agent-inspect 4.2.0 → 4.3.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 4.3.0
+
+### Minor Changes
+
+- 8a21bce: Add share-safe offline trace bundles (`agent-inspect bundle`) with automatic verify-safe, default share redaction profile, session/since targeting, and folder output for PR-ready evidence.
+
 ## 4.2.0
 
 ### Minor Changes

package/docs/CLI.md

@@ -37,6 +37,7 @@ Core commands:
 - `scan` — best-effort local safety scan for trace capture risks
 - `verify-safe` — best-effort local trace safety verification
 - `artifacts` — create safe local CI trace artifact bundles and optional step summaries
+- `bundle` — create share-safe offline trace bundles (redacted copies + verify-safe)
 - `ci-summary` — summarize local reporter artifact manifests for CI
 - `diff` — compare two manual traces (local, read-only)
 - `timeline` — chronological view of one run (local JSONL)
@@ -860,6 +861,38 @@ agent-inspect index sqlite clean [--dir <path>] [--json]
 
 If `@agent-inspect/index-sqlite` is not installed, these subcommands print a short install hint and exit non-zero.
 
+### 6.24 `bundle`
+
+Create a **share-safe offline trace bundle** as a local folder (v4.3+). Bundles are derived copies: original traces are read-only and never mutated. Automatic `verify-safe` runs before write; the command fails on `UNSAFE` unless `--allow-unsafe`. See [BUNDLES.md](BUNDLES.md).
+
+```bash
+agent-inspect bundle <run-id> [options]
+agent-inspect bundle --session <session-id> [options]
+agent-inspect bundle --since <duration> [options]
+```
+
+Options:
+
+- `--dir <path>` — trace directory
+- `--session <session-id>` — bundle all runs in a session
+- `--since <duration>` — bundle runs with activity since a window (e.g. `24h`, `7d`)
+- `--profile <profile>` — `local`, `share` (default), or `strict` redaction for exported copies
+- `--out <path>` — output directory; `.zip` suffix is stripped (folder-first)
+- `--allow-unsafe` — write bundle even when verify-safe reports UNSAFE
+- `--json` — print deterministic JSON manifest
+
+Output includes `trace.html`, `trace.jsonl`, `summary.md`, `metadata.json`, `check-results.json`, `redaction-report.json`, and `assets/runs/` mirrors for multi-run bundles.
+
+Examples:
+
+```bash
+npx agent-inspect bundle minimal-success --dir fixtures/traces --out ./bundle-out
+npx agent-inspect bundle --session sess-handoff-001 --dir ./.agent-inspect --profile strict
+npx agent-inspect bundle --since 24h --dir ./.agent-inspect --json
+```
+
+Recipe: [shareable-bundle-basic](../examples/recipes/shareable-bundle-basic/README.md).
+
 ## 7. Optional TUI behavior
 
 `view --tui` delegates to `@agent-inspect/tui` and requires an interactive terminal. If the package is not installed, the CLI prints a short install hint.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "license": "MIT",
   "type": "module",
   "description": "Trace, check, and safely share TypeScript AI-agent runs locally — no account, no upload, metadata-only by default",

package/packages/cli/dist/{chunk-5VSPJEZ7.mjs → chunk-BS5LSKZ3.mjs}

@@ -3268,12 +3268,12 @@ function buildCriticalPath(runs, handoffs) {
     handoffs.filter((edge) => edge.confidence === "explicit").map((edge) => edge.from)
   );
   const ordered = [...runs].sort(compareRuns);
-  const path5 = [];
+  const path6 = [];
   const visited = /* @__PURE__ */ new Set();
   const pushRun = (run, confidence, source) => {
     if (visited.has(run.runId)) return;
     visited.add(run.runId);
-    path5.push({
+    path6.push({
       runId: run.runId,
       name: run.name,
       startedAt: run.startedAt,
@@ -3298,7 +3298,7 @@ function buildCriticalPath(runs, handoffs) {
     const confidence = explicitTargets.has(run.runId) || explicitSources.has(run.runId) ? "explicit" : "correlated";
     pushRun(run, confidence, confidence === "explicit" ? "manual" : "inferred");
   }
-  return path5;
+  return path6;
 }
 function metaRunIdMatches(run, token, runById) {
   const meta = extractSessionWorkflowMetadata(run.metadata);
@@ -3482,6 +3482,190 @@ async function isAgentInspectTrace(filePath) {
   }
 }
 
-export { Redactor, TraceDirectory, __commonJS, __require, __toESM, aggregateSessionCheckResults, applyProfileMetadataCaps, buildActivitySummary, buildLocalExplanation, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, enrichSessionRunRecord, extractCorrelationMetadata, extractMetadata, filterMetasBySessionScope, filterTraces, formatDuration2 as formatDuration, formatTimestamp, getIndent, getTraceFilePath, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadTraceMetadataList, nanoid, parseDuration, parseDurationFilter, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderErrorLine, renderRunWhat, renderStepLine, renderTimeline, renderTraceStats, resolveRedactionProfile, resolveTraceDir, searchTraces, source_default, truncateName, truncateStringForProfile, validateEvent };
-//# sourceMappingURL=chunk-5VSPJEZ7.mjs.map
-//# sourceMappingURL=chunk-5VSPJEZ7.mjs.map
+// packages/core/src/bundle/resolve.ts
+function parseSinceCutoff(since) {
+  const trimmed = since.trim();
+  if (trimmed === "") {
+    throw new Error("--since requires a non-empty duration (e.g. 24h, 7d).");
+  }
+  return Date.now() - parseDuration(trimmed);
+}
+function runActivityMs(run) {
+  if (run.startedAt !== void 0 && Number.isFinite(run.startedAt)) return run.startedAt;
+  if (run.endedAt !== void 0 && Number.isFinite(run.endedAt)) return run.endedAt;
+  return void 0;
+}
+function runsInSinceWindow(runs, since) {
+  const cutoff = parseSinceCutoff(since);
+  const ids = [];
+  for (const run of runs) {
+    const activity = runActivityMs(run);
+    if (activity !== void 0 && activity >= cutoff) {
+      ids.push(run.runId);
+    }
+  }
+  return ids.sort((a, b) => a.localeCompare(b));
+}
+function findSession(index, sessionId) {
+  return index.sessions.find((session) => session.sessionId === sessionId);
+}
+function resolveBundleRunIds(index, runs, options) {
+  const runId = options.runId?.trim();
+  const sessionId = options.sessionId?.trim();
+  const since = options.since?.trim();
+  const modes = [runId ? 1 : 0, sessionId ? 1 : 0, since ? 1 : 0].reduce((a, b) => a + b, 0);
+  if (modes === 0) {
+    throw new Error(
+      "bundle requires a run id, --session <sessionId>, or --since <duration>."
+    );
+  }
+  if (modes > 1) {
+    throw new Error(
+      "bundle accepts only one target: a run id, --session, or --since (not combined)."
+    );
+  }
+  if (runId) {
+    const known = runs.some((run) => run.runId === runId);
+    if (!known) {
+      throw new Error(`Run "${runId}" was not found in the trace directory.`);
+    }
+    return { runIds: [runId] };
+  }
+  if (sessionId) {
+    const session = findSession(index, sessionId);
+    if (!session) {
+      throw new Error(`Session "${sessionId}" was not found.`);
+    }
+    if (session.runIds.length === 0) {
+      throw new Error(`Session "${sessionId}" has no runs to bundle.`);
+    }
+    return {
+      runIds: [...session.runIds].sort((a, b) => a.localeCompare(b)),
+      sessionId
+    };
+  }
+  const runIds = runsInSinceWindow(runs, since);
+  if (runIds.length === 0) {
+    throw new Error(`No runs matched --since ${since}.`);
+  }
+  return { runIds, since };
+}
+
+// packages/core/src/bundle/safety-status.ts
+function aggregateBundleSafeStatus(statuses) {
+  if (statuses.length === 0) return "UNKNOWN";
+  if (statuses.some((status) => status === "UNSAFE")) return "UNSAFE";
+  if (statuses.some((status) => status === "UNKNOWN")) return "UNKNOWN";
+  if (statuses.some((status) => status === "SAFE WITH WARNINGS")) return "SAFE WITH WARNINGS";
+  return "SAFE";
+}
+function toMetadataSafeStatus(status) {
+  if (status === "SAFE WITH WARNINGS") return "SAFE_WITH_WARNINGS";
+  return status;
+}
+function bundleFailsOnSafety(status, allowUnsafe) {
+  if (allowUnsafe) return false;
+  return status === "UNSAFE" || status === "UNKNOWN";
+}
+
+// packages/core/src/bundle/manifest.ts
+var BUNDLE_NOTE = "Generated locally by AgentInspect. Bundles are derived copies for review \u2014 not compliance or security certification. Review before sharing.";
+var PLACEHOLDER_NOTE = "No eval or performance artifacts were requested for this bundle.";
+function buildBundleMetadata(parts) {
+  const aggregate = aggregateBundleSafeStatus(
+    parts.checks.runs.map((run) => run.status)
+  );
+  return {
+    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    agentInspectVersion: parts.agentInspectVersion,
+    redactionProfile: parts.profile,
+    sourceTraceCount: parts.resolve.runIds.length,
+    runIds: [...parts.resolve.runIds],
+    safeStatus: toMetadataSafeStatus(aggregate),
+    files: [...parts.files].sort((a, b) => a.localeCompare(b)),
+    note: BUNDLE_NOTE,
+    ...parts.resolve.sessionId !== void 0 ? { sessionId: parts.resolve.sessionId } : {},
+    ...parts.resolve.since !== void 0 ? { since: parts.resolve.since } : {}
+  };
+}
+function buildPlaceholderArtifact() {
+  return {
+    status: "not_requested",
+    note: PLACEHOLDER_NOTE
+  };
+}
+
+// packages/core/src/bundle/summary.ts
+function markdownTable(rows) {
+  const lines = ["| Field | Value |", "| --- | --- |"];
+  for (const [key, value] of rows) {
+    lines.push(`| ${key} | ${value ?? "unknown"} |`);
+  }
+  return lines.join("\n");
+}
+function buildBundleSummaryMarkdown(parts) {
+  const { metadata, checks, redaction } = parts;
+  const lines = [
+    "# AgentInspect trace bundle",
+    "",
+    metadata.note,
+    "",
+    "## Overview",
+    "",
+    markdownTable([
+      ["Created", metadata.createdAt],
+      ["AgentInspect", metadata.agentInspectVersion],
+      ["Redaction profile", metadata.redactionProfile],
+      ["Safe status", metadata.safeStatus],
+      ["Source traces", metadata.sourceTraceCount],
+      ["Runs", metadata.runIds.join(", ")],
+      ...metadata.sessionId ? [["Session", metadata.sessionId]] : [],
+      ...metadata.since ? [["Since", metadata.since]] : []
+    ]),
+    "",
+    "## Safety checks",
+    "",
+    `Aggregate: **${checks.aggregateStatus}**`,
+    ""
+  ];
+  for (const run of checks.runs) {
+    lines.push(
+      `- \`${run.runId}\`: ${run.status} (${run.findings} finding(s), ${run.errors} error(s), ${run.warnings} warning(s))`
+    );
+  }
+  lines.push("", "## Redaction", "", `Total findings: ${redaction.totalFindings}`, "");
+  for (const run of redaction.runs) {
+    const detectors = run.detectors.length > 0 ? run.detectors.join(", ") : "none";
+    lines.push(`- \`${run.runId}\`: ${run.findings} finding(s); detectors: ${detectors}`);
+  }
+  lines.push(
+    "",
+    "## Files",
+    "",
+    ...metadata.files.map((file) => `- \`${file}\``),
+    "",
+    "_Review every generated artifact before sharing outside your team._",
+    ""
+  );
+  return lines.join("\n");
+}
+function normalizeBundleOutputPath(out) {
+  const trimmed = out.trim();
+  if (trimmed === "") {
+    throw new Error("--out requires a non-empty path.");
+  }
+  const resolved = path.resolve(trimmed);
+  if (resolved.toLowerCase().endsWith(".zip")) {
+    return resolved.slice(0, -4);
+  }
+  return resolved;
+}
+function defaultBundleOutputPath(runIds) {
+  const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return path.resolve(`agent-inspect-bundle-${label}-${stamp}`);
+}
+
+export { Redactor, TraceDirectory, __commonJS, __require, __toESM, aggregateBundleSafeStatus, aggregateSessionCheckResults, applyProfileMetadataCaps, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, bundleFailsOnSafety, defaultBundleOutputPath, enrichSessionRunRecord, extractCorrelationMetadata, extractMetadata, filterMetasBySessionScope, filterTraces, formatDuration2 as formatDuration, formatTimestamp, getIndent, getTraceFilePath, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadTraceMetadataList, nanoid, normalizeBundleOutputPath, parseDuration, parseDurationFilter, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderErrorLine, renderRunWhat, renderStepLine, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveTraceDir, searchTraces, source_default, truncateName, truncateStringForProfile, validateEvent };
+//# sourceMappingURL=chunk-BS5LSKZ3.mjs.map
+//# sourceMappingURL=chunk-BS5LSKZ3.mjs.map