAt,
-        status: meta.status
-      })).sort((a, b) => a.runId.localeCompare(b.runId));
-      if (entries.length < slice.length) {
-        warnings.push(
-          `indexer.partial: indexed ${entries.length} of ${slice.length} trace files`
-        );
-      }
-      return {
-        traceDir,
-        builtAt: (/* @__PURE__ */ new Date()).toISOString(),
-        entries,
-        warnings
-      };
-    }
-  });
+  return safeText(value);
 }
-
-// packages/cli/src/index-cmd.ts
-var INDEX_FILENAME = ".agent-inspect-index.json";
-function traceIndexPath(traceDir) {
-  return path10.join(traceDir, INDEX_FILENAME);
+function readOptionalString(value) {
+  return typeof value === "string" && value.trim() !== "" ? safeText(value) : void 0;
 }
-function parseMaxEntries(raw) {
-  if (raw === void 0 || raw.trim() === "") return void 0;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new Error("--max-entries must be a positive integer.");
+function readFramework(value) {
+  const framework = readString(value, "manifest.framework");
+  if (!FRAMEWORKS.has(framework)) {
+    throw new Error(`Unsupported reporter framework: ${framework}.`);
   }
-  return parsed;
+  return framework;
 }
-async function readSnapshot(indexPath2) {
-  try {
-    const raw = await readFile(indexPath2, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return void 0;
+function readStatus(value) {
+  const status = readString(value, "result.status");
+  if (!STATUSES.has(status)) {
+    throw new Error(`Unsupported reporter test status: ${status}.`);
   }
+  return status;
 }
-async function indexBuildCommand(options = {}) {
-  try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    await mkdir(traceDir, { recursive: true });
-    const indexer = createTraceDirectoryIndexer();
-    const snapshot = await indexer.rebuild(traceDir, {
-      maxEntries: parseMaxEntries(options.maxEntries)
-    });
-    const indexPath2 = traceIndexPath(traceDir);
-    await writeFile(indexPath2, `${JSON.stringify(snapshot, null, 2)}
-`, "utf8");
-    if (options.json) {
-      console.log(JSON.stringify({ ok: true, indexPath: indexPath2, ...snapshot }, null, 2));
-      return;
-    }
-    console.log(`Built trace index: ${indexPath2}`);
-    console.log(`Entries: ${snapshot.entries.length}`);
-    if (snapshot.warnings.length > 0) {
-      for (const warning of snapshot.warnings) {
-        console.log(`warning: ${warning}`);
-      }
-    }
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index build failed: ${msg}`);
-    process.exitCode = 1;
+function readArtifact(value, index) {
+  if (!isObject(value)) throw new Error(`manifest.artifacts[${index}] must be an object.`);
+  const kind = readString(value.kind, `manifest.artifacts[${index}].kind`);
+  const format = readString(value.format, `manifest.artifacts[${index}].format`);
+  const redactionProfile = readString(
+    value.redactionProfile,
+    `manifest.artifacts[${index}].redactionProfile`
+  );
+  if (!ARTIFACT_KINDS.has(kind)) throw new Error(`Unsupported artifact kind: ${kind}.`);
+  if (!ARTIFACT_FORMATS.has(format)) throw new Error(`Unsupported artifact format: ${format}.`);
+  if (!REDACTION_PROFILES2.has(redactionProfile)) {
+    throw new Error(`Unsupported artifact redaction profile: ${redactionProfile}.`);
   }
-}
-async function indexStatusCommand(options = {}) {
-  try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    const indexPath2 = traceIndexPath(traceDir);
-    const snapshot = await readSnapshot(indexPath2);
-    if (!snapshot) {
-      const payload2 = { ok: true, exists: false, indexPath: indexPath2, traceDir, stale: true };
-      if (options.json) {
-        console.log(JSON.stringify(payload2, null, 2));
-      } else {
-        console.log(`No index at ${indexPath2}`);
-        console.log("Run: agent-inspect index build");
-      }
-      return;
+  const artifactPath = readString(value.path, `manifest.artifacts[${index}].path`);
+  const pathCheck = validateReporterArtifactPath({
+    outputDir: process.cwd(),
+    relativePath: artifactPath
+  });
+  if (!pathCheck.ok || pathCheck.relativePath === void 0) {
+    throw new Error(`Unsafe reporter artifact path: ${artifactPath}.`);
+  }
+  return {
+    kind,
+    path: pathCheck.relativePath,
+    format,
+    redactionProfile
+  };
+}
+function readArtifacts(value, label) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.map((item, index) => readArtifact(item, index));
+}
+function readDiagnosticsCount(value, label) {
+  if (value === void 0) return 0;
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.length;
+}
+function readResult(value, index) {
+  if (!isObject(value)) throw new Error(`manifest.results[${index}] must be an object.`);
+  const file = readOptionalString(value.file);
+  const tracePath = readOptionalString(value.tracePath);
+  return {
+    testId: readString(value.testId, `manifest.results[${index}].testId`),
+    name: readString(value.name, `manifest.results[${index}].name`),
+    ...file === void 0 ? {} : { file },
+    status: readStatus(value.status),
+    ...tracePath === void 0 ? {} : { tracePath },
+    artifacts: readArtifacts(value.artifacts, `manifest.results[${index}].artifacts`),
+    diagnostics: readDiagnosticsCount(
+      value.diagnostics,
+      `manifest.results[${index}].diagnostics`
+    )
+  };
+}
+function readManifestDocument(value) {
+  if (!isObject(value)) throw new Error("Reporter manifest file must contain a JSON object.");
+  const candidate = isObject(value.manifest) ? value.manifest : value;
+  if (!isObject(candidate)) throw new Error("Reporter manifest must be a JSON object.");
+  const schemaVersion = readString(candidate.schemaVersion, "manifest.schemaVersion");
+  if (schemaVersion !== "0.1") {
+    throw new Error(`Unsupported reporter manifest schemaVersion: ${schemaVersion}.`);
+  }
+  if (!Array.isArray(candidate.results)) {
+    throw new Error("manifest.results must be an array.");
+  }
+  const artifacts = readArtifacts(candidate.artifacts, "manifest.artifacts");
+  const results = candidate.results.map((item, index) => readResult(item, index));
+  const diagnostics = readDiagnosticsCount(candidate.diagnostics, "manifest.diagnostics");
+  const manifest = {
+    framework: readFramework(candidate.framework),
+    generatedAt: readString(candidate.generatedAt, "manifest.generatedAt"),
+    results,
+    artifacts
+  };
+  return {
+    packageName: readOptionalString(value.package),
+    manifest,
+    diagnostics
+  };
+}
+function cwdRelative(filePath) {
+  const relative = path13.relative(process.cwd(), path13.resolve(filePath)).replace(/\\/g, "/");
+  if (relative === "" || relative.startsWith("../") || path13.isAbsolute(relative)) {
+    return path13.basename(filePath);
+  }
+  return relative;
+}
+async function readReporterManifest(filePath) {
+  const absolute = path13.resolve(filePath);
+  const raw = await readFile(absolute, "utf-8");
+  const document = readManifestDocument(JSON.parse(raw));
+  const manifest = document.manifest;
+  const results = manifest.results.map((result) => ({
+    testId: safeText(result.testId),
+    name: safeText(result.name),
+    ...result.file === void 0 ? {} : { file: safeText(path13.basename(result.file)) },
+    status: result.status,
+    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path13.basename(result.tracePath)) },
+    artifacts: result.artifacts,
+    diagnostics: result.diagnostics
+  }));
+  return {
+    ...document.packageName === void 0 ? {} : { packageName: document.packageName },
+    manifestFile: cwdRelative(absolute),
+    framework: manifest.framework,
+    generatedAt: manifest.generatedAt,
+    results,
+    artifacts: manifest.artifacts,
+    diagnostics: document.diagnostics
+  };
+}
+function summarize3(manifests) {
+  const summary = {
+    manifests: manifests.length,
+    tests: 0,
+    failed: 0,
+    passed: 0,
+    skipped: 0,
+    todo: 0,
+    artifacts: 0,
+    diagnostics: 0
+  };
+  for (const manifest of manifests) {
+    summary.artifacts += manifest.artifacts.length;
+    summary.diagnostics += manifest.diagnostics;
+    for (const result of manifest.results) {
+      summary.tests += 1;
+      if (result.status === "failed") summary.failed += 1;
+      else if (result.status === "passed") summary.passed += 1;
+      else if (result.status === "skipped") summary.skipped += 1;
+      else summary.todo += 1;
+      summary.artifacts += result.artifacts.length;
+      summary.diagnostics += result.diagnostics;
     }
-    const stale = await indexIsStale(snapshot, traceDir);
-    const payload = {
-      ok: true,
-      exists: true,
-      indexPath: indexPath2,
-      traceDir,
-      stale,
-      builtAt: snapshot.builtAt,
-      entries: snapshot.entries.length,
-      warnings: snapshot.warnings
-    };
-    if (options.json) {
-      console.log(JSON.stringify(payload, null, 2));
-      return;
+  }
+  return {
+    status: summary.failed > 0 ? "failed" : summary.diagnostics > 0 ? "warning" : "ok",
+    manifests,
+    summary,
+    note: NOTE2
+  };
+}
+function markdownCell(value) {
+  return safeText(String(value ?? "unknown")).replaceAll("|", "\\|").replace(/\r?\n/g, " ");
+}
+function renderMarkdown2(result) {
+  const lines = [
+    "# AgentInspect CI Summary",
+    "",
+    NOTE2,
+    "",
+    "| Field | Value |",
+    "| --- | --- |",
+    `| Status | ${result.status} |`,
+    `| Manifests | ${result.summary.manifests} |`,
+    `| Tests | ${result.summary.tests} |`,
+    `| Failed | ${result.summary.failed} |`,
+    `| Passed | ${result.summary.passed} |`,
+    `| Skipped | ${result.summary.skipped} |`,
+    `| Todo | ${result.summary.todo} |`,
+    `| Artifacts | ${result.summary.artifacts} |`,
+    `| Diagnostics | ${result.summary.diagnostics} |`,
+    "",
+    "## Tests",
+    "",
+    "| Framework | Status | Test | File | Trace | Artifacts |",
+    "| --- | --- | --- | --- | --- | --- |"
+  ];
+  const rows = result.manifests.flatMap(
+    (manifest) => manifest.results.map((test) => ({
+      framework: manifest.framework,
+      test
+    }))
+  );
+  if (rows.length === 0) {
+    lines.push("| unknown | unknown | No tests found | unknown | unknown | 0 |");
+  } else {
+    for (const row of rows) {
+      lines.push(
+        `| ${markdownCell(row.framework)} | ${markdownCell(row.test.status)} | ${markdownCell(row.test.name)} | ${markdownCell(row.test.file)} | ${markdownCell(row.test.tracePath)} | ${row.test.artifacts.length} |`
+      );
     }
-    console.log(`Index: ${indexPath2}`);
-    console.log(`Built: ${snapshot.builtAt}`);
-    console.log(`Entries: ${snapshot.entries.length}`);
-    console.log(`Stale: ${stale ? "yes" : "no"}`);
-    if (snapshot.warnings.length > 0) {
-      for (const warning of snapshot.warnings) {
-        console.log(`warning: ${warning}`);
-      }
+  }
+  lines.push("", "## Manifests", "", "| Framework | File | Generated | Artifacts |", "| --- | --- | --- | --- |");
+  for (const manifest of result.manifests) {
+    lines.push(
+      `| ${markdownCell(manifest.framework)} | ${markdownCell(manifest.manifestFile)} | ${markdownCell(manifest.generatedAt)} | ${manifest.artifacts.length} |`
+    );
+  }
+  lines.push("", "## Artifacts", "", "| Framework | Kind | Path | Format | Profile |", "| --- | --- | --- | --- | --- |");
+  const artifacts = result.manifests.flatMap(
+    (manifest) => manifest.artifacts.map((artifact) => ({ framework: manifest.framework, artifact }))
+  );
+  if (artifacts.length === 0) {
+    lines.push("| unknown | unknown | No artifacts found | unknown | unknown |");
+  } else {
+    for (const row of artifacts) {
+      lines.push(
+        `| ${markdownCell(row.framework)} | ${markdownCell(row.artifact.kind)} | ${markdownCell(row.artifact.path)} | ${markdownCell(row.artifact.format)} | ${markdownCell(row.artifact.redactionProfile)} |`
+      );
     }
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index status failed: ${msg}`);
-    process.exitCode = 1;
   }
+  lines.push("");
+  return `${lines.join("\n")}
+`;
 }
-async function indexCleanCommand(options = {}) {
+function safeText(value) {
+  const compact = value.replace(/\s+/g, " ").trim();
+  const redacted = compact.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(
+    /\b(?:api[_-]?key|authorization|token|secret|password)\s*[:=]\s*[^,\s]+/gi,
+    "$1=[REDACTED]"
+  );
+  if (redacted.length <= MAX_TEXT) return redacted;
+  return `${redacted.slice(0, MAX_TEXT - 12)}...[truncated]`;
+}
+async function ciSummaryCommand(manifestPaths, options = {}) {
+  if (manifestPaths.length === 0) {
+    console.error("At least one reporter manifest path is required.");
+    process.exitCode = 1;
+    return;
+  }
+  let result;
   try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    const indexPath2 = traceIndexPath(traceDir);
-    await rm(indexPath2, { force: true });
-    if (options.json) {
-      console.log(JSON.stringify({ ok: true, removed: indexPath2 }, null, 2));
-      return;
+    const manifests = [];
+    for (const manifestPath of manifestPaths) {
+      manifests.push(await readReporterManifest(manifestPath));
+    }
+    manifests.sort((a, b) => a.manifestFile.localeCompare(b.manifestFile));
+    result = summarize3(manifests);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[AgentInspect] ci-summary failed: ${message}`);
+    process.exitCode = 1;
+    return;
+  }
+  const markdown = renderMarkdown2(result);
+  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
+  if (outputPath !== void 0) {
+    await mkdir(path13.dirname(outputPath), { recursive: true });
+    await writeFile(outputPath, markdown, "utf-8");
+  }
+  const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
+  if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
+    const summaryPath = path13.resolve(summaryTarget);
+    await mkdir(path13.dirname(summaryPath), { recursive: true });
+    await appendFile(summaryPath, `
+${markdown}`, "utf-8");
+  }
+  if (options.json === true) {
+    console.log(writeJson5(result).trimEnd());
+  } else if (outputPath !== void 0) {
+    console.log(`Wrote AgentInspect CI summary to ${outputPath}`);
+    console.log(`Status: ${result.status}`);
+  } else {
+    console.log(markdown.trimEnd());
+  }
+}
+var CONFIG_FILE = "agent-inspect.config.ts";
+var TRACE_DIR = ".agent-inspect";
+var GITKEEP = ".agent-inspect/.gitkeep";
+function normalizeFramework(value) {
+  const raw = (value ?? "custom").trim();
+  if (raw === "ai-sdk" || raw === "openai-agents" || raw === "langchain" || raw === "custom") {
+    return raw;
+  }
+  throw new Error(
+    "Unsupported --framework value. Use ai-sdk, openai-agents, langchain, or custom."
+  );
+}
+function configTemplate(framework) {
+  const base = `/**
+ * AgentInspect local config (metadata-only capture by default).
+ * See https://github.com/rajudandigam/agent-inspect/blob/main/docs/SAFE-TRACE-SHARING.md
+ */
+export const agentInspectConfig = {
+  traceDir: ".agent-inspect",
+  enabled: process.env.AGENT_INSPECT !== "0",
+  redactionProfile: "local" as const,
+};
+`;
+  if (framework === "custom") return base;
+  return `${base}
+export const framework = "${framework}" as const;
+`;
+}
+function demoTemplate(framework) {
+  switch (framework) {
+    case "ai-sdk":
+      return `/**
+ * AI SDK starter \u2014 metadata-only telemetry (no real model calls in this demo).
+ * Install: npm install agent-inspect @agent-inspect/ai-sdk ai
+ */
+import { inspectRun, step } from "agent-inspect";
+
+async function main() {
+  await inspectRun("ai-sdk-demo", async () => {
+    await step.tool("mock-generate", async () => ({ text: "ok" }));
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    case "openai-agents":
+      return `/**
+ * OpenAI Agents starter \u2014 use @agent-inspect/openai-agents for local-only processors.
+ * This demo uses manual steps (no API keys).
+ */
+import { inspectRun, step } from "agent-inspect";
+
+async function main() {
+  await inspectRun("openai-agents-demo", async () => {
+    await step.tool("mock-agent-run", async () => "ok");
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    case "langchain":
+      return `/**
+ * LangChain starter \u2014 wire @agent-inspect/langchain callbacks in your app.
+ * This demo uses manual steps (no API keys).
+ */
+import { inspectRun, step } from "agent-inspect";
+
+async function main() {
+  await inspectRun("langchain-demo", async () => {
+    await step.tool("mock-chain", async () => "ok");
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    default:
+      return `import { observe } from "agent-inspect";
+
+class DemoAgent {
+  async run(input: { question: string }) {
+    return { answer: \`Echo: \${input.question}\` };
+  }
+}
+
+const agent = observe(new DemoAgent(), {
+  traceDir: ".agent-inspect",
+  silent: true,
+});
+
+await agent.run({ question: "hello" });
+console.log("Trace written to .agent-inspect/");
+`;
+  }
+}
+function githubWorkflowTemplate() {
+  return `name: AgentInspect artifacts
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+jobs:
+  trace-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm ci
+      - run: npm test
+      - name: Upload AgentInspect traces
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: agent-inspect-traces
+          path: .agent-inspect/**/*.jsonl
+          if-no-files-found: ignore
+`;
+}
+async function planInit(options = {}) {
+  const framework = normalizeFramework(options.framework);
+  const cwd = path13.resolve(options.cwd ?? process.cwd());
+  const demoPath = framework === "custom" ? path13.join("examples", "agent-inspect-demo.mjs") : path13.join("examples", `agent-inspect-${framework}-demo.mjs`);
+  const candidates = [
+    { rel: CONFIG_FILE, content: configTemplate(framework) },
+    { rel: GITKEEP, content: "" },
+    { rel: demoPath, content: demoTemplate(framework) }
+  ];
+  if (options.ci === "github") {
+    candidates.push({
+      rel: ".github/workflows/agent-inspect-artifacts.yml",
+      content: githubWorkflowTemplate()
+    });
+  }
+  const files = [];
+  for (const candidate of candidates) {
+    const abs = path13.join(cwd, candidate.rel);
+    try {
+      await access(abs);
+      files.push({
+        path: candidate.rel,
+        action: "skip",
+        reason: "file already exists"
+      });
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      files.push({ path: candidate.rel, action: "create" });
     }
-    console.log(`Removed index: ${indexPath2}`);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index clean failed: ${msg}`);
-    process.exitCode = 1;
   }
+  return { framework, ...options.ci ? { ci: options.ci } : {}, files };
 }
-var PACKAGE = "@agent-inspect/index-sqlite";
-function isModuleNotFound2(e) {
-  return e !== null && typeof e === "object" && "code" in e && (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND");
-}
-async function loadIndexSqlite() {
-  try {
-    return await import('./src-DUGEOAZ7.mjs');
-  } catch (e) {
-    if (isModuleNotFound2(e)) {
-      console.error(
-        `The optional SQLite index is not installed. Run: npm install ${PACKAGE}`
-      );
-      process.exitCode = 1;
-      return null;
+async function writePlannedFiles(plan, cwd, options) {
+  const written = [];
+  for (const entry of plan.files) {
+    if (entry.action === "skip") {
+      continue;
     }
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] failed to load ${PACKAGE}: ${msg}`);
-    process.exitCode = 1;
-    return null;
-  }
-}
-function parsePositiveInt(raw, flag) {
-  if (raw === void 0 || raw.trim() === "") return void 0;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new Error(`${flag} must be a positive integer.`);
+    const abs = path13.join(cwd, entry.path);
+    if (options.dryRun) {
+      written.push(entry.path);
+      continue;
+    }
+    await mkdir(path13.dirname(abs), { recursive: true });
+    const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
+    await writeFile(abs, content, "utf-8");
+    written.push(entry.path);
   }
-  return parsed;
+  return written;
 }
-async function newestTraceMtimeMs(traceDir) {
-  let newest = 0;
+async function initCommand(options = {}) {
+  const cwd = path13.resolve(options.cwd ?? process.cwd());
   try {
-    const files = await readdir(traceDir);
-    for (const file of files) {
-      if (!file.endsWith(".jsonl")) continue;
-      try {
-        const s = await stat(path10.join(traceDir, file));
-        if (s.mtimeMs > newest) newest = s.mtimeMs;
-      } catch {
+    const plan = await planInit({ ...options, cwd });
+    const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
+    const skipped = plan.files.filter((file) => file.action === "skip");
+    if (options.json) {
+      const payload = {
+        ok: true,
+        version,
+        framework: plan.framework,
+        ci: plan.ci ?? null,
+        dryRun: options.dryRun === true,
+        planned: plan.files,
+        wouldWrite: options.dryRun ? toWrite : void 0
+      };
+      console.log(JSON.stringify(payload, null, 2));
+      if (options.dryRun) return;
+    }
+    const written = await writePlannedFiles(plan, cwd, options);
+    if (!options.json) {
+      console.log("AgentInspect init");
+      console.log(`Framework: ${plan.framework}`);
+      console.log(`Trace directory: ${TRACE_DIR}/`);
+      if (options.dryRun) {
+        console.log("Dry run \u2014 would create:");
+        for (const file of toWrite) console.log(`- ${file}`);
+        for (const file of skipped) {
+          console.log(`- ${file.path} (skip: ${file.reason ?? "exists"})`);
+        }
+        return;
+      }
+      console.log("Created:");
+      for (const file of written) console.log(`- ${file}`);
+      for (const file of skipped) {
+        console.log(`- ${file.path} (skipped: ${file.reason ?? "exists"})`);
       }
+      console.log("\nNext: run your demo, then `npx agent-inspect list --dir .agent-inspect`");
+      console.log("No dependencies were installed. Add packages manually when ready.");
     }
-  } catch {
-  }
-  return newest;
-}
-async function indexSqliteBuildCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const result = await mod.buildIndex({
-    traceDir: options.dir,
-    maxRuns: parsePositiveInt(options.maxRuns, "--max-runs")
-  });
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, ...result }, null, 2));
-    return;
-  }
-  console.log(`Built SQLite index: ${result.dbPath}`);
-  console.log(`Runs: ${result.runs}  Steps: ${result.steps}  Errors: ${result.errors}`);
-  for (const warning of result.warnings) console.log(`warning: ${warning}`);
-}
-async function indexSqliteStatusCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  const status = mod.indexStatus(dbPath);
-  const stale = mod.isIndexStale(dbPath, await newestTraceMtimeMs(traceDir));
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, traceDir, stale, ...status }, null, 2));
-    return;
-  }
-  if (!status.exists) {
-    console.log(`No SQLite index at ${dbPath}`);
-    console.log("Run: agent-inspect index sqlite build");
-    return;
-  }
-  console.log(`Index: ${status.dbPath}`);
-  console.log(`Healthy: ${status.healthy ? "yes" : "no"}`);
-  console.log(`Built: ${status.builtAt ?? "unknown"}`);
-  console.log(`Runs: ${status.runs}  Steps: ${status.steps}`);
-  console.log(`Stale: ${stale ? "yes" : "no"}`);
-}
-async function indexSqliteQueryCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  const status = mod.indexStatus(dbPath);
-  if (!status.exists || !status.healthy) {
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     if (options.json) {
-      console.log(JSON.stringify({ ok: false, reason: "index-missing", dbPath }, null, 2));
+      console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
     } else {
-      console.log("No usable SQLite index. Run: agent-inspect index sqlite build");
+      console.error(`[AgentInspect] init failed: ${msg}`);
     }
     process.exitCode = 1;
-    return;
-  }
-  const rows = mod.queryRuns(dbPath, {
-    status: options.status,
-    sessionId: options.session,
-    name: options.name,
-    kind: options.kind,
-    tool: options.tool,
-    limit: parsePositiveInt(options.limit, "--limit")
-  });
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, count: rows.length, runs: rows }, null, 2));
-    return;
-  }
-  if (rows.length === 0) {
-    console.log("No matching runs.");
-    return;
-  }
-  for (const run of rows) {
-    const parts = [
-      run.runId,
-      run.status ?? "unknown",
-      run.name ?? "",
-      run.durationMs != null ? `${run.durationMs}ms` : ""
-    ].filter((p) => p !== "");
-    console.log(parts.join("  "));
-  }
-}
-async function indexSqliteCleanCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  await mod.cleanIndex(dbPath);
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, removed: dbPath }, null, 2));
-    return;
   }
-  console.log(`Removed SQLite index: ${dbPath}`);
 }
-
-// packages/core/src/workspace/types.ts
-var WORKSPACE_SCHEMA_VERSION = "1.0";
-var WORKSPACE_DIR_NAME = ".agent-inspect";
-var WORKSPACE_MANIFEST_FILENAME = "workspace.json";
-
-// packages/core/src/workspace/manifest.ts
-var DEFAULT_WORKSPACE_LAYOUT = {
-  traceDirs: ["runs"],
-  reportsDir: "reports",
-  artifactsDir: "artifacts",
-  bundlesDir: "bundles",
-  notesDir: "notes"
+var OPTIONAL_PACKAGES = {
+  custom: [],
+  "ai-sdk": ["@agent-inspect/ai-sdk"],
+  "openai-agents": ["@agent-inspect/openai-agents"],
+  langchain: ["@agent-inspect/langchain"]
 };
-var DEFAULT_REDACTION_PROFILE = "share";
-var REDACTION_PROFILES2 = [
-  "local",
-  "share",
-  "strict"
-];
-var INDEX_TYPES = ["none", "sqlite", "custom"];
-var MAX_WORKSPACE_MANIFEST_BYTES = 64 * 1024;
-function createDefaultWorkspaceManifest(options) {
-  const project = typeof options.project === "string" ? options.project.trim() : "";
-  const index = {
-    enabled: options.index?.enabled ?? false,
-    type: options.index?.type ?? "none",
-    ...options.index?.path !== void 0 ? { path: options.index.path } : {}
-  };
-  return {
-    schemaVersion: WORKSPACE_SCHEMA_VERSION,
-    project,
-    createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    traceDirs: options.traceDirs ? [...options.traceDirs] : [...DEFAULT_WORKSPACE_LAYOUT.traceDirs],
-    reportsDir: options.reportsDir ?? DEFAULT_WORKSPACE_LAYOUT.reportsDir,
-    artifactsDir: options.artifactsDir ?? DEFAULT_WORKSPACE_LAYOUT.artifactsDir,
-    bundlesDir: options.bundlesDir ?? DEFAULT_WORKSPACE_LAYOUT.bundlesDir,
-    notesDir: options.notesDir ?? DEFAULT_WORKSPACE_LAYOUT.notesDir,
-    redactionProfile: options.redactionProfile ?? DEFAULT_REDACTION_PROFILE,
-    index
-  };
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isSafeRelativeWorkspacePath(p) {
-  if (typeof p !== "string") return false;
-  const trimmed = p.trim();
-  if (trimmed === "") return false;
-  if (trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
-  if (/^[a-zA-Z]:/.test(trimmed)) return false;
-  const segments = trimmed.split(/[/\\]+/);
-  return !segments.some((seg) => seg === "..");
-}
-function validateDirField(value, field, errors) {
-  if (typeof value !== "string" || value.trim() === "") {
-    errors.push(`${field} must be a non-empty string`);
-    return;
-  }
-  if (!isSafeRelativeWorkspacePath(value)) {
-    errors.push(
-      `${field} must be a relative path inside the workspace (no absolute paths or ".." traversal)`
-    );
+function nodeVersionCheck() {
+  const major = Number(process2.versions.node.split(".")[0]);
+  if (Number.isNaN(major) || major < 20) {
+    return {
+      id: "node-version",
+      status: "fail",
+      message: `Node ${process2.versions.node} is below the supported minimum (20).`,
+      remediation: "Upgrade to Node 20 LTS or newer.",
+      evidence: process2.versions.node
+    };
   }
+  return {
+    id: "node-version",
+    status: "pass",
+    message: `Node ${process2.versions.node} meets the minimum (>=20).`,
+    evidence: process2.versions.node
+  };
 }
-function validateIndex(value, errors) {
-  if (!isPlainObject(value)) {
-    errors.push("index must be an object");
-    return void 0;
-  }
-  if (typeof value.enabled !== "boolean") {
-    errors.push("index.enabled must be a boolean");
-  }
-  if (!INDEX_TYPES.includes(value.type)) {
-    errors.push(`index.type must be one of: ${INDEX_TYPES.join(", ")}`);
-  }
-  if (value.path !== void 0 && !isSafeRelativeWorkspacePath(value.path)) {
-    errors.push(
-      'index.path must be a relative path inside the workspace (no absolute paths or ".." traversal)'
-    );
+function envCheck(name, optional = true) {
+  const value = process2.env[name];
+  if (value === void 0 || value.trim() === "") {
+    return {
+      id: `env-${name.toLowerCase()}`,
+      status: optional ? "skipped" : "warn",
+      message: `${name} is not set.`,
+      remediation: optional ? void 0 : `Set ${name}=1 to enable tracing.`
+    };
   }
-  if (errors.length > 0) return void 0;
   return {
-    enabled: value.enabled,
-    type: value.type,
-    ...value.path !== void 0 ? { path: value.path } : {}
+    id: `env-${name.toLowerCase()}`,
+    status: "pass",
+    message: `${name} is set.`,
+    evidence: value
   };
 }
-function validateWorkspaceManifest(input3) {
-  const errors = [];
-  const warnings = [];
-  if (!isPlainObject(input3)) {
-    return { ok: false, errors: ["manifest must be an object"], warnings };
-  }
-  if (input3.schemaVersion !== WORKSPACE_SCHEMA_VERSION) {
-    errors.push(
-      `schemaVersion must be "${WORKSPACE_SCHEMA_VERSION}" (received ${JSON.stringify(
-        input3.schemaVersion
-      )})`
-    );
-  }
-  if (typeof input3.project !== "string" || input3.project.trim() === "") {
-    errors.push("project must be a non-empty string");
+async function traceDirWritable(traceDir) {
+  const resolved = path13.resolve(traceDir);
+  try {
+    await mkdir(resolved, { recursive: true });
+    await access(resolved, constants.W_OK);
+    return {
+      id: "trace-dir-writable",
+      status: "pass",
+      message: `Trace directory is writable: ${resolved}`,
+      evidence: resolved
+    };
+  } catch (error) {
+    return {
+      id: "trace-dir-writable",
+      status: "fail",
+      message: `Trace directory is not writable: ${resolved}`,
+      remediation: "Create the directory or set AGENT_INSPECT_TRACE_DIR to a writable path.",
+      evidence: error instanceof Error ? error.message : String(error)
+    };
   }
-  if (typeof input3.createdAt !== "string" || input3.createdAt.trim() === "") {
-    errors.push("createdAt must be a non-empty ISO-8601 string");
-  } else if (Number.isNaN(Date.parse(input3.createdAt))) {
-    errors.push("createdAt must be a valid ISO-8601 date string");
+}
+function resolvePackage(cwd, name) {
+  const require2 = createRequire(path13.join(cwd, "package.json"));
+  try {
+    const pkgPath = require2.resolve(`${name}/package.json`);
+    const pkg = require2(pkgPath);
+    return { ok: true, version: pkg.version };
+  } catch {
+    return { ok: false };
   }
-  if (!Array.isArray(input3.traceDirs) || input3.traceDirs.length === 0) {
-    errors.push("traceDirs must be a non-empty array");
-  } else {
-    input3.traceDirs.forEach((dir, i) => {
-      if (typeof dir !== "string" || dir.trim() === "") {
-        errors.push(`traceDirs[${i}] must be a non-empty string`);
-      } else if (!isSafeRelativeWorkspacePath(dir)) {
-        errors.push(
-          `traceDirs[${i}] must be a relative path inside the workspace (no absolute paths or ".." traversal)`
-        );
-      }
+}
+function importSmoke(cwd) {
+  const results = [];
+  const require2 = createRequire(path13.join(cwd, "package.json"));
+  try {
+    require2.resolve("agent-inspect");
+    results.push({
+      id: "import-agent-inspect",
+      status: "pass",
+      message: "agent-inspect resolves from the current project."
+    });
+  } catch {
+    results.push({
+      id: "import-agent-inspect",
+      status: "warn",
+      message: "agent-inspect is not installed in the current project.",
+      remediation: "Run npm install agent-inspect (or pnpm add agent-inspect)."
     });
   }
-  validateDirField(input3.reportsDir, "reportsDir", errors);
-  validateDirField(input3.artifactsDir, "artifactsDir", errors);
-  validateDirField(input3.bundlesDir, "bundlesDir", errors);
-  validateDirField(input3.notesDir, "notesDir", errors);
-  if (!REDACTION_PROFILES2.includes(input3.redactionProfile)) {
-    errors.push(`redactionProfile must be one of: ${REDACTION_PROFILES2.join(", ")}`);
+  try {
+    require2.resolve("agent-inspect/package.json");
+    results.push({
+      id: "import-agent-inspect-cjs",
+      status: "pass",
+      message: "CJS resolution for agent-inspect succeeded."
+    });
+  } catch {
+    results.push({
+      id: "import-agent-inspect-cjs",
+      status: "skipped",
+      message: "CJS resolution check skipped (package not installed locally)."
+    });
   }
-  const indexErrors = [];
-  const index = validateIndex(input3.index, indexErrors);
-  errors.push(...indexErrors);
-  if (index && index.type !== "none" && !index.enabled) {
-    warnings.push(`index.type is "${index.type}" but index.enabled is false`);
+  return results;
+}
+function optionalPackageChecks(cwd, framework) {
+  const packages = framework !== void 0 ? OPTIONAL_PACKAGES[framework] : [
+    "@agent-inspect/ai-sdk",
+    "@agent-inspect/openai-agents",
+    "@agent-inspect/langchain",
+    "@agent-inspect/redact",
+    "@agent-inspect/eval"
+  ];
+  return packages.map((name) => {
+    const resolved = resolvePackage(cwd, name);
+    if (!resolved.ok) {
+      return {
+        id: `optional-package-${name}`,
+        status: framework !== void 0 ? "warn" : "skipped",
+        message: `${name} is not installed.`,
+        remediation: framework !== void 0 ? `npm install ${name}` : void 0
+      };
+    }
+    return {
+      id: `optional-package-${name}`,
+      status: "pass",
+      message: `${name} is available.`,
+      evidence: resolved.version
+    };
+  });
+}
+function versionMismatchCheck(cwd) {
+  const root = resolvePackage(cwd, "agent-inspect");
+  if (!root.ok || root.version === void 0) {
+    return {
+      id: "version-alignment",
+      status: "skipped",
+      message: "Skipped version alignment \u2014 agent-inspect not installed locally."
+    };
   }
-  if (errors.length > 0 || index === void 0) {
-    return { ok: false, errors, warnings };
+  if (root.version !== version) {
+    return {
+      id: "version-alignment",
+      status: "warn",
+      message: `CLI version ${version} differs from local agent-inspect@${root.version}.`,
+      remediation: "Align versions with npm install agent-inspect@latest",
+      evidence: `cli=${version};local=${root.version}`
+    };
   }
-  const manifest = {
-    schemaVersion: WORKSPACE_SCHEMA_VERSION,
-    project: input3.project.trim(),
-    createdAt: input3.createdAt,
-    traceDirs: input3.traceDirs.map((d) => d.trim()),
-    reportsDir: input3.reportsDir.trim(),
-    artifactsDir: input3.artifactsDir.trim(),
-    bundlesDir: input3.bundlesDir.trim(),
-    notesDir: input3.notesDir.trim(),
-    redactionProfile: input3.redactionProfile,
-    index
+  return {
+    id: "version-alignment",
+    status: "pass",
+    message: `CLI and local agent-inspect are aligned at ${version}.`
   };
-  return { ok: true, manifest, errors, warnings };
 }
-function parseWorkspaceManifest(json) {
-  const warnings = [];
-  if (typeof json !== "string") {
-    return { ok: false, errors: ["manifest input must be a string"], warnings };
+async function runDoctorChecks(options = {}) {
+  const cwd = path13.resolve(options.cwd ?? process2.cwd());
+  const traceDir = options.traceDir?.trim() || process2.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
+  const checks2 = [
+    nodeVersionCheck(),
+    {
+      id: "cli-version",
+      status: "pass",
+      message: `agent-inspect CLI ${version}`,
+      evidence: version
+    },
+    await traceDirWritable(traceDir),
+    envCheck("AGENT_INSPECT"),
+    envCheck("AGENT_INSPECT_TRACE_DIR"),
+    versionMismatchCheck(cwd)
+  ];
+  if (options.checkImports !== false) {
+    checks2.push(...importSmoke(cwd));
   }
-  if (json.length > MAX_WORKSPACE_MANIFEST_BYTES) {
-    return {
-      ok: false,
-      errors: [
-        `manifest exceeds maximum size of ${MAX_WORKSPACE_MANIFEST_BYTES} bytes`
-      ],
-      warnings
-    };
+  checks2.push(...optionalPackageChecks(cwd, options.framework));
+  return checks2.sort((a, b) => a.id.localeCompare(b.id));
+}
+async function doctorCommand(options = {}) {
+  const checks2 = await runDoctorChecks(options);
+  const failed = checks2.filter((check) => check.status === "fail").length;
+  const warned = checks2.filter((check) => check.status === "warn").length;
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: failed === 0,
+          version,
+          summary: { pass: checks2.filter((c) => c.status === "pass").length, warn: warned, fail: failed },
+          checks: checks2
+        },
+        null,
+        2
+      )
+    );
+    if (failed > 0) process2.exitCode = 1;
+    return;
   }
-  let parsed;
-  try {
-    parsed = JSON.parse(json);
-  } catch {
-    return { ok: false, errors: ["manifest is not valid JSON"], warnings };
+  console.log("AgentInspect doctor");
+  for (const check of checks2) {
+    const tag = check.status.toUpperCase();
+    console.log(`[${tag}] ${check.id}: ${check.message}`);
+    if (check.remediation) console.log(`  \u2192 ${check.remediation}`);
   }
-  return validateWorkspaceManifest(parsed);
-}
-function serializeWorkspaceManifest(manifest) {
-  return `${JSON.stringify(manifest, null, 2)}
-`;
+  console.log(`
+Summary: ${failed} failed, ${warned} warnings`);
+  if (failed > 0) process2.exitCode = 1;
 }
-var INDEX_DIR_NAME = "index";
-function resolveWorkspaceLocation(cwd = process.cwd()) {
-  const projectRoot = path10.resolve(cwd);
-  const workspaceDir = path10.join(projectRoot, WORKSPACE_DIR_NAME);
-  return {
-    projectRoot,
-    workspaceDir,
-    manifestPath: path10.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
-  };
+
+// packages/adapter-sdk/src/indexer.ts
+function defineIndexer(indexer) {
+  if (!indexer.id.trim()) throw new Error("indexer id is required");
+  return indexer;
 }
-function resolveInsideWorkspace(workspaceDir, relative) {
-  const base = path10.resolve(workspaceDir);
-  const resolved = path10.resolve(base, relative);
-  const rel = path10.relative(base, resolved);
-  if (rel === "" || rel === "." || !rel.startsWith("..") && !path10.isAbsolute(rel)) {
-    return resolved;
+async function indexIsStale(snapshot, traceDir) {
+  const builtMs = Date.parse(snapshot.builtAt);
+  if (Number.isNaN(builtMs)) return true;
+  const td = new TraceDirectory({ dir: traceDir });
+  const files = await td.list();
+  for (const file of files) {
+    const stats = await td.getFileStats(file);
+    if (stats.mtimeMs > builtMs) return true;
   }
-  throw new Error(
-    `Workspace path "${relative}" resolves outside the workspace directory`
-  );
+  return false;
 }
-async function pathExists(p) {
-  try {
-    await access(p);
-    return true;
-  } catch {
-    return false;
-  }
+function createTraceDirectoryIndexer() {
+  return defineIndexer({
+    id: "trace-directory-metadata",
+    async rebuild(traceDir, options = {}) {
+      const warnings = [];
+      const td = new TraceDirectory({ dir: traceDir });
+      const files = await td.list();
+      const maxEntries = options.maxEntries ?? 1e4;
+      if (files.length > maxEntries) {
+        warnings.push(
+          `indexer.truncated: trace directory has ${files.length} files; indexing first ${maxEntries}`
+        );
+      }
+      const slice = files.slice(0, maxEntries);
+      const metas = await loadTraceMetadataList(
+        traceDir,
+        slice,
+        (fileName) => td.getPath(fileName)
+      );
+      const entries = metas.map((meta) => ({
+        runId: meta.runId,
+        path: meta.filePath,
+        name: meta.name,
+        startedAt: meta.startedAt,
+        status: meta.status
+      })).sort((a, b) => a.runId.localeCompare(b.runId));
+      if (entries.length < slice.length) {
+        warnings.push(
+          `indexer.partial: indexed ${entries.length} of ${slice.length} trace files`
+        );
+      }
+      return {
+        traceDir,
+        builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+        entries,
+        warnings
+      };
+    }
+  });
 }
-async function isWritable(p) {
-  try {
-    await access(p, constants$1.W_OK);
-    return true;
-  } catch {
-    return false;
+
+// packages/cli/src/index-cmd.ts
+var INDEX_FILENAME = ".agent-inspect-index.json";
+function traceIndexPath(traceDir) {
+  return path13.join(traceDir, INDEX_FILENAME);
+}
+function parseMaxEntries(raw) {
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error("--max-entries must be a positive integer.");
   }
+  return parsed;
 }
-async function listJsonl(dir) {
+async function readSnapshot(indexPath2) {
   try {
-    const entries = await readdir(dir);
-    return entries.filter((f) => f.endsWith(".jsonl"));
+    const raw = await readFile(indexPath2, "utf8");
+    return JSON.parse(raw);
   } catch {
-    return [];
+    return void 0;
   }
 }
-async function countFiles(dir) {
+async function indexBuildCommand(options = {}) {
   try {
-    const entries = await readdir(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isFile()).length;
-  } catch {
-    return 0;
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    await mkdir(traceDir, { recursive: true });
+    const indexer = createTraceDirectoryIndexer();
+    const snapshot = await indexer.rebuild(traceDir, {
+      maxEntries: parseMaxEntries(options.maxEntries)
+    });
+    const indexPath2 = traceIndexPath(traceDir);
+    await writeFile(indexPath2, `${JSON.stringify(snapshot, null, 2)}
+`, "utf8");
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true, indexPath: indexPath2, ...snapshot }, null, 2));
+      return;
+    }
+    console.log(`Built trace index: ${indexPath2}`);
+    console.log(`Entries: ${snapshot.entries.length}`);
+    if (snapshot.warnings.length > 0) {
+      for (const warning of snapshot.warnings) {
+        console.log(`warning: ${warning}`);
+      }
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index build failed: ${msg}`);
+    process.exitCode = 1;
   }
 }
-async function readWorkspaceManifestFile(location) {
-  let raw;
+async function indexStatusCommand(options = {}) {
   try {
-    raw = await readFile(location.manifestPath, "utf-8");
-  } catch {
-    return { exists: false, ok: false, errors: ["workspace.json not found"], warnings: [] };
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const indexPath2 = traceIndexPath(traceDir);
+    const snapshot = await readSnapshot(indexPath2);
+    if (!snapshot) {
+      const payload2 = { ok: true, exists: false, indexPath: indexPath2, traceDir, stale: true };
+      if (options.json) {
+        console.log(JSON.stringify(payload2, null, 2));
+      } else {
+        console.log(`No index at ${indexPath2}`);
+        console.log("Run: agent-inspect index build");
+      }
+      return;
+    }
+    const stale = await indexIsStale(snapshot, traceDir);
+    const payload = {
+      ok: true,
+      exists: true,
+      indexPath: indexPath2,
+      traceDir,
+      stale,
+      builtAt: snapshot.builtAt,
+      entries: snapshot.entries.length,
+      warnings: snapshot.warnings
+    };
+    if (options.json) {
+      console.log(JSON.stringify(payload, null, 2));
+      return;
+    }
+    console.log(`Index: ${indexPath2}`);
+    console.log(`Built: ${snapshot.builtAt}`);
+    console.log(`Entries: ${snapshot.entries.length}`);
+    console.log(`Stale: ${stale ? "yes" : "no"}`);
+    if (snapshot.warnings.length > 0) {
+      for (const warning of snapshot.warnings) {
+        console.log(`warning: ${warning}`);
+      }
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index status failed: ${msg}`);
+    process.exitCode = 1;
   }
-  const parsed = parseWorkspaceManifest(raw);
-  return {
-    exists: true,
-    ok: parsed.ok,
-    ...parsed.manifest ? { manifest: parsed.manifest } : {},
-    errors: parsed.errors,
-    warnings: parsed.warnings
-  };
 }
-async function createWorkspace(options = {}) {
-  const location = resolveWorkspaceLocation(options.cwd);
-  const dryRun = options.dryRun === true;
-  const existing = await readWorkspaceManifestFile(location);
-  const topLevelTraces = await listJsonl(location.workspaceDir);
-  const detectedExistingTraces = topLevelTraces.length > 0;
-  let manifest;
-  let created;
-  let adopted;
-  if (existing.exists && existing.ok && existing.manifest) {
-    manifest = existing.manifest;
-    created = false;
-    adopted = true;
-  } else {
-    const project = options.project?.trim() || path10.basename(location.projectRoot) || "workspace";
-    const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
-    manifest = createDefaultWorkspaceManifest({
-      project,
-      traceDirs,
-      ...options.redactionProfile ? { redactionProfile: options.redactionProfile } : {}
-    });
-    created = true;
-    adopted = detectedExistingTraces || existing.exists && !existing.ok;
-  }
-  const relDirs = uniqueDirs([
-    ...manifest.traceDirs.filter((d) => d !== "."),
-    manifest.reportsDir,
-    manifest.artifactsDir,
-    manifest.bundlesDir,
-    manifest.notesDir,
-    INDEX_DIR_NAME
-  ]);
-  const createdDirs = [];
-  for (const rel of relDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    if (await pathExists(abs)) continue;
-    createdDirs.push(rel);
-    if (!dryRun) await mkdir(abs, { recursive: true });
-  }
-  if (!dryRun && created) {
-    await mkdir(location.workspaceDir, { recursive: true });
-    await writeFile(location.manifestPath, serializeWorkspaceManifest(manifest), "utf-8");
+async function indexCleanCommand(options = {}) {
+  try {
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const indexPath2 = traceIndexPath(traceDir);
+    await rm(indexPath2, { force: true });
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true, removed: indexPath2 }, null, 2));
+      return;
+    }
+    console.log(`Removed index: ${indexPath2}`);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index clean failed: ${msg}`);
+    process.exitCode = 1;
   }
-  return {
-    location,
-    manifest,
-    created,
-    adopted,
-    createdDirs,
-    detectedExistingTraces,
-    dryRun
-  };
 }
-function uniqueDirs(dirs) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const d of dirs) {
-    const t = d.trim();
-    if (t === "" || t === "." || seen.has(t)) continue;
-    seen.add(t);
-    out.push(t);
+var PACKAGE = "@agent-inspect/index-sqlite";
+function isModuleNotFound3(e) {
+  return e !== null && typeof e === "object" && "code" in e && (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND");
+}
+async function loadIndexSqlite() {
+  try {
+    return await import('./src-YFMPWEIS.mjs');
+  } catch (e) {
+    if (isModuleNotFound3(e)) {
+      console.error(
+        `The optional SQLite index is not installed. Run: npm install ${PACKAGE}`
+      );
+      process.exitCode = 1;
+      return null;
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] failed to load ${PACKAGE}: ${msg}`);
+    process.exitCode = 1;
+    return null;
   }
-  return out;
 }
-async function getWorkspaceStatus(location, manifest) {
-  let traceFiles = 0;
-  for (const rel of manifest.traceDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    traceFiles += (await listJsonl(abs)).length;
+function parsePositiveInt(raw, flag) {
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${flag} must be a positive integer.`);
   }
-  const reports = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.reportsDir)
-  );
-  const artifacts = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.artifactsDir)
-  );
-  const bundles = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.bundlesDir)
-  );
-  const notes = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.notesDir)
-  );
-  const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
-  return {
-    project: manifest.project,
-    traceFiles,
-    reports,
-    artifacts,
-    bundles,
-    notes,
-    index: {
-      enabled: manifest.index.enabled,
-      type: manifest.index.type,
-      exists: await pathExists(indexPath2)
+  return parsed;
+}
+async function newestTraceMtimeMs2(traceDir) {
+  let newest = 0;
+  try {
+    const files = await readdir(traceDir);
+    for (const file of files) {
+      if (!file.endsWith(".jsonl")) continue;
+      try {
+        const s = await stat(path13.join(traceDir, file));
+        if (s.mtimeMs > newest) newest = s.mtimeMs;
+      } catch {
+      }
     }
-  };
+  } catch {
+  }
+  return newest;
 }
-async function doctorWorkspace(location) {
-  const checks2 = [];
-  const manifestResult = await readWorkspaceManifestFile(location);
-  if (!manifestResult.exists) {
-    checks2.push({
-      id: "manifest",
-      status: "fail",
-      message: "workspace.json not found (run `agent-inspect workspace init`)"
-    });
-    return { ok: false, checks: checks2 };
+async function indexSqliteBuildCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const result = await mod.buildIndex({
+    traceDir: options.dir,
+    maxRuns: parsePositiveInt(options.maxRuns, "--max-runs")
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+    return;
   }
-  if (!manifestResult.ok || !manifestResult.manifest) {
-    checks2.push({
-      id: "manifest",
-      status: "fail",
-      message: `workspace.json is invalid: ${manifestResult.errors.join("; ")}`
-    });
-    return { ok: false, checks: checks2 };
+  console.log(`Built SQLite index: ${result.dbPath}`);
+  console.log(`Runs: ${result.runs}  Steps: ${result.steps}  Errors: ${result.errors}`);
+  for (const warning of result.warnings) console.log(`warning: ${warning}`);
+}
+async function indexSqliteStatusCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  const status = mod.indexStatus(dbPath);
+  const stale = mod.isIndexStale(dbPath, await newestTraceMtimeMs2(traceDir));
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, traceDir, stale, ...status }, null, 2));
+    return;
   }
-  const manifest = manifestResult.manifest;
-  checks2.push({ id: "manifest", status: "pass", message: "workspace.json is valid" });
-  for (const warning of manifestResult.warnings) {
-    checks2.push({ id: "manifest-warning", status: "warn", message: warning });
+  if (!status.exists) {
+    console.log(`No SQLite index at ${dbPath}`);
+    console.log("Run: agent-inspect index sqlite build");
+    return;
   }
-  const dirFields = [
-    ...manifest.traceDirs.filter((d) => d !== ".").map((d, i) => [`traceDir[${i}]`, d]),
-    ["reportsDir", manifest.reportsDir],
-    ["artifactsDir", manifest.artifactsDir],
-    ["bundlesDir", manifest.bundlesDir],
-    ["notesDir", manifest.notesDir]
-  ];
-  for (const [id, rel] of dirFields) {
-    let abs;
-    try {
-      abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    } catch (error) {
-      checks2.push({
-        id,
-        status: "fail",
-        message: error instanceof Error ? error.message : String(error)
-      });
-      continue;
-    }
-    if (!await pathExists(abs)) {
-      checks2.push({ id, status: "warn", message: `${rel}/ does not exist yet` });
-    } else if (!await isWritable(abs)) {
-      checks2.push({ id, status: "fail", message: `${rel}/ is not writable` });
+  console.log(`Index: ${status.dbPath}`);
+  console.log(`Healthy: ${status.healthy ? "yes" : "no"}`);
+  console.log(`Built: ${status.builtAt ?? "unknown"}`);
+  console.log(`Runs: ${status.runs}  Steps: ${status.steps}`);
+  console.log(`Stale: ${stale ? "yes" : "no"}`);
+}
+async function indexSqliteQueryCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  const status = mod.indexStatus(dbPath);
+  if (!status.exists || !status.healthy) {
+    if (options.json) {
+      console.log(JSON.stringify({ ok: false, reason: "index-missing", dbPath }, null, 2));
     } else {
-      checks2.push({ id, status: "pass", message: `${rel}/ is present and writable` });
+      console.log("No usable SQLite index. Run: agent-inspect index sqlite build");
     }
+    process.exitCode = 1;
+    return;
   }
-  let newestTraceMtime = 0;
-  for (const rel of manifest.traceDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    for (const file of await listJsonl(abs)) {
-      try {
-        const s = await stat(path10.join(abs, file));
-        newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
-      } catch {
-        checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
-      }
-    }
+  const rows = mod.queryRuns(dbPath, {
+    status: options.status,
+    sessionId: options.session,
+    name: options.name,
+    kind: options.kind,
+    tool: options.tool,
+    limit: parsePositiveInt(options.limit, "--limit")
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, count: rows.length, runs: rows }, null, 2));
+    return;
   }
-  if (manifest.index.enabled) {
-    const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
-    if (!await pathExists(indexPath2)) {
-      checks2.push({ id: "index", status: "warn", message: "index enabled but not built" });
-    } else {
-      try {
-        const s = await stat(indexPath2);
-        if (newestTraceMtime > s.mtimeMs) {
-          checks2.push({ id: "index", status: "warn", message: "index is stale (traces are newer)" });
-        } else {
-          checks2.push({ id: "index", status: "pass", message: "index is present" });
-        }
-      } catch {
-        checks2.push({ id: "index", status: "warn", message: "cannot stat index" });
-      }
-    }
+  if (rows.length === 0) {
+    console.log("No matching runs.");
+    return;
+  }
+  for (const run of rows) {
+    const parts = [
+      run.runId,
+      run.status ?? "unknown",
+      run.name ?? "",
+      run.durationMs != null ? `${run.durationMs}ms` : ""
+    ].filter((p) => p !== "");
+    console.log(parts.join("  "));
   }
-  const ok = !checks2.some((c) => c.status === "fail");
-  return { ok, checks: checks2 };
 }
-async function cleanWorkspace(location, manifest, options = {}) {
-  const dryRun = options.confirm !== true;
-  const targets = uniqueDirs([
-    manifest.reportsDir,
-    manifest.artifactsDir,
-    manifest.bundlesDir,
-    manifest.index.path ?? INDEX_DIR_NAME
-  ]);
-  const removed = [];
-  for (const rel of targets) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    let entries;
-    try {
-      entries = await readdir(abs);
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const relPath = `${rel}/${entry}`;
-      removed.push(relPath);
-      if (!dryRun) {
-        await rm(path10.join(abs, entry), { recursive: true, force: true });
-      }
-    }
+async function indexSqliteCleanCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  await mod.cleanIndex(dbPath);
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, removed: dbPath }, null, 2));
+    return;
   }
-  return { dryRun, removed };
+  console.log(`Removed SQLite index: ${dbPath}`);
 }
 
 // packages/cli/src/workspace.ts
@@ -12996,6 +13579,11 @@ function createCliProgram() {
   ).option("--run <run-id>", "select a run when the trace contains multiple runs").option("--baseline <trace-path-or-run-id>", "optional baseline trace for diff artifacts").option("--baseline-run <run-id>", "select a run from the baseline trace").option("--github-summary <path>", "append a safe summary to this file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON manifest").action((target, opts) => {
     runCommand(() => artifactsCommand(target, opts));
   });
+  program.command("bundle").description("Create a share-safe offline trace bundle (local folder)").argument("[run-id]", "run id to bundle (optional with --session or --since)").option("--dir <path>", "trace directory for run/session lookup").option("--session <session-id>", "bundle all runs in a session").option("--since <duration>", "bundle runs with activity since a duration (e.g. 24h)").addOption(
+    new Option("--profile <profile>", "redaction profile for exported copies").choices(["local", "share", "strict"]).default("share")
+  ).option("--out <path>", "output directory (folder; .zip suffix is stripped)").option("--allow-unsafe", "write bundle even when verify-safe reports UNSAFE").option("--json", "print deterministic JSON manifest").action((runId, opts) => {
+    runCommand(() => bundleCommand(runId, opts));
+  });
   program.command("ci-summary").description("Summarize local reporter artifact manifests for CI").argument("<manifest...>", "reporter artifact manifest JSON files").option("-o, --output <path>", "write Markdown summary to a local file").option("--github-summary <path>", "append Markdown summary to this local file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON summary").action((manifest, opts) => {
     runCommand(() => ciSummaryCommand(manifest, opts));
   });
@@ -13046,12 +13634,32 @@ function createCliProgram() {
   ).option("--json", "print results as JSON").action((opts) => {
     runCommand(() => searchCommand(opts));
   });
-  program.command("sessions").description("List workflow sessions grouped from local trace metadata (read-only)").option("--dir <path>", "trace directory").option(
+  const sessionsCmd = program.command("sessions").description(
+    "Workflow sessions and activity from local trace metadata (read-only, v4.2+)"
+  ).option("--dir <path>", "trace directory").option(
     "--correlate-group",
     "treat shared groupId as a synthetic session when sessionId is absent"
-  ).option("--json", "print sessions index as JSON").action((opts) => {
+  ).option("--json", "print JSON output").option(
+    "--stale-after <duration>",
+    "mark sessions stale after inactivity (e.g. 24h, 7d)"
+  ).action((opts) => {
     runCommand(() => sessionsCommand(opts));
   });
+  sessionsCmd.command("latest").description("Show the most recently active session").option("--dir <path>", "trace directory").option("--correlate-group", "include synthetic group: sessions").option("--stale-after <duration>", "staleness threshold for status derivation").option("--json", "print JSON result").action((opts) => {
+    runCommand(() => sessionsLatestCommand(opts));
+  });
+  sessionsCmd.command("activity").description("Summarize recent session activity").option("--dir <path>", "trace directory").option("--since <duration>", "activity window (default 7d)").option("--correlate-group", "include synthetic group: sessions").option("--stale-after <duration>", "staleness threshold for status derivation").option("--json", "print JSON result").action((opts) => {
+    runCommand(() => sessionsActivityCommand(opts));
+  });
+  sessionsCmd.command("show").description("Show one session (alias for session <id>)").argument("<session-id>", "session id").option("--dir <path>", "trace directory").option("--timeline", "include per-run timelines").option("--critical-path", "include critical path section").option("--diagnostics", "include ambiguity warnings").option("--json", "print JSON result").action((sessionId, opts) => {
+    runCommand(() => sessionsShowCommand(sessionId, opts));
+  });
+  sessionsCmd.command("handoffs").description("List handoff edges across sessions").option("--dir <path>", "trace directory").option("--session <id>", "limit to one session").option("--correlate-group", "include synthetic group: sessions").option("--json", "print JSON result").action((opts) => {
+    runCommand(() => sessionsHandoffsCommand(opts));
+  });
+  sessionsCmd.command("errors").description("List sessions with errors in a time window").option("--dir <path>", "trace directory").option("--since <duration>", "filter by last activity (default: all)").option("--correlate-group", "include synthetic group: sessions").option("--stale-after <duration>", "staleness threshold for status derivation").option("--json", "print JSON result").action((opts) => {
+    runCommand(() => sessionsErrorsCommand(opts));
+  });
   program.command("session").description("Inspect one workflow session: runs, handoffs, retries (read-only)").argument("<session-id>", "session id (from sessions output)").option("--dir <path>", "trace directory").option("--timeline", "include per-run timelines").option("--critical-path", "include critical path section").option("--diagnostics", "include ambiguity warnings").option("--json", "print session view as JSON").action((sessionId, opts) => {
     runCommand(() => sessionCommand(sessionId, opts));
   });
@@ -13180,9 +13788,9 @@ function isPrimaryModule() {
   if (!entry) return false;
   const selfPath = fileURLToPath(import.meta.url);
   try {
-    return realpathSync(path10.resolve(entry)) === realpathSync(path10.resolve(selfPath));
+    return realpathSync(path13.resolve(entry)) === realpathSync(path13.resolve(selfPath));
   } catch {
-    return path10.resolve(entry) === path10.resolve(selfPath);
+    return path13.resolve(entry) === path13.resolve(selfPath);
   }
 }
 if (isPrimaryModule()) {