agent-inspect 4.2.0 → 4.4.0

package/packages/cli/dist/index.mjs

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { resolveTraceDir, parseDuration, buildSessionIndex, enrichSessionRunRecord, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, extractMetadata, filterTraces, truncateName, getTraceFilePath, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, Redactor, validateEvent, isPersistedInspectEvent, nanoid, resolveRedactionProfile, applyProfileMetadataCaps, extractCorrelationMetadata, truncateStringForProfile, parseTraceJsonl } from './chunk-5VSPJEZ7.mjs';
+import { resolveTraceDir, parseDuration, buildSessionIndex, enrichSessionRunRecord, TraceDirectory, loadTraceMetadataList, loadSessionRunRecords, extractMetadata, filterTraces, truncateName, getTraceFilePath, buildRunSummary, formatDuration, formatTimestamp, isAgentInspectTrace, filterMetasBySessionScope, aggregateSessionCheckResults, resolveBundleRunIds, aggregateBundleSafeStatus, bundleFailsOnSafety, buildPlaceholderArtifact, buildBundleMetadata, buildBundleSummaryMarkdown, buildRunTimeline, renderTimeline, buildTraceStats, renderTraceStats, parseDurationFilter, searchTraces, buildActivitySummary, renderActivitySummaryHuman, buildRunWhatSummary, renderRunWhat, buildLocalExplanation, persistedInspectEventsToTraceEvents, renderStepLine, renderErrorLine, getIndent, Redactor, validateEvent, isPersistedInspectEvent, normalizeBundleOutputPath, defaultBundleOutputPath, summarizeObservedOutcomes, extractOutcomesFromTraceEvents, renderObservedOutcomesMarkdown, renderObservedOutcomesHtml, nanoid, resolveRedactionProfile, applyProfileMetadataCaps, extractCorrelationMetadata, extractOutcomesFromPersistedEvents, outcomesMatchingStatus, truncateStringForProfile, parseTraceJsonl } from './chunk-ORHDQUT6.mjs';
 import { realpathSync, constants as constants$1 } from 'fs';
-import path11 from 'path';
+import path13 from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, Option } from 'commander';
-import { unlink, stat, mkdir, writeFile, appendFile, rm, access, readFile, open, readdir, constants } from 'fs/promises';
+import { unlink, stat, mkdir, writeFile, appendFile, readFile, rm, access, open, readdir, constants } from 'fs/promises';
 import process2, { stdin, stdout } from 'process';
 import crypto, { createHash } from 'crypto';
 import { createServer } from 'http';
 import { createRequire } from 'module';
 
 // package.json
-var version = "4.2.0";
+var version = "4.4.0";
 
 // packages/cli/src/trace-dir-scale.ts
 var TRACE_COUNT_WARN = 1e3;
@@ -353,6 +353,8 @@ function nodeIdForEvent(event) {
     case "step_started":
     case "step_completed":
       return event.stepId;
+    case "outcome_observed":
+      return event.outcomeId;
     default:
       return "unknown";
   }
@@ -536,6 +538,39 @@ function traceEventToPersistedInspectEvent(event, options) {
         error
       };
     }
+    case "outcome_observed": {
+      const tsObserved = toIsoTimestamp(event.observedAt);
+      const attributes = compactAttributes({
+        legacyEvent: "outcome_observed",
+        outcomeId: event.outcomeId,
+        outcomeStatus: event.status,
+        expectation: event.expectation,
+        method: event.method,
+        actual: event.actual,
+        evidence: event.evidence,
+        observedAt: tsObserved.iso,
+        invalidTimestamp: tsMain.invalidTimestamp || tsObserved.invalidTimestamp ? true : void 0
+      });
+      const out = {
+        schemaVersion: "0.2",
+        eventId,
+        runId: event.runId,
+        kind: "OUTCOME",
+        name: event.name,
+        status: event.status === "failed" ? "error" : "ok",
+        timestamp: tsMain.iso,
+        confidence: "explicit",
+        source,
+        attributes
+      };
+      if (event.parentId !== void 0) {
+        out.parentId = event.parentId;
+      }
+      if (event.actual !== void 0) {
+        out.outputSummary = event.actual;
+      }
+      return out;
+    }
     default: {
       const _exhaustive = event;
       throw new Error(`Unsupported trace event: ${_exhaustive.event}`);
@@ -895,7 +930,7 @@ function findReaderByFormat(format, readers) {
 }
 async function jsonlFilesInDirectory(dirPath) {
   const entries = await readdir(dirPath, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path11.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path13.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
 }
 async function resolveInput(input3) {
   const cached = resolvedInputCache.get(input3);
@@ -1265,7 +1300,7 @@ function sanitizeOpenInferenceAttributes(attributes, pathPrefix) {
 function mapOpenInferenceKind(span, attributes, pathPrefix) {
   const warnings = [];
   const agentInspectKind = attributes["agent_inspect.kind"];
-  if (agentInspectKind === "RUN" || agentInspectKind === "AGENT" || agentInspectKind === "LLM" || agentInspectKind === "TOOL" || agentInspectKind === "CHAIN" || agentInspectKind === "RETRIEVER" || agentInspectKind === "DECISION" || agentInspectKind === "RESULT" || agentInspectKind === "ERROR" || agentInspectKind === "LOGIC" || agentInspectKind === "LOG") {
+  if (agentInspectKind === "RUN" || agentInspectKind === "AGENT" || agentInspectKind === "LLM" || agentInspectKind === "TOOL" || agentInspectKind === "CHAIN" || agentInspectKind === "RETRIEVER" || agentInspectKind === "DECISION" || agentInspectKind === "RESULT" || agentInspectKind === "ERROR" || agentInspectKind === "LOGIC" || agentInspectKind === "LOG" || agentInspectKind === "OUTCOME") {
     return { kind: agentInspectKind, warnings };
   }
   const rawKind = readStringField(span, ["kind", "span_kind", "spanKind"]) ?? (typeof attributes["openinference.span.kind"] === "string" ? attributes["openinference.span.kind"] : void 0);
@@ -1786,7 +1821,7 @@ function mapOtlpStatus(status) {
 function readOtlpKind(attributes, pathPrefix) {
   const warnings = [];
   const agentInspectKind = attributes["agent_inspect.kind"];
-  if (agentInspectKind === "RUN" || agentInspectKind === "AGENT" || agentInspectKind === "LLM" || agentInspectKind === "TOOL" || agentInspectKind === "CHAIN" || agentInspectKind === "RETRIEVER" || agentInspectKind === "DECISION" || agentInspectKind === "RESULT" || agentInspectKind === "ERROR" || agentInspectKind === "LOGIC" || agentInspectKind === "LOG") {
+  if (agentInspectKind === "RUN" || agentInspectKind === "AGENT" || agentInspectKind === "LLM" || agentInspectKind === "TOOL" || agentInspectKind === "CHAIN" || agentInspectKind === "RETRIEVER" || agentInspectKind === "DECISION" || agentInspectKind === "RESULT" || agentInspectKind === "ERROR" || agentInspectKind === "LOGIC" || agentInspectKind === "LOG" || agentInspectKind === "OUTCOME") {
     return { kind: agentInspectKind, warnings };
   }
   const operation = attributes["gen_ai.operation.name"];
@@ -3914,6 +3949,40 @@ function redactTraceEventsForReport(events, options) {
             )
           } : {}
         };
+      case "outcome_observed": {
+        const actualAttrs = event.actual !== void 0 ? redactEventAttributes(
+          { value: event.actual },
+          redactor,
+          maxMetadataValueLength,
+          maxPreviewLength
+        ) : void 0;
+        const redactedActual = actualAttrs !== void 0 && "value" in actualAttrs ? actualAttrs.value : void 0;
+        const redactedEvidence = event.evidence !== void 0 ? redactEventAttributes(
+          isRecord6(event.evidence) ? event.evidence : { value: event.evidence },
+          redactor,
+          maxMetadataValueLength,
+          maxPreviewLength
+        ) : void 0;
+        return {
+          ...event,
+          name: truncateStringForProfile(
+            event.name,
+            "name",
+            maxMetadataValueLength,
+            maxPreviewLength
+          ),
+          expectation: truncateStringForProfile(
+            event.expectation,
+            "expectation",
+            maxMetadataValueLength,
+            maxPreviewLength
+          ),
+          ...redactedActual !== void 0 ? { actual: redactedActual } : {},
+          ...redactedEvidence !== void 0 ? { evidence: redactedEvidence } : {}
+        };
+      }
+      default:
+        return event;
     }
   });
 }
@@ -4052,7 +4121,8 @@ function zeroKinds() {
     RESULT: 0,
     ERROR: 0,
     LOGIC: 0,
-    LOG: 0
+    LOG: 0,
+    OUTCOME: 0
   };
 }
 
@@ -4361,7 +4431,8 @@ function exportOpenInference(tree, options) {
   ];
   const traceId = hexFrom(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
-  const maxLen = options?.maxAttributeLength;
+  const maxLen = options?.maxAttributeLength ?? 500;
+  const pretty = options?.pretty ?? true;
   const spans = [];
   for (const n of flattenTree(tree)) {
     const ev = n.event;
@@ -4435,7 +4506,7 @@ function exportOpenInference(tree, options) {
   };
   return {
     format: "openinference",
-    content: JSON.stringify(payload, null, 2 ),
+    content: JSON.stringify(payload, null, pretty ? 2 : void 0),
     contentType: "application/json",
     fileExtension: ".openinference.json",
     warnings
@@ -4469,7 +4540,8 @@ function exportOtlpJson(tree, options) {
   ];
   const traceId = hexFrom2(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
-  const maxLen = options?.maxAttributeLength;
+  const maxLen = options?.maxAttributeLength ?? 500;
+  const pretty = options?.pretty ?? true;
   const flat = flattenTree(tree);
   const spans = [];
   for (const n of flat) {
@@ -4565,7 +4637,7 @@ function exportOtlpJson(tree, options) {
   };
   return {
     format: "otlp-json",
-    content: JSON.stringify(payload, null, 2 ),
+    content: JSON.stringify(payload, null, pretty ? 2 : void 0),
     contentType: "application/json",
     fileExtension: ".otlp.json",
     warnings
@@ -4788,9 +4860,9 @@ function mergeExportDefaults(options) {
     includeMetadata: options.includeMetadata ?? true,
     includeAttributes: options.includeAttributes ?? false,
     includeErrors: options.includeErrors ?? true,
-    pretty: options.pretty,
-    redacted: options.redacted,
-    maxAttributeLength: options.maxAttributeLength,
+    pretty: options.pretty ?? true,
+    redacted: options.redacted ?? true,
+    maxAttributeLength: options.maxAttributeLength ?? 500,
     redactionProfile: options.redactionProfile ?? "local"
   };
 }
@@ -4853,9 +4925,34 @@ footer{margin-top:2rem;font-size:0.85rem;color:#555}
 `.trim();
 function buildRunReport(events, options) {
   const profile = options.redactionProfile ?? "local";
+  const section = options.section ?? "all";
   const safeEvents = redactTraceEventsForReport(events, {
     redactionProfile: profile
   });
+  const outcomes = summarizeObservedOutcomes(
+    extractOutcomesFromTraceEvents(safeEvents)
+  );
+  const observationsMarkdown = renderObservedOutcomesMarkdown(outcomes);
+  const observationsHtml = renderObservedOutcomesHtml(outcomes);
+  if (section === "observations") {
+    if (options.format === "markdown") {
+      return {
+        format: "markdown",
+        content: `## Observed outcomes
+
+${observationsMarkdown}
+`,
+        contentType: "text/markdown",
+        fileExtension: ".md"
+      };
+    }
+    return {
+      format: "html",
+      content: `<!doctype html><html lang="en"><head><meta charset="utf-8"/><title>Observed outcomes</title><style>${REPORT_HTML_CSS}</style></head><body><h1>Observed outcomes</h1>${observationsHtml}</body></html>`,
+      contentType: "text/html",
+      fileExtension: ".html"
+    };
+  }
   const whatSummary = buildRunWhatSummary(safeEvents);
   const whatText = renderRunWhat(whatSummary, {
     correlation: options.correlation !== false
@@ -4889,6 +4986,10 @@ function buildRunReport(events, options) {
       "```text",
       timelineText,
       "```",
+      "",
+      "## Observed outcomes",
+      "",
+      observationsMarkdown,
       ""
     ];
     if (tail2) {
@@ -4932,6 +5033,7 @@ function buildRunReport(events, options) {
 <p class="note">Generated locally by AgentInspect. Review for sensitive data before sharing.</p>
 <section class="what"><h2>What happened</h2><pre>${escapeHtml(whatText)}</pre></section>
 <section class="timeline"><h2>Timeline</h2><pre>${escapeHtml(timelineText)}</pre></section>
+<section class="observations"><h2>Observed outcomes</h2>${observationsHtml}</section>
 ${treeSection || '<section class="tree"><h2>Execution tree</h2><p>No steps recorded.</p></section>'}
 ${errorsSection}
 ${attrsSection}
@@ -5024,9 +5126,9 @@ Trace directory: ${traceDir}`);
   if (validation !== void 0 && !validation.ok) {
     process.exitCode = 1;
   }
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path11.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await mkdir(path11.dirname(outPath), { recursive: true });
+    await mkdir(path13.dirname(outPath), { recursive: true });
     await writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
     console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
@@ -5203,13 +5305,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path18 = buildPath(segments);
+  const path19 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path18,
+      path: path19,
       left: L.name,
       right: R.name
     });
@@ -5219,7 +5321,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path18,
+      path: path19,
       left: L.type,
       right: R.type
     });
@@ -5229,7 +5331,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path18,
+      path: path19,
       left: L.status,
       right: R.status
     });
@@ -5241,7 +5343,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path18,
+      path: path19,
       left: le || void 0,
       right: re || void 0
     });
@@ -5259,7 +5361,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path18,
+        path: path19,
         left: ld,
         right: rd
       });
@@ -5272,7 +5374,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path18,
+      path: path19,
       left: L.metadata,
       right: R.metadata
     });
@@ -5284,7 +5386,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path18,
+      path: path19,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -5444,11 +5546,11 @@ function diffRuns(left, right, options) {
 }
 
 // packages/core/src/diff/renderer.ts
-function formatPath(path18) {
-  if (path18 === void 0 || path18.path.length === 0) {
+function formatPath(path19) {
+  if (path19 === void 0 || path19.path.length === 0) {
     return "(run)";
   }
-  return path18.path.map((s) => s.name).join(" > ");
+  return path19.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -5783,7 +5885,8 @@ async function searchCommand(options = {}) {
       duration: options.duration,
       limit: parseLimit2(options.limit),
       ...sessionId ? { session: sessionId } : {},
-      ...options.correlateGroup ? { correlateGroup: true } : {}
+      ...options.correlateGroup ? { correlateGroup: true } : {},
+      ...options.observation ? { observation: options.observation } : {}
     });
     if (options.json) {
       console.log(JSON.stringify(results, null, 2));
@@ -5826,7 +5929,7 @@ function indexedToMetadata(row, traceDir) {
     endedAt: row.endedAt ?? void 0,
     durationMs: row.durationMs ?? void 0,
     eventCount: 0,
-    filePath: path11.join(traceDir, row.file),
+    filePath: path13.join(traceDir, row.file),
     fileSize: 0,
     createdAt: new Date(row.mtimeMs)
   };
@@ -5855,7 +5958,7 @@ async function newestTraceMtimeMs(traceDir) {
 }
 async function loadSessionRuns(traceDir) {
   try {
-    const mod = await import('./src-VQT7QLGV.mjs');
+    const mod = await import('./src-FJOHPC4X.mjs');
     const dbPath = mod.resolveIndexDbPath(traceDir);
     const status = mod.indexStatus(dbPath);
     if (!status.healthy) {
@@ -6300,11 +6403,12 @@ async function reportCommand(runId, options = {}) {
     includeAttributes: options.includeAttributes === true,
     includeErrors: options.noErrors !== true,
     redactionProfile,
-    correlation: !options.noCorrelation
+    correlation: !options.noCorrelation,
+    ...options.section ? { section: options.section } : {}
   });
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path11.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await mkdir(path11.dirname(outPath), { recursive: true });
+    await mkdir(path13.dirname(outPath), { recursive: true });
     await writeFile(outPath, result.content, "utf-8");
     console.log(`Wrote ${result.fileExtension} report to ${outPath}`);
   }
@@ -6551,17 +6655,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path18, key) {
+function childPath(path19, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path18 ? `${path18}.${key}` : key;
+    return path19 ? `${path19}.${key}` : key;
   }
-  return `${path18 || "$"}[${JSON.stringify(key)}]`;
+  return `${path19 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path18, index) {
-  return `${path18 || "$"}[${index}]`;
+function indexPath(path19, index) {
+  return `${path19 || "$"}[${index}]`;
 }
-function makeFinding(path18, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path18, detector, action, severity, matchKind } : { path: path18, detector, action, severity, matchKind, preview };
+function makeFinding(path19, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path19, detector, action, severity, matchKind } : { path: path19, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -6630,11 +6734,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path18, depth, state) {
+  #redactValue(value, key, path19, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path18, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path19, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -6643,19 +6747,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path18, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path19, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path18, key, value });
+      const detections = detector.detect({ path: path19, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path18,
+            path19,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -6673,7 +6777,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path18, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path19, index), depth + 1, state);
       });
       return out;
     }
@@ -6685,7 +6789,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path18 === "$" ? "" : path18, entryKey),
+          childPath(path19 === "$" ? "" : path19, entryKey),
           depth + 1,
           state
         );
@@ -6811,6 +6915,9 @@ function redactDocument(content, profile) {
     return redactJsonlText(content, profile);
   }
 }
+function redactTraceContent(content, profile) {
+  return redactDocument(content, profile);
+}
 async function redactCommand(target, options = {}, stdin = process.stdin) {
   const profile = parseRedactionProfile3(options.profile);
   const source = await contentFromTarget(target, options, stdin);
@@ -7132,14 +7239,14 @@ function uniqueSorted(values) {
   return [...new Set(values)].sort();
 }
 function isWithinDirectory(child, parent) {
-  const relative = path11.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path11.isAbsolute(relative);
+  const relative = path13.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path13.isAbsolute(relative);
 }
 async function resolveOutputPath(inputPath, output2, force) {
   if (output2 === void 0 || output2.trim() === "") return void 0;
-  const inputAbs = path11.resolve(inputPath);
-  const outputAbs = path11.resolve(output2.trim());
-  const inputDir = path11.dirname(inputAbs);
+  const inputAbs = path13.resolve(inputPath);
+  const outputAbs = path13.resolve(output2.trim());
+  const inputDir = path13.dirname(inputAbs);
   if (!isWithinDirectory(outputAbs, inputDir)) {
     throw new Error("Refusing to write migrated output outside the input directory.");
   }
@@ -7260,7 +7367,7 @@ async function migrateCommand(input3, options = {}) {
     process.exitCode = 1;
     return;
   }
-  const inputPath = path11.resolve(input3.trim());
+  const inputPath = path13.resolve(input3.trim());
   const dryRun = options.dryRun === true;
   if (!dryRun && (options.output === void 0 || options.output.trim() === "")) {
     console.error("migrate requires --dry-run or --output <path>.");
@@ -7279,7 +7386,7 @@ async function migrateCommand(input3, options = {}) {
     );
     const result = await buildMigration(inputPath, outputPath);
     if (!dryRun && outputPath !== void 0) {
-      await mkdir(path11.dirname(outputPath), { recursive: true });
+      await mkdir(path13.dirname(outputPath), { recursive: true });
       await writeFile(outputPath, result.content, "utf-8");
     }
     printSummary2(result, dryRun);
@@ -7557,7 +7664,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path18) {
+function eventEvidence(event, path19) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -7567,7 +7674,7 @@ function eventEvidence(event, path18) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path18 ? { path: path18 } : {}
+    ...path19 ? { path: path19 } : {}
   };
 }
 function runEvidence(run) {
@@ -7630,9 +7737,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path18) {
-  const parts = path18.split(".");
-  return parts[parts.length - 1] ?? path18;
+function lastPathSegment(path19) {
+  const parts = path19.split(".");
+  return parts[parts.length - 1] ?? path19;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -7646,12 +7753,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path18, key, depth = 0) {
-  entries.push({ event, path: path18, key, value });
+function pushValueEntries(entries, event, value, path19, key, depth = 0) {
+  entries.push({ event, path: path19, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path18}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path19}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -7661,7 +7768,7 @@ function pushValueEntries(entries, event, value, path18, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path18}.${nestedKey}`,
+      `${path19}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -7742,9 +7849,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path18) => {
-    lines.push(`${path18}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path18}.${index}`));
+  const visit = (node, path19) => {
+    lines.push(`${path19}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path19}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -7793,9 +7900,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path18) {
+function firstEvidenceForKind(context, kind, path19) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path18)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path19)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -8145,13 +8252,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path18 = [];
+        const path19 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path18.slice(existing);
+            const cycle = path19.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -8167,8 +8274,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path18.length);
-          path18.push(current);
+          seenAt.set(current.eventId, path19.length);
+          path19.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -8601,6 +8708,40 @@ function createBaselineRegressionRule(options) {
     }
   };
 }
+function createObservedOutcomeRule(options = {}) {
+  const failOn = options.failOn ?? ["failed"];
+  return {
+    id: "outcome.status",
+    category: "run",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const outcomes = extractOutcomesFromPersistedEvents(context.events);
+      const matching = outcomesMatchingStatus(outcomes, failOn);
+      if (matching.length === 0) return [];
+      return [
+        failFinding(
+          "outcome.status",
+          `Observed outcome count ${matching.length} matched [${failOn.join(", ")}].`,
+          matching.map((outcome) => ({
+            runId: outcome.runId,
+            eventId: outcome.outcomeId,
+            ...outcome.parentId !== void 0 ? { parentId: outcome.parentId } : {},
+            kind: "OUTCOME",
+            name: outcome.name,
+            status: outcome.status,
+            path: `outcome.${outcome.name}`
+          })),
+          { failOn },
+          matching.map((outcome) => ({
+            name: outcome.name,
+            status: outcome.status,
+            expectation: outcome.expectation
+          }))
+        )
+      ];
+    }
+  };
+}
 function runTraceChecks(input3, options = {}) {
   const selected = resolveSelectedRun(input3, options.runId);
   if (selected.diagnostics.length > 0) {
@@ -8965,23 +9106,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path18, evidence) {
+function validateSchemaField(value, field, path19, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path18, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path19, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path18, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path19, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path18}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path19}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -9308,7 +9449,7 @@ function asConfig(value) {
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
-  const extension = path11.extname(configPath);
+  const extension = path13.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
     throw new Error(
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -9317,7 +9458,7 @@ async function loadConfig(configPath) {
   if (!CONFIG_EXTENSIONS.has(extension)) {
     throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path11.resolve(configPath);
+  const absolute = path13.resolve(configPath);
   if (extension === ".json") {
     const raw = await readFile(absolute, "utf-8");
     return asConfig(JSON.parse(raw));
@@ -9372,6 +9513,22 @@ function buildRules(config, options) {
   if (options.detectStalls) {
     rules.push(createStallDetectionRule({ requireEndedAt: true }));
   }
+  if (options.failOnObservation !== void 0 && options.failOnObservation.trim() !== "") {
+    try {
+      const statuses = options.failOnObservation.split(",").map((value) => value.trim()).filter((value) => value !== "").map((value) => {
+        if (value === "passed" || value === "failed" || value === "unknown" || value === "skipped") {
+          return value;
+        }
+        throw new Error(`unsupported status "${value}"`);
+      });
+      rules.push(createObservedOutcomeRule({ failOn: statuses }));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      diagnostics.push(
+        diagnostic2("AI_CHECK_INVALID_ARGUMENTS", `--fail-on-observation: ${message}`)
+      );
+    }
+  }
   if (run.maxDepth !== void 0) {
     rules.push(createRunDepthRule({ maxDepth: run.maxDepth }));
   }
@@ -9466,10 +9623,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path18 = finding.evidence[0]?.path;
+    const path19 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path18 ? ` (${path18})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -9669,7 +9826,7 @@ function createViewerServer(options = {}) {
         return sendJson(res, 200, {
           ok: true,
           readOnly: true,
-          traceDir: path11.resolve(traceDir)
+          traceDir: path13.resolve(traceDir)
         });
       }
       const td = new TraceDirectory({ dir: traceDir });
@@ -9687,7 +9844,7 @@ function createViewerServer(options = {}) {
             runId: meta.runId,
             name: meta.name,
             status: meta.status,
-            file: path11.basename(meta.filePath),
+            file: path13.basename(meta.filePath),
             startedAt: meta.startedAt,
             durationMs: meta.durationMs
           }))
@@ -9802,7 +9959,7 @@ function startViewerServer(options = {}) {
       resolve({
         host,
         port: resolvedPort,
-        traceDir: path11.resolve(traceDir),
+        traceDir: path13.resolve(traceDir),
         url: `http://${host}:${resolvedPort}`
       });
     });
@@ -10007,10 +10164,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path18) {
-  return [{ runId: run.runId, ...path18 !== void 0 ? { path: path18 } : {} }];
+function evidenceForRun(run, path19) {
+  return [{ runId: run.runId, ...path19 !== void 0 ? { path: path19 } : {} }];
 }
-function evidenceForEvent(event, path18) {
+function evidenceForEvent(event, path19) {
   return [
     {
       runId: event.runId,
@@ -10018,7 +10175,7 @@ function evidenceForEvent(event, path18) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path18 !== void 0 ? { path: path18 } : {}
+      ...path19 !== void 0 ? { path: path19 } : {}
     }
   ];
 }
@@ -10176,9 +10333,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path18) {
+function firstEvidence(fields, run, path19) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path18) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path19) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -10555,8 +10712,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path18 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path18 ? ` (${path18})` : ""}`);
+      const path19 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -10603,7 +10760,7 @@ function asConfig2(value) {
 }
 async function loadConfig2(configPath) {
   if (configPath === void 0) return {};
-  const extension = path11.extname(configPath);
+  const extension = path13.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error(
       "TypeScript eval configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -10612,7 +10769,7 @@ async function loadConfig2(configPath) {
   if (!CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error("Unsupported eval config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path11.resolve(configPath);
+  const absolute = path13.resolve(configPath);
   if (extension === ".json") {
     const raw = await readFile(absolute, "utf-8");
     return asConfig2(JSON.parse(raw));
@@ -10749,8 +10906,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path18 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path18 ? ` (${path18})` : ""}`);
+    const path19 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -10988,8 +11145,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic4.code}: ${diagnostic4.message}`);
   }
   for (const finding of result.findings) {
-    const path18 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path18 ? ` (${path18})` : ""}`);
+    const path19 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path19 ? ` (${path19})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -11035,6 +11192,38 @@ function scanCommand(target, options = {}, stdin = process.stdin) {
 function verifySafeCommand(target, options = {}, stdin = process.stdin) {
   return safetyCommand("verify-safe", target, options, stdin);
 }
+function assessOpenedTrace(read, options = {}) {
+  try {
+    const rules = buildSafetyRules(options);
+    const checkResult = runTraceChecks(
+      { read },
+      {
+        rules,
+        ...options.runId !== void 0 ? { runId: options.runId } : {},
+        ...options.run !== void 0 ? { runId: options.run } : {}
+      }
+    );
+    const detectorFindings = checkResult.diagnostics.length === 0 ? redactionDetectorFindings(read, checkResult.runId) : [];
+    return resultFromParts({
+      command: "verify-safe",
+      format: checkResult.format,
+      runId: checkResult.runId,
+      findings: [...checkResult.findings, ...detectorFindings],
+      diagnostics: [
+        ...checkResult.diagnostics.map(diagnosticFromCheck),
+        ...warningDiagnostics(read.warnings, read.unsupportedFields)
+      ],
+      warnings: read.warnings,
+      unsupportedFields: read.unsupportedFields
+    });
+  } catch (error) {
+    return messageStartsWithDash(error) ? invalidArgumentResult("verify-safe", error) : readErrorResult3("verify-safe", error);
+  }
+}
+function messageStartsWithDash(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.startsWith("--");
+}
 var NOTE = "Generated locally by AgentInspect. Artifacts are best-effort summaries, not compliance or security certification.";
 var SAFETY_RULES = [
   createSafetyRawContentRule(),
@@ -11108,8 +11297,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path18 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path18})`);
+    const path19 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path19})`);
   }
   for (const diagnostic4 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic4.code}: ${diagnostic4.message}`);
@@ -11187,8 +11376,8 @@ function renderHtml(trace, check, diff) {
 `;
 }
 async function writeArtifact(outputDir, relativePath, content, files) {
-  const outPath = path11.join(outputDir, relativePath);
-  await mkdir(path11.dirname(outPath), { recursive: true });
+  const outPath = path13.join(outputDir, relativePath);
+  await mkdir(path13.dirname(outPath), { recursive: true });
   await writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -11204,7 +11393,7 @@ function manifestStatus(check, diff) {
   return "ok";
 }
 async function artifactsCommand(target, options = {}, stdin = process.stdin) {
-  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path11.resolve(options.outputDir.trim()) : "";
+  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path13.resolve(options.outputDir.trim()) : "";
   if (outputDir === "") {
     console.error("--output-dir is required.");
     process.exitCode = 1;
@@ -11270,8 +11459,8 @@ async function artifactsCommand(target, options = {}, stdin = process.stdin) {
   await writeArtifact(outputDir, "report.html", renderHtml(trace, check, diff), files);
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    await mkdir(path11.dirname(path11.resolve(summaryTarget)), { recursive: true });
-    await appendFile(path11.resolve(summaryTarget), `
+    await mkdir(path13.dirname(path13.resolve(summaryTarget)), { recursive: true });
+    await appendFile(path13.resolve(summaryTarget), `
 ${renderMarkdown(trace, check, diff)}`, "utf-8");
   }
   const manifestFiles = [...files, "manifest.json"].sort((a, b) => a.localeCompare(b));
@@ -11290,10 +11479,10 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
       findings: diff?.findings.length ?? 0,
       diagnostics: diff?.diagnostics.length ?? 0
     },
-    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path11.resolve(summaryTarget) } : {},
+    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path13.resolve(summaryTarget) } : {},
     note: NOTE
   };
-  await writeFile(path11.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
+  await writeFile(path13.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
   if (options.json === true) {
     console.log(writeJson3(manifest).trimEnd());
   } else {
@@ -11304,1568 +11493,1893 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
     }
   }
 }
-function validateReporterArtifactPath(options) {
-  const outputDir = path11.resolve(options.outputDir);
-  const diagnostics = [];
-  const rawPath = options.relativePath;
-  if (rawPath.length === 0) {
-    diagnostics.push({
-      code: "artifact_path_empty",
-      severity: "error",
-      message: "Reporter artifact path must not be empty."
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  if (rawPath.includes("\0")) {
-    diagnostics.push({
-      code: "invalid_artifact_path",
-      severity: "error",
-      message: "Reporter artifact path must not contain null bytes.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  if (path11.isAbsolute(rawPath) || path11.win32.isAbsolute(rawPath)) {
-    diagnostics.push({
-      code: "artifact_path_absolute",
-      severity: "error",
-      message: "Reporter artifact path must be relative.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  const normalized = path11.posix.normalize(rawPath.replace(/\\/g, "/"));
-  const segments = normalized.split("/");
-  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
-    diagnostics.push({
-      code: "artifact_path_escape",
-      severity: "error",
-      message: "Reporter artifact path must stay under the output directory.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  const absolutePath = path11.resolve(outputDir, normalized);
-  const relFromOutput = path11.relative(outputDir, absolutePath);
-  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path11.isAbsolute(relFromOutput)) {
-    diagnostics.push({
-      code: "artifact_path_escape",
-      severity: "error",
-      message: "Reporter artifact path resolved outside the output directory.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
+
+// packages/core/src/workspace/types.ts
+var WORKSPACE_SCHEMA_VERSION = "1.0";
+var WORKSPACE_DIR_NAME = ".agent-inspect";
+var WORKSPACE_MANIFEST_FILENAME = "workspace.json";
+
+// packages/core/src/workspace/manifest.ts
+var DEFAULT_WORKSPACE_LAYOUT = {
+  traceDirs: ["runs"],
+  reportsDir: "reports",
+  artifactsDir: "artifacts",
+  bundlesDir: "bundles",
+  notesDir: "notes"
+};
+var DEFAULT_REDACTION_PROFILE = "share";
+var REDACTION_PROFILES = [
+  "local",
+  "share",
+  "strict"
+];
+var INDEX_TYPES = ["none", "sqlite", "custom"];
+var MAX_WORKSPACE_MANIFEST_BYTES = 64 * 1024;
+function createDefaultWorkspaceManifest(options) {
+  const project = typeof options.project === "string" ? options.project.trim() : "";
+  const index = {
+    enabled: options.index?.enabled ?? false,
+    type: options.index?.type ?? "none",
+    ...options.index?.path !== void 0 ? { path: options.index.path } : {}
+  };
   return {
-    ok: true,
-    outputDir,
-    relativePath: normalized,
-    absolutePath,
-    diagnostics
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    project,
+    createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    traceDirs: options.traceDirs ? [...options.traceDirs] : [...DEFAULT_WORKSPACE_LAYOUT.traceDirs],
+    reportsDir: options.reportsDir ?? DEFAULT_WORKSPACE_LAYOUT.reportsDir,
+    artifactsDir: options.artifactsDir ?? DEFAULT_WORKSPACE_LAYOUT.artifactsDir,
+    bundlesDir: options.bundlesDir ?? DEFAULT_WORKSPACE_LAYOUT.bundlesDir,
+    notesDir: options.notesDir ?? DEFAULT_WORKSPACE_LAYOUT.notesDir,
+    redactionProfile: options.redactionProfile ?? DEFAULT_REDACTION_PROFILE,
+    index
   };
 }
-
-// packages/cli/src/ci-summary.ts
-var NOTE2 = "Generated locally by AgentInspect from reporter artifact manifests. Trace contents are not embedded.";
-var MAX_TEXT = 180;
-var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "jest", "manual"]);
-var STATUSES = /* @__PURE__ */ new Set(["passed", "failed", "skipped", "todo"]);
-var ARTIFACT_KINDS = /* @__PURE__ */ new Set(["trace", "report", "eval", "redaction", "summary"]);
-var ARTIFACT_FORMATS = /* @__PURE__ */ new Set(["json", "jsonl", "md", "html"]);
-var REDACTION_PROFILES = /* @__PURE__ */ new Set(["local", "share", "strict"]);
-function stable6(value) {
-  if (Array.isArray(value)) return value.map(stable6);
-  if (value === null || typeof value !== "object") return value;
-  const record = value;
-  return Object.fromEntries(
-    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable6(record[key])])
-  );
-}
-function writeJson4(value) {
-  return `${JSON.stringify(stable6(value), null, 2)}
-`;
-}
-function isObject(value) {
+function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readString(value, label) {
+function isSafeRelativeWorkspacePath(p) {
+  if (typeof p !== "string") return false;
+  const trimmed = p.trim();
+  if (trimmed === "") return false;
+  if (trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
+  if (/^[a-zA-Z]:/.test(trimmed)) return false;
+  const segments = trimmed.split(/[/\\]+/);
+  return !segments.some((seg) => seg === "..");
+}
+function validateDirField(value, field, errors) {
   if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`${label} must be a non-empty string.`);
+    errors.push(`${field} must be a non-empty string`);
+    return;
   }
-  return safeText(value);
-}
-function readOptionalString(value) {
-  return typeof value === "string" && value.trim() !== "" ? safeText(value) : void 0;
-}
-function readFramework(value) {
-  const framework = readString(value, "manifest.framework");
-  if (!FRAMEWORKS.has(framework)) {
-    throw new Error(`Unsupported reporter framework: ${framework}.`);
+  if (!isSafeRelativeWorkspacePath(value)) {
+    errors.push(
+      `${field} must be a relative path inside the workspace (no absolute paths or ".." traversal)`
+    );
   }
-  return framework;
 }
-function readStatus(value) {
-  const status = readString(value, "result.status");
-  if (!STATUSES.has(status)) {
-    throw new Error(`Unsupported reporter test status: ${status}.`);
+function validateIndex(value, errors) {
+  if (!isPlainObject(value)) {
+    errors.push("index must be an object");
+    return void 0;
   }
-  return status;
-}
-function readArtifact(value, index) {
-  if (!isObject(value)) throw new Error(`manifest.artifacts[${index}] must be an object.`);
-  const kind = readString(value.kind, `manifest.artifacts[${index}].kind`);
-  const format = readString(value.format, `manifest.artifacts[${index}].format`);
-  const redactionProfile = readString(
-    value.redactionProfile,
-    `manifest.artifacts[${index}].redactionProfile`
-  );
-  if (!ARTIFACT_KINDS.has(kind)) throw new Error(`Unsupported artifact kind: ${kind}.`);
-  if (!ARTIFACT_FORMATS.has(format)) throw new Error(`Unsupported artifact format: ${format}.`);
-  if (!REDACTION_PROFILES.has(redactionProfile)) {
-    throw new Error(`Unsupported artifact redaction profile: ${redactionProfile}.`);
+  if (typeof value.enabled !== "boolean") {
+    errors.push("index.enabled must be a boolean");
   }
-  const artifactPath = readString(value.path, `manifest.artifacts[${index}].path`);
-  const pathCheck = validateReporterArtifactPath({
-    outputDir: process.cwd(),
-    relativePath: artifactPath
-  });
-  if (!pathCheck.ok || pathCheck.relativePath === void 0) {
-    throw new Error(`Unsafe reporter artifact path: ${artifactPath}.`);
+  if (!INDEX_TYPES.includes(value.type)) {
+    errors.push(`index.type must be one of: ${INDEX_TYPES.join(", ")}`);
+  }
+  if (value.path !== void 0 && !isSafeRelativeWorkspacePath(value.path)) {
+    errors.push(
+      'index.path must be a relative path inside the workspace (no absolute paths or ".." traversal)'
+    );
   }
+  if (errors.length > 0) return void 0;
   return {
-    kind,
-    path: pathCheck.relativePath,
-    format,
-    redactionProfile
+    enabled: value.enabled,
+    type: value.type,
+    ...value.path !== void 0 ? { path: value.path } : {}
   };
 }
-function readArtifacts(value, label) {
-  if (value === void 0) return [];
-  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
-  return value.map((item, index) => readArtifact(item, index));
+function validateWorkspaceManifest(input3) {
+  const errors = [];
+  const warnings = [];
+  if (!isPlainObject(input3)) {
+    return { ok: false, errors: ["manifest must be an object"], warnings };
+  }
+  if (input3.schemaVersion !== WORKSPACE_SCHEMA_VERSION) {
+    errors.push(
+      `schemaVersion must be "${WORKSPACE_SCHEMA_VERSION}" (received ${JSON.stringify(
+        input3.schemaVersion
+      )})`
+    );
+  }
+  if (typeof input3.project !== "string" || input3.project.trim() === "") {
+    errors.push("project must be a non-empty string");
+  }
+  if (typeof input3.createdAt !== "string" || input3.createdAt.trim() === "") {
+    errors.push("createdAt must be a non-empty ISO-8601 string");
+  } else if (Number.isNaN(Date.parse(input3.createdAt))) {
+    errors.push("createdAt must be a valid ISO-8601 date string");
+  }
+  if (!Array.isArray(input3.traceDirs) || input3.traceDirs.length === 0) {
+    errors.push("traceDirs must be a non-empty array");
+  } else {
+    input3.traceDirs.forEach((dir, i) => {
+      if (typeof dir !== "string" || dir.trim() === "") {
+        errors.push(`traceDirs[${i}] must be a non-empty string`);
+      } else if (!isSafeRelativeWorkspacePath(dir)) {
+        errors.push(
+          `traceDirs[${i}] must be a relative path inside the workspace (no absolute paths or ".." traversal)`
+        );
+      }
+    });
+  }
+  validateDirField(input3.reportsDir, "reportsDir", errors);
+  validateDirField(input3.artifactsDir, "artifactsDir", errors);
+  validateDirField(input3.bundlesDir, "bundlesDir", errors);
+  validateDirField(input3.notesDir, "notesDir", errors);
+  if (!REDACTION_PROFILES.includes(input3.redactionProfile)) {
+    errors.push(`redactionProfile must be one of: ${REDACTION_PROFILES.join(", ")}`);
+  }
+  const indexErrors = [];
+  const index = validateIndex(input3.index, indexErrors);
+  errors.push(...indexErrors);
+  if (index && index.type !== "none" && !index.enabled) {
+    warnings.push(`index.type is "${index.type}" but index.enabled is false`);
+  }
+  if (errors.length > 0 || index === void 0) {
+    return { ok: false, errors, warnings };
+  }
+  const manifest = {
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    project: input3.project.trim(),
+    createdAt: input3.createdAt,
+    traceDirs: input3.traceDirs.map((d) => d.trim()),
+    reportsDir: input3.reportsDir.trim(),
+    artifactsDir: input3.artifactsDir.trim(),
+    bundlesDir: input3.bundlesDir.trim(),
+    notesDir: input3.notesDir.trim(),
+    redactionProfile: input3.redactionProfile,
+    index
+  };
+  return { ok: true, manifest, errors, warnings };
 }
-function readDiagnosticsCount(value, label) {
-  if (value === void 0) return 0;
-  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
-  return value.length;
+function parseWorkspaceManifest(json) {
+  const warnings = [];
+  if (typeof json !== "string") {
+    return { ok: false, errors: ["manifest input must be a string"], warnings };
+  }
+  if (json.length > MAX_WORKSPACE_MANIFEST_BYTES) {
+    return {
+      ok: false,
+      errors: [
+        `manifest exceeds maximum size of ${MAX_WORKSPACE_MANIFEST_BYTES} bytes`
+      ],
+      warnings
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return { ok: false, errors: ["manifest is not valid JSON"], warnings };
+  }
+  return validateWorkspaceManifest(parsed);
 }
-function readResult(value, index) {
-  if (!isObject(value)) throw new Error(`manifest.results[${index}] must be an object.`);
-  const file = readOptionalString(value.file);
-  const tracePath = readOptionalString(value.tracePath);
+function serializeWorkspaceManifest(manifest) {
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+var INDEX_DIR_NAME = "index";
+function resolveWorkspaceLocation(cwd = process.cwd()) {
+  const projectRoot = path13.resolve(cwd);
+  const workspaceDir = path13.join(projectRoot, WORKSPACE_DIR_NAME);
   return {
-    testId: readString(value.testId, `manifest.results[${index}].testId`),
-    name: readString(value.name, `manifest.results[${index}].name`),
-    ...file === void 0 ? {} : { file },
-    status: readStatus(value.status),
-    ...tracePath === void 0 ? {} : { tracePath },
-    artifacts: readArtifacts(value.artifacts, `manifest.results[${index}].artifacts`),
-    diagnostics: readDiagnosticsCount(
-      value.diagnostics,
-      `manifest.results[${index}].diagnostics`
-    )
+    projectRoot,
+    workspaceDir,
+    manifestPath: path13.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
   };
 }
-function readManifestDocument(value) {
-  if (!isObject(value)) throw new Error("Reporter manifest file must contain a JSON object.");
-  const candidate = isObject(value.manifest) ? value.manifest : value;
-  if (!isObject(candidate)) throw new Error("Reporter manifest must be a JSON object.");
-  const schemaVersion = readString(candidate.schemaVersion, "manifest.schemaVersion");
-  if (schemaVersion !== "0.1") {
-    throw new Error(`Unsupported reporter manifest schemaVersion: ${schemaVersion}.`);
+function resolveInsideWorkspace(workspaceDir, relative) {
+  const base = path13.resolve(workspaceDir);
+  const resolved = path13.resolve(base, relative);
+  const rel = path13.relative(base, resolved);
+  if (rel === "" || rel === "." || !rel.startsWith("..") && !path13.isAbsolute(rel)) {
+    return resolved;
   }
-  if (!Array.isArray(candidate.results)) {
-    throw new Error("manifest.results must be an array.");
+  throw new Error(
+    `Workspace path "${relative}" resolves outside the workspace directory`
+  );
+}
+async function pathExists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
   }
-  const artifacts = readArtifacts(candidate.artifacts, "manifest.artifacts");
-  const results = candidate.results.map((item, index) => readResult(item, index));
-  const diagnostics = readDiagnosticsCount(candidate.diagnostics, "manifest.diagnostics");
-  const manifest = {
-    framework: readFramework(candidate.framework),
-    generatedAt: readString(candidate.generatedAt, "manifest.generatedAt"),
-    results,
-    artifacts
-  };
-  return {
-    packageName: readOptionalString(value.package),
-    manifest,
-    diagnostics
-  };
 }
-function cwdRelative(filePath) {
-  const relative = path11.relative(process.cwd(), path11.resolve(filePath)).replace(/\\/g, "/");
-  if (relative === "" || relative.startsWith("../") || path11.isAbsolute(relative)) {
-    return path11.basename(filePath);
+async function isWritable(p) {
+  try {
+    await access(p, constants$1.W_OK);
+    return true;
+  } catch {
+    return false;
   }
-  return relative;
 }
-async function readReporterManifest(filePath) {
-  const absolute = path11.resolve(filePath);
-  const raw = await readFile(absolute, "utf-8");
-  const document = readManifestDocument(JSON.parse(raw));
-  const manifest = document.manifest;
-  const results = manifest.results.map((result) => ({
-    testId: safeText(result.testId),
-    name: safeText(result.name),
-    ...result.file === void 0 ? {} : { file: safeText(path11.basename(result.file)) },
-    status: result.status,
-    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path11.basename(result.tracePath)) },
-    artifacts: result.artifacts,
-    diagnostics: result.diagnostics
-  }));
-  return {
-    ...document.packageName === void 0 ? {} : { packageName: document.packageName },
-    manifestFile: cwdRelative(absolute),
-    framework: manifest.framework,
-    generatedAt: manifest.generatedAt,
-    results,
-    artifacts: manifest.artifacts,
-    diagnostics: document.diagnostics
-  };
+async function listJsonl(dir) {
+  try {
+    const entries = await readdir(dir);
+    return entries.filter((f) => f.endsWith(".jsonl"));
+  } catch {
+    return [];
+  }
 }
-function summarize3(manifests) {
-  const summary = {
-    manifests: manifests.length,
-    tests: 0,
-    failed: 0,
-    passed: 0,
-    skipped: 0,
-    todo: 0,
-    artifacts: 0,
-    diagnostics: 0
-  };
-  for (const manifest of manifests) {
-    summary.artifacts += manifest.artifacts.length;
-    summary.diagnostics += manifest.diagnostics;
-    for (const result of manifest.results) {
-      summary.tests += 1;
-      if (result.status === "failed") summary.failed += 1;
-      else if (result.status === "passed") summary.passed += 1;
-      else if (result.status === "skipped") summary.skipped += 1;
-      else summary.todo += 1;
-      summary.artifacts += result.artifacts.length;
-      summary.diagnostics += result.diagnostics;
-    }
+async function countFiles(dir) {
+  try {
+    const entries = await readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => e.isFile()).length;
+  } catch {
+    return 0;
+  }
+}
+async function readWorkspaceManifestFile(location) {
+  let raw;
+  try {
+    raw = await readFile(location.manifestPath, "utf-8");
+  } catch {
+    return { exists: false, ok: false, errors: ["workspace.json not found"], warnings: [] };
   }
+  const parsed = parseWorkspaceManifest(raw);
   return {
-    status: summary.failed > 0 ? "failed" : summary.diagnostics > 0 ? "warning" : "ok",
-    manifests,
-    summary,
-    note: NOTE2
+    exists: true,
+    ok: parsed.ok,
+    ...parsed.manifest ? { manifest: parsed.manifest } : {},
+    errors: parsed.errors,
+    warnings: parsed.warnings
   };
 }
-function markdownCell(value) {
-  return safeText(String(value ?? "unknown")).replaceAll("|", "\\|").replace(/\r?\n/g, " ");
-}
-function renderMarkdown2(result) {
-  const lines = [
-    "# AgentInspect CI Summary",
-    "",
-    NOTE2,
-    "",
-    "| Field | Value |",
-    "| --- | --- |",
-    `| Status | ${result.status} |`,
-    `| Manifests | ${result.summary.manifests} |`,
-    `| Tests | ${result.summary.tests} |`,
-    `| Failed | ${result.summary.failed} |`,
-    `| Passed | ${result.summary.passed} |`,
-    `| Skipped | ${result.summary.skipped} |`,
-    `| Todo | ${result.summary.todo} |`,
-    `| Artifacts | ${result.summary.artifacts} |`,
-    `| Diagnostics | ${result.summary.diagnostics} |`,
-    "",
-    "## Tests",
-    "",
-    "| Framework | Status | Test | File | Trace | Artifacts |",
-    "| --- | --- | --- | --- | --- | --- |"
-  ];
-  const rows = result.manifests.flatMap(
-    (manifest) => manifest.results.map((test) => ({
-      framework: manifest.framework,
-      test
-    }))
-  );
-  if (rows.length === 0) {
-    lines.push("| unknown | unknown | No tests found | unknown | unknown | 0 |");
+async function createWorkspace(options = {}) {
+  const location = resolveWorkspaceLocation(options.cwd);
+  const dryRun = options.dryRun === true;
+  const existing = await readWorkspaceManifestFile(location);
+  const topLevelTraces = await listJsonl(location.workspaceDir);
+  const detectedExistingTraces = topLevelTraces.length > 0;
+  let manifest;
+  let created;
+  let adopted;
+  if (existing.exists && existing.ok && existing.manifest) {
+    manifest = existing.manifest;
+    created = false;
+    adopted = true;
   } else {
-    for (const row of rows) {
-      lines.push(
-        `| ${markdownCell(row.framework)} | ${markdownCell(row.test.status)} | ${markdownCell(row.test.name)} | ${markdownCell(row.test.file)} | ${markdownCell(row.test.tracePath)} | ${row.test.artifacts.length} |`
-      );
-    }
+    const project = options.project?.trim() || path13.basename(location.projectRoot) || "workspace";
+    const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
+    manifest = createDefaultWorkspaceManifest({
+      project,
+      traceDirs,
+      ...options.redactionProfile ? { redactionProfile: options.redactionProfile } : {}
+    });
+    created = true;
+    adopted = detectedExistingTraces || existing.exists && !existing.ok;
   }
-  lines.push("", "## Manifests", "", "| Framework | File | Generated | Artifacts |", "| --- | --- | --- | --- |");
-  for (const manifest of result.manifests) {
-    lines.push(
-      `| ${markdownCell(manifest.framework)} | ${markdownCell(manifest.manifestFile)} | ${markdownCell(manifest.generatedAt)} | ${manifest.artifacts.length} |`
-    );
+  const relDirs = uniqueDirs([
+    ...manifest.traceDirs.filter((d) => d !== "."),
+    manifest.reportsDir,
+    manifest.artifactsDir,
+    manifest.bundlesDir,
+    manifest.notesDir,
+    INDEX_DIR_NAME
+  ]);
+  const createdDirs = [];
+  for (const rel of relDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    if (await pathExists(abs)) continue;
+    createdDirs.push(rel);
+    if (!dryRun) await mkdir(abs, { recursive: true });
   }
-  lines.push("", "## Artifacts", "", "| Framework | Kind | Path | Format | Profile |", "| --- | --- | --- | --- | --- |");
-  const artifacts = result.manifests.flatMap(
-    (manifest) => manifest.artifacts.map((artifact) => ({ framework: manifest.framework, artifact }))
-  );
-  if (artifacts.length === 0) {
-    lines.push("| unknown | unknown | No artifacts found | unknown | unknown |");
-  } else {
-    for (const row of artifacts) {
-      lines.push(
-        `| ${markdownCell(row.framework)} | ${markdownCell(row.artifact.kind)} | ${markdownCell(row.artifact.path)} | ${markdownCell(row.artifact.format)} | ${markdownCell(row.artifact.redactionProfile)} |`
-      );
-    }
+  if (!dryRun && created) {
+    await mkdir(location.workspaceDir, { recursive: true });
+    await writeFile(location.manifestPath, serializeWorkspaceManifest(manifest), "utf-8");
   }
-  lines.push("");
-  return `${lines.join("\n")}
-`;
+  return {
+    location,
+    manifest,
+    created,
+    adopted,
+    createdDirs,
+    detectedExistingTraces,
+    dryRun
+  };
 }
-function safeText(value) {
-  const compact = value.replace(/\s+/g, " ").trim();
-  const redacted = compact.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(
-    /\b(?:api[_-]?key|authorization|token|secret|password)\s*[:=]\s*[^,\s]+/gi,
-    "$1=[REDACTED]"
-  );
-  if (redacted.length <= MAX_TEXT) return redacted;
-  return `${redacted.slice(0, MAX_TEXT - 12)}...[truncated]`;
+function uniqueDirs(dirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const d of dirs) {
+    const t = d.trim();
+    if (t === "" || t === "." || seen.has(t)) continue;
+    seen.add(t);
+    out.push(t);
+  }
+  return out;
 }
-async function ciSummaryCommand(manifestPaths, options = {}) {
-  if (manifestPaths.length === 0) {
-    console.error("At least one reporter manifest path is required.");
-    process.exitCode = 1;
-    return;
+async function getWorkspaceStatus(location, manifest) {
+  let traceFiles = 0;
+  for (const rel of manifest.traceDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    traceFiles += (await listJsonl(abs)).length;
   }
-  let result;
-  try {
-    const manifests = [];
-    for (const manifestPath of manifestPaths) {
-      manifests.push(await readReporterManifest(manifestPath));
+  const reports = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.reportsDir)
+  );
+  const artifacts = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.artifactsDir)
+  );
+  const bundles = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.bundlesDir)
+  );
+  const notes = await countFiles(
+    resolveInsideWorkspace(location.workspaceDir, manifest.notesDir)
+  );
+  const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
+  return {
+    project: manifest.project,
+    traceFiles,
+    reports,
+    artifacts,
+    bundles,
+    notes,
+    index: {
+      enabled: manifest.index.enabled,
+      type: manifest.index.type,
+      exists: await pathExists(indexPath2)
     }
-    manifests.sort((a, b) => a.manifestFile.localeCompare(b.manifestFile));
-    result = summarize3(manifests);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error(`[AgentInspect] ci-summary failed: ${message}`);
-    process.exitCode = 1;
-    return;
+  };
+}
+async function doctorWorkspace(location) {
+  const checks2 = [];
+  const manifestResult = await readWorkspaceManifestFile(location);
+  if (!manifestResult.exists) {
+    checks2.push({
+      id: "manifest",
+      status: "fail",
+      message: "workspace.json not found (run `agent-inspect workspace init`)"
+    });
+    return { ok: false, checks: checks2 };
   }
-  const markdown = renderMarkdown2(result);
-  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path11.resolve(options.output.trim()) : void 0;
-  if (outputPath !== void 0) {
-    await mkdir(path11.dirname(outputPath), { recursive: true });
-    await writeFile(outputPath, markdown, "utf-8");
+  if (!manifestResult.ok || !manifestResult.manifest) {
+    checks2.push({
+      id: "manifest",
+      status: "fail",
+      message: `workspace.json is invalid: ${manifestResult.errors.join("; ")}`
+    });
+    return { ok: false, checks: checks2 };
   }
-  const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
-  if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    const summaryPath = path11.resolve(summaryTarget);
-    await mkdir(path11.dirname(summaryPath), { recursive: true });
-    await appendFile(summaryPath, `
-${markdown}`, "utf-8");
+  const manifest = manifestResult.manifest;
+  checks2.push({ id: "manifest", status: "pass", message: "workspace.json is valid" });
+  for (const warning of manifestResult.warnings) {
+    checks2.push({ id: "manifest-warning", status: "warn", message: warning });
   }
-  if (options.json === true) {
-    console.log(writeJson4(result).trimEnd());
-  } else if (outputPath !== void 0) {
-    console.log(`Wrote AgentInspect CI summary to ${outputPath}`);
-    console.log(`Status: ${result.status}`);
-  } else {
-    console.log(markdown.trimEnd());
+  const dirFields = [
+    ...manifest.traceDirs.filter((d) => d !== ".").map((d, i) => [`traceDir[${i}]`, d]),
+    ["reportsDir", manifest.reportsDir],
+    ["artifactsDir", manifest.artifactsDir],
+    ["bundlesDir", manifest.bundlesDir],
+    ["notesDir", manifest.notesDir]
+  ];
+  for (const [id, rel] of dirFields) {
+    let abs;
+    try {
+      abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    } catch (error) {
+      checks2.push({
+        id,
+        status: "fail",
+        message: error instanceof Error ? error.message : String(error)
+      });
+      continue;
+    }
+    if (!await pathExists(abs)) {
+      checks2.push({ id, status: "warn", message: `${rel}/ does not exist yet` });
+    } else if (!await isWritable(abs)) {
+      checks2.push({ id, status: "fail", message: `${rel}/ is not writable` });
+    } else {
+      checks2.push({ id, status: "pass", message: `${rel}/ is present and writable` });
+    }
   }
-}
-var CONFIG_FILE = "agent-inspect.config.ts";
-var TRACE_DIR = ".agent-inspect";
-var GITKEEP = ".agent-inspect/.gitkeep";
-function normalizeFramework(value) {
-  const raw = (value ?? "custom").trim();
-  if (raw === "ai-sdk" || raw === "openai-agents" || raw === "langchain" || raw === "custom") {
-    return raw;
+  let newestTraceMtime = 0;
+  for (const rel of manifest.traceDirs) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    for (const file of await listJsonl(abs)) {
+      try {
+        const s = await stat(path13.join(abs, file));
+        newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
+      } catch {
+        checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
+      }
+    }
   }
-  throw new Error(
-    "Unsupported --framework value. Use ai-sdk, openai-agents, langchain, or custom."
-  );
-}
-function configTemplate(framework) {
-  const base = `/**
- * AgentInspect local config (metadata-only capture by default).
- * See https://github.com/rajudandigam/agent-inspect/blob/main/docs/SAFE-TRACE-SHARING.md
- */
-export const agentInspectConfig = {
-  traceDir: ".agent-inspect",
-  enabled: process.env.AGENT_INSPECT !== "0",
-  redactionProfile: "local" as const,
-};
-`;
-  if (framework === "custom") return base;
-  return `${base}
-export const framework = "${framework}" as const;
-`;
+  if (manifest.index.enabled) {
+    const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
+    if (!await pathExists(indexPath2)) {
+      checks2.push({ id: "index", status: "warn", message: "index enabled but not built" });
+    } else {
+      try {
+        const s = await stat(indexPath2);
+        if (newestTraceMtime > s.mtimeMs) {
+          checks2.push({ id: "index", status: "warn", message: "index is stale (traces are newer)" });
+        } else {
+          checks2.push({ id: "index", status: "pass", message: "index is present" });
+        }
+      } catch {
+        checks2.push({ id: "index", status: "warn", message: "cannot stat index" });
+      }
+    }
+  }
+  const ok = !checks2.some((c) => c.status === "fail");
+  return { ok, checks: checks2 };
 }
-function demoTemplate(framework) {
-  switch (framework) {
-    case "ai-sdk":
-      return `/**
- * AI SDK starter \u2014 metadata-only telemetry (no real model calls in this demo).
- * Install: npm install agent-inspect @agent-inspect/ai-sdk ai
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("ai-sdk-demo", async () => {
-    await step.tool("mock-generate", async () => ({ text: "ok" }));
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
+async function cleanWorkspace(location, manifest, options = {}) {
+  const dryRun = options.confirm !== true;
+  const targets = uniqueDirs([
+    manifest.reportsDir,
+    manifest.artifactsDir,
+    manifest.bundlesDir,
+    manifest.index.path ?? INDEX_DIR_NAME
+  ]);
+  const removed = [];
+  for (const rel of targets) {
+    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
+    let entries;
+    try {
+      entries = await readdir(abs);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const relPath = `${rel}/${entry}`;
+      removed.push(relPath);
+      if (!dryRun) {
+        await rm(path13.join(abs, entry), { recursive: true, force: true });
+      }
+    }
+  }
+  return { dryRun, removed };
 }
 
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
-`;
-    case "openai-agents":
-      return `/**
- * OpenAI Agents starter \u2014 use @agent-inspect/openai-agents for local-only processors.
- * This demo uses manual steps (no API keys).
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("openai-agents-demo", async () => {
-    await step.tool("mock-agent-run", async () => "ok");
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
+// packages/cli/src/bundle.ts
+var BUNDLE_NOTE = "Generated locally by AgentInspect. Bundles are derived copies for review \u2014 not compliance or security certification.";
+function stable6(value) {
+  if (Array.isArray(value)) return value.map(stable6);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable6(record[key])])
+  );
 }
-
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
+function writeJson4(value) {
+  return `${JSON.stringify(stable6(value), null, 2)}
 `;
-    case "langchain":
-      return `/**
- * LangChain starter \u2014 wire @agent-inspect/langchain callbacks in your app.
- * This demo uses manual steps (no API keys).
- */
-import { inspectRun, step } from "agent-inspect";
-
-async function main() {
-  await inspectRun("langchain-demo", async () => {
-    await step.tool("mock-chain", async () => "ok");
-  }, { traceDir: ".agent-inspect", silent: true });
-  console.log("Trace written to .agent-inspect/");
 }
-
-main().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
-`;
-    default:
-      return `import { observe } from "agent-inspect";
-
-class DemoAgent {
-  async run(input: { question: string }) {
-    return { answer: \`Echo: \${input.question}\` };
+function parseBundleProfile(value) {
+  if (value === void 0 || value === "local" || value === "share" || value === "strict") {
+    return value ?? "share";
   }
+  throw new Error(`Unsupported --profile "${value}". Use local, share, or strict.`);
 }
-
-const agent = observe(new DemoAgent(), {
-  traceDir: ".agent-inspect",
-  silent: true,
-});
-
-await agent.run({ question: "hello" });
-console.log("Trace written to .agent-inspect/");
-`;
-  }
+function toReportProfile(profile) {
+  return profile;
 }
-function githubWorkflowTemplate() {
-  return `name: AgentInspect artifacts
-
-on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-
-jobs:
-  trace-artifacts:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-      - run: npm ci
-      - run: npm test
-      - name: Upload AgentInspect traces
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: agent-inspect-traces
-          path: .agent-inspect/**/*.jsonl
-          if-no-files-found: ignore
-`;
+function escapeHtml3(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
-async function planInit(options = {}) {
-  const framework = normalizeFramework(options.framework);
-  const cwd = path11.resolve(options.cwd ?? process.cwd());
-  const demoPath = framework === "custom" ? path11.join("examples", "agent-inspect-demo.mjs") : path11.join("examples", `agent-inspect-${framework}-demo.mjs`);
-  const candidates = [
-    { rel: CONFIG_FILE, content: configTemplate(framework) },
-    { rel: GITKEEP, content: "" },
-    { rel: demoPath, content: demoTemplate(framework) }
-  ];
-  if (options.ci === "github") {
-    candidates.push({
-      rel: ".github/workflows/agent-inspect-artifacts.yml",
-      content: githubWorkflowTemplate()
-    });
+function safetyStatusFromAssess(status) {
+  if (status === "SAFE" || status === "SAFE WITH WARNINGS" || status === "UNSAFE" || status === "UNKNOWN") {
+    return status;
   }
-  const files = [];
-  for (const candidate of candidates) {
-    const abs = path11.join(cwd, candidate.rel);
+  return "UNKNOWN";
+}
+async function resolveOutputDir(options, runIds, cwd) {
+  if (options.out !== void 0 && options.out.trim() !== "") {
+    const normalized = normalizeBundleOutputPath(options.out);
     try {
-      await access(abs);
-      files.push({
-        path: candidate.rel,
-        action: "skip",
-        reason: "file already exists"
-      });
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      files.push({ path: candidate.rel, action: "create" });
+      const location = resolveWorkspaceLocation(cwd);
+      const manifest = await readWorkspaceManifestFile(location);
+      if (manifest.ok && manifest.manifest) {
+        const rel = path13.relative(location.workspaceDir, normalized);
+        if (!rel.startsWith("..") && !path13.isAbsolute(rel)) {
+          return resolveInsideWorkspace(location.workspaceDir, rel);
+        }
+      }
+    } catch {
     }
+    return normalized;
   }
-  return { framework, ...options.ci ? { ci: options.ci } : {}, files };
-}
-async function writePlannedFiles(plan, cwd, options) {
-  const written = [];
-  for (const entry of plan.files) {
-    if (entry.action === "skip") {
-      continue;
-    }
-    const abs = path11.join(cwd, entry.path);
-    if (options.dryRun) {
-      written.push(entry.path);
-      continue;
+  try {
+    const location = resolveWorkspaceLocation(cwd);
+    const manifest = await readWorkspaceManifestFile(location);
+    if (manifest.ok && manifest.manifest) {
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
+      return resolveInsideWorkspace(
+        location.workspaceDir,
+        path13.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
+      );
     }
-    await mkdir(path11.dirname(abs), { recursive: true });
-    const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
-    await writeFile(abs, content, "utf-8");
-    written.push(entry.path);
+  } catch {
   }
-  return written;
+  return defaultBundleOutputPath(runIds);
 }
-async function initCommand(options = {}) {
-  const cwd = path11.resolve(options.cwd ?? process.cwd());
+async function writeBundleFile(outputDir, relativePath, content, files) {
+  const outPath = path13.join(outputDir, relativePath);
+  await mkdir(path13.dirname(outPath), { recursive: true });
+  await writeFile(outPath, content, "utf-8");
+  files.push(relativePath);
+}
+function renderBundleIndexHtml(parts) {
+  const links = parts.runIds.map(
+    (runId) => `<li><a href="assets/runs/${escapeHtml3(runId)}.html">${escapeHtml3(runId)}</a></li>`
+  ).join("");
+  const sections = parts.runIds.map((runId) => {
+    const html = parts.reports.get(runId) ?? "";
+    return `<section id="run-${escapeHtml3(runId)}"><h2>${escapeHtml3(runId)}</h2>${html}</section>`;
+  }).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>AgentInspect Bundle</title>
+<style>
+body{font-family:system-ui,sans-serif;line-height:1.5;margin:1.5rem;max-width:960px;color:#111}
+a{color:#0366d6}
+section{border-top:1px solid #ddd;margin-top:1.5rem;padding-top:1rem}
+</style>
+</head>
+<body>
+<h1>AgentInspect trace bundle</h1>
+<p>${escapeHtml3(BUNDLE_NOTE)}</p>
+<h2>Runs</h2>
+<ul>${links}</ul>
+${sections}
+</body>
+</html>
+`;
+}
+function extractHtmlBody(content) {
+  const match = content.match(/<body[^>]*>([\s\S]*)<\/body>/i);
+  return match?.[1]?.trim() ?? content;
+}
+async function bundleCommand(runIdArg, options = {}) {
+  const profile = parseBundleProfile(options.profile);
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const cwd = process.cwd();
+  let resolveResult;
   try {
-    const plan = await planInit({ ...options, cwd });
-    const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
-    const skipped = plan.files.filter((file) => file.action === "skip");
+    const { runs } = await loadSessionRuns(traceDir);
+    const staleThresholdMs = options.staleAfter && options.staleAfter.trim() !== "" ? parseDuration(options.staleAfter.trim()) : void 0;
+    const index = buildSessionIndex(runs, {
+      correlateByGroupId: options.correlateGroup === true,
+      staleThresholdMs
+    });
+    resolveResult = resolveBundleRunIds(index, runs, {
+      ...runIdArg !== void 0 && runIdArg.trim() !== "" ? { runId: runIdArg.trim() } : {},
+      ...options.session ? { sessionId: options.session } : {},
+      ...options.since ? { since: options.since } : {}
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
     if (options.json) {
-      const payload = {
-        ok: true,
-        version,
-        framework: plan.framework,
-        ci: plan.ci ?? null,
-        dryRun: options.dryRun === true,
-        planned: plan.files,
-        wouldWrite: options.dryRun ? toWrite : void 0
-      };
-      console.log(JSON.stringify(payload, null, 2));
-      if (options.dryRun) return;
+      console.log(writeJson4({ ok: false, error: message }).trimEnd());
+    } else {
+      console.error(`[AgentInspect] bundle failed: ${message}`);
     }
-    const written = await writePlannedFiles(plan, cwd, options);
-    if (!options.json) {
-      console.log("AgentInspect init");
-      console.log(`Framework: ${plan.framework}`);
-      console.log(`Trace directory: ${TRACE_DIR}/`);
-      if (options.dryRun) {
-        console.log("Dry run \u2014 would create:");
-        for (const file of toWrite) console.log(`- ${file}`);
-        for (const file of skipped) {
-          console.log(`- ${file.path} (skip: ${file.reason ?? "exists"})`);
-        }
-        return;
+    process.exitCode = 1;
+    return;
+  }
+  const outputDir = await resolveOutputDir(options, resolveResult.runIds, cwd);
+  const files = [];
+  const checkRuns = [];
+  const redactionRuns = [];
+  const htmlByRun = /* @__PURE__ */ new Map();
+  const redactedJsonlByRun = /* @__PURE__ */ new Map();
+  let combinedJsonl = "";
+  for (const runId of resolveResult.runIds) {
+    const tracePath = getTraceFilePath(runId, traceDir);
+    let rawContent;
+    let sourceMtimeMs;
+    try {
+      rawContent = await readFile(tracePath, "utf-8");
+      sourceMtimeMs = (await stat(tracePath)).mtimeMs;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message, runId }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
       }
-      console.log("Created:");
-      for (const file of written) console.log(`- ${file}`);
-      for (const file of skipped) {
-        console.log(`- ${file.path} (skipped: ${file.reason ?? "exists"})`);
+      process.exitCode = 1;
+      return;
+    }
+    let read;
+    try {
+      read = await openTrace(
+        { type: "file", path: tracePath },
+        { format: "agent-inspect-jsonl" }
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message, runId }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
       }
-      console.log("\nNext: run your demo, then `npx agent-inspect list --dir .agent-inspect`");
-      console.log("No dependencies were installed. Add packages manually when ready.");
+      process.exitCode = 1;
+      return;
     }
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
+    const safety = assessOpenedTrace(read, { run: runId });
+    const status = safetyStatusFromAssess(safety.status);
+    checkRuns.push({
+      runId,
+      status,
+      errors: safety.summary.errors,
+      warnings: safety.summary.warnings,
+      findings: safety.summary.findings
+    });
+    const redacted = redactTraceContent(rawContent, toReportProfile(profile));
+    redactedJsonlByRun.set(runId, redacted.content);
+    combinedJsonl += redacted.content.endsWith("\n") ? redacted.content : `${redacted.content}
+`;
+    const detectors = [
+      ...new Set(redacted.findings.map((finding) => finding.detector))
+    ].sort((a, b) => a.localeCompare(b));
+    redactionRuns.push({
+      runId,
+      findings: redacted.findings.length,
+      detectors
+    });
+    const selected = read.runs.find((run) => run.runId === runId);
+    const runReport = exportRunTree(selected ?? read.runs[0], {
+      format: "html",
+      redacted: true,
+      redactionProfile: toReportProfile(profile)
+    });
+    htmlByRun.set(runId, extractHtmlBody(runReport.content));
+    const afterMtime = (await stat(tracePath)).mtimeMs;
+    if (afterMtime !== sourceMtimeMs) {
+      const message = `Source trace "${runId}" was modified during bundle creation.`;
+      if (options.json) {
+        console.log(writeJson4({ ok: false, error: message }).trimEnd());
+      } else {
+        console.error(`[AgentInspect] bundle failed: ${message}`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const checks2 = {
+    aggregateStatus: aggregateBundleSafeStatus(checkRuns.map((run) => run.status)),
+    runs: checkRuns
+  };
+  if (bundleFailsOnSafety(checks2.aggregateStatus, options.allowUnsafe === true)) {
     if (options.json) {
-      console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+      console.log(
+        writeJson4({
+          ok: false,
+          error: `Bundle safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`,
+          checks: checks2
+        }).trimEnd()
+      );
     } else {
-      console.error(`[AgentInspect] init failed: ${msg}`);
+      console.error(
+        `[AgentInspect] bundle refused: safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`
+      );
     }
     process.exitCode = 1;
+    return;
   }
-}
-var OPTIONAL_PACKAGES = {
-  custom: [],
-  "ai-sdk": ["@agent-inspect/ai-sdk"],
-  "openai-agents": ["@agent-inspect/openai-agents"],
-  langchain: ["@agent-inspect/langchain"]
-};
-function nodeVersionCheck() {
-  const major = Number(process2.versions.node.split(".")[0]);
-  if (Number.isNaN(major) || major < 20) {
-    return {
-      id: "node-version",
-      status: "fail",
-      message: `Node ${process2.versions.node} is below the supported minimum (20).`,
-      remediation: "Upgrade to Node 20 LTS or newer.",
-      evidence: process2.versions.node
-    };
-  }
-  return {
-    id: "node-version",
-    status: "pass",
-    message: `Node ${process2.versions.node} meets the minimum (>=20).`,
-    evidence: process2.versions.node
+  const redactionReport = {
+    profile,
+    totalFindings: redactionRuns.reduce((sum, run) => sum + run.findings, 0),
+    runs: redactionRuns
   };
-}
-function envCheck(name, optional = true) {
-  const value = process2.env[name];
-  if (value === void 0 || value.trim() === "") {
-    return {
-      id: `env-${name.toLowerCase()}`,
-      status: optional ? "skipped" : "warn",
-      message: `${name} is not set.`,
-      remediation: optional ? void 0 : `Set ${name}=1 to enable tracing.`
-    };
+  await mkdir(outputDir, { recursive: true });
+  for (const runId of resolveResult.runIds) {
+    const jsonl = redactedJsonlByRun.get(runId) ?? "";
+    await writeBundleFile(outputDir, `assets/runs/${runId}.jsonl`, jsonl, files);
+    const html = htmlByRun.get(runId) ?? "";
+    await writeBundleFile(
+      outputDir,
+      `assets/runs/${runId}.html`,
+      runReportWrap(html, runId),
+      files
+    );
   }
-  return {
-    id: `env-${name.toLowerCase()}`,
-    status: "pass",
-    message: `${name} is set.`,
-    evidence: value
-  };
-}
-async function traceDirWritable(traceDir) {
-  const resolved = path11.resolve(traceDir);
-  try {
-    await mkdir(resolved, { recursive: true });
-    await access(resolved, constants.W_OK);
-    return {
-      id: "trace-dir-writable",
-      status: "pass",
-      message: `Trace directory is writable: ${resolved}`,
-      evidence: resolved
-    };
-  } catch (error) {
-    return {
-      id: "trace-dir-writable",
-      status: "fail",
-      message: `Trace directory is not writable: ${resolved}`,
-      remediation: "Create the directory or set AGENT_INSPECT_TRACE_DIR to a writable path.",
-      evidence: error instanceof Error ? error.message : String(error)
-    };
+  const primaryRunId = resolveResult.runIds[0];
+  const traceHtml = resolveResult.runIds.length === 1 ? runReportWrap(htmlByRun.get(primaryRunId) ?? "", primaryRunId) : renderBundleIndexHtml({ runIds: resolveResult.runIds, reports: htmlByRun });
+  await writeBundleFile(outputDir, "trace.jsonl", combinedJsonl, files);
+  await writeBundleFile(outputDir, "trace.html", traceHtml, files);
+  await writeBundleFile(
+    outputDir,
+    "check-results.json",
+    writeJson4(checks2),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "eval-results.json",
+    writeJson4(buildPlaceholderArtifact()),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "redaction-report.json",
+    writeJson4(redactionReport),
+    files
+  );
+  await writeBundleFile(
+    outputDir,
+    "performance-summary.json",
+    writeJson4(buildPlaceholderArtifact()),
+    files
+  );
+  const metadata = buildBundleMetadata({
+    agentInspectVersion: version,
+    profile,
+    resolve: resolveResult,
+    checks: checks2,
+    files: [...files]
+  });
+  await writeBundleFile(outputDir, "metadata.json", writeJson4(metadata), files);
+  await writeBundleFile(
+    outputDir,
+    "summary.md",
+    buildBundleSummaryMarkdown({ metadata, checks: checks2, redaction: redactionReport }),
+    files
+  );
+  metadata.files = [...files].sort((a, b) => a.localeCompare(b));
+  await writeFile(path13.join(outputDir, "metadata.json"), writeJson4(metadata), "utf-8");
+  if (options.json) {
+    console.log(
+      writeJson4({
+        ok: true,
+        outputDir,
+        metadata,
+        checks: checks2,
+        redaction: redactionReport
+      }).trimEnd()
+    );
+    return;
   }
+  console.log(`Bundle written to ${outputDir}`);
+  console.log(`Safe status: ${metadata.safeStatus}`);
+  console.log(`Runs: ${resolveResult.runIds.join(", ")}`);
+  console.log(`Files: ${metadata.files.length}`);
 }
-function resolvePackage(cwd, name) {
-  const require2 = createRequire(path11.join(cwd, "package.json"));
-  try {
-    const pkgPath = require2.resolve(`${name}/package.json`);
-    const pkg = require2(pkgPath);
-    return { ok: true, version: pkg.version };
-  } catch {
-    return { ok: false };
-  }
+function runReportWrap(body, runId) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>AgentInspect \u2014 ${escapeHtml3(runId)}</title>
+<style>body{font-family:system-ui,sans-serif;line-height:1.5;margin:1.5rem;max-width:960px;color:#111}</style>
+</head>
+<body>
+${body}
+</body>
+</html>
+`;
 }
-function importSmoke(cwd) {
-  const results = [];
-  const require2 = createRequire(path11.join(cwd, "package.json"));
-  try {
-    require2.resolve("agent-inspect");
-    results.push({
-      id: "import-agent-inspect",
-      status: "pass",
-      message: "agent-inspect resolves from the current project."
+function validateReporterArtifactPath(options) {
+  const outputDir = path13.resolve(options.outputDir);
+  const diagnostics = [];
+  const rawPath = options.relativePath;
+  if (rawPath.length === 0) {
+    diagnostics.push({
+      code: "artifact_path_empty",
+      severity: "error",
+      message: "Reporter artifact path must not be empty."
     });
-  } catch {
-    results.push({
-      id: "import-agent-inspect",
-      status: "warn",
-      message: "agent-inspect is not installed in the current project.",
-      remediation: "Run npm install agent-inspect (or pnpm add agent-inspect)."
+    return { ok: false, outputDir, diagnostics };
+  }
+  if (rawPath.includes("\0")) {
+    diagnostics.push({
+      code: "invalid_artifact_path",
+      severity: "error",
+      message: "Reporter artifact path must not contain null bytes.",
+      target: rawPath
     });
+    return { ok: false, outputDir, diagnostics };
   }
-  try {
-    require2.resolve("agent-inspect/package.json");
-    results.push({
-      id: "import-agent-inspect-cjs",
-      status: "pass",
-      message: "CJS resolution for agent-inspect succeeded."
+  if (path13.isAbsolute(rawPath) || path13.win32.isAbsolute(rawPath)) {
+    diagnostics.push({
+      code: "artifact_path_absolute",
+      severity: "error",
+      message: "Reporter artifact path must be relative.",
+      target: rawPath
     });
-  } catch {
-    results.push({
-      id: "import-agent-inspect-cjs",
-      status: "skipped",
-      message: "CJS resolution check skipped (package not installed locally)."
+    return { ok: false, outputDir, diagnostics };
+  }
+  const normalized = path13.posix.normalize(rawPath.replace(/\\/g, "/"));
+  const segments = normalized.split("/");
+  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path must stay under the output directory.",
+      target: rawPath
     });
+    return { ok: false, outputDir, diagnostics };
   }
-  return results;
-}
-function optionalPackageChecks(cwd, framework) {
-  const packages = framework !== void 0 ? OPTIONAL_PACKAGES[framework] : [
-    "@agent-inspect/ai-sdk",
-    "@agent-inspect/openai-agents",
-    "@agent-inspect/langchain",
-    "@agent-inspect/redact",
-    "@agent-inspect/eval"
-  ];
-  return packages.map((name) => {
-    const resolved = resolvePackage(cwd, name);
-    if (!resolved.ok) {
-      return {
-        id: `optional-package-${name}`,
-        status: framework !== void 0 ? "warn" : "skipped",
-        message: `${name} is not installed.`,
-        remediation: framework !== void 0 ? `npm install ${name}` : void 0
-      };
-    }
-    return {
-      id: `optional-package-${name}`,
-      status: "pass",
-      message: `${name} is available.`,
-      evidence: resolved.version
-    };
-  });
-}
-function versionMismatchCheck(cwd) {
-  const root = resolvePackage(cwd, "agent-inspect");
-  if (!root.ok || root.version === void 0) {
-    return {
-      id: "version-alignment",
-      status: "skipped",
-      message: "Skipped version alignment \u2014 agent-inspect not installed locally."
-    };
-  }
-  if (root.version !== version) {
-    return {
-      id: "version-alignment",
-      status: "warn",
-      message: `CLI version ${version} differs from local agent-inspect@${root.version}.`,
-      remediation: "Align versions with npm install agent-inspect@latest",
-      evidence: `cli=${version};local=${root.version}`
-    };
+  const absolutePath = path13.resolve(outputDir, normalized);
+  const relFromOutput = path13.relative(outputDir, absolutePath);
+  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path13.isAbsolute(relFromOutput)) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path resolved outside the output directory.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
   }
   return {
-    id: "version-alignment",
-    status: "pass",
-    message: `CLI and local agent-inspect are aligned at ${version}.`
+    ok: true,
+    outputDir,
+    relativePath: normalized,
+    absolutePath,
+    diagnostics
   };
 }
-async function runDoctorChecks(options = {}) {
-  const cwd = path11.resolve(options.cwd ?? process2.cwd());
-  const traceDir = options.traceDir?.trim() || process2.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
-  const checks2 = [
-    nodeVersionCheck(),
-    {
-      id: "cli-version",
-      status: "pass",
-      message: `agent-inspect CLI ${version}`,
-      evidence: version
-    },
-    await traceDirWritable(traceDir),
-    envCheck("AGENT_INSPECT"),
-    envCheck("AGENT_INSPECT_TRACE_DIR"),
-    versionMismatchCheck(cwd)
-  ];
-  if (options.checkImports !== false) {
-    checks2.push(...importSmoke(cwd));
-  }
-  checks2.push(...optionalPackageChecks(cwd, options.framework));
-  return checks2.sort((a, b) => a.id.localeCompare(b.id));
+
+// packages/cli/src/ci-summary.ts
+var NOTE2 = "Generated locally by AgentInspect from reporter artifact manifests. Trace contents are not embedded.";
+var MAX_TEXT = 180;
+var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "jest", "manual"]);
+var STATUSES = /* @__PURE__ */ new Set(["passed", "failed", "skipped", "todo"]);
+var ARTIFACT_KINDS = /* @__PURE__ */ new Set(["trace", "report", "eval", "redaction", "summary"]);
+var ARTIFACT_FORMATS = /* @__PURE__ */ new Set(["json", "jsonl", "md", "html"]);
+var REDACTION_PROFILES2 = /* @__PURE__ */ new Set(["local", "share", "strict"]);
+function stable7(value) {
+  if (Array.isArray(value)) return value.map(stable7);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable7(record[key])])
+  );
 }
-async function doctorCommand(options = {}) {
-  const checks2 = await runDoctorChecks(options);
-  const failed = checks2.filter((check) => check.status === "fail").length;
-  const warned = checks2.filter((check) => check.status === "warn").length;
-  if (options.json) {
-    console.log(
-      JSON.stringify(
-        {
-          ok: failed === 0,
-          version,
-          summary: { pass: checks2.filter((c) => c.status === "pass").length, warn: warned, fail: failed },
-          checks: checks2
-        },
-        null,
-        2
-      )
-    );
-    if (failed > 0) process2.exitCode = 1;
-    return;
-  }
-  console.log("AgentInspect doctor");
-  for (const check of checks2) {
-    const tag = check.status.toUpperCase();
-    console.log(`[${tag}] ${check.id}: ${check.message}`);
-    if (check.remediation) console.log(`  \u2192 ${check.remediation}`);
+function writeJson5(value) {
+  return `${JSON.stringify(stable7(value), null, 2)}
+`;
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`${label} must be a non-empty string.`);
   }
-  console.log(`
-Summary: ${failed} failed, ${warned} warnings`);
-  if (failed > 0) process2.exitCode = 1;
+  return safeText(value);
 }
-
-// packages/adapter-sdk/src/indexer.ts
-function defineIndexer(indexer) {
-  if (!indexer.id.trim()) throw new Error("indexer id is required");
-  return indexer;
+function readOptionalString(value) {
+  return typeof value === "string" && value.trim() !== "" ? safeText(value) : void 0;
 }
-async function indexIsStale(snapshot, traceDir) {
-  const builtMs = Date.parse(snapshot.builtAt);
-  if (Number.isNaN(builtMs)) return true;
-  const td = new TraceDirectory({ dir: traceDir });
-  const files = await td.list();
-  for (const file of files) {
-    const stats = await td.getFileStats(file);
-    if (stats.mtimeMs > builtMs) return true;
+function readFramework(value) {
+  const framework = readString(value, "manifest.framework");
+  if (!FRAMEWORKS.has(framework)) {
+    throw new Error(`Unsupported reporter framework: ${framework}.`);
   }
-  return false;
+  return framework;
 }
-function createTraceDirectoryIndexer() {
-  return defineIndexer({
-    id: "trace-directory-metadata",
-    async rebuild(traceDir, options = {}) {
-      const warnings = [];
-      const td = new TraceDirectory({ dir: traceDir });
-      const files = await td.list();
-      const maxEntries = options.maxEntries ?? 1e4;
-      if (files.length > maxEntries) {
-        warnings.push(
-          `indexer.truncated: trace directory has ${files.length} files; indexing first ${maxEntries}`
-        );
-      }
-      const slice = files.slice(0, maxEntries);
-      const metas = await loadTraceMetadataList(
-        traceDir,
-        slice,
-        (fileName) => td.getPath(fileName)
-      );
-      const entries = metas.map((meta) => ({
-        runId: meta.runId,
-        path: meta.filePath,
-        name: meta.name,
-        startedAt: meta.startedAt,
-        status: meta.status
-      })).sort((a, b) => a.runId.localeCompare(b.runId));
-      if (entries.length < slice.length) {
-        warnings.push(
-          `indexer.partial: indexed ${entries.length} of ${slice.length} trace files`
-        );
-      }
-      return {
-        traceDir,
-        builtAt: (/* @__PURE__ */ new Date()).toISOString(),
-        entries,
-        warnings
-      };
-    }
+function readStatus(value) {
+  const status = readString(value, "result.status");
+  if (!STATUSES.has(status)) {
+    throw new Error(`Unsupported reporter test status: ${status}.`);
+  }
+  return status;
+}
+function readArtifact(value, index) {
+  if (!isObject(value)) throw new Error(`manifest.artifacts[${index}] must be an object.`);
+  const kind = readString(value.kind, `manifest.artifacts[${index}].kind`);
+  const format = readString(value.format, `manifest.artifacts[${index}].format`);
+  const redactionProfile = readString(
+    value.redactionProfile,
+    `manifest.artifacts[${index}].redactionProfile`
+  );
+  if (!ARTIFACT_KINDS.has(kind)) throw new Error(`Unsupported artifact kind: ${kind}.`);
+  if (!ARTIFACT_FORMATS.has(format)) throw new Error(`Unsupported artifact format: ${format}.`);
+  if (!REDACTION_PROFILES2.has(redactionProfile)) {
+    throw new Error(`Unsupported artifact redaction profile: ${redactionProfile}.`);
+  }
+  const artifactPath = readString(value.path, `manifest.artifacts[${index}].path`);
+  const pathCheck = validateReporterArtifactPath({
+    outputDir: process.cwd(),
+    relativePath: artifactPath
   });
+  if (!pathCheck.ok || pathCheck.relativePath === void 0) {
+    throw new Error(`Unsafe reporter artifact path: ${artifactPath}.`);
+  }
+  return {
+    kind,
+    path: pathCheck.relativePath,
+    format,
+    redactionProfile
+  };
 }
-
-// packages/cli/src/index-cmd.ts
-var INDEX_FILENAME = ".agent-inspect-index.json";
-function traceIndexPath(traceDir) {
-  return path11.join(traceDir, INDEX_FILENAME);
+function readArtifacts(value, label) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.map((item, index) => readArtifact(item, index));
 }
-function parseMaxEntries(raw) {
-  if (raw === void 0 || raw.trim() === "") return void 0;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new Error("--max-entries must be a positive integer.");
+function readDiagnosticsCount(value, label) {
+  if (value === void 0) return 0;
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.length;
+}
+function readResult(value, index) {
+  if (!isObject(value)) throw new Error(`manifest.results[${index}] must be an object.`);
+  const file = readOptionalString(value.file);
+  const tracePath = readOptionalString(value.tracePath);
+  return {
+    testId: readString(value.testId, `manifest.results[${index}].testId`),
+    name: readString(value.name, `manifest.results[${index}].name`),
+    ...file === void 0 ? {} : { file },
+    status: readStatus(value.status),
+    ...tracePath === void 0 ? {} : { tracePath },
+    artifacts: readArtifacts(value.artifacts, `manifest.results[${index}].artifacts`),
+    diagnostics: readDiagnosticsCount(
+      value.diagnostics,
+      `manifest.results[${index}].diagnostics`
+    )
+  };
+}
+function readManifestDocument(value) {
+  if (!isObject(value)) throw new Error("Reporter manifest file must contain a JSON object.");
+  const candidate = isObject(value.manifest) ? value.manifest : value;
+  if (!isObject(candidate)) throw new Error("Reporter manifest must be a JSON object.");
+  const schemaVersion = readString(candidate.schemaVersion, "manifest.schemaVersion");
+  if (schemaVersion !== "0.1") {
+    throw new Error(`Unsupported reporter manifest schemaVersion: ${schemaVersion}.`);
   }
-  return parsed;
+  if (!Array.isArray(candidate.results)) {
+    throw new Error("manifest.results must be an array.");
+  }
+  const artifacts = readArtifacts(candidate.artifacts, "manifest.artifacts");
+  const results = candidate.results.map((item, index) => readResult(item, index));
+  const diagnostics = readDiagnosticsCount(candidate.diagnostics, "manifest.diagnostics");
+  const manifest = {
+    framework: readFramework(candidate.framework),
+    generatedAt: readString(candidate.generatedAt, "manifest.generatedAt"),
+    results,
+    artifacts
+  };
+  return {
+    packageName: readOptionalString(value.package),
+    manifest,
+    diagnostics
+  };
 }
-async function readSnapshot(indexPath2) {
-  try {
-    const raw = await readFile(indexPath2, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return void 0;
+function cwdRelative(filePath) {
+  const relative = path13.relative(process.cwd(), path13.resolve(filePath)).replace(/\\/g, "/");
+  if (relative === "" || relative.startsWith("../") || path13.isAbsolute(relative)) {
+    return path13.basename(filePath);
   }
+  return relative;
 }
-async function indexBuildCommand(options = {}) {
-  try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    await mkdir(traceDir, { recursive: true });
-    const indexer = createTraceDirectoryIndexer();
-    const snapshot = await indexer.rebuild(traceDir, {
-      maxEntries: parseMaxEntries(options.maxEntries)
-    });
-    const indexPath2 = traceIndexPath(traceDir);
-    await writeFile(indexPath2, `${JSON.stringify(snapshot, null, 2)}
-`, "utf8");
-    if (options.json) {
-      console.log(JSON.stringify({ ok: true, indexPath: indexPath2, ...snapshot }, null, 2));
-      return;
-    }
-    console.log(`Built trace index: ${indexPath2}`);
-    console.log(`Entries: ${snapshot.entries.length}`);
-    if (snapshot.warnings.length > 0) {
-      for (const warning of snapshot.warnings) {
-        console.log(`warning: ${warning}`);
-      }
+async function readReporterManifest(filePath) {
+  const absolute = path13.resolve(filePath);
+  const raw = await readFile(absolute, "utf-8");
+  const document = readManifestDocument(JSON.parse(raw));
+  const manifest = document.manifest;
+  const results = manifest.results.map((result) => ({
+    testId: safeText(result.testId),
+    name: safeText(result.name),
+    ...result.file === void 0 ? {} : { file: safeText(path13.basename(result.file)) },
+    status: result.status,
+    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path13.basename(result.tracePath)) },
+    artifacts: result.artifacts,
+    diagnostics: result.diagnostics
+  }));
+  return {
+    ...document.packageName === void 0 ? {} : { packageName: document.packageName },
+    manifestFile: cwdRelative(absolute),
+    framework: manifest.framework,
+    generatedAt: manifest.generatedAt,
+    results,
+    artifacts: manifest.artifacts,
+    diagnostics: document.diagnostics
+  };
+}
+function summarize3(manifests) {
+  const summary = {
+    manifests: manifests.length,
+    tests: 0,
+    failed: 0,
+    passed: 0,
+    skipped: 0,
+    todo: 0,
+    artifacts: 0,
+    diagnostics: 0
+  };
+  for (const manifest of manifests) {
+    summary.artifacts += manifest.artifacts.length;
+    summary.diagnostics += manifest.diagnostics;
+    for (const result of manifest.results) {
+      summary.tests += 1;
+      if (result.status === "failed") summary.failed += 1;
+      else if (result.status === "passed") summary.passed += 1;
+      else if (result.status === "skipped") summary.skipped += 1;
+      else summary.todo += 1;
+      summary.artifacts += result.artifacts.length;
+      summary.diagnostics += result.diagnostics;
     }
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index build failed: ${msg}`);
-    process.exitCode = 1;
   }
+  return {
+    status: summary.failed > 0 ? "failed" : summary.diagnostics > 0 ? "warning" : "ok",
+    manifests,
+    summary,
+    note: NOTE2
+  };
 }
-async function indexStatusCommand(options = {}) {
-  try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    const indexPath2 = traceIndexPath(traceDir);
-    const snapshot = await readSnapshot(indexPath2);
-    if (!snapshot) {
-      const payload2 = { ok: true, exists: false, indexPath: indexPath2, traceDir, stale: true };
-      if (options.json) {
-        console.log(JSON.stringify(payload2, null, 2));
-      } else {
-        console.log(`No index at ${indexPath2}`);
-        console.log("Run: agent-inspect index build");
-      }
-      return;
+function markdownCell(value) {
+  return safeText(String(value ?? "unknown")).replaceAll("|", "\\|").replace(/\r?\n/g, " ");
+}
+function renderMarkdown2(result) {
+  const lines = [
+    "# AgentInspect CI Summary",
+    "",
+    NOTE2,
+    "",
+    "| Field | Value |",
+    "| --- | --- |",
+    `| Status | ${result.status} |`,
+    `| Manifests | ${result.summary.manifests} |`,
+    `| Tests | ${result.summary.tests} |`,
+    `| Failed | ${result.summary.failed} |`,
+    `| Passed | ${result.summary.passed} |`,
+    `| Skipped | ${result.summary.skipped} |`,
+    `| Todo | ${result.summary.todo} |`,
+    `| Artifacts | ${result.summary.artifacts} |`,
+    `| Diagnostics | ${result.summary.diagnostics} |`,
+    "",
+    "## Tests",
+    "",
+    "| Framework | Status | Test | File | Trace | Artifacts |",
+    "| --- | --- | --- | --- | --- | --- |"
+  ];
+  const rows = result.manifests.flatMap(
+    (manifest) => manifest.results.map((test) => ({
+      framework: manifest.framework,
+      test
+    }))
+  );
+  if (rows.length === 0) {
+    lines.push("| unknown | unknown | No tests found | unknown | unknown | 0 |");
+  } else {
+    for (const row of rows) {
+      lines.push(
+        `| ${markdownCell(row.framework)} | ${markdownCell(row.test.status)} | ${markdownCell(row.test.name)} | ${markdownCell(row.test.file)} | ${markdownCell(row.test.tracePath)} | ${row.test.artifacts.length} |`
+      );
     }
-    const stale = await indexIsStale(snapshot, traceDir);
-    const payload = {
-      ok: true,
-      exists: true,
-      indexPath: indexPath2,
-      traceDir,
-      stale,
-      builtAt: snapshot.builtAt,
-      entries: snapshot.entries.length,
-      warnings: snapshot.warnings
-    };
-    if (options.json) {
-      console.log(JSON.stringify(payload, null, 2));
-      return;
+  }
+  lines.push("", "## Manifests", "", "| Framework | File | Generated | Artifacts |", "| --- | --- | --- | --- |");
+  for (const manifest of result.manifests) {
+    lines.push(
+      `| ${markdownCell(manifest.framework)} | ${markdownCell(manifest.manifestFile)} | ${markdownCell(manifest.generatedAt)} | ${manifest.artifacts.length} |`
+    );
+  }
+  lines.push("", "## Artifacts", "", "| Framework | Kind | Path | Format | Profile |", "| --- | --- | --- | --- | --- |");
+  const artifacts = result.manifests.flatMap(
+    (manifest) => manifest.artifacts.map((artifact) => ({ framework: manifest.framework, artifact }))
+  );
+  if (artifacts.length === 0) {
+    lines.push("| unknown | unknown | No artifacts found | unknown | unknown |");
+  } else {
+    for (const row of artifacts) {
+      lines.push(
+        `| ${markdownCell(row.framework)} | ${markdownCell(row.artifact.kind)} | ${markdownCell(row.artifact.path)} | ${markdownCell(row.artifact.format)} | ${markdownCell(row.artifact.redactionProfile)} |`
+      );
     }
-    console.log(`Index: ${indexPath2}`);
-    console.log(`Built: ${snapshot.builtAt}`);
-    console.log(`Entries: ${snapshot.entries.length}`);
-    console.log(`Stale: ${stale ? "yes" : "no"}`);
-    if (snapshot.warnings.length > 0) {
-      for (const warning of snapshot.warnings) {
-        console.log(`warning: ${warning}`);
-      }
+  }
+  lines.push("");
+  return `${lines.join("\n")}
+`;
+}
+function safeText(value) {
+  const compact = value.replace(/\s+/g, " ").trim();
+  const redacted = compact.replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(
+    /\b(?:api[_-]?key|authorization|token|secret|password)\s*[:=]\s*[^,\s]+/gi,
+    "$1=[REDACTED]"
+  );
+  if (redacted.length <= MAX_TEXT) return redacted;
+  return `${redacted.slice(0, MAX_TEXT - 12)}...[truncated]`;
+}
+async function ciSummaryCommand(manifestPaths, options = {}) {
+  if (manifestPaths.length === 0) {
+    console.error("At least one reporter manifest path is required.");
+    process.exitCode = 1;
+    return;
+  }
+  let result;
+  try {
+    const manifests = [];
+    for (const manifestPath of manifestPaths) {
+      manifests.push(await readReporterManifest(manifestPath));
     }
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index status failed: ${msg}`);
+    manifests.sort((a, b) => a.manifestFile.localeCompare(b.manifestFile));
+    result = summarize3(manifests);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[AgentInspect] ci-summary failed: ${message}`);
     process.exitCode = 1;
+    return;
+  }
+  const markdown = renderMarkdown2(result);
+  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path13.resolve(options.output.trim()) : void 0;
+  if (outputPath !== void 0) {
+    await mkdir(path13.dirname(outputPath), { recursive: true });
+    await writeFile(outputPath, markdown, "utf-8");
+  }
+  const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
+  if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
+    const summaryPath = path13.resolve(summaryTarget);
+    await mkdir(path13.dirname(summaryPath), { recursive: true });
+    await appendFile(summaryPath, `
+${markdown}`, "utf-8");
+  }
+  if (options.json === true) {
+    console.log(writeJson5(result).trimEnd());
+  } else if (outputPath !== void 0) {
+    console.log(`Wrote AgentInspect CI summary to ${outputPath}`);
+    console.log(`Status: ${result.status}`);
+  } else {
+    console.log(markdown.trimEnd());
   }
 }
-async function indexCleanCommand(options = {}) {
-  try {
-    const traceDir = resolveTraceDir({ dir: options.dir });
-    const indexPath2 = traceIndexPath(traceDir);
-    await rm(indexPath2, { force: true });
-    if (options.json) {
-      console.log(JSON.stringify({ ok: true, removed: indexPath2 }, null, 2));
-      return;
+var CONFIG_FILE = "agent-inspect.config.ts";
+var TRACE_DIR = ".agent-inspect";
+var GITKEEP = ".agent-inspect/.gitkeep";
+function normalizeFramework(value) {
+  const raw = (value ?? "custom").trim();
+  if (raw === "ai-sdk" || raw === "openai-agents" || raw === "langchain" || raw === "custom") {
+    return raw;
+  }
+  throw new Error(
+    "Unsupported --framework value. Use ai-sdk, openai-agents, langchain, or custom."
+  );
+}
+function configTemplate(framework) {
+  const base = `/**
+ * AgentInspect local config (metadata-only capture by default).
+ * See https://github.com/rajudandigam/agent-inspect/blob/main/docs/SAFE-TRACE-SHARING.md
+ */
+export const agentInspectConfig = {
+  traceDir: ".agent-inspect",
+  enabled: process.env.AGENT_INSPECT !== "0",
+  redactionProfile: "local" as const,
+};
+`;
+  if (framework === "custom") return base;
+  return `${base}
+export const framework = "${framework}" as const;
+`;
+}
+function demoTemplate(framework) {
+  switch (framework) {
+    case "ai-sdk":
+      return `/**
+ * AI SDK starter \u2014 metadata-only telemetry (no real model calls in this demo).
+ * Install: npm install agent-inspect @agent-inspect/ai-sdk ai
+ */
+import { inspectRun, step } from "agent-inspect";
+
+async function main() {
+  await inspectRun("ai-sdk-demo", async () => {
+    await step.tool("mock-generate", async () => ({ text: "ok" }));
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    case "openai-agents":
+      return `/**
+ * OpenAI Agents starter \u2014 use @agent-inspect/openai-agents for local-only processors.
+ * This demo uses manual steps (no API keys).
+ */
+import { inspectRun, step } from "agent-inspect";
+
+async function main() {
+  await inspectRun("openai-agents-demo", async () => {
+    await step.tool("mock-agent-run", async () => "ok");
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    case "langchain":
+      return `/**
+ * LangChain starter \u2014 wire @agent-inspect/langchain callbacks in your app.
+ * This demo uses manual steps (no API keys).
+ */
+import { inspectRun, step } from "agent-inspect";
+
+async function main() {
+  await inspectRun("langchain-demo", async () => {
+    await step.tool("mock-chain", async () => "ok");
+  }, { traceDir: ".agent-inspect", silent: true });
+  console.log("Trace written to .agent-inspect/");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+`;
+    default:
+      return `import { observe } from "agent-inspect";
+
+class DemoAgent {
+  async run(input: { question: string }) {
+    return { answer: \`Echo: \${input.question}\` };
+  }
+}
+
+const agent = observe(new DemoAgent(), {
+  traceDir: ".agent-inspect",
+  silent: true,
+});
+
+await agent.run({ question: "hello" });
+console.log("Trace written to .agent-inspect/");
+`;
+  }
+}
+function githubWorkflowTemplate() {
+  return `name: AgentInspect artifacts
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+jobs:
+  trace-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm ci
+      - run: npm test
+      - name: Upload AgentInspect traces
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: agent-inspect-traces
+          path: .agent-inspect/**/*.jsonl
+          if-no-files-found: ignore
+`;
+}
+async function planInit(options = {}) {
+  const framework = normalizeFramework(options.framework);
+  const cwd = path13.resolve(options.cwd ?? process.cwd());
+  const demoPath = framework === "custom" ? path13.join("examples", "agent-inspect-demo.mjs") : path13.join("examples", `agent-inspect-${framework}-demo.mjs`);
+  const candidates = [
+    { rel: CONFIG_FILE, content: configTemplate(framework) },
+    { rel: GITKEEP, content: "" },
+    { rel: demoPath, content: demoTemplate(framework) }
+  ];
+  if (options.ci === "github") {
+    candidates.push({
+      rel: ".github/workflows/agent-inspect-artifacts.yml",
+      content: githubWorkflowTemplate()
+    });
+  }
+  const files = [];
+  for (const candidate of candidates) {
+    const abs = path13.join(cwd, candidate.rel);
+    try {
+      await access(abs);
+      files.push({
+        path: candidate.rel,
+        action: "skip",
+        reason: "file already exists"
+      });
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      files.push({ path: candidate.rel, action: "create" });
     }
-    console.log(`Removed index: ${indexPath2}`);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] index clean failed: ${msg}`);
-    process.exitCode = 1;
   }
+  return { framework, ...options.ci ? { ci: options.ci } : {}, files };
 }
-var PACKAGE = "@agent-inspect/index-sqlite";
-function isModuleNotFound3(e) {
-  return e !== null && typeof e === "object" && "code" in e && (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND");
-}
-async function loadIndexSqlite() {
-  try {
-    return await import('./src-VQT7QLGV.mjs');
-  } catch (e) {
-    if (isModuleNotFound3(e)) {
-      console.error(
-        `The optional SQLite index is not installed. Run: npm install ${PACKAGE}`
-      );
-      process.exitCode = 1;
-      return null;
+async function writePlannedFiles(plan, cwd, options) {
+  const written = [];
+  for (const entry of plan.files) {
+    if (entry.action === "skip") {
+      continue;
     }
-    const msg = e instanceof Error ? e.message : String(e);
-    console.error(`[AgentInspect] failed to load ${PACKAGE}: ${msg}`);
-    process.exitCode = 1;
-    return null;
-  }
-}
-function parsePositiveInt(raw, flag) {
-  if (raw === void 0 || raw.trim() === "") return void 0;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new Error(`${flag} must be a positive integer.`);
+    const abs = path13.join(cwd, entry.path);
+    if (options.dryRun) {
+      written.push(entry.path);
+      continue;
+    }
+    await mkdir(path13.dirname(abs), { recursive: true });
+    const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
+    await writeFile(abs, content, "utf-8");
+    written.push(entry.path);
   }
-  return parsed;
+  return written;
 }
-async function newestTraceMtimeMs2(traceDir) {
-  let newest = 0;
+async function initCommand(options = {}) {
+  const cwd = path13.resolve(options.cwd ?? process.cwd());
   try {
-    const files = await readdir(traceDir);
-    for (const file of files) {
-      if (!file.endsWith(".jsonl")) continue;
-      try {
-        const s = await stat(path11.join(traceDir, file));
-        if (s.mtimeMs > newest) newest = s.mtimeMs;
-      } catch {
+    const plan = await planInit({ ...options, cwd });
+    const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
+    const skipped = plan.files.filter((file) => file.action === "skip");
+    if (options.json) {
+      const payload = {
+        ok: true,
+        version,
+        framework: plan.framework,
+        ci: plan.ci ?? null,
+        dryRun: options.dryRun === true,
+        planned: plan.files,
+        wouldWrite: options.dryRun ? toWrite : void 0
+      };
+      console.log(JSON.stringify(payload, null, 2));
+      if (options.dryRun) return;
+    }
+    const written = await writePlannedFiles(plan, cwd, options);
+    if (!options.json) {
+      console.log("AgentInspect init");
+      console.log(`Framework: ${plan.framework}`);
+      console.log(`Trace directory: ${TRACE_DIR}/`);
+      if (options.dryRun) {
+        console.log("Dry run \u2014 would create:");
+        for (const file of toWrite) console.log(`- ${file}`);
+        for (const file of skipped) {
+          console.log(`- ${file.path} (skip: ${file.reason ?? "exists"})`);
+        }
+        return;
+      }
+      console.log("Created:");
+      for (const file of written) console.log(`- ${file}`);
+      for (const file of skipped) {
+        console.log(`- ${file.path} (skipped: ${file.reason ?? "exists"})`);
       }
+      console.log("\nNext: run your demo, then `npx agent-inspect list --dir .agent-inspect`");
+      console.log("No dependencies were installed. Add packages manually when ready.");
     }
-  } catch {
-  }
-  return newest;
-}
-async function indexSqliteBuildCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const result = await mod.buildIndex({
-    traceDir: options.dir,
-    maxRuns: parsePositiveInt(options.maxRuns, "--max-runs")
-  });
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, ...result }, null, 2));
-    return;
-  }
-  console.log(`Built SQLite index: ${result.dbPath}`);
-  console.log(`Runs: ${result.runs}  Steps: ${result.steps}  Errors: ${result.errors}`);
-  for (const warning of result.warnings) console.log(`warning: ${warning}`);
-}
-async function indexSqliteStatusCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  const status = mod.indexStatus(dbPath);
-  const stale = mod.isIndexStale(dbPath, await newestTraceMtimeMs2(traceDir));
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, traceDir, stale, ...status }, null, 2));
-    return;
-  }
-  if (!status.exists) {
-    console.log(`No SQLite index at ${dbPath}`);
-    console.log("Run: agent-inspect index sqlite build");
-    return;
-  }
-  console.log(`Index: ${status.dbPath}`);
-  console.log(`Healthy: ${status.healthy ? "yes" : "no"}`);
-  console.log(`Built: ${status.builtAt ?? "unknown"}`);
-  console.log(`Runs: ${status.runs}  Steps: ${status.steps}`);
-  console.log(`Stale: ${stale ? "yes" : "no"}`);
-}
-async function indexSqliteQueryCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  const status = mod.indexStatus(dbPath);
-  if (!status.exists || !status.healthy) {
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
     if (options.json) {
-      console.log(JSON.stringify({ ok: false, reason: "index-missing", dbPath }, null, 2));
+      console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
     } else {
-      console.log("No usable SQLite index. Run: agent-inspect index sqlite build");
+      console.error(`[AgentInspect] init failed: ${msg}`);
     }
     process.exitCode = 1;
-    return;
-  }
-  const rows = mod.queryRuns(dbPath, {
-    status: options.status,
-    sessionId: options.session,
-    name: options.name,
-    kind: options.kind,
-    tool: options.tool,
-    limit: parsePositiveInt(options.limit, "--limit")
-  });
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, count: rows.length, runs: rows }, null, 2));
-    return;
-  }
-  if (rows.length === 0) {
-    console.log("No matching runs.");
-    return;
-  }
-  for (const run of rows) {
-    const parts = [
-      run.runId,
-      run.status ?? "unknown",
-      run.name ?? "",
-      run.durationMs != null ? `${run.durationMs}ms` : ""
-    ].filter((p) => p !== "");
-    console.log(parts.join("  "));
-  }
-}
-async function indexSqliteCleanCommand(options = {}) {
-  const mod = await loadIndexSqlite();
-  if (!mod) return;
-  const traceDir = resolveTraceDir({ dir: options.dir });
-  const dbPath = mod.resolveIndexDbPath(traceDir);
-  await mod.cleanIndex(dbPath);
-  if (options.json) {
-    console.log(JSON.stringify({ ok: true, removed: dbPath }, null, 2));
-    return;
   }
-  console.log(`Removed SQLite index: ${dbPath}`);
 }
-
-// packages/core/src/workspace/types.ts
-var WORKSPACE_SCHEMA_VERSION = "1.0";
-var WORKSPACE_DIR_NAME = ".agent-inspect";
-var WORKSPACE_MANIFEST_FILENAME = "workspace.json";
-
-// packages/core/src/workspace/manifest.ts
-var DEFAULT_WORKSPACE_LAYOUT = {
-  traceDirs: ["runs"],
-  reportsDir: "reports",
-  artifactsDir: "artifacts",
-  bundlesDir: "bundles",
-  notesDir: "notes"
+var OPTIONAL_PACKAGES = {
+  custom: [],
+  "ai-sdk": ["@agent-inspect/ai-sdk"],
+  "openai-agents": ["@agent-inspect/openai-agents"],
+  langchain: ["@agent-inspect/langchain"]
 };
-var DEFAULT_REDACTION_PROFILE = "share";
-var REDACTION_PROFILES2 = [
-  "local",
-  "share",
-  "strict"
-];
-var INDEX_TYPES = ["none", "sqlite", "custom"];
-var MAX_WORKSPACE_MANIFEST_BYTES = 64 * 1024;
-function createDefaultWorkspaceManifest(options) {
-  const project = typeof options.project === "string" ? options.project.trim() : "";
-  const index = {
-    enabled: options.index?.enabled ?? false,
-    type: options.index?.type ?? "none",
-    ...options.index?.path !== void 0 ? { path: options.index.path } : {}
-  };
-  return {
-    schemaVersion: WORKSPACE_SCHEMA_VERSION,
-    project,
-    createdAt: options.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    traceDirs: options.traceDirs ? [...options.traceDirs] : [...DEFAULT_WORKSPACE_LAYOUT.traceDirs],
-    reportsDir: options.reportsDir ?? DEFAULT_WORKSPACE_LAYOUT.reportsDir,
-    artifactsDir: options.artifactsDir ?? DEFAULT_WORKSPACE_LAYOUT.artifactsDir,
-    bundlesDir: options.bundlesDir ?? DEFAULT_WORKSPACE_LAYOUT.bundlesDir,
-    notesDir: options.notesDir ?? DEFAULT_WORKSPACE_LAYOUT.notesDir,
-    redactionProfile: options.redactionProfile ?? DEFAULT_REDACTION_PROFILE,
-    index
-  };
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isSafeRelativeWorkspacePath(p) {
-  if (typeof p !== "string") return false;
-  const trimmed = p.trim();
-  if (trimmed === "") return false;
-  if (trimmed.startsWith("/") || trimmed.startsWith("\\")) return false;
-  if (/^[a-zA-Z]:/.test(trimmed)) return false;
-  const segments = trimmed.split(/[/\\]+/);
-  return !segments.some((seg) => seg === "..");
-}
-function validateDirField(value, field, errors) {
-  if (typeof value !== "string" || value.trim() === "") {
-    errors.push(`${field} must be a non-empty string`);
-    return;
-  }
-  if (!isSafeRelativeWorkspacePath(value)) {
-    errors.push(
-      `${field} must be a relative path inside the workspace (no absolute paths or ".." traversal)`
-    );
+function nodeVersionCheck() {
+  const major = Number(process2.versions.node.split(".")[0]);
+  if (Number.isNaN(major) || major < 20) {
+    return {
+      id: "node-version",
+      status: "fail",
+      message: `Node ${process2.versions.node} is below the supported minimum (20).`,
+      remediation: "Upgrade to Node 20 LTS or newer.",
+      evidence: process2.versions.node
+    };
   }
+  return {
+    id: "node-version",
+    status: "pass",
+    message: `Node ${process2.versions.node} meets the minimum (>=20).`,
+    evidence: process2.versions.node
+  };
 }
-function validateIndex(value, errors) {
-  if (!isPlainObject(value)) {
-    errors.push("index must be an object");
-    return void 0;
-  }
-  if (typeof value.enabled !== "boolean") {
-    errors.push("index.enabled must be a boolean");
-  }
-  if (!INDEX_TYPES.includes(value.type)) {
-    errors.push(`index.type must be one of: ${INDEX_TYPES.join(", ")}`);
-  }
-  if (value.path !== void 0 && !isSafeRelativeWorkspacePath(value.path)) {
-    errors.push(
-      'index.path must be a relative path inside the workspace (no absolute paths or ".." traversal)'
-    );
+function envCheck(name, optional = true) {
+  const value = process2.env[name];
+  if (value === void 0 || value.trim() === "") {
+    return {
+      id: `env-${name.toLowerCase()}`,
+      status: optional ? "skipped" : "warn",
+      message: `${name} is not set.`,
+      remediation: optional ? void 0 : `Set ${name}=1 to enable tracing.`
+    };
   }
-  if (errors.length > 0) return void 0;
   return {
-    enabled: value.enabled,
-    type: value.type,
-    ...value.path !== void 0 ? { path: value.path } : {}
+    id: `env-${name.toLowerCase()}`,
+    status: "pass",
+    message: `${name} is set.`,
+    evidence: value
   };
 }
-function validateWorkspaceManifest(input3) {
-  const errors = [];
-  const warnings = [];
-  if (!isPlainObject(input3)) {
-    return { ok: false, errors: ["manifest must be an object"], warnings };
-  }
-  if (input3.schemaVersion !== WORKSPACE_SCHEMA_VERSION) {
-    errors.push(
-      `schemaVersion must be "${WORKSPACE_SCHEMA_VERSION}" (received ${JSON.stringify(
-        input3.schemaVersion
-      )})`
-    );
-  }
-  if (typeof input3.project !== "string" || input3.project.trim() === "") {
-    errors.push("project must be a non-empty string");
+async function traceDirWritable(traceDir) {
+  const resolved = path13.resolve(traceDir);
+  try {
+    await mkdir(resolved, { recursive: true });
+    await access(resolved, constants.W_OK);
+    return {
+      id: "trace-dir-writable",
+      status: "pass",
+      message: `Trace directory is writable: ${resolved}`,
+      evidence: resolved
+    };
+  } catch (error) {
+    return {
+      id: "trace-dir-writable",
+      status: "fail",
+      message: `Trace directory is not writable: ${resolved}`,
+      remediation: "Create the directory or set AGENT_INSPECT_TRACE_DIR to a writable path.",
+      evidence: error instanceof Error ? error.message : String(error)
+    };
   }
-  if (typeof input3.createdAt !== "string" || input3.createdAt.trim() === "") {
-    errors.push("createdAt must be a non-empty ISO-8601 string");
-  } else if (Number.isNaN(Date.parse(input3.createdAt))) {
-    errors.push("createdAt must be a valid ISO-8601 date string");
+}
+function resolvePackage(cwd, name) {
+  const require2 = createRequire(path13.join(cwd, "package.json"));
+  try {
+    const pkgPath = require2.resolve(`${name}/package.json`);
+    const pkg = require2(pkgPath);
+    return { ok: true, version: pkg.version };
+  } catch {
+    return { ok: false };
   }
-  if (!Array.isArray(input3.traceDirs) || input3.traceDirs.length === 0) {
-    errors.push("traceDirs must be a non-empty array");
-  } else {
-    input3.traceDirs.forEach((dir, i) => {
-      if (typeof dir !== "string" || dir.trim() === "") {
-        errors.push(`traceDirs[${i}] must be a non-empty string`);
-      } else if (!isSafeRelativeWorkspacePath(dir)) {
-        errors.push(
-          `traceDirs[${i}] must be a relative path inside the workspace (no absolute paths or ".." traversal)`
-        );
-      }
+}
+function importSmoke(cwd) {
+  const results = [];
+  const require2 = createRequire(path13.join(cwd, "package.json"));
+  try {
+    require2.resolve("agent-inspect");
+    results.push({
+      id: "import-agent-inspect",
+      status: "pass",
+      message: "agent-inspect resolves from the current project."
+    });
+  } catch {
+    results.push({
+      id: "import-agent-inspect",
+      status: "warn",
+      message: "agent-inspect is not installed in the current project.",
+      remediation: "Run npm install agent-inspect (or pnpm add agent-inspect)."
     });
   }
-  validateDirField(input3.reportsDir, "reportsDir", errors);
-  validateDirField(input3.artifactsDir, "artifactsDir", errors);
-  validateDirField(input3.bundlesDir, "bundlesDir", errors);
-  validateDirField(input3.notesDir, "notesDir", errors);
-  if (!REDACTION_PROFILES2.includes(input3.redactionProfile)) {
-    errors.push(`redactionProfile must be one of: ${REDACTION_PROFILES2.join(", ")}`);
+  try {
+    require2.resolve("agent-inspect/package.json");
+    results.push({
+      id: "import-agent-inspect-cjs",
+      status: "pass",
+      message: "CJS resolution for agent-inspect succeeded."
+    });
+  } catch {
+    results.push({
+      id: "import-agent-inspect-cjs",
+      status: "skipped",
+      message: "CJS resolution check skipped (package not installed locally)."
+    });
   }
-  const indexErrors = [];
-  const index = validateIndex(input3.index, indexErrors);
-  errors.push(...indexErrors);
-  if (index && index.type !== "none" && !index.enabled) {
-    warnings.push(`index.type is "${index.type}" but index.enabled is false`);
+  return results;
+}
+function optionalPackageChecks(cwd, framework) {
+  const packages = framework !== void 0 ? OPTIONAL_PACKAGES[framework] : [
+    "@agent-inspect/ai-sdk",
+    "@agent-inspect/openai-agents",
+    "@agent-inspect/langchain",
+    "@agent-inspect/redact",
+    "@agent-inspect/eval"
+  ];
+  return packages.map((name) => {
+    const resolved = resolvePackage(cwd, name);
+    if (!resolved.ok) {
+      return {
+        id: `optional-package-${name}`,
+        status: framework !== void 0 ? "warn" : "skipped",
+        message: `${name} is not installed.`,
+        remediation: framework !== void 0 ? `npm install ${name}` : void 0
+      };
+    }
+    return {
+      id: `optional-package-${name}`,
+      status: "pass",
+      message: `${name} is available.`,
+      evidence: resolved.version
+    };
+  });
+}
+function versionMismatchCheck(cwd) {
+  const root = resolvePackage(cwd, "agent-inspect");
+  if (!root.ok || root.version === void 0) {
+    return {
+      id: "version-alignment",
+      status: "skipped",
+      message: "Skipped version alignment \u2014 agent-inspect not installed locally."
+    };
   }
-  if (errors.length > 0 || index === void 0) {
-    return { ok: false, errors, warnings };
+  if (root.version !== version) {
+    return {
+      id: "version-alignment",
+      status: "warn",
+      message: `CLI version ${version} differs from local agent-inspect@${root.version}.`,
+      remediation: "Align versions with npm install agent-inspect@latest",
+      evidence: `cli=${version};local=${root.version}`
+    };
   }
-  const manifest = {
-    schemaVersion: WORKSPACE_SCHEMA_VERSION,
-    project: input3.project.trim(),
-    createdAt: input3.createdAt,
-    traceDirs: input3.traceDirs.map((d) => d.trim()),
-    reportsDir: input3.reportsDir.trim(),
-    artifactsDir: input3.artifactsDir.trim(),
-    bundlesDir: input3.bundlesDir.trim(),
-    notesDir: input3.notesDir.trim(),
-    redactionProfile: input3.redactionProfile,
-    index
+  return {
+    id: "version-alignment",
+    status: "pass",
+    message: `CLI and local agent-inspect are aligned at ${version}.`
   };
-  return { ok: true, manifest, errors, warnings };
 }
-function parseWorkspaceManifest(json) {
-  const warnings = [];
-  if (typeof json !== "string") {
-    return { ok: false, errors: ["manifest input must be a string"], warnings };
+async function runDoctorChecks(options = {}) {
+  const cwd = path13.resolve(options.cwd ?? process2.cwd());
+  const traceDir = options.traceDir?.trim() || process2.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
+  const checks2 = [
+    nodeVersionCheck(),
+    {
+      id: "cli-version",
+      status: "pass",
+      message: `agent-inspect CLI ${version}`,
+      evidence: version
+    },
+    await traceDirWritable(traceDir),
+    envCheck("AGENT_INSPECT"),
+    envCheck("AGENT_INSPECT_TRACE_DIR"),
+    versionMismatchCheck(cwd)
+  ];
+  if (options.checkImports !== false) {
+    checks2.push(...importSmoke(cwd));
   }
-  if (json.length > MAX_WORKSPACE_MANIFEST_BYTES) {
-    return {
-      ok: false,
-      errors: [
-        `manifest exceeds maximum size of ${MAX_WORKSPACE_MANIFEST_BYTES} bytes`
-      ],
-      warnings
-    };
+  checks2.push(...optionalPackageChecks(cwd, options.framework));
+  return checks2.sort((a, b) => a.id.localeCompare(b.id));
+}
+async function doctorCommand(options = {}) {
+  const checks2 = await runDoctorChecks(options);
+  const failed = checks2.filter((check) => check.status === "fail").length;
+  const warned = checks2.filter((check) => check.status === "warn").length;
+  if (options.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: failed === 0,
+          version,
+          summary: { pass: checks2.filter((c) => c.status === "pass").length, warn: warned, fail: failed },
+          checks: checks2
+        },
+        null,
+        2
+      )
+    );
+    if (failed > 0) process2.exitCode = 1;
+    return;
   }
-  let parsed;
-  try {
-    parsed = JSON.parse(json);
-  } catch {
-    return { ok: false, errors: ["manifest is not valid JSON"], warnings };
+  console.log("AgentInspect doctor");
+  for (const check of checks2) {
+    const tag = check.status.toUpperCase();
+    console.log(`[${tag}] ${check.id}: ${check.message}`);
+    if (check.remediation) console.log(`  \u2192 ${check.remediation}`);
   }
-  return validateWorkspaceManifest(parsed);
-}
-function serializeWorkspaceManifest(manifest) {
-  return `${JSON.stringify(manifest, null, 2)}
-`;
+  console.log(`
+Summary: ${failed} failed, ${warned} warnings`);
+  if (failed > 0) process2.exitCode = 1;
 }
-var INDEX_DIR_NAME = "index";
-function resolveWorkspaceLocation(cwd = process.cwd()) {
-  const projectRoot = path11.resolve(cwd);
-  const workspaceDir = path11.join(projectRoot, WORKSPACE_DIR_NAME);
-  return {
-    projectRoot,
-    workspaceDir,
-    manifestPath: path11.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
-  };
+
+// packages/adapter-sdk/src/indexer.ts
+function defineIndexer(indexer) {
+  if (!indexer.id.trim()) throw new Error("indexer id is required");
+  return indexer;
 }
-function resolveInsideWorkspace(workspaceDir, relative) {
-  const base = path11.resolve(workspaceDir);
-  const resolved = path11.resolve(base, relative);
-  const rel = path11.relative(base, resolved);
-  if (rel === "" || rel === "." || !rel.startsWith("..") && !path11.isAbsolute(rel)) {
-    return resolved;
+async function indexIsStale(snapshot, traceDir) {
+  const builtMs = Date.parse(snapshot.builtAt);
+  if (Number.isNaN(builtMs)) return true;
+  const td = new TraceDirectory({ dir: traceDir });
+  const files = await td.list();
+  for (const file of files) {
+    const stats = await td.getFileStats(file);
+    if (stats.mtimeMs > builtMs) return true;
   }
-  throw new Error(
-    `Workspace path "${relative}" resolves outside the workspace directory`
-  );
+  return false;
 }
-async function pathExists(p) {
-  try {
-    await access(p);
-    return true;
-  } catch {
-    return false;
+function createTraceDirectoryIndexer() {
+  return defineIndexer({
+    id: "trace-directory-metadata",
+    async rebuild(traceDir, options = {}) {
+      const warnings = [];
+      const td = new TraceDirectory({ dir: traceDir });
+      const files = await td.list();
+      const maxEntries = options.maxEntries ?? 1e4;
+      if (files.length > maxEntries) {
+        warnings.push(
+          `indexer.truncated: trace directory has ${files.length} files; indexing first ${maxEntries}`
+        );
+      }
+      const slice = files.slice(0, maxEntries);
+      const metas = await loadTraceMetadataList(
+        traceDir,
+        slice,
+        (fileName) => td.getPath(fileName)
+      );
+      const entries = metas.map((meta) => ({
+        runId: meta.runId,
+        path: meta.filePath,
+        name: meta.name,
+        startedAt: meta.startedAt,
+        status: meta.status
+      })).sort((a, b) => a.runId.localeCompare(b.runId));
+      if (entries.length < slice.length) {
+        warnings.push(
+          `indexer.partial: indexed ${entries.length} of ${slice.length} trace files`
+        );
+      }
+      return {
+        traceDir,
+        builtAt: (/* @__PURE__ */ new Date()).toISOString(),
+        entries,
+        warnings
+      };
+    }
+  });
+}
+
+// packages/cli/src/index-cmd.ts
+var INDEX_FILENAME = ".agent-inspect-index.json";
+function traceIndexPath(traceDir) {
+  return path13.join(traceDir, INDEX_FILENAME);
+}
+function parseMaxEntries(raw) {
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error("--max-entries must be a positive integer.");
   }
+  return parsed;
 }
-async function isWritable(p) {
+async function readSnapshot(indexPath2) {
   try {
-    await access(p, constants$1.W_OK);
-    return true;
+    const raw = await readFile(indexPath2, "utf8");
+    return JSON.parse(raw);
   } catch {
-    return false;
+    return void 0;
   }
 }
-async function listJsonl(dir) {
+async function indexBuildCommand(options = {}) {
   try {
-    const entries = await readdir(dir);
-    return entries.filter((f) => f.endsWith(".jsonl"));
-  } catch {
-    return [];
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    await mkdir(traceDir, { recursive: true });
+    const indexer = createTraceDirectoryIndexer();
+    const snapshot = await indexer.rebuild(traceDir, {
+      maxEntries: parseMaxEntries(options.maxEntries)
+    });
+    const indexPath2 = traceIndexPath(traceDir);
+    await writeFile(indexPath2, `${JSON.stringify(snapshot, null, 2)}
+`, "utf8");
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true, indexPath: indexPath2, ...snapshot }, null, 2));
+      return;
+    }
+    console.log(`Built trace index: ${indexPath2}`);
+    console.log(`Entries: ${snapshot.entries.length}`);
+    if (snapshot.warnings.length > 0) {
+      for (const warning of snapshot.warnings) {
+        console.log(`warning: ${warning}`);
+      }
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index build failed: ${msg}`);
+    process.exitCode = 1;
   }
 }
-async function countFiles(dir) {
+async function indexStatusCommand(options = {}) {
   try {
-    const entries = await readdir(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isFile()).length;
-  } catch {
-    return 0;
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const indexPath2 = traceIndexPath(traceDir);
+    const snapshot = await readSnapshot(indexPath2);
+    if (!snapshot) {
+      const payload2 = { ok: true, exists: false, indexPath: indexPath2, traceDir, stale: true };
+      if (options.json) {
+        console.log(JSON.stringify(payload2, null, 2));
+      } else {
+        console.log(`No index at ${indexPath2}`);
+        console.log("Run: agent-inspect index build");
+      }
+      return;
+    }
+    const stale = await indexIsStale(snapshot, traceDir);
+    const payload = {
+      ok: true,
+      exists: true,
+      indexPath: indexPath2,
+      traceDir,
+      stale,
+      builtAt: snapshot.builtAt,
+      entries: snapshot.entries.length,
+      warnings: snapshot.warnings
+    };
+    if (options.json) {
+      console.log(JSON.stringify(payload, null, 2));
+      return;
+    }
+    console.log(`Index: ${indexPath2}`);
+    console.log(`Built: ${snapshot.builtAt}`);
+    console.log(`Entries: ${snapshot.entries.length}`);
+    console.log(`Stale: ${stale ? "yes" : "no"}`);
+    if (snapshot.warnings.length > 0) {
+      for (const warning of snapshot.warnings) {
+        console.log(`warning: ${warning}`);
+      }
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index status failed: ${msg}`);
+    process.exitCode = 1;
   }
 }
-async function readWorkspaceManifestFile(location) {
-  let raw;
+async function indexCleanCommand(options = {}) {
   try {
-    raw = await readFile(location.manifestPath, "utf-8");
-  } catch {
-    return { exists: false, ok: false, errors: ["workspace.json not found"], warnings: [] };
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const indexPath2 = traceIndexPath(traceDir);
+    await rm(indexPath2, { force: true });
+    if (options.json) {
+      console.log(JSON.stringify({ ok: true, removed: indexPath2 }, null, 2));
+      return;
+    }
+    console.log(`Removed index: ${indexPath2}`);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] index clean failed: ${msg}`);
+    process.exitCode = 1;
   }
-  const parsed = parseWorkspaceManifest(raw);
-  return {
-    exists: true,
-    ok: parsed.ok,
-    ...parsed.manifest ? { manifest: parsed.manifest } : {},
-    errors: parsed.errors,
-    warnings: parsed.warnings
-  };
 }
-async function createWorkspace(options = {}) {
-  const location = resolveWorkspaceLocation(options.cwd);
-  const dryRun = options.dryRun === true;
-  const existing = await readWorkspaceManifestFile(location);
-  const topLevelTraces = await listJsonl(location.workspaceDir);
-  const detectedExistingTraces = topLevelTraces.length > 0;
-  let manifest;
-  let created;
-  let adopted;
-  if (existing.exists && existing.ok && existing.manifest) {
-    manifest = existing.manifest;
-    created = false;
-    adopted = true;
-  } else {
-    const project = options.project?.trim() || path11.basename(location.projectRoot) || "workspace";
-    const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
-    manifest = createDefaultWorkspaceManifest({
-      project,
-      traceDirs,
-      ...options.redactionProfile ? { redactionProfile: options.redactionProfile } : {}
-    });
-    created = true;
-    adopted = detectedExistingTraces || existing.exists && !existing.ok;
-  }
-  const relDirs = uniqueDirs([
-    ...manifest.traceDirs.filter((d) => d !== "."),
-    manifest.reportsDir,
-    manifest.artifactsDir,
-    manifest.bundlesDir,
-    manifest.notesDir,
-    INDEX_DIR_NAME
-  ]);
-  const createdDirs = [];
-  for (const rel of relDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    if (await pathExists(abs)) continue;
-    createdDirs.push(rel);
-    if (!dryRun) await mkdir(abs, { recursive: true });
-  }
-  if (!dryRun && created) {
-    await mkdir(location.workspaceDir, { recursive: true });
-    await writeFile(location.manifestPath, serializeWorkspaceManifest(manifest), "utf-8");
-  }
-  return {
-    location,
-    manifest,
-    created,
-    adopted,
-    createdDirs,
-    detectedExistingTraces,
-    dryRun
-  };
+var PACKAGE = "@agent-inspect/index-sqlite";
+function isModuleNotFound3(e) {
+  return e !== null && typeof e === "object" && "code" in e && (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND");
 }
-function uniqueDirs(dirs) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const d of dirs) {
-    const t = d.trim();
-    if (t === "" || t === "." || seen.has(t)) continue;
-    seen.add(t);
-    out.push(t);
+async function loadIndexSqlite() {
+  try {
+    return await import('./src-FJOHPC4X.mjs');
+  } catch (e) {
+    if (isModuleNotFound3(e)) {
+      console.error(
+        `The optional SQLite index is not installed. Run: npm install ${PACKAGE}`
+      );
+      process.exitCode = 1;
+      return null;
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`[AgentInspect] failed to load ${PACKAGE}: ${msg}`);
+    process.exitCode = 1;
+    return null;
   }
-  return out;
 }
-async function getWorkspaceStatus(location, manifest) {
-  let traceFiles = 0;
-  for (const rel of manifest.traceDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    traceFiles += (await listJsonl(abs)).length;
+function parsePositiveInt(raw, flag) {
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${flag} must be a positive integer.`);
   }
-  const reports = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.reportsDir)
-  );
-  const artifacts = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.artifactsDir)
-  );
-  const bundles = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.bundlesDir)
-  );
-  const notes = await countFiles(
-    resolveInsideWorkspace(location.workspaceDir, manifest.notesDir)
-  );
-  const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
-  return {
-    project: manifest.project,
-    traceFiles,
-    reports,
-    artifacts,
-    bundles,
-    notes,
-    index: {
-      enabled: manifest.index.enabled,
-      type: manifest.index.type,
-      exists: await pathExists(indexPath2)
+  return parsed;
+}
+async function newestTraceMtimeMs2(traceDir) {
+  let newest = 0;
+  try {
+    const files = await readdir(traceDir);
+    for (const file of files) {
+      if (!file.endsWith(".jsonl")) continue;
+      try {
+        const s = await stat(path13.join(traceDir, file));
+        if (s.mtimeMs > newest) newest = s.mtimeMs;
+      } catch {
+      }
     }
-  };
+  } catch {
+  }
+  return newest;
 }
-async function doctorWorkspace(location) {
-  const checks2 = [];
-  const manifestResult = await readWorkspaceManifestFile(location);
-  if (!manifestResult.exists) {
-    checks2.push({
-      id: "manifest",
-      status: "fail",
-      message: "workspace.json not found (run `agent-inspect workspace init`)"
-    });
-    return { ok: false, checks: checks2 };
+async function indexSqliteBuildCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const result = await mod.buildIndex({
+    traceDir: options.dir,
+    maxRuns: parsePositiveInt(options.maxRuns, "--max-runs")
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, ...result }, null, 2));
+    return;
   }
-  if (!manifestResult.ok || !manifestResult.manifest) {
-    checks2.push({
-      id: "manifest",
-      status: "fail",
-      message: `workspace.json is invalid: ${manifestResult.errors.join("; ")}`
-    });
-    return { ok: false, checks: checks2 };
+  console.log(`Built SQLite index: ${result.dbPath}`);
+  console.log(`Runs: ${result.runs}  Steps: ${result.steps}  Errors: ${result.errors}`);
+  for (const warning of result.warnings) console.log(`warning: ${warning}`);
+}
+async function indexSqliteStatusCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  const status = mod.indexStatus(dbPath);
+  const stale = mod.isIndexStale(dbPath, await newestTraceMtimeMs2(traceDir));
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, traceDir, stale, ...status }, null, 2));
+    return;
   }
-  const manifest = manifestResult.manifest;
-  checks2.push({ id: "manifest", status: "pass", message: "workspace.json is valid" });
-  for (const warning of manifestResult.warnings) {
-    checks2.push({ id: "manifest-warning", status: "warn", message: warning });
+  if (!status.exists) {
+    console.log(`No SQLite index at ${dbPath}`);
+    console.log("Run: agent-inspect index sqlite build");
+    return;
   }
-  const dirFields = [
-    ...manifest.traceDirs.filter((d) => d !== ".").map((d, i) => [`traceDir[${i}]`, d]),
-    ["reportsDir", manifest.reportsDir],
-    ["artifactsDir", manifest.artifactsDir],
-    ["bundlesDir", manifest.bundlesDir],
-    ["notesDir", manifest.notesDir]
-  ];
-  for (const [id, rel] of dirFields) {
-    let abs;
-    try {
-      abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    } catch (error) {
-      checks2.push({
-        id,
-        status: "fail",
-        message: error instanceof Error ? error.message : String(error)
-      });
-      continue;
-    }
-    if (!await pathExists(abs)) {
-      checks2.push({ id, status: "warn", message: `${rel}/ does not exist yet` });
-    } else if (!await isWritable(abs)) {
-      checks2.push({ id, status: "fail", message: `${rel}/ is not writable` });
+  console.log(`Index: ${status.dbPath}`);
+  console.log(`Healthy: ${status.healthy ? "yes" : "no"}`);
+  console.log(`Built: ${status.builtAt ?? "unknown"}`);
+  console.log(`Runs: ${status.runs}  Steps: ${status.steps}`);
+  console.log(`Stale: ${stale ? "yes" : "no"}`);
+}
+async function indexSqliteQueryCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  const status = mod.indexStatus(dbPath);
+  if (!status.exists || !status.healthy) {
+    if (options.json) {
+      console.log(JSON.stringify({ ok: false, reason: "index-missing", dbPath }, null, 2));
     } else {
-      checks2.push({ id, status: "pass", message: `${rel}/ is present and writable` });
+      console.log("No usable SQLite index. Run: agent-inspect index sqlite build");
     }
+    process.exitCode = 1;
+    return;
   }
-  let newestTraceMtime = 0;
-  for (const rel of manifest.traceDirs) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    for (const file of await listJsonl(abs)) {
-      try {
-        const s = await stat(path11.join(abs, file));
-        newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
-      } catch {
-        checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
-      }
-    }
+  const rows = mod.queryRuns(dbPath, {
+    status: options.status,
+    sessionId: options.session,
+    name: options.name,
+    kind: options.kind,
+    tool: options.tool,
+    limit: parsePositiveInt(options.limit, "--limit")
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, count: rows.length, runs: rows }, null, 2));
+    return;
   }
-  if (manifest.index.enabled) {
-    const indexPath2 = manifest.index.path ? resolveInsideWorkspace(location.workspaceDir, manifest.index.path) : resolveInsideWorkspace(location.workspaceDir, INDEX_DIR_NAME);
-    if (!await pathExists(indexPath2)) {
-      checks2.push({ id: "index", status: "warn", message: "index enabled but not built" });
-    } else {
-      try {
-        const s = await stat(indexPath2);
-        if (newestTraceMtime > s.mtimeMs) {
-          checks2.push({ id: "index", status: "warn", message: "index is stale (traces are newer)" });
-        } else {
-          checks2.push({ id: "index", status: "pass", message: "index is present" });
-        }
-      } catch {
-        checks2.push({ id: "index", status: "warn", message: "cannot stat index" });
-      }
-    }
+  if (rows.length === 0) {
+    console.log("No matching runs.");
+    return;
+  }
+  for (const run of rows) {
+    const parts = [
+      run.runId,
+      run.status ?? "unknown",
+      run.name ?? "",
+      run.durationMs != null ? `${run.durationMs}ms` : ""
+    ].filter((p) => p !== "");
+    console.log(parts.join("  "));
   }
-  const ok = !checks2.some((c) => c.status === "fail");
-  return { ok, checks: checks2 };
 }
-async function cleanWorkspace(location, manifest, options = {}) {
-  const dryRun = options.confirm !== true;
-  const targets = uniqueDirs([
-    manifest.reportsDir,
-    manifest.artifactsDir,
-    manifest.bundlesDir,
-    manifest.index.path ?? INDEX_DIR_NAME
-  ]);
-  const removed = [];
-  for (const rel of targets) {
-    const abs = resolveInsideWorkspace(location.workspaceDir, rel);
-    let entries;
-    try {
-      entries = await readdir(abs);
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const relPath = `${rel}/${entry}`;
-      removed.push(relPath);
-      if (!dryRun) {
-        await rm(path11.join(abs, entry), { recursive: true, force: true });
-      }
-    }
+async function indexSqliteCleanCommand(options = {}) {
+  const mod = await loadIndexSqlite();
+  if (!mod) return;
+  const traceDir = resolveTraceDir({ dir: options.dir });
+  const dbPath = mod.resolveIndexDbPath(traceDir);
+  await mod.cleanIndex(dbPath);
+  if (options.json) {
+    console.log(JSON.stringify({ ok: true, removed: dbPath }, null, 2));
+    return;
   }
-  return { dryRun, removed };
+  console.log(`Removed SQLite index: ${dbPath}`);
 }
 
 // packages/cli/src/workspace.ts
@@ -13143,7 +13657,10 @@ function createCliProgram() {
   ]).option("--max-total-tokens <number>", "add llm.usage with a max total-token budget").option(
     "--max-step-duration <duration>",
     "add run.maxStepDuration (e.g. 30s, 5m)"
-  ).option("--require-completed", "add run.requireCompleted").option("--detect-stalls", "add run.stall for running or incomplete events").option("--session <id>", "check all runs in a workflow session (requires --dir)").option("--group <id>", "check all runs sharing a groupId (requires --dir)").option(
+  ).option("--require-completed", "add run.requireCompleted").option("--detect-stalls", "add run.stall for running or incomplete events").option(
+    "--fail-on-observation <status>",
+    "fail when observed outcomes match status (passed, failed, unknown, skipped; comma-separated)"
+  ).option("--session <id>", "check all runs in a workflow session (requires --dir)").option("--group <id>", "check all runs sharing a groupId (requires --dir)").option(
     "--correlate-group",
     "when using --session, also match synthetic group: session keys"
   ).option(
@@ -13217,6 +13734,11 @@ function createCliProgram() {
   ).option("--run <run-id>", "select a run when the trace contains multiple runs").option("--baseline <trace-path-or-run-id>", "optional baseline trace for diff artifacts").option("--baseline-run <run-id>", "select a run from the baseline trace").option("--github-summary <path>", "append a safe summary to this file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON manifest").action((target, opts) => {
     runCommand(() => artifactsCommand(target, opts));
   });
+  program.command("bundle").description("Create a share-safe offline trace bundle (local folder)").argument("[run-id]", "run id to bundle (optional with --session or --since)").option("--dir <path>", "trace directory for run/session lookup").option("--session <session-id>", "bundle all runs in a session").option("--since <duration>", "bundle runs with activity since a duration (e.g. 24h)").addOption(
+    new Option("--profile <profile>", "redaction profile for exported copies").choices(["local", "share", "strict"]).default("share")
+  ).option("--out <path>", "output directory (folder; .zip suffix is stripped)").option("--allow-unsafe", "write bundle even when verify-safe reports UNSAFE").option("--json", "print deterministic JSON manifest").action((runId, opts) => {
+    runCommand(() => bundleCommand(runId, opts));
+  });
   program.command("ci-summary").description("Summarize local reporter artifact manifests for CI").argument("<manifest...>", "reporter artifact manifest JSON files").option("-o, --output <path>", "write Markdown summary to a local file").option("--github-summary <path>", "append Markdown summary to this local file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON summary").action((manifest, opts) => {
     runCommand(() => ciSummaryCommand(manifest, opts));
   });
@@ -13259,6 +13781,9 @@ function createCliProgram() {
       "unknown"
     ])
   ).option("--kind <kind>", "filter by step kind/type (llm, tool, logic, \u2026)").option("--type <type>", "alias for --kind on manual trace step type").option("--name <query>", "substring match on run or step name").option("--tool <query>", "substring match on tool step name or metadata.toolName").option(
+    "--observation <status>",
+    "filter by observed outcome status (passed, failed, unknown, skipped)"
+  ).option(
     "--duration <expr>",
     "duration filter on run or step (e.g. >5s, >=500ms)"
   ).option("--limit <number>", "max results (default 50)").option("--session <id>", "limit search to one workflow session").option(
@@ -13305,6 +13830,14 @@ function createCliProgram() {
       "html"
     ])
   ).option("-o, --output <path>", "write report to file (creates parent dirs)").option("--json", "emit JSON wrapper (includes content when writing to stdout)").option("--include-attributes", "include bounded step attributes in tree section").option("--no-errors", "omit error details from tree section").option("--no-correlation", "omit correlation metadata from what section").addOption(
+    new Option("--section <section>", "report section (default: all)").choices([
+      "all",
+      "observations",
+      "what",
+      "timeline",
+      "tree"
+    ])
+  ).addOption(
     new Option(
       "--redaction-profile <profile>",
       "redaction profile for entire report: local, share, strict (default: local)"
@@ -13421,9 +13954,9 @@ function isPrimaryModule() {
   if (!entry) return false;
   const selfPath = fileURLToPath(import.meta.url);
   try {
-    return realpathSync(path11.resolve(entry)) === realpathSync(path11.resolve(selfPath));
+    return realpathSync(path13.resolve(entry)) === realpathSync(path13.resolve(selfPath));
   } catch {
-    return path11.resolve(entry) === path11.resolve(selfPath);
+    return path13.resolve(entry) === path13.resolve(selfPath);
   }
 }
 if (isPrimaryModule()) {