agent-inspect 5.1.0 → 5.2.0

package/packages/cli/dist/index.cjs

@@ -4,7 +4,7 @@
 var crypto = require('crypto');
 var promises = require('fs/promises');
 var os = require('os');
-var path23 = require('path');
+var path24 = require('path');
 var async_hooks = require('async_hooks');
 var process3 = require('process');
 var tty = require('tty');
@@ -20,7 +20,7 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var os__default = /*#__PURE__*/_interopDefault(os);
-var path23__default = /*#__PURE__*/_interopDefault(path23);
+var path24__default = /*#__PURE__*/_interopDefault(path24);
 var process3__default = /*#__PURE__*/_interopDefault(process3);
 var tty__default = /*#__PURE__*/_interopDefault(tty);
 
@@ -893,7 +893,7 @@ function getDefaultTraceDir() {
     if (typeof home !== "string" || home.trim() === "") {
       return FALLBACK_TRACE_DIR;
     }
-    return path23__default.default.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
+    return path24__default.default.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
   } catch {
     return FALLBACK_TRACE_DIR;
   }
@@ -901,11 +901,11 @@ function getDefaultTraceDir() {
 function getTraceFilePath(runId, traceDir) {
   const baseDir = traceDir ?? getDefaultTraceDir();
   let safeId = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
-  safeId = path23__default.default.basename(safeId);
+  safeId = path24__default.default.basename(safeId);
   if (safeId === "" || safeId === "." || safeId === "..") {
     safeId = "run_unknown";
   }
-  return path23__default.default.join(baseDir, `${safeId}.jsonl`);
+  return path24__default.default.join(baseDir, `${safeId}.jsonl`);
 }
 function formatError(error) {
   if (error instanceof Error) {
@@ -962,7 +962,7 @@ var init_utils = __esm({
     init_duration();
     DEFAULT_TRACE_DIR_NAME = ".agent-inspect";
     RUNS_DIR_NAME = "runs";
-    FALLBACK_TRACE_DIR = path23__default.default.join(
+    FALLBACK_TRACE_DIR = path24__default.default.join(
       os__default.default.tmpdir(),
       "agent-inspect",
       RUNS_DIR_NAME
@@ -1928,7 +1928,7 @@ var init_trace_directory = __esm({
         this.#dir = resolveTraceDir(options);
       }
       getPath(filename) {
-        return filename ? path23__default.default.join(this.#dir, filename) : this.#dir;
+        return filename ? path24__default.default.join(this.#dir, filename) : this.#dir;
       }
       async list() {
         try {
@@ -1957,7 +1957,7 @@ function parseIsoToMs2(value) {
 }
 async function extractMetadata(filePath, _quickScan) {
   const stats = await promises.stat(filePath);
-  let runIdFromFile = path23__default.default.basename(filePath);
+  let runIdFromFile = path24__default.default.basename(filePath);
   if (runIdFromFile.endsWith(".jsonl")) {
     runIdFromFile = runIdFromFile.slice(0, -".jsonl".length);
   }
@@ -2942,9 +2942,9 @@ async function searchTraces(metas, options) {
   }
   const limit = options.limit ?? 50;
   const sessionId = options.session?.trim();
-  const observationStatus = parseObservationFilter(options.observation);
+  const observationStatus2 = parseObservationFilter(options.observation);
   const hasContentFilter = Boolean(
-    options.status || stepTypeFilter || nameQuery || toolQuery || durationFilter || observationStatus
+    options.status || stepTypeFilter || nameQuery || toolQuery || durationFilter || observationStatus2
   );
   const results = [];
   const sessionLabel = sessionId && sessionId !== "" ? sessionId : void 0;
@@ -2989,9 +2989,9 @@ async function searchTraces(metas, options) {
       statusFilter: options.status
     });
     results.push(...stepMatches);
-    if (observationStatus) {
+    if (observationStatus2) {
       const outcomes = extractOutcomesFromTraceEvents(events);
-      const matched = outcomes.filter((outcome) => outcome.status === observationStatus);
+      const matched = outcomes.filter((outcome) => outcome.status === observationStatus2);
       for (const outcome of matched) {
         results.push({
           runId: m.runId,
@@ -3786,12 +3786,12 @@ function buildCriticalPath(runs, handoffs) {
     handoffs.filter((edge) => edge.confidence === "explicit").map((edge) => edge.from)
   );
   const ordered = [...runs].sort(compareRuns);
-  const path31 = [];
+  const path33 = [];
   const visited = /* @__PURE__ */ new Set();
   const pushRun = (run, confidence, source) => {
     if (visited.has(run.runId)) return;
     visited.add(run.runId);
-    path31.push({
+    path33.push({
       runId: run.runId,
       name: run.name,
       startedAt: run.startedAt,
@@ -3816,7 +3816,7 @@ function buildCriticalPath(runs, handoffs) {
     const confidence = explicitTargets.has(run.runId) || explicitSources.has(run.runId) ? "explicit" : "correlated";
     pushRun(run, confidence, confidence === "explicit" ? "manual" : "inferred");
   }
-  return path31;
+  return path33;
 }
 function metaRunIdMatches(run, token, runById) {
   const meta2 = extractSessionWorkflowMetadata(run.metadata);
@@ -4147,7 +4147,7 @@ function normalizeBundleOutputPath(out) {
   if (trimmed === "") {
     throw new Error("--out requires a non-empty path.");
   }
-  const resolved = path23__default.default.resolve(trimmed);
+  const resolved = path24__default.default.resolve(trimmed);
   if (resolved.toLowerCase().endsWith(".zip")) {
     return resolved.slice(0, -4);
   }
@@ -4156,7 +4156,7 @@ function normalizeBundleOutputPath(out) {
 function defaultBundleOutputPath(runIds) {
   const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  return path23__default.default.resolve(`agent-inspect-bundle-${label}-${stamp}`);
+  return path24__default.default.resolve(`agent-inspect-bundle-${label}-${stamp}`);
 }
 var init_paths = __esm({
   "packages/core/src/bundle/paths.ts"() {
@@ -4330,7 +4330,7 @@ function normalizeSuiteConfig(value) {
 }
 async function validateSuiteConfig(config, options) {
   const diagnostics = [];
-  const tracesDir = path23__default.default.resolve(options.configDir, config.traces);
+  const tracesDir = path24__default.default.resolve(options.configDir, config.traces);
   try {
     await promises.access(tracesDir);
   } catch {
@@ -4340,7 +4340,7 @@ async function validateSuiteConfig(config, options) {
   }
   for (const suiteCase of config.cases) {
     if (suiteCase.input !== void 0) {
-      const inputPath = path23__default.default.resolve(options.configDir, suiteCase.input);
+      const inputPath = path24__default.default.resolve(options.configDir, suiteCase.input);
       try {
         await promises.access(inputPath);
       } catch {
@@ -4373,12 +4373,12 @@ async function fileExists(filePath) {
   }
 }
 async function resolveSuiteConfigPath(options = {}) {
-  const cwd = path23__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path24__default.default.resolve(options.cwd ?? process.cwd());
   if (options.configPath !== void 0 && options.configPath.trim() !== "") {
-    return path23__default.default.resolve(cwd, options.configPath.trim());
+    return path24__default.default.resolve(cwd, options.configPath.trim());
   }
   for (const name of DEFAULT_SUITE_CONFIG_NAMES) {
-    const candidate = path23__default.default.join(cwd, name);
+    const candidate = path24__default.default.join(cwd, name);
     if (await fileExists(candidate)) return candidate;
   }
   throw new Error(
@@ -4395,7 +4395,7 @@ async function loadSuiteConfig(options = {}) {
       diagnostics: [diagnostic2("AI_SUITE_CONFIG_LOAD_FAILED", message)]
     });
   }
-  const extension = path23__default.default.extname(configPath);
+  const extension = path24__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
     const message = "TypeScript suite configs require an explicit precompiled JavaScript config or future --config-loader support.";
     throw Object.assign(new Error(message), {
@@ -4420,7 +4420,7 @@ async function loadSuiteConfig(options = {}) {
     return {
       config,
       configPath,
-      configDir: path23__default.default.dirname(configPath)
+      configDir: path24__default.default.dirname(configPath)
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -4470,7 +4470,7 @@ async function exists(filePath) {
 }
 async function resolveSuiteCaseTrace(suiteCase, options) {
   if (suiteCase.trace !== void 0) {
-    const tracePath = path23__default.default.resolve(options.configDir, suiteCase.trace);
+    const tracePath = path24__default.default.resolve(options.configDir, suiteCase.trace);
     if (await exists(tracePath)) {
       return { caseId: suiteCase.id, tracePath, missing: false };
     }
@@ -4486,7 +4486,7 @@ async function resolveSuiteCaseTrace(suiteCase, options) {
   if (await exists(directPath)) {
     return { caseId: suiteCase.id, tracePath: directPath, runId: runKey, missing: false };
   }
-  const nestedPath = path23__default.default.join(options.tracesDir, `${path23__default.default.basename(runKey)}.jsonl`);
+  const nestedPath = path24__default.default.join(options.tracesDir, `${path24__default.default.basename(runKey)}.jsonl`);
   if (await exists(nestedPath)) {
     return { caseId: suiteCase.id, tracePath: nestedPath, runId: runKey, missing: false };
   }
@@ -4716,7 +4716,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path31) {
+function eventEvidence(event, path33) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -4726,7 +4726,7 @@ function eventEvidence(event, path31) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path31 ? { path: path31 } : {}
+    ...path33 ? { path: path33 } : {}
   };
 }
 function runEvidence(run) {
@@ -4789,9 +4789,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path31) {
-  const parts = path31.split(".");
-  return parts[parts.length - 1] ?? path31;
+function lastPathSegment(path33) {
+  const parts = path33.split(".");
+  return parts[parts.length - 1] ?? path33;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -4805,12 +4805,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path31, key, depth = 0) {
-  entries.push({ event, path: path31, key, value });
+function pushValueEntries(entries, event, value, path33, key, depth = 0) {
+  entries.push({ event, path: path33, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path31}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path33}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -4820,7 +4820,7 @@ function pushValueEntries(entries, event, value, path31, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path31}.${nestedKey}`,
+      `${path33}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -4901,9 +4901,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path31) => {
-    lines.push(`${path31}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path31}.${index}`));
+  const visit = (node, path33) => {
+    lines.push(`${path33}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path33}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -4952,9 +4952,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path31) {
+function firstEvidenceForKind(context, kind, path33) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path31)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path33)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -5304,13 +5304,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path31 = [];
+        const path33 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path31.slice(existing);
+            const cycle = path33.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -5326,8 +5326,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path31.length);
-          path31.push(current);
+          seenAt.set(current.eventId, path33.length);
+          path33.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -6468,7 +6468,7 @@ function findReaderByFormat(format, readers) {
 }
 async function jsonlFilesInDirectory(dirPath) {
   const entries = await promises.readdir(dirPath, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path23__default.default.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path24__default.default.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
 }
 async function resolveInput(input3) {
   const cached = resolvedInputCache.get(input3);
@@ -8167,7 +8167,7 @@ async function runSuiteCase(suiteCase, config, options) {
 async function runSuite(options = {}) {
   const startedAt = new Date(options.nowMs ?? Date.now()).toISOString();
   const { config, configPath, configDir } = await loadSuiteConfig(options);
-  const tracesDir = path23__default.default.resolve(configDir, config.traces);
+  const tracesDir = path24__default.default.resolve(configDir, config.traces);
   const cases = [];
   const diagnostics = [];
   for (const suiteCase of config.cases) {
@@ -8951,6 +8951,426 @@ var init_cohort2 = __esm({
   }
 });
 
+// packages/core/src/gate/parse.ts
+function parseGateList(value) {
+  if (value === void 0 || value.trim() === "") return [];
+  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
+var init_parse = __esm({
+  "packages/core/src/gate/parse.ts"() {
+  }
+});
+
+// packages/core/src/gate/evaluate.ts
+function percentile3(values, p) {
+  if (values.length === 0) return void 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const idx = Math.min(
+    sorted.length - 1,
+    Math.max(0, Math.ceil(p / 100 * sorted.length) - 1)
+  );
+  return sorted[idx];
+}
+function hasThresholds(options) {
+  return options.maxErrorRate !== void 0 || options.maxP95DurationMs !== void 0 || (options.forbidTools?.length ?? 0) > 0 || (options.requireObservations?.length ?? 0) > 0;
+}
+function gateHasThresholds(options) {
+  return hasThresholds(options);
+}
+async function loadRunMetrics(runs) {
+  const metrics = [];
+  for (const run of runs) {
+    if (run.filePath === void 0) continue;
+    metrics.push(
+      await computeCohortRunMetrics({
+        runId: run.runId,
+        filePath: run.filePath,
+        metadata: run.metadata,
+        status: run.status,
+        durationMs: run.durationMs,
+        groupKey: "all"
+      })
+    );
+  }
+  return metrics;
+}
+async function observationStatus(filePath, name) {
+  const events = await readTraceEventsFromFile(filePath);
+  const outcomes = extractOutcomesFromTraceEvents(events);
+  const match = outcomes.find((item) => item.name === name);
+  if (!match) return "missing";
+  return match.status === "passed" ? "passed" : "failed";
+}
+async function evaluateGateThresholds(runs, options) {
+  const checks2 = [];
+  const readErrors = [];
+  if (!hasThresholds(options)) {
+    return { checks: checks2, readErrors };
+  }
+  if (runs.length === 0) {
+    readErrors.push("No trace runs found in the gate directory.");
+    return { checks: checks2, readErrors };
+  }
+  let runMetrics;
+  try {
+    runMetrics = await loadRunMetrics(runs);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    readErrors.push(message);
+    return { checks: checks2, readErrors };
+  }
+  if (options.maxErrorRate !== void 0) {
+    const errors = runMetrics.filter((run) => run.error).length;
+    const actual = runMetrics.length > 0 ? errors / runMetrics.length * 100 : 0;
+    const ok = actual <= options.maxErrorRate;
+    checks2.push({
+      id: "maxErrorRate",
+      name: "Max error rate",
+      ok,
+      expected: options.maxErrorRate,
+      actual: Math.round(actual * 10) / 10,
+      message: ok ? `Error rate ${actual.toFixed(1)}% within limit ${options.maxErrorRate}%` : `Error rate ${actual.toFixed(1)}% exceeds limit ${options.maxErrorRate}%`
+    });
+  }
+  if (options.maxP95DurationMs !== void 0) {
+    const durations = runMetrics.map((run) => run.durationMs).filter((value) => typeof value === "number");
+    const actual = percentile3(durations, 95);
+    const ok = actual !== void 0 && actual <= options.maxP95DurationMs;
+    checks2.push({
+      id: "maxP95Duration",
+      name: "Max p95 duration (ms)",
+      ok,
+      expected: options.maxP95DurationMs,
+      actual: actual ?? "n/a",
+      message: actual === void 0 ? "No duration samples available for p95 check." : ok ? `P95 duration ${Math.round(actual)} ms within limit ${options.maxP95DurationMs} ms` : `P95 duration ${Math.round(actual)} ms exceeds limit ${options.maxP95DurationMs} ms`
+    });
+  }
+  for (const tool of options.forbidTools ?? []) {
+    let violated = false;
+    for (const run of runMetrics) {
+      const used = run.toolChoices.includes(tool) || run.toolOrdering.includes(tool);
+      if (used) {
+        violated = true;
+        checks2.push({
+          id: "forbidTool",
+          name: `Forbid tool: ${tool}`,
+          ok: false,
+          expected: `not used`,
+          actual: "used",
+          runId: run.runId,
+          message: `Forbidden tool "${tool}" used in run ${run.runId}`
+        });
+      }
+    }
+    if (!violated) {
+      checks2.push({
+        id: "forbidTool",
+        name: `Forbid tool: ${tool}`,
+        ok: true,
+        message: `Forbidden tool "${tool}" not used`
+      });
+    }
+  }
+  for (const observation of options.requireObservations ?? []) {
+    for (const run of runs) {
+      if (run.filePath === void 0) continue;
+      try {
+        const status = await observationStatus(run.filePath, observation);
+        const ok = status === "passed";
+        checks2.push({
+          id: "requireObservation",
+          name: `Require observation: ${observation}`,
+          ok,
+          expected: "passed",
+          actual: status,
+          runId: run.runId,
+          message: ok ? `Observation "${observation}" passed in run ${run.runId}` : status === "missing" ? `Observation "${observation}" missing in run ${run.runId}` : `Observation "${observation}" failed in run ${run.runId}`
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        readErrors.push(`Run ${run.runId}: ${message}`);
+      }
+    }
+  }
+  return { checks: checks2, readErrors };
+}
+function checksFromSuiteResult(suiteResult) {
+  const checks2 = [
+    {
+      id: "suite",
+      name: `Suite: ${suiteResult.suiteName}`,
+      ok: suiteResult.ok,
+      message: suiteResult.ok ? `Suite passed (${suiteResult.summary.passed} cases)` : `Suite failed (${suiteResult.summary.failed} failed, ${suiteResult.summary.errors} errors)`
+    }
+  ];
+  for (const suiteCase of suiteResult.cases) {
+    if (suiteCase.status === "pass") continue;
+    checks2.push({
+      id: "suite",
+      name: `Case: ${suiteCase.id}`,
+      ok: false,
+      message: suiteCase.message ?? `Case status: ${suiteCase.status}`
+    });
+  }
+  return checks2;
+}
+var init_evaluate = __esm({
+  "packages/core/src/gate/evaluate.ts"() {
+    init_extract();
+    init_storage();
+    init_metrics();
+  }
+});
+function resolveExitCode(input3) {
+  if (input3.configError) return 2;
+  if (input3.readError) return 3;
+  if (!input3.ok) return 1;
+  return 0;
+}
+function validateOptions(options) {
+  const errors = [];
+  const hasSuite = options.suitePath !== void 0 && options.suitePath.trim() !== "";
+  const hasThresholds2 = gateHasThresholds(options);
+  if (!hasSuite && !hasThresholds2) {
+    errors.push(
+      "No gate rules specified. Pass --suite or at least one threshold flag."
+    );
+  }
+  if (hasThresholds2 && (options.traceDir === void 0 || options.traceDir.trim() === "")) {
+    if (!hasSuite) {
+      errors.push("Threshold flags require --dir <trace-directory>.");
+    }
+  }
+  if (options.maxErrorRate !== void 0 && options.maxErrorRate < 0) {
+    errors.push("--max-error-rate must be a non-negative percentage.");
+  }
+  if (options.maxP95DurationMs !== void 0 && options.maxP95DurationMs < 0) {
+    errors.push("--max-p95-duration must be a non-negative millisecond value.");
+  }
+  return errors;
+}
+function isConfigLoadError(error) {
+  if (!(error instanceof Error)) return false;
+  const ext = path24__default.default.extname(error.message);
+  if (error.message.includes("Unsupported suite config extension")) return true;
+  if (error.message.includes("TypeScript suite configs require")) return true;
+  if (error.message.includes("No suite config found")) return true;
+  if (error.message.includes("AI_SUITE_CONFIG")) return true;
+  if (ext === ".ts" || ext === ".mts" || ext === ".cts") return true;
+  return "diagnostics" in error;
+}
+async function runGate(runs, options) {
+  const diagnostics = [];
+  const checks2 = [];
+  const validationErrors = validateOptions(options);
+  if (validationErrors.length > 0) {
+    return {
+      ok: false,
+      exitCode: 2,
+      runCount: 0,
+      checks: checks2,
+      diagnostics: validationErrors
+    };
+  }
+  let traceDir = options.traceDir?.trim();
+  let suiteResult;
+  if (options.suitePath !== void 0 && options.suitePath.trim() !== "") {
+    try {
+      suiteResult = await runSuite({
+        configPath: options.suitePath,
+        cwd: options.cwd
+      });
+      traceDir = traceDir ?? suiteResult.tracesDir;
+      checks2.push(...checksFromSuiteResult(suiteResult));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      diagnostics.push(message);
+      return {
+        ok: false,
+        exitCode: isConfigLoadError(error) ? 2 : 3,
+        traceDir,
+        suitePath: options.suitePath,
+        runCount: 0,
+        checks: checks2,
+        diagnostics
+      };
+    }
+  }
+  if (gateHasThresholds(options)) {
+    const thresholdDir = traceDir;
+    if (thresholdDir === void 0 || thresholdDir.trim() === "") {
+      return {
+        ok: false,
+        exitCode: 2,
+        traceDir,
+        suitePath: options.suitePath,
+        runCount: runs.length,
+        checks: checks2,
+        diagnostics: ["Threshold evaluation requires a trace directory."],
+        ...suiteResult !== void 0 ? { suiteResult } : {}
+      };
+    }
+    const thresholdRuns = runs.length > 0 ? runs : [];
+    const { checks: thresholdChecks, readErrors } = await evaluateGateThresholds(
+      thresholdRuns,
+      options
+    );
+    checks2.push(...thresholdChecks);
+    diagnostics.push(...readErrors);
+    if (readErrors.length > 0) {
+      const ok2 = checks2.length > 0 && checks2.every((item) => item.ok);
+      return {
+        ok: ok2,
+        exitCode: resolveExitCode({
+          ok: ok2,
+          configError: false,
+          readError: true
+        }),
+        traceDir: thresholdDir,
+        suitePath: options.suitePath,
+        runCount: thresholdRuns.length,
+        checks: checks2,
+        diagnostics,
+        ...suiteResult !== void 0 ? { suiteResult } : {}
+      };
+    }
+  }
+  const ok = checks2.length > 0 && checks2.every((item) => item.ok);
+  return {
+    ok,
+    exitCode: resolveExitCode({ ok, configError: false, readError: false }),
+    traceDir,
+    suitePath: options.suitePath,
+    runCount: runs.length,
+    checks: checks2,
+    diagnostics,
+    ...suiteResult !== void 0 ? { suiteResult } : {}
+  };
+}
+var init_run2 = __esm({
+  "packages/core/src/gate/run.ts"() {
+    init_run();
+    init_evaluate();
+  }
+});
+
+// packages/core/src/gate/render.ts
+function escapeXml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function renderGateSummaryMarkdown(result) {
+  const lines = [];
+  lines.push("# AgentInspect gate");
+  lines.push("");
+  lines.push(`Status: **${result.ok ? "PASS" : "FAIL"}** (exit ${result.exitCode})`);
+  if (result.traceDir !== void 0) {
+    lines.push(`Trace directory: \`${result.traceDir}\``);
+  }
+  if (result.suitePath !== void 0) {
+    lines.push(`Suite config: \`${result.suitePath}\``);
+  }
+  lines.push(`Runs evaluated: ${result.runCount}`);
+  lines.push("");
+  if (result.diagnostics.length > 0) {
+    lines.push("## Diagnostics");
+    for (const item of result.diagnostics) lines.push(`- ${item}`);
+    lines.push("");
+  }
+  lines.push("## Checks");
+  for (const check of result.checks) {
+    const flag = check.ok ? "PASS" : "FAIL";
+    lines.push(`- [${flag}] ${check.name}: ${check.message}`);
+  }
+  lines.push("");
+  return lines.join("\n").trimEnd();
+}
+function renderGateGithubStepSummary(result) {
+  const lines = [];
+  lines.push(`## AgentInspect gate: ${result.ok ? "PASS" : "FAIL"}`);
+  lines.push("");
+  lines.push("| Check | Status | Details |");
+  lines.push("| --- | --- | --- |");
+  for (const check of result.checks) {
+    lines.push(
+      `| ${check.name} | ${check.ok ? "pass" : "fail"} | ${check.message.replace(/\|/g, "/")} |`
+    );
+  }
+  if (result.diagnostics.length > 0) {
+    lines.push("");
+    lines.push("**Diagnostics**");
+    for (const item of result.diagnostics) lines.push(`- ${item}`);
+  }
+  return lines.join("\n").trimEnd();
+}
+function renderGateReportHtml(result) {
+  const rows = result.checks.map(
+    (check) => `<tr><td>${escapeHtml(check.name)}</td><td>${check.ok ? "PASS" : "FAIL"}</td><td>${escapeHtml(check.message)}</td></tr>`
+  ).join("");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Gate report</title>
+  <style>
+    body { font-family: system-ui, sans-serif; margin: 2rem; }
+    table { border-collapse: collapse; width: 100%; }
+    th, td { border: 1px solid #ddd; padding: 0.5rem; text-align: left; }
+    th { background: #f6f6f6; }
+  </style>
+</head>
+<body>
+  <h1>AgentInspect gate</h1>
+  <p>Status: <strong>${result.ok ? "PASS" : "FAIL"}</strong> (exit ${result.exitCode})</p>
+  <h2>Checks</h2>
+  <table>
+    <thead><tr><th>Check</th><th>Status</th><th>Details</th></tr></thead>
+    <tbody>${rows}</tbody>
+  </table>
+</body>
+</html>`;
+}
+function renderGateJUnit(result) {
+  const failures = result.checks.filter((check) => !check.ok).length;
+  const tests = result.checks.length;
+  const cases = result.checks.map((check) => {
+    if (check.ok) {
+      return `    <testcase name="${escapeXml(check.name)}" classname="gate" />`;
+    }
+    return `    <testcase name="${escapeXml(check.name)}" classname="gate">
+      <failure message="${escapeXml(check.message)}">${escapeXml(check.message)}</failure>
+    </testcase>`;
+  }).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<testsuites tests="${tests}" failures="${failures}" errors="0" time="0">
+  <testsuite name="agent-inspect-gate" tests="${tests}" failures="${failures}" errors="0" time="0">
+${cases}
+  </testsuite>
+</testsuites>`;
+}
+function renderGateReport(result, options = {}) {
+  const format = options.format ?? "markdown";
+  if (format === "json") return JSON.stringify(result, null, 2);
+  if (format === "html") return renderGateReportHtml(result);
+  if (format === "junit") return renderGateJUnit(result);
+  if (format === "github") return renderGateGithubStepSummary(result);
+  return renderGateSummaryMarkdown(result);
+}
+var init_render3 = __esm({
+  "packages/core/src/gate/render.ts"() {
+    init_helpers();
+  }
+});
+
+// packages/core/src/gate/index.ts
+var init_gate = __esm({
+  "packages/core/src/gate/index.ts"() {
+    init_parse();
+    init_evaluate();
+    init_run2();
+    init_render3();
+  }
+});
+
 // packages/core/src/inspect-run.ts
 var init_inspect_run = __esm({
   "packages/core/src/inspect-run.ts"() {
@@ -8997,6 +9417,7 @@ var init_advanced = __esm({
     init_bundle();
     init_suite();
     init_cohort2();
+    init_gate();
     init_maybe_inspect_run();
   }
 });
@@ -9061,19 +9482,19 @@ var require_file_uri_to_path = __commonJS({
       var rest = decodeURI(uri.substring(7));
       var firstSlash = rest.indexOf("/");
       var host = rest.substring(0, firstSlash);
-      var path31 = rest.substring(firstSlash + 1);
+      var path33 = rest.substring(firstSlash + 1);
       if ("localhost" == host) host = "";
       if (host) {
         host = sep + sep + host;
       }
-      path31 = path31.replace(/^(.+)\|/, "$1:");
+      path33 = path33.replace(/^(.+)\|/, "$1:");
       if (sep == "\\") {
-        path31 = path31.replace(/\//g, "\\");
+        path33 = path33.replace(/\//g, "\\");
       }
-      if (/^.+\:/.test(path31)) ; else {
-        path31 = sep + path31;
+      if (/^.+\:/.test(path33)) ; else {
+        path33 = sep + path33;
       }
-      return host + path31;
+      return host + path33;
     }
   }
 });
@@ -9082,18 +9503,18 @@ var require_file_uri_to_path = __commonJS({
 var require_bindings = __commonJS({
   "node_modules/.pnpm/bindings@1.5.0/node_modules/bindings/bindings.js"(exports$1, module) {
     var fs = __require("fs");
-    var path31 = __require("path");
+    var path33 = __require("path");
     var fileURLToPath2 = require_file_uri_to_path();
-    var join = path31.join;
-    var dirname = path31.dirname;
-    var exists2 = fs.accessSync && function(path32) {
+    var join = path33.join;
+    var dirname = path33.dirname;
+    var exists2 = fs.accessSync && function(path34) {
       try {
-        fs.accessSync(path32);
+        fs.accessSync(path34);
       } catch (e) {
         return false;
       }
       return true;
-    } || fs.existsSync || path31.existsSync;
+    } || fs.existsSync || path33.existsSync;
     var defaults = {
       arrow: process.env.NODE_BINDINGS_ARROW || " \u2192 ",
       compiled: process.env.NODE_BINDINGS_COMPILED_DIR || "compiled",
@@ -9138,7 +9559,7 @@ var require_bindings = __commonJS({
       if (!opts.module_root) {
         opts.module_root = exports$1.getRoot(exports$1.getFileName());
       }
-      if (path31.extname(opts.bindings) != ".node") {
+      if (path33.extname(opts.bindings) != ".node") {
         opts.bindings += ".node";
       }
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
@@ -9373,7 +9794,7 @@ var require_pragma = __commonJS({
 var require_backup = __commonJS({
   "node_modules/.pnpm/better-sqlite3@11.10.0/node_modules/better-sqlite3/lib/methods/backup.js"(exports$1, module) {
     var fs = __require("fs");
-    var path31 = __require("path");
+    var path33 = __require("path");
     var { promisify } = __require("util");
     var { cppdb } = require_util();
     var fsAccess = promisify(fs.access);
@@ -9389,7 +9810,7 @@ var require_backup = __commonJS({
       if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
       if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
       if (handler != null && typeof handler !== "function") throw new TypeError('Expected the "progress" option to be a function');
-      await fsAccess(path31.dirname(filename)).catch(() => {
+      await fsAccess(path33.dirname(filename)).catch(() => {
         throw new TypeError("Cannot save backup because the directory does not exist");
       });
       const isNewFile = await fsAccess(filename).then(() => false, () => true);
@@ -9689,7 +10110,7 @@ var require_inspect = __commonJS({
 var require_database = __commonJS({
   "node_modules/.pnpm/better-sqlite3@11.10.0/node_modules/better-sqlite3/lib/database.js"(exports$1, module) {
     var fs = __require("fs");
-    var path31 = __require("path");
+    var path33 = __require("path");
     var util = require_util();
     var SqliteError = require_sqlite_error();
     var DEFAULT_ADDON;
@@ -9725,7 +10146,7 @@ var require_database = __commonJS({
         addon = DEFAULT_ADDON || (DEFAULT_ADDON = require_bindings()("better_sqlite3.node"));
       } else if (typeof nativeBinding === "string") {
         const requireFunc = typeof __non_webpack_require__ === "function" ? __non_webpack_require__ : __require;
-        addon = requireFunc(path31.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
+        addon = requireFunc(path33.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
       } else {
         addon = nativeBinding;
       }
@@ -9733,7 +10154,7 @@ var require_database = __commonJS({
         addon.setErrorConstructor(SqliteError);
         addon.isInitialized = true;
       }
-      if (!anonymous && !fs.existsSync(path31.dirname(filename))) {
+      if (!anonymous && !fs.existsSync(path33.dirname(filename))) {
         throw new TypeError("Cannot open database because the directory does not exist");
       }
       Object.defineProperties(this, {
@@ -9860,8 +10281,8 @@ GROUP BY session_id;
   }
 });
 function resolveIndexDbPath(traceDir, dbPath) {
-  if (dbPath && dbPath.trim() !== "") return path23__default.default.resolve(dbPath);
-  return path23__default.default.join(path23__default.default.resolve(traceDir), INDEX_DB_FILENAME);
+  if (dbPath && dbPath.trim() !== "") return path24__default.default.resolve(dbPath);
+  return path24__default.default.join(path24__default.default.resolve(traceDir), INDEX_DB_FILENAME);
 }
 function str(value) {
   return typeof value === "string" && value !== "" ? value : null;
@@ -9953,7 +10374,7 @@ async function buildIndex(options = {}) {
       warnings.push(`index.unreadable: ${file}`);
     }
   }
-  await promises.mkdir(path23__default.default.dirname(dbPath), { recursive: true });
+  await promises.mkdir(path24__default.default.dirname(dbPath), { recursive: true });
   await promises.rm(dbPath, { force: true });
   const db = new import_better_sqlite3.default(dbPath);
   let runCount = 0;
@@ -10191,7 +10612,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "5.1.0";
+var version = "5.2.0";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -13192,9 +13613,9 @@ Trace directory: ${traceDir}`);
   if (validation !== void 0 && !validation.ok) {
     process.exitCode = 1;
   }
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path23__default.default.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path24__default.default.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await promises.mkdir(path23__default.default.dirname(outPath), { recursive: true });
+    await promises.mkdir(path24__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
     console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
@@ -13375,13 +13796,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path31 = buildPath(segments);
+  const path33 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path31,
+      path: path33,
       left: L.name,
       right: R.name
     });
@@ -13391,7 +13812,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path31,
+      path: path33,
       left: L.type,
       right: R.type
     });
@@ -13401,7 +13822,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path31,
+      path: path33,
       left: L.status,
       right: R.status
     });
@@ -13413,7 +13834,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path31,
+      path: path33,
       left: le || void 0,
       right: re || void 0
     });
@@ -13431,7 +13852,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path31,
+        path: path33,
         left: ld,
         right: rd
       });
@@ -13444,7 +13865,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path31,
+      path: path33,
       left: L.metadata,
       right: R.metadata
     });
@@ -13456,7 +13877,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path31,
+      path: path33,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -13617,11 +14038,11 @@ function diffRuns(left, right, options) {
 
 // packages/core/src/diff/renderer.ts
 init_source();
-function formatPath(path31) {
-  if (path31 === void 0 || path31.path.length === 0) {
+function formatPath(path33) {
+  if (path33 === void 0 || path33.path.length === 0) {
     return "(run)";
   }
-  return path31.path.map((s) => s.name).join(" > ");
+  return path33.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -14009,7 +14430,7 @@ function indexedToMetadata(row, traceDir) {
     endedAt: row.endedAt ?? void 0,
     durationMs: row.durationMs ?? void 0,
     eventCount: 0,
-    filePath: path23__default.default.join(traceDir, row.file),
+    filePath: path24__default.default.join(traceDir, row.file),
     fileSize: 0,
     createdAt: new Date(row.mtimeMs)
   };
@@ -14490,9 +14911,9 @@ async function reportCommand(runId, options = {}) {
     correlation: !options.noCorrelation,
     ...options.section ? { section: options.section } : {}
   });
-  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path23__default.default.resolve(options.output.trim()) : void 0;
+  const outPath = options.output !== void 0 && options.output.trim() !== "" ? path24__default.default.resolve(options.output.trim()) : void 0;
   if (outPath !== void 0) {
-    await promises.mkdir(path23__default.default.dirname(outPath), { recursive: true });
+    await promises.mkdir(path24__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     console.log(`Wrote ${result.fileExtension} report to ${outPath}`);
   }
@@ -14742,17 +15163,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path31, key) {
+function childPath(path33, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path31 ? `${path31}.${key}` : key;
+    return path33 ? `${path33}.${key}` : key;
   }
-  return `${path31 || "$"}[${JSON.stringify(key)}]`;
+  return `${path33 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path31, index) {
-  return `${path31 || "$"}[${index}]`;
+function indexPath(path33, index) {
+  return `${path33 || "$"}[${index}]`;
 }
-function makeFinding(path31, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path31, detector, action, severity, matchKind } : { path: path31, detector, action, severity, matchKind, preview };
+function makeFinding(path33, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path33, detector, action, severity, matchKind } : { path: path33, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -14821,11 +15242,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path31, depth, state) {
+  #redactValue(value, key, path33, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path31, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path33, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -14834,19 +15255,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path31, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path33, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path31, key, value });
+      const detections = detector.detect({ path: path33, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path31,
+            path33,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -14864,7 +15285,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path31, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path33, index), depth + 1, state);
       });
       return out;
     }
@@ -14876,7 +15297,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path31 === "$" ? "" : path31, entryKey),
+          childPath(path33 === "$" ? "" : path33, entryKey),
           depth + 1,
           state
         );
@@ -15336,14 +15757,14 @@ function uniqueSorted(values) {
   return [...new Set(values)].sort();
 }
 function isWithinDirectory(child, parent) {
-  const relative = path23__default.default.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path23__default.default.isAbsolute(relative);
+  const relative = path24__default.default.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path24__default.default.isAbsolute(relative);
 }
 async function resolveOutputPath(inputPath, output2, force) {
   if (output2 === void 0 || output2.trim() === "") return void 0;
-  const inputAbs = path23__default.default.resolve(inputPath);
-  const outputAbs = path23__default.default.resolve(output2.trim());
-  const inputDir = path23__default.default.dirname(inputAbs);
+  const inputAbs = path24__default.default.resolve(inputPath);
+  const outputAbs = path24__default.default.resolve(output2.trim());
+  const inputDir = path24__default.default.dirname(inputAbs);
   if (!isWithinDirectory(outputAbs, inputDir)) {
     throw new Error("Refusing to write migrated output outside the input directory.");
   }
@@ -15464,7 +15885,7 @@ async function migrateCommand(input3, options = {}) {
     process.exitCode = 1;
     return;
   }
-  const inputPath = path23__default.default.resolve(input3.trim());
+  const inputPath = path24__default.default.resolve(input3.trim());
   const dryRun = options.dryRun === true;
   if (!dryRun && (options.output === void 0 || options.output.trim() === "")) {
     console.error("migrate requires --dry-run or --output <path>.");
@@ -15483,7 +15904,7 @@ async function migrateCommand(input3, options = {}) {
     );
     const result = await buildMigration(inputPath, outputPath);
     if (!dryRun && outputPath !== void 0) {
-      await promises.mkdir(path23__default.default.dirname(outputPath), { recursive: true });
+      await promises.mkdir(path24__default.default.dirname(outputPath), { recursive: true });
       await promises.writeFile(outputPath, result.content, "utf-8");
     }
     printSummary2(result, dryRun);
@@ -15817,23 +16238,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path31, evidence) {
+function validateSchemaField(value, field, path33, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path31, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path33, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path31, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path33, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path31}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path33}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -16160,7 +16581,7 @@ function asConfig(value) {
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
-  const extension = path23__default.default.extname(configPath);
+  const extension = path24__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error(
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -16169,7 +16590,7 @@ async function loadConfig(configPath) {
   if (!CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path23__default.default.resolve(configPath);
+  const absolute = path24__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
     return asConfig(JSON.parse(raw));
@@ -16334,10 +16755,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path31 = finding.evidence[0]?.path;
+    const path33 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path31 ? ` (${path31})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path33 ? ` (${path33})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -16540,7 +16961,7 @@ function createViewerServer(options = {}) {
         return sendJson(res, 200, {
           ok: true,
           readOnly: true,
-          traceDir: path23__default.default.resolve(traceDir)
+          traceDir: path24__default.default.resolve(traceDir)
         });
       }
       const td = new TraceDirectory({ dir: traceDir });
@@ -16558,7 +16979,7 @@ function createViewerServer(options = {}) {
             runId: meta2.runId,
             name: meta2.name,
             status: meta2.status,
-            file: path23__default.default.basename(meta2.filePath),
+            file: path24__default.default.basename(meta2.filePath),
             startedAt: meta2.startedAt,
             durationMs: meta2.durationMs
           }))
@@ -16673,7 +17094,7 @@ function startViewerServer(options = {}) {
       resolve({
         host,
         port: resolvedPort,
-        traceDir: path23__default.default.resolve(traceDir),
+        traceDir: path24__default.default.resolve(traceDir),
         url: `http://${host}:${resolvedPort}`
       });
     });
@@ -16878,10 +17299,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path31) {
-  return [{ runId: run.runId, ...path31 !== void 0 ? { path: path31 } : {} }];
+function evidenceForRun(run, path33) {
+  return [{ runId: run.runId, ...path33 !== void 0 ? { path: path33 } : {} }];
 }
-function evidenceForEvent(event, path31) {
+function evidenceForEvent(event, path33) {
   return [
     {
       runId: event.runId,
@@ -16889,7 +17310,7 @@ function evidenceForEvent(event, path31) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path31 !== void 0 ? { path: path31 } : {}
+      ...path33 !== void 0 ? { path: path33 } : {}
     }
   ];
 }
@@ -17047,9 +17468,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path31) {
+function firstEvidence(fields, run, path33) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path31) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path33) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -17426,8 +17847,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path31 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path31 ? ` (${path31})` : ""}`);
+      const path33 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path33 ? ` (${path33})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -17474,7 +17895,7 @@ function asConfig2(value) {
 }
 async function loadConfig2(configPath) {
   if (configPath === void 0) return {};
-  const extension = path23__default.default.extname(configPath);
+  const extension = path24__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS3.has(extension)) {
     throw new Error(
       "TypeScript eval configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -17483,7 +17904,7 @@ async function loadConfig2(configPath) {
   if (!CONFIG_EXTENSIONS3.has(extension)) {
     throw new Error("Unsupported eval config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path23__default.default.resolve(configPath);
+  const absolute = path24__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
     return asConfig2(JSON.parse(raw));
@@ -17620,8 +18041,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path31 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path31 ? ` (${path31})` : ""}`);
+    const path33 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path33 ? ` (${path33})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -17859,8 +18280,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path31 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path31 ? ` (${path31})` : ""}`);
+    const path33 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path33 ? ` (${path33})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -18011,8 +18432,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path31 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path31})`);
+    const path33 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path33})`);
   }
   for (const diagnostic7 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic7.code}: ${diagnostic7.message}`);
@@ -18090,8 +18511,8 @@ function renderHtml(trace, check, diff) {
 `;
 }
 async function writeArtifact(outputDir, relativePath, content, files) {
-  const outPath = path23__default.default.join(outputDir, relativePath);
-  await promises.mkdir(path23__default.default.dirname(outPath), { recursive: true });
+  const outPath = path24__default.default.join(outputDir, relativePath);
+  await promises.mkdir(path24__default.default.dirname(outPath), { recursive: true });
   await promises.writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -18107,7 +18528,7 @@ function manifestStatus(check, diff) {
   return "ok";
 }
 async function artifactsCommand(target, options = {}, stdin = process.stdin) {
-  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path23__default.default.resolve(options.outputDir.trim()) : "";
+  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path24__default.default.resolve(options.outputDir.trim()) : "";
   if (outputDir === "") {
     console.error("--output-dir is required.");
     process.exitCode = 1;
@@ -18173,8 +18594,8 @@ async function artifactsCommand(target, options = {}, stdin = process.stdin) {
   await writeArtifact(outputDir, "report.html", renderHtml(trace, check, diff), files);
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    await promises.mkdir(path23__default.default.dirname(path23__default.default.resolve(summaryTarget)), { recursive: true });
-    await promises.appendFile(path23__default.default.resolve(summaryTarget), `
+    await promises.mkdir(path24__default.default.dirname(path24__default.default.resolve(summaryTarget)), { recursive: true });
+    await promises.appendFile(path24__default.default.resolve(summaryTarget), `
 ${renderMarkdown(trace, check, diff)}`, "utf-8");
   }
   const manifestFiles = [...files, "manifest.json"].sort((a, b) => a.localeCompare(b));
@@ -18193,10 +18614,10 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
       findings: diff?.findings.length ?? 0,
       diagnostics: diff?.diagnostics.length ?? 0
     },
-    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path23__default.default.resolve(summaryTarget) } : {},
+    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path24__default.default.resolve(summaryTarget) } : {},
     note: NOTE
   };
-  await promises.writeFile(path23__default.default.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
+  await promises.writeFile(path24__default.default.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
   if (options.json === true) {
     console.log(writeJson3(manifest).trimEnd());
   } else {
@@ -18390,19 +18811,19 @@ function serializeWorkspaceManifest(manifest) {
 }
 var INDEX_DIR_NAME = "index";
 function resolveWorkspaceLocation(cwd = process.cwd()) {
-  const projectRoot = path23__default.default.resolve(cwd);
-  const workspaceDir = path23__default.default.join(projectRoot, WORKSPACE_DIR_NAME);
+  const projectRoot = path24__default.default.resolve(cwd);
+  const workspaceDir = path24__default.default.join(projectRoot, WORKSPACE_DIR_NAME);
   return {
     projectRoot,
     workspaceDir,
-    manifestPath: path23__default.default.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
+    manifestPath: path24__default.default.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
   };
 }
 function resolveInsideWorkspace(workspaceDir, relative) {
-  const base = path23__default.default.resolve(workspaceDir);
-  const resolved = path23__default.default.resolve(base, relative);
-  const rel = path23__default.default.relative(base, resolved);
-  if (rel === "" || rel === "." || !rel.startsWith("..") && !path23__default.default.isAbsolute(rel)) {
+  const base = path24__default.default.resolve(workspaceDir);
+  const resolved = path24__default.default.resolve(base, relative);
+  const rel = path24__default.default.relative(base, resolved);
+  if (rel === "" || rel === "." || !rel.startsWith("..") && !path24__default.default.isAbsolute(rel)) {
     return resolved;
   }
   throw new Error(
@@ -18471,7 +18892,7 @@ async function createWorkspace(options = {}) {
     created = false;
     adopted = true;
   } else {
-    const project = options.project?.trim() || path23__default.default.basename(location.projectRoot) || "workspace";
+    const project = options.project?.trim() || path24__default.default.basename(location.projectRoot) || "workspace";
     const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
     manifest = createDefaultWorkspaceManifest({
       project,
@@ -18610,7 +19031,7 @@ async function doctorWorkspace(location) {
     const abs = resolveInsideWorkspace(location.workspaceDir, rel);
     for (const file of await listJsonl(abs)) {
       try {
-        const s = await promises.stat(path23__default.default.join(abs, file));
+        const s = await promises.stat(path24__default.default.join(abs, file));
         newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
       } catch {
         checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
@@ -18658,7 +19079,7 @@ async function cleanWorkspace(location, manifest, options = {}) {
       const relPath = `${rel}/${entry}`;
       removed.push(relPath);
       if (!dryRun) {
-        await promises.rm(path23__default.default.join(abs, entry), { recursive: true, force: true });
+        await promises.rm(path24__default.default.join(abs, entry), { recursive: true, force: true });
       }
     }
   }
@@ -18704,8 +19125,8 @@ async function resolveOutputDir(options, runIds, cwd) {
       const location = resolveWorkspaceLocation(cwd);
       const manifest = await readWorkspaceManifestFile(location);
       if (manifest.ok && manifest.manifest) {
-        const rel = path23__default.default.relative(location.workspaceDir, normalized);
-        if (!rel.startsWith("..") && !path23__default.default.isAbsolute(rel)) {
+        const rel = path24__default.default.relative(location.workspaceDir, normalized);
+        if (!rel.startsWith("..") && !path24__default.default.isAbsolute(rel)) {
           return resolveInsideWorkspace(location.workspaceDir, rel);
         }
       }
@@ -18721,7 +19142,7 @@ async function resolveOutputDir(options, runIds, cwd) {
       const label = runIds.length === 1 ? runIds[0] : `multi-${runIds.length}`;
       return resolveInsideWorkspace(
         location.workspaceDir,
-        path23__default.default.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
+        path24__default.default.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
       );
     }
   } catch {
@@ -18729,8 +19150,8 @@ async function resolveOutputDir(options, runIds, cwd) {
   return defaultBundleOutputPath(runIds);
 }
 async function writeBundleFile(outputDir, relativePath, content, files) {
-  const outPath = path23__default.default.join(outputDir, relativePath);
-  await promises.mkdir(path23__default.default.dirname(outPath), { recursive: true });
+  const outPath = path24__default.default.join(outputDir, relativePath);
+  await promises.mkdir(path24__default.default.dirname(outPath), { recursive: true });
   await promises.writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -18956,7 +19377,7 @@ async function bundleCommand(runIdArg, options = {}) {
     files
   );
   metadata.files = [...files].sort((a, b) => a.localeCompare(b));
-  await promises.writeFile(path23__default.default.join(outputDir, "metadata.json"), writeJson4(metadata), "utf-8");
+  await promises.writeFile(path24__default.default.join(outputDir, "metadata.json"), writeJson4(metadata), "utf-8");
   if (options.json) {
     console.log(
       writeJson4({
@@ -18990,7 +19411,7 @@ ${body}
 `;
 }
 function validateReporterArtifactPath(options) {
-  const outputDir = path23__default.default.resolve(options.outputDir);
+  const outputDir = path24__default.default.resolve(options.outputDir);
   const diagnostics = [];
   const rawPath = options.relativePath;
   if (rawPath.length === 0) {
@@ -19010,7 +19431,7 @@ function validateReporterArtifactPath(options) {
     });
     return { ok: false, outputDir, diagnostics };
   }
-  if (path23__default.default.isAbsolute(rawPath) || path23__default.default.win32.isAbsolute(rawPath)) {
+  if (path24__default.default.isAbsolute(rawPath) || path24__default.default.win32.isAbsolute(rawPath)) {
     diagnostics.push({
       code: "artifact_path_absolute",
       severity: "error",
@@ -19019,7 +19440,7 @@ function validateReporterArtifactPath(options) {
     });
     return { ok: false, outputDir, diagnostics };
   }
-  const normalized = path23__default.default.posix.normalize(rawPath.replace(/\\/g, "/"));
+  const normalized = path24__default.default.posix.normalize(rawPath.replace(/\\/g, "/"));
   const segments = normalized.split("/");
   if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
     diagnostics.push({
@@ -19030,9 +19451,9 @@ function validateReporterArtifactPath(options) {
     });
     return { ok: false, outputDir, diagnostics };
   }
-  const absolutePath = path23__default.default.resolve(outputDir, normalized);
-  const relFromOutput = path23__default.default.relative(outputDir, absolutePath);
-  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path23__default.default.isAbsolute(relFromOutput)) {
+  const absolutePath = path24__default.default.resolve(outputDir, normalized);
+  const relFromOutput = path24__default.default.relative(outputDir, absolutePath);
+  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path24__default.default.isAbsolute(relFromOutput)) {
     diagnostics.push({
       code: "artifact_path_escape",
       severity: "error",
@@ -19178,23 +19599,23 @@ function readManifestDocument(value) {
   };
 }
 function cwdRelative(filePath) {
-  const relative = path23__default.default.relative(process.cwd(), path23__default.default.resolve(filePath)).replace(/\\/g, "/");
-  if (relative === "" || relative.startsWith("../") || path23__default.default.isAbsolute(relative)) {
-    return path23__default.default.basename(filePath);
+  const relative = path24__default.default.relative(process.cwd(), path24__default.default.resolve(filePath)).replace(/\\/g, "/");
+  if (relative === "" || relative.startsWith("../") || path24__default.default.isAbsolute(relative)) {
+    return path24__default.default.basename(filePath);
   }
   return relative;
 }
 async function readReporterManifest(filePath) {
-  const absolute = path23__default.default.resolve(filePath);
+  const absolute = path24__default.default.resolve(filePath);
   const raw = await promises.readFile(absolute, "utf-8");
   const document = readManifestDocument(JSON.parse(raw));
   const manifest = document.manifest;
   const results = manifest.results.map((result) => ({
     testId: safeText(result.testId),
     name: safeText(result.name),
-    ...result.file === void 0 ? {} : { file: safeText(path23__default.default.basename(result.file)) },
+    ...result.file === void 0 ? {} : { file: safeText(path24__default.default.basename(result.file)) },
     status: result.status,
-    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path23__default.default.basename(result.tracePath)) },
+    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path24__default.default.basename(result.tracePath)) },
     artifacts: result.artifacts,
     diagnostics: result.diagnostics
   }));
@@ -19333,15 +19754,15 @@ async function ciSummaryCommand(manifestPaths, options = {}) {
     return;
   }
   const markdown = renderMarkdown2(result);
-  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path23__default.default.resolve(options.output.trim()) : void 0;
+  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path24__default.default.resolve(options.output.trim()) : void 0;
   if (outputPath !== void 0) {
-    await promises.mkdir(path23__default.default.dirname(outputPath), { recursive: true });
+    await promises.mkdir(path24__default.default.dirname(outputPath), { recursive: true });
     await promises.writeFile(outputPath, markdown, "utf-8");
   }
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    const summaryPath = path23__default.default.resolve(summaryTarget);
-    await promises.mkdir(path23__default.default.dirname(summaryPath), { recursive: true });
+    const summaryPath = path24__default.default.resolve(summaryTarget);
+    await promises.mkdir(path24__default.default.dirname(summaryPath), { recursive: true });
     await promises.appendFile(summaryPath, `
 ${markdown}`, "utf-8");
   }
@@ -19489,8 +19910,8 @@ jobs:
 }
 async function planInit(options = {}) {
   const framework = normalizeFramework(options.framework);
-  const cwd = path23__default.default.resolve(options.cwd ?? process.cwd());
-  const demoPath = framework === "custom" ? path23__default.default.join("examples", "agent-inspect-demo.mjs") : path23__default.default.join("examples", `agent-inspect-${framework}-demo.mjs`);
+  const cwd = path24__default.default.resolve(options.cwd ?? process.cwd());
+  const demoPath = framework === "custom" ? path24__default.default.join("examples", "agent-inspect-demo.mjs") : path24__default.default.join("examples", `agent-inspect-${framework}-demo.mjs`);
   const candidates = [
     { rel: CONFIG_FILE, content: configTemplate(framework) },
     { rel: GITKEEP, content: "" },
@@ -19504,7 +19925,7 @@ async function planInit(options = {}) {
   }
   const files = [];
   for (const candidate of candidates) {
-    const abs = path23__default.default.join(cwd, candidate.rel);
+    const abs = path24__default.default.join(cwd, candidate.rel);
     try {
       await promises.access(abs);
       files.push({
@@ -19525,12 +19946,12 @@ async function writePlannedFiles(plan, cwd, options) {
     if (entry.action === "skip") {
       continue;
     }
-    const abs = path23__default.default.join(cwd, entry.path);
+    const abs = path24__default.default.join(cwd, entry.path);
     if (options.dryRun) {
       written.push(entry.path);
       continue;
     }
-    await promises.mkdir(path23__default.default.dirname(abs), { recursive: true });
+    await promises.mkdir(path24__default.default.dirname(abs), { recursive: true });
     const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
     await promises.writeFile(abs, content, "utf-8");
     written.push(entry.path);
@@ -19538,7 +19959,7 @@ async function writePlannedFiles(plan, cwd, options) {
   return written;
 }
 async function initCommand(options = {}) {
-  const cwd = path23__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path24__default.default.resolve(options.cwd ?? process.cwd());
   try {
     const plan = await planInit({ ...options, cwd });
     const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
@@ -19629,7 +20050,7 @@ function envCheck(name, optional = true) {
   };
 }
 async function traceDirWritable(traceDir) {
-  const resolved = path23__default.default.resolve(traceDir);
+  const resolved = path24__default.default.resolve(traceDir);
   try {
     await promises.mkdir(resolved, { recursive: true });
     await promises.access(resolved, promises.constants.W_OK);
@@ -19650,7 +20071,7 @@ async function traceDirWritable(traceDir) {
   }
 }
 function resolvePackage(cwd, name) {
-  const require2 = module$1.createRequire(path23__default.default.join(cwd, "package.json"));
+  const require2 = module$1.createRequire(path24__default.default.join(cwd, "package.json"));
   try {
     const pkgPath = require2.resolve(`${name}/package.json`);
     const pkg = require2(pkgPath);
@@ -19661,7 +20082,7 @@ function resolvePackage(cwd, name) {
 }
 function importSmoke(cwd) {
   const results = [];
-  const require2 = module$1.createRequire(path23__default.default.join(cwd, "package.json"));
+  const require2 = module$1.createRequire(path24__default.default.join(cwd, "package.json"));
   try {
     require2.resolve("agent-inspect");
     results.push({
@@ -19744,7 +20165,7 @@ function versionMismatchCheck(cwd) {
   };
 }
 async function runDoctorChecks(options = {}) {
-  const cwd = path23__default.default.resolve(options.cwd ?? process3__default.default.cwd());
+  const cwd = path24__default.default.resolve(options.cwd ?? process3__default.default.cwd());
   const traceDir = options.traceDir?.trim() || process3__default.default.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
   const checks2 = [
     nodeVersionCheck(),
@@ -19858,7 +20279,7 @@ function createTraceDirectoryIndexer() {
 init_advanced();
 var INDEX_FILENAME = ".agent-inspect-index.json";
 function traceIndexPath(traceDir) {
-  return path23__default.default.join(traceDir, INDEX_FILENAME);
+  return path24__default.default.join(traceDir, INDEX_FILENAME);
 }
 function parseMaxEntries(raw) {
   if (raw === void 0 || raw.trim() === "") return void 0;
@@ -20004,7 +20425,7 @@ async function newestTraceMtimeMs2(traceDir) {
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
       try {
-        const s = await promises.stat(path23__default.default.join(traceDir, file));
+        const s = await promises.stat(path24__default.default.join(traceDir, file));
         if (s.mtimeMs > newest) newest = s.mtimeMs;
       } catch {
       }
@@ -20259,11 +20680,11 @@ function printJson5(value) {
   console.log(JSON.stringify(value, null, 2));
 }
 function resolveCwd(options) {
-  return path23__default.default.resolve(options.cwd ?? process.cwd());
+  return path24__default.default.resolve(options.cwd ?? process.cwd());
 }
 async function suiteInitCommand(options = {}) {
   const cwd = resolveCwd(options);
-  const configPath = path23__default.default.join(cwd, DEFAULT_CONFIG_FILENAME);
+  const configPath = path24__default.default.join(cwd, DEFAULT_CONFIG_FILENAME);
   const template = defaultSuiteConfigTemplate();
   if (options.dryRun) {
     if (options.json) {
@@ -20373,13 +20794,13 @@ async function suiteListCommand(options = {}) {
 }
 async function writeSuiteArtifact(result, configOutputDir, options) {
   const cwd = resolveCwd(options);
-  const outputDir = path23__default.default.resolve(
+  const outputDir = path24__default.default.resolve(
     cwd,
     options.output ?? configOutputDir ?? DEFAULT_SUITE_ARTIFACTS_DIR
   );
   await promises.mkdir(outputDir, { recursive: true });
   const stamp = result.startedAt.replace(/[:.]/g, "-");
-  const filePath = path23__default.default.join(outputDir, `${result.suiteName}-${stamp}.json`);
+  const filePath = path24__default.default.join(outputDir, `${result.suiteName}-${stamp}.json`);
   await promises.writeFile(filePath, `${JSON.stringify(result, null, 2)}
 `, "utf-8");
   return filePath;
@@ -20437,7 +20858,7 @@ async function loadSuiteResultFromInput(options) {
   if (options.input === void 0 || options.input.trim() === "") {
     throw new Error("Pass --input <suite-run.json> from a prior suite run.");
   }
-  const inputPath = path23__default.default.resolve(cwd, options.input.trim());
+  const inputPath = path24__default.default.resolve(cwd, options.input.trim());
   const raw = await promises.readFile(inputPath, "utf-8");
   return JSON.parse(raw);
 }
@@ -20474,9 +20895,9 @@ function normalizeMetrics2(raw) {
 }
 async function writeArtifacts(result, outputDir) {
   await promises.mkdir(outputDir, { recursive: true });
-  const jsonPath = path23__default.default.join(outputDir, "cohort-results.json");
-  const markdownPath = path23__default.default.join(outputDir, "cohort-summary.md");
-  const htmlPath = path23__default.default.join(outputDir, "cohort-report.html");
+  const jsonPath = path24__default.default.join(outputDir, "cohort-results.json");
+  const markdownPath = path24__default.default.join(outputDir, "cohort-summary.md");
+  const htmlPath = path24__default.default.join(outputDir, "cohort-report.html");
   await promises.writeFile(jsonPath, `${renderCohortReport(result, { format: "json" })}
 `, "utf-8");
   await promises.writeFile(
@@ -20504,7 +20925,7 @@ async function cohortCommand(options = {}) {
     const format = options.format ?? (options.json ? "json" : "markdown");
     let artifacts;
     if (options.output !== void 0 && options.output.trim() !== "") {
-      artifacts = await writeArtifacts(result, path23__default.default.resolve(options.output.trim()));
+      artifacts = await writeArtifacts(result, path24__default.default.resolve(options.output.trim()));
     }
     if (options.json || format === "json") {
       console.log(
@@ -20544,6 +20965,135 @@ async function cohortCommand(options = {}) {
   }
 }
 
+// packages/cli/src/gate.ts
+init_advanced();
+var SUPPORTED_FORMATS = /* @__PURE__ */ new Set(["markdown", "json", "html", "junit", "github"]);
+function collectList(value) {
+  if (value === void 0) return [];
+  const items = Array.isArray(value) ? value : [value];
+  return items.flatMap((item) => parseGateList(item));
+}
+function parseRate(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`Invalid --max-error-rate: ${value}`);
+  }
+  return parsed;
+}
+function parseDuration2(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`Invalid --max-p95-duration: ${value}`);
+  }
+  return parsed;
+}
+async function writeArtifacts2(result, outputDir) {
+  await promises.mkdir(outputDir, { recursive: true });
+  const paths = {
+    jsonPath: path24__default.default.join(outputDir, "gate-results.json"),
+    markdownPath: path24__default.default.join(outputDir, "gate-summary.md"),
+    htmlPath: path24__default.default.join(outputDir, "gate-report.html"),
+    junitPath: path24__default.default.join(outputDir, "junit.xml"),
+    githubPath: path24__default.default.join(outputDir, "github-step-summary.md")
+  };
+  await promises.writeFile(
+    paths.jsonPath,
+    `${renderGateReport(result, { format: "json" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(
+    paths.markdownPath,
+    `${renderGateReport(result, { format: "markdown" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(
+    paths.htmlPath,
+    `${renderGateReport(result, { format: "html" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(
+    paths.junitPath,
+    `${renderGateReport(result, { format: "junit" })}
+`,
+    "utf-8"
+  );
+  await promises.writeFile(
+    paths.githubPath,
+    `${renderGateReport(result, { format: "github" })}
+`,
+    "utf-8"
+  );
+  return paths;
+}
+async function gateCommand(options = {}) {
+  try {
+    const format = options.format ?? (options.json ? "json" : "markdown");
+    if (!SUPPORTED_FORMATS.has(format)) {
+      if (options.json) {
+        console.log(
+          JSON.stringify({ ok: false, exitCode: 4, error: `Unsupported format: ${format}` }, null, 2)
+        );
+      } else {
+        console.error(`[AgentInspect] Unsupported format: ${format}`);
+      }
+      process.exitCode = 4;
+      return;
+    }
+    const gateOptions = {
+      ...options.dir !== void 0 ? { traceDir: resolveTraceDir({ dir: options.dir }) } : {},
+      ...options.suite !== void 0 ? { suitePath: options.suite } : {},
+      ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
+      ...parseRate(options.maxErrorRate) !== void 0 ? { maxErrorRate: parseRate(options.maxErrorRate) } : {},
+      ...parseDuration2(options.maxP95Duration) !== void 0 ? { maxP95DurationMs: parseDuration2(options.maxP95Duration) } : {},
+      forbidTools: collectList(options.forbidTool),
+      requireObservations: collectList(options.requireObservation)
+    };
+    let runs = [];
+    const needsRuns = gateHasThresholds(gateOptions) || gateOptions.traceDir !== void 0 && gateOptions.suitePath === void 0;
+    if (needsRuns) {
+      const traceDir = gateOptions.traceDir ?? resolveTraceDir({ dir: options.dir });
+      const loaded = await loadSessionRuns(traceDir);
+      runs = loaded.runs;
+      gateOptions.traceDir = traceDir;
+    }
+    const result = await runGate(runs, gateOptions);
+    let artifacts;
+    if (options.output !== void 0 && options.output.trim() !== "") {
+      artifacts = await writeArtifacts2(result, path24__default.default.resolve(options.output.trim()));
+    }
+    if (options.json || format === "json") {
+      console.log(JSON.stringify({ ...result, artifacts: artifacts ?? null }, null, 2));
+    } else if (format === "html") {
+      console.log(renderGateReport(result, { format: "html" }));
+    } else if (format === "junit") {
+      console.log(renderGateReport(result, { format: "junit" }));
+    } else if (format === "github") {
+      console.log(renderGateReport(result, { format: "github" }));
+    } else {
+      console.log(renderGateReport(result, { format: "markdown" }));
+      if (artifacts !== void 0) {
+        console.log("");
+        console.log("Artifacts:");
+        for (const value of Object.values(artifacts)) console.log(`- ${value}`);
+      }
+    }
+    process.exitCode = result.exitCode;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json) {
+      console.log(JSON.stringify({ ok: false, exitCode: 2, error: message }, null, 2));
+    } else {
+      console.error(`[AgentInspect] gate failed: ${message}`);
+    }
+    process.exitCode = 2;
+  }
+}
+
 // packages/cli/src/index.ts
 function runCommand(action) {
   void action().catch((error) => {
@@ -20983,6 +21533,15 @@ function createCliProgram() {
   ).option("--format <format>", "markdown, json, or html", "markdown").option("-o, --output <dir>", "write cohort-results.json, cohort-summary.md, cohort-report.html").option("--json", "print deterministic JSON result").action((opts) => {
     runCommand(() => cohortCommand(opts));
   });
+  program.command("gate").description("Run deterministic CI quality gates over traces or suites (v5.2+)").option("--dir <path>", "trace directory for threshold checks").option("--suite <path>", "suite config path").option("--max-error-rate <percent>", "maximum allowed error rate percentage").option("--max-p95-duration <ms>", "maximum allowed p95 run duration in ms").option("--forbid-tool <name>", "forbidden tool name (repeatable or comma-separated)").option(
+    "--require-observation <name>",
+    "required passed observation (repeatable or comma-separated)"
+  ).option("--format <format>", "markdown, json, html, junit, or github", "markdown").option(
+    "-o, --output <dir>",
+    "write gate-results.json, gate-summary.md, gate-report.html, junit.xml, github-step-summary.md"
+  ).option("--json", "print deterministic JSON result").action((opts) => {
+    runCommand(() => gateCommand(opts));
+  });
   return program;
 }
 function isPrimaryModule() {
@@ -20990,9 +21549,9 @@ function isPrimaryModule() {
   if (!entry) return false;
   const selfPath = url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
   try {
-    return fs.realpathSync(path23__default.default.resolve(entry)) === fs.realpathSync(path23__default.default.resolve(selfPath));
+    return fs.realpathSync(path24__default.default.resolve(entry)) === fs.realpathSync(path24__default.default.resolve(selfPath));
   } catch {
-    return path23__default.default.resolve(entry) === path23__default.default.resolve(selfPath);
+    return path24__default.default.resolve(entry) === path24__default.default.resolve(selfPath);
   }
 }
 if (isPrimaryModule()) {