agent-inspect 4.2.0 → 4.3.0

package/packages/cli/dist/index.cjs

@@ -4,7 +4,7 @@
 var crypto = require('crypto');
 var promises = require('fs/promises');
 var os = require('os');
-var path16 = require('path');
+var path19 = require('path');
 var async_hooks = require('async_hooks');
 var process3 = require('process');
 var tty = require('tty');
@@ -20,7 +20,7 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var os__default = /*#__PURE__*/_interopDefault(os);
-var path16__default = /*#__PURE__*/_interopDefault(path16);
+var path19__default = /*#__PURE__*/_interopDefault(path19);
 var process3__default = /*#__PURE__*/_interopDefault(process3);
 var tty__default = /*#__PURE__*/_interopDefault(tty);
 
@@ -859,7 +859,7 @@ function getDefaultTraceDir() {
     if (typeof home !== "string" || home.trim() === "") {
       return FALLBACK_TRACE_DIR;
     }
-    return path16__default.default.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
+    return path19__default.default.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
   } catch {
     return FALLBACK_TRACE_DIR;
   }
@@ -867,11 +867,11 @@ function getDefaultTraceDir() {
 function getTraceFilePath(runId, traceDir) {
   const baseDir = traceDir ?? getDefaultTraceDir();
   let safeId = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
-  safeId = path16__default.default.basename(safeId);
+  safeId = path19__default.default.basename(safeId);
   if (safeId === "" || safeId === "." || safeId === "..") {
     safeId = "run_unknown";
   }
-  return path16__default.default.join(baseDir, `${safeId}.jsonl`);
+  return path19__default.default.join(baseDir, `${safeId}.jsonl`);
 }
 function formatError(error) {
   if (error instanceof Error) {
@@ -928,7 +928,7 @@ var init_utils = __esm({
     init_duration();
     DEFAULT_TRACE_DIR_NAME = ".agent-inspect";
     RUNS_DIR_NAME = "runs";
-    FALLBACK_TRACE_DIR = path16__default.default.join(
+    FALLBACK_TRACE_DIR = path19__default.default.join(
       os__default.default.tmpdir(),
       "agent-inspect",
       RUNS_DIR_NAME
@@ -1723,7 +1723,7 @@ var init_trace_directory = __esm({
         this.#dir = resolveTraceDir(options);
       }
       getPath(filename) {
-        return filename ? path16__default.default.join(this.#dir, filename) : this.#dir;
+        return filename ? path19__default.default.join(this.#dir, filename) : this.#dir;
       }
       async list() {
         try {
@@ -1752,7 +1752,7 @@ function parseIsoToMs2(value) {
 }
 async function extractMetadata(filePath, _quickScan) {
   const stats = await promises.stat(filePath);
-  let runIdFromFile = path16__default.default.basename(filePath);
+  let runIdFromFile = path19__default.default.basename(filePath);
   if (runIdFromFile.endsWith(".jsonl")) {
     runIdFromFile = runIdFromFile.slice(0, -".jsonl".length);
   }
@@ -3562,12 +3562,12 @@ function buildCriticalPath(runs, handoffs) {
     handoffs.filter((edge) => edge.confidence === "explicit").map((edge) => edge.from)
   );
   const ordered = [...runs].sort(compareRuns);
-  const path23 = [];
+  const path25 = [];
   const visited = /* @__PURE__ */ new Set();
   const pushRun = (run, confidence, source) => {
     if (visited.has(run.runId)) return;
     visited.add(run.runId);
-    path23.push({
+    path25.push({
       runId: run.runId,
       name: run.name,
       startedAt: run.startedAt,
@@ -3592,7 +3592,7 @@ function buildCriticalPath(runs, handoffs) {
     const confidence = explicitTargets.has(run.runId) || explicitSources.has(run.runId) ? "explicit" : "correlated";
     pushRun(run, confidence, confidence === "explicit" ? "manual" : "inferred");
   }
-  return path23;
+  return path25;
 }
 function metaRunIdMatches(run, token, runById) {
   const meta2 = extractSessionWorkflowMetadata(run.metadata);
@@ -3732,6 +3732,224 @@ var init_trace_verification = __esm({
   }
 });
 
+// packages/core/src/bundle/resolve.ts
+function parseSinceCutoff(since) {
+  const trimmed = since.trim();
+  if (trimmed === "") {
+    throw new Error("--since requires a non-empty duration (e.g. 24h, 7d).");
+  }
+  return Date.now() - parseDuration(trimmed);
+}
+function runActivityMs(run) {
+  if (run.startedAt !== void 0 && Number.isFinite(run.startedAt)) return run.startedAt;
+  if (run.endedAt !== void 0 && Number.isFinite(run.endedAt)) return run.endedAt;
+  return void 0;
+}
+function runsInSinceWindow(runs, since) {
+  const cutoff = parseSinceCutoff(since);
+  const ids = [];
+  for (const run of runs) {
+    const activity = runActivityMs(run);
+    if (activity !== void 0 && activity >= cutoff) {
+      ids.push(run.runId);
+    }
+  }
+  return ids.sort((a, b) => a.localeCompare(b));
+}
+function findSession(index, sessionId) {
+  return index.sessions.find((session) => session.sessionId === sessionId);
+}
+function resolveBundleRunIds(index, runs, options) {
+  const runId = options.runId?.trim();
+  const sessionId = options.sessionId?.trim();
+  const since = options.since?.trim();
+  const modes = [runId ? 1 : 0, sessionId ? 1 : 0, since ? 1 : 0].reduce((a, b) => a + b, 0);
+  if (modes === 0) {
+    throw new Error(
+      "bundle requires a run id, --session <sessionId>, or --since <duration>."
+    );
+  }
+  if (modes > 1) {
+    throw new Error(
+      "bundle accepts only one target: a run id, --session, or --since (not combined)."
+    );
+  }
+  if (runId) {
+    const known = runs.some((run) => run.runId === runId);
+    if (!known) {
+      throw new Error(`Run "${runId}" was not found in the trace directory.`);
+    }
+    return { runIds: [runId] };
+  }
+  if (sessionId) {
+    const session = findSession(index, sessionId);
+    if (!session) {
+      throw new Error(`Session "${sessionId}" was not found.`);
+    }
+    if (session.runIds.length === 0) {
+      throw new Error(`Session "${sessionId}" has no runs to bundle.`);
+    }
+    return {
+      runIds: [...session.runIds].sort((a, b) => a.localeCompare(b)),
+      sessionId
+    };
+  }
+  const runIds = runsInSinceWindow(runs, since);
+  if (runIds.length === 0) {
+    throw new Error(`No runs matched --since ${since}.`);
+  }
+  return { runIds, since };
+}
+var init_resolve = __esm({
+  "packages/core/src/bundle/resolve.ts"() {
+    init_duration();
+  }
+});
+
+// packages/core/src/bundle/safety-status.ts
+function aggregateBundleSafeStatus(statuses) {
+  if (statuses.length === 0) return "UNKNOWN";
+  if (statuses.some((status) => status === "UNSAFE")) return "UNSAFE";
+  if (statuses.some((status) => status === "UNKNOWN")) return "UNKNOWN";
+  if (statuses.some((status) => status === "SAFE WITH WARNINGS")) return "SAFE WITH WARNINGS";
+  return "SAFE";
+}
+function toMetadataSafeStatus(status) {
+  if (status === "SAFE WITH WARNINGS") return "SAFE_WITH_WARNINGS";
+  return status;
+}
+function bundleFailsOnSafety(status, allowUnsafe) {
+  if (allowUnsafe) return false;
+  return status === "UNSAFE" || status === "UNKNOWN";
+}
+var init_safety_status = __esm({
+  "packages/core/src/bundle/safety-status.ts"() {
+  }
+});
+
+// packages/core/src/bundle/manifest.ts
+function buildBundleMetadata(parts) {
+  const aggregate = aggregateBundleSafeStatus(
+    parts.checks.runs.map((run) => run.status)
+  );
+  return {
+    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    agentInspectVersion: parts.agentInspectVersion,
+    redactionProfile: parts.profile,
+    sourceTraceCount: parts.resolve.runIds.length,
+    runIds: [...parts.resolve.runIds],
+    safeStatus: toMetadataSafeStatus(aggregate),
+    files: [...parts.files].sort((a, b) => a.localeCompare(b)),
+    note: BUNDLE_NOTE,
+    ...parts.resolve.sessionId !== void 0 ? { sessionId: parts.resolve.sessionId } : {},
+    ...parts.resolve.since !== void 0 ? { since: parts.resolve.since } : {}
+  };
+}
+function buildPlaceholderArtifact() {
+  return {
+    status: "not_requested",
+    note: PLACEHOLDER_NOTE
+  };
+}
+var BUNDLE_NOTE, PLACEHOLDER_NOTE;
+var init_manifest = __esm({
+  "packages/core/src/bundle/manifest.ts"() {
+    init_safety_status();
+    BUNDLE_NOTE = "Generated locally by AgentInspect. Bundles are derived copies for review \u2014 not compliance or security certification. Review before sharing.";
+    PLACEHOLDER_NOTE = "No eval or performance artifacts were requested for this bundle.";
+  }
+});
+
+// packages/core/src/bundle/summary.ts
+function markdownTable(rows) {
+  const lines = ["| Field | Value |", "| --- | --- |"];
+  for (const [key, value] of rows) {
+    lines.push(`| ${key} | ${value ?? "unknown"} |`);
+  }
+  return lines.join("\n");
+}
+function buildBundleSummaryMarkdown(parts) {
+  const { metadata, checks: checks2, redaction } = parts;
+  const lines = [
+    "# AgentInspect trace bundle",
+    "",
+    metadata.note,
+    "",
+    "## Overview",
+    "",
+    markdownTable([
+      ["Created", metadata.createdAt],
+      ["AgentInspect", metadata.agentInspectVersion],
+      ["Redaction profile", metadata.redactionProfile],
+      ["Safe status", metadata.safeStatus],
+      ["Source traces", metadata.sourceTraceCount],
+      ["Runs", metadata.runIds.join(", ")],
+      ...metadata.sessionId ? [["Session", metadata.sessionId]] : [],
+      ...metadata.since ? [["Since", metadata.since]] : []
+    ]),
+    "",
+    "## Safety checks",
+    "",
+    `Aggregate: **${checks2.aggregateStatus}**`,
+    ""
+  ];
+  for (const run of checks2.runs) {
+    lines.push(
+      `- \`${run.runId}\`: ${run.status} (${run.findings} finding(s), ${run.errors} error(s), ${run.warnings} warning(s))`
+    );
+  }
+  lines.push("", "## Redaction", "", `Total findings: ${redaction.totalFindings}`, "");
+  for (const run of redaction.runs) {
+    const detectors = run.detectors.length > 0 ? run.detectors.join(", ") : "none";
+    lines.push(`- \`${run.runId}\`: ${run.findings} finding(s); detectors: ${detectors}`);
+  }
+  lines.push(
+    "",
+    "## Files",
+    "",
+    ...metadata.files.map((file) => `- \`${file}\``),
+    "",
+    "_Review every generated artifact before sharing outside your team._",
+    ""
+  );
+  return lines.join("\n");
+}
+var init_summary = __esm({
+  "packages/core/src/bundle/summary.ts"() {
+  }
+});
+function normalizeBundleOutputPath(out) {
+  const trimmed = out.trim();
+  if (trimmed === "") {
+    throw new Error("--out requires a non-empty path.");
+  }
+  const resolved = path19__default.default.resolve(trimmed);
+  if (resolved.toLowerCase().endsWith(".zip")) {
+    return resolved.slice(0, -4);
+  }
+  return resolved;
+}
+function defaultBundleOutputPath(runIds) {
+  const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return path19__default.default.resolve(`agent-inspect-bundle-${label}-${stamp}`);
+}
+var init_paths = __esm({
+  "packages/core/src/bundle/paths.ts"() {
+  }
+});
+
+// packages/core/src/bundle/index.ts
+var init_bundle = __esm({
+  "packages/core/src/bundle/index.ts"() {
+    init_resolve();
+    init_manifest();
+    init_summary();
+    init_safety_status();
+    init_paths();
+  }
+});
+
 // packages/core/src/inspect-run.ts
 var init_inspect_run = __esm({
   "packages/core/src/inspect-run.ts"() {
@@ -3775,6 +3993,7 @@ var init_advanced = __esm({
     init_sessions();
     init_trace_verification();
     init_duration();
+    init_bundle();
     init_maybe_inspect_run();
   }
 });
@@ -3839,19 +4058,19 @@ var require_file_uri_to_path = __commonJS({
       var rest = decodeURI(uri.substring(7));
       var firstSlash = rest.indexOf("/");
       var host = rest.substring(0, firstSlash);
-      var path23 = rest.substring(firstSlash + 1);
+      var path25 = rest.substring(firstSlash + 1);
       if ("localhost" == host) host = "";
       if (host) {
         host = sep + sep + host;
       }
-      path23 = path23.replace(/^(.+)\|/, "$1:");
+      path25 = path25.replace(/^(.+)\|/, "$1:");
       if (sep == "\\") {
-        path23 = path23.replace(/\//g, "\\");
+        path25 = path25.replace(/\//g, "\\");
       }
-      if (/^.+\:/.test(path23)) ; else {
-        path23 = sep + path23;
+      if (/^.+\:/.test(path25)) ; else {
+        path25 = sep + path25;
       }
-      return host + path23;
+      return host + path25;
     }
   }
 });
@@ -3860,18 +4079,18 @@ var require_file_uri_to_path = __commonJS({
 var require_bindings = __commonJS({
   "node_modules/.pnpm/bindings@1.5.0/node_modules/bindings/bindings.js"(exports$1, module) {
     var fs = __require("fs");
-    var path23 = __require("path");
+    var path25 = __require("path");
     var fileURLToPath2 = require_file_uri_to_path();
-    var join = path23.join;
-    var dirname = path23.dirname;
-    var exists = fs.accessSync && function(path24) {
+    var join = path25.join;
+    var dirname = path25.dirname;
+    var exists = fs.accessSync && function(path26) {
       try {
-        fs.accessSync(path24);
+        fs.accessSync(path26);
       } catch (e) {
         return false;
       }
       return true;
-    } || fs.existsSync || path23.existsSync;
+    } || fs.existsSync || path25.existsSync;
     var defaults = {
       arrow: process.env.NODE_BINDINGS_ARROW || " \u2192 ",
       compiled: process.env.NODE_BINDINGS_COMPILED_DIR || "compiled",
@@ -3916,7 +4135,7 @@ var require_bindings = __commonJS({
       if (!opts.module_root) {
         opts.module_root = exports$1.getRoot(exports$1.getFileName());
       }
-      if (path23.extname(opts.bindings) != ".node") {
+      if (path25.extname(opts.bindings) != ".node") {
         opts.bindings += ".node";
       }
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
@@ -4151,7 +4370,7 @@ var require_pragma = __commonJS({
 var require_backup = __commonJS({
   "node_modules/.pnpm/better-sqlite3@11.10.0/node_modules/better-sqlite3/lib/methods/backup.js"(exports$1, module) {
     var fs = __require("fs");
-    var path23 = __require("path");
+    var path25 = __require("path");
     var { promisify } = __require("util");
     var { cppdb } = require_util();
     var fsAccess = promisify(fs.access);
@@ -4167,7 +4386,7 @@ var require_backup = __commonJS({
       if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
       if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
       if (handler != null && typeof handler !== "function") throw new TypeError('Expected the "progress" option to be a function');
-      await fsAccess(path23.dirname(filename)).catch(() => {
+      await fsAccess(path25.dirname(filename)).catch(() => {
         throw new TypeError("Cannot save backup because the directory does not exist");
       });
       const isNewFile = await fsAccess(filename).then(() => false, () => true);
@@ -4467,7 +4686,7 @@ var require_inspect = __commonJS({
 var require_database = __commonJS({
   "node_modules/.pnpm/better-sqlite3@11.10.0/node_modules/better-sqlite3/lib/database.js"(exports$1, module) {
     var fs = __require("fs");
-    var path23 = __require("path");
+    var path25 = __require("path");
     var util = require_util();
     var SqliteError = require_sqlite_error();
     var DEFAULT_ADDON;
@@ -4503,7 +4722,7 @@ var require_database = __commonJS({
         addon = DEFAULT_ADDON || (DEFAULT_ADDON = require_bindings()("better_sqlite3.node"));
       } else if (typeof nativeBinding === "string") {
         const requireFunc = typeof __non_webpack_require__ === "function" ? __non_webpack_require__ : __require;
-        addon = requireFunc(path23.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
+        addon = requireFunc(path25.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
       } else {
         addon = nativeBinding;
       }
@@ -4511,7 +4730,7 @@ var require_database = __commonJS({
         addon.setErrorConstructor(SqliteError);
         addon.isInitialized = true;
       }
-      if (!anonymous && !fs.existsSync(path23.dirname(filename))) {
+      if (!anonymous && !fs.existsSync(path25.dirname(filename))) {
         throw new TypeError("Cannot open database because the directory does not exist");
       }
       Object.defineProperties(this, {
@@ -4638,8 +4857,8 @@ GROUP BY session_id;
   }
 });
 function resolveIndexDbPath(traceDir, dbPath) {
-  if (dbPath && dbPath.trim() !== "") return path16__default.default.resolve(dbPath);
-  return path16__default.default.join(path16__default.default.resolve(traceDir), INDEX_DB_FILENAME);
+  if (dbPath && dbPath.trim() !== "") return path19__default.default.resolve(dbPath);
+  return path19__default.default.join(path19__default.default.resolve(traceDir), INDEX_DB_FILENAME);
 }
 function str(value) {
   return typeof value === "string" && value !== "" ? value : null;
@@ -4731,7 +4950,7 @@ async function buildIndex(options = {}) {
       warnings.push(`index.unreadable: ${file}`);
     }
   }
-  await promises.mkdir(path16__default.default.dirname(dbPath), { recursive: true });
+  await promises.mkdir(path19__default.default.dirname(dbPath), { recursive: true });
   await promises.rm(dbPath, { force: true });
   const db = new import_better_sqlite3.default(dbPath);
   let runCount = 0;
@@ -4969,7 +5188,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "4.2.0";
+var version = "4.3.0";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -5878,7 +6097,7 @@ function findReaderByFormat(format, readers) {
 }
 async function jsonlFilesInDirectory(dirPath) {
   const entries = await promises.readdir(dirPath, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path16__default.default.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path19__default.default.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
 }
 async function resolveInput(input3) {
   const cached = resolvedInputCache.get(input3);
@@ -9355,7 +9574,8 @@ function exportOpenInference(tree, options) {
   ];
   const traceId = hexFrom(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
-  const maxLen = options?.maxAttributeLength;
+  const maxLen = options?.maxAttributeLength ?? 500;
+  const pretty = options?.pretty ?? true;
   const spans = [];
   for (const n of flattenTree(tree)) {
     const ev = n.event;
@@ -9429,7 +9649,7 @@ function exportOpenInference(tree, options) {
   };
   return {
     format: "openinference",
-    content: JSON.stringify(payload, null, 2 ),
+    content: JSON.stringify(payload, null, pretty ? 2 : void 0),
     contentType: "application/json",
     fileExtension: ".openinference.json",
     warnings
@@ -9463,7 +9683,8 @@ function exportOtlpJson(tree, options) {
   ];
   const traceId = hexFrom2(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
-  const maxLen = options?.maxAttributeLength;
+  const maxLen = options?.maxAttributeLength ?? 500;
+  const pretty = options?.pretty ?? true;
   const flat = flattenTree(tree);
   const spans = [];
   for (const n of flat) {
@@ -9559,7 +9780,7 @@ function exportOtlpJson(tree, options) {
   };
   return {
     format: "otlp-json",
-    content: JSON.stringify(payload, null, 2 ),
+    content: JSON.stringify(payload, null, pretty ? 2 : void 0),
     contentType: "application/json",
     fileExtension: ".otlp.json",
     warnings
@@ -9782,9 +10003,9 @@ function mergeExportDefaults(options) {
     includeMetadata: options.includeMetadata ?? true,
     includeAttributes: options.includeAttributes ?? false,
     includeErrors: options.includeErrors ?? true,
-    pretty: options.pretty,
-    redacted: options.redacted,
-    maxAttributeLength: options.maxAttributeLength,
+    pretty: options.pretty ?? true,
+    redacted: options.redacted ?? true,
+    maxAttributeLength: options.maxAttributeLength ?? 500,
     redactionProfile: options.redactionProfile ?? "local"
   };
 }
@@ -10020,9 +10241,9 @@ Trace directory: ${traceDir}`);
   if (validation !== void 0 && !validation.ok) {
     process.exitCode = 1;
   }
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path16__default.default.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path19__default.default.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await promises.mkdir(path16__default.default.dirname(outPath), { recursive: true });
+    await promises.mkdir(path19__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
     console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
@@ -10202,13 +10423,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path23 = buildPath(segments);
+  const path25 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path23,
+      path: path25,
       left: L.name,
       right: R.name
     });
@@ -10218,7 +10439,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path23,
+      path: path25,
       left: L.type,
       right: R.type
     });
@@ -10228,7 +10449,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path23,
+      path: path25,
       left: L.status,
       right: R.status
     });
@@ -10240,7 +10461,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path23,
+      path: path25,
       left: le || void 0,
       right: re || void 0
     });
@@ -10258,7 +10479,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path23,
+        path: path25,
         left: ld,
         right: rd
       });
@@ -10271,7 +10492,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path23,
+      path: path25,
       left: L.metadata,
       right: R.metadata
     });
@@ -10283,7 +10504,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path23,
+      path: path25,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -10444,11 +10665,11 @@ function diffRuns(left, right, options) {
 
 // packages/core/src/diff/renderer.ts
 init_source();
-function formatPath(path23) {
-  if (path23 === void 0 || path23.path.length === 0) {
+function formatPath(path25) {
+  if (path25 === void 0 || path25.path.length === 0) {
     return "(run)";
   }
-  return path23.path.map((s) => s.name).join(" > ");
+  return path25.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -10835,7 +11056,7 @@ function indexedToMetadata(row, traceDir) {
     endedAt: row.endedAt ?? void 0,
     durationMs: row.durationMs ?? void 0,
     eventCount: 0,
-    filePath: path16__default.default.join(traceDir, row.file),
+    filePath: path19__default.default.join(traceDir, row.file),
     fileSize: 0,
     createdAt: new Date(row.mtimeMs)
   };
@@ -10899,7 +11120,7 @@ async function loadSessionIndex(traceDir, options = {}) {
     staleThresholdMs
   });
 }
-function findSession(index, sessionId) {
+function findSession2(index, sessionId) {
   return index.sessions.find((session) => session.sessionId === sessionId);
 }
 function latestSession(index) {
@@ -10908,12 +11129,12 @@ function latestSession(index) {
     (a, b) => Date.parse(b.lastActivity) - Date.parse(a.lastActivity)
   )[0];
 }
-function parseSinceCutoff(since) {
+function parseSinceCutoff2(since) {
   if (!since || since.trim() === "") return void 0;
   return Date.now() - parseDuration(since.trim());
 }
 function sessionsInSinceWindow(index, since) {
-  const cutoff = parseSinceCutoff(since);
+  const cutoff = parseSinceCutoff2(since);
   if (cutoff === void 0) return index.sessions;
   return index.sessions.filter(
     (session) => Date.parse(session.lastActivity) >= cutoff
@@ -11168,7 +11389,7 @@ async function sessionCommand(sessionId, options = {}) {
   try {
     const traceDir = resolveTraceDir({ dir: options.dir });
     const index = await loadSessionIndex(traceDir);
-    const session = findSession(index, id);
+    const session = findSession2(index, id);
     if (!session) {
       console.log(`Session not found: ${id}`);
       console.log(`Trace directory: ${traceDir}`);
@@ -11315,9 +11536,9 @@ async function reportCommand(runId, options = {}) {
     redactionProfile,
     correlation: !options.noCorrelation
   });
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path16__default.default.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path19__default.default.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await promises.mkdir(path16__default.default.dirname(outPath), { recursive: true });
+    await promises.mkdir(path19__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     console.log(`Wrote ${result.fileExtension} report to ${outPath}`);
   }
@@ -11567,17 +11788,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path23, key) {
+function childPath(path25, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path23 ? `${path23}.${key}` : key;
+    return path25 ? `${path25}.${key}` : key;
   }
-  return `${path23 || "$"}[${JSON.stringify(key)}]`;
+  return `${path25 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path23, index) {
-  return `${path23 || "$"}[${index}]`;
+function indexPath(path25, index) {
+  return `${path25 || "$"}[${index}]`;
 }
-function makeFinding(path23, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path23, detector, action, severity, matchKind } : { path: path23, detector, action, severity, matchKind, preview };
+function makeFinding(path25, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path25, detector, action, severity, matchKind } : { path: path25, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -11646,11 +11867,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path23, depth, state) {
+  #redactValue(value, key, path25, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path23, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path25, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -11659,19 +11880,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path23, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path25, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path23, key, value });
+      const detections = detector.detect({ path: path25, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path23,
+            path25,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -11689,7 +11910,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path23, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path25, index), depth + 1, state);
       });
       return out;
     }
@@ -11701,7 +11922,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path23 === "$" ? "" : path23, entryKey),
+          childPath(path25 === "$" ? "" : path25, entryKey),
           depth + 1,
           state
         );
@@ -11830,6 +12051,9 @@ function redactDocument(content, profile) {
     return redactJsonlText(content, profile);
   }
 }
+function redactTraceContent(content, profile) {
+  return redactDocument(content, profile);
+}
 async function redactCommand(target, options = {}, stdin = process.stdin) {
   const profile = parseRedactionProfile3(options.profile);
   const source = await contentFromTarget(target, options, stdin);
@@ -12158,14 +12382,14 @@ function uniqueSorted(values) {
   return [...new Set(values)].sort();
 }
 function isWithinDirectory(child, parent) {
-  const relative = path16__default.default.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path16__default.default.isAbsolute(relative);
+  const relative = path19__default.default.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path19__default.default.isAbsolute(relative);
 }
 async function resolveOutputPath(inputPath, output2, force) {
   if (output2 === void 0 || output2.trim() === "") return void 0;
-  const inputAbs = path16__default.default.resolve(inputPath);
-  const outputAbs = path16__default.default.resolve(output2.trim());
-  const inputDir = path16__default.default.dirname(inputAbs);
+  const inputAbs = path19__default.default.resolve(inputPath);
+  const outputAbs = path19__default.default.resolve(output2.trim());
+  const inputDir = path19__default.default.dirname(inputAbs);
   if (!isWithinDirectory(outputAbs, inputDir)) {
     throw new Error("Refusing to write migrated output outside the input directory.");
   }
@@ -12286,7 +12510,7 @@ async function migrateCommand(input3, options = {}) {
     process.exitCode = 1;
     return;
   }
-  const inputPath = path16__default.default.resolve(input3.trim());
+  const inputPath = path19__default.default.resolve(input3.trim());
   const dryRun = options.dryRun === true;
   if (!dryRun && (options.output === void 0 || options.output.trim() === "")) {
     console.error("migrate requires --dry-run or --output <path>.");
@@ -12305,7 +12529,7 @@ async function migrateCommand(input3, options = {}) {
     );
     const result = await buildMigration(inputPath, outputPath);
     if (!dryRun && outputPath !== void 0) {
-      await promises.mkdir(path16__default.default.dirname(outputPath), { recursive: true });
+      await promises.mkdir(path19__default.default.dirname(outputPath), { recursive: true });
       await promises.writeFile(outputPath, result.content, "utf-8");
     }
     printSummary2(result, dryRun);
@@ -12584,7 +12808,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path23) {
+function eventEvidence(event, path25) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -12594,7 +12818,7 @@ function eventEvidence(event, path23) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path23 ? { path: path23 } : {}
+    ...path25 ? { path: path25 } : {}
   };
 }
 function runEvidence(run) {
@@ -12657,9 +12881,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path23) {
-  const parts = path23.split(".");
-  return parts[parts.length - 1] ?? path23;
+function lastPathSegment(path25) {
+  const parts = path25.split(".");
+  return parts[parts.length - 1] ?? path25;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -12673,12 +12897,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path23, key, depth = 0) {
-  entries.push({ event, path: path23, key, value });
+function pushValueEntries(entries, event, value, path25, key, depth = 0) {
+  entries.push({ event, path: path25, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path23}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path25}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -12688,7 +12912,7 @@ function pushValueEntries(entries, event, value, path23, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path23}.${nestedKey}`,
+      `${path25}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -12769,9 +12993,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path23) => {
-    lines.push(`${path23}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path23}.${index}`));
+  const visit = (node, path25) => {
+    lines.push(`${path25}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path25}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -12820,9 +13044,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path23) {
+function firstEvidenceForKind(context, kind, path25) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path23)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path25)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -13172,13 +13396,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path23 = [];
+        const path25 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path23.slice(existing);
+            const cycle = path25.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -13194,8 +13418,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path23.length);
-          path23.push(current);
+          seenAt.set(current.eventId, path25.length);
+          path25.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -13992,23 +14216,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path23, evidence) {
+function validateSchemaField(value, field, path25, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path23, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path25, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path23, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path25, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path23}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path25}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -14335,7 +14559,7 @@ function asConfig(value) {
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
-  const extension = path16__default.default.extname(configPath);
+  const extension = path19__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
     throw new Error(
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -14344,7 +14568,7 @@ async function loadConfig(configPath) {
   if (!CONFIG_EXTENSIONS.has(extension)) {
     throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path16__default.default.resolve(configPath);
+  const absolute = path19__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
     return asConfig(JSON.parse(raw));
@@ -14493,10 +14717,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path23 = finding.evidence[0]?.path;
+    const path25 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path23 ? ` (${path23})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path25 ? ` (${path25})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -14699,7 +14923,7 @@ function createViewerServer(options = {}) {
         return sendJson(res, 200, {
           ok: true,
           readOnly: true,
-          traceDir: path16__default.default.resolve(traceDir)
+          traceDir: path19__default.default.resolve(traceDir)
         });
       }
       const td = new TraceDirectory({ dir: traceDir });
@@ -14717,7 +14941,7 @@ function createViewerServer(options = {}) {
             runId: meta2.runId,
             name: meta2.name,
             status: meta2.status,
-            file: path16__default.default.basename(meta2.filePath),
+            file: path19__default.default.basename(meta2.filePath),
             startedAt: meta2.startedAt,
             durationMs: meta2.durationMs
           }))
@@ -14832,7 +15056,7 @@ function startViewerServer(options = {}) {
       resolve({
         host,
         port: resolvedPort,
-        traceDir: path16__default.default.resolve(traceDir),
+        traceDir: path19__default.default.resolve(traceDir),
         url: `http://${host}:${resolvedPort}`
       });
     });
@@ -15037,10 +15261,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path23) {
-  return [{ runId: run.runId, ...path23 !== void 0 ? { path: path23 } : {} }];
+function evidenceForRun(run, path25) {
+  return [{ runId: run.runId, ...path25 !== void 0 ? { path: path25 } : {} }];
 }
-function evidenceForEvent(event, path23) {
+function evidenceForEvent(event, path25) {
   return [
     {
       runId: event.runId,
@@ -15048,7 +15272,7 @@ function evidenceForEvent(event, path23) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path23 !== void 0 ? { path: path23 } : {}
+      ...path25 !== void 0 ? { path: path25 } : {}
     }
   ];
 }
@@ -15206,9 +15430,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path23) {
+function firstEvidence(fields, run, path25) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path23) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path25) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -15585,8 +15809,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path23 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path23 ? ` (${path23})` : ""}`);
+      const path25 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path25 ? ` (${path25})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -15633,7 +15857,7 @@ function asConfig2(value) {
 }
 async function loadConfig2(configPath) {
   if (configPath === void 0) return {};
-  const extension = path16__default.default.extname(configPath);
+  const extension = path19__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error(
       "TypeScript eval configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -15642,7 +15866,7 @@ async function loadConfig2(configPath) {
   if (!CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error("Unsupported eval config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path16__default.default.resolve(configPath);
+  const absolute = path19__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
     return asConfig2(JSON.parse(raw));
@@ -15779,8 +16003,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path23 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path23 ? ` (${path23})` : ""}`);
+    const path25 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path25 ? ` (${path25})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -16018,8 +16242,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path23 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path23 ? ` (${path23})` : ""}`);
+    const path25 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path25 ? ` (${path25})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -16065,6 +16289,38 @@ function scanCommand(target, options = {}, stdin = process.stdin) {
 function verifySafeCommand(target, options = {}, stdin = process.stdin) {
   return safetyCommand("verify-safe", target, options, stdin);
 }
+function assessOpenedTrace(read, options = {}) {
+  try {
+    const rules = buildSafetyRules(options);
+    const checkResult = runTraceChecks(
+      { read },
+      {
+        rules,
+        ...options.runId !== void 0 ? { runId: options.runId } : {},
+        ...options.run !== void 0 ? { runId: options.run } : {}
+      }
+    );
+    const detectorFindings = checkResult.diagnostics.length === 0 ? redactionDetectorFindings(read, checkResult.runId) : [];
+    return resultFromParts({
+      command: "verify-safe",
+      format: checkResult.format,
+      runId: checkResult.runId,
+      findings: [...checkResult.findings, ...detectorFindings],
+      diagnostics: [
+        ...checkResult.diagnostics.map(diagnosticFromCheck),
+        ...warningDiagnostics(read.warnings, read.unsupportedFields)
+      ],
+      warnings: read.warnings,
+      unsupportedFields: read.unsupportedFields
+    });
+  } catch (error) {
+    return messageStartsWithDash(error) ? invalidArgumentResult("verify-safe", error) : readErrorResult3("verify-safe", error);
+  }
+}
+function messageStartsWithDash(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.startsWith("--");
+}
 var NOTE = "Generated locally by AgentInspect. Artifacts are best-effort summaries, not compliance or security certification.";
 var SAFETY_RULES = [
   createSafetyRawContentRule(),
@@ -16092,7 +16348,7 @@ function writeJson3(value) {
 function escapeHtml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
-function markdownTable(rows) {
+function markdownTable2(rows) {
   const lines = ["| Field | Value |", "| --- | --- |"];
   for (const [key, value] of rows) {
     lines.push(`| ${key} | ${value ?? "unknown"} |`);
@@ -16138,8 +16394,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path23 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path23})`);
+    const path25 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path25})`);
   }
   for (const diagnostic4 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic4.code}: ${diagnostic4.message}`);
@@ -16154,7 +16410,7 @@ function renderMarkdown(trace, check, diff) {
     "",
     "## Trace",
     "",
-    markdownTable([
+    markdownTable2([
       ["Format", trace.format],
       ["Run", trace.runId],
       ["Run status", trace.runStatus],
@@ -16217,8 +16473,8 @@ function renderHtml(trace, check, diff) {
 `;
 }
 async function writeArtifact(outputDir, relativePath, content, files) {
-  const outPath = path16__default.default.join(outputDir, relativePath);
-  await promises.mkdir(path16__default.default.dirname(outPath), { recursive: true });
+  const outPath = path19__default.default.join(outputDir, relativePath);
+  await promises.mkdir(path19__default.default.dirname(outPath), { recursive: true });
   await promises.writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -16234,7 +16490,7 @@ function manifestStatus(check, diff) {
   return "ok";
 }
 async function artifactsCommand(target, options = {}, stdin = process.stdin) {
-  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path16__default.default.resolve(options.outputDir.trim()) : "";
+  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path19__default.default.resolve(options.outputDir.trim()) : "";
   if (outputDir === "") {
     console.error("--output-dir is required.");
     process.exitCode = 1;
@@ -16300,8 +16556,8 @@ async function artifactsCommand(target, options = {}, stdin = process.stdin) {
   await writeArtifact(outputDir, "report.html", renderHtml(trace, check, diff), files);
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    await promises.mkdir(path16__default.default.dirname(path16__default.default.resolve(summaryTarget)), { recursive: true });
-    await promises.appendFile(path16__default.default.resolve(summaryTarget), `
+    await promises.mkdir(path19__default.default.dirname(path19__default.default.resolve(summaryTarget)), { recursive: true });
+    await promises.appendFile(path19__default.default.resolve(summaryTarget), `
 ${renderMarkdown(trace, check, diff)}`, "utf-8");
   }
   const manifestFiles = [...files, "manifest.json"].sort((a, b) => a.localeCompare(b));
@@ -16320,10 +16576,10 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
       findings: diff?.findings.length ?? 0,
       diagnostics: diff?.diagnostics.length ?? 0
     },
-    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path16__default.default.resolve(summaryTarget) } : {},
+    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path19__default.default.resolve(summaryTarget) } : {},
     note: NOTE
   };
-  await promises.writeFile(path16__default.default.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
+  await promises.writeFile(path19__default.default.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
   if (options.json === true) {
     console.log(writeJson3(manifest).trimEnd());
   } else {
@@ -16334,1573 +16590,1901 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
     }
   }
 }
-function validateReporterArtifactPath(options) {
-  const outputDir = path16__default.default.resolve(options.outputDir);
-  const diagnostics = [];
-  const rawPath = options.relativePath;
-  if (rawPath.length === 0) {
-    diagnostics.push({
-      code: "artifact_path_empty",
-      severity: "error",
-      message: "Reporter artifact path must not be empty."
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  if (rawPath.includes("\0")) {
-    diagnostics.push({
-      code: "invalid_artifact_path",
-      severity: "error",
-      message: "Reporter artifact path must not contain null bytes.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  if (path16__default.default.isAbsolute(rawPath) || path16__default.default.win32.isAbsolute(rawPath)) {
-    diagnostics.push({
-      code: "artifact_path_absolute",
-      severity: "error",
-      message: "Reporter artifact path must be relative.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  const normalized = path16__default.default.posix.normalize(rawPath.replace(/\\/g, "/"));
-  const segments = normalized.split("/");
-  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
-    diagnostics.push({
-      code: "artifact_path_escape",
-      severity: "error",
-      message: "Reporter artifact path must stay under the output directory.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  const absolutePath = path16__default.default.resolve(outputDir, normalized);
-  const relFromOutput = path16__default.default.relative(outputDir, absolutePath);
-  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path16__default.default.isAbsolute(relFromOutput)) {
-    diagnostics.push({
-      code: "artifact_path_escape",
-      severity: "error",
-      message: "Reporter artifact path resolved outside the output directory.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
+
+// packages/cli/src/bundle.ts
+init_advanced();
+
+// packages/core/src/workspace/types.ts
+var WORKSPACE_SCHEMA_VERSION = "1.0";
+var WORKSPACE_DIR_NAME = ".agent-inspect";
+var WORKSPACE_MANIFEST_FILENAME = "workspace.json";
+
+// packages/core/src/workspace/manifest.ts
+var DEFAULT_WORKSPACE_LAYOUT = {
+  traceDirs: ["runs"],
+  reportsDir: "reports",
+  artifactsDir: "artifacts",
+  bundlesDir: "bundles",
+  notesDir: "notes"
+};
+var DEFAULT_REDACTION_PROFILE = "share";
+var REDACTION_PROFILES = [
+  "local",
+  "share",
+  "strict"
+];
+var INDEX_TYPES = ["none", "sqlite", "custom"];
+var MAX_WORKSPACE_MANIFEST_BYTES = 64 * 1024;
+function createDefaultWorkspaceManifest(options) {
+  const project = typeof options.project === "string" ? options.project.trim() : "";
+  const index = {
+    enabled: options.index?.enabled ?? false,
+    type: options.index?.type ?? "none",
+    ...options.index?.path !== void 0 ? { path: options.index.path } : {}
+  };
   return {
-    ok: true,
-    outputDir,
-    relativePath: normalized,
-    absolutePath,
-    diagnostics
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    project,
+    createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    traceDirs: options.traceDirs ? [...options.traceDirs] : [...DEFAULT_WORKSPACE_LAYOUT.traceDirs],
+    reportsDir: options.reportsDir ?? DEFAULT_WORKSPACE_LAYOUT.reportsDir,
+    artifactsDir: options.artifactsDir ?? DEFAULT_WORKSPACE_LAYOUT.artifactsDir,
+    bundlesDir: options.bundlesDir ?? DEFAULT_WORKSPACE_LAYOUT.bundlesDir,
+    notesDir: options.notesDir ?? DEFAULT_WORKSPACE_LAYOUT.notesDir,
+    redactionProfile: options.redactionProfile ?? DEFAULT_REDACTION_PROFILE,
+    index
   };
 }
-
-// packages/cli/src/ci-summary.ts
-var NOTE2 = "Generated locally by AgentInspect from reporter artifact manifests. Trace contents are not embedded.";
-var MAX_TEXT = 180;
-var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "jest", "manual"]);
-var STATUSES = /* @__PURE__ */ new Set(["passed", "failed", "skipped", "todo"]);
-var ARTIFACT_KINDS = /* @__PURE__ */ new Set(["trace", "report", "eval", "redaction", "summary"]);
-var ARTIFACT_FORMATS = /* @__PURE__ */ new Set(["json", "jsonl", "md", "html"]);
-var REDACTION_PROFILES = /* @__PURE__ */ new Set(["local", "share", "strict"]);
-function stable6(value) {
-  if (Array.isArray(value)) return value.map(stable6);
-  if (value === null || typeof value !== "object") return value;
-  const record = value;
-  return Object.fromEntries(
-    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable6(record[key])])
-  );
-}
-function writeJson4(value) {
-  return `${JSON.stringify(stable6(value), null, 2)}
-`;
-}
-function isObject(value) {
+function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readString(value, label) {
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`${label} must be a non-empty string.`);
-  }
-  return safeText(value);
+function isSafeRelativeWorkspacePath(p) {
+  if (typeof p !== "string") return false;
+  const trimmed = p.trim();
+  if (trimmed === "") return false;
+  if (trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
+  if (/^[a-zA-Z]:/.test(trimmed)) return false;
+  const segments = trimmed.split(/[/\\]+/);
+  return !segments.some((seg) => seg === "..");
 }
-function readOptionalString(value) {
-  return typeof value === "string" && value.trim() !== "" ? safeText(value) : void 0;
-}
-function readFramework(value) {
-  const framework = readString(value, "manifest.framework");
-  if (!FRAMEWORKS.has(framework)) {
-    throw new Error(`Unsupported reporter framework: ${framework}.`);
+function validateDirField(value, field, errors) {
+  if (typeof value !== "string" || value.trim() === "") {
+    errors.push(`${field} must be a non-empty string`);
+    return;
   }
-  return framework;
-}
-function readStatus(value) {
-  const status = readString(value, "result.status");
-  if (!STATUSES.has(status)) {
-    throw new Error(`Unsupported reporter test status: ${status}.`);
+  if (!isSafeRelativeWorkspacePath(value)) {
+    errors.push(
+      `${field} must be a relative path inside the workspace (no absolute paths or ".." traversal)`
+    );
   }
-  return status;
 }
-function readArtifact(value, index) {
-  if (!isObject(value)) throw new Error(`manifest.artifacts[${index}] must be an object.`);
-  const kind = readString(value.kind, `manifest.artifacts[${index}].kind`);
-  const format = readString(value.format, `manifest.artifacts[${index}].format`);
-  const redactionProfile = readString(
-    value.redactionProfile,
-    `manifest.artifacts[${index}].redactionProfile`
-  );
-  if (!ARTIFACT_KINDS.has(kind)) throw new Error(`Unsupported artifact kind: ${kind}.`);
-  if (!ARTIFACT_FORMATS.has(format)) throw new Error(`Unsupported artifact format: ${format}.`);
-  if (!REDACTION_PROFILES.has(redactionProfile)) {
-    throw new Error(`Unsupported artifact redaction profile: ${redactionProfile}.`);
+function validateIndex(value, errors) {
+  if (!isPlainObject(value)) {
+    errors.push("index must be an object");
+    return void 0;
   }
-  const artifactPath = readString(value.path, `manifest.artifacts[${index}].path`);
-  const pathCheck = validateReporterArtifactPath({
-    outputDir: process.cwd(),
-    relativePath: artifactPath
-  });
-  if (!pathCheck.ok || pathCheck.relativePath === void 0) {
-    throw new Error(`Unsafe reporter artifact path: ${artifactPath}.`);
+  if (typeof value.enabled !== "boolean") {
+    errors.push("index.enabled must be a boolean");
   }
+  if (!INDEX_TYPES.includes(value.type)) {
+    errors.push(`index.type must be one of: ${INDEX_TYPES.join(", ")}`);
+  }
+  if (value.path !== void 0 && !isSafeRelativeWorkspacePath(value.path)) {
+    errors.push(
+      'index.path must be a relative path inside the workspace (no absolute paths or ".." traversal)'
+    );
+  }
+  if (errors.length > 0) return void 0;
   return {
-    kind,
-    path: pathCheck.relativePath,
-    format,
-    redactionProfile
-  };
-}
-function readArtifacts(value, label) {
-  if (value === void 0) return [];
-  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
-  return value.map((item, index) => readArtifact(item, index));
-}
-function readDiagnosticsCount(value, label) {
-  if (value === void 0) return 0;
-  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
-  return value.length;
-}
-function readResult(value, index) {
-  if (!isObject(value)) throw new Error(`manifest.results[${index}] must be an object.`);
-  const file = readOptionalString(value.file);
-  const tracePath = readOptionalString(value.tracePath);
-  return {
-    testId: readString(value.testId, `manifest.results[${index}].testId`),
-    name: readString(value.name, `manifest.results[${index}].name`),
-    ...file === void 0 ? {} : { file },
-    status: readStatus(value.status),
-    ...tracePath === void 0 ? {} : { tracePath },
-    artifacts: readArtifacts(value.artifacts, `manifest.results[${index}].artifacts`),
-    diagnostics: readDiagnosticsCount(
-      value.diagnostics,
-      `manifest.results[${index}].diagnostics`
-    )
+    enabled: value.enabled,
+    type: value.type,
+    ...value.path !== void 0 ? { path: value.path } : {}
   };
 }
-function readManifestDocument(value) {
-  if (!isObject(value)) throw new Error("Reporter manifest file must contain a JSON object.");
-  const candidate = isObject(value.manifest) ? value.manifest : value;
-  if (!isObject(candidate)) throw new Error("Reporter manifest must be a JSON object.");
-  const schemaVersion = readString(candidate.schemaVersion, "manifest.schemaVersion");
-  if (schemaVersion !== "0.1") {
-    throw new Error(`Unsupported reporter manifest schemaVersion: ${schemaVersion}.`);
+function validateWorkspaceManifest(input3) {
+  const errors = [];
+  const warnings = [];
+  if (!isPlainObject(input3)) {
+    return { ok: false, errors: ["manifest must be an object"], warnings };
   }
-  if (!Array.isArray(candidate.results)) {
-    throw new Error("manifest.results must be an array.");
+  if (input3.schemaVersion !== WORKSPACE_SCHEMA_VERSION) {
+    errors.push(
+      `schemaVersion must be "${WORKSPACE_SCHEMA_VERSION}" (received ${JSON.stringify(
+        input3.schemaVersion
+      )})`
+    );
+  }
+  if (typeof input3.project !== "string" || input3.project.trim() === "") {
+    errors.push("project must be a non-empty string");
+  }
+  if (typeof input3.createdAt !== "string" || input3.createdAt.trim() === "") {
+    errors.push("createdAt must be a non-empty ISO-8601 string");
+  } else if (Number.isNaN(Date.parse(input3.createdAt))) {
+    errors.push("createdAt must be a valid ISO-8601 date string");
+  }
+  if (!Array.isArray(input3.traceDirs) || input3.traceDirs.length === 0) {
+    errors.push("traceDirs must be a non-empty array");
+  } else {
+    input3.traceDirs.forEach((dir, i) => {
+      if (typeof dir !== "string" || dir.trim() === "") {
+        errors.push(`traceDirs[${i}] must be a non-empty string`);
+      } else if (!isSafeRelativeWorkspacePath(dir)) {
+        errors.push(
+          `traceDirs[${i}] must be a relative path inside the workspace (no absolute paths or ".." traversal)`
+        );
+      }
+    });
+  }
+  validateDirField(input3.reportsDir, "reportsDir", errors);
+  validateDirField(input3.artifactsDir, "artifactsDir", errors);
+  validateDirField(input3.bundlesDir, "bundlesDir", errors);
+  validateDirField(input3.notesDir, "notesDir", errors);
+  if (!REDACTION_PROFILES.includes(input3.redactionProfile)) {
+    errors.push(`redactionProfile must be one of: ${REDACTION_PROFILES.join(", ")}`);
+  }
+  const indexErrors = [];
+  const index = validateIndex(input3.index, indexErrors);
+  errors.push(...indexErrors);
+  if (index && index.type !== "none" && !index.enabled) {
+    warnings.push(`index.type is "${index.type}" but index.enabled is false`);
+  }
+  if (errors.length > 0 || index === void 0) {
+    return { ok: false, errors, warnings };
   }
-  const artifacts = readArtifacts(candidate.artifacts, "manifest.artifacts");
-  const results = candidate.results.map((item, index) => readResult(item, index));
-  const diagnostics = readDiagnosticsCount(candidate.diagnostics, "manifest.diagnostics");
   const manifest = {
-    framework: readFramework(candidate.framework),
-    generatedAt: readString(candidate.generatedAt, "manifest.generatedAt"),
-    results,
-    artifacts
-  };
-  return {
-    packageName: readOptionalString(value.package),
-    manifest,
-    diagnostics
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    project: input3.project.trim(),
+    createdAt: input3.createdAt,
+    traceDirs: input3.traceDirs.map((d) => d.trim()),
+    reportsDir: input3.reportsDir.trim(),
+    artifactsDir: input3.artifactsDir.trim(),
+    bundlesDir: input3.bundlesDir.trim(),
+    notesDir: input3.notesDir.trim(),
+    redactionProfile: input3.redactionProfile,
+    index
   };
+  return { ok: true, manifest, errors, warnings };
 }
-function cwdRelative(filePath) {
-  const relative = path16__default.default.relative(process.cwd(), path16__default.default.resolve(filePath)).replace(/\\/g, "/");
-  if (relative === "" || relative.startsWith("../") || path16__default.default.isAbsolute(relative)) {
-    return path16__default.default.basename(filePath);
+function parseWorkspaceManifest(json) {
+  const warnings = [];
+  if (typeof json !== "string") {
+    return { ok: false, errors: ["manifest input must be a string"], warnings };
   }
-  return relative;
+  if (json.length > MAX_WORKSPACE_MANIFEST_BYTES) {
+    return {
+      ok: false,
+      errors: [
+        `manifest exceeds maximum size of ${MAX_WORKSPACE_MANIFEST_BYTES} bytes`
+      ],
+      warnings
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return { ok: false, errors: ["manifest is not valid JSON"], warnings };
+  }
+  return validateWorkspaceManifest(parsed);
 }
-async function readReporterManifest(filePath) {
-  const absolute = path16__default.default.resolve(filePath);
-  const raw = await promises.readFile(absolute, "utf-8");
-  const document = readManifestDocument(JSON.parse(raw));
-  const manifest = document.manifest;
-  const results = manifest.results.map((result) => ({
-    testId: safeText(result.testId),
-    name: safeText(result.name),
-    ...result.file === void 0 ? {} : { file: safeText(path16__default.default.basename(result.file)) },
-    status: result.status,
-    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path16__default.default.basename(result.tracePath)) },
-    artifacts: result.artifacts,
-    diagnostics: result.diagnostics
-  }));
-  return {
-    ...document.packageName === void 0 ? {} : { packageName: document.packageName },
-    manifestFile: cwdRelative(absolute),
-    framework: manifest.framework,
-    generatedAt: manifest.generatedAt,
-    results,
-    artifacts: manifest.artifacts,
-    diagnostics: document.diagnostics
-  };
+function serializeWorkspaceManifest(manifest) {
+  return `${JSON.stringify(manifest, null, 2)}
+`;
 }
-function summarize3(manifests) {
-  const summary = {
-    manifests: manifests.length,
-    tests: 0,
-    failed: 0,
-    passed: 0,
-    skipped: 0,
-    todo: 0,
-    artifacts: 0,
-    diagnostics: 0
-  };
-  for (const manifest of manifests) {
-    summary.artifacts += manifest.artifacts.length;
-    summary.diagnostics += manifest.diagnostics;
-    for (const result of manifest.results) {
-      summary.tests += 1;
-      if (result.status === "failed") summary.failed += 1;
-      else if (result.status === "passed") summary.passed += 1;
-      else if (result.status === "skipped") summary.skipped += 1;
-      else summary.todo += 1;
-      summary.artifacts += result.artifacts.length;
-      summary.diagnostics += result.diagnostics;
-    }
-  }
+var INDEX_DIR_NAME = "index";
+function resolveWorkspaceLocation(cwd = process.cwd()) {
+  const projectRoot = path19__default.default.resolve(cwd);
+  const workspaceDir = path19__default.default.join(projectRoot, WORKSPACE_DIR_NAME);
   return {
-    status: summary.failed > 0 ? "failed" : summary.diagnostics > 0 ? "warning" : "ok",
-    manifests,
-    summary,
-    note: NOTE2
+    projectRoot,
+    workspaceDir,
+    manifestPath: path19__default.default.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
   };
 }
-function markdownCell(value) {
-  return safeText(String(value ?? "unknown")).replaceAll("|", "\\|").replace(/\r?\n/g, " ");
+function resolveInsideWorkspace(workspaceDir, relative) {
+  const base = path19__default.default.resolve(workspaceDir);
+  const resolved = path19__default.default.resolve(base, relative);
+  const rel = path19__default.default.relative(base, resolved);
+  if (rel === "" || rel === "." || !rel.startsWith("..") && !path19__default.default.isAbsolute(rel)) {
+    return resolved;
+  }
+  throw new Error(
+    `Workspace path "${relative}" resolves outside the workspace directory`
+  );
 }
-function renderMarkdown2(result) {
-  const lines = [
-    "# AgentInspect CI Summary",
-    "",
-    NOTE2,
-    "",
-    "| Field | Value |",
-    "| --- | --- |",
-    `| Status | ${result.status} |`,
-    `| Manifests | ${result.summary.manifests} |`,
-    `| Tests | ${result.summary.tests} |`,
-    `| Failed | ${result.summary.failed} |`,
-    `| Passed | ${result.summary.passed} |`,
-    `| Skipped | ${result.summary.skipped} |`,
-    `| Todo | ${result.summary.todo} |`,
-    `| Artifacts | ${result.summary.artifacts} |`,
-    `| Diagnostics | ${result.summary.diagnostics} |`,
-    "",
-    "## Tests",
-    "",
-    "| Framework | Status | Test | File | Trace | Artifacts |",
-    "| --- | --- | --- | --- | --- | --- |"
-  ];
-  const rows = result.manifests.flatMap(
-    (manifest) => manifest.results.map((test) => ({
-      framework: manifest.framework,
-      test
-    }))
-  );
-  if (rows.length === 0) {
-    lines.push("| unknown | unknown | No tests found | unknown | unknown | 0 |");
-  } else {
-    for (const row of rows) {
-      lines.push(
-        `| ${markdownCell(row.framework)} | ${markdownCell(row.test.status)} | ${markdownCell(row.test.name)} | ${markdownCell(row.test.file)} | ${markdownCell(row.test.tracePath)} | ${row.test.artifacts.length} |`
-      );
-    }
-  }
-  lines.push("", "## Manifests", "", "| Framework | File | Generated | Artifacts |", "| --- | --- | --- | --- |");
-  for (const manifest of result.manifests) {
-    lines.push(
-      `| ${markdownCell(manifest.framework)} | ${markdownCell(manifest.manifestFile)} | ${markdownCell(manifest.generatedAt)} | ${manifest.artifacts.length} |`
-    );
+async function pathExists(p) {
+  try {
+    await promises.access(p);
+    return true;
+  } catch {
+    return false;
   }
-  lines.push("", "## Artifacts", "", "| Framework | Kind | Path | Format | Profile |", "| --- | --- | --- | --- | --- |");
-  const artifacts = result.manifests.flatMap(
-    (manifest) => manifest.artifacts.map((artifact) => ({ framework: manifest.framework, artifact }))
-  );
-  if (artifacts.length === 0) {
-    lines.push("| unknown | unknown | No artifacts found | unknown | unknown |");
-  } else {
-    for (const row of artifacts) {
-      lines.push(
-        `| ${markdownCell(row.framework)} | ${markdownCell(row.artifact.kind)} | ${markdownCell(row.artifact.path)} | ${markdownCell(row.artifact.format)} | ${markdownCell(row.artifact.redactionProfile)} |`
-      );
-    }
+}
+async function isWritable(p) {
+  try {
+    await promises.access(p, fs.constants.W_OK);
+    return true;
+  } catch {
+    return false;
   }
-  lines.push("");
-  return `${lines.join("\n")}
-`;
 }
-function safeText(value) {
-  const compact = value.replace(/\s+/g, " ").trim();
-  const redacted = compact.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(
-    /\b(?:api[_-]?key|authorization|token|secret|password)\s*[:=]\s*[^,\s]+/gi,
-    "$1=[REDACTED]"
-  );
-  if (redacted.length <= MAX_TEXT) return redacted;
-  return `${redacted.slice(0, MAX_TEXT - 12)}...[truncated]`;
+async function listJsonl(dir) {
+  try {
+    const entries = await promises.readdir(dir);
+    return entries.filter((f) => f.endsWith(".jsonl"));
+  } catch {
+    return [];
+  }
 }
-async function ciSummaryCommand(manifestPaths, options = {}) {
-  if (manifestPaths.length === 0) {
-    console.error("At least one reporter manifest path is required.");
-    process.exitCode = 1;
-    return;
+async function countFiles(dir) {
+  try {
+    const entries = await promises.readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => e.isFile()).length;
+  } catch {
+    return 0;
   }
-  let result;
+}
+async function readWorkspaceManifestFile(location) {
+  let raw;
   try {
-    const manifests = [];
-    for (const manifestPath of manifestPaths) {
-      manifests.push(await readReporterManifest(manifestPath));
-    }
-    manifests.sort((a, b) => a.manifestFile.localeCompare(b.manifestFile));
-    result = summarize3(manifests);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error(`[AgentInspect] ci-summary failed: ${message}`);
-    process.exitCode = 1;
-    return;
+    raw = await promises.readFile(location.manifestPath, "utf-8");
+  } catch {
+    return { exists: false, ok: false, errors: ["workspace.json not found"], warnings: [] };
   }
-  const markdown = renderMarkdown2(result);
-  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path16__default.default.resolve(options.output.trim()) : void 0;
-  if (outputPath !== void 0) {
-    await promises.mkdir(path16__default.default.dirname(outputPath), { recursive: true });
-    await promises.writeFile(outputPath, markdown, "utf-8");
+  const parsed = parseWorkspaceManifest(raw);
+  return {
+    exists: true,
+    ok: parsed.ok,
+    ...parsed.manifest ? { manifest: parsed.manifest } : {},
+    errors: parsed.errors,
+    warnings: parsed.warnings
+  };
+}
+async function createWorkspace(options = {}) {
+  const location = resolveWorkspaceLocation(options.cwd);
+  const dryRun = options.dryRun === true;
+  const existing = await readWorkspaceManifestFile(location);
+  const topLevelTraces = await listJsonl(location.workspaceDir);
+  const detectedExistingTraces = topLevelTraces.length > 0;
+  let manifest;
+  let created;
+  let adopted;
+  if (existing.exists && existing.ok && existing.manifest) {
+    manifest = existing.manifest;
+    created = false;
+    adopted = true;
+  } else {
+    const project = options.project?.trim() || path19__default.default.basename(location.projectRoot) || "workspace";
+    const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
+    manifest = createDefaultWorkspaceManifest({
+      project,
+      traceDirs,
+      ...options.redactionProfile ? { redactionProfile: options.redactionProfile } : {}
+    });
+    created = true;
+    adopted = detectedExistingTraces || existing.exists && !existing.ok;
   }
-  const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
-  if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    const summaryPath = path16__default.default.resolve(summaryTarget);
-    await promises.mkdir(path16__default.default.dirname(summaryPath), { recursive: true });
-    await promises.appendFile(summaryPath, `
-${markdown}`, "utf-8");
+  const relDirs = uniqueDirs([
+    ...manifest.traceDirs.filter((d) => d !== "."),
+    manifest.reportsDir,
+    manifest.artifactsDir,
+    manifest.bundlesDir,
+    manifest.notesDir,
+    INDEX_DIR_NAME
+  ]);
+  const createdDirs = [];
+  for (const rel of relDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    if (await pathExists(abs)) continue;
+    createdDirs.push(rel);
+    if (!dryRun) await promises.mkdir(abs, { recursive: true });
   }
-  if (options.json === true) {
-    console.log(writeJson4(result).trimEnd());
-  } else if (outputPath !== void 0) {
-    console.log(`Wrote AgentInspect CI summary to ${outputPath}`);
-    console.log(`Status: ${result.status}`);
-  } else {
-    console.log(markdown.trimEnd());
+  if (!dryRun && created) {
+    await promises.mkdir(location.workspaceDir, { recursive: true });
+    await promises.writeFile(location.manifestPath, serializeWorkspaceManifest(manifest), "utf-8");
   }
+  return {
+    location,
+    manifest,
+    created,
+    adopted,
+    createdDirs,
+    detectedExistingTraces,
+    dryRun
+  };
 }
-var CONFIG_FILE = "agent-inspect.config.ts";
-var TRACE_DIR = ".agent-inspect";
-var GITKEEP = ".agent-inspect/.gitkeep";
-function normalizeFramework(value) {
-  const raw = (value ?? "custom").trim();
-  if (raw === "ai-sdk" || raw === "openai-agents" || raw === "langchain" || raw === "custom") {
-    return raw;
+function uniqueDirs(dirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const d of dirs) {
+    const t = d.trim();
+    if (t === "" || t === "." || seen.has(t)) continue;
+    seen.add(t);
+    out.push(t);
   }
-  throw new Error(
-    "Unsupported --framework value. Use ai-sdk, openai-agents, langchain, or custom."
-  );
+  return out;
 }
-function configTemplate(framework) {
-  const base = `/**
- * AgentInspect local config (metadata-only capture by default).
- * See https://github.com/rajudandigam/agent-inspect/blob/main/docs/SAFE-TRACE-SHARING.md
- */
-export const agentInspectConfig = {
-  traceDir: ".agent-inspect",
-  enabled: process.env.AGENT_INSPECT !== "0",
-  redactionProfile: "local" as const,
-};
-`;
-  if (framework === "custom") return base;
-  return `${base}
-export const framework = "${framework}" as const;
-`;
+async function getWorkspaceStatus(location, manifest) {
+  let traceFiles = 0;
+  for (const rel of manifest.traceDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    traceFiles += (await listJsonl(abs)).length;
+  }
+  const reports = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.reportsDir)
+  );
+  const artifacts = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.artifactsDir)
+  );
+  const bundles = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.bundlesDir)
+  );
+  const notes = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.notesDir)
+  );
+  const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
+  return {
+    project: manifest.project,
+    traceFiles,
+    reports,
+    artifacts,
+    bundles,
+    notes,
+    index: {
+      enabled: manifest.index.enabled,
+      type: manifest.index.type,
+      exists: await pathExists(indexPath2)
+    }
+  };
 }
-function demoTemplate(framework) {
-  switch (framework) {
-    case "ai-sdk":
-      return `/**
- * AI SDK starter \u2014 metadata-only telemetry (no real model calls in this demo).
- * Install: npm install agent-inspect @agent-inspect/ai-sdk ai
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("ai-sdk-demo", async () => {
-    await step.tool("mock-generate", async () => ({ text: "ok" }));
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
+async function doctorWorkspace(location) {
+  const checks2 = [];
+  const manifestResult = await readWorkspaceManifestFile(location);
+  if (!manifestResult.exists) {
+    checks2.push({
+      id: "manifest",
+      status: "fail",
+      message: "workspace.json not found (run `agent-inspect workspace init`)"
+    });
+    return { ok: false, checks: checks2 };
+  }
+  if (!manifestResult.ok || !manifestResult.manifest) {
+    checks2.push({
+      id: "manifest",
+      status: "fail",
+      message: `workspace.json is invalid: ${manifestResult.errors.join("; ")}`
+    });
+    return { ok: false, checks: checks2 };
+  }
+  const manifest = manifestResult.manifest;
+  checks2.push({ id: "manifest", status: "pass", message: "workspace.json is valid" });
+  for (const warning of manifestResult.warnings) {
+    checks2.push({ id: "manifest-warning", status: "warn", message: warning });
+  }
+  const dirFields = [
+    ...manifest.traceDirs.filter((d) => d !== ".").map((d, i) => [`traceDir[${i}]`, d]),
+    ["reportsDir", manifest.reportsDir],
+    ["artifactsDir", manifest.artifactsDir],
+    ["bundlesDir", manifest.bundlesDir],
+    ["notesDir", manifest.notesDir]
+  ];
+  for (const [id, rel] of dirFields) {
+    let abs;
+    try {
+      abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    } catch (error) {
+      checks2.push({
+        id,
+        status: "fail",
+        message: error instanceof Error ? error.message : String(error)
+      });
+      continue;
+    }
+    if (!await pathExists(abs)) {
+      checks2.push({ id, status: "warn", message: `${rel}/ does not exist yet` });
+    } else if (!await isWritable(abs)) {
+      checks2.push({ id, status: "fail", message: `${rel}/ is not writable` });
+    } else {
+      checks2.push({ id, status: "pass", message: `${rel}/ is present and writable` });
+    }
+  }
+  let newestTraceMtime = 0;
+  for (const rel of manifest.traceDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    for (const file of await listJsonl(abs)) {
+      try {
+        const s = await promises.stat(path19__default.default.join(abs, file));
+        newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
+      } catch {
+        checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
+      }
+    }
+  }
+  if (manifest.index.enabled) {
+    const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
+    if (!await pathExists(indexPath2)) {
+      checks2.push({ id: "index", status: "warn", message: "index enabled but not built" });
+    } else {
+      try {
+        const s = await promises.stat(indexPath2);
+        if (newestTraceMtime > s.mtimeMs) {
+          checks2.push({ id: "index", status: "warn", message: "index is stale (traces are newer)" });
+        } else {
+          checks2.push({ id: "index", status: "pass", message: "index is present" });
+        }
+      } catch {
+        checks2.push({ id: "index", status: "warn", message: "cannot stat index" });
+      }
+    }
+  }
+  const ok = !checks2.some((c) => c.status === "fail");
+  return { ok, checks: checks2 };
 }
-
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
-`;
-    case "openai-agents":
-      return `/**
- * OpenAI Agents starter \u2014 use @agent-inspect/openai-agents for local-only processors.
- * This demo uses manual steps (no API keys).
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("openai-agents-demo", async () => {
-    await step.tool("mock-agent-run", async () => "ok");
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
+async function cleanWorkspace(location, manifest, options = {}) {
+  const dryRun = options.confirm !== true;
+  const targets = uniqueDirs([
+    manifest.reportsDir,
+    manifest.artifactsDir,
+    manifest.bundlesDir,
+    manifest.index.path ?? INDEX_DIR_NAME
+  ]);
+  const removed = [];
+  for (const rel of targets) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    let entries;
+    try {
+      entries = await promises.readdir(abs);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const relPath = `${rel}/${entry}`;
+      removed.push(relPath);
+      if (!dryRun) {
+        await promises.rm(path19__default.default.join(abs, entry), { recursive: true, force: true });
+      }
+    }
+  }
+  return { dryRun, removed };
 }
 
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
-`;
-    case "langchain":
-      return `/**
- * LangChain starter \u2014 wire @agent-inspect/langchain callbacks in your app.
- * This demo uses manual steps (no API keys).
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("langchain-demo", async () => {
-    await step.tool("mock-chain", async () => "ok");
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
+// packages/cli/src/bundle.ts
+var BUNDLE_NOTE2 = "Generated locally by AgentInspect. Bundles are derived copies for review \u2014 not compliance or security certification.";
+function stable6(value) {
+  if (Array.isArray(value)) return value.map(stable6);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable6(record[key])])
+  );
 }
-
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
+function writeJson4(value) {
+  return `${JSON.stringify(stable6(value), null, 2)}
 `;
-    default:
-      return `import { observe } from "agent-inspect";
-
-class DemoAgent {
-  async run(input: { question: string }) {
-    return { answer: \`Echo: \${input.question}\` };
-  }
 }
-
-const agent = observe(new DemoAgent(), {
-  traceDir: ".agent-inspect",
-  silent: true,
-});
-
-await agent.run({ question: "hello" });
-console.log("Trace written to .agent-inspect/");
-`;
+function parseBundleProfile(value) {
+  if (value === void 0 || value === "local" || value === "share" || value === "strict") {
+    return value ?? "share";
   }
+  throw new Error(`Unsupported --profile "${value}". Use local, share, or strict.`);
 }
-function githubWorkflowTemplate() {
-  return `name: AgentInspect artifacts
-
-on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-
-jobs:
-  trace-artifacts:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-      - run: npm ci
-      - run: npm test
-      - name: Upload AgentInspect traces
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: agent-inspect-traces
-          path: .agent-inspect/**/*.jsonl
-          if-no-files-found: ignore
-`;
+function toReportProfile(profile) {
+  return profile;
 }
-async function planInit(options = {}) {
-  const framework = normalizeFramework(options.framework);
-  const cwd = path16__default.default.resolve(options.cwd ?? process.cwd());
-  const demoPath = framework === "custom" ? path16__default.default.join("examples", "agent-inspect-demo.mjs") : path16__default.default.join("examples", `agent-inspect-${framework}-demo.mjs`);
-  const candidates = [
-    { rel: CONFIG_FILE, content: configTemplate(framework) },
-    { rel: GITKEEP, content: "" },
-    { rel: demoPath, content: demoTemplate(framework) }
-  ];
-  if (options.ci === "github") {
-    candidates.push({
-      rel: ".github/workflows/agent-inspect-artifacts.yml",
-      content: githubWorkflowTemplate()
-    });
+function escapeHtml3(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function safetyStatusFromAssess(status) {
+  if (status === "SAFE" || status === "SAFE WITH WARNINGS" || status === "UNSAFE" || status === "UNKNOWN") {
+    return status;
   }
-  const files = [];
-  for (const candidate of candidates) {
-    const abs = path16__default.default.join(cwd, candidate.rel);
+  return "UNKNOWN";
+}
+async function resolveOutputDir(options, runIds, cwd) {
+  if (options.out !== void 0 && options.out.trim() !== "") {
+    const normalized = normalizeBundleOutputPath(options.out);
     try {
-      await promises.access(abs);
-      files.push({
-        path: candidate.rel,
-        action: "skip",
-        reason: "file already exists"
-      });
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      files.push({ path: candidate.rel, action: "create" });
+      const location = resolveWorkspaceLocation(cwd);
+      const manifest = await readWorkspaceManifestFile(location);
+      if (manifest.ok && manifest.manifest) {
+        const rel = path19__default.default.relative(location.workspaceDir, normalized);
+        if (!rel.startsWith("..") && !path19__default.default.isAbsolute(rel)) {
+          return resolveInsideWorkspace(location.workspaceDir, rel);
+        }
+      }
+    } catch {
     }
+    return normalized;
   }
-  return { framework, ...options.ci ? { ci: options.ci } : {}, files };
-}
-async function writePlannedFiles(plan, cwd, options) {
-  const written = [];
-  for (const entry of plan.files) {
-    if (entry.action === "skip") {
-      continue;
-    }
-    const abs = path16__default.default.join(cwd, entry.path);
-    if (options.dryRun) {
-      written.push(entry.path);
-      continue;
+  try {
+    const location = resolveWorkspaceLocation(cwd);
+    const manifest = await readWorkspaceManifestFile(location);
+    if (manifest.ok && manifest.manifest) {
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
+      return resolveInsideWorkspace(
+        location.workspaceDir,
+        path19__default.default.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
+      );
     }
-    await promises.mkdir(path16__default.default.dirname(abs), { recursive: true });
-    const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
-    await promises.writeFile(abs, content, "utf-8");
-    written.push(entry.path);
+  } catch {
   }
-  return written;
+  return defaultBundleOutputPath(runIds);
 }
-async function initCommand(options = {}) {
-  const cwd = path16__default.default.resolve(options.cwd ?? process.cwd());
-  try {
-    const plan = await planInit({ ...options, cwd });
-    const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
-    const skipped = plan.files.filter((file) => file.action === "skip");
+async function writeBundleFile(outputDir, relativePath, content, files) {
+  const outPath = path19__default.default.join(outputDir, relativePath);
+  await promises.mkdir(path19__default.default.dirname(outPath), { recursive: true });
+  await promises.writeFile(outPath, content, "utf-8");
+  files.push(relativePath);
+}
+function renderBundleIndexHtml(parts) {
+  const links = parts.runIds.map(
+    (runId) => `<li><a href="assets/runs/${escapeHtml3(runId)}.html">${escapeHtml3(runId)}</a></li>`
+  ).join("");
+  const sections = parts.runIds.map((runId) => {
+    const html = parts.reports.get(runId) ?? "";
+    return `<section id="run-${escapeHtml3(runId)}"><h2>${escapeHtml3(runId)}</h2>${html}</section>`;
+  }).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>AgentInspect Bundle</title>
+<style>
+body{font-family:system-ui,sans-serif;line-height:1.5;margin:1.5rem;max-width:960px;color:#111}
+a{color:#0366d6}
+section{border-top:1px solid #ddd;margin-top:1.5rem;padding-top:1rem}
+</style>
+</head>
+<body>
+<h1>AgentInspect trace bundle</h1>
+<p>${escapeHtml3(BUNDLE_NOTE2)}</p>
+<h2>Runs</h2>
+<ul>${links}</ul>
+${sections}
+</body>
+</html>
+`;
+}
+function extractHtmlBody(content) {
+  const match = content.match(/<body[^>]*>([\s\S]*)<\/body>/i);
+  return match?.[1]?.trim() ?? content;
+}
+async function bundleCommand(runIdArg, options = {}) {
+  const profile = parseBundleProfile(options.profile);
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const cwd = process.cwd();
+  let resolveResult;
+  try {
+    const { runs } = await loadSessionRuns(traceDir);
+    const staleThresholdMs = options.staleAfter && options.staleAfter.trim() !== "" ? parseDuration(options.staleAfter.trim()) : void 0;
+    const index = buildSessionIndex(runs, {
+      correlateByGroupId: options.correlateGroup === true,
+      staleThresholdMs
+    });
+    resolveResult = resolveBundleRunIds(index, runs, {
+      ...runIdArg !== void 0 && runIdArg.trim() !== "" ? { runId: runIdArg.trim() } : {},
+      ...options.session ? { sessionId: options.session } : {},
+      ...options.since ? { since: options.since } : {}
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
     if (options.json) {
-      const payload = {
-        ok: true,
-        version,
-        framework: plan.framework,
-        ci: plan.ci ?? null,
-        dryRun: options.dryRun === true,
-        planned: plan.files,
-        wouldWrite: options.dryRun ? toWrite : void 0
-      };
-      console.log(JSON.stringify(payload, null, 2));
-      if (options.dryRun) return;
+      console.log(writeJson4({ ok: false, error: message }).trimEnd());
+    } else {
+      console.error(`[AgentInspect] bundle failed: ${message}`);
     }
-    const written = await writePlannedFiles(plan, cwd, options);
-    if (!options.json) {
-      console.log("AgentInspect init");
-      console.log(`Framework: ${plan.framework}`);
-      console.log(`Trace directory: ${TRACE_DIR}/`);
-      if (options.dryRun) {
-        console.log("Dry run \u2014 would create:");
-        for (const file of toWrite) console.log(`- ${file}`);
-        for (const file of skipped) {
-          console.log(`- ${file.path} (skip: ${file.reason ?? "exists"})`);
-        }
-        return;
+    process.exitCode = 1;
+    return;
+  }
+  const outputDir = await resolveOutputDir(options, resolveResult.runIds, cwd);
+  const files = [];
+  const checkRuns = [];
+  const redactionRuns = [];
+  const htmlByRun = /* @__PURE__ */ new Map();
+  const redactedJsonlByRun = /* @__PURE__ */ new Map();
+  let combinedJsonl = "";
+  for (const runId of resolveResult.runIds) {
+    const tracePath = getTraceFilePath(runId, traceDir);
+    let rawContent;
+    let sourceMtimeMs;
+    try {
+      rawContent = await promises.readFile(tracePath, "utf-8");
+      sourceMtimeMs = (await promises.stat(tracePath)).mtimeMs;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message, runId }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
       }
-      console.log("Created:");
-      for (const file of written) console.log(`- ${file}`);
-      for (const file of skipped) {
-        console.log(`- ${file.path} (skipped: ${file.reason ?? "exists"})`);
+      process.exitCode = 1;
+      return;
+    }
+    let read;
+    try {
+      read = await openTrace(
+        { type: "file", path: tracePath },
+        { format: "agent-inspect-jsonl" }
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message, runId }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
       }
-      console.log("\nNext: run your demo, then `npx agent-inspect list --dir .agent-inspect`");
-      console.log("No dependencies were installed. Add packages manually when ready.");
+      process.exitCode = 1;
+      return;
     }
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
+    const safety = assessOpenedTrace(read, { run: runId });
+    const status = safetyStatusFromAssess(safety.status);
+    checkRuns.push({
+      runId,
+      status,
+      errors: safety.summary.errors,
+      warnings: safety.summary.warnings,
+      findings: safety.summary.findings
+    });
+    const redacted = redactTraceContent(rawContent, toReportProfile(profile));
+    redactedJsonlByRun.set(runId, redacted.content);
+    combinedJsonl += redacted.content.endsWith("\n") ? redacted.content : `${redacted.content}
+`;
+    const detectors = [
+      ...new Set(redacted.findings.map((finding) => finding.detector))
+    ].sort((a, b) => a.localeCompare(b));
+    redactionRuns.push({
+      runId,
+      findings: redacted.findings.length,
+      detectors
+    });
+    const selected = read.runs.find((run) => run.runId === runId);
+    const runReport = exportRunTree(selected ?? read.runs[0], {
+      format: "html",
+      redacted: true,
+      redactionProfile: toReportProfile(profile)
+    });
+    htmlByRun.set(runId, extractHtmlBody(runReport.content));
+    const afterMtime = (await promises.stat(tracePath)).mtimeMs;
+    if (afterMtime !== sourceMtimeMs) {
+      const message = `Source trace "${runId}" was modified during bundle creation.`;
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const checks2 = {
+    aggregateStatus: aggregateBundleSafeStatus(checkRuns.map((run) => run.status)),
+    runs: checkRuns
+  };
+  if (bundleFailsOnSafety(checks2.aggregateStatus, options.allowUnsafe === true)) {
     if (options.json) {
-      console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+      console.log(
+        writeJson4({
+          ok: false,
+          error: `Bundle safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`,
+          checks: checks2
+        }).trimEnd()
+      );
     } else {
-      console.error(`[AgentInspect] init failed: ${msg}`);
+      console.error(
+        `[AgentInspect] bundle refused: safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`
+      );
     }
     process.exitCode = 1;
+    return;
   }
-}
-var OPTIONAL_PACKAGES = {
-  custom: [],
-  "ai-sdk": ["@agent-inspect/ai-sdk"],
-  "openai-agents": ["@agent-inspect/openai-agents"],
-  langchain: ["@agent-inspect/langchain"]
-};
-function nodeVersionCheck() {
-  const major = Number(process3__default.default.versions.node.split(".")[0]);
-  if (Number.isNaN(major) || major < 20) {
-    return {
-      id: "node-version",
-      status: "fail",
-      message: `Node ${process3__default.default.versions.node} is below the supported minimum (20).`,
-      remediation: "Upgrade to Node 20 LTS or newer.",
-      evidence: process3__default.default.versions.node
-    };
-  }
-  return {
-    id: "node-version",
-    status: "pass",
-    message: `Node ${process3__default.default.versions.node} meets the minimum (>=20).`,
-    evidence: process3__default.default.versions.node
+  const redactionReport = {
+    profile,
+    totalFindings: redactionRuns.reduce((sum, run) => sum + run.findings, 0),
+    runs: redactionRuns
   };
-}
-function envCheck(name, optional = true) {
-  const value = process3__default.default.env[name];
-  if (value === void 0 || value.trim() === "") {
-    return {
-      id: `env-${name.toLowerCase()}`,
-      status: optional ? "skipped" : "warn",
-      message: `${name} is not set.`,
-      remediation: optional ? void 0 : `Set ${name}=1 to enable tracing.`
-    };
+  await promises.mkdir(outputDir, { recursive: true });
+  for (const runId of resolveResult.runIds) {
+    const jsonl = redactedJsonlByRun.get(runId) ?? "";
+    await writeBundleFile(outputDir, `assets/runs/${runId}.jsonl`, jsonl, files);
+    const html = htmlByRun.get(runId) ?? "";
+    await writeBundleFile(
+      outputDir,
+      `assets/runs/${runId}.html`,
+      runReportWrap(html, runId),
+      files
+    );
   }
-  return {
-    id: `env-${name.toLowerCase()}`,
-    status: "pass",
-    message: `${name} is set.`,
-    evidence: value
-  };
-}
-async function traceDirWritable(traceDir) {
-  const resolved = path16__default.default.resolve(traceDir);
-  try {
-    await promises.mkdir(resolved, { recursive: true });
-    await promises.access(resolved, promises.constants.W_OK);
-    return {
-      id: "trace-dir-writable",
-      status: "pass",
-      message: `Trace directory is writable: ${resolved}`,
-      evidence: resolved
-    };
-  } catch (error) {
-    return {
-      id: "trace-dir-writable",
-      status: "fail",
-      message: `Trace directory is not writable: ${resolved}`,
-      remediation: "Create the directory or set AGENT_INSPECT_TRACE_DIR to a writable path.",
-      evidence: error instanceof Error ? error.message : String(error)
-    };
+  const primaryRunId = resolveResult.runIds[0];
+  const traceHtml = resolveResult.runIds.length === 1 ? runReportWrap(htmlByRun.get(primaryRunId) ?? "", primaryRunId) : renderBundleIndexHtml({ runIds: resolveResult.runIds, reports: htmlByRun });
+  await writeBundleFile(outputDir, "trace.jsonl", combinedJsonl, files);
+  await writeBundleFile(outputDir, "trace.html", traceHtml, files);
+  await writeBundleFile(
+    outputDir,
+    "check-results.json",
+    writeJson4(checks2),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "eval-results.json",
+    writeJson4(buildPlaceholderArtifact()),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "redaction-report.json",
+    writeJson4(redactionReport),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "performance-summary.json",
+    writeJson4(buildPlaceholderArtifact()),
+    files
+  );
+  const metadata = buildBundleMetadata({
+    agentInspectVersion: version,
+    profile,
+    resolve: resolveResult,
+    checks: checks2,
+    files: [...files]
+  });
+  await writeBundleFile(outputDir, "metadata.json", writeJson4(metadata), files);
+  await writeBundleFile(
+    outputDir,
+    "summary.md",
+    buildBundleSummaryMarkdown({ metadata, checks: checks2, redaction: redactionReport }),
+    files
+  );
+  metadata.files = [...files].sort((a, b) => a.localeCompare(b));
+  await promises.writeFile(path19__default.default.join(outputDir, "metadata.json"), writeJson4(metadata), "utf-8");
+  if (options.json) {
+    console.log(
+      writeJson4({
+        ok: true,
+        outputDir,
+        metadata,
+        checks: checks2,
+        redaction: redactionReport
+      }).trimEnd()
+    );
+    return;
   }
+  console.log(`Bundle written to ${outputDir}`);
+  console.log(`Safe status: ${metadata.safeStatus}`);
+  console.log(`Runs: ${resolveResult.runIds.join(", ")}`);
+  console.log(`Files: ${metadata.files.length}`);
 }
-function resolvePackage(cwd, name) {
-  const require2 = module$1.createRequire(path16__default.default.join(cwd, "package.json"));
-  try {
-    const pkgPath = require2.resolve(`${name}/package.json`);
-    const pkg = require2(pkgPath);
-    return { ok: true, version: pkg.version };
-  } catch {
-    return { ok: false };
-  }
+function runReportWrap(body, runId) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>AgentInspect \u2014 ${escapeHtml3(runId)}</title>
+<style>body{font-family:system-ui,sans-serif;line-height:1.5;margin:1.5rem;max-width:960px;color:#111}</style>
+</head>
+<body>
+${body}
+</body>
+</html>
+`;
 }
-function importSmoke(cwd) {
-  const results = [];
-  const require2 = module$1.createRequire(path16__default.default.join(cwd, "package.json"));
-  try {
-    require2.resolve("agent-inspect");
-    results.push({
-      id: "import-agent-inspect",
-      status: "pass",
-      message: "agent-inspect resolves from the current project."
+function validateReporterArtifactPath(options) {
+  const outputDir = path19__default.default.resolve(options.outputDir);
+  const diagnostics = [];
+  const rawPath = options.relativePath;
+  if (rawPath.length === 0) {
+    diagnostics.push({
+      code: "artifact_path_empty",
+      severity: "error",
+      message: "Reporter artifact path must not be empty."
     });
-  } catch {
-    results.push({
-      id: "import-agent-inspect",
-      status: "warn",
-      message: "agent-inspect is not installed in the current project.",
-      remediation: "Run npm install agent-inspect (or pnpm add agent-inspect)."
+    return { ok: false, outputDir, diagnostics };
+  }
+  if (rawPath.includes("\0")) {
+    diagnostics.push({
+      code: "invalid_artifact_path",
+      severity: "error",
+      message: "Reporter artifact path must not contain null bytes.",
+      target: rawPath
     });
+    return { ok: false, outputDir, diagnostics };
   }
-  try {
-    require2.resolve("agent-inspect/package.json");
-    results.push({
-      id: "import-agent-inspect-cjs",
-      status: "pass",
-      message: "CJS resolution for agent-inspect succeeded."
+  if (path19__default.default.isAbsolute(rawPath) || path19__default.default.win32.isAbsolute(rawPath)) {
+    diagnostics.push({
+      code: "artifact_path_absolute",
+      severity: "error",
+      message: "Reporter artifact path must be relative.",
+      target: rawPath
     });
-  } catch {
-    results.push({
-      id: "import-agent-inspect-cjs",
-      status: "skipped",
-      message: "CJS resolution check skipped (package not installed locally)."
+    return { ok: false, outputDir, diagnostics };
+  }
+  const normalized = path19__default.default.posix.normalize(rawPath.replace(/\\/g, "/"));
+  const segments = normalized.split("/");
+  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path must stay under the output directory.",
+      target: rawPath
     });
+    return { ok: false, outputDir, diagnostics };
   }
-  return results;
-}
-function optionalPackageChecks(cwd, framework) {
-  const packages = framework !== void 0 ? OPTIONAL_PACKAGES[framework] : [
-    "@agent-inspect/ai-sdk",
-    "@agent-inspect/openai-agents",
-    "@agent-inspect/langchain",
-    "@agent-inspect/redact",
-    "@agent-inspect/eval"
-  ];
-  return packages.map((name) => {
-    const resolved = resolvePackage(cwd, name);
-    if (!resolved.ok) {
-      return {
-        id: `optional-package-${name}`,
-        status: framework !== void 0 ? "warn" : "skipped",
-        message: `${name} is not installed.`,
-        remediation: framework !== void 0 ? `npm install ${name}` : void 0
-      };
-    }
-    return {
-      id: `optional-package-${name}`,
-      status: "pass",
-      message: `${name} is available.`,
-      evidence: resolved.version
-    };
-  });
-}
-function versionMismatchCheck(cwd) {
-  const root = resolvePackage(cwd, "agent-inspect");
-  if (!root.ok || root.version === void 0) {
-    return {
-      id: "version-alignment",
-      status: "skipped",
-      message: "Skipped version alignment \u2014 agent-inspect not installed locally."
-    };
-  }
-  if (root.version !== version) {
-    return {
-      id: "version-alignment",
-      status: "warn",
-      message: `CLI version ${version} differs from local agent-inspect@${root.version}.`,
-      remediation: "Align versions with npm install agent-inspect@latest",
-      evidence: `cli=${version};local=${root.version}`
-    };
+  const absolutePath = path19__default.default.resolve(outputDir, normalized);
+  const relFromOutput = path19__default.default.relative(outputDir, absolutePath);
+  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path19__default.default.isAbsolute(relFromOutput)) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path resolved outside the output directory.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
   }
   return {
-    id: "version-alignment",
-    status: "pass",
-    message: `CLI and local agent-inspect are aligned at ${version}.`
+    ok: true,
+    outputDir,
+    relativePath: normalized,
+    absolutePath,
+    diagnostics
   };
 }
-async function runDoctorChecks(options = {}) {
-  const cwd = path16__default.default.resolve(options.cwd ?? process3__default.default.cwd());
-  const traceDir = options.traceDir?.trim() || process3__default.default.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
-  const checks2 = [
-    nodeVersionCheck(),
-    {
-      id: "cli-version",
-      status: "pass",
-      message: `agent-inspect CLI ${version}`,
-      evidence: version
-    },
-    await traceDirWritable(traceDir),
-    envCheck("AGENT_INSPECT"),
-    envCheck("AGENT_INSPECT_TRACE_DIR"),
-    versionMismatchCheck(cwd)
-  ];
-  if (options.checkImports !== false) {
-    checks2.push(...importSmoke(cwd));
-  }
-  checks2.push(...optionalPackageChecks(cwd, options.framework));
-  return checks2.sort((a, b) => a.id.localeCompare(b.id));
+
+// packages/cli/src/ci-summary.ts
+var NOTE2 = "Generated locally by AgentInspect from reporter artifact manifests. Trace contents are not embedded.";
+var MAX_TEXT = 180;
+var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "jest", "manual"]);
+var STATUSES = /* @__PURE__ */ new Set(["passed", "failed", "skipped", "todo"]);
+var ARTIFACT_KINDS = /* @__PURE__ */ new Set(["trace", "report", "eval", "redaction", "summary"]);
+var ARTIFACT_FORMATS = /* @__PURE__ */ new Set(["json", "jsonl", "md", "html"]);
+var REDACTION_PROFILES2 = /* @__PURE__ */ new Set(["local", "share", "strict"]);
+function stable7(value) {
+  if (Array.isArray(value)) return value.map(stable7);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable7(record[key])])
+  );
 }
-async function doctorCommand(options = {}) {
-  const checks2 = await runDoctorChecks(options);
-  const failed = checks2.filter((check) => check.status === "fail").length;
-  const warned = checks2.filter((check) => check.status === "warn").length;
-  if (options.json) {
-    console.log(
-      JSON.stringify(
-        {
-          ok: failed === 0,
-          version,
-          summary: { pass: checks2.filter((c) => c.status === "pass").length, warn: warned, fail: failed },
-          checks: checks2
-        },
-        null,
-        2
-      )
-    );
-    if (failed > 0) process3__default.default.exitCode = 1;
-    return;
-  }
-  console.log("AgentInspect doctor");
-  for (const check of checks2) {
-    const tag = check.status.toUpperCase();
-    console.log(`[${tag}] ${check.id}: ${check.message}`);
-    if (check.remediation) console.log(`  \u2192 ${check.remediation}`);
-  }
-  console.log(`
-Summary: ${failed} failed, ${warned} warnings`);
-  if (failed > 0) process3__default.default.exitCode = 1;
+function writeJson5(value) {
+  return `${JSON.stringify(stable7(value), null, 2)}
+`;
 }
-
-// packages/adapter-sdk/src/indexer.ts
-init_advanced();
-function defineIndexer(indexer) {
-  if (!indexer.id.trim()) throw new Error("indexer id is required");
-  return indexer;
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function indexIsStale(snapshot, traceDir) {
-  const builtMs = Date.parse(snapshot.builtAt);
-  if (Number.isNaN(builtMs)) return true;
-  const td = new TraceDirectory({ dir: traceDir });
-  const files = await td.list();
-  for (const file of files) {
-    const stats = await td.getFileStats(file);
-    if (stats.mtimeMs > builtMs) return true;
+function readString(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`${label} must be a non-empty string.`);
   }
-  return false;
-}
-function createTraceDirectoryIndexer() {
-  return defineIndexer({
-    id: "trace-directory-metadata",
-    async rebuild(traceDir, options = {}) {
-      const warnings = [];
-      const td = new TraceDirectory({ dir: traceDir });
-      const files = await td.list();
-      const maxEntries = options.maxEntries ?? 1e4;
-      if (files.length > maxEntries) {
-        warnings.push(
-          `indexer.truncated: trace directory has ${files.length} files; indexing first ${maxEntries}`
-        );
-      }
-      const slice = files.slice(0, maxEntries);
-      const metas = await loadTraceMetadataList(
-        traceDir,
-        slice,
-        (fileName) => td.getPath(fileName)
-      );
-      const entries = metas.map((meta2) => ({
-        runId: meta2.runId,
-        path: meta2.filePath,
-        name: meta2.name,
-        startedAt: meta2.startedAt,
-        status: meta2.status
-      })).sort((a, b) => a.runId.localeCompare(b.runId));
-      if (entries.length < slice.length) {
-        warnings.push(
-          `indexer.partial: indexed ${entries.length} of ${slice.length} trace files`
-        );
-      }
-      return {
-        traceDir,
-        builtAt: (/* @__PURE__ */ new Date()).toISOString(),
-        entries,
-        warnings
-      };
-    }
-  });
+  return safeText(value);
 }
-
-// packages/cli/src/index-cmd.ts
-init_advanced();
-var INDEX_FILENAME = ".agent-inspect-index.json";
-function traceIndexPath(traceDir) {
-  return path16__default.default.join(traceDir, INDEX_FILENAME);
+function readOptionalString(value) {
+  return typeof value === "string" && value.trim() !== "" ? safeText(value) : void 0;
 }
-function parseMaxEntries(raw) {
-  if (raw === void 0 || raw.trim() === "") return void 0;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new Error("--max-entries must be a positive integer.");
+function readFramework(value) {
+  const framework = readString(value, "manifest.framework");
+  if (!FRAMEWORKS.has(framework)) {
+    throw new Error(`Unsupported reporter framework: ${framework}.`);
   }
-  return parsed;
+  return framework;
 }
-async function readSnapshot(indexPath2) {
-  try {
-    const raw = await promises.readFile(indexPath2, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return void 0;
+function readStatus(value) {
+  const status = readString(value, "result.status");
+  if (!STATUSES.has(status)) {
+    throw new Error(`Unsupported reporter test status: ${status}.`);
   }
+  return status;
 }
-async function indexBuildCommand(options = {}) {
-  try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    await promises.mkdir(traceDir, { recursive: true });
-    const indexer = createTraceDirectoryIndexer();
-    const snapshot = await indexer.rebuild(traceDir, {
-      maxEntries: parseMaxEntries(options.maxEntries)
-    });
-    const indexPath2 = traceIndexPath(traceDir);
-    await promises.writeFile(indexPath2, `${JSON.stringify(snapshot, null, 2)}
-`, "utf8");
-    if (options.json) {
-      console.log(JSON.stringify({ ok: true, indexPath: indexPath2, ...snapshot }, null, 2));
-      return;
-    }
-    console.log(`Built trace index: ${indexPath2}`);
-    console.log(`Entries: ${snapshot.entries.length}`);
-    if (snapshot.warnings.length > 0) {
-      for (const warning of snapshot.warnings) {
-        console.log(`warning: ${warning}`);
-      }
-    }
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index build failed: ${msg}`);
-    process.exitCode = 1;
+function readArtifact(value, index) {
+  if (!isObject(value)) throw new Error(`manifest.artifacts[${index}] must be an object.`);
+  const kind = readString(value.kind, `manifest.artifacts[${index}].kind`);
+  const format = readString(value.format, `manifest.artifacts[${index}].format`);
+  const redactionProfile = readString(
+    value.redactionProfile,
+    `manifest.artifacts[${index}].redactionProfile`
+  );
+  if (!ARTIFACT_KINDS.has(kind)) throw new Error(`Unsupported artifact kind: ${kind}.`);
+  if (!ARTIFACT_FORMATS.has(format)) throw new Error(`Unsupported artifact format: ${format}.`);
+  if (!REDACTION_PROFILES2.has(redactionProfile)) {
+    throw new Error(`Unsupported artifact redaction profile: ${redactionProfile}.`);
   }
-}
-async function indexStatusCommand(options = {}) {
-  try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    const indexPath2 = traceIndexPath(traceDir);
-    const snapshot = await readSnapshot(indexPath2);
-    if (!snapshot) {
-      const payload2 = { ok: true, exists: false, indexPath: indexPath2, traceDir, stale: true };
-      if (options.json) {
-        console.log(JSON.stringify(payload2, null, 2));
-      } else {
-        console.log(`No index at ${indexPath2}`);
-        console.log("Run: agent-inspect index build");
-      }
-      return;
+  const artifactPath = readString(value.path, `manifest.artifacts[${index}].path`);
+  const pathCheck = validateReporterArtifactPath({
+    outputDir: process.cwd(),
+    relativePath: artifactPath
+  });
+  if (!pathCheck.ok || pathCheck.relativePath === void 0) {
+    throw new Error(`Unsafe reporter artifact path: ${artifactPath}.`);
+  }
+  return {
+    kind,
+    path: pathCheck.relativePath,
+    format,
+    redactionProfile
+  };
+}
+function readArtifacts(value, label) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.map((item, index) => readArtifact(item, index));
+}
+function readDiagnosticsCount(value, label) {
+  if (value === void 0) return 0;
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.length;
+}
+function readResult(value, index) {
+  if (!isObject(value)) throw new Error(`manifest.results[${index}] must be an object.`);
+  const file = readOptionalString(value.file);
+  const tracePath = readOptionalString(value.tracePath);
+  return {
+    testId: readString(value.testId, `manifest.results[${index}].testId`),
+    name: readString(value.name, `manifest.results[${index}].name`),
+    ...file === void 0 ? {} : { file },
+    status: readStatus(value.status),
+    ...tracePath === void 0 ? {} : { tracePath },
+    artifacts: readArtifacts(value.artifacts, `manifest.results[${index}].artifacts`),
+    diagnostics: readDiagnosticsCount(
+      value.diagnostics,
+      `manifest.results[${index}].diagnostics`
+    )
+  };
+}
+function readManifestDocument(value) {
+  if (!isObject(value)) throw new Error("Reporter manifest file must contain a JSON object.");
+  const candidate = isObject(value.manifest) ? value.manifest : value;
+  if (!isObject(candidate)) throw new Error("Reporter manifest must be a JSON object.");
+  const schemaVersion = readString(candidate.schemaVersion, "manifest.schemaVersion");
+  if (schemaVersion !== "0.1") {
+    throw new Error(`Unsupported reporter manifest schemaVersion: ${schemaVersion}.`);
+  }
+  if (!Array.isArray(candidate.results)) {
+    throw new Error("manifest.results must be an array.");
+  }
+  const artifacts = readArtifacts(candidate.artifacts, "manifest.artifacts");
+  const results = candidate.results.map((item, index) => readResult(item, index));
+  const diagnostics = readDiagnosticsCount(candidate.diagnostics, "manifest.diagnostics");
+  const manifest = {
+    framework: readFramework(candidate.framework),
+    generatedAt: readString(candidate.generatedAt, "manifest.generatedAt"),
+    results,
+    artifacts
+  };
+  return {
+    packageName: readOptionalString(value.package),
+    manifest,
+    diagnostics
+  };
+}
+function cwdRelative(filePath) {
+  const relative = path19__default.default.relative(process.cwd(), path19__default.default.resolve(filePath)).replace(/\\/g, "/");
+  if (relative === "" || relative.startsWith("../") || path19__default.default.isAbsolute(relative)) {
+    return path19__default.default.basename(filePath);
+  }
+  return relative;
+}
+async function readReporterManifest(filePath) {
+  const absolute = path19__default.default.resolve(filePath);
+  const raw = await promises.readFile(absolute, "utf-8");
+  const document = readManifestDocument(JSON.parse(raw));
+  const manifest = document.manifest;
+  const results = manifest.results.map((result) => ({
+    testId: safeText(result.testId),
+    name: safeText(result.name),
+    ...result.file === void 0 ? {} : { file: safeText(path19__default.default.basename(result.file)) },
+    status: result.status,
+    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path19__default.default.basename(result.tracePath)) },
+    artifacts: result.artifacts,
+    diagnostics: result.diagnostics
+  }));
+  return {
+    ...document.packageName === void 0 ? {} : { packageName: document.packageName },
+    manifestFile: cwdRelative(absolute),
+    framework: manifest.framework,
+    generatedAt: manifest.generatedAt,
+    results,
+    artifacts: manifest.artifacts,
+    diagnostics: document.diagnostics
+  };
+}
+function summarize3(manifests) {
+  const summary = {
+    manifests: manifests.length,
+    tests: 0,
+    failed: 0,
+    passed: 0,
+    skipped: 0,
+    todo: 0,
+    artifacts: 0,
+    diagnostics: 0
+  };
+  for (const manifest of manifests) {
+    summary.artifacts += manifest.artifacts.length;
+    summary.diagnostics += manifest.diagnostics;
+    for (const result of manifest.results) {
+      summary.tests += 1;
+      if (result.status === "failed") summary.failed += 1;
+      else if (result.status === "passed") summary.passed += 1;
+      else if (result.status === "skipped") summary.skipped += 1;
+      else summary.todo += 1;
+      summary.artifacts += result.artifacts.length;
+      summary.diagnostics += result.diagnostics;
     }
-    const stale = await indexIsStale(snapshot, traceDir);
-    const payload = {
-      ok: true,
-      exists: true,
-      indexPath: indexPath2,
-      traceDir,
-      stale,
-      builtAt: snapshot.builtAt,
-      entries: snapshot.entries.length,
-      warnings: snapshot.warnings
-    };
-    if (options.json) {
-      console.log(JSON.stringify(payload, null, 2));
-      return;
+  }
+  return {
+    status: summary.failed > 0 ? "failed" : summary.diagnostics > 0 ? "warning" : "ok",
+    manifests,
+    summary,
+    note: NOTE2
+  };
+}
+function markdownCell(value) {
+  return safeText(String(value ?? "unknown")).replaceAll("|", "\\|").replace(/\r?\n/g, " ");
+}
+function renderMarkdown2(result) {
+  const lines = [
+    "# AgentInspect CI Summary",
+    "",
+    NOTE2,
+    "",
+    "| Field | Value |",
+    "| --- | --- |",
+    `| Status | ${result.status} |`,
+    `| Manifests | ${result.summary.manifests} |`,
+    `| Tests | ${result.summary.tests} |`,
+    `| Failed | ${result.summary.failed} |`,
+    `| Passed | ${result.summary.passed} |`,
+    `| Skipped | ${result.summary.skipped} |`,
+    `| Todo | ${result.summary.todo} |`,
+    `| Artifacts | ${result.summary.artifacts} |`,
+    `| Diagnostics | ${result.summary.diagnostics} |`,
+    "",
+    "## Tests",
+    "",
+    "| Framework | Status | Test | File | Trace | Artifacts |",
+    "| --- | --- | --- | --- | --- | --- |"
+  ];
+  const rows = result.manifests.flatMap(
+    (manifest) => manifest.results.map((test) => ({
+      framework: manifest.framework,
+      test
+    }))
+  );
+  if (rows.length === 0) {
+    lines.push("| unknown | unknown | No tests found | unknown | unknown | 0 |");
+  } else {
+    for (const row of rows) {
+      lines.push(
+        `| ${markdownCell(row.framework)} | ${markdownCell(row.test.status)} | ${markdownCell(row.test.name)} | ${markdownCell(row.test.file)} | ${markdownCell(row.test.tracePath)} | ${row.test.artifacts.length} |`
+      );
     }
-    console.log(`Index: ${indexPath2}`);
-    console.log(`Built: ${snapshot.builtAt}`);
-    console.log(`Entries: ${snapshot.entries.length}`);
-    console.log(`Stale: ${stale ? "yes" : "no"}`);
-    if (snapshot.warnings.length > 0) {
-      for (const warning of snapshot.warnings) {
-        console.log(`warning: ${warning}`);
-      }
+  }
+  lines.push("", "## Manifests", "", "| Framework | File | Generated | Artifacts |", "| --- | --- | --- | --- |");
+  for (const manifest of result.manifests) {
+    lines.push(
+      `| ${markdownCell(manifest.framework)} | ${markdownCell(manifest.manifestFile)} | ${markdownCell(manifest.generatedAt)} | ${manifest.artifacts.length} |`
+    );
+  }
+  lines.push("", "## Artifacts", "", "| Framework | Kind | Path | Format | Profile |", "| --- | --- | --- | --- | --- |");
+  const artifacts = result.manifests.flatMap(
+    (manifest) => manifest.artifacts.map((artifact) => ({ framework: manifest.framework, artifact }))
+  );
+  if (artifacts.length === 0) {
+    lines.push("| unknown | unknown | No artifacts found | unknown | unknown |");
+  } else {
+    for (const row of artifacts) {
+      lines.push(
+        `| ${markdownCell(row.framework)} | ${markdownCell(row.artifact.kind)} | ${markdownCell(row.artifact.path)} | ${markdownCell(row.artifact.format)} | ${markdownCell(row.artifact.redactionProfile)} |`
+      );
     }
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index status failed: ${msg}`);
-    process.exitCode = 1;
   }
+  lines.push("");
+  return `${lines.join("\n")}
+`;
 }
-async function indexCleanCommand(options = {}) {
+function safeText(value) {
+  const compact = value.replace(/\s+/g, " ").trim();
+  const redacted = compact.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(
+    /\b(?:api[_-]?key|authorization|token|secret|password)\s*[:=]\s*[^,\s]+/gi,
+    "$1=[REDACTED]"
+  );
+  if (redacted.length <= MAX_TEXT) return redacted;
+  return `${redacted.slice(0, MAX_TEXT - 12)}...[truncated]`;
+}
+async function ciSummaryCommand(manifestPaths, options = {}) {
+  if (manifestPaths.length === 0) {
+    console.error("At least one reporter manifest path is required.");
+    process.exitCode = 1;
+    return;
+  }
+  let result;
   try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    const indexPath2 = traceIndexPath(traceDir);
-    await promises.rm(indexPath2, { force: true });
-    if (options.json) {
-      console.log(JSON.stringify({ ok: true, removed: indexPath2 }, null, 2));
-      return;
+    const manifests = [];
+    for (const manifestPath of manifestPaths) {
+      manifests.push(await readReporterManifest(manifestPath));
     }
-    console.log(`Removed index: ${indexPath2}`);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index clean failed: ${msg}`);
+    manifests.sort((a, b) => a.manifestFile.localeCompare(b.manifestFile));
+    result = summarize3(manifests);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[AgentInspect] ci-summary failed: ${message}`);
     process.exitCode = 1;
+    return;
+  }
+  const markdown = renderMarkdown2(result);
+  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path19__default.default.resolve(options.output.trim()) : void 0;
+  if (outputPath !== void 0) {
+    await promises.mkdir(path19__default.default.dirname(outputPath), { recursive: true });
+    await promises.writeFile(outputPath, markdown, "utf-8");
   }
+  const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
+  if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
+    const summaryPath = path19__default.default.resolve(summaryTarget);
+    await promises.mkdir(path19__default.default.dirname(summaryPath), { recursive: true });
+    await promises.appendFile(summaryPath, `
+${markdown}`, "utf-8");
+  }
+  if (options.json === true) {
+    console.log(writeJson5(result).trimEnd());
+  } else if (outputPath !== void 0) {
+    console.log(`Wrote AgentInspect CI summary to ${outputPath}`);
+    console.log(`Status: ${result.status}`);
+  } else {
+    console.log(markdown.trimEnd());
+  }
+}
+var CONFIG_FILE = "agent-inspect.config.ts";
+var TRACE_DIR = ".agent-inspect";
+var GITKEEP = ".agent-inspect/.gitkeep";
+function normalizeFramework(value) {
+  const raw = (value ?? "custom").trim();
+  if (raw === "ai-sdk" || raw === "openai-agents" || raw === "langchain" || raw === "custom") {
+    return raw;
+  }
+  throw new Error(
+    "Unsupported --framework value. Use ai-sdk, openai-agents, langchain, or custom."
+  );
+}
+function configTemplate(framework) {
+  const base = `/**
+ * AgentInspect local config (metadata-only capture by default).
+ * See https://github.com/rajudandigam/agent-inspect/blob/main/docs/SAFE-TRACE-SHARING.md
+ */
+export const agentInspectConfig = {
+  traceDir: ".agent-inspect",
+  enabled: process.env.AGENT_INSPECT !== "0",
+  redactionProfile: "local" as const,
+};
+`;
+  if (framework === "custom") return base;
+  return `${base}
+export const framework = "${framework}" as const;
+`;
 }
+function demoTemplate(framework) {
+  switch (framework) {
+    case "ai-sdk":
+      return `/**
+ * AI SDK starter \u2014 metadata-only telemetry (no real model calls in this demo).
+ * Install: npm install agent-inspect @agent-inspect/ai-sdk ai
+ */
+import { inspectRun, step } from "agent-inspect";
 
-// packages/cli/src/index-sqlite-cmd.ts
-init_advanced();
-var PACKAGE = "@agent-inspect/index-sqlite";
-function isModuleNotFound3(e) {
-  return e !== null && typeof e === "object" && "code" in e && (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND");
+async function main() {
+  await inspectRun("ai-sdk-demo", async () => {
+    await step.tool("mock-generate", async () => ({ text: "ok" }));
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
 }
-async function loadIndexSqlite() {
-  try {
-    return await Promise.resolve().then(() => (init_src(), src_exports));
-  } catch (e) {
-    if (isModuleNotFound3(e)) {
-      console.error(
-        `The optional SQLite index is not installed. Run: npm install ${PACKAGE}`
-      );
-      process.exitCode = 1;
-      return null;
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    case "openai-agents":
+      return `/**
+ * OpenAI Agents starter \u2014 use @agent-inspect/openai-agents for local-only processors.
+ * This demo uses manual steps (no API keys).
+ */
+import { inspectRun, step } from "agent-inspect";
+
+async function main() {
+  await inspectRun("openai-agents-demo", async () => {
+    await step.tool("mock-agent-run", async () => "ok");
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    case "langchain":
+      return `/**
+ * LangChain starter \u2014 wire @agent-inspect/langchain callbacks in your app.
+ * This demo uses manual steps (no API keys).
+ */
+import { inspectRun, step } from "agent-inspect";
+
+async function main() {
+  await inspectRun("langchain-demo", async () => {
+    await step.tool("mock-chain", async () => "ok");
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    default:
+      return `import { observe } from "agent-inspect";
+
+class DemoAgent {
+  async run(input: { question: string }) {
+    return { answer: \`Echo: \${input.question}\` };
+  }
+}
+
+const agent = observe(new DemoAgent(), {
+  traceDir: ".agent-inspect",
+  silent: true,
+});
+
+await agent.run({ question: "hello" });
+console.log("Trace written to .agent-inspect/");
+`;
+  }
+}
+function githubWorkflowTemplate() {
+  return `name: AgentInspect artifacts
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+jobs:
+  trace-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm ci
+      - run: npm test
+      - name: Upload AgentInspect traces
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: agent-inspect-traces
+          path: .agent-inspect/**/*.jsonl
+          if-no-files-found: ignore
+`;
+}
+async function planInit(options = {}) {
+  const framework = normalizeFramework(options.framework);
+  const cwd = path19__default.default.resolve(options.cwd ?? process.cwd());
+  const demoPath = framework === "custom" ? path19__default.default.join("examples", "agent-inspect-demo.mjs") : path19__default.default.join("examples", `agent-inspect-${framework}-demo.mjs`);
+  const candidates = [
+    { rel: CONFIG_FILE, content: configTemplate(framework) },
+    { rel: GITKEEP, content: "" },
+    { rel: demoPath, content: demoTemplate(framework) }
+  ];
+  if (options.ci === "github") {
+    candidates.push({
+      rel: ".github/workflows/agent-inspect-artifacts.yml",
+      content: githubWorkflowTemplate()
+    });
+  }
+  const files = [];
+  for (const candidate of candidates) {
+    const abs = path19__default.default.join(cwd, candidate.rel);
+    try {
+      await promises.access(abs);
+      files.push({
+        path: candidate.rel,
+        action: "skip",
+        reason: "file already exists"
+      });
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      files.push({ path: candidate.rel, action: "create" });
     }
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] failed to load ${PACKAGE}: ${msg}`);
-    process.exitCode = 1;
-    return null;
   }
+  return { framework, ...options.ci ? { ci: options.ci } : {}, files };
 }
-function parsePositiveInt(raw, flag) {
-  if (raw === void 0 || raw.trim() === "") return void 0;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new Error(`${flag} must be a positive integer.`);
+async function writePlannedFiles(plan, cwd, options) {
+  const written = [];
+  for (const entry of plan.files) {
+    if (entry.action === "skip") {
+      continue;
+    }
+    const abs = path19__default.default.join(cwd, entry.path);
+    if (options.dryRun) {
+      written.push(entry.path);
+      continue;
+    }
+    await promises.mkdir(path19__default.default.dirname(abs), { recursive: true });
+    const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
+    await promises.writeFile(abs, content, "utf-8");
+    written.push(entry.path);
   }
-  return parsed;
+  return written;
 }
-async function newestTraceMtimeMs2(traceDir) {
-  let newest = 0;
+async function initCommand(options = {}) {
+  const cwd = path19__default.default.resolve(options.cwd ?? process.cwd());
   try {
-    const files = await promises.readdir(traceDir);
-    for (const file of files) {
-      if (!file.endsWith(".jsonl")) continue;
-      try {
-        const s = await promises.stat(path16__default.default.join(traceDir, file));
-        if (s.mtimeMs > newest) newest = s.mtimeMs;
-      } catch {
+    const plan = await planInit({ ...options, cwd });
+    const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
+    const skipped = plan.files.filter((file) => file.action === "skip");
+    if (options.json) {
+      const payload = {
+        ok: true,
+        version,
+        framework: plan.framework,
+        ci: plan.ci ?? null,
+        dryRun: options.dryRun === true,
+        planned: plan.files,
+        wouldWrite: options.dryRun ? toWrite : void 0
+      };
+      console.log(JSON.stringify(payload, null, 2));
+      if (options.dryRun) return;
+    }
+    const written = await writePlannedFiles(plan, cwd, options);
+    if (!options.json) {
+      console.log("AgentInspect init");
+      console.log(`Framework: ${plan.framework}`);
+      console.log(`Trace directory: ${TRACE_DIR}/`);
+      if (options.dryRun) {
+        console.log("Dry run \u2014 would create:");
+        for (const file of toWrite) console.log(`- ${file}`);
+        for (const file of skipped) {
+          console.log(`- ${file.path} (skip: ${file.reason ?? "exists"})`);
+        }
+        return;
+      }
+      console.log("Created:");
+      for (const file of written) console.log(`- ${file}`);
+      for (const file of skipped) {
+        console.log(`- ${file.path} (skipped: ${file.reason ?? "exists"})`);
       }
+      console.log("\nNext: run your demo, then `npx agent-inspect list --dir .agent-inspect`");
+      console.log("No dependencies were installed. Add packages manually when ready.");
     }
-  } catch {
-  }
-  return newest;
-}
-async function indexSqliteBuildCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const result = await mod.buildIndex({
-    traceDir: options.dir,
-    maxRuns: parsePositiveInt(options.maxRuns, "--max-runs")
-  });
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, ...result }, null, 2));
-    return;
-  }
-  console.log(`Built SQLite index: ${result.dbPath}`);
-  console.log(`Runs: ${result.runs}  Steps: ${result.steps}  Errors: ${result.errors}`);
-  for (const warning of result.warnings) console.log(`warning: ${warning}`);
-}
-async function indexSqliteStatusCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  const status = mod.indexStatus(dbPath);
-  const stale = mod.isIndexStale(dbPath, await newestTraceMtimeMs2(traceDir));
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, traceDir, stale, ...status }, null, 2));
-    return;
-  }
-  if (!status.exists) {
-    console.log(`No SQLite index at ${dbPath}`);
-    console.log("Run: agent-inspect index sqlite build");
-    return;
-  }
-  console.log(`Index: ${status.dbPath}`);
-  console.log(`Healthy: ${status.healthy ? "yes" : "no"}`);
-  console.log(`Built: ${status.builtAt ?? "unknown"}`);
-  console.log(`Runs: ${status.runs}  Steps: ${status.steps}`);
-  console.log(`Stale: ${stale ? "yes" : "no"}`);
-}
-async function indexSqliteQueryCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  const status = mod.indexStatus(dbPath);
-  if (!status.exists || !status.healthy) {
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     if (options.json) {
-      console.log(JSON.stringify({ ok: false, reason: "index-missing", dbPath }, null, 2));
+      console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
     } else {
-      console.log("No usable SQLite index. Run: agent-inspect index sqlite build");
+      console.error(`[AgentInspect] init failed: ${msg}`);
     }
     process.exitCode = 1;
-    return;
-  }
-  const rows = mod.queryRuns(dbPath, {
-    status: options.status,
-    sessionId: options.session,
-    name: options.name,
-    kind: options.kind,
-    tool: options.tool,
-    limit: parsePositiveInt(options.limit, "--limit")
-  });
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, count: rows.length, runs: rows }, null, 2));
-    return;
-  }
-  if (rows.length === 0) {
-    console.log("No matching runs.");
-    return;
-  }
-  for (const run of rows) {
-    const parts = [
-      run.runId,
-      run.status ?? "unknown",
-      run.name ?? "",
-      run.durationMs != null ? `${run.durationMs}ms` : ""
-    ].filter((p) => p !== "");
-    console.log(parts.join("  "));
-  }
-}
-async function indexSqliteCleanCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  await mod.cleanIndex(dbPath);
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, removed: dbPath }, null, 2));
-    return;
   }
-  console.log(`Removed SQLite index: ${dbPath}`);
 }
-
-// packages/core/src/workspace/types.ts
-var WORKSPACE_SCHEMA_VERSION = "1.0";
-var WORKSPACE_DIR_NAME = ".agent-inspect";
-var WORKSPACE_MANIFEST_FILENAME = "workspace.json";
-
-// packages/core/src/workspace/manifest.ts
-var DEFAULT_WORKSPACE_LAYOUT = {
-  traceDirs: ["runs"],
-  reportsDir: "reports",
-  artifactsDir: "artifacts",
-  bundlesDir: "bundles",
-  notesDir: "notes"
+var OPTIONAL_PACKAGES = {
+  custom: [],
+  "ai-sdk": ["@agent-inspect/ai-sdk"],
+  "openai-agents": ["@agent-inspect/openai-agents"],
+  langchain: ["@agent-inspect/langchain"]
 };
-var DEFAULT_REDACTION_PROFILE = "share";
-var REDACTION_PROFILES2 = [
-  "local",
-  "share",
-  "strict"
-];
-var INDEX_TYPES = ["none", "sqlite", "custom"];
-var MAX_WORKSPACE_MANIFEST_BYTES = 64 * 1024;
-function createDefaultWorkspaceManifest(options) {
-  const project = typeof options.project === "string" ? options.project.trim() : "";
-  const index = {
-    enabled: options.index?.enabled ?? false,
-    type: options.index?.type ?? "none",
-    ...options.index?.path !== void 0 ? { path: options.index.path } : {}
-  };
-  return {
-    schemaVersion: WORKSPACE_SCHEMA_VERSION,
-    project,
-    createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    traceDirs: options.traceDirs ? [...options.traceDirs] : [...DEFAULT_WORKSPACE_LAYOUT.traceDirs],
-    reportsDir: options.reportsDir ?? DEFAULT_WORKSPACE_LAYOUT.reportsDir,
-    artifactsDir: options.artifactsDir ?? DEFAULT_WORKSPACE_LAYOUT.artifactsDir,
-    bundlesDir: options.bundlesDir ?? DEFAULT_WORKSPACE_LAYOUT.bundlesDir,
-    notesDir: options.notesDir ?? DEFAULT_WORKSPACE_LAYOUT.notesDir,
-    redactionProfile: options.redactionProfile ?? DEFAULT_REDACTION_PROFILE,
-    index
-  };
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isSafeRelativeWorkspacePath(p) {
-  if (typeof p !== "string") return false;
-  const trimmed = p.trim();
-  if (trimmed === "") return false;
-  if (trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
-  if (/^[a-zA-Z]:/.test(trimmed)) return false;
-  const segments = trimmed.split(/[/\\]+/);
-  return !segments.some((seg) => seg === "..");
-}
-function validateDirField(value, field, errors) {
-  if (typeof value !== "string" || value.trim() === "") {
-    errors.push(`${field} must be a non-empty string`);
-    return;
-  }
-  if (!isSafeRelativeWorkspacePath(value)) {
-    errors.push(
-      `${field} must be a relative path inside the workspace (no absolute paths or ".." traversal)`
-    );
+function nodeVersionCheck() {
+  const major = Number(process3__default.default.versions.node.split(".")[0]);
+  if (Number.isNaN(major) || major < 20) {
+    return {
+      id: "node-version",
+      status: "fail",
+      message: `Node ${process3__default.default.versions.node} is below the supported minimum (20).`,
+      remediation: "Upgrade to Node 20 LTS or newer.",
+      evidence: process3__default.default.versions.node
+    };
   }
+  return {
+    id: "node-version",
+    status: "pass",
+    message: `Node ${process3__default.default.versions.node} meets the minimum (>=20).`,
+    evidence: process3__default.default.versions.node
+  };
 }
-function validateIndex(value, errors) {
-  if (!isPlainObject(value)) {
-    errors.push("index must be an object");
-    return void 0;
-  }
-  if (typeof value.enabled !== "boolean") {
-    errors.push("index.enabled must be a boolean");
-  }
-  if (!INDEX_TYPES.includes(value.type)) {
-    errors.push(`index.type must be one of: ${INDEX_TYPES.join(", ")}`);
-  }
-  if (value.path !== void 0 && !isSafeRelativeWorkspacePath(value.path)) {
-    errors.push(
-      'index.path must be a relative path inside the workspace (no absolute paths or ".." traversal)'
-    );
+function envCheck(name, optional = true) {
+  const value = process3__default.default.env[name];
+  if (value === void 0 || value.trim() === "") {
+    return {
+      id: `env-${name.toLowerCase()}`,
+      status: optional ? "skipped" : "warn",
+      message: `${name} is not set.`,
+      remediation: optional ? void 0 : `Set ${name}=1 to enable tracing.`
+    };
   }
-  if (errors.length > 0) return void 0;
   return {
-    enabled: value.enabled,
-    type: value.type,
-    ...value.path !== void 0 ? { path: value.path } : {}
+    id: `env-${name.toLowerCase()}`,
+    status: "pass",
+    message: `${name} is set.`,
+    evidence: value
   };
 }
-function validateWorkspaceManifest(input3) {
-  const errors = [];
-  const warnings = [];
-  if (!isPlainObject(input3)) {
-    return { ok: false, errors: ["manifest must be an object"], warnings };
-  }
-  if (input3.schemaVersion !== WORKSPACE_SCHEMA_VERSION) {
-    errors.push(
-      `schemaVersion must be "${WORKSPACE_SCHEMA_VERSION}" (received ${JSON.stringify(
-        input3.schemaVersion
-      )})`
-    );
-  }
-  if (typeof input3.project !== "string" || input3.project.trim() === "") {
-    errors.push("project must be a non-empty string");
+async function traceDirWritable(traceDir) {
+  const resolved = path19__default.default.resolve(traceDir);
+  try {
+    await promises.mkdir(resolved, { recursive: true });
+    await promises.access(resolved, promises.constants.W_OK);
+    return {
+      id: "trace-dir-writable",
+      status: "pass",
+      message: `Trace directory is writable: ${resolved}`,
+      evidence: resolved
+    };
+  } catch (error) {
+    return {
+      id: "trace-dir-writable",
+      status: "fail",
+      message: `Trace directory is not writable: ${resolved}`,
+      remediation: "Create the directory or set AGENT_INSPECT_TRACE_DIR to a writable path.",
+      evidence: error instanceof Error ? error.message : String(error)
+    };
   }
-  if (typeof input3.createdAt !== "string" || input3.createdAt.trim() === "") {
-    errors.push("createdAt must be a non-empty ISO-8601 string");
-  } else if (Number.isNaN(Date.parse(input3.createdAt))) {
-    errors.push("createdAt must be a valid ISO-8601 date string");
+}
+function resolvePackage(cwd, name) {
+  const require2 = module$1.createRequire(path19__default.default.join(cwd, "package.json"));
+  try {
+    const pkgPath = require2.resolve(`${name}/package.json`);
+    const pkg = require2(pkgPath);
+    return { ok: true, version: pkg.version };
+  } catch {
+    return { ok: false };
   }
-  if (!Array.isArray(input3.traceDirs) || input3.traceDirs.length === 0) {
-    errors.push("traceDirs must be a non-empty array");
-  } else {
-    input3.traceDirs.forEach((dir, i) => {
-      if (typeof dir !== "string" || dir.trim() === "") {
-        errors.push(`traceDirs[${i}] must be a non-empty string`);
-      } else if (!isSafeRelativeWorkspacePath(dir)) {
-        errors.push(
-          `traceDirs[${i}] must be a relative path inside the workspace (no absolute paths or ".." traversal)`
-        );
-      }
+}
+function importSmoke(cwd) {
+  const results = [];
+  const require2 = module$1.createRequire(path19__default.default.join(cwd, "package.json"));
+  try {
+    require2.resolve("agent-inspect");
+    results.push({
+      id: "import-agent-inspect",
+      status: "pass",
+      message: "agent-inspect resolves from the current project."
+    });
+  } catch {
+    results.push({
+      id: "import-agent-inspect",
+      status: "warn",
+      message: "agent-inspect is not installed in the current project.",
+      remediation: "Run npm install agent-inspect (or pnpm add agent-inspect)."
     });
   }
-  validateDirField(input3.reportsDir, "reportsDir", errors);
-  validateDirField(input3.artifactsDir, "artifactsDir", errors);
-  validateDirField(input3.bundlesDir, "bundlesDir", errors);
-  validateDirField(input3.notesDir, "notesDir", errors);
-  if (!REDACTION_PROFILES2.includes(input3.redactionProfile)) {
-    errors.push(`redactionProfile must be one of: ${REDACTION_PROFILES2.join(", ")}`);
+  try {
+    require2.resolve("agent-inspect/package.json");
+    results.push({
+      id: "import-agent-inspect-cjs",
+      status: "pass",
+      message: "CJS resolution for agent-inspect succeeded."
+    });
+  } catch {
+    results.push({
+      id: "import-agent-inspect-cjs",
+      status: "skipped",
+      message: "CJS resolution check skipped (package not installed locally)."
+    });
   }
-  const indexErrors = [];
-  const index = validateIndex(input3.index, indexErrors);
-  errors.push(...indexErrors);
-  if (index && index.type !== "none" && !index.enabled) {
-    warnings.push(`index.type is "${index.type}" but index.enabled is false`);
+  return results;
+}
+function optionalPackageChecks(cwd, framework) {
+  const packages = framework !== void 0 ? OPTIONAL_PACKAGES[framework] : [
+    "@agent-inspect/ai-sdk",
+    "@agent-inspect/openai-agents",
+    "@agent-inspect/langchain",
+    "@agent-inspect/redact",
+    "@agent-inspect/eval"
+  ];
+  return packages.map((name) => {
+    const resolved = resolvePackage(cwd, name);
+    if (!resolved.ok) {
+      return {
+        id: `optional-package-${name}`,
+        status: framework !== void 0 ? "warn" : "skipped",
+        message: `${name} is not installed.`,
+        remediation: framework !== void 0 ? `npm install ${name}` : void 0
+      };
+    }
+    return {
+      id: `optional-package-${name}`,
+      status: "pass",
+      message: `${name} is available.`,
+      evidence: resolved.version
+    };
+  });
+}
+function versionMismatchCheck(cwd) {
+  const root = resolvePackage(cwd, "agent-inspect");
+  if (!root.ok || root.version === void 0) {
+    return {
+      id: "version-alignment",
+      status: "skipped",
+      message: "Skipped version alignment \u2014 agent-inspect not installed locally."
+    };
   }
-  if (errors.length > 0 || index === void 0) {
-    return { ok: false, errors, warnings };
+  if (root.version !== version) {
+    return {
+      id: "version-alignment",
+      status: "warn",
+      message: `CLI version ${version} differs from local agent-inspect@${root.version}.`,
+      remediation: "Align versions with npm install agent-inspect@latest",
+      evidence: `cli=${version};local=${root.version}`
+    };
   }
-  const manifest = {
-    schemaVersion: WORKSPACE_SCHEMA_VERSION,
-    project: input3.project.trim(),
-    createdAt: input3.createdAt,
-    traceDirs: input3.traceDirs.map((d) => d.trim()),
-    reportsDir: input3.reportsDir.trim(),
-    artifactsDir: input3.artifactsDir.trim(),
-    bundlesDir: input3.bundlesDir.trim(),
-    notesDir: input3.notesDir.trim(),
-    redactionProfile: input3.redactionProfile,
-    index
+  return {
+    id: "version-alignment",
+    status: "pass",
+    message: `CLI and local agent-inspect are aligned at ${version}.`
   };
-  return { ok: true, manifest, errors, warnings };
 }
-function parseWorkspaceManifest(json) {
-  const warnings = [];
-  if (typeof json !== "string") {
-    return { ok: false, errors: ["manifest input must be a string"], warnings };
+async function runDoctorChecks(options = {}) {
+  const cwd = path19__default.default.resolve(options.cwd ?? process3__default.default.cwd());
+  const traceDir = options.traceDir?.trim() || process3__default.default.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
+  const checks2 = [
+    nodeVersionCheck(),
+    {
+      id: "cli-version",
+      status: "pass",
+      message: `agent-inspect CLI ${version}`,
+      evidence: version
+    },
+    await traceDirWritable(traceDir),
+    envCheck("AGENT_INSPECT"),
+    envCheck("AGENT_INSPECT_TRACE_DIR"),
+    versionMismatchCheck(cwd)
+  ];
+  if (options.checkImports !== false) {
+    checks2.push(...importSmoke(cwd));
   }
-  if (json.length > MAX_WORKSPACE_MANIFEST_BYTES) {
-    return {
-      ok: false,
-      errors: [
-        `manifest exceeds maximum size of ${MAX_WORKSPACE_MANIFEST_BYTES} bytes`
-      ],
-      warnings
-    };
+  checks2.push(...optionalPackageChecks(cwd, options.framework));
+  return checks2.sort((a, b) => a.id.localeCompare(b.id));
+}
+async function doctorCommand(options = {}) {
+  const checks2 = await runDoctorChecks(options);
+  const failed = checks2.filter((check) => check.status === "fail").length;
+  const warned = checks2.filter((check) => check.status === "warn").length;
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: failed === 0,
+          version,
+          summary: { pass: checks2.filter((c) => c.status === "pass").length, warn: warned, fail: failed },
+          checks: checks2
+        },
+        null,
+        2
+      )
+    );
+    if (failed > 0) process3__default.default.exitCode = 1;
+    return;
   }
-  let parsed;
-  try {
-    parsed = JSON.parse(json);
-  } catch {
-    return { ok: false, errors: ["manifest is not valid JSON"], warnings };
+  console.log("AgentInspect doctor");
+  for (const check of checks2) {
+    const tag = check.status.toUpperCase();
+    console.log(`[${tag}] ${check.id}: ${check.message}`);
+    if (check.remediation) console.log(`  \u2192 ${check.remediation}`);
   }
-  return validateWorkspaceManifest(parsed);
-}
-function serializeWorkspaceManifest(manifest) {
-  return `${JSON.stringify(manifest, null, 2)}
-`;
+  console.log(`
+Summary: ${failed} failed, ${warned} warnings`);
+  if (failed > 0) process3__default.default.exitCode = 1;
 }
-var INDEX_DIR_NAME = "index";
-function resolveWorkspaceLocation(cwd = process.cwd()) {
-  const projectRoot = path16__default.default.resolve(cwd);
-  const workspaceDir = path16__default.default.join(projectRoot, WORKSPACE_DIR_NAME);
-  return {
-    projectRoot,
-    workspaceDir,
-    manifestPath: path16__default.default.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
-  };
+
+// packages/adapter-sdk/src/indexer.ts
+init_advanced();
+function defineIndexer(indexer) {
+  if (!indexer.id.trim()) throw new Error("indexer id is required");
+  return indexer;
 }
-function resolveInsideWorkspace(workspaceDir, relative) {
-  const base = path16__default.default.resolve(workspaceDir);
-  const resolved = path16__default.default.resolve(base, relative);
-  const rel = path16__default.default.relative(base, resolved);
-  if (rel === "" || rel === "." || !rel.startsWith("..") && !path16__default.default.isAbsolute(rel)) {
-    return resolved;
+async function indexIsStale(snapshot, traceDir) {
+  const builtMs = Date.parse(snapshot.builtAt);
+  if (Number.isNaN(builtMs)) return true;
+  const td = new TraceDirectory({ dir: traceDir });
+  const files = await td.list();
+  for (const file of files) {
+    const stats = await td.getFileStats(file);
+    if (stats.mtimeMs > builtMs) return true;
   }
-  throw new Error(
-    `Workspace path "${relative}" resolves outside the workspace directory`
-  );
+  return false;
 }
-async function pathExists(p) {
-  try {
-    await promises.access(p);
-    return true;
-  } catch {
-    return false;
+function createTraceDirectoryIndexer() {
+  return defineIndexer({
+    id: "trace-directory-metadata",
+    async rebuild(traceDir, options = {}) {
+      const warnings = [];
+      const td = new TraceDirectory({ dir: traceDir });
+      const files = await td.list();
+      const maxEntries = options.maxEntries ?? 1e4;
+      if (files.length > maxEntries) {
+        warnings.push(
+          `indexer.truncated: trace directory has ${files.length} files; indexing first ${maxEntries}`
+        );
+      }
+      const slice = files.slice(0, maxEntries);
+      const metas = await loadTraceMetadataList(
+        traceDir,
+        slice,
+        (fileName) => td.getPath(fileName)
+      );
+      const entries = metas.map((meta2) => ({
+        runId: meta2.runId,
+        path: meta2.filePath,
+        name: meta2.name,
+        startedAt: meta2.startedAt,
+        status: meta2.status
+      })).sort((a, b) => a.runId.localeCompare(b.runId));
+      if (entries.length < slice.length) {
+        warnings.push(
+          `indexer.partial: indexed ${entries.length} of ${slice.length} trace files`
+        );
+      }
+      return {
+        traceDir,
+        builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+        entries,
+        warnings
+      };
+    }
+  });
+}
+
+// packages/cli/src/index-cmd.ts
+init_advanced();
+var INDEX_FILENAME = ".agent-inspect-index.json";
+function traceIndexPath(traceDir) {
+  return path19__default.default.join(traceDir, INDEX_FILENAME);
+}
+function parseMaxEntries(raw) {
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error("--max-entries must be a positive integer.");
   }
+  return parsed;
 }
-async function isWritable(p) {
+async function readSnapshot(indexPath2) {
   try {
-    await promises.access(p, fs.constants.W_OK);
-    return true;
+    const raw = await promises.readFile(indexPath2, "utf8");
+    return JSON.parse(raw);
   } catch {
-    return false;
+    return void 0;
   }
 }
-async function listJsonl(dir) {
+async function indexBuildCommand(options = {}) {
   try {
-    const entries = await promises.readdir(dir);
-    return entries.filter((f) => f.endsWith(".jsonl"));
-  } catch {
-    return [];
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    await promises.mkdir(traceDir, { recursive: true });
+    const indexer = createTraceDirectoryIndexer();
+    const snapshot = await indexer.rebuild(traceDir, {
+      maxEntries: parseMaxEntries(options.maxEntries)
+    });
+    const indexPath2 = traceIndexPath(traceDir);
+    await promises.writeFile(indexPath2, `${JSON.stringify(snapshot, null, 2)}
+`, "utf8");
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true, indexPath: indexPath2, ...snapshot }, null, 2));
+      return;
+    }
+    console.log(`Built trace index: ${indexPath2}`);
+    console.log(`Entries: ${snapshot.entries.length}`);
+    if (snapshot.warnings.length > 0) {
+      for (const warning of snapshot.warnings) {
+        console.log(`warning: ${warning}`);
+      }
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index build failed: ${msg}`);
+    process.exitCode = 1;
   }
 }
-async function countFiles(dir) {
+async function indexStatusCommand(options = {}) {
   try {
-    const entries = await promises.readdir(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isFile()).length;
-  } catch {
-    return 0;
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const indexPath2 = traceIndexPath(traceDir);
+    const snapshot = await readSnapshot(indexPath2);
+    if (!snapshot) {
+      const payload2 = { ok: true, exists: false, indexPath: indexPath2, traceDir, stale: true };
+      if (options.json) {
+        console.log(JSON.stringify(payload2, null, 2));
+      } else {
+        console.log(`No index at ${indexPath2}`);
+        console.log("Run: agent-inspect index build");
+      }
+      return;
+    }
+    const stale = await indexIsStale(snapshot, traceDir);
+    const payload = {
+      ok: true,
+      exists: true,
+      indexPath: indexPath2,
+      traceDir,
+      stale,
+      builtAt: snapshot.builtAt,
+      entries: snapshot.entries.length,
+      warnings: snapshot.warnings
+    };
+    if (options.json) {
+      console.log(JSON.stringify(payload, null, 2));
+      return;
+    }
+    console.log(`Index: ${indexPath2}`);
+    console.log(`Built: ${snapshot.builtAt}`);
+    console.log(`Entries: ${snapshot.entries.length}`);
+    console.log(`Stale: ${stale ? "yes" : "no"}`);
+    if (snapshot.warnings.length > 0) {
+      for (const warning of snapshot.warnings) {
+        console.log(`warning: ${warning}`);
+      }
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index status failed: ${msg}`);
+    process.exitCode = 1;
   }
 }
-async function readWorkspaceManifestFile(location) {
-  let raw;
+async function indexCleanCommand(options = {}) {
   try {
-    raw = await promises.readFile(location.manifestPath, "utf-8");
-  } catch {
-    return { exists: false, ok: false, errors: ["workspace.json not found"], warnings: [] };
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const indexPath2 = traceIndexPath(traceDir);
+    await promises.rm(indexPath2, { force: true });
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true, removed: indexPath2 }, null, 2));
+      return;
+    }
+    console.log(`Removed index: ${indexPath2}`);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index clean failed: ${msg}`);
+    process.exitCode = 1;
   }
-  const parsed = parseWorkspaceManifest(raw);
-  return {
-    exists: true,
-    ok: parsed.ok,
-    ...parsed.manifest ? { manifest: parsed.manifest } : {},
-    errors: parsed.errors,
-    warnings: parsed.warnings
-  };
 }
-async function createWorkspace(options = {}) {
-  const location = resolveWorkspaceLocation(options.cwd);
-  const dryRun = options.dryRun === true;
-  const existing = await readWorkspaceManifestFile(location);
-  const topLevelTraces = await listJsonl(location.workspaceDir);
-  const detectedExistingTraces = topLevelTraces.length > 0;
-  let manifest;
-  let created;
-  let adopted;
-  if (existing.exists && existing.ok && existing.manifest) {
-    manifest = existing.manifest;
-    created = false;
-    adopted = true;
-  } else {
-    const project = options.project?.trim() || path16__default.default.basename(location.projectRoot) || "workspace";
-    const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
-    manifest = createDefaultWorkspaceManifest({
-      project,
-      traceDirs,
-      ...options.redactionProfile ? { redactionProfile: options.redactionProfile } : {}
-    });
-    created = true;
-    adopted = detectedExistingTraces || existing.exists && !existing.ok;
-  }
-  const relDirs = uniqueDirs([
-    ...manifest.traceDirs.filter((d) => d !== "."),
-    manifest.reportsDir,
-    manifest.artifactsDir,
-    manifest.bundlesDir,
-    manifest.notesDir,
-    INDEX_DIR_NAME
-  ]);
-  const createdDirs = [];
-  for (const rel of relDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    if (await pathExists(abs)) continue;
-    createdDirs.push(rel);
-    if (!dryRun) await promises.mkdir(abs, { recursive: true });
-  }
-  if (!dryRun && created) {
-    await promises.mkdir(location.workspaceDir, { recursive: true });
-    await promises.writeFile(location.manifestPath, serializeWorkspaceManifest(manifest), "utf-8");
-  }
-  return {
-    location,
-    manifest,
-    created,
-    adopted,
-    createdDirs,
-    detectedExistingTraces,
-    dryRun
-  };
+
+// packages/cli/src/index-sqlite-cmd.ts
+init_advanced();
+var PACKAGE = "@agent-inspect/index-sqlite";
+function isModuleNotFound3(e) {
+  return e !== null && typeof e === "object" && "code" in e && (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND");
 }
-function uniqueDirs(dirs) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const d of dirs) {
-    const t = d.trim();
-    if (t === "" || t === "." || seen.has(t)) continue;
-    seen.add(t);
-    out.push(t);
+async function loadIndexSqlite() {
+  try {
+    return await Promise.resolve().then(() => (init_src(), src_exports));
+  } catch (e) {
+    if (isModuleNotFound3(e)) {
+      console.error(
+        `The optional SQLite index is not installed. Run: npm install ${PACKAGE}`
+      );
+      process.exitCode = 1;
+      return null;
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] failed to load ${PACKAGE}: ${msg}`);
+    process.exitCode = 1;
+    return null;
   }
-  return out;
 }
-async function getWorkspaceStatus(location, manifest) {
-  let traceFiles = 0;
-  for (const rel of manifest.traceDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    traceFiles += (await listJsonl(abs)).length;
+function parsePositiveInt(raw, flag) {
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${flag} must be a positive integer.`);
   }
-  const reports = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.reportsDir)
-  );
-  const artifacts = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.artifactsDir)
-  );
-  const bundles = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.bundlesDir)
-  );
-  const notes = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.notesDir)
-  );
-  const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
-  return {
-    project: manifest.project,
-    traceFiles,
-    reports,
-    artifacts,
-    bundles,
-    notes,
-    index: {
-      enabled: manifest.index.enabled,
-      type: manifest.index.type,
-      exists: await pathExists(indexPath2)
+  return parsed;
+}
+async function newestTraceMtimeMs2(traceDir) {
+  let newest = 0;
+  try {
+    const files = await promises.readdir(traceDir);
+    for (const file of files) {
+      if (!file.endsWith(".jsonl")) continue;
+      try {
+        const s = await promises.stat(path19__default.default.join(traceDir, file));
+        if (s.mtimeMs > newest) newest = s.mtimeMs;
+      } catch {
+      }
     }
-  };
+  } catch {
+  }
+  return newest;
 }
-async function doctorWorkspace(location) {
-  const checks2 = [];
-  const manifestResult = await readWorkspaceManifestFile(location);
-  if (!manifestResult.exists) {
-    checks2.push({
-      id: "manifest",
-      status: "fail",
-      message: "workspace.json not found (run `agent-inspect workspace init`)"
-    });
-    return { ok: false, checks: checks2 };
+async function indexSqliteBuildCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const result = await mod.buildIndex({
+    traceDir: options.dir,
+    maxRuns: parsePositiveInt(options.maxRuns, "--max-runs")
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+    return;
   }
-  if (!manifestResult.ok || !manifestResult.manifest) {
-    checks2.push({
-      id: "manifest",
-      status: "fail",
-      message: `workspace.json is invalid: ${manifestResult.errors.join("; ")}`
-    });
-    return { ok: false, checks: checks2 };
+  console.log(`Built SQLite index: ${result.dbPath}`);
+  console.log(`Runs: ${result.runs}  Steps: ${result.steps}  Errors: ${result.errors}`);
+  for (const warning of result.warnings) console.log(`warning: ${warning}`);
+}
+async function indexSqliteStatusCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  const status = mod.indexStatus(dbPath);
+  const stale = mod.isIndexStale(dbPath, await newestTraceMtimeMs2(traceDir));
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, traceDir, stale, ...status }, null, 2));
+    return;
   }
-  const manifest = manifestResult.manifest;
-  checks2.push({ id: "manifest", status: "pass", message: "workspace.json is valid" });
-  for (const warning of manifestResult.warnings) {
-    checks2.push({ id: "manifest-warning", status: "warn", message: warning });
+  if (!status.exists) {
+    console.log(`No SQLite index at ${dbPath}`);
+    console.log("Run: agent-inspect index sqlite build");
+    return;
   }
-  const dirFields = [
-    ...manifest.traceDirs.filter((d) => d !== ".").map((d, i) => [`traceDir[${i}]`, d]),
-    ["reportsDir", manifest.reportsDir],
-    ["artifactsDir", manifest.artifactsDir],
-    ["bundlesDir", manifest.bundlesDir],
-    ["notesDir", manifest.notesDir]
-  ];
-  for (const [id, rel] of dirFields) {
-    let abs;
-    try {
-      abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    } catch (error) {
-      checks2.push({
-        id,
-        status: "fail",
-        message: error instanceof Error ? error.message : String(error)
-      });
-      continue;
-    }
-    if (!await pathExists(abs)) {
-      checks2.push({ id, status: "warn", message: `${rel}/ does not exist yet` });
-    } else if (!await isWritable(abs)) {
-      checks2.push({ id, status: "fail", message: `${rel}/ is not writable` });
+  console.log(`Index: ${status.dbPath}`);
+  console.log(`Healthy: ${status.healthy ? "yes" : "no"}`);
+  console.log(`Built: ${status.builtAt ?? "unknown"}`);
+  console.log(`Runs: ${status.runs}  Steps: ${status.steps}`);
+  console.log(`Stale: ${stale ? "yes" : "no"}`);
+}
+async function indexSqliteQueryCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  const status = mod.indexStatus(dbPath);
+  if (!status.exists || !status.healthy) {
+    if (options.json) {
+      console.log(JSON.stringify({ ok: false, reason: "index-missing", dbPath }, null, 2));
     } else {
-      checks2.push({ id, status: "pass", message: `${rel}/ is present and writable` });
+      console.log("No usable SQLite index. Run: agent-inspect index sqlite build");
     }
+    process.exitCode = 1;
+    return;
   }
-  let newestTraceMtime = 0;
-  for (const rel of manifest.traceDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    for (const file of await listJsonl(abs)) {
-      try {
-        const s = await promises.stat(path16__default.default.join(abs, file));
-        newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
-      } catch {
-        checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
-      }
-    }
+  const rows = mod.queryRuns(dbPath, {
+    status: options.status,
+    sessionId: options.session,
+    name: options.name,
+    kind: options.kind,
+    tool: options.tool,
+    limit: parsePositiveInt(options.limit, "--limit")
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, count: rows.length, runs: rows }, null, 2));
+    return;
   }
-  if (manifest.index.enabled) {
-    const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
-    if (!await pathExists(indexPath2)) {
-      checks2.push({ id: "index", status: "warn", message: "index enabled but not built" });
-    } else {
-      try {
-        const s = await promises.stat(indexPath2);
-        if (newestTraceMtime > s.mtimeMs) {
-          checks2.push({ id: "index", status: "warn", message: "index is stale (traces are newer)" });
-        } else {
-          checks2.push({ id: "index", status: "pass", message: "index is present" });
-        }
-      } catch {
-        checks2.push({ id: "index", status: "warn", message: "cannot stat index" });
-      }
-    }
+  if (rows.length === 0) {
+    console.log("No matching runs.");
+    return;
+  }
+  for (const run of rows) {
+    const parts = [
+      run.runId,
+      run.status ?? "unknown",
+      run.name ?? "",
+      run.durationMs != null ? `${run.durationMs}ms` : ""
+    ].filter((p) => p !== "");
+    console.log(parts.join("  "));
   }
-  const ok = !checks2.some((c) => c.status === "fail");
-  return { ok, checks: checks2 };
 }
-async function cleanWorkspace(location, manifest, options = {}) {
-  const dryRun = options.confirm !== true;
-  const targets = uniqueDirs([
-    manifest.reportsDir,
-    manifest.artifactsDir,
-    manifest.bundlesDir,
-    manifest.index.path ?? INDEX_DIR_NAME
-  ]);
-  const removed = [];
-  for (const rel of targets) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    let entries;
-    try {
-      entries = await promises.readdir(abs);
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const relPath = `${rel}/${entry}`;
-      removed.push(relPath);
-      if (!dryRun) {
-        await promises.rm(path16__default.default.join(abs, entry), { recursive: true, force: true });
-      }
-    }
+async function indexSqliteCleanCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  await mod.cleanIndex(dbPath);
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, removed: dbPath }, null, 2));
+    return;
   }
-  return { dryRun, removed };
+  console.log(`Removed SQLite index: ${dbPath}`);
 }
 
 // packages/cli/src/workspace.ts
@@ -18252,6 +18836,11 @@ function createCliProgram() {
   ).option("--run <run-id>", "select a run when the trace contains multiple runs").option("--baseline <trace-path-or-run-id>", "optional baseline trace for diff artifacts").option("--baseline-run <run-id>", "select a run from the baseline trace").option("--github-summary <path>", "append a safe summary to this file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON manifest").action((target, opts) => {
     runCommand(() => artifactsCommand(target, opts));
   });
+  program.command("bundle").description("Create a share-safe offline trace bundle (local folder)").argument("[run-id]", "run id to bundle (optional with --session or --since)").option("--dir <path>", "trace directory for run/session lookup").option("--session <session-id>", "bundle all runs in a session").option("--since <duration>", "bundle runs with activity since a duration (e.g. 24h)").addOption(
+    new commander.Option("--profile <profile>", "redaction profile for exported copies").choices(["local", "share", "strict"]).default("share")
+  ).option("--out <path>", "output directory (folder; .zip suffix is stripped)").option("--allow-unsafe", "write bundle even when verify-safe reports UNSAFE").option("--json", "print deterministic JSON manifest").action((runId, opts) => {
+    runCommand(() => bundleCommand(runId, opts));
+  });
   program.command("ci-summary").description("Summarize local reporter artifact manifests for CI").argument("<manifest...>", "reporter artifact manifest JSON files").option("-o, --output <path>", "write Markdown summary to a local file").option("--github-summary <path>", "append Markdown summary to this local file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON summary").action((manifest, opts) => {
     runCommand(() => ciSummaryCommand(manifest, opts));
   });
@@ -18456,9 +19045,9 @@ function isPrimaryModule() {
   if (!entry) return false;
   const selfPath = url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
   try {
-    return fs.realpathSync(path16__default.default.resolve(entry)) === fs.realpathSync(path16__default.default.resolve(selfPath));
+    return fs.realpathSync(path19__default.default.resolve(entry)) === fs.realpathSync(path19__default.default.resolve(selfPath));
   } catch {
-    return path16__default.default.resolve(entry) === path16__default.default.resolve(selfPath);
+    return path19__default.default.resolve(entry) === path19__default.default.resolve(selfPath);
   }
 }
 if (isPrimaryModule()) {