agent-inspect 6.1.0 → 6.3.0

package/packages/cli/dist/index.cjs

@@ -3786,12 +3786,12 @@ function buildCriticalPath(runs, handoffs) {
     handoffs.filter((edge) => edge.confidence === "explicit").map((edge) => edge.from)
   );
   const ordered = [...runs].sort(compareRuns);
-  const path35 = [];
+  const path37 = [];
   const visited = /* @__PURE__ */ new Set();
   const pushRun = (run, confidence, source) => {
     if (visited.has(run.runId)) return;
     visited.add(run.runId);
-    path35.push({
+    path37.push({
       runId: run.runId,
       name: run.name,
       startedAt: run.startedAt,
@@ -3816,7 +3816,7 @@ function buildCriticalPath(runs, handoffs) {
     const confidence = explicitTargets.has(run.runId) || explicitSources.has(run.runId) ? "explicit" : "correlated";
     pushRun(run, confidence, confidence === "explicit" ? "manual" : "inferred");
   }
-  return path35;
+  return path37;
 }
 function metaRunIdMatches(run, token, runById) {
   const meta2 = extractSessionWorkflowMetadata(run.metadata);
@@ -4716,7 +4716,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path35) {
+function eventEvidence(event, path37) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -4726,7 +4726,7 @@ function eventEvidence(event, path35) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path35 ? { path: path35 } : {}
+    ...path37 ? { path: path37 } : {}
   };
 }
 function runEvidence(run) {
@@ -4789,9 +4789,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path35) {
-  const parts = path35.split(".");
-  return parts[parts.length - 1] ?? path35;
+function lastPathSegment(path37) {
+  const parts = path37.split(".");
+  return parts[parts.length - 1] ?? path37;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -4805,12 +4805,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path35, key, depth = 0) {
-  entries.push({ event, path: path35, key, value });
+function pushValueEntries(entries, event, value, path37, key, depth = 0) {
+  entries.push({ event, path: path37, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path35}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path37}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -4820,7 +4820,7 @@ function pushValueEntries(entries, event, value, path35, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path35}.${nestedKey}`,
+      `${path37}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -4901,9 +4901,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path35) => {
-    lines.push(`${path35}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path35}.${index}`));
+  const visit = (node, path37) => {
+    lines.push(`${path37}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path37}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -4952,9 +4952,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path35) {
+function firstEvidenceForKind(context, kind, path37) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path35)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path37)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -5304,13 +5304,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path35 = [];
+        const path37 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path35.slice(existing);
+            const cycle = path37.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -5326,8 +5326,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path35.length);
-          path35.push(current);
+          seenAt.set(current.eventId, path37.length);
+          path37.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -9599,19 +9599,19 @@ var require_file_uri_to_path = __commonJS({
       var rest = decodeURI(uri.substring(7));
       var firstSlash = rest.indexOf("/");
       var host = rest.substring(0, firstSlash);
-      var path35 = rest.substring(firstSlash + 1);
+      var path37 = rest.substring(firstSlash + 1);
       if ("localhost" == host) host = "";
       if (host) {
         host = sep + sep + host;
       }
-      path35 = path35.replace(/^(.+)\|/, "$1:");
+      path37 = path37.replace(/^(.+)\|/, "$1:");
       if (sep == "\\") {
-        path35 = path35.replace(/\//g, "\\");
+        path37 = path37.replace(/\//g, "\\");
       }
-      if (/^.+\:/.test(path35)) ; else {
-        path35 = sep + path35;
+      if (/^.+\:/.test(path37)) ; else {
+        path37 = sep + path37;
       }
-      return host + path35;
+      return host + path37;
     }
   }
 });
@@ -9620,18 +9620,18 @@ var require_file_uri_to_path = __commonJS({
 var require_bindings = __commonJS({
   "node_modules/.pnpm/bindings@1.5.0/node_modules/bindings/bindings.js"(exports$1, module) {
     var fs = __require("fs");
-    var path35 = __require("path");
+    var path37 = __require("path");
     var fileURLToPath2 = require_file_uri_to_path();
-    var join = path35.join;
-    var dirname = path35.dirname;
-    var exists2 = fs.accessSync && function(path36) {
+    var join = path37.join;
+    var dirname = path37.dirname;
+    var exists2 = fs.accessSync && function(path38) {
       try {
-        fs.accessSync(path36);
+        fs.accessSync(path38);
       } catch (e) {
         return false;
       }
       return true;
-    } || fs.existsSync || path35.existsSync;
+    } || fs.existsSync || path37.existsSync;
     var defaults = {
       arrow: process.env.NODE_BINDINGS_ARROW || " \u2192 ",
       compiled: process.env.NODE_BINDINGS_COMPILED_DIR || "compiled",
@@ -9676,7 +9676,7 @@ var require_bindings = __commonJS({
       if (!opts.module_root) {
         opts.module_root = exports$1.getRoot(exports$1.getFileName());
       }
-      if (path35.extname(opts.bindings) != ".node") {
+      if (path37.extname(opts.bindings) != ".node") {
         opts.bindings += ".node";
       }
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
@@ -9911,7 +9911,7 @@ var require_pragma = __commonJS({
 var require_backup = __commonJS({
   "node_modules/.pnpm/better-sqlite3@11.10.0/node_modules/better-sqlite3/lib/methods/backup.js"(exports$1, module) {
     var fs = __require("fs");
-    var path35 = __require("path");
+    var path37 = __require("path");
     var { promisify } = __require("util");
     var { cppdb } = require_util();
     var fsAccess = promisify(fs.access);
@@ -9927,7 +9927,7 @@ var require_backup = __commonJS({
       if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
       if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
       if (handler != null && typeof handler !== "function") throw new TypeError('Expected the "progress" option to be a function');
-      await fsAccess(path35.dirname(filename)).catch(() => {
+      await fsAccess(path37.dirname(filename)).catch(() => {
         throw new TypeError("Cannot save backup because the directory does not exist");
       });
       const isNewFile = await fsAccess(filename).then(() => false, () => true);
@@ -10227,7 +10227,7 @@ var require_inspect = __commonJS({
 var require_database = __commonJS({
   "node_modules/.pnpm/better-sqlite3@11.10.0/node_modules/better-sqlite3/lib/database.js"(exports$1, module) {
     var fs = __require("fs");
-    var path35 = __require("path");
+    var path37 = __require("path");
     var util = require_util();
     var SqliteError = require_sqlite_error();
     var DEFAULT_ADDON;
@@ -10263,7 +10263,7 @@ var require_database = __commonJS({
         addon = DEFAULT_ADDON || (DEFAULT_ADDON = require_bindings()("better_sqlite3.node"));
       } else if (typeof nativeBinding === "string") {
         const requireFunc = typeof __non_webpack_require__ === "function" ? __non_webpack_require__ : __require;
-        addon = requireFunc(path35.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
+        addon = requireFunc(path37.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
       } else {
         addon = nativeBinding;
       }
@@ -10271,7 +10271,7 @@ var require_database = __commonJS({
         addon.setErrorConstructor(SqliteError);
         addon.isInitialized = true;
       }
-      if (!anonymous && !fs.existsSync(path35.dirname(filename))) {
+      if (!anonymous && !fs.existsSync(path37.dirname(filename))) {
         throw new TypeError("Cannot open database because the directory does not exist");
       }
       Object.defineProperties(this, {
@@ -10729,7 +10729,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.1.0";
+var version = "6.3.0";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -13913,13 +13913,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path35 = buildPath(segments);
+  const path37 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path35,
+      path: path37,
       left: L.name,
       right: R.name
     });
@@ -13929,7 +13929,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path35,
+      path: path37,
       left: L.type,
       right: R.type
     });
@@ -13939,7 +13939,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path35,
+      path: path37,
       left: L.status,
       right: R.status
     });
@@ -13951,7 +13951,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path35,
+      path: path37,
       left: le || void 0,
       right: re || void 0
     });
@@ -13969,7 +13969,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path35,
+        path: path37,
         left: ld,
         right: rd
       });
@@ -13982,7 +13982,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path35,
+      path: path37,
       left: L.metadata,
       right: R.metadata
     });
@@ -13994,7 +13994,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path35,
+      path: path37,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -14155,11 +14155,11 @@ function diffRuns(left, right, options) {
 
 // packages/core/src/diff/renderer.ts
 init_source();
-function formatPath(path35) {
-  if (path35 === void 0 || path35.path.length === 0) {
+function formatPath(path37) {
+  if (path37 === void 0 || path37.path.length === 0) {
     return "(run)";
   }
-  return path35.path.map((s) => s.name).join(" > ");
+  return path37.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -15280,17 +15280,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path35, key) {
+function childPath(path37, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path35 ? `${path35}.${key}` : key;
+    return path37 ? `${path37}.${key}` : key;
   }
-  return `${path35 || "$"}[${JSON.stringify(key)}]`;
+  return `${path37 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path35, index) {
-  return `${path35 || "$"}[${index}]`;
+function indexPath(path37, index) {
+  return `${path37 || "$"}[${index}]`;
 }
-function makeFinding(path35, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path35, detector, action, severity, matchKind } : { path: path35, detector, action, severity, matchKind, preview };
+function makeFinding(path37, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path37, detector, action, severity, matchKind } : { path: path37, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -15359,11 +15359,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path35, depth, state) {
+  #redactValue(value, key, path37, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path35, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path37, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -15372,19 +15372,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path35, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path37, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path35, key, value });
+      const detections = detector.detect({ path: path37, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path35,
+            path37,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -15402,7 +15402,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path35, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path37, index), depth + 1, state);
       });
       return out;
     }
@@ -15414,7 +15414,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path35 === "$" ? "" : path35, entryKey),
+          childPath(path37 === "$" ? "" : path37, entryKey),
           depth + 1,
           state
         );
@@ -16355,23 +16355,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path35, evidence) {
+function validateSchemaField(value, field, path37, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path35, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path37, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path35, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path37, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path35}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path37}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -16872,10 +16872,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path35 = finding.evidence[0]?.path;
+    const path37 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path35 ? ` (${path35})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path37 ? ` (${path37})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -18228,10 +18228,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path35) {
-  return [{ runId: run.runId, ...path35 !== void 0 ? { path: path35 } : {} }];
+function evidenceForRun(run, path37) {
+  return [{ runId: run.runId, ...path37 !== void 0 ? { path: path37 } : {} }];
 }
-function evidenceForEvent(event, path35) {
+function evidenceForEvent(event, path37) {
   return [
     {
       runId: event.runId,
@@ -18239,7 +18239,7 @@ function evidenceForEvent(event, path35) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path35 !== void 0 ? { path: path35 } : {}
+      ...path37 !== void 0 ? { path: path37 } : {}
     }
   ];
 }
@@ -18397,9 +18397,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path35) {
+function firstEvidence(fields, run, path37) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path35) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path37) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -18776,8 +18776,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path35 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path35 ? ` (${path35})` : ""}`);
+      const path37 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path37 ? ` (${path37})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -18970,8 +18970,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path35 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path35 ? ` (${path35})` : ""}`);
+    const path37 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path37 ? ` (${path37})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -19209,8 +19209,8 @@ function printHuman3(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path35 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path35 ? ` (${path35})` : ""}`);
+    const path37 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path37 ? ` (${path37})` : ""}`);
   }
   console.log(`Note: ${result.note}`);
 }
@@ -19361,8 +19361,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path35 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path35})`);
+    const path37 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path37})`);
   }
   for (const diagnostic7 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic7.code}: ${diagnostic7.message}`);
@@ -20690,6 +20690,176 @@ Summary: ${failed} failed, ${warned} warnings`);
   if (failed > 0) process3__default.default.exitCode = 1;
 }
 
+// packages/adapter-sdk/src/privacy.ts
+var PRIVACY_CHECKLIST_ITEMS = [
+  {
+    id: "capture-metadata-only-default",
+    label: "Default capture is metadata-only (no full prompts/outputs on disk)",
+    required: true
+  },
+  {
+    id: "no-network-by-default",
+    label: "Adapter tests and defaults do not call external networks",
+    required: true
+  },
+  {
+    id: "no-upload",
+    label: "Adapter does not upload traces or logs to vendors by default",
+    required: true
+  },
+  {
+    id: "redaction-documented",
+    label: "Redaction/capture modes are documented for adapter users",
+    required: true
+  },
+  {
+    id: "framework-deps-scoped",
+    label: "Framework SDK dependencies stay in the optional adapter package",
+    required: true
+  }
+];
+function runPrivacyChecklist(input3 = {}) {
+  const captureMode = input3.captureMode ?? "metadata-only";
+  const items = [
+    {
+      id: "capture-metadata-only-default",
+      ok: captureMode === "metadata-only",
+      detail: captureMode === "metadata-only" ? void 0 : `captureMode is ${captureMode}; metadata-only is required by default`
+    },
+    {
+      id: "no-network-by-default",
+      ok: input3.networkAllowed !== true,
+      detail: input3.networkAllowed ? "network must be disabled in adapter defaults" : void 0
+    },
+    {
+      id: "no-upload",
+      ok: input3.uploadAllowed !== true,
+      detail: input3.uploadAllowed ? "upload must not be enabled by default" : void 0
+    },
+    {
+      id: "redaction-documented",
+      ok: input3.redactionDocumented !== false,
+      detail: input3.redactionDocumented === false ? "document capture/redaction behavior in adapter README" : void 0
+    },
+    {
+      id: "framework-deps-scoped",
+      ok: input3.frameworkDepsPackageScoped !== false,
+      detail: input3.frameworkDepsPackageScoped === false ? "keep framework SDK deps out of agent-inspect root/core" : void 0
+    }
+  ];
+  const requiredFailed = items.some(
+    (item) => PRIVACY_CHECKLIST_ITEMS.find((def) => def.id === item.id)?.required && !item.ok
+  );
+  return { ok: !requiredFailed, items };
+}
+var PLUGIN_MANIFEST_FILENAME = "agent-inspect-plugin.manifest.json";
+var PLUGIN_NAME_PREFIXES = [
+  "agent-inspect-plugin-",
+  "agent-inspect-adapter-",
+  "agent-inspect-renderer-",
+  "agent-inspect-check-",
+  "agent-inspect-importer-"
+];
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPluginPackageName(name) {
+  return PLUGIN_NAME_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function inferPluginTypeFromName(name) {
+  if (name.startsWith("agent-inspect-adapter-")) return "adapter";
+  if (name.startsWith("agent-inspect-renderer-")) return "renderer";
+  if (name.startsWith("agent-inspect-check-")) return "check";
+  if (name.startsWith("agent-inspect-importer-")) return "importer";
+  if (name.startsWith("agent-inspect-plugin-")) return "plugin";
+  return void 0;
+}
+function parsePluginManifest(input3) {
+  const errors = [];
+  const warnings = [];
+  if (!isPlainObject2(input3)) {
+    return { ok: false, errors: ["manifest must be a JSON object"], warnings };
+  }
+  if (input3.schemaVersion !== "1.0") {
+    errors.push('schemaVersion must be "1.0"');
+  }
+  const id = typeof input3.id === "string" ? input3.id.trim() : "";
+  if (!id || !isPluginPackageName(id)) {
+    errors.push("id must use an agent-inspect plugin naming prefix");
+  }
+  const type = typeof input3.type === "string" ? input3.type.trim() : "";
+  const allowedTypes = [
+    "plugin",
+    "adapter",
+    "renderer",
+    "check",
+    "importer"
+  ];
+  if (!allowedTypes.includes(type)) {
+    errors.push(`type must be one of: ${allowedTypes.join(", ")}`);
+  }
+  const name = typeof input3.name === "string" ? input3.name.trim() : "";
+  if (!name) errors.push("name must be a non-empty string");
+  const version2 = typeof input3.version === "string" ? input3.version.trim() : "";
+  if (!version2) errors.push("version must be a non-empty string");
+  let privacy;
+  if (input3.privacy !== void 0) {
+    if (!isPlainObject2(input3.privacy)) {
+      errors.push("privacy must be an object");
+    } else {
+      privacy = {};
+      if (input3.privacy.captureMode !== void 0) {
+        privacy.captureMode = String(input3.privacy.captureMode);
+      }
+      if (input3.privacy.networkAllowed !== void 0) {
+        privacy.networkAllowed = Boolean(input3.privacy.networkAllowed);
+      }
+      if (input3.privacy.uploadAllowed !== void 0) {
+        privacy.uploadAllowed = Boolean(input3.privacy.uploadAllowed);
+      }
+      if (input3.privacy.redactionDocumented !== void 0) {
+        privacy.redactionDocumented = Boolean(input3.privacy.redactionDocumented);
+      }
+      if (input3.privacy.frameworkDepsPackageScoped !== void 0) {
+        privacy.frameworkDepsPackageScoped = Boolean(input3.privacy.frameworkDepsPackageScoped);
+      }
+      if (privacy.networkAllowed === true || privacy.uploadAllowed === true) {
+        warnings.push("plugin declares network or upload \u2014 review before install");
+      }
+    }
+  } else {
+    warnings.push("privacy block missing; plugins doctor will assume conservative defaults");
+  }
+  if (errors.length > 0) return { ok: false, errors, warnings };
+  return {
+    ok: true,
+    manifest: {
+      schemaVersion: "1.0",
+      id,
+      type,
+      name,
+      version: version2,
+      ...privacy ? { privacy } : {}
+    },
+    errors: [],
+    warnings
+  };
+}
+async function readPluginManifestFile(packageDir) {
+  const manifestPath = path26__default.default.join(packageDir, PLUGIN_MANIFEST_FILENAME);
+  try {
+    const raw = await promises.readFile(manifestPath, "utf8");
+    const parsed = parsePluginManifest(JSON.parse(raw));
+    return { ...parsed, path: manifestPath };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, path: manifestPath, errors: [message], warnings: [] };
+  }
+}
+function validatePluginPrivacy(manifest) {
+  return runPrivacyChecklist(manifest.privacy ?? {});
+}
+
 // packages/adapter-sdk/src/indexer.ts
 init_advanced();
 function defineIndexer(indexer) {
@@ -20748,7 +20918,115 @@ function createTraceDirectoryIndexer() {
   });
 }
 
-// packages/cli/src/index-cmd.ts
+// packages/cli/src/plugins.ts
+async function readPackageName(packageDir) {
+  try {
+    const raw = await promises.readFile(path26__default.default.join(packageDir, "package.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed.name === "string" ? parsed.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function discoverPlugins(cwd = process.cwd()) {
+  const nodeModules = path26__default.default.join(cwd, "node_modules");
+  const found = [];
+  let entries;
+  try {
+    entries = await promises.readdir(nodeModules);
+  } catch {
+    return found;
+  }
+  for (const entry of entries.sort()) {
+    if (entry.startsWith("@")) continue;
+    if (!isPluginPackageName(entry)) continue;
+    const packageDir = path26__default.default.join(nodeModules, entry);
+    const manifestRead = await readPluginManifestFile(packageDir);
+    found.push({
+      packageName: entry,
+      packageDir,
+      ...manifestRead.manifest ? { manifest: manifestRead.manifest } : {},
+      manifestErrors: manifestRead.errors,
+      warnings: manifestRead.warnings
+    });
+  }
+  return found;
+}
+async function validatePluginPackage(packageRef, cwd = process.cwd()) {
+  const packageDir = path26__default.default.isAbsolute(packageRef) ? packageRef : path26__default.default.join(cwd, "node_modules", packageRef);
+  const packageName = await readPackageName(packageDir) ?? packageRef;
+  const errors = [];
+  const warnings = [];
+  if (!isPluginPackageName(packageName)) {
+    errors.push(`package name ${packageName} does not match plugin naming convention`);
+  }
+  const manifestRead = await readPluginManifestFile(packageDir);
+  errors.push(...manifestRead.errors);
+  warnings.push(...manifestRead.warnings);
+  if (manifestRead.manifest) {
+    const inferred = inferPluginTypeFromName(packageName);
+    if (inferred && inferred !== manifestRead.manifest.type) {
+      warnings.push(`manifest type ${manifestRead.manifest.type} differs from name prefix (${inferred})`);
+    }
+    const privacy = validatePluginPrivacy(manifestRead.manifest);
+    if (!privacy.ok) {
+      errors.push(
+        ...privacy.items.filter((item) => !item.ok).map((item) => item.detail ?? item.id)
+      );
+    }
+  } else if (manifestRead.errors.some((e) => e.includes("ENOENT"))) {
+    warnings.push(`missing ${PLUGIN_MANIFEST_FILENAME}; add manifest for doctor/validate`);
+  }
+  return {
+    ok: errors.length === 0,
+    packageName,
+    packageDir,
+    errors,
+    warnings,
+    manifest: manifestRead.manifest
+  };
+}
+async function pluginsListCommand(cwd) {
+  const plugins = await discoverPlugins(cwd);
+  if (plugins.length === 0) {
+    console.log("No agent-inspect plugins found in node_modules.");
+    return;
+  }
+  for (const plugin of plugins) {
+    const type = plugin.manifest?.type ?? inferPluginTypeFromName(plugin.packageName) ?? "unknown";
+    console.log(`${plugin.packageName} (${type})`);
+  }
+}
+async function pluginsDoctorCommand(cwd) {
+  const plugins = await discoverPlugins(cwd);
+  if (plugins.length === 0) {
+    console.log("No agent-inspect plugins found.");
+    return;
+  }
+  let issues = 0;
+  for (const plugin of plugins) {
+    const result = await validatePluginPackage(plugin.packageName, cwd);
+    if (result.ok && result.warnings.length === 0) {
+      console.log(`OK  ${plugin.packageName}`);
+      continue;
+    }
+    issues += 1;
+    console.log(`WARN ${plugin.packageName}`);
+    for (const warning of result.warnings) console.log(`  - ${warning}`);
+    for (const error of result.errors) console.log(`  ! ${error}`);
+  }
+  if (issues > 0) process.exitCode = 1;
+}
+async function pluginsValidateCommand(packageRef, cwd) {
+  const result = await validatePluginPackage(packageRef, cwd);
+  for (const warning of result.warnings) console.warn(`warning: ${warning}`);
+  if (!result.ok) {
+    for (const error of result.errors) console.error(`error: ${error}`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log(`Valid: ${result.packageName}`);
+}
 init_advanced();
 var INDEX_FILENAME = ".agent-inspect-index.json";
 function traceIndexPath(traceDir) {
@@ -21954,6 +22232,16 @@ function createCliProgram() {
   ).action((opts) => {
     runCommand(() => doctorCommand(opts));
   });
+  const pluginsCmd = program.command("plugins").description("List and validate explicit-install agent-inspect plugins (v6.2+)");
+  pluginsCmd.command("list").description("List installed plugin packages in node_modules").action(() => {
+    runCommand(() => pluginsListCommand());
+  });
+  pluginsCmd.command("doctor").description("Validate plugin manifests and privacy checklists").action(() => {
+    runCommand(() => pluginsDoctorCommand());
+  });
+  pluginsCmd.command("validate").description("Validate one plugin package by name or path").argument("<package>", "plugin package name or directory path").action((packageRef) => {
+    runCommand(() => pluginsValidateCommand(packageRef));
+  });
   const indexCmd = program.command("index").description("Optional local trace directory index (rebuildable metadata cache)");
   indexCmd.command("build").description("Build or refresh .agent-inspect-index.json").option("--dir <path>", "trace directory").option("--json", "print JSON result").option("--max-entries <n>", "cap indexed entries (default 10000)").action((opts) => {
     runCommand(() => indexBuildCommand(opts));