agent-inspect 5.0.0 → 5.2.0

package/packages/cli/dist/index.cjs

@@ -4,7 +4,7 @@
 var crypto = require('crypto');
 var promises = require('fs/promises');
 var os = require('os');
-var path23 = require('path');
+var path24 = require('path');
 var async_hooks = require('async_hooks');
 var process3 = require('process');
 var tty = require('tty');
@@ -20,7 +20,7 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var os__default = /*#__PURE__*/_interopDefault(os);
-var path23__default = /*#__PURE__*/_interopDefault(path23);
+var path24__default = /*#__PURE__*/_interopDefault(path24);
 var process3__default = /*#__PURE__*/_interopDefault(process3);
 var tty__default = /*#__PURE__*/_interopDefault(tty);
 
@@ -893,7 +893,7 @@ function getDefaultTraceDir() {
     if (typeof home !== "string" || home.trim() === "") {
       return FALLBACK_TRACE_DIR;
     }
-    return path23__default.default.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
+    return path24__default.default.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
   } catch {
     return FALLBACK_TRACE_DIR;
   }
@@ -901,11 +901,11 @@ function getDefaultTraceDir() {
 function getTraceFilePath(runId, traceDir) {
   const baseDir = traceDir ?? getDefaultTraceDir();
   let safeId = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
-  safeId = path23__default.default.basename(safeId);
+  safeId = path24__default.default.basename(safeId);
   if (safeId === "" || safeId === "." || safeId === "..") {
     safeId = "run_unknown";
   }
-  return path23__default.default.join(baseDir, `${safeId}.jsonl`);
+  return path24__default.default.join(baseDir, `${safeId}.jsonl`);
 }
 function formatError(error) {
   if (error instanceof Error) {
@@ -962,7 +962,7 @@ var init_utils = __esm({
     init_duration();
     DEFAULT_TRACE_DIR_NAME = ".agent-inspect";
     RUNS_DIR_NAME = "runs";
-    FALLBACK_TRACE_DIR = path23__default.default.join(
+    FALLBACK_TRACE_DIR = path24__default.default.join(
       os__default.default.tmpdir(),
       "agent-inspect",
       RUNS_DIR_NAME
@@ -1928,7 +1928,7 @@ var init_trace_directory = __esm({
         this.#dir = resolveTraceDir(options);
       }
       getPath(filename) {
-        return filename ? path23__default.default.join(this.#dir, filename) : this.#dir;
+        return filename ? path24__default.default.join(this.#dir, filename) : this.#dir;
       }
       async list() {
         try {
@@ -1957,7 +1957,7 @@ function parseIsoToMs2(value) {
 }
 async function extractMetadata(filePath, _quickScan) {
   const stats = await promises.stat(filePath);
-  let runIdFromFile = path23__default.default.basename(filePath);
+  let runIdFromFile = path24__default.default.basename(filePath);
   if (runIdFromFile.endsWith(".jsonl")) {
     runIdFromFile = runIdFromFile.slice(0, -".jsonl".length);
   }
@@ -2100,7 +2100,7 @@ function buildRunSummary(events) {
   }
   let totalSteps = 0;
   let llmSteps = 0;
-  let toolSteps = 0;
+  let toolSteps2 = 0;
   let logicSteps = 0;
   let errorSteps = 0;
   let maxDepth = 0;
@@ -2130,7 +2130,7 @@ function buildRunSummary(events) {
   for (const [id, s] of steps.entries()) {
     totalSteps += 1;
     if (s.type === "llm") llmSteps += 1;
-    else if (s.type === "tool") toolSteps += 1;
+    else if (s.type === "tool") toolSteps2 += 1;
     else logicSteps += 1;
     if (s.status === "error") errorSteps += 1;
     const depth = computeDepth(id);
@@ -2164,7 +2164,7 @@ function buildRunSummary(events) {
     durationMs: durationMs2,
     totalSteps,
     llmSteps,
-    toolSteps,
+    toolSteps: toolSteps2,
     logicSteps,
     errorSteps,
     maxDepth,
@@ -2942,9 +2942,9 @@ async function searchTraces(metas, options) {
   }
   const limit = options.limit ?? 50;
   const sessionId = options.session?.trim();
-  const observationStatus = parseObservationFilter(options.observation);
+  const observationStatus2 = parseObservationFilter(options.observation);
   const hasContentFilter = Boolean(
-    options.status || stepTypeFilter || nameQuery || toolQuery || durationFilter || observationStatus
+    options.status || stepTypeFilter || nameQuery || toolQuery || durationFilter || observationStatus2
   );
   const results = [];
   const sessionLabel = sessionId && sessionId !== "" ? sessionId : void 0;
@@ -2989,9 +2989,9 @@ async function searchTraces(metas, options) {
       statusFilter: options.status
     });
     results.push(...stepMatches);
-    if (observationStatus) {
+    if (observationStatus2) {
       const outcomes = extractOutcomesFromTraceEvents(events);
-      const matched = outcomes.filter((outcome) => outcome.status === observationStatus);
+      const matched = outcomes.filter((outcome) => outcome.status === observationStatus2);
       for (const outcome of matched) {
         results.push({
           runId: m.runId,
@@ -3786,12 +3786,12 @@ function buildCriticalPath(runs, handoffs) {
     handoffs.filter((edge) => edge.confidence === "explicit").map((edge) => edge.from)
   );
   const ordered = [...runs].sort(compareRuns);
-  const path30 = [];
+  const path33 = [];
   const visited = /* @__PURE__ */ new Set();
   const pushRun = (run, confidence, source) => {
     if (visited.has(run.runId)) return;
     visited.add(run.runId);
-    path30.push({
+    path33.push({
       runId: run.runId,
       name: run.name,
       startedAt: run.startedAt,
@@ -3816,7 +3816,7 @@ function buildCriticalPath(runs, handoffs) {
     const confidence = explicitTargets.has(run.runId) || explicitSources.has(run.runId) ? "explicit" : "correlated";
     pushRun(run, confidence, confidence === "explicit" ? "manual" : "inferred");
   }
-  return path30;
+  return path33;
 }
 function metaRunIdMatches(run, token, runById) {
   const meta2 = extractSessionWorkflowMetadata(run.metadata);
@@ -4147,7 +4147,7 @@ function normalizeBundleOutputPath(out) {
   if (trimmed === "") {
     throw new Error("--out requires a non-empty path.");
   }
-  const resolved = path23__default.default.resolve(trimmed);
+  const resolved = path24__default.default.resolve(trimmed);
   if (resolved.toLowerCase().endsWith(".zip")) {
     return resolved.slice(0, -4);
   }
@@ -4156,7 +4156,7 @@ function normalizeBundleOutputPath(out) {
 function defaultBundleOutputPath(runIds) {
   const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  return path23__default.default.resolve(`agent-inspect-bundle-${label}-${stamp}`);
+  return path24__default.default.resolve(`agent-inspect-bundle-${label}-${stamp}`);
 }
 var init_paths = __esm({
   "packages/core/src/bundle/paths.ts"() {
@@ -4330,7 +4330,7 @@ function normalizeSuiteConfig(value) {
 }
 async function validateSuiteConfig(config, options) {
   const diagnostics = [];
-  const tracesDir = path23__default.default.resolve(options.configDir, config.traces);
+  const tracesDir = path24__default.default.resolve(options.configDir, config.traces);
   try {
     await promises.access(tracesDir);
   } catch {
@@ -4340,7 +4340,7 @@ async function validateSuiteConfig(config, options) {
   }
   for (const suiteCase of config.cases) {
     if (suiteCase.input !== void 0) {
-      const inputPath = path23__default.default.resolve(options.configDir, suiteCase.input);
+      const inputPath = path24__default.default.resolve(options.configDir, suiteCase.input);
       try {
         await promises.access(inputPath);
       } catch {
@@ -4373,12 +4373,12 @@ async function fileExists(filePath) {
   }
 }
 async function resolveSuiteConfigPath(options = {}) {
-  const cwd = path23__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path24__default.default.resolve(options.cwd ?? process.cwd());
   if (options.configPath !== void 0 && options.configPath.trim() !== "") {
-    return path23__default.default.resolve(cwd, options.configPath.trim());
+    return path24__default.default.resolve(cwd, options.configPath.trim());
   }
   for (const name of DEFAULT_SUITE_CONFIG_NAMES) {
-    const candidate = path23__default.default.join(cwd, name);
+    const candidate = path24__default.default.join(cwd, name);
     if (await fileExists(candidate)) return candidate;
   }
   throw new Error(
@@ -4395,7 +4395,7 @@ async function loadSuiteConfig(options = {}) {
       diagnostics: [diagnostic2("AI_SUITE_CONFIG_LOAD_FAILED", message)]
     });
   }
-  const extension = path23__default.default.extname(configPath);
+  const extension = path24__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
     const message = "TypeScript suite configs require an explicit precompiled JavaScript config or future --config-loader support.";
     throw Object.assign(new Error(message), {
@@ -4420,7 +4420,7 @@ async function loadSuiteConfig(options = {}) {
     return {
       config,
       configPath,
-      configDir: path23__default.default.dirname(configPath)
+      configDir: path24__default.default.dirname(configPath)
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -4470,7 +4470,7 @@ async function exists(filePath) {
 }
 async function resolveSuiteCaseTrace(suiteCase, options) {
   if (suiteCase.trace !== void 0) {
-    const tracePath = path23__default.default.resolve(options.configDir, suiteCase.trace);
+    const tracePath = path24__default.default.resolve(options.configDir, suiteCase.trace);
     if (await exists(tracePath)) {
       return { caseId: suiteCase.id, tracePath, missing: false };
     }
@@ -4486,7 +4486,7 @@ async function resolveSuiteCaseTrace(suiteCase, options) {
   if (await exists(directPath)) {
     return { caseId: suiteCase.id, tracePath: directPath, runId: runKey, missing: false };
   }
-  const nestedPath = path23__default.default.join(options.tracesDir, `${path23__default.default.basename(runKey)}.jsonl`);
+  const nestedPath = path24__default.default.join(options.tracesDir, `${path24__default.default.basename(runKey)}.jsonl`);
   if (await exists(nestedPath)) {
     return { caseId: suiteCase.id, tracePath: nestedPath, runId: runKey, missing: false };
   }
@@ -4716,7 +4716,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path30) {
+function eventEvidence(event, path33) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -4726,7 +4726,7 @@ function eventEvidence(event, path30) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path30 ? { path: path30 } : {}
+    ...path33 ? { path: path33 } : {}
   };
 }
 function runEvidence(run) {
@@ -4789,9 +4789,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path30) {
-  const parts = path30.split(".");
-  return parts[parts.length - 1] ?? path30;
+function lastPathSegment(path33) {
+  const parts = path33.split(".");
+  return parts[parts.length - 1] ?? path33;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -4805,12 +4805,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path30, key, depth = 0) {
-  entries.push({ event, path: path30, key, value });
+function pushValueEntries(entries, event, value, path33, key, depth = 0) {
+  entries.push({ event, path: path33, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path30}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path33}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -4820,7 +4820,7 @@ function pushValueEntries(entries, event, value, path30, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path30}.${nestedKey}`,
+      `${path33}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -4901,9 +4901,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path30) => {
-    lines.push(`${path30}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path30}.${index}`));
+  const visit = (node, path33) => {
+    lines.push(`${path33}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path33}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -4952,9 +4952,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path30) {
+function firstEvidenceForKind(context, kind, path33) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path30)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path33)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -5304,13 +5304,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path30 = [];
+        const path33 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path30.slice(existing);
+            const cycle = path33.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -5326,8 +5326,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path30.length);
-          path30.push(current);
+          seenAt.set(current.eventId, path33.length);
+          path33.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -6468,7 +6468,7 @@ function findReaderByFormat(format, readers) {
 }
 async function jsonlFilesInDirectory(dirPath) {
   const entries = await promises.readdir(dirPath, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path23__default.default.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path24__default.default.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
 }
 async function resolveInput(input3) {
   const cached = resolvedInputCache.get(input3);
@@ -8167,7 +8167,7 @@ async function runSuiteCase(suiteCase, config, options) {
 async function runSuite(options = {}) {
   const startedAt = new Date(options.nowMs ?? Date.now()).toISOString();
   const { config, configPath, configDir } = await loadSuiteConfig(options);
-  const tracesDir = path23__default.default.resolve(configDir, config.traces);
+  const tracesDir = path24__default.default.resolve(configDir, config.traces);
   const cases = [];
   const diagnostics = [];
   for (const suiteCase of config.cases) {
@@ -8275,6 +8275,1102 @@ var init_suite = __esm({
   }
 });
 
+// packages/core/src/cohort/types.ts
+var COHORT_METRIC_IDS;
+var init_types5 = __esm({
+  "packages/core/src/cohort/types.ts"() {
+    COHORT_METRIC_IDS = [
+      "errorRate",
+      "duration",
+      "toolChoice",
+      "toolOrdering",
+      "llmCallCount",
+      "tokenUsage",
+      "retryCount",
+      "observationFailure",
+      "guardrailFailure",
+      "circuitViolation",
+      "redactionWarning"
+    ];
+  }
+});
+
+// packages/core/src/cohort/compare.ts
+function compareNumber(metric, label, baseline, candidate, higherIsWorse = true) {
+  if (baseline === void 0 && candidate === void 0) return void 0;
+  const delta = baseline !== void 0 && candidate !== void 0 ? candidate - baseline : void 0;
+  const regression = delta !== void 0 && (higherIsWorse && delta > 0 || !higherIsWorse && delta < 0);
+  return {
+    metric,
+    baseline,
+    candidate,
+    delta,
+    regression,
+    message: `${label}: baseline=${baseline ?? "n/a"} candidate=${candidate ?? "n/a"}${delta !== void 0 ? ` (delta ${delta})` : ""}`
+  };
+}
+function pickAggregate(groups, cohortLabel, groupKey) {
+  return groups.find(
+    (group) => group.cohortLabel === cohortLabel && (groupKey === void 0 || group.groupKey === groupKey)
+  );
+}
+function compareCohortAggregates(groups, options) {
+  const baselineAgg = pickAggregate(groups, options.baseline, options.groupKey);
+  const candidateAgg = pickAggregate(groups, options.candidate, options.groupKey);
+  const comparisons = [];
+  for (const metric of options.metrics) {
+    switch (metric) {
+      case "errorRate": {
+        const item = compareNumber(
+          metric,
+          "Error rate",
+          baselineAgg?.errorRate,
+          candidateAgg?.errorRate
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+      case "duration": {
+        const item = compareNumber(
+          metric,
+          "Average duration (ms)",
+          baselineAgg?.avgDurationMs,
+          candidateAgg?.avgDurationMs
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+      case "llmCallCount": {
+        const item = compareNumber(
+          metric,
+          "Average LLM calls",
+          baselineAgg?.avgLlmCallCount,
+          candidateAgg?.avgLlmCallCount
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+      case "tokenUsage": {
+        const item = compareNumber(
+          metric,
+          "Average token usage",
+          baselineAgg?.avgTokenUsage,
+          candidateAgg?.avgTokenUsage
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+      case "retryCount": {
+        const item = compareNumber(
+          metric,
+          "Average retries",
+          baselineAgg?.avgRetryCount,
+          candidateAgg?.avgRetryCount
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+      case "observationFailure": {
+        const item = compareNumber(
+          metric,
+          "Observation failure rate",
+          baselineAgg?.observationFailureRate,
+          candidateAgg?.observationFailureRate
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+      case "toolChoice": {
+        const baselineValue = baselineAgg?.dominantToolChoice;
+        const candidateValue = candidateAgg?.dominantToolChoice;
+        comparisons.push({
+          metric,
+          baseline: baselineValue,
+          candidate: candidateValue,
+          delta: baselineValue === candidateValue ? "same" : "changed",
+          regression: baselineValue !== candidateValue,
+          message: `Tool choice: baseline=${baselineValue ?? "n/a"} candidate=${candidateValue ?? "n/a"}`
+        });
+        break;
+      }
+      case "toolOrdering": {
+        const baselineValue = baselineAgg?.toolOrderingSignature;
+        const candidateValue = candidateAgg?.toolOrderingSignature;
+        comparisons.push({
+          metric,
+          baseline: baselineValue,
+          candidate: candidateValue,
+          delta: baselineValue === candidateValue ? "same" : "changed",
+          regression: baselineValue !== candidateValue,
+          message: `Tool ordering: baseline=${baselineValue ?? "n/a"} candidate=${candidateValue ?? "n/a"}`
+        });
+        break;
+      }
+      case "guardrailFailure": {
+        const item = compareNumber(
+          metric,
+          "Guardrail failures",
+          baselineAgg?.avgGuardrailFailures,
+          candidateAgg?.avgGuardrailFailures
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+      case "circuitViolation": {
+        const item = compareNumber(
+          metric,
+          "Circuit violations",
+          baselineAgg?.avgCircuitViolations,
+          candidateAgg?.avgCircuitViolations
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+      case "redactionWarning": {
+        const item = compareNumber(
+          metric,
+          "Redaction warnings",
+          baselineAgg?.avgRedactionWarnings,
+          candidateAgg?.avgRedactionWarnings
+        );
+        if (item) comparisons.push(item);
+        break;
+      }
+    }
+  }
+  return comparisons;
+}
+var init_compare = __esm({
+  "packages/core/src/cohort/compare.ts"() {
+  }
+});
+
+// packages/core/src/cohort/grouping.ts
+function parseCohortMetricList(value) {
+  if (value === void 0 || value.trim() === "") return [];
+  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
+function parseGroupBySpec(groupBy) {
+  const raw = (groupBy ?? "model").trim();
+  if (raw === "model") return { kind: "model" };
+  if (raw === "session") return { kind: "session" };
+  if (raw === "group") return { kind: "group" };
+  if (raw.startsWith("metadata.")) {
+    const metadataKey = raw.slice("metadata.".length).trim();
+    if (metadataKey === "") throw new Error("metadata group-by requires a key.");
+    return { kind: "metadata", metadataKey };
+  }
+  throw new Error(`Unsupported --group-by value: ${raw}`);
+}
+function metadataString(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function resolveRunGroupKey(run, groupBy) {
+  const metadata = run.metadata ?? {};
+  switch (groupBy.kind) {
+    case "model":
+      return metadataString(metadata, "model") ?? "unknown";
+    case "session":
+      return extractSessionWorkflowMetadata(metadata)?.sessionId ?? metadataString(metadata, "sessionId") ?? "__unscoped__";
+    case "group":
+      return extractSessionWorkflowMetadata(metadata)?.groupId ?? metadataString(metadata, "groupId") ?? "__unscoped__";
+    case "metadata":
+      return metadataString(metadata, groupBy.metadataKey) ?? "__missing__";
+    default:
+      return "unknown";
+  }
+}
+function resolveCohortLabel(run, cohortKey, baseline, candidate) {
+  const label = metadataString(run.metadata, cohortKey);
+  if (label === void 0) return void 0;
+  if (baseline !== void 0 && label === baseline) return baseline;
+  if (candidate !== void 0 && label === candidate) return candidate;
+  if (baseline === void 0 && candidate === void 0) return label;
+  return void 0;
+}
+function filterRunsForCohort(runs, options) {
+  const warnings = [];
+  if (options.baseline === void 0 && options.candidate === void 0) {
+    return { runs: [...runs], warnings };
+  }
+  const selected = [];
+  for (const run of runs) {
+    const label = resolveCohortLabel(
+      run,
+      options.cohortKey,
+      options.baseline,
+      options.candidate
+    );
+    if (label !== void 0) selected.push(run);
+  }
+  if (selected.length === 0) {
+    warnings.push(
+      `No runs matched baseline/candidate labels on metadata.${options.cohortKey}.`
+    );
+  }
+  return { runs: selected, warnings };
+}
+var init_grouping = __esm({
+  "packages/core/src/cohort/grouping.ts"() {
+    init_metadata();
+  }
+});
+
+// packages/core/src/cohort/metrics.ts
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function toolSteps(events) {
+  const ordering = [];
+  const choices = /* @__PURE__ */ new Set();
+  const sorted = [...events].filter((event) => event.event === "step_started").sort((a, b) => a.timestamp - b.timestamp);
+  for (const event of sorted) {
+    const step = event;
+    if (step.type !== "tool") continue;
+    const name = typeof step.metadata?.toolName === "string" ? step.metadata.toolName : step.name;
+    ordering.push(name);
+    choices.add(name);
+  }
+  return { choices: [...choices].sort(), ordering };
+}
+async function computeCohortRunMetrics(input3) {
+  const events = await readTraceEventsFromFile(input3.filePath);
+  const summary = buildRunSummary(events);
+  const tools = toolSteps(events);
+  const outcomes = extractOutcomesFromTraceEvents(events);
+  const observationFailures = outcomes.filter((item) => item.status === "failed").length;
+  const metadata = input3.metadata ?? {};
+  const retryCount2 = asNumber(metadata.attempt) !== void 0 && asNumber(metadata.attempt) > 1 ? asNumber(metadata.attempt) - 1 : typeof metadata.retryOf === "string" ? 1 : 0;
+  return {
+    runId: input3.runId,
+    ...input3.cohortLabel !== void 0 ? { cohortLabel: input3.cohortLabel } : {},
+    groupKey: input3.groupKey,
+    status: summary.status,
+    error: summary.status === "error",
+    durationMs: summary.durationMs ?? input3.durationMs,
+    llmCallCount: summary.llmSteps,
+    tokenUsageTotal: summary.totalTokens?.total,
+    retryCount: retryCount2,
+    observationFailures,
+    guardrailFailures: asNumber(metadata.guardrailFailures) ?? 0,
+    circuitViolations: asNumber(metadata.circuitViolations) ?? 0,
+    redactionWarnings: asNumber(metadata.redactionWarnings) ?? 0,
+    toolChoices: tools.choices,
+    toolOrdering: tools.ordering
+  };
+}
+function percentile2(values, p) {
+  if (values.length === 0) return void 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const idx = Math.min(
+    sorted.length - 1,
+    Math.max(0, Math.ceil(p / 100 * sorted.length) - 1)
+  );
+  return sorted[idx];
+}
+function dominantToolChoice(runs) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const run of runs) {
+    const signature = run.toolChoices.join(",");
+    if (signature === "") continue;
+    counts.set(signature, (counts.get(signature) ?? 0) + 1);
+  }
+  let best;
+  let bestCount = 0;
+  for (const [key, count] of counts) {
+    if (count > bestCount) {
+      best = key;
+      bestCount = count;
+    }
+  }
+  return best;
+}
+function orderingSignature(runs) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const run of runs) {
+    const signature = run.toolOrdering.join(">");
+    if (signature === "") continue;
+    counts.set(signature, (counts.get(signature) ?? 0) + 1);
+  }
+  let best;
+  let bestCount = 0;
+  for (const [key, count] of counts) {
+    if (count > bestCount) {
+      best = key;
+      bestCount = count;
+    }
+  }
+  return best;
+}
+function aggregateCohortMetrics(runs, groupKey, cohortLabel) {
+  const durations = runs.map((run) => run.durationMs).filter((value) => typeof value === "number");
+  const tokenValues = runs.map((run) => run.tokenUsageTotal).filter((value) => typeof value === "number");
+  const errors = runs.filter((run) => run.error).length;
+  const observationFailures = runs.reduce((sum, run) => sum + run.observationFailures, 0);
+  return {
+    groupKey,
+    ...cohortLabel !== void 0 ? { cohortLabel } : {},
+    runCount: runs.length,
+    errorRate: runs.length > 0 ? errors / runs.length : 0,
+    avgDurationMs: durations.length > 0 ? durations.reduce((sum, value) => sum + value, 0) / durations.length : void 0,
+    p95DurationMs: percentile2(durations, 95),
+    avgLlmCallCount: runs.length > 0 ? runs.reduce((sum, run) => sum + run.llmCallCount, 0) / runs.length : 0,
+    avgTokenUsage: tokenValues.length > 0 ? tokenValues.reduce((sum, value) => sum + value, 0) / tokenValues.length : void 0,
+    avgRetryCount: runs.length > 0 ? runs.reduce((sum, run) => sum + run.retryCount, 0) / runs.length : 0,
+    observationFailureRate: runs.length > 0 ? observationFailures / runs.length : 0,
+    avgGuardrailFailures: runs.length > 0 ? runs.reduce((sum, run) => sum + run.guardrailFailures, 0) / runs.length : 0,
+    avgCircuitViolations: runs.length > 0 ? runs.reduce((sum, run) => sum + run.circuitViolations, 0) / runs.length : 0,
+    avgRedactionWarnings: runs.length > 0 ? runs.reduce((sum, run) => sum + run.redactionWarnings, 0) / runs.length : 0,
+    dominantToolChoice: dominantToolChoice(runs),
+    toolOrderingSignature: orderingSignature(runs)
+  };
+}
+var init_metrics = __esm({
+  "packages/core/src/cohort/metrics.ts"() {
+    init_extract();
+    init_trace_metadata();
+    init_storage();
+  }
+});
+
+// packages/core/src/cohort/analyze.ts
+function normalizeMetrics(metrics) {
+  if (metrics === void 0 || metrics.length === 0) return [...DEFAULT_METRICS];
+  const allowed = new Set(COHORT_METRIC_IDS);
+  return metrics.filter((metric) => allowed.has(metric));
+}
+async function analyzeCohort(runsInput, options) {
+  const cohortKey = options.cohortKey ?? "cohort";
+  const groupBySpec = parseGroupBySpec(options.groupBy);
+  const metrics = normalizeMetrics(options.metrics);
+  const { runs: filteredRuns, warnings } = filterRunsForCohort(runsInput, {
+    cohortKey,
+    baseline: options.baseline,
+    candidate: options.candidate
+  });
+  const runMetrics = [];
+  for (const run of filteredRuns) {
+    if (run.filePath === void 0) continue;
+    const cohortLabel = resolveCohortLabel(
+      run,
+      cohortKey,
+      options.baseline,
+      options.candidate
+    );
+    runMetrics.push(
+      await computeCohortRunMetrics({
+        runId: run.runId,
+        filePath: run.filePath,
+        metadata: run.metadata,
+        status: run.status,
+        durationMs: run.durationMs,
+        groupKey: resolveRunGroupKey(run, groupBySpec),
+        cohortLabel
+      })
+    );
+  }
+  const groupMap = /* @__PURE__ */ new Map();
+  for (const run of runMetrics) {
+    const key = `${run.cohortLabel ?? "*"}::${run.groupKey}`;
+    const bucket = groupMap.get(key) ?? [];
+    bucket.push(run);
+    groupMap.set(key, bucket);
+  }
+  const groups = [...groupMap.entries()].sort(([a], [b]) => a.localeCompare(b)).map(
+    ([, bucket]) => aggregateCohortMetrics(
+      bucket,
+      bucket[0].groupKey,
+      bucket[0]?.cohortLabel
+    )
+  );
+  const comparisons = options.baseline !== void 0 && options.candidate !== void 0 ? (() => {
+    const groupKeys = [
+      ...new Set(groups.map((group) => group.groupKey))
+    ].sort((a, b) => a.localeCompare(b));
+    const items = [];
+    for (const groupKey of groupKeys) {
+      items.push(
+        ...compareCohortAggregates(groups, {
+          baseline: options.baseline,
+          candidate: options.candidate,
+          metrics,
+          groupKey
+        })
+      );
+    }
+    return items;
+  })() : [];
+  const regression = comparisons.some((item) => item.regression);
+  return {
+    ok: !regression,
+    traceDir: options.traceDir,
+    ...options.baseline !== void 0 ? { baseline: options.baseline } : {},
+    ...options.candidate !== void 0 ? { candidate: options.candidate } : {},
+    cohortKey,
+    groupBy: options.groupBy ?? "model",
+    metrics,
+    groups,
+    comparisons,
+    runs: runMetrics,
+    warnings
+  };
+}
+var DEFAULT_METRICS;
+var init_analyze = __esm({
+  "packages/core/src/cohort/analyze.ts"() {
+    init_compare();
+    init_grouping();
+    init_metrics();
+    init_types5();
+    DEFAULT_METRICS = [
+      "errorRate",
+      "duration",
+      "toolChoice",
+      "observationFailure"
+    ];
+  }
+});
+
+// packages/core/src/exporters/helpers.ts
+function shouldRedactKey(key) {
+  const k = key.toLowerCase();
+  for (const s of REDACT_SUBSTRINGS) {
+    if (k.includes(s)) return true;
+  }
+  return false;
+}
+function safeString(value, maxLength) {
+  if (value === null || value === void 0) return "";
+  let s;
+  if (typeof value === "string") s = value;
+  else if (typeof value === "number" || typeof value === "boolean") s = String(value);
+  else s = stableJson(value, false);
+  if (maxLength !== void 0 && maxLength >= 0 && s.length > maxLength) {
+    return `${s.slice(0, maxLength)}\u2026`;
+  }
+  return s;
+}
+function escapeMarkdown(value) {
+  return value.replace(/\|/g, "\\|").replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\n/g, " ");
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function sortKeysDeep(input3) {
+  if (input3 === null || typeof input3 !== "object") return input3;
+  if (Array.isArray(input3)) return input3.map(sortKeysDeep);
+  const o = input3;
+  const out = {};
+  for (const k of Object.keys(o).sort()) {
+    out[k] = sortKeysDeep(o[k]);
+  }
+  return out;
+}
+function stableJson(value, pretty) {
+  const sorted = sortKeysDeep(value);
+  return pretty === true ? JSON.stringify(sorted, null, 2) : JSON.stringify(sorted);
+}
+function compactAttributes3(attrs, options) {
+  if (attrs === void 0) return {};
+  const maxLen = options?.maxLength ?? 500;
+  const redacted = options?.redacted ?? true;
+  const out = {};
+  for (const key of Object.keys(attrs).sort()) {
+    if (redacted && shouldRedactKey(key)) {
+      out[key] = "[REDACTED]";
+      continue;
+    }
+    const v = attrs[key];
+    out[key] = compactValue(v, maxLen, redacted);
+  }
+  return out;
+}
+function compactValue(value, maxLen, redacted) {
+  if (value === null || typeof value !== "object") {
+    return typeof value === "string" ? safeString(value, maxLen) : value;
+  }
+  if (Array.isArray(value)) {
+    const arr = value.slice(0, 20).map((x) => compactValue(x, maxLen, redacted));
+    if (value.length > 20) arr.push(`\u2026(+${value.length - 20} more)`);
+    return arr;
+  }
+  const o = value;
+  const inner = {};
+  for (const k of Object.keys(o)) {
+    if (redacted && shouldRedactKey(k)) inner[k] = "[REDACTED]";
+    else inner[k] = compactValue(o[k], maxLen, redacted);
+  }
+  return inner;
+}
+function flattenTree(tree) {
+  const out = [];
+  function walk(nodes) {
+    for (const n of nodes) {
+      out.push(n);
+      if (n.children.length > 0) walk(n.children);
+    }
+  }
+  walk(tree.children);
+  return out;
+}
+function zeroKinds() {
+  return {
+    RUN: 0,
+    AGENT: 0,
+    LLM: 0,
+    TOOL: 0,
+    CHAIN: 0,
+    RETRIEVER: 0,
+    DECISION: 0,
+    RESULT: 0,
+    ERROR: 0,
+    LOGIC: 0,
+    LOG: 0,
+    OUTCOME: 0
+  };
+}
+var REDACT_SUBSTRINGS;
+var init_helpers = __esm({
+  "packages/core/src/exporters/helpers.ts"() {
+    REDACT_SUBSTRINGS = [
+      "authorization",
+      "cookie",
+      "token",
+      "apikey",
+      "password",
+      "secret",
+      "email"
+    ];
+  }
+});
+
+// packages/core/src/cohort/render.ts
+function formatRate(value) {
+  if (value === void 0) return "n/a";
+  return `${(value * 100).toFixed(1)}%`;
+}
+function renderCohortSummaryMarkdown(result) {
+  const lines = [];
+  lines.push("# Cohort analysis");
+  lines.push("");
+  lines.push(`Trace directory: \`${result.traceDir}\``);
+  lines.push(`Group by: \`${result.groupBy}\``);
+  if (result.baseline !== void 0 && result.candidate !== void 0) {
+    lines.push(
+      `Baseline/Candidate key: \`${result.cohortKey}\` (${result.baseline} vs ${result.candidate})`
+    );
+  }
+  lines.push(`Status: **${result.ok ? "PASS" : "REGRESSION"}**`);
+  lines.push("");
+  if (result.warnings.length > 0) {
+    lines.push("## Warnings");
+    for (const warning of result.warnings) lines.push(`- ${warning}`);
+    lines.push("");
+  }
+  lines.push("## Groups");
+  for (const group of result.groups) {
+    lines.push(
+      `### ${group.cohortLabel ?? "all"} / ${group.groupKey} (${group.runCount} runs)`
+    );
+    lines.push(`- Error rate: ${formatRate(group.errorRate)}`);
+    if (group.avgDurationMs !== void 0) {
+      lines.push(`- Avg duration: ${Math.round(group.avgDurationMs)} ms`);
+    }
+    if (group.dominantToolChoice !== void 0) {
+      lines.push(`- Dominant tools: ${group.dominantToolChoice}`);
+    }
+    lines.push(
+      `- Observation failure rate: ${formatRate(group.observationFailureRate)}`
+    );
+    lines.push("");
+  }
+  if (result.comparisons.length > 0) {
+    lines.push("## Comparisons");
+    for (const comparison of result.comparisons) {
+      const flag = comparison.regression ? " **REGRESSION**" : "";
+      lines.push(`- ${comparison.message}${flag}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n").trimEnd();
+}
+function renderCohortReportHtml(result) {
+  const rows = result.groups.map(
+    (group) => `<tr><td>${escapeHtml(group.cohortLabel ?? "all")}</td><td>${escapeHtml(group.groupKey)}</td><td>${group.runCount}</td><td>${escapeHtml(formatRate(group.errorRate))}</td><td>${group.avgDurationMs !== void 0 ? Math.round(group.avgDurationMs) : "n/a"}</td></tr>`
+  ).join("");
+  const comparisons = result.comparisons.map(
+    (item) => `<li>${escapeHtml(item.message)}${item.regression ? " <strong>REGRESSION</strong>" : ""}</li>`
+  ).join("");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Cohort report</title>
+  <style>
+    body { font-family: system-ui, sans-serif; margin: 2rem; }
+    table { border-collapse: collapse; width: 100%; }
+    th, td { border: 1px solid #ddd; padding: 0.5rem; text-align: left; }
+    th { background: #f6f6f6; }
+  </style>
+</head>
+<body>
+  <h1>Cohort analysis</h1>
+  <p>Status: <strong>${result.ok ? "PASS" : "REGRESSION"}</strong></p>
+  <p>Trace directory: <code>${escapeHtml(result.traceDir)}</code></p>
+  <h2>Groups</h2>
+  <table>
+    <thead><tr><th>Cohort</th><th>Group</th><th>Runs</th><th>Error rate</th><th>Avg duration (ms)</th></tr></thead>
+    <tbody>${rows}</tbody>
+  </table>
+  ${result.comparisons.length > 0 ? `<h2>Comparisons</h2><ul>${comparisons}</ul>` : ""}
+</body>
+</html>`;
+}
+function renderCohortReport(result, options = {}) {
+  const format = options.format ?? "markdown";
+  if (format === "json") return JSON.stringify(result, null, 2);
+  if (format === "html") return renderCohortReportHtml(result);
+  return renderCohortSummaryMarkdown(result);
+}
+var init_render2 = __esm({
+  "packages/core/src/cohort/render.ts"() {
+    init_helpers();
+  }
+});
+
+// packages/core/src/cohort/index.ts
+var init_cohort2 = __esm({
+  "packages/core/src/cohort/index.ts"() {
+    init_types5();
+    init_analyze();
+    init_compare();
+    init_grouping();
+    init_metrics();
+    init_render2();
+  }
+});
+
+// packages/core/src/gate/parse.ts
+function parseGateList(value) {
+  if (value === void 0 || value.trim() === "") return [];
+  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
+var init_parse = __esm({
+  "packages/core/src/gate/parse.ts"() {
+  }
+});
+
+// packages/core/src/gate/evaluate.ts
+function percentile3(values, p) {
+  if (values.length === 0) return void 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const idx = Math.min(
+    sorted.length - 1,
+    Math.max(0, Math.ceil(p / 100 * sorted.length) - 1)
+  );
+  return sorted[idx];
+}
+function hasThresholds(options) {
+  return options.maxErrorRate !== void 0 || options.maxP95DurationMs !== void 0 || (options.forbidTools?.length ?? 0) > 0 || (options.requireObservations?.length ?? 0) > 0;
+}
+function gateHasThresholds(options) {
+  return hasThresholds(options);
+}
+async function loadRunMetrics(runs) {
+  const metrics = [];
+  for (const run of runs) {
+    if (run.filePath === void 0) continue;
+    metrics.push(
+      await computeCohortRunMetrics({
+        runId: run.runId,
+        filePath: run.filePath,
+        metadata: run.metadata,
+        status: run.status,
+        durationMs: run.durationMs,
+        groupKey: "all"
+      })
+    );
+  }
+  return metrics;
+}
+async function observationStatus(filePath, name) {
+  const events = await readTraceEventsFromFile(filePath);
+  const outcomes = extractOutcomesFromTraceEvents(events);
+  const match = outcomes.find((item) => item.name === name);
+  if (!match) return "missing";
+  return match.status === "passed" ? "passed" : "failed";
+}
+async function evaluateGateThresholds(runs, options) {
+  const checks2 = [];
+  const readErrors = [];
+  if (!hasThresholds(options)) {
+    return { checks: checks2, readErrors };
+  }
+  if (runs.length === 0) {
+    readErrors.push("No trace runs found in the gate directory.");
+    return { checks: checks2, readErrors };
+  }
+  let runMetrics;
+  try {
+    runMetrics = await loadRunMetrics(runs);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    readErrors.push(message);
+    return { checks: checks2, readErrors };
+  }
+  if (options.maxErrorRate !== void 0) {
+    const errors = runMetrics.filter((run) => run.error).length;
+    const actual = runMetrics.length > 0 ? errors / runMetrics.length * 100 : 0;
+    const ok = actual <= options.maxErrorRate;
+    checks2.push({
+      id: "maxErrorRate",
+      name: "Max error rate",
+      ok,
+      expected: options.maxErrorRate,
+      actual: Math.round(actual * 10) / 10,
+      message: ok ? `Error rate ${actual.toFixed(1)}% within limit ${options.maxErrorRate}%` : `Error rate ${actual.toFixed(1)}% exceeds limit ${options.maxErrorRate}%`
+    });
+  }
+  if (options.maxP95DurationMs !== void 0) {
+    const durations = runMetrics.map((run) => run.durationMs).filter((value) => typeof value === "number");
+    const actual = percentile3(durations, 95);
+    const ok = actual !== void 0 && actual <= options.maxP95DurationMs;
+    checks2.push({
+      id: "maxP95Duration",
+      name: "Max p95 duration (ms)",
+      ok,
+      expected: options.maxP95DurationMs,
+      actual: actual ?? "n/a",
+      message: actual === void 0 ? "No duration samples available for p95 check." : ok ? `P95 duration ${Math.round(actual)} ms within limit ${options.maxP95DurationMs} ms` : `P95 duration ${Math.round(actual)} ms exceeds limit ${options.maxP95DurationMs} ms`
+    });
+  }
+  for (const tool of options.forbidTools ?? []) {
+    let violated = false;
+    for (const run of runMetrics) {
+      const used = run.toolChoices.includes(tool) || run.toolOrdering.includes(tool);
+      if (used) {
+        violated = true;
+        checks2.push({
+          id: "forbidTool",
+          name: `Forbid tool: ${tool}`,
+          ok: false,
+          expected: `not used`,
+          actual: "used",
+          runId: run.runId,
+          message: `Forbidden tool "${tool}" used in run ${run.runId}`
+        });
+      }
+    }
+    if (!violated) {
+      checks2.push({
+        id: "forbidTool",
+        name: `Forbid tool: ${tool}`,
+        ok: true,
+        message: `Forbidden tool "${tool}" not used`
+      });
+    }
+  }
+  for (const observation of options.requireObservations ?? []) {
+    for (const run of runs) {
+      if (run.filePath === void 0) continue;
+      try {
+        const status = await observationStatus(run.filePath, observation);
+        const ok = status === "passed";
+        checks2.push({
+          id: "requireObservation",
+          name: `Require observation: ${observation}`,
+          ok,
+          expected: "passed",
+          actual: status,
+          runId: run.runId,
+          message: ok ? `Observation "${observation}" passed in run ${run.runId}` : status === "missing" ? `Observation "${observation}" missing in run ${run.runId}` : `Observation "${observation}" failed in run ${run.runId}`
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        readErrors.push(`Run ${run.runId}: ${message}`);
+      }
+    }
+  }
+  return { checks: checks2, readErrors };
+}
+function checksFromSuiteResult(suiteResult) {
+  const checks2 = [
+    {
+      id: "suite",
+      name: `Suite: ${suiteResult.suiteName}`,
+      ok: suiteResult.ok,
+      message: suiteResult.ok ? `Suite passed (${suiteResult.summary.passed} cases)` : `Suite failed (${suiteResult.summary.failed} failed, ${suiteResult.summary.errors} errors)`
+    }
+  ];
+  for (const suiteCase of suiteResult.cases) {
+    if (suiteCase.status === "pass") continue;
+    checks2.push({
+      id: "suite",
+      name: `Case: ${suiteCase.id}`,
+      ok: false,
+      message: suiteCase.message ?? `Case status: ${suiteCase.status}`
+    });
+  }
+  return checks2;
+}
+var init_evaluate = __esm({
+  "packages/core/src/gate/evaluate.ts"() {
+    init_extract();
+    init_storage();
+    init_metrics();
+  }
+});
+function resolveExitCode(input3) {
+  if (input3.configError) return 2;
+  if (input3.readError) return 3;
+  if (!input3.ok) return 1;
+  return 0;
+}
+function validateOptions(options) {
+  const errors = [];
+  const hasSuite = options.suitePath !== void 0 && options.suitePath.trim() !== "";
+  const hasThresholds2 = gateHasThresholds(options);
+  if (!hasSuite && !hasThresholds2) {
+    errors.push(
+      "No gate rules specified. Pass --suite or at least one threshold flag."
+    );
+  }
+  if (hasThresholds2 && (options.traceDir === void 0 || options.traceDir.trim() === "")) {
+    if (!hasSuite) {
+      errors.push("Threshold flags require --dir <trace-directory>.");
+    }
+  }
+  if (options.maxErrorRate !== void 0 && options.maxErrorRate < 0) {
+    errors.push("--max-error-rate must be a non-negative percentage.");
+  }
+  if (options.maxP95DurationMs !== void 0 && options.maxP95DurationMs < 0) {
+    errors.push("--max-p95-duration must be a non-negative millisecond value.");
+  }
+  return errors;
+}
+function isConfigLoadError(error) {
+  if (!(error instanceof Error)) return false;
+  const ext = path24__default.default.extname(error.message);
+  if (error.message.includes("Unsupported suite config extension")) return true;
+  if (error.message.includes("TypeScript suite configs require")) return true;
+  if (error.message.includes("No suite config found")) return true;
+  if (error.message.includes("AI_SUITE_CONFIG")) return true;
+  if (ext === ".ts" || ext === ".mts" || ext === ".cts") return true;
+  return "diagnostics" in error;
+}
+async function runGate(runs, options) {
+  const diagnostics = [];
+  const checks2 = [];
+  const validationErrors = validateOptions(options);
+  if (validationErrors.length > 0) {
+    return {
+      ok: false,
+      exitCode: 2,
+      runCount: 0,
+      checks: checks2,
+      diagnostics: validationErrors
+    };
+  }
+  let traceDir = options.traceDir?.trim();
+  let suiteResult;
+  if (options.suitePath !== void 0 && options.suitePath.trim() !== "") {
+    try {
+      suiteResult = await runSuite({
+        configPath: options.suitePath,
+        cwd: options.cwd
+      });
+      traceDir = traceDir ?? suiteResult.tracesDir;
+      checks2.push(...checksFromSuiteResult(suiteResult));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      diagnostics.push(message);
+      return {
+        ok: false,
+        exitCode: isConfigLoadError(error) ? 2 : 3,
+        traceDir,
+        suitePath: options.suitePath,
+        runCount: 0,
+        checks: checks2,
+        diagnostics
+      };
+    }
+  }
+  if (gateHasThresholds(options)) {
+    const thresholdDir = traceDir;
+    if (thresholdDir === void 0 || thresholdDir.trim() === "") {
+      return {
+        ok: false,
+        exitCode: 2,
+        traceDir,
+        suitePath: options.suitePath,
+        runCount: runs.length,
+        checks: checks2,
+        diagnostics: ["Threshold evaluation requires a trace directory."],
+        ...suiteResult !== void 0 ? { suiteResult } : {}
+      };
+    }
+    const thresholdRuns = runs.length > 0 ? runs : [];
+    const { checks: thresholdChecks, readErrors } = await evaluateGateThresholds(
+      thresholdRuns,
+      options
+    );
+    checks2.push(...thresholdChecks);
+    diagnostics.push(...readErrors);
+    if (readErrors.length > 0) {
+      const ok2 = checks2.length > 0 && checks2.every((item) => item.ok);
+      return {
+        ok: ok2,
+        exitCode: resolveExitCode({
+          ok: ok2,
+          configError: false,
+          readError: true
+        }),
+        traceDir: thresholdDir,
+        suitePath: options.suitePath,
+        runCount: thresholdRuns.length,
+        checks: checks2,
+        diagnostics,
+        ...suiteResult !== void 0 ? { suiteResult } : {}
+      };
+    }
+  }
+  const ok = checks2.length > 0 && checks2.every((item) => item.ok);
+  return {
+    ok,
+    exitCode: resolveExitCode({ ok, configError: false, readError: false }),
+    traceDir,
+    suitePath: options.suitePath,
+    runCount: runs.length,
+    checks: checks2,
+    diagnostics,
+    ...suiteResult !== void 0 ? { suiteResult } : {}
+  };
+}
+var init_run2 = __esm({
+  "packages/core/src/gate/run.ts"() {
+    init_run();
+    init_evaluate();
+  }
+});
+
+// packages/core/src/gate/render.ts
+function escapeXml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function renderGateSummaryMarkdown(result) {
+  const lines = [];
+  lines.push("# AgentInspect gate");
+  lines.push("");
+  lines.push(`Status: **${result.ok ? "PASS" : "FAIL"}** (exit ${result.exitCode})`);
+  if (result.traceDir !== void 0) {
+    lines.push(`Trace directory: \`${result.traceDir}\``);
+  }
+  if (result.suitePath !== void 0) {
+    lines.push(`Suite config: \`${result.suitePath}\``);
+  }
+  lines.push(`Runs evaluated: ${result.runCount}`);
+  lines.push("");
+  if (result.diagnostics.length > 0) {
+    lines.push("## Diagnostics");
+    for (const item of result.diagnostics) lines.push(`- ${item}`);
+    lines.push("");
+  }
+  lines.push("## Checks");
+  for (const check of result.checks) {
+    const flag = check.ok ? "PASS" : "FAIL";
+    lines.push(`- [${flag}] ${check.name}: ${check.message}`);
+  }
+  lines.push("");
+  return lines.join("\n").trimEnd();
+}
+function renderGateGithubStepSummary(result) {
+  const lines = [];
+  lines.push(`## AgentInspect gate: ${result.ok ? "PASS" : "FAIL"}`);
+  lines.push("");
+  lines.push("| Check | Status | Details |");
+  lines.push("| --- | --- | --- |");
+  for (const check of result.checks) {
+    lines.push(
+      `| ${check.name} | ${check.ok ? "pass" : "fail"} | ${check.message.replace(/\|/g, "/")} |`
+    );
+  }
+  if (result.diagnostics.length > 0) {
+    lines.push("");
+    lines.push("**Diagnostics**");
+    for (const item of result.diagnostics) lines.push(`- ${item}`);
+  }
+  return lines.join("\n").trimEnd();
+}
+function renderGateReportHtml(result) {
+  const rows = result.checks.map(
+    (check) => `<tr><td>${escapeHtml(check.name)}</td><td>${check.ok ? "PASS" : "FAIL"}</td><td>${escapeHtml(check.message)}</td></tr>`
+  ).join("");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Gate report</title>
+  <style>
+    body { font-family: system-ui, sans-serif; margin: 2rem; }
+    table { border-collapse: collapse; width: 100%; }
+    th, td { border: 1px solid #ddd; padding: 0.5rem; text-align: left; }
+    th { background: #f6f6f6; }
+  </style>
+</head>
+<body>
+  <h1>AgentInspect gate</h1>
+  <p>Status: <strong>${result.ok ? "PASS" : "FAIL"}</strong> (exit ${result.exitCode})</p>
+  <h2>Checks</h2>
+  <table>
+    <thead><tr><th>Check</th><th>Status</th><th>Details</th></tr></thead>
+    <tbody>${rows}</tbody>
+  </table>
+</body>
+</html>`;
+}
+function renderGateJUnit(result) {
+  const failures = result.checks.filter((check) => !check.ok).length;
+  const tests = result.checks.length;
+  const cases = result.checks.map((check) => {
+    if (check.ok) {
+      return `    <testcase name="${escapeXml(check.name)}" classname="gate" />`;
+    }
+    return `    <testcase name="${escapeXml(check.name)}" classname="gate">
+      <failure message="${escapeXml(check.message)}">${escapeXml(check.message)}</failure>
+    </testcase>`;
+  }).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<testsuites tests="${tests}" failures="${failures}" errors="0" time="0">
+  <testsuite name="agent-inspect-gate" tests="${tests}" failures="${failures}" errors="0" time="0">
+${cases}
+  </testsuite>
+</testsuites>`;
+}
+function renderGateReport(result, options = {}) {
+  const format = options.format ?? "markdown";
+  if (format === "json") return JSON.stringify(result, null, 2);
+  if (format === "html") return renderGateReportHtml(result);
+  if (format === "junit") return renderGateJUnit(result);
+  if (format === "github") return renderGateGithubStepSummary(result);
+  return renderGateSummaryMarkdown(result);
+}
+var init_render3 = __esm({
+  "packages/core/src/gate/render.ts"() {
+    init_helpers();
+  }
+});
+
+// packages/core/src/gate/index.ts
+var init_gate = __esm({
+  "packages/core/src/gate/index.ts"() {
+    init_parse();
+    init_evaluate();
+    init_run2();
+    init_render3();
+  }
+});
+
 // packages/core/src/inspect-run.ts
 var init_inspect_run = __esm({
   "packages/core/src/inspect-run.ts"() {
@@ -8320,13 +9416,15 @@ var init_advanced = __esm({
     init_duration();
     init_bundle();
     init_suite();
+    init_cohort2();
+    init_gate();
     init_maybe_inspect_run();
   }
 });
 
 // packages/index-sqlite/src/types.ts
 var INDEX_SCHEMA_VERSION, INDEX_DB_FILENAME;
-var init_types5 = __esm({
+var init_types6 = __esm({
   "packages/index-sqlite/src/types.ts"() {
     INDEX_SCHEMA_VERSION = "1";
     INDEX_DB_FILENAME = "trace-index.sqlite";
@@ -8384,19 +9482,19 @@ var require_file_uri_to_path = __commonJS({
       var rest = decodeURI(uri.substring(7));
       var firstSlash = rest.indexOf("/");
       var host = rest.substring(0, firstSlash);
-      var path30 = rest.substring(firstSlash + 1);
+      var path33 = rest.substring(firstSlash + 1);
       if ("localhost" == host) host = "";
       if (host) {
         host = sep + sep + host;
       }
-      path30 = path30.replace(/^(.+)\|/, "$1:");
+      path33 = path33.replace(/^(.+)\|/, "$1:");
       if (sep == "\\") {
-        path30 = path30.replace(/\//g, "\\");
+        path33 = path33.replace(/\//g, "\\");
       }
-      if (/^.+\:/.test(path30)) ; else {
-        path30 = sep + path30;
+      if (/^.+\:/.test(path33)) ; else {
+        path33 = sep + path33;
       }
-      return host + path30;
+      return host + path33;
     }
   }
 });
@@ -8405,18 +9503,18 @@ var require_file_uri_to_path = __commonJS({
 var require_bindings = __commonJS({
   "node_modules/.pnpm/bindings@1.5.0/node_modules/bindings/bindings.js"(exports$1, module) {
     var fs = __require("fs");
-    var path30 = __require("path");
+    var path33 = __require("path");
     var fileURLToPath2 = require_file_uri_to_path();
-    var join = path30.join;
-    var dirname = path30.dirname;
-    var exists2 = fs.accessSync && function(path31) {
+    var join = path33.join;
+    var dirname = path33.dirname;
+    var exists2 = fs.accessSync && function(path34) {
       try {
-        fs.accessSync(path31);
+        fs.accessSync(path34);
       } catch (e) {
         return false;
       }
       return true;
-    } || fs.existsSync || path30.existsSync;
+    } || fs.existsSync || path33.existsSync;
     var defaults = {
       arrow: process.env.NODE_BINDINGS_ARROW || " \u2192 ",
       compiled: process.env.NODE_BINDINGS_COMPILED_DIR || "compiled",
@@ -8461,7 +9559,7 @@ var require_bindings = __commonJS({
       if (!opts.module_root) {
         opts.module_root = exports$1.getRoot(exports$1.getFileName());
       }
-      if (path30.extname(opts.bindings) != ".node") {
+      if (path33.extname(opts.bindings) != ".node") {
         opts.bindings += ".node";
       }
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
@@ -8696,7 +9794,7 @@ var require_pragma = __commonJS({
 var require_backup = __commonJS({
   "node_modules/.pnpm/better-sqlite3@11.10.0/node_modules/better-sqlite3/lib/methods/backup.js"(exports$1, module) {
     var fs = __require("fs");
-    var path30 = __require("path");
+    var path33 = __require("path");
     var { promisify } = __require("util");
     var { cppdb } = require_util();
     var fsAccess = promisify(fs.access);
@@ -8712,7 +9810,7 @@ var require_backup = __commonJS({
       if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
       if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
       if (handler != null && typeof handler !== "function") throw new TypeError('Expected the "progress" option to be a function');
-      await fsAccess(path30.dirname(filename)).catch(() => {
+      await fsAccess(path33.dirname(filename)).catch(() => {
         throw new TypeError("Cannot save backup because the directory does not exist");
       });
       const isNewFile = await fsAccess(filename).then(() => false, () => true);
@@ -9012,7 +10110,7 @@ var require_inspect = __commonJS({
 var require_database = __commonJS({
   "node_modules/.pnpm/better-sqlite3@11.10.0/node_modules/better-sqlite3/lib/database.js"(exports$1, module) {
     var fs = __require("fs");
-    var path30 = __require("path");
+    var path33 = __require("path");
     var util = require_util();
     var SqliteError = require_sqlite_error();
     var DEFAULT_ADDON;
@@ -9048,7 +10146,7 @@ var require_database = __commonJS({
         addon = DEFAULT_ADDON || (DEFAULT_ADDON = require_bindings()("better_sqlite3.node"));
       } else if (typeof nativeBinding === "string") {
         const requireFunc = typeof __non_webpack_require__ === "function" ? __non_webpack_require__ : __require;
-        addon = requireFunc(path30.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
+        addon = requireFunc(path33.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
       } else {
         addon = nativeBinding;
       }
@@ -9056,7 +10154,7 @@ var require_database = __commonJS({
         addon.setErrorConstructor(SqliteError);
         addon.isInitialized = true;
       }
-      if (!anonymous && !fs.existsSync(path30.dirname(filename))) {
+      if (!anonymous && !fs.existsSync(path33.dirname(filename))) {
         throw new TypeError("Cannot open database because the directory does not exist");
       }
       Object.defineProperties(this, {
@@ -9104,7 +10202,7 @@ function metaDefaults(sourceDir, fileCount) {
 var INDEX_SCHEMA_SQL, DERIVE_SESSIONS_SQL, META_KEYS;
 var init_schema = __esm({
   "packages/index-sqlite/src/schema.ts"() {
-    init_types5();
+    init_types6();
     INDEX_SCHEMA_SQL = `
 DROP TABLE IF EXISTS meta;
 DROP TABLE IF EXISTS errors;
@@ -9183,8 +10281,8 @@ GROUP BY session_id;
   }
 });
 function resolveIndexDbPath(traceDir, dbPath) {
-  if (dbPath && dbPath.trim() !== "") return path23__default.default.resolve(dbPath);
-  return path23__default.default.join(path23__default.default.resolve(traceDir), INDEX_DB_FILENAME);
+  if (dbPath && dbPath.trim() !== "") return path24__default.default.resolve(dbPath);
+  return path24__default.default.join(path24__default.default.resolve(traceDir), INDEX_DB_FILENAME);
 }
 function str(value) {
   return typeof value === "string" && value !== "" ? value : null;
@@ -9276,7 +10374,7 @@ async function buildIndex(options = {}) {
       warnings.push(`index.unreadable: ${file}`);
     }
   }
-  await promises.mkdir(path23__default.default.dirname(dbPath), { recursive: true });
+  await promises.mkdir(path24__default.default.dirname(dbPath), { recursive: true });
   await promises.rm(dbPath, { force: true });
   const db = new import_better_sqlite3.default(dbPath);
   let runCount = 0;
@@ -9357,7 +10455,7 @@ var init_builder = __esm({
     import_better_sqlite3 = __toESM(require_lib());
     init_advanced();
     init_schema();
-    init_types5();
+    init_types6();
     DEFAULT_MAX_RUNS = 1e4;
     rebuildIndex = buildIndex;
   }
@@ -9507,14 +10605,14 @@ __export(src_exports, {
 });
 var init_src = __esm({
   "packages/index-sqlite/src/index.ts"() {
-    init_types5();
+    init_types6();
     init_builder();
     init_query();
   }
 });
 
 // package.json
-var version = "5.0.0";
+var version = "5.2.0";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -10459,7 +11557,7 @@ init_nanoid();
 function isFiniteNumber2(v) {
   return typeof v === "number" && Number.isFinite(v);
 }
-function safeString(v) {
+function safeString2(v) {
   if (typeof v !== "string") return void 0;
   const t = v.trim();
   return t === "" ? void 0 : t;
@@ -10509,7 +11607,7 @@ var EventNormalizer = class {
     let runId;
     for (const k of cfg.runIdKeys) {
       const v = raw[k];
-      const s = safeString(v);
+      const s = safeString2(v);
       if (s) {
         runId = s;
         break;
@@ -10525,7 +11623,7 @@ var EventNormalizer = class {
         }
       };
     }
-    const eventName = safeString(raw[cfg.eventKey]);
+    const eventName = safeString2(raw[cfg.eventKey]);
     if (!eventName) {
       return {
         warning: {
@@ -10543,7 +11641,7 @@ var EventNormalizer = class {
     const timestamp = parsedTs ?? Date.now();
     const timestampMissing = parsedTs === void 0;
     const parentIdKey = cfg.parentIdKey;
-    const parentId = parentIdKey ? safeString(raw[parentIdKey]) : void 0;
+    const parentId = parentIdKey ? safeString2(raw[parentIdKey]) : void 0;
     let durationMs2;
     const durationKey = cfg.durationKey;
     if (durationKey) {
@@ -10554,7 +11652,7 @@ var EventNormalizer = class {
     }
     let status;
     const statusKey = cfg.statusKey;
-    const statusRaw = statusKey ? safeString(raw[statusKey]) : void 0;
+    const statusRaw = statusKey ? safeString2(raw[statusKey]) : void 0;
     if (statusRaw === "running" || statusRaw === "ok" || statusRaw === "error") {
       status = statusRaw;
     } else if (mapping?.status) {
@@ -11498,115 +12596,8 @@ function redactRunTreeForExport(tree, options) {
   return clone;
 }
 
-// packages/core/src/exporters/helpers.ts
-var REDACT_SUBSTRINGS = [
-  "authorization",
-  "cookie",
-  "token",
-  "apikey",
-  "password",
-  "secret",
-  "email"
-];
-function shouldRedactKey(key) {
-  const k = key.toLowerCase();
-  for (const s of REDACT_SUBSTRINGS) {
-    if (k.includes(s)) return true;
-  }
-  return false;
-}
-function safeString2(value, maxLength) {
-  if (value === null || value === void 0) return "";
-  let s;
-  if (typeof value === "string") s = value;
-  else if (typeof value === "number" || typeof value === "boolean") s = String(value);
-  else s = stableJson(value, false);
-  if (maxLength !== void 0 && maxLength >= 0 && s.length > maxLength) {
-    return `${s.slice(0, maxLength)}\u2026`;
-  }
-  return s;
-}
-function escapeMarkdown(value) {
-  return value.replace(/\|/g, "\\|").replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\n/g, " ");
-}
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function sortKeysDeep(input3) {
-  if (input3 === null || typeof input3 !== "object") return input3;
-  if (Array.isArray(input3)) return input3.map(sortKeysDeep);
-  const o = input3;
-  const out = {};
-  for (const k of Object.keys(o).sort()) {
-    out[k] = sortKeysDeep(o[k]);
-  }
-  return out;
-}
-function stableJson(value, pretty) {
-  const sorted = sortKeysDeep(value);
-  return pretty === true ? JSON.stringify(sorted, null, 2) : JSON.stringify(sorted);
-}
-function compactAttributes3(attrs, options) {
-  if (attrs === void 0) return {};
-  const maxLen = options?.maxLength ?? 500;
-  const redacted = options?.redacted ?? true;
-  const out = {};
-  for (const key of Object.keys(attrs).sort()) {
-    if (redacted && shouldRedactKey(key)) {
-      out[key] = "[REDACTED]";
-      continue;
-    }
-    const v = attrs[key];
-    out[key] = compactValue(v, maxLen, redacted);
-  }
-  return out;
-}
-function compactValue(value, maxLen, redacted) {
-  if (value === null || typeof value !== "object") {
-    return typeof value === "string" ? safeString2(value, maxLen) : value;
-  }
-  if (Array.isArray(value)) {
-    const arr = value.slice(0, 20).map((x) => compactValue(x, maxLen, redacted));
-    if (value.length > 20) arr.push(`\u2026(+${value.length - 20} more)`);
-    return arr;
-  }
-  const o = value;
-  const inner = {};
-  for (const k of Object.keys(o)) {
-    if (redacted && shouldRedactKey(k)) inner[k] = "[REDACTED]";
-    else inner[k] = compactValue(o[k], maxLen, redacted);
-  }
-  return inner;
-}
-function flattenTree(tree) {
-  const out = [];
-  function walk(nodes) {
-    for (const n of nodes) {
-      out.push(n);
-      if (n.children.length > 0) walk(n.children);
-    }
-  }
-  walk(tree.children);
-  return out;
-}
-function zeroKinds() {
-  return {
-    RUN: 0,
-    AGENT: 0,
-    LLM: 0,
-    TOOL: 0,
-    CHAIN: 0,
-    RETRIEVER: 0,
-    DECISION: 0,
-    RESULT: 0,
-    ERROR: 0,
-    LOGIC: 0,
-    LOG: 0,
-    OUTCOME: 0
-  };
-}
-
 // packages/core/src/exporters/html-exporter.ts
+init_helpers();
 function renderTreeHtml(nodes, ulClass = "tree") {
   if (nodes.length === 0) return "";
   const parts = [`<ul class="${ulClass}">`];
@@ -11679,7 +12670,7 @@ function exportHtml(tree, options) {
   if (includeErrors && errors.length > 0) {
     errorsHtml += "<h2>Errors</h2><ul>";
     for (const n of errors) {
-      const msg = n.event.attributes && typeof n.event.attributes.error === "object" ? safeString2(
+      const msg = n.event.attributes && typeof n.event.attributes.error === "object" ? safeString(
         n.event.attributes.error.message,
         maxLen
       ) : "";
@@ -11744,6 +12735,7 @@ ${attrsHtml}
 }
 
 // packages/core/src/exporters/markdown-exporter.ts
+init_helpers();
 function renderTreeAscii(nodes, indent = "") {
   const lines = [];
   for (let i = 0; i < nodes.length; i++) {
@@ -11828,7 +12820,7 @@ function exportMarkdown(tree, options) {
     lines.push("## Errors");
     lines.push("");
     for (const n of errors) {
-      const msg = n.event.attributes && typeof n.event.attributes.error === "object" ? safeString2(
+      const msg = n.event.attributes && typeof n.event.attributes.error === "object" ? safeString(
         n.event.attributes.error.message,
         maxLen
       ) : "";
@@ -11866,6 +12858,7 @@ function exportMarkdown(tree, options) {
     warnings
   };
 }
+init_helpers();
 function hexFrom(seed, byteLen) {
   return crypto__default.default.createHash("sha256").update(seed, "utf8").digest("hex").slice(0, byteLen * 2);
 }
@@ -11992,6 +12985,9 @@ function exportOpenInference(tree, options) {
     warnings
   };
 }
+
+// packages/core/src/exporters/otlp-json-exporter.ts
+init_helpers();
 function hexFrom2(seed, byteLen) {
   return crypto__default.default.createHash("sha256").update(seed, "utf8").digest("hex").slice(0, byteLen * 2);
 }
@@ -12195,7 +13191,11 @@ function validateExportContent(format, content) {
   return { ok: false, format, errors, warnings };
 }
 
+// packages/core/src/exporters/index.ts
+init_helpers();
+
 // packages/core/src/exporters/manual-trace-adapter.ts
+init_helpers();
 function stepTypeToInspectKind(t) {
   switch (t) {
     case "llm":
@@ -12375,6 +13375,7 @@ function validateExport(result) {
 }
 
 // packages/core/src/report.ts
+init_helpers();
 init_timeline();
 init_what();
 init_outcomes();
@@ -12531,6 +13532,9 @@ ${attrsSection}
   };
 }
 
+// packages/core/src/entries/exporters.ts
+init_helpers();
+
 // packages/cli/src/export.ts
 function parseRedactionProfile(s) {
   const v = (s ?? "local").trim().toLowerCase();
@@ -12609,9 +13613,9 @@ Trace directory: ${traceDir}`);
   if (validation !== void 0 && !validation.ok) {
     process.exitCode = 1;
   }
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path23__default.default.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path24__default.default.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await promises.mkdir(path23__default.default.dirname(outPath), { recursive: true });
+    await promises.mkdir(path24__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
     console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
@@ -12752,6 +13756,7 @@ function manualTraceEventsToComparableRun(events) {
 }
 
 // packages/core/src/diff/engine.ts
+init_helpers();
 var DEFAULT_THRESHOLD_MS = 0;
 function pathSeg(step, index) {
   return { index, name: step.name, stepId: step.id };
@@ -12791,13 +13796,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path30 = buildPath(segments);
+  const path33 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path30,
+      path: path33,
       left: L.name,
       right: R.name
     });
@@ -12807,7 +13812,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path30,
+      path: path33,
       left: L.type,
       right: R.type
     });
@@ -12817,7 +13822,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path30,
+      path: path33,
       left: L.status,
       right: R.status
     });
@@ -12829,7 +13834,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path30,
+      path: path33,
       left: le || void 0,
       right: re || void 0
     });
@@ -12847,7 +13852,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path30,
+        path: path33,
         left: ld,
         right: rd
       });
@@ -12860,7 +13865,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path30,
+      path: path33,
       left: L.metadata,
       right: R.metadata
     });
@@ -12872,7 +13877,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path30,
+      path: path33,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -13033,11 +14038,11 @@ function diffRuns(left, right, options) {
 
 // packages/core/src/diff/renderer.ts
 init_source();
-function formatPath(path30) {
-  if (path30 === void 0 || path30.path.length === 0) {
+function formatPath(path33) {
+  if (path33 === void 0 || path33.path.length === 0) {
     return "(run)";
   }
-  return path30.path.map((s) => s.name).join(" > ");
+  return path33.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -13425,7 +14430,7 @@ function indexedToMetadata(row, traceDir) {
     endedAt: row.endedAt ?? void 0,
     durationMs: row.durationMs ?? void 0,
     eventCount: 0,
-    filePath: path23__default.default.join(traceDir, row.file),
+    filePath: path24__default.default.join(traceDir, row.file),
     fileSize: 0,
     createdAt: new Date(row.mtimeMs)
   };
@@ -13906,9 +14911,9 @@ async function reportCommand(runId, options = {}) {
     correlation: !options.noCorrelation,
     ...options.section ? { section: options.section } : {}
   });
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path23__default.default.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path24__default.default.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await promises.mkdir(path23__default.default.dirname(outPath), { recursive: true });
+    await promises.mkdir(path24__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     console.log(`Wrote ${result.fileExtension} report to ${outPath}`);
   }
@@ -14158,17 +15163,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path30, key) {
+function childPath(path33, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path30 ? `${path30}.${key}` : key;
+    return path33 ? `${path33}.${key}` : key;
   }
-  return `${path30 || "$"}[${JSON.stringify(key)}]`;
+  return `${path33 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path30, index) {
-  return `${path30 || "$"}[${index}]`;
+function indexPath(path33, index) {
+  return `${path33 || "$"}[${index}]`;
 }
-function makeFinding(path30, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path30, detector, action, severity, matchKind } : { path: path30, detector, action, severity, matchKind, preview };
+function makeFinding(path33, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path33, detector, action, severity, matchKind } : { path: path33, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -14237,11 +15242,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path30, depth, state) {
+  #redactValue(value, key, path33, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path30, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path33, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -14250,19 +15255,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path30, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path33, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path30, key, value });
+      const detections = detector.detect({ path: path33, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path30,
+            path33,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -14280,7 +15285,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path30, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path33, index), depth + 1, state);
       });
       return out;
     }
@@ -14292,7 +15297,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path30 === "$" ? "" : path30, entryKey),
+          childPath(path33 === "$" ? "" : path33, entryKey),
           depth + 1,
           state
         );
@@ -14752,14 +15757,14 @@ function uniqueSorted(values) {
   return [...new Set(values)].sort();
 }
 function isWithinDirectory(child, parent) {
-  const relative = path23__default.default.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path23__default.default.isAbsolute(relative);
+  const relative = path24__default.default.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path24__default.default.isAbsolute(relative);
 }
 async function resolveOutputPath(inputPath, output2, force) {
   if (output2 === void 0 || output2.trim() === "") return void 0;
-  const inputAbs = path23__default.default.resolve(inputPath);
-  const outputAbs = path23__default.default.resolve(output2.trim());
-  const inputDir = path23__default.default.dirname(inputAbs);
+  const inputAbs = path24__default.default.resolve(inputPath);
+  const outputAbs = path24__default.default.resolve(output2.trim());
+  const inputDir = path24__default.default.dirname(inputAbs);
   if (!isWithinDirectory(outputAbs, inputDir)) {
     throw new Error("Refusing to write migrated output outside the input directory.");
   }
@@ -14880,7 +15885,7 @@ async function migrateCommand(input3, options = {}) {
     process.exitCode = 1;
     return;
   }
-  const inputPath = path23__default.default.resolve(input3.trim());
+  const inputPath = path24__default.default.resolve(input3.trim());
   const dryRun = options.dryRun === true;
   if (!dryRun && (options.output === void 0 || options.output.trim() === "")) {
     console.error("migrate requires --dry-run or --output <path>.");
@@ -14899,7 +15904,7 @@ async function migrateCommand(input3, options = {}) {
     );
     const result = await buildMigration(inputPath, outputPath);
     if (!dryRun && outputPath !== void 0) {
-      await promises.mkdir(path23__default.default.dirname(outputPath), { recursive: true });
+      await promises.mkdir(path24__default.default.dirname(outputPath), { recursive: true });
       await promises.writeFile(outputPath, result.content, "utf-8");
     }
     printSummary2(result, dryRun);
@@ -15233,23 +16238,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path30, evidence) {
+function validateSchemaField(value, field, path33, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path30, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path33, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path30, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path33, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path30}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path33}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -15576,7 +16581,7 @@ function asConfig(value) {
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
-  const extension = path23__default.default.extname(configPath);
+  const extension = path24__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error(
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -15585,7 +16590,7 @@ async function loadConfig(configPath) {
   if (!CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path23__default.default.resolve(configPath);
+  const absolute = path24__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
     return asConfig(JSON.parse(raw));
@@ -15750,10 +16755,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path30 = finding.evidence[0]?.path;
+    const path33 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path30 ? ` (${path30})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path33 ? ` (${path33})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -15956,7 +16961,7 @@ function createViewerServer(options = {}) {
         return sendJson(res, 200, {
           ok: true,
           readOnly: true,
-          traceDir: path23__default.default.resolve(traceDir)
+          traceDir: path24__default.default.resolve(traceDir)
         });
       }
       const td = new TraceDirectory({ dir: traceDir });
@@ -15974,7 +16979,7 @@ function createViewerServer(options = {}) {
             runId: meta2.runId,
             name: meta2.name,
             status: meta2.status,
-            file: path23__default.default.basename(meta2.filePath),
+            file: path24__default.default.basename(meta2.filePath),
             startedAt: meta2.startedAt,
             durationMs: meta2.durationMs
           }))
@@ -16089,7 +17094,7 @@ function startViewerServer(options = {}) {
       resolve({
         host,
         port: resolvedPort,
-        traceDir: path23__default.default.resolve(traceDir),
+        traceDir: path24__default.default.resolve(traceDir),
         url: `http://${host}:${resolvedPort}`
       });
     });
@@ -16294,10 +17299,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path30) {
-  return [{ runId: run.runId, ...path30 !== void 0 ? { path: path30 } : {} }];
+function evidenceForRun(run, path33) {
+  return [{ runId: run.runId, ...path33 !== void 0 ? { path: path33 } : {} }];
 }
-function evidenceForEvent(event, path30) {
+function evidenceForEvent(event, path33) {
   return [
     {
       runId: event.runId,
@@ -16305,7 +17310,7 @@ function evidenceForEvent(event, path30) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path30 !== void 0 ? { path: path30 } : {}
+      ...path33 !== void 0 ? { path: path33 } : {}
     }
   ];
 }
@@ -16463,9 +17468,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path30) {
+function firstEvidence(fields, run, path33) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path30) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path33) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -16842,8 +17847,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path30 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path30 ? ` (${path30})` : ""}`);
+      const path33 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path33 ? ` (${path33})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -16890,7 +17895,7 @@ function asConfig2(value) {
 }
 async function loadConfig2(configPath) {
   if (configPath === void 0) return {};
-  const extension = path23__default.default.extname(configPath);
+  const extension = path24__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS3.has(extension)) {
     throw new Error(
       "TypeScript eval configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -16899,7 +17904,7 @@ async function loadConfig2(configPath) {
   if (!CONFIG_EXTENSIONS3.has(extension)) {
     throw new Error("Unsupported eval config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path23__default.default.resolve(configPath);
+  const absolute = path24__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
     return asConfig2(JSON.parse(raw));
@@ -17036,8 +18041,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path30 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path30 ? ` (${path30})` : ""}`);
+    const path33 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path33 ? ` (${path33})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -17275,8 +18280,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path30 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path30 ? ` (${path30})` : ""}`);
+    const path33 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path33 ? ` (${path33})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -17427,8 +18432,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path30 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path30})`);
+    const path33 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path33})`);
   }
   for (const diagnostic7 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic7.code}: ${diagnostic7.message}`);
@@ -17506,8 +18511,8 @@ function renderHtml(trace, check, diff) {
 `;
 }
 async function writeArtifact(outputDir, relativePath, content, files) {
-  const outPath = path23__default.default.join(outputDir, relativePath);
-  await promises.mkdir(path23__default.default.dirname(outPath), { recursive: true });
+  const outPath = path24__default.default.join(outputDir, relativePath);
+  await promises.mkdir(path24__default.default.dirname(outPath), { recursive: true });
   await promises.writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -17523,7 +18528,7 @@ function manifestStatus(check, diff) {
   return "ok";
 }
 async function artifactsCommand(target, options = {}, stdin = process.stdin) {
-  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path23__default.default.resolve(options.outputDir.trim()) : "";
+  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path24__default.default.resolve(options.outputDir.trim()) : "";
   if (outputDir === "") {
     console.error("--output-dir is required.");
     process.exitCode = 1;
@@ -17589,8 +18594,8 @@ async function artifactsCommand(target, options = {}, stdin = process.stdin) {
   await writeArtifact(outputDir, "report.html", renderHtml(trace, check, diff), files);
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    await promises.mkdir(path23__default.default.dirname(path23__default.default.resolve(summaryTarget)), { recursive: true });
-    await promises.appendFile(path23__default.default.resolve(summaryTarget), `
+    await promises.mkdir(path24__default.default.dirname(path24__default.default.resolve(summaryTarget)), { recursive: true });
+    await promises.appendFile(path24__default.default.resolve(summaryTarget), `
 ${renderMarkdown(trace, check, diff)}`, "utf-8");
   }
   const manifestFiles = [...files, "manifest.json"].sort((a, b) => a.localeCompare(b));
@@ -17609,10 +18614,10 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
       findings: diff?.findings.length ?? 0,
       diagnostics: diff?.diagnostics.length ?? 0
     },
-    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path23__default.default.resolve(summaryTarget) } : {},
+    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path24__default.default.resolve(summaryTarget) } : {},
     note: NOTE
   };
-  await promises.writeFile(path23__default.default.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
+  await promises.writeFile(path24__default.default.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
   if (options.json === true) {
     console.log(writeJson3(manifest).trimEnd());
   } else {
@@ -17806,19 +18811,19 @@ function serializeWorkspaceManifest(manifest) {
 }
 var INDEX_DIR_NAME = "index";
 function resolveWorkspaceLocation(cwd = process.cwd()) {
-  const projectRoot = path23__default.default.resolve(cwd);
-  const workspaceDir = path23__default.default.join(projectRoot, WORKSPACE_DIR_NAME);
+  const projectRoot = path24__default.default.resolve(cwd);
+  const workspaceDir = path24__default.default.join(projectRoot, WORKSPACE_DIR_NAME);
   return {
     projectRoot,
     workspaceDir,
-    manifestPath: path23__default.default.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
+    manifestPath: path24__default.default.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
   };
 }
 function resolveInsideWorkspace(workspaceDir, relative) {
-  const base = path23__default.default.resolve(workspaceDir);
-  const resolved = path23__default.default.resolve(base, relative);
-  const rel = path23__default.default.relative(base, resolved);
-  if (rel === "" || rel === "." || !rel.startsWith("..") && !path23__default.default.isAbsolute(rel)) {
+  const base = path24__default.default.resolve(workspaceDir);
+  const resolved = path24__default.default.resolve(base, relative);
+  const rel = path24__default.default.relative(base, resolved);
+  if (rel === "" || rel === "." || !rel.startsWith("..") && !path24__default.default.isAbsolute(rel)) {
     return resolved;
   }
   throw new Error(
@@ -17887,7 +18892,7 @@ async function createWorkspace(options = {}) {
     created = false;
     adopted = true;
   } else {
-    const project = options.project?.trim() || path23__default.default.basename(location.projectRoot) || "workspace";
+    const project = options.project?.trim() || path24__default.default.basename(location.projectRoot) || "workspace";
     const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
     manifest = createDefaultWorkspaceManifest({
       project,
@@ -18026,7 +19031,7 @@ async function doctorWorkspace(location) {
     const abs = resolveInsideWorkspace(location.workspaceDir, rel);
     for (const file of await listJsonl(abs)) {
       try {
-        const s = await promises.stat(path23__default.default.join(abs, file));
+        const s = await promises.stat(path24__default.default.join(abs, file));
         newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
       } catch {
         checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
@@ -18074,7 +19079,7 @@ async function cleanWorkspace(location, manifest, options = {}) {
       const relPath = `${rel}/${entry}`;
       removed.push(relPath);
       if (!dryRun) {
-        await promises.rm(path23__default.default.join(abs, entry), { recursive: true, force: true });
+        await promises.rm(path24__default.default.join(abs, entry), { recursive: true, force: true });
       }
     }
   }
@@ -18120,8 +19125,8 @@ async function resolveOutputDir(options, runIds, cwd) {
       const location = resolveWorkspaceLocation(cwd);
       const manifest = await readWorkspaceManifestFile(location);
       if (manifest.ok && manifest.manifest) {
-        const rel = path23__default.default.relative(location.workspaceDir, normalized);
-        if (!rel.startsWith("..") && !path23__default.default.isAbsolute(rel)) {
+        const rel = path24__default.default.relative(location.workspaceDir, normalized);
+        if (!rel.startsWith("..") && !path24__default.default.isAbsolute(rel)) {
           return resolveInsideWorkspace(location.workspaceDir, rel);
         }
       }
@@ -18137,7 +19142,7 @@ async function resolveOutputDir(options, runIds, cwd) {
       const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
       return resolveInsideWorkspace(
         location.workspaceDir,
-        path23__default.default.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
+        path24__default.default.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
       );
     }
   } catch {
@@ -18145,8 +19150,8 @@ async function resolveOutputDir(options, runIds, cwd) {
   return defaultBundleOutputPath(runIds);
 }
 async function writeBundleFile(outputDir, relativePath, content, files) {
-  const outPath = path23__default.default.join(outputDir, relativePath);
-  await promises.mkdir(path23__default.default.dirname(outPath), { recursive: true });
+  const outPath = path24__default.default.join(outputDir, relativePath);
+  await promises.mkdir(path24__default.default.dirname(outPath), { recursive: true });
   await promises.writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -18372,7 +19377,7 @@ async function bundleCommand(runIdArg, options = {}) {
     files
   );
   metadata.files = [...files].sort((a, b) => a.localeCompare(b));
-  await promises.writeFile(path23__default.default.join(outputDir, "metadata.json"), writeJson4(metadata), "utf-8");
+  await promises.writeFile(path24__default.default.join(outputDir, "metadata.json"), writeJson4(metadata), "utf-8");
   if (options.json) {
     console.log(
       writeJson4({
@@ -18406,7 +19411,7 @@ ${body}
 `;
 }
 function validateReporterArtifactPath(options) {
-  const outputDir = path23__default.default.resolve(options.outputDir);
+  const outputDir = path24__default.default.resolve(options.outputDir);
   const diagnostics = [];
   const rawPath = options.relativePath;
   if (rawPath.length === 0) {
@@ -18426,7 +19431,7 @@ function validateReporterArtifactPath(options) {
     });
     return { ok: false, outputDir, diagnostics };
   }
-  if (path23__default.default.isAbsolute(rawPath) || path23__default.default.win32.isAbsolute(rawPath)) {
+  if (path24__default.default.isAbsolute(rawPath) || path24__default.default.win32.isAbsolute(rawPath)) {
     diagnostics.push({
       code: "artifact_path_absolute",
       severity: "error",
@@ -18435,7 +19440,7 @@ function validateReporterArtifactPath(options) {
     });
     return { ok: false, outputDir, diagnostics };
   }
-  const normalized = path23__default.default.posix.normalize(rawPath.replace(/\\/g, "/"));
+  const normalized = path24__default.default.posix.normalize(rawPath.replace(/\\/g, "/"));
   const segments = normalized.split("/");
   if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
     diagnostics.push({
@@ -18446,9 +19451,9 @@ function validateReporterArtifactPath(options) {
     });
     return { ok: false, outputDir, diagnostics };
   }
-  const absolutePath = path23__default.default.resolve(outputDir, normalized);
-  const relFromOutput = path23__default.default.relative(outputDir, absolutePath);
-  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path23__default.default.isAbsolute(relFromOutput)) {
+  const absolutePath = path24__default.default.resolve(outputDir, normalized);
+  const relFromOutput = path24__default.default.relative(outputDir, absolutePath);
+  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path24__default.default.isAbsolute(relFromOutput)) {
     diagnostics.push({
       code: "artifact_path_escape",
       severity: "error",
@@ -18594,23 +19599,23 @@ function readManifestDocument(value) {
   };
 }
 function cwdRelative(filePath) {
-  const relative = path23__default.default.relative(process.cwd(), path23__default.default.resolve(filePath)).replace(/\\/g, "/");
-  if (relative === "" || relative.startsWith("../") || path23__default.default.isAbsolute(relative)) {
-    return path23__default.default.basename(filePath);
+  const relative = path24__default.default.relative(process.cwd(), path24__default.default.resolve(filePath)).replace(/\\/g, "/");
+  if (relative === "" || relative.startsWith("../") || path24__default.default.isAbsolute(relative)) {
+    return path24__default.default.basename(filePath);
   }
   return relative;
 }
 async function readReporterManifest(filePath) {
-  const absolute = path23__default.default.resolve(filePath);
+  const absolute = path24__default.default.resolve(filePath);
   const raw = await promises.readFile(absolute, "utf-8");
   const document = readManifestDocument(JSON.parse(raw));
   const manifest = document.manifest;
   const results = manifest.results.map((result) => ({
     testId: safeText(result.testId),
     name: safeText(result.name),
-    ...result.file === void 0 ? {} : { file: safeText(path23__default.default.basename(result.file)) },
+    ...result.file === void 0 ? {} : { file: safeText(path24__default.default.basename(result.file)) },
     status: result.status,
-    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path23__default.default.basename(result.tracePath)) },
+    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path24__default.default.basename(result.tracePath)) },
     artifacts: result.artifacts,
     diagnostics: result.diagnostics
   }));
@@ -18749,15 +19754,15 @@ async function ciSummaryCommand(manifestPaths, options = {}) {
     return;
   }
   const markdown = renderMarkdown2(result);
-  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path23__default.default.resolve(options.output.trim()) : void 0;
+  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path24__default.default.resolve(options.output.trim()) : void 0;
   if (outputPath !== void 0) {
-    await promises.mkdir(path23__default.default.dirname(outputPath), { recursive: true });
+    await promises.mkdir(path24__default.default.dirname(outputPath), { recursive: true });
     await promises.writeFile(outputPath, markdown, "utf-8");
   }
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    const summaryPath = path23__default.default.resolve(summaryTarget);
-    await promises.mkdir(path23__default.default.dirname(summaryPath), { recursive: true });
+    const summaryPath = path24__default.default.resolve(summaryTarget);
+    await promises.mkdir(path24__default.default.dirname(summaryPath), { recursive: true });
     await promises.appendFile(summaryPath, `
 ${markdown}`, "utf-8");
   }
@@ -18905,8 +19910,8 @@ jobs:
 }
 async function planInit(options = {}) {
   const framework = normalizeFramework(options.framework);
-  const cwd = path23__default.default.resolve(options.cwd ?? process.cwd());
-  const demoPath = framework === "custom" ? path23__default.default.join("examples", "agent-inspect-demo.mjs") : path23__default.default.join("examples", `agent-inspect-${framework}-demo.mjs`);
+  const cwd = path24__default.default.resolve(options.cwd ?? process.cwd());
+  const demoPath = framework === "custom" ? path24__default.default.join("examples", "agent-inspect-demo.mjs") : path24__default.default.join("examples", `agent-inspect-${framework}-demo.mjs`);
   const candidates = [
     { rel: CONFIG_FILE, content: configTemplate(framework) },
     { rel: GITKEEP, content: "" },
@@ -18920,7 +19925,7 @@ async function planInit(options = {}) {
   }
   const files = [];
   for (const candidate of candidates) {
-    const abs = path23__default.default.join(cwd, candidate.rel);
+    const abs = path24__default.default.join(cwd, candidate.rel);
     try {
       await promises.access(abs);
       files.push({
@@ -18941,12 +19946,12 @@ async function writePlannedFiles(plan, cwd, options) {
     if (entry.action === "skip") {
       continue;
     }
-    const abs = path23__default.default.join(cwd, entry.path);
+    const abs = path24__default.default.join(cwd, entry.path);
     if (options.dryRun) {
       written.push(entry.path);
       continue;
     }
-    await promises.mkdir(path23__default.default.dirname(abs), { recursive: true });
+    await promises.mkdir(path24__default.default.dirname(abs), { recursive: true });
     const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
     await promises.writeFile(abs, content, "utf-8");
     written.push(entry.path);
@@ -18954,7 +19959,7 @@ async function writePlannedFiles(plan, cwd, options) {
   return written;
 }
 async function initCommand(options = {}) {
-  const cwd = path23__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path24__default.default.resolve(options.cwd ?? process.cwd());
   try {
     const plan = await planInit({ ...options, cwd });
     const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
@@ -19045,7 +20050,7 @@ function envCheck(name, optional = true) {
   };
 }
 async function traceDirWritable(traceDir) {
-  const resolved = path23__default.default.resolve(traceDir);
+  const resolved = path24__default.default.resolve(traceDir);
   try {
     await promises.mkdir(resolved, { recursive: true });
     await promises.access(resolved, promises.constants.W_OK);
@@ -19066,7 +20071,7 @@ async function traceDirWritable(traceDir) {
   }
 }
 function resolvePackage(cwd, name) {
-  const require2 = module$1.createRequire(path23__default.default.join(cwd, "package.json"));
+  const require2 = module$1.createRequire(path24__default.default.join(cwd, "package.json"));
   try {
     const pkgPath = require2.resolve(`${name}/package.json`);
     const pkg = require2(pkgPath);
@@ -19077,7 +20082,7 @@ function resolvePackage(cwd, name) {
 }
 function importSmoke(cwd) {
   const results = [];
-  const require2 = module$1.createRequire(path23__default.default.join(cwd, "package.json"));
+  const require2 = module$1.createRequire(path24__default.default.join(cwd, "package.json"));
   try {
     require2.resolve("agent-inspect");
     results.push({
@@ -19160,7 +20165,7 @@ function versionMismatchCheck(cwd) {
   };
 }
 async function runDoctorChecks(options = {}) {
-  const cwd = path23__default.default.resolve(options.cwd ?? process3__default.default.cwd());
+  const cwd = path24__default.default.resolve(options.cwd ?? process3__default.default.cwd());
   const traceDir = options.traceDir?.trim() || process3__default.default.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
   const checks2 = [
     nodeVersionCheck(),
@@ -19274,7 +20279,7 @@ function createTraceDirectoryIndexer() {
 init_advanced();
 var INDEX_FILENAME = ".agent-inspect-index.json";
 function traceIndexPath(traceDir) {
-  return path23__default.default.join(traceDir, INDEX_FILENAME);
+  return path24__default.default.join(traceDir, INDEX_FILENAME);
 }
 function parseMaxEntries(raw) {
   if (raw === void 0 || raw.trim() === "") return void 0;
@@ -19420,7 +20425,7 @@ async function newestTraceMtimeMs2(traceDir) {
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
       try {
-        const s = await promises.stat(path23__default.default.join(traceDir, file));
+        const s = await promises.stat(path24__default.default.join(traceDir, file));
         if (s.mtimeMs > newest) newest = s.mtimeMs;
       } catch {
       }
@@ -19675,11 +20680,11 @@ function printJson5(value) {
   console.log(JSON.stringify(value, null, 2));
 }
 function resolveCwd(options) {
-  return path23__default.default.resolve(options.cwd ?? process.cwd());
+  return path24__default.default.resolve(options.cwd ?? process.cwd());
 }
 async function suiteInitCommand(options = {}) {
   const cwd = resolveCwd(options);
-  const configPath = path23__default.default.join(cwd, DEFAULT_CONFIG_FILENAME);
+  const configPath = path24__default.default.join(cwd, DEFAULT_CONFIG_FILENAME);
   const template = defaultSuiteConfigTemplate();
   if (options.dryRun) {
     if (options.json) {
@@ -19789,13 +20794,13 @@ async function suiteListCommand(options = {}) {
 }
 async function writeSuiteArtifact(result, configOutputDir, options) {
   const cwd = resolveCwd(options);
-  const outputDir = path23__default.default.resolve(
+  const outputDir = path24__default.default.resolve(
     cwd,
     options.output ?? configOutputDir ?? DEFAULT_SUITE_ARTIFACTS_DIR
   );
   await promises.mkdir(outputDir, { recursive: true });
   const stamp = result.startedAt.replace(/[:.]/g, "-");
-  const filePath = path23__default.default.join(outputDir, `${result.suiteName}-${stamp}.json`);
+  const filePath = path24__default.default.join(outputDir, `${result.suiteName}-${stamp}.json`);
   await promises.writeFile(filePath, `${JSON.stringify(result, null, 2)}
 `, "utf-8");
   return filePath;
@@ -19853,7 +20858,7 @@ async function loadSuiteResultFromInput(options) {
   if (options.input === void 0 || options.input.trim() === "") {
     throw new Error("Pass --input <suite-run.json> from a prior suite run.");
   }
-  const inputPath = path23__default.default.resolve(cwd, options.input.trim());
+  const inputPath = path24__default.default.resolve(cwd, options.input.trim());
   const raw = await promises.readFile(inputPath, "utf-8");
   return JSON.parse(raw);
 }
@@ -19878,6 +20883,217 @@ async function suiteReportCommand(options = {}) {
   }
 }
 
+// packages/cli/src/cohort.ts
+init_advanced();
+function normalizeMetrics2(raw) {
+  const parsed = parseCohortMetricList(raw);
+  if (parsed.length === 0) return void 0;
+  const allowed = new Set(COHORT_METRIC_IDS);
+  return parsed.filter(
+    (item) => allowed.has(item)
+  );
+}
+async function writeArtifacts(result, outputDir) {
+  await promises.mkdir(outputDir, { recursive: true });
+  const jsonPath = path24__default.default.join(outputDir, "cohort-results.json");
+  const markdownPath = path24__default.default.join(outputDir, "cohort-summary.md");
+  const htmlPath = path24__default.default.join(outputDir, "cohort-report.html");
+  await promises.writeFile(jsonPath, `${renderCohortReport(result, { format: "json" })}
+`, "utf-8");
+  await promises.writeFile(
+    markdownPath,
+    `${renderCohortReport(result, { format: "markdown" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(htmlPath, `${renderCohortReport(result, { format: "html" })}
+`, "utf-8");
+  return { jsonPath, markdownPath, htmlPath };
+}
+async function cohortCommand(options = {}) {
+  try {
+    const traceDir = resolveTraceDir({ dir: options.dir });
+    const { runs } = await loadSessionRuns(traceDir);
+    const result = await analyzeCohort(runs, {
+      traceDir,
+      baseline: options.baseline,
+      candidate: options.candidate,
+      cohortKey: options.cohortKey,
+      groupBy: options.groupBy,
+      metrics: normalizeMetrics2(options.metric)
+    });
+    const format = options.format ?? (options.json ? "json" : "markdown");
+    let artifacts;
+    if (options.output !== void 0 && options.output.trim() !== "") {
+      artifacts = await writeArtifacts(result, path24__default.default.resolve(options.output.trim()));
+    }
+    if (options.json || format === "json") {
+      console.log(
+        JSON.stringify(
+          {
+            ...result,
+            artifacts: artifacts ?? null
+          },
+          null,
+          2
+        )
+      );
+    } else if (format === "html") {
+      console.log(renderCohortReport(result, { format: "html" }));
+      if (artifacts !== void 0) {
+        console.error(`Artifacts written to ${options.output}`);
+      }
+    } else {
+      console.log(renderCohortReport(result, { format: "markdown" }));
+      if (artifacts !== void 0) {
+        console.log("");
+        console.log(`Artifacts:`);
+        console.log(`- ${artifacts.jsonPath}`);
+        console.log(`- ${artifacts.markdownPath}`);
+        console.log(`- ${artifacts.htmlPath}`);
+      }
+    }
+    if (!result.ok) process.exitCode = 1;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json) {
+      console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+    } else {
+      console.error(`[AgentInspect] cohort failed: ${message}`);
+    }
+    process.exitCode = 1;
+  }
+}
+
+// packages/cli/src/gate.ts
+init_advanced();
+var SUPPORTED_FORMATS = /* @__PURE__ */ new Set(["markdown", "json", "html", "junit", "github"]);
+function collectList(value) {
+  if (value === void 0) return [];
+  const items = Array.isArray(value) ? value : [value];
+  return items.flatMap((item) => parseGateList(item));
+}
+function parseRate(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`Invalid --max-error-rate: ${value}`);
+  }
+  return parsed;
+}
+function parseDuration2(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`Invalid --max-p95-duration: ${value}`);
+  }
+  return parsed;
+}
+async function writeArtifacts2(result, outputDir) {
+  await promises.mkdir(outputDir, { recursive: true });
+  const paths = {
+    jsonPath: path24__default.default.join(outputDir, "gate-results.json"),
+    markdownPath: path24__default.default.join(outputDir, "gate-summary.md"),
+    htmlPath: path24__default.default.join(outputDir, "gate-report.html"),
+    junitPath: path24__default.default.join(outputDir, "junit.xml"),
+    githubPath: path24__default.default.join(outputDir, "github-step-summary.md")
+  };
+  await promises.writeFile(
+    paths.jsonPath,
+    `${renderGateReport(result, { format: "json" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(
+    paths.markdownPath,
+    `${renderGateReport(result, { format: "markdown" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(
+    paths.htmlPath,
+    `${renderGateReport(result, { format: "html" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(
+    paths.junitPath,
+    `${renderGateReport(result, { format: "junit" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(
+    paths.githubPath,
+    `${renderGateReport(result, { format: "github" })}
+`,
+    "utf-8"
+  );
+  return paths;
+}
+async function gateCommand(options = {}) {
+  try {
+    const format = options.format ?? (options.json ? "json" : "markdown");
+    if (!SUPPORTED_FORMATS.has(format)) {
+      if (options.json) {
+        console.log(
+          JSON.stringify({ ok: false, exitCode: 4, error: `Unsupported format: ${format}` }, null, 2)
+        );
+      } else {
+        console.error(`[AgentInspect] Unsupported format: ${format}`);
+      }
+      process.exitCode = 4;
+      return;
+    }
+    const gateOptions = {
+      ...options.dir !== void 0 ? { traceDir: resolveTraceDir({ dir: options.dir }) } : {},
+      ...options.suite !== void 0 ? { suitePath: options.suite } : {},
+      ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
+      ...parseRate(options.maxErrorRate) !== void 0 ? { maxErrorRate: parseRate(options.maxErrorRate) } : {},
+      ...parseDuration2(options.maxP95Duration) !== void 0 ? { maxP95DurationMs: parseDuration2(options.maxP95Duration) } : {},
+      forbidTools: collectList(options.forbidTool),
+      requireObservations: collectList(options.requireObservation)
+    };
+    let runs = [];
+    const needsRuns = gateHasThresholds(gateOptions) || gateOptions.traceDir !== void 0 && gateOptions.suitePath === void 0;
+    if (needsRuns) {
+      const traceDir = gateOptions.traceDir ?? resolveTraceDir({ dir: options.dir });
+      const loaded = await loadSessionRuns(traceDir);
+      runs = loaded.runs;
+      gateOptions.traceDir = traceDir;
+    }
+    const result = await runGate(runs, gateOptions);
+    let artifacts;
+    if (options.output !== void 0 && options.output.trim() !== "") {
+      artifacts = await writeArtifacts2(result, path24__default.default.resolve(options.output.trim()));
+    }
+    if (options.json || format === "json") {
+      console.log(JSON.stringify({ ...result, artifacts: artifacts ?? null }, null, 2));
+    } else if (format === "html") {
+      console.log(renderGateReport(result, { format: "html" }));
+    } else if (format === "junit") {
+      console.log(renderGateReport(result, { format: "junit" }));
+    } else if (format === "github") {
+      console.log(renderGateReport(result, { format: "github" }));
+    } else {
+      console.log(renderGateReport(result, { format: "markdown" }));
+      if (artifacts !== void 0) {
+        console.log("");
+        console.log("Artifacts:");
+        for (const value of Object.values(artifacts)) console.log(`- ${value}`);
+      }
+    }
+    process.exitCode = result.exitCode;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json) {
+      console.log(JSON.stringify({ ok: false, exitCode: 2, error: message }, null, 2));
+    } else {
+      console.error(`[AgentInspect] gate failed: ${message}`);
+    }
+    process.exitCode = 2;
+  }
+}
+
 // packages/cli/src/index.ts
 function runCommand(action) {
   void action().catch((error) => {
@@ -20311,6 +21527,21 @@ function createCliProgram() {
   suiteCmd.command("report").description("Render a report from a prior suite run artifact").option("--input <path>", "suite run JSON artifact").option("--format <format>", "markdown or json", "markdown").option("--json", "print JSON wrapper").action((opts) => {
     runCommand(() => suiteReportCommand(opts));
   });
+  program.command("cohort").description("Compare baseline/candidate trace cohorts for regressions (v5.1+)").option("--dir <path>", "trace directory").option("--baseline <label>", "baseline cohort label (metadata key)").option("--candidate <label>", "candidate cohort label (metadata key)").option("--cohort-key <key>", "metadata key for cohort labels", "cohort").option("--group-by <spec>", "model | session | group | metadata.<key>", "model").option(
+    "--metric <list>",
+    "comma-separated metrics (errorRate,duration,toolChoice,...)"
+  ).option("--format <format>", "markdown, json, or html", "markdown").option("-o, --output <dir>", "write cohort-results.json, cohort-summary.md, cohort-report.html").option("--json", "print deterministic JSON result").action((opts) => {
+    runCommand(() => cohortCommand(opts));
+  });
+  program.command("gate").description("Run deterministic CI quality gates over traces or suites (v5.2+)").option("--dir <path>", "trace directory for threshold checks").option("--suite <path>", "suite config path").option("--max-error-rate <percent>", "maximum allowed error rate percentage").option("--max-p95-duration <ms>", "maximum allowed p95 run duration in ms").option("--forbid-tool <name>", "forbidden tool name (repeatable or comma-separated)").option(
+    "--require-observation <name>",
+    "required passed observation (repeatable or comma-separated)"
+  ).option("--format <format>", "markdown, json, html, junit, or github", "markdown").option(
+    "-o, --output <dir>",
+    "write gate-results.json, gate-summary.md, gate-report.html, junit.xml, github-step-summary.md"
+  ).option("--json", "print deterministic JSON result").action((opts) => {
+    runCommand(() => gateCommand(opts));
+  });
   return program;
 }
 function isPrimaryModule() {
@@ -20318,9 +21549,9 @@ function isPrimaryModule() {
   if (!entry) return false;
   const selfPath = url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
   try {
-    return fs.realpathSync(path23__default.default.resolve(entry)) === fs.realpathSync(path23__default.default.resolve(selfPath));
+    return fs.realpathSync(path24__default.default.resolve(entry)) === fs.realpathSync(path24__default.default.resolve(selfPath));
   } catch {
-    return path23__default.default.resolve(entry) === path23__default.default.resolve(selfPath);
+    return path24__default.default.resolve(entry) === path24__default.default.resolve(selfPath);
   }
 }
 if (isPrimaryModule()) {