agent-inspect 6.16.2 → 6.17.0

package/packages/cli/dist/index.cjs

@@ -4,7 +4,7 @@
 var crypto = require('crypto');
 var promises = require('fs/promises');
 var os = require('os');
-var path30 = require('path');
+var path32 = require('path');
 var async_hooks = require('async_hooks');
 var process3 = require('process');
 var tty = require('tty');
@@ -14,13 +14,14 @@ var url = require('url');
 var module$1 = require('module');
 var commander = require('commander');
 var http = require('http');
+var child_process = require('child_process');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var os__default = /*#__PURE__*/_interopDefault(os);
-var path30__default = /*#__PURE__*/_interopDefault(path30);
+var path32__default = /*#__PURE__*/_interopDefault(path32);
 var process3__default = /*#__PURE__*/_interopDefault(process3);
 var tty__default = /*#__PURE__*/_interopDefault(tty);
 
@@ -864,7 +865,7 @@ function getDefaultTraceDir() {
     if (typeof home !== "string" || home.trim() === "") {
       return FALLBACK_TRACE_DIR;
     }
-    return path30__default.default.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
+    return path32__default.default.join(home, DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME);
   } catch {
     return FALLBACK_TRACE_DIR;
   }
@@ -872,11 +873,11 @@ function getDefaultTraceDir() {
 function getTraceFilePath(runId, traceDir) {
   const baseDir = traceDir ?? getDefaultTraceDir();
   let safeId = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
-  safeId = path30__default.default.basename(safeId);
+  safeId = path32__default.default.basename(safeId);
   if (safeId === "" || safeId === "." || safeId === "..") {
     safeId = "run_unknown";
   }
-  return path30__default.default.join(baseDir, `${safeId}.jsonl`);
+  return path32__default.default.join(baseDir, `${safeId}.jsonl`);
 }
 function formatError(error) {
   if (error instanceof Error) {
@@ -933,7 +934,7 @@ var init_utils = __esm({
     init_duration();
     DEFAULT_TRACE_DIR_NAME = ".agent-inspect";
     RUNS_DIR_NAME = "runs";
-    FALLBACK_TRACE_DIR = path30__default.default.join(
+    FALLBACK_TRACE_DIR = path32__default.default.join(
       os__default.default.tmpdir(),
       "agent-inspect",
       RUNS_DIR_NAME
@@ -1899,7 +1900,7 @@ var init_trace_directory = __esm({
         this.#dir = resolveTraceDir(options);
       }
       getPath(filename) {
-        return filename ? path30__default.default.join(this.#dir, filename) : this.#dir;
+        return filename ? path32__default.default.join(this.#dir, filename) : this.#dir;
       }
       async list() {
         try {
@@ -1928,7 +1929,7 @@ function parseIsoToMs2(value) {
 }
 async function extractMetadata(filePath, _quickScan) {
   const stats = await promises.stat(filePath);
-  let runIdFromFile = path30__default.default.basename(filePath);
+  let runIdFromFile = path32__default.default.basename(filePath);
   if (runIdFromFile.endsWith(".jsonl")) {
     runIdFromFile = runIdFromFile.slice(0, -".jsonl".length);
   }
@@ -3781,12 +3782,12 @@ function buildCriticalPath(runs, handoffs) {
     handoffs.filter((edge) => edge.confidence === "explicit").map((edge) => edge.from)
   );
   const ordered = [...runs].sort(compareRuns);
-  const path41 = [];
+  const path43 = [];
   const visited = /* @__PURE__ */ new Set();
   const pushRun = (run, confidence, source) => {
     if (visited.has(run.runId)) return;
     visited.add(run.runId);
-    path41.push({
+    path43.push({
       runId: run.runId,
       name: run.name,
       startedAt: run.startedAt,
@@ -3811,7 +3812,7 @@ function buildCriticalPath(runs, handoffs) {
     const confidence = explicitTargets.has(run.runId) || explicitSources.has(run.runId) ? "explicit" : "correlated";
     pushRun(run, confidence, confidence === "explicit" ? "manual" : "inferred");
   }
-  return path41;
+  return path43;
 }
 function metaRunIdMatches(run, token, runById) {
   const meta2 = extractSessionWorkflowMetadata(run.metadata);
@@ -4140,7 +4141,7 @@ var init_summary = __esm({
 });
 function sanitizeBundleRunId(runId) {
   let safe = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
-  safe = path30__default.default.basename(safe);
+  safe = path32__default.default.basename(safe);
   safe = safe.replace(/[^a-zA-Z0-9._-]+/g, "_");
   if (safe === "" || safe === "." || safe === "..") {
     safe = "run_unknown";
@@ -4150,12 +4151,12 @@ function sanitizeBundleRunId(runId) {
 function bundleRunAssetRelativePath(runId, extension) {
   const safe = sanitizeBundleRunId(runId);
   const ext = extension.startsWith(".") ? extension : `.${extension}`;
-  return path30__default.default.posix.join("assets", "runs", `${safe}${ext}`);
+  return path32__default.default.posix.join("assets", "runs", `${safe}${ext}`);
 }
 function assertBundlePathContained(outputDir, relativePath) {
-  const base = path30__default.default.resolve(outputDir);
-  const resolved = path30__default.default.resolve(base, relativePath);
-  if (resolved !== base && !resolved.startsWith(base + path30__default.default.sep)) {
+  const base = path32__default.default.resolve(outputDir);
+  const resolved = path32__default.default.resolve(base, relativePath);
+  if (resolved !== base && !resolved.startsWith(base + path32__default.default.sep)) {
     throw new Error(`Bundle path escapes output directory: ${relativePath}`);
   }
   return resolved;
@@ -4165,7 +4166,7 @@ function normalizeBundleOutputPath(out, options) {
   if (trimmed === "") {
     throw new Error("--out requires a non-empty path.");
   }
-  const resolved = path30__default.default.resolve(trimmed);
+  const resolved = path32__default.default.resolve(trimmed);
   if (options?.preserveZipExtension !== true && resolved.toLowerCase().endsWith(".zip")) {
     return resolved.slice(0, -4);
   }
@@ -4174,7 +4175,7 @@ function normalizeBundleOutputPath(out, options) {
 function defaultBundleOutputPath(runIds) {
   const label = runIds.length === 1 ? sanitizeBundleRunId(runIds[0]) : `multi-${runIds.length}`;
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  return path30__default.default.resolve(`agent-inspect-bundle-${label}-${stamp}`);
+  return path32__default.default.resolve(`agent-inspect-bundle-${label}-${stamp}`);
 }
 var init_paths = __esm({
   "packages/core/src/bundle/paths.ts"() {
@@ -4237,7 +4238,7 @@ function assertEvidenceRelativePath(relativePath) {
     throw new Error("Evidence file path must be a non-empty relative path.");
   }
   const trimmed = relativePath.trim().replaceAll("\\", "/");
-  if (path30__default.default.isAbsolute(trimmed) || trimmed.startsWith("/")) {
+  if (path32__default.default.isAbsolute(trimmed) || trimmed.startsWith("/")) {
     throw new Error(`Evidence file path must be relative: ${relativePath}`);
   }
   const parts = trimmed.split("/").filter((part) => part !== "");
@@ -5104,13 +5105,13 @@ function pairSteps(left, right) {
   return pairs;
 }
 function compareLeafSteps(L, R, segments, opts, out) {
-  const path41 = buildPath(segments);
+  const path43 = buildPath(segments);
   if (L.name !== R.name) {
     out.push({
       kind: "structure",
       severity: "warning",
       message: "Step name differs",
-      path: path41,
+      path: path43,
       left: L.name,
       right: R.name
     });
@@ -5120,7 +5121,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-type",
       severity: "warning",
       message: "Step type differs",
-      path: path41,
+      path: path43,
       left: L.type,
       right: R.type
     });
@@ -5130,7 +5131,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "step-status",
       severity: "warning",
       message: "Step status differs",
-      path: path41,
+      path: path43,
       left: L.status,
       right: R.status
     });
@@ -5142,7 +5143,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "error",
       severity: "error",
       message: "Step error message differs",
-      path: path41,
+      path: path43,
       left: le || void 0,
       right: re || void 0
     });
@@ -5160,7 +5161,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
         kind: "duration",
         severity: "info",
         message: "Step duration differs",
-        path: path41,
+        path: path43,
         left: ld,
         right: rd
       });
@@ -5173,7 +5174,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "metadata",
       severity: "info",
       message: "Step metadata differs",
-      path: path41,
+      path: path43,
       left: L.metadata,
       right: R.metadata
     });
@@ -5185,7 +5186,7 @@ function compareLeafSteps(L, R, segments, opts, out) {
       kind: "output",
       severity: "info",
       message: "Output preview differs",
-      path: path41,
+      path: path43,
       left: L.outputPreview,
       right: R.outputPreview
     });
@@ -5352,11 +5353,11 @@ var init_engine = __esm({
 });
 
 // packages/core/src/diff/renderer.ts
-function formatPath(path41) {
-  if (path41 === void 0 || path41.path.length === 0) {
+function formatPath(path43) {
+  if (path43 === void 0 || path43.path.length === 0) {
     return "(run)";
   }
-  return path41.path.map((s) => s.name).join(" > ");
+  return path43.path.map((s) => s.name).join(" > ");
 }
 function formatValue(v, verbose) {
   if (v === void 0) return "(undefined)";
@@ -5736,11 +5737,11 @@ async function listFilesRecursive(root) {
   async function walk(dir) {
     const entries = await promises.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const abs = path30__default.default.join(dir, entry.name);
+      const abs = path32__default.default.join(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(abs);
       } else if (entry.isFile()) {
-        const rel = path30__default.default.relative(root, abs).split(path30__default.default.sep).join("/");
+        const rel = path32__default.default.relative(root, abs).split(path32__default.default.sep).join("/");
         out.push(rel);
       }
     }
@@ -5750,7 +5751,7 @@ async function listFilesRecursive(root) {
 }
 async function verifyEvidenceDirectory(rootPath, options = {}) {
   const unexpectedMode = options.unexpectedFiles ?? "fail";
-  const root = path30__default.default.resolve(rootPath);
+  const root = path32__default.default.resolve(rootPath);
   const issues = [];
   let rootStat;
   try {
@@ -5780,7 +5781,7 @@ async function verifyEvidenceDirectory(rootPath, options = {}) {
       checkedFiles: 0
     };
   }
-  const manifestPath = path30__default.default.join(root, EVIDENCE_MANIFEST_FILENAME);
+  const manifestPath = path32__default.default.join(root, EVIDENCE_MANIFEST_FILENAME);
   let manifestText;
   try {
     manifestText = await promises.readFile(manifestPath, "utf-8");
@@ -5866,7 +5867,7 @@ async function verifyEvidenceDirectory(rootPath, options = {}) {
       continue;
     }
     listed.add(rel);
-    const abs = path30__default.default.join(root, ...rel.split("/"));
+    const abs = path32__default.default.join(root, ...rel.split("/"));
     let bytes;
     try {
       bytes = await promises.readFile(abs);
@@ -6181,7 +6182,7 @@ function normalizeSuiteConfig(value) {
 }
 async function validateSuiteConfig(config, options) {
   const diagnostics = [];
-  const tracesDir = path30__default.default.resolve(options.configDir, config.traces);
+  const tracesDir = path32__default.default.resolve(options.configDir, config.traces);
   try {
     await promises.access(tracesDir);
   } catch {
@@ -6191,7 +6192,7 @@ async function validateSuiteConfig(config, options) {
   }
   for (const suiteCase of config.cases) {
     if (suiteCase.input !== void 0) {
-      const inputPath = path30__default.default.resolve(options.configDir, suiteCase.input);
+      const inputPath = path32__default.default.resolve(options.configDir, suiteCase.input);
       try {
         await promises.access(inputPath);
       } catch {
@@ -6224,12 +6225,12 @@ async function fileExists(filePath) {
   }
 }
 async function resolveSuiteConfigPath(options = {}) {
-  const cwd = path30__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path32__default.default.resolve(options.cwd ?? process.cwd());
   if (options.configPath !== void 0 && options.configPath.trim() !== "") {
-    return path30__default.default.resolve(cwd, options.configPath.trim());
+    return path32__default.default.resolve(cwd, options.configPath.trim());
   }
   for (const name of DEFAULT_SUITE_CONFIG_NAMES) {
-    const candidate = path30__default.default.join(cwd, name);
+    const candidate = path32__default.default.join(cwd, name);
     if (await fileExists(candidate)) return candidate;
   }
   throw new Error(
@@ -6246,7 +6247,7 @@ async function loadSuiteConfig(options = {}) {
       diagnostics: [diagnostic2("AI_SUITE_CONFIG_LOAD_FAILED", message)]
     });
   }
-  const extension = path30__default.default.extname(configPath);
+  const extension = path32__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS.has(extension)) {
     const message = "TypeScript suite configs require an explicit precompiled JavaScript config or future --config-loader support.";
     throw Object.assign(new Error(message), {
@@ -6271,7 +6272,7 @@ async function loadSuiteConfig(options = {}) {
     return {
       config,
       configPath,
-      configDir: path30__default.default.dirname(configPath)
+      configDir: path32__default.default.dirname(configPath)
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -6321,7 +6322,7 @@ async function exists(filePath) {
 }
 async function resolveSuiteCaseTrace(suiteCase, options) {
   if (suiteCase.trace !== void 0) {
-    const tracePath = path30__default.default.resolve(options.configDir, suiteCase.trace);
+    const tracePath = path32__default.default.resolve(options.configDir, suiteCase.trace);
     if (await exists(tracePath)) {
       return { caseId: suiteCase.id, tracePath, missing: false };
     }
@@ -6337,7 +6338,7 @@ async function resolveSuiteCaseTrace(suiteCase, options) {
   if (await exists(directPath)) {
     return { caseId: suiteCase.id, tracePath: directPath, runId: runKey, missing: false };
   }
-  const nestedPath = path30__default.default.join(options.tracesDir, `${path30__default.default.basename(runKey)}.jsonl`);
+  const nestedPath = path32__default.default.join(options.tracesDir, `${path32__default.default.basename(runKey)}.jsonl`);
   if (await exists(nestedPath)) {
     return { caseId: suiteCase.id, tracePath: nestedPath, runId: runKey, missing: false };
   }
@@ -7055,7 +7056,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path41) {
+function eventEvidence(event, path43) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -7065,7 +7066,7 @@ function eventEvidence(event, path41) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path41 ? { path: path41 } : {}
+    ...path43 ? { path: path43 } : {}
   };
 }
 function runEvidence(run) {
@@ -7135,9 +7136,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path41) {
-  const parts = path41.split(".");
-  return parts[parts.length - 1] ?? path41;
+function lastPathSegment(path43) {
+  const parts = path43.split(".");
+  return parts[parts.length - 1] ?? path43;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -7151,12 +7152,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path41, key, depth = 0) {
-  entries.push({ event, path: path41, key, value });
+function pushValueEntries(entries, event, value, path43, key, depth = 0) {
+  entries.push({ event, path: path43, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path41}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path43}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -7166,7 +7167,7 @@ function pushValueEntries(entries, event, value, path41, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path41}.${nestedKey}`,
+      `${path43}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -7205,18 +7206,18 @@ function isRawContentKey(key, forbiddenKeys) {
   const normalized = normalizedKey(key);
   return forbiddenKeys.some((forbidden) => normalized === normalizedKey(forbidden));
 }
-function isSafeRawContentMetricPath(path41, key, safePathPrefixes) {
-  const leaf = normalizedKey(key ?? lastPathSegment(path41));
+function isSafeRawContentMetricPath(path43, key, safePathPrefixes) {
+  const leaf = normalizedKey(key ?? lastPathSegment(path43));
   if (!SAFE_USAGE_LEAF_KEYS.has(leaf)) return false;
-  const parts = path41.split(".").filter(Boolean);
+  const parts = path43.split(".").filter(Boolean);
   if (parts.length < 2) return false;
   const parent = parts[parts.length - 2] ?? "";
   const parentNorm = normalizedKey(parent);
   return safePathPrefixes.some((prefix) => parentNorm === normalizedKey(prefix));
 }
-function isRawContentPath(path41, key, forbiddenKeys, safePathPrefixes) {
-  if (isSafeRawContentMetricPath(path41, key, safePathPrefixes)) return false;
-  return isRawContentKey(key ?? lastPathSegment(path41), forbiddenKeys);
+function isRawContentPath(path43, key, forbiddenKeys, safePathPrefixes) {
+  if (isSafeRawContentMetricPath(path43, key, safePathPrefixes)) return false;
+  return isRawContentKey(key ?? lastPathSegment(path43), forbiddenKeys);
 }
 function parentMarkedUnresolved(event) {
   if (booleanAttr(event, [
@@ -7255,9 +7256,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path41) => {
-    lines.push(`${path41}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path41}.${index}`));
+  const visit = (node, path43) => {
+    lines.push(`${path43}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path43}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -7306,9 +7307,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path41) {
+function firstEvidenceForKind(context, kind, path43) {
   const event = semanticEvents(context).find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path41)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path43)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -7658,13 +7659,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...semanticEvents(context)].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path41 = [];
+        const path43 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path41.slice(existing);
+            const cycle = path43.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -7680,8 +7681,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path41.length);
-          path41.push(current);
+          seenAt.set(current.eventId, path43.length);
+          path43.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -9015,7 +9016,7 @@ function findReaderByFormat(format, readers) {
 }
 async function jsonlFilesInDirectory(dirPath) {
   const entries = await promises.readdir(dirPath, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path30__default.default.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path32__default.default.join(dirPath, entry.name)).sort((a, b) => a.localeCompare(b));
 }
 async function resolveInput(input3) {
   const cached2 = resolvedInputCache.get(input3);
@@ -10723,7 +10724,7 @@ async function runSuiteCase(suiteCase, config, options) {
 async function runSuite(options = {}) {
   const startedAt = new Date(options.nowMs ?? Date.now()).toISOString();
   const { config, configPath, configDir } = await loadSuiteConfig(options);
-  const tracesDir = path30__default.default.resolve(configDir, config.traces);
+  const tracesDir = path32__default.default.resolve(configDir, config.traces);
   const cases = [];
   const diagnostics = [];
   for (const suiteCase of config.cases) {
@@ -11750,7 +11751,7 @@ function validateOptions(options) {
 }
 function isConfigLoadError(error) {
   if (!(error instanceof Error)) return false;
-  const ext = path30__default.default.extname(error.message);
+  const ext = path32__default.default.extname(error.message);
   if (error.message.includes("Unsupported suite config extension")) return true;
   if (error.message.includes("TypeScript suite configs require")) return true;
   if (error.message.includes("No suite config found")) return true;
@@ -12144,8 +12145,8 @@ var init_load_sqlite = __esm({
   }
 });
 function resolveIndexDbPath(traceDir, dbPath) {
-  if (dbPath && dbPath.trim() !== "") return path30__default.default.resolve(dbPath);
-  return path30__default.default.join(path30__default.default.resolve(traceDir), INDEX_DB_FILENAME);
+  if (dbPath && dbPath.trim() !== "") return path32__default.default.resolve(dbPath);
+  return path32__default.default.join(path32__default.default.resolve(traceDir), INDEX_DB_FILENAME);
 }
 function str(value) {
   return typeof value === "string" && value !== "" ? value : null;
@@ -12237,7 +12238,7 @@ async function buildIndex(options = {}) {
       warnings.push(`index.unreadable: ${file}`);
     }
   }
-  await promises.mkdir(path30__default.default.dirname(dbPath), { recursive: true });
+  await promises.mkdir(path32__default.default.dirname(dbPath), { recursive: true });
   await promises.rm(dbPath, { force: true });
   const Sqlite = loadBetterSqlite3();
   const db = new Sqlite(dbPath);
@@ -12485,7 +12486,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.16.2";
+var version = "6.17.0";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -15508,9 +15509,9 @@ Trace directory: ${traceDir}`);
     process.exitCode = 1;
   }
   const resolvedOutput = resolveOutputOption(options);
-  const outPath = resolvedOutput !== void 0 ? path30__default.default.resolve(resolvedOutput) : void 0;
+  const outPath = resolvedOutput !== void 0 ? path32__default.default.resolve(resolvedOutput) : void 0;
   if (outPath !== void 0) {
-    await promises.mkdir(path30__default.default.dirname(outPath), { recursive: true });
+    await promises.mkdir(path32__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     const vlabel = validation !== void 0 ? validation.ok ? "ok" : "failed" : "skipped";
     console.log(`Wrote ${result.fileExtension} export to ${outPath} (validation: ${vlabel})`);
@@ -15869,7 +15870,7 @@ function indexedToMetadata(row, traceDir) {
     endedAt: row.endedAt ?? void 0,
     durationMs: row.durationMs ?? void 0,
     eventCount: 0,
-    filePath: path30__default.default.join(traceDir, row.file),
+    filePath: path32__default.default.join(traceDir, row.file),
     fileSize: 0,
     createdAt: new Date(row.mtimeMs)
   };
@@ -16351,9 +16352,9 @@ async function reportCommand(runId, options = {}) {
     ...options.section ? { section: options.section } : {}
   });
   const resolvedOutput = resolveOutputOption(options);
-  const outPath = resolvedOutput !== void 0 ? path30__default.default.resolve(resolvedOutput) : void 0;
+  const outPath = resolvedOutput !== void 0 ? path32__default.default.resolve(resolvedOutput) : void 0;
   if (outPath !== void 0) {
-    await promises.mkdir(path30__default.default.dirname(outPath), { recursive: true });
+    await promises.mkdir(path32__default.default.dirname(outPath), { recursive: true });
     await promises.writeFile(outPath, result.content, "utf-8");
     console.log(`Wrote ${result.fileExtension} report to ${outPath}`);
   }
@@ -16535,8 +16536,8 @@ function passesLuhn(value) {
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var EPOCH_MS_RE = /^1[0-9]{12}$/;
 var EMAIL_RE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
-function pathSuggestsNonCard(path41) {
-  const normalized = path41.toLowerCase().replace(/[^a-z0-9._]/g, "");
+function pathSuggestsNonCard(path43) {
+  const normalized = path43.toLowerCase().replace(/[^a-z0-9._]/g, "");
   return /(^|\.)(tokenusage|usage)(\.|$)/.test(normalized) || /(startedat|endedat|durationms|timestamp|createdat|updatedat)(\.|$)/.test(normalized) || /(^|\.)(runid|traceid|spanid|eventid|sessionid|userid|parentid|requestid|correlationid)(\.|$)/.test(
     normalized
   ) || /(^|\.)ts(\.|$)/.test(normalized);
@@ -16723,17 +16724,17 @@ function applyRule(rule, value, replacement) {
   }
   return value;
 }
-function childPath(path41, key) {
+function childPath(path43, key) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
-    return path41 ? `${path41}.${key}` : key;
+    return path43 ? `${path43}.${key}` : key;
   }
-  return `${path41 || "$"}[${JSON.stringify(key)}]`;
+  return `${path43 || "$"}[${JSON.stringify(key)}]`;
 }
-function indexPath(path41, index) {
-  return `${path41 || "$"}[${index}]`;
+function indexPath(path43, index) {
+  return `${path43 || "$"}[${index}]`;
 }
-function makeFinding(path41, detector, action, matchKind, severity = "warning", preview) {
-  return preview === void 0 ? { path: path41, detector, action, severity, matchKind } : { path: path41, detector, action, severity, matchKind, preview };
+function makeFinding(path43, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path43, detector, action, severity, matchKind } : { path: path43, detector, action, severity, matchKind, preview };
 }
 function createRedactionProfile(profile = "local") {
   switch (profile) {
@@ -16802,11 +16803,11 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
-  #redactValue(value, key, path41, depth, state) {
+  #redactValue(value, key, path43, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
         state,
-        makeFinding(path41, "structure.maxDepth", "truncate", "value", "warning")
+        makeFinding(path43, "structure.maxDepth", "truncate", "value", "warning")
       );
       return "[Truncated]";
     }
@@ -16815,19 +16816,19 @@ var Redactor2 = class {
       if (rule) {
         this.#recordFinding(
           state,
-          makeFinding(path41, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+          makeFinding(path43, `key.${rule.key}`, actionForRule(rule), "key", "warning")
         );
         return applyRule(rule, value, this.#replacement);
       }
     }
     for (const detector of this.#detectors) {
-      const detections = detector.detect({ path: path41, key, value });
+      const detections = detector.detect({ path: path43, key, value });
       for (const detection of detections) {
         const action = detection.action ?? "replace";
         this.#recordFinding(
           state,
           makeFinding(
-            path41,
+            path43,
             detector.id,
             action,
             detection.matchKind ?? detector.matchKind ?? "custom",
@@ -16845,7 +16846,7 @@ var Redactor2 = class {
       const out = [];
       state.seen.set(value, out);
       value.forEach((item, index) => {
-        out[index] = this.#redactValue(item, void 0, indexPath(path41, index), depth + 1, state);
+        out[index] = this.#redactValue(item, void 0, indexPath(path43, index), depth + 1, state);
       });
       return out;
     }
@@ -16857,7 +16858,7 @@ var Redactor2 = class {
         out[entryKey] = this.#redactValue(
           entryValue,
           entryKey,
-          childPath(path41 === "$" ? "" : path41, entryKey),
+          childPath(path43 === "$" ? "" : path43, entryKey),
           depth + 1,
           state
         );
@@ -17328,14 +17329,14 @@ function uniqueSorted(values) {
   return [...new Set(values)].sort();
 }
 function isWithinDirectory(child, parent) {
-  const relative = path30__default.default.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path30__default.default.isAbsolute(relative);
+  const relative = path32__default.default.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path32__default.default.isAbsolute(relative);
 }
 async function resolveOutputPath(inputPath, output2, force) {
   if (output2 === void 0 || output2.trim() === "") return void 0;
-  const inputAbs = path30__default.default.resolve(inputPath);
-  const outputAbs = path30__default.default.resolve(output2.trim());
-  const inputDir = path30__default.default.dirname(inputAbs);
+  const inputAbs = path32__default.default.resolve(inputPath);
+  const outputAbs = path32__default.default.resolve(output2.trim());
+  const inputDir = path32__default.default.dirname(inputAbs);
   if (!isWithinDirectory(outputAbs, inputDir)) {
     throw new Error("Refusing to write migrated output outside the input directory.");
   }
@@ -17456,7 +17457,7 @@ async function migrateCommand(input3, options = {}) {
     process.exitCode = 1;
     return;
   }
-  const inputPath = path30__default.default.resolve(input3.trim());
+  const inputPath = path32__default.default.resolve(input3.trim());
   const dryRun = options.dryRun === true;
   if (!dryRun && (options.output === void 0 || options.output.trim() === "")) {
     console.error("migrate requires --dry-run or --output <path>.");
@@ -17475,7 +17476,7 @@ async function migrateCommand(input3, options = {}) {
     );
     const result = await buildMigration(inputPath, outputPath);
     if (!dryRun && outputPath !== void 0) {
-      await promises.mkdir(path30__default.default.dirname(outputPath), { recursive: true });
+      await promises.mkdir(path32__default.default.dirname(outputPath), { recursive: true });
       await promises.writeFile(outputPath, result.content, "utf-8");
     }
     printSummary2(result, dryRun);
@@ -17489,6 +17490,246 @@ init_advanced();
 
 // packages/core/src/entries/checks.ts
 init_checks2();
+
+// packages/cli/src/evidence-on.ts
+init_advanced();
+function validateReporterArtifactPath(options) {
+  const outputDir = path32__default.default.resolve(options.outputDir);
+  const diagnostics = [];
+  const rawPath = options.relativePath;
+  if (rawPath.length === 0) {
+    diagnostics.push({
+      code: "artifact_path_empty",
+      severity: "error",
+      message: "Reporter artifact path must not be empty."
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  if (rawPath.includes("\0")) {
+    diagnostics.push({
+      code: "invalid_artifact_path",
+      severity: "error",
+      message: "Reporter artifact path must not contain null bytes.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  if (path32__default.default.isAbsolute(rawPath) || path32__default.default.win32.isAbsolute(rawPath)) {
+    diagnostics.push({
+      code: "artifact_path_absolute",
+      severity: "error",
+      message: "Reporter artifact path must be relative.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  const normalized = path32__default.default.posix.normalize(rawPath.replace(/\\/g, "/"));
+  const segments = normalized.split("/");
+  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path must stay under the output directory.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  const absolutePath = path32__default.default.resolve(outputDir, normalized);
+  const relFromOutput = path32__default.default.relative(outputDir, absolutePath);
+  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path32__default.default.isAbsolute(relFromOutput)) {
+    diagnostics.push({
+      code: "artifact_path_escape",
+      severity: "error",
+      message: "Reporter artifact path resolved outside the output directory.",
+      target: rawPath
+    });
+    return { ok: false, outputDir, diagnostics };
+  }
+  return {
+    ok: true,
+    outputDir,
+    relativePath: normalized,
+    absolutePath,
+    diagnostics
+  };
+}
+var EVIDENCE_CI_ARTIFACT_FILES = [
+  "evidence.html",
+  "evidence.json",
+  "check-results.json",
+  "trace.jsonl"
+];
+function createEvidenceCiArtifacts(options) {
+  const profile = options.redactionProfile ?? "share";
+  const prefix = options.relativeDir !== void 0 && options.relativeDir.trim() !== "" ? options.relativeDir.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "") : "";
+  const join = (name) => prefix === "" ? name : path32__default.default.posix.join(prefix, name);
+  const formatFor = (name) => {
+    if (name.endsWith(".html")) return "html";
+    if (name.endsWith(".jsonl")) return "jsonl";
+    return "json";
+  };
+  return EVIDENCE_CI_ARTIFACT_FILES.map((name) => ({
+    kind: "evidence",
+    path: join(name),
+    format: formatFor(name),
+    redactionProfile: profile,
+    title: `Evidence v2 ${name}`
+  }));
+}
+
+// packages/cli/src/evidence-on.ts
+function shouldEmitEvidence(mode, failed) {
+  if (mode === void 0 || mode === "never") return false;
+  if (mode === "always") return true;
+  return failed;
+}
+function parseEvidenceProfile(value) {
+  const profile = (value ?? "share").trim().toLowerCase();
+  if (profile === "local" || profile === "share" || profile === "strict") {
+    return profile;
+  }
+  throw new Error(
+    `Unsupported --evidence-profile "${value}". Use local, share, or strict.`
+  );
+}
+function parseEvidenceFormat(value) {
+  const format = (value ?? "directory").trim().toLowerCase();
+  if (format === "directory" || format === "html" || format === "zip") {
+    return format;
+  }
+  throw new Error(
+    `Unsupported --evidence-format "${value}". Use directory, html, or zip.`
+  );
+}
+function toAssessmentStatus(failed) {
+  return failed ? "UNSAFE" : "SAFE";
+}
+function stableJson2(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+async function writeLocalEvidence(input3) {
+  const profile = input3.redactionProfile ?? "share";
+  const format = input3.format ?? "directory";
+  const baseDir = path32__default.default.resolve(input3.outputDir);
+  await promises.mkdir(
+    format === "zip" && baseDir.toLowerCase().endsWith(".zip") ? path32__default.default.dirname(baseDir) : baseDir,
+    { recursive: true }
+  );
+  const sourceContents = /* @__PURE__ */ new Map();
+  if (input3.sourceContents instanceof Map) {
+    for (const [runId, content] of input3.sourceContents) {
+      sourceContents.set(runId, content);
+    }
+  } else if (input3.sourceContents !== void 0) {
+    for (const [runId, content] of Object.entries(input3.sourceContents)) {
+      sourceContents.set(runId, content);
+    }
+  }
+  const traceDir = resolveTraceDir({ dir: input3.dir });
+  let combined = "";
+  for (const runId of input3.runIds) {
+    let raw = sourceContents.get(runId) ?? "";
+    if (raw === "") {
+      try {
+        raw = await promises.readFile(getTraceFilePath(runId, traceDir), "utf-8");
+      } catch {
+        raw = "";
+      }
+      sourceContents.set(runId, raw);
+    }
+    const redacted = redactTraceContent(raw, profile);
+    combined += redacted.content.endsWith("\n") ? redacted.content : `${redacted.content}
+`;
+  }
+  const assessmentStatus = toAssessmentStatus(input3.failed);
+  const evidencePackage = buildEvidenceCiPackage({
+    generatorVersion: version,
+    runIds: input3.runIds,
+    sourceContents,
+    redactedTraceJsonl: combined,
+    redactionProfile: profile,
+    assessmentStatus,
+    checkResultsJson: input3.checkResultsJson,
+    ...input3.summaryText !== void 0 ? { summaryText: input3.summaryText } : {}
+  });
+  const files = [
+    ["evidence.html", evidencePackage["evidence.html"]],
+    ["evidence.json", evidencePackage["evidence.json"]],
+    ["check-results.json", evidencePackage["check-results.json"]],
+    ["trace.jsonl", evidencePackage["trace.jsonl"]]
+  ];
+  const expected = createEvidenceCiArtifacts({
+    redactionProfile: profile
+  }).map((a) => a.path);
+  for (const name of expected) {
+    if (!files.some(([fileName]) => fileName === name)) {
+      throw new Error(`Evidence CI package missing expected file: ${name}`);
+    }
+  }
+  if (format === "zip") {
+    const zipPath = baseDir.toLowerCase().endsWith(".zip") ? baseDir : `${baseDir}.zip`;
+    await promises.mkdir(path32__default.default.dirname(zipPath), { recursive: true });
+    const archive = buildZipArchive(
+      files.map(([relativePath, content]) => ({
+        path: relativePath,
+        content
+      }))
+    );
+    await promises.writeFile(zipPath, archive);
+    return zipPath;
+  }
+  if (format === "html") {
+    let htmlPath = baseDir;
+    let sidecarDir = baseDir;
+    if (baseDir.toLowerCase().endsWith(".html")) {
+      htmlPath = baseDir;
+      sidecarDir = path32__default.default.dirname(baseDir);
+    } else {
+      await promises.mkdir(baseDir, { recursive: true });
+      htmlPath = path32__default.default.join(baseDir, "evidence.html");
+      sidecarDir = baseDir;
+    }
+    await promises.mkdir(sidecarDir, { recursive: true });
+    await promises.writeFile(htmlPath, evidencePackage["evidence.html"], "utf-8");
+    await promises.writeFile(
+      path32__default.default.join(sidecarDir, "evidence.json"),
+      evidencePackage["evidence.json"],
+      "utf-8"
+    );
+    return htmlPath;
+  }
+  await promises.mkdir(baseDir, { recursive: true });
+  for (const [name, content] of files) {
+    await promises.writeFile(path32__default.default.join(baseDir, name), content, "utf-8");
+  }
+  return baseDir;
+}
+function checkResultToEvidenceJson(result, runIds) {
+  const status = result.status === "pass" ? "SAFE" : result.status === "fail" ? "UNSAFE" : "UNKNOWN";
+  return stableJson2({
+    aggregateStatus: status,
+    runs: runIds.map((runId) => ({
+      runId,
+      status,
+      errors: result.summary.errors,
+      warnings: result.summary.warnings,
+      findings: result.findings.length
+    })),
+    findings: result.findings,
+    diagnostics: result.diagnostics
+  });
+}
+function defaultEvidenceDir(label) {
+  const safe = label.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 80) || "evidence";
+  return path32__default.default.join(".agent-inspect", "evidence", safe);
+}
+function resolveEvidenceOutputDir(evidenceDir, label) {
+  if (evidenceDir !== void 0 && evidenceDir.trim() !== "") {
+    return path32__default.default.resolve(evidenceDir.trim());
+  }
+  return defaultEvidenceDir(label);
+}
 var ALL_RULES = [
   "circuit.same-tool-repetition",
   "circuit.same-args-repetition",
@@ -17809,23 +18050,23 @@ function evaluatePromptInjection(text, options = {}) {
   }
   return fail(ruleId, `Matched ${evidence.length} injection pattern(s).`, evidence, "warning");
 }
-function validateSchemaField(value, field, path41, evidence) {
+function validateSchemaField(value, field, path43, evidence) {
   const ruleId = "guardrail.structured-output";
   if (field.type) {
     const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     if (actual !== field.type) {
-      evidence.push({ ruleId, path: path41, preview: `expected ${field.type}, got ${actual}` });
+      evidence.push({ ruleId, path: path43, preview: `expected ${field.type}, got ${actual}` });
       return;
     }
   }
   if (field.enum && !field.enum.some((item) => Object.is(item, value))) {
-    evidence.push({ ruleId, path: path41, preview: "value not in enum" });
+    evidence.push({ ruleId, path: path43, preview: "value not in enum" });
   }
   if (field.type === "object" && field.required && value && typeof value === "object" && !Array.isArray(value)) {
     const record = value;
     for (const key of field.required) {
       if (!(key in record)) {
-        evidence.push({ ruleId, path: `${path41}.${key}`, preview: "missing required key" });
+        evidence.push({ ruleId, path: `${path43}.${key}`, preview: "missing required key" });
       }
     }
   }
@@ -18106,6 +18347,54 @@ function mergeSafetyExtensions(result, read, options) {
 }
 
 // packages/cli/src/check.ts
+function resolvePreset(preset, context = {}) {
+  if (preset === void 0 || preset.trim() === "") return void 0;
+  const name = preset.trim().toLowerCase();
+  if (name !== "trajectory" && name !== "safety" && name !== "comprehensive") {
+    throw new Error(
+      `Unknown --preset "${preset}". Use trajectory, safety, or comprehensive.`
+    );
+  }
+  const trajectorySelect = [
+    "run.status",
+    "run.requireCompleted",
+    "structure.orphan",
+    "structure.cycle",
+    "structure.relationship"
+  ];
+  if (context.hasToolRules === true) {
+    trajectorySelect.push("tool.usage");
+  }
+  const safetySelect = [
+    "run.status",
+    "safety.rawPrompt",
+    "safety.secretPattern",
+    "safety.redaction"
+  ];
+  if (name === "trajectory") {
+    return {
+      requireCompleted: true,
+      enableSafetyRedaction: false,
+      enableStructureRelationshipDefaults: true,
+      select: trajectorySelect
+    };
+  }
+  if (name === "safety") {
+    return {
+      requireCompleted: false,
+      enableSafetyRedaction: true,
+      enableStructureRelationshipDefaults: false,
+      select: safetySelect
+    };
+  }
+  const select = [.../* @__PURE__ */ new Set([...trajectorySelect, ...safetySelect])];
+  return {
+    requireCompleted: true,
+    enableSafetyRedaction: true,
+    enableStructureRelationshipDefaults: true,
+    select
+  };
+}
 var DEFAULT_SELECT = ["run.status"];
 var CONFIG_EXTENSIONS2 = /* @__PURE__ */ new Set([".json", ".js", ".mjs", ".cjs"]);
 var TS_CONFIG_EXTENSIONS2 = /* @__PURE__ */ new Set([".ts", ".mts", ".cts"]);
@@ -18152,7 +18441,7 @@ function asConfig(value) {
 }
 async function loadConfig(configPath) {
   if (configPath === void 0) return {};
-  const extension = path30__default.default.extname(configPath);
+  const extension = path32__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error(
       "TypeScript check configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -18161,7 +18450,7 @@ async function loadConfig(configPath) {
   if (!CONFIG_EXTENSIONS2.has(extension)) {
     throw new Error("Unsupported check config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path30__default.default.resolve(configPath);
+  const absolute = path32__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
     return asConfig(JSON.parse(raw));
@@ -18176,6 +18465,33 @@ function normalizeConfig(config) {
   }
   return config.checks;
 }
+function hasToolRulesConfigured(config, options) {
+  const tool = normalizeConfig(config).tool ?? {};
+  return Boolean(
+    (tool.required?.length ?? 0) > 0 || (tool.forbidden?.length ?? 0) > 0 || (tool.allowed?.length ?? 0) > 0 || tool.minCount !== void 0 || tool.maxCount !== void 0 || (options.requiredTool?.length ?? 0) > 0 || (options.forbiddenTool?.length ?? 0) > 0
+  );
+}
+function applyResolvedPreset(config, options, resolved) {
+  const checks2 = { ...normalizeConfig(config) };
+  if (resolved.enableSafetyRedaction) {
+    checks2.safety = { ...checks2.safety, redaction: true };
+  }
+  if (resolved.enableStructureRelationshipDefaults) {
+    const structure = checks2.structure ?? {};
+    const needed = structure.minConfidence === void 0 && structure.requireParentBeforeChild === void 0 && structure.requireTraceParentSpan === void 0;
+    if (needed) {
+      checks2.structure = { ...structure, requireParentBeforeChild: true };
+    }
+  }
+  return {
+    config: { checks: checks2 },
+    options: {
+      ...options,
+      ...resolved.requireCompleted ? { requireCompleted: true } : {},
+      rule: [...resolved.select, ...options.rule ?? []]
+    }
+  };
+}
 function buildRules(config, options) {
   const diagnostics = [];
   const checks2 = normalizeConfig(config);
@@ -18319,7 +18635,42 @@ function stable3(value) {
 function printJson(result) {
   console.log(JSON.stringify(stable3(result), null, 2));
 }
-function printHuman(result) {
+function isSafetyFinding(ruleId) {
+  return ruleId.startsWith("safety.") || ruleId.startsWith("guardrail.") || ruleId.includes("pii") || ruleId.includes("secret");
+}
+function printPresetClassSummary(result, preset) {
+  const name = preset?.trim().toLowerCase();
+  if (name !== "trajectory" && name !== "safety" && name !== "comprehensive") {
+    return;
+  }
+  const hasSafetyFindings = result.findings.some(
+    (finding) => isSafetyFinding(finding.ruleId)
+  );
+  const hasTrajectoryFindings = result.findings.some(
+    (finding) => !isSafetyFinding(finding.ruleId)
+  );
+  if (name === "trajectory") {
+    console.log(
+      `Trajectory: ${result.status === "pass" && !hasTrajectoryFindings ? "PASS" : result.status === "pass" ? "PASS" : "FAIL"}`
+    );
+    console.log("Share safety: not evaluated");
+    console.log("Run verify-safe before sharing.");
+    return;
+  }
+  if (name === "safety") {
+    console.log(
+      `Share safety: ${result.status === "pass" && !hasSafetyFindings ? "PASS" : result.status === "pass" ? "PASS" : "FAIL"}`
+    );
+    return;
+  }
+  console.log(
+    `Trajectory: ${hasTrajectoryFindings || result.status === "error" ? "FAIL" : "PASS"}`
+  );
+  console.log(
+    `Share safety: ${hasSafetyFindings || result.status === "fail" ? "FAIL" : result.status === "pass" ? "PASS" : "FAIL"}`
+  );
+}
+function printHuman(result, options = {}) {
   const scoped = result;
   if (scoped.scopeLabel) {
     console.log(`Scope: ${scoped.scopeKind} ${scoped.scopeLabel}`);
@@ -18328,6 +18679,7 @@ function printHuman(result) {
     }
   }
   console.log(`Check status: ${result.status}`);
+  printPresetClassSummary(result, options.preset);
   console.log(`Format: ${result.format}`);
   if (result.runId !== void 0) console.log(`Run: ${result.runId}`);
   console.log(
@@ -18337,10 +18689,10 @@ function printHuman(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path41 = finding.evidence[0]?.path;
+    const path43 = finding.evidence[0]?.path;
     const run = finding.evidence[0]?.runId;
     const runPrefix = run ? `[${run}] ` : "";
-    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path41 ? ` (${path41})` : ""}`);
+    console.log(`- ${runPrefix}${finding.ruleId}: ${finding.message}${path43 ? ` (${path43})` : ""}`);
   }
 }
 function readErrorResult(error) {
@@ -18356,12 +18708,24 @@ function readErrorResult(error) {
 async function checkCommand(target, options = {}, stdin = process.stdin) {
   let result;
   let phase = "config";
+  let evidenceRead;
+  let evidenceRunIds = [];
+  let evidenceSourceContents;
   const sessionId = options.session?.trim();
   const groupId = options.group?.trim();
   const useSessionScope = Boolean(sessionId || groupId);
   try {
-    const config = await loadConfig(options.config);
-    const built = buildRules(config, options);
+    let config = await loadConfig(options.config);
+    let effectiveOptions = options;
+    const resolved = resolvePreset(options.preset, {
+      hasToolRules: hasToolRulesConfigured(config, options)
+    });
+    if (resolved !== void 0) {
+      const applied = applyResolvedPreset(config, options, resolved);
+      config = applied.config;
+      effectiveOptions = applied.options;
+    }
+    const built = buildRules(config, effectiveOptions);
     if (built.diagnostics.some((item) => item.severity === "error")) {
       result = errorResult2("AI_CHECK_INVALID_CONFIG", "Invalid check configuration.");
       result.diagnostics = [...built.diagnostics];
@@ -18382,6 +18746,7 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
         correlateByGroupId: options.correlateGroup === true
       });
       const perRun = [];
+      const sourceContents = /* @__PURE__ */ new Map();
       for (const meta2 of scoped.metas) {
         const read = await openTrace(
           { type: "file", path: meta2.filePath },
@@ -18389,6 +18754,15 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
             ...options.format !== void 0 ? { format: options.format } : {}
           }
         );
+        try {
+          sourceContents.set(meta2.runId, await promises.readFile(meta2.filePath, "utf-8"));
+        } catch {
+          sourceContents.set(
+            meta2.runId,
+            `${read.events.map((event) => JSON.stringify(event)).join("\n")}
+`
+          );
+        }
         perRun.push(
           mergeSafetyExtensions(
             runTraceChecks(
@@ -18407,6 +18781,8 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
           )
         );
       }
+      evidenceRunIds = scoped.runIds;
+      evidenceSourceContents = sourceContents;
       result = aggregateSessionCheckResults(perRun, {
         scopeKind: scoped.scopeKind,
         scopeLabel: scoped.scopeLabel,
@@ -18421,6 +18797,26 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
       const read = await openTrace(input3, {
         ...options.format !== void 0 ? { format: options.format } : {}
       });
+      evidenceRead = read;
+      evidenceRunIds = options.run !== void 0 ? [options.run] : read.runs.length === 1 ? [read.runs[0].runId] : read.runs.map((run) => run.runId);
+      if (input3.type === "file") {
+        try {
+          const raw = await promises.readFile(input3.path, "utf-8");
+          evidenceSourceContents = new Map(
+            evidenceRunIds.map((runId) => [runId, raw])
+          );
+        } catch {
+          evidenceSourceContents = void 0;
+        }
+      } else {
+        evidenceSourceContents = new Map(
+          evidenceRunIds.map((runId) => [
+            runId,
+            `${read.events.filter((event) => event.runId === runId).map((event) => JSON.stringify(event)).join("\n")}
+`
+          ])
+        );
+      }
       result = mergeSafetyExtensions(
         runTraceChecks(
           { read },
@@ -18440,7 +18836,7 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
   } catch (error) {
     if (phase === "config") {
       const message = error instanceof Error ? error.message : String(error);
-      const code = message.startsWith("--") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
+      const code = message.startsWith("--") || message.includes("Unknown --preset") ? "AI_CHECK_INVALID_ARGUMENTS" : error instanceof SyntaxError || message.includes("Unsupported check config extension") || message.includes("TypeScript check configs") || message.includes("Config must") || message.includes("checks config") || message.includes("Expected an array") ? "AI_CHECK_INVALID_CONFIG" : "AI_CHECK_CONFIG_LOAD_FAILED";
       result = errorResult2(
         code,
         message
@@ -18450,8 +18846,47 @@ async function checkCommand(target, options = {}, stdin = process.stdin) {
     }
   }
   process.exitCode = exitCodeFor(result);
+  const failed = result.status !== "pass";
+  if (shouldEmitEvidence(options.evidenceOn, failed)) {
+    try {
+      const runIds = evidenceRunIds.length > 0 ? evidenceRunIds : result.runId !== void 0 ? [result.runId] : ["check"];
+      if (evidenceSourceContents === void 0 && evidenceRead !== void 0) {
+        evidenceSourceContents = new Map(
+          runIds.map((runId) => [
+            runId,
+            `${evidenceRead.events.filter((event) => event.runId === runId).map((event) => JSON.stringify(event)).join("\n")}
+`
+          ])
+        );
+      }
+      let redactionProfile = parseEvidenceProfile(options.evidenceProfile);
+      let evidenceFormat = parseEvidenceFormat(options.evidenceFormat);
+      const outputDir = resolveEvidenceOutputDir(
+        options.evidenceDir,
+        runIds[0] ?? "check"
+      );
+      const written = await writeLocalEvidence({
+        outputDir,
+        runIds,
+        ...evidenceSourceContents !== void 0 ? { sourceContents: evidenceSourceContents } : {},
+        ...options.dir !== void 0 ? { dir: options.dir } : {},
+        failed,
+        checkResultsJson: checkResultToEvidenceJson(result, runIds),
+        summaryText: `Check status: ${result.status}`,
+        redactionProfile,
+        format: evidenceFormat
+      });
+      if (!options.json) {
+        console.log(`Evidence: ${written}`);
+      }
+    } catch (error) {
+      console.error(
+        `[AgentInspect] evidence package skipped: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
   if (options.json) printJson(result);
-  else printHuman(result);
+  else printHuman(result, options);
 }
 
 // packages/viewer/src/server.ts
@@ -18608,7 +19043,7 @@ async function loadSuiteViewerData(options) {
   for (const suiteCase of result.cases) {
     cases.push(await enrichCase(suiteCase, baselinePath));
   }
-  const artifactsDir = path30__default.default.join(path30__default.default.dirname(result.configPath), ".agent-inspect/suite-runs");
+  const artifactsDir = path32__default.default.join(path32__default.default.dirname(result.configPath), ".agent-inspect/suite-runs");
   return {
     suiteName: result.suiteName,
     configPath: result.configPath,
@@ -18804,19 +19239,19 @@ function serializeWorkspaceManifest(manifest) {
 }
 var INDEX_DIR_NAME = "index";
 function resolveWorkspaceLocation(cwd = process.cwd()) {
-  const projectRoot = path30__default.default.resolve(cwd);
-  const workspaceDir = path30__default.default.join(projectRoot, WORKSPACE_DIR_NAME);
+  const projectRoot = path32__default.default.resolve(cwd);
+  const workspaceDir = path32__default.default.join(projectRoot, WORKSPACE_DIR_NAME);
   return {
     projectRoot,
     workspaceDir,
-    manifestPath: path30__default.default.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
+    manifestPath: path32__default.default.join(workspaceDir, WORKSPACE_MANIFEST_FILENAME)
   };
 }
 function resolveInsideWorkspace(workspaceDir, relative) {
-  const base = path30__default.default.resolve(workspaceDir);
-  const resolved = path30__default.default.resolve(base, relative);
-  const rel = path30__default.default.relative(base, resolved);
-  if (rel === "" || rel === "." || !rel.startsWith("..") && !path30__default.default.isAbsolute(rel)) {
+  const base = path32__default.default.resolve(workspaceDir);
+  const resolved = path32__default.default.resolve(base, relative);
+  const rel = path32__default.default.relative(base, resolved);
+  if (rel === "" || rel === "." || !rel.startsWith("..") && !path32__default.default.isAbsolute(rel)) {
     return resolved;
   }
   throw new Error(
@@ -18885,7 +19320,7 @@ async function createWorkspace(options = {}) {
     created = false;
     adopted = true;
   } else {
-    const project = options.project?.trim() || path30__default.default.basename(location.projectRoot) || "workspace";
+    const project = options.project?.trim() || path32__default.default.basename(location.projectRoot) || "workspace";
     const traceDirs = detectedExistingTraces ? ["runs", "."] : ["runs"];
     manifest = createDefaultWorkspaceManifest({
       project,
@@ -19024,7 +19459,7 @@ async function doctorWorkspace(location) {
     const abs = resolveInsideWorkspace(location.workspaceDir, rel);
     for (const file of await listJsonl(abs)) {
       try {
-        const s = await promises.stat(path30__default.default.join(abs, file));
+        const s = await promises.stat(path32__default.default.join(abs, file));
         newestTraceMtime = Math.max(newestTraceMtime, s.mtimeMs);
       } catch {
         checks2.push({ id: "trace-readability", status: "warn", message: `cannot stat ${rel}/${file}` });
@@ -19072,7 +19507,7 @@ async function cleanWorkspace(location, manifest, options = {}) {
       const relPath = `${rel}/${entry}`;
       removed.push(relPath);
       if (!dryRun) {
-        await promises.rm(path30__default.default.join(abs, entry), { recursive: true, force: true });
+        await promises.rm(path32__default.default.join(abs, entry), { recursive: true, force: true });
       }
     }
   }
@@ -19081,7 +19516,7 @@ async function cleanWorkspace(location, manifest, options = {}) {
 
 // packages/viewer/src/workspace-data.ts
 async function loadWorkspaceViewerData(options) {
-  const cwd = path30__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path32__default.default.resolve(options.cwd ?? process.cwd());
   const location = resolveWorkspaceLocation(cwd);
   const manifestRead = await readWorkspaceManifestFile(location);
   if (!manifestRead.ok || manifestRead.manifest === void 0) {
@@ -19094,7 +19529,7 @@ async function loadWorkspaceViewerData(options) {
   const runs = [];
   for (const rel of manifestRead.manifest.traceDirs) {
     const traceDir = resolveTraceDir({
-      dir: path30__default.default.join(location.workspaceDir, rel)
+      dir: path32__default.default.join(location.workspaceDir, rel)
     });
     const td = new TraceDirectory({ dir: traceDir });
     const files = await td.list();
@@ -19108,7 +19543,7 @@ async function loadWorkspaceViewerData(options) {
         runId: meta2.runId,
         ...meta2.name !== void 0 ? { name: meta2.name } : {},
         status: meta2.status,
-        file: path30__default.default.basename(meta2.filePath)
+        file: path32__default.default.basename(meta2.filePath)
       });
     }
   }
@@ -19119,8 +19554,8 @@ async function loadWorkspaceViewerData(options) {
     doctor,
     runs,
     bundleDirs: [
-      path30__default.default.join(location.workspaceDir, manifestRead.manifest.bundlesDir),
-      path30__default.default.join(location.workspaceDir, manifestRead.manifest.artifactsDir)
+      path32__default.default.join(location.workspaceDir, manifestRead.manifest.bundlesDir),
+      path32__default.default.join(location.workspaceDir, manifestRead.manifest.artifactsDir)
     ]
   };
 }
@@ -19183,7 +19618,7 @@ function createViewerServer(options = {}) {
           ok: true,
           readOnly: true,
           mode,
-          traceDir: path30__default.default.resolve(traceDir)
+          traceDir: path32__default.default.resolve(traceDir)
         });
       }
       if (pathname === "/api/suite" && mode === "suite") {
@@ -19212,7 +19647,7 @@ function createViewerServer(options = {}) {
             runId: meta2.runId,
             name: meta2.name,
             status: meta2.status,
-            file: path30__default.default.basename(meta2.filePath),
+            file: path32__default.default.basename(meta2.filePath),
             startedAt: meta2.startedAt,
             durationMs: meta2.durationMs
           }))
@@ -19329,7 +19764,7 @@ function startViewerServer(options = {}) {
       resolve({
         host,
         port: resolvedPort,
-        traceDir: path30__default.default.resolve(traceDir),
+        traceDir: path32__default.default.resolve(traceDir),
         url: `http://${host}:${resolvedPort}/${modeQuery}`,
         mode
       });
@@ -19700,10 +20135,10 @@ async function evalRun(input3, options = {}) {
     diagnostics: []
   };
 }
-function evidenceForRun(run, path41) {
-  return [{ runId: run.runId, ...path41 !== void 0 ? { path: path41 } : {} }];
+function evidenceForRun(run, path43) {
+  return [{ runId: run.runId, ...path43 !== void 0 ? { path: path43 } : {} }];
 }
-function evidenceForEvent(event, path41) {
+function evidenceForEvent(event, path43) {
   return [
     {
       runId: event.runId,
@@ -19711,7 +20146,7 @@ function evidenceForEvent(event, path41) {
       ...event.parentId !== void 0 ? { parentId: event.parentId } : {},
       kind: event.kind,
       name: event.name,
-      ...path41 !== void 0 ? { path: path41 } : {}
+      ...path43 !== void 0 ? { path: path43 } : {}
     }
   ];
 }
@@ -19869,9 +20304,9 @@ function collectTextFields(nodes, keys, preferredKinds = []) {
 function tokenize(text) {
   return [...text.toLowerCase().matchAll(/[a-z0-9][a-z0-9'-]{2,}/g)].map((match) => match[0].replace(/^['-]+|['-]+$/g, "")).filter((token) => token.length > 2 && !STOP_WORDS.has(token));
 }
-function firstEvidence(fields, run, path41) {
+function firstEvidence(fields, run, path43) {
   const first = fields[0];
-  return first === void 0 ? evidenceForRun(run, path41) : evidenceForEvent(first.node.event, first.path);
+  return first === void 0 ? evidenceForRun(run, path43) : evidenceForEvent(first.node.event, first.path);
 }
 function collectSourceIds(nodes, keys) {
   const wanted = keySet(keys);
@@ -20248,8 +20683,8 @@ function renderEvalMarkdown(result) {
   if (result.findings.length > 0) {
     lines.push("", "## Findings");
     for (const finding of result.findings) {
-      const path41 = finding.evidence[0]?.path;
-      lines.push(`- ${finding.ruleId}: ${finding.message}${path41 ? ` (${path41})` : ""}`);
+      const path43 = finding.evidence[0]?.path;
+      lines.push(`- ${finding.ruleId}: ${finding.message}${path43 ? ` (${path43})` : ""}`);
     }
   }
   return `${lines.join("\n")}
@@ -20296,7 +20731,7 @@ function asConfig2(value) {
 }
 async function loadConfig2(configPath) {
   if (configPath === void 0) return {};
-  const extension = path30__default.default.extname(configPath);
+  const extension = path32__default.default.extname(configPath);
   if (TS_CONFIG_EXTENSIONS3.has(extension)) {
     throw new Error(
       "TypeScript eval configs require an explicit precompiled JavaScript config or future --config-loader support."
@@ -20305,7 +20740,7 @@ async function loadConfig2(configPath) {
   if (!CONFIG_EXTENSIONS3.has(extension)) {
     throw new Error("Unsupported eval config extension. Use .json, .js, .mjs, or .cjs.");
   }
-  const absolute = path30__default.default.resolve(configPath);
+  const absolute = path32__default.default.resolve(configPath);
   if (extension === ".json") {
     const raw = await promises.readFile(absolute, "utf-8");
     return asConfig2(JSON.parse(raw));
@@ -20442,8 +20877,8 @@ function printHuman2(result) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path41 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path41 ? ` (${path41})` : ""}`);
+    const path43 = finding.evidence[0]?.path;
+    console.log(`- ${finding.ruleId}: ${finding.message}${path43 ? ` (${path43})` : ""}`);
   }
 }
 function readErrorResult2(error) {
@@ -20696,14 +21131,14 @@ function exitCodeFor3(result) {
   return 2;
 }
 function explainFinding(finding, blocksBundle) {
-  const path41 = finding.evidence[0]?.path ?? "(unknown path)";
+  const path43 = finding.evidence[0]?.path ?? "(unknown path)";
   const category = finding.category ?? "structure";
   const confidence = finding.confidence ?? "medium";
   const detector = finding.detector ?? finding.ruleId;
   const action = finding.action ?? "review";
   const redactionHint = category === "credential" || category === "personal-data" || category === "raw-content" || action.includes("redact") ? "Usually removable by share/strict redaction before bundling." : "May require omitting the field, lowering limits, or an explicit local override.";
   return [
-    `  Matched: detector=${detector}; path=${path41}; category=${category}`,
+    `  Matched: detector=${detector}; path=${path43}; category=${category}`,
     `  Why: ${finding.message}`,
     `  Confidence: ${confidence}`,
     `  Redaction: ${redactionHint}`,
@@ -20745,9 +21180,9 @@ function printHuman3(result, explain = false) {
     console.log(`- ${diagnostic7.code}: ${diagnostic7.message}`);
   }
   for (const finding of result.findings) {
-    const path41 = finding.evidence[0]?.path;
+    const path43 = finding.evidence[0]?.path;
     const taxonomy = finding.category !== void 0 || finding.confidence !== void 0 ? ` [${[finding.category, finding.confidence].filter(Boolean).join("/")}]` : "";
-    console.log(`- ${finding.ruleId}: ${finding.message}${path41 ? ` (${path41})` : ""}${taxonomy}`);
+    console.log(`- ${finding.ruleId}: ${finding.message}${path43 ? ` (${path43})` : ""}${taxonomy}`);
     if (explain) {
       const blocks = finding.severity === "error" || finding.status === "fail";
       for (const line of explainFinding(finding, blocks)) {
@@ -20862,91 +21297,6 @@ function messageStartsWithDash(error) {
   return message.startsWith("--");
 }
 init_advanced();
-function validateReporterArtifactPath(options) {
-  const outputDir = path30__default.default.resolve(options.outputDir);
-  const diagnostics = [];
-  const rawPath = options.relativePath;
-  if (rawPath.length === 0) {
-    diagnostics.push({
-      code: "artifact_path_empty",
-      severity: "error",
-      message: "Reporter artifact path must not be empty."
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  if (rawPath.includes("\0")) {
-    diagnostics.push({
-      code: "invalid_artifact_path",
-      severity: "error",
-      message: "Reporter artifact path must not contain null bytes.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  if (path30__default.default.isAbsolute(rawPath) || path30__default.default.win32.isAbsolute(rawPath)) {
-    diagnostics.push({
-      code: "artifact_path_absolute",
-      severity: "error",
-      message: "Reporter artifact path must be relative.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  const normalized = path30__default.default.posix.normalize(rawPath.replace(/\\/g, "/"));
-  const segments = normalized.split("/");
-  if (normalized === "." || normalized.startsWith("../") || segments.some((segment) => segment === "..")) {
-    diagnostics.push({
-      code: "artifact_path_escape",
-      severity: "error",
-      message: "Reporter artifact path must stay under the output directory.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  const absolutePath = path30__default.default.resolve(outputDir, normalized);
-  const relFromOutput = path30__default.default.relative(outputDir, absolutePath);
-  if (relFromOutput.length === 0 || relFromOutput.startsWith("..") || path30__default.default.isAbsolute(relFromOutput)) {
-    diagnostics.push({
-      code: "artifact_path_escape",
-      severity: "error",
-      message: "Reporter artifact path resolved outside the output directory.",
-      target: rawPath
-    });
-    return { ok: false, outputDir, diagnostics };
-  }
-  return {
-    ok: true,
-    outputDir,
-    relativePath: normalized,
-    absolutePath,
-    diagnostics
-  };
-}
-var EVIDENCE_CI_ARTIFACT_FILES = [
-  "evidence.html",
-  "evidence.json",
-  "check-results.json",
-  "trace.jsonl"
-];
-function createEvidenceCiArtifacts(options) {
-  const profile = options.redactionProfile;
-  const prefix = options.relativeDir !== void 0 && options.relativeDir.trim() !== "" ? options.relativeDir.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "") : "";
-  const join = (name) => prefix === "" ? name : path30__default.default.posix.join(prefix, name);
-  const formatFor = (name) => {
-    if (name.endsWith(".html")) return "html";
-    if (name.endsWith(".jsonl")) return "jsonl";
-    return "json";
-  };
-  return EVIDENCE_CI_ARTIFACT_FILES.map((name) => ({
-    kind: "evidence",
-    path: join(name),
-    format: formatFor(name),
-    redactionProfile: profile,
-    title: `Evidence v2 ${name}`
-  }));
-}
-
-// packages/cli/src/artifacts.ts
 var NOTE = "Generated locally by AgentInspect. Artifacts are best-effort summaries, not compliance or security certification.";
 var SAFETY_RULES = [
   createSafetyRawContentRule(),
@@ -21020,8 +21370,8 @@ function renderCheckSection(result) {
     `Diagnostics: ${result.diagnostics.length}`
   ];
   for (const finding of result.findings.slice(0, 10)) {
-    const path41 = finding.evidence[0]?.path ?? "(run)";
-    lines.push(`- ${finding.ruleId}: ${finding.message} (${path41})`);
+    const path43 = finding.evidence[0]?.path ?? "(run)";
+    lines.push(`- ${finding.ruleId}: ${finding.message} (${path43})`);
   }
   for (const diagnostic7 of result.diagnostics.slice(0, 10)) {
     lines.push(`- ${diagnostic7.code}: ${diagnostic7.message}`);
@@ -21099,8 +21449,8 @@ function renderHtml(trace, check, diff) {
 `;
 }
 async function writeArtifact(outputDir, relativePath, content, files) {
-  const outPath = path30__default.default.join(outputDir, relativePath);
-  await promises.mkdir(path30__default.default.dirname(outPath), { recursive: true });
+  const outPath = path32__default.default.join(outputDir, relativePath);
+  await promises.mkdir(path32__default.default.dirname(outPath), { recursive: true });
   await promises.writeFile(outPath, content, "utf-8");
   files.push(relativePath);
 }
@@ -21129,7 +21479,7 @@ function shouldWriteEvidence(options, status) {
   return status === "unsafe" || status === "regression" || status === "unknown" || status === "warning";
 }
 async function artifactsCommand(target, options = {}, stdin = process.stdin) {
-  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path30__default.default.resolve(options.outputDir.trim()) : "";
+  const outputDir = options.outputDir !== void 0 && options.outputDir.trim() !== "" ? path32__default.default.resolve(options.outputDir.trim()) : "";
   if (outputDir === "") {
     console.error("--output-dir is required.");
     process.exitCode = 1;
@@ -21269,8 +21619,8 @@ async function artifactsCommand(target, options = {}, stdin = process.stdin) {
   }
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    await promises.mkdir(path30__default.default.dirname(path30__default.default.resolve(summaryTarget)), { recursive: true });
-    await promises.appendFile(path30__default.default.resolve(summaryTarget), `
+    await promises.mkdir(path32__default.default.dirname(path32__default.default.resolve(summaryTarget)), { recursive: true });
+    await promises.appendFile(path32__default.default.resolve(summaryTarget), `
 ${renderMarkdown(trace, check, diff)}`, "utf-8");
   }
   const manifestFiles = [...files, "manifest.json"].sort((a, b) => a.localeCompare(b));
@@ -21289,10 +21639,10 @@ ${renderMarkdown(trace, check, diff)}`, "utf-8");
       findings: diff?.findings.length ?? 0,
       diagnostics: diff?.diagnostics.length ?? 0
     },
-    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path30__default.default.resolve(summaryTarget) } : {},
+    ...summaryTarget !== void 0 && summaryTarget.trim() !== "" ? { githubSummary: path32__default.default.resolve(summaryTarget) } : {},
     note: NOTE
   };
-  await promises.writeFile(path30__default.default.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
+  await promises.writeFile(path32__default.default.join(outputDir, "manifest.json"), writeJson3(manifest), "utf-8");
   if (options.json === true) {
     console.log(writeJson3(manifest).trimEnd());
   } else {
@@ -21353,8 +21703,8 @@ async function resolveOutputDir(options, runIds, cwd, format) {
       const location = resolveWorkspaceLocation(cwd);
       const manifest = await readWorkspaceManifestFile(location);
       if (manifest.ok && manifest.manifest) {
-        const rel = path30__default.default.relative(location.workspaceDir, normalized);
-        if (!rel.startsWith("..") && !path30__default.default.isAbsolute(rel)) {
+        const rel = path32__default.default.relative(location.workspaceDir, normalized);
+        if (!rel.startsWith("..") && !path32__default.default.isAbsolute(rel)) {
           return resolveInsideWorkspace(location.workspaceDir, rel);
         }
       }
@@ -21370,7 +21720,7 @@ async function resolveOutputDir(options, runIds, cwd, format) {
       const label = runIds.length === 1 ? sanitizeBundleRunId(runIds[0]) : `multi-${runIds.length}`;
       const base2 = resolveInsideWorkspace(
         location.workspaceDir,
-        path30__default.default.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
+        path32__default.default.join(manifest.manifest.bundlesDir, `bundle-${label}-${stamp}`)
       );
       return format === "zip" ? `${base2}.zip` : base2;
     }
@@ -21775,19 +22125,19 @@ async function bundleCommand(runIdArg, options = {}) {
     let sidecarDir = outputDir;
     if (outputDir.toLowerCase().endsWith(".html")) {
       htmlPath = outputDir;
-      sidecarDir = path30__default.default.dirname(outputDir);
+      sidecarDir = path32__default.default.dirname(outputDir);
     } else {
       await promises.mkdir(outputDir, { recursive: true });
-      htmlPath = path30__default.default.join(outputDir, EVIDENCE_HTML_FILENAME);
+      htmlPath = path32__default.default.join(outputDir, EVIDENCE_HTML_FILENAME);
       sidecarDir = outputDir;
     }
     await promises.mkdir(sidecarDir, { recursive: true });
     await promises.writeFile(htmlPath, htmlContent, "utf-8");
-    await promises.writeFile(path30__default.default.join(sidecarDir, EVIDENCE_MANIFEST_FILENAME), evidenceJson, "utf-8");
+    await promises.writeFile(path32__default.default.join(sidecarDir, EVIDENCE_MANIFEST_FILENAME), evidenceJson, "utf-8");
     outputPath = htmlPath;
   } else if (format === "zip") {
     const zipPath = outputDir.toLowerCase().endsWith(".zip") ? outputDir : `${outputDir}.zip`;
-    const zipParent = path30__default.default.dirname(zipPath);
+    const zipParent = path32__default.default.dirname(zipPath);
     await promises.mkdir(zipParent, { recursive: true });
     const entries = [
       ...[...packaged.entries()].map(([relativePath, content]) => ({
@@ -21803,10 +22153,10 @@ async function bundleCommand(runIdArg, options = {}) {
     await promises.mkdir(outputDir, { recursive: true });
     for (const [relativePath, content] of packaged.entries()) {
       const outPath = assertBundlePathContained(outputDir, relativePath);
-      await promises.mkdir(path30__default.default.dirname(outPath), { recursive: true });
+      await promises.mkdir(path32__default.default.dirname(outPath), { recursive: true });
       await promises.writeFile(outPath, content, "utf-8");
     }
-    await promises.writeFile(path30__default.default.join(outputDir, EVIDENCE_MANIFEST_FILENAME), evidenceJson, "utf-8");
+    await promises.writeFile(path32__default.default.join(outputDir, EVIDENCE_MANIFEST_FILENAME), evidenceJson, "utf-8");
     if (!files.includes(EVIDENCE_MANIFEST_FILENAME)) {
       files.push(EVIDENCE_MANIFEST_FILENAME);
     }
@@ -21855,7 +22205,7 @@ function writeJson5(value) {
 `;
 }
 async function bundleVerifyCommand(targetPath, options = {}) {
-  const root = path30__default.default.resolve(targetPath.trim() || ".");
+  const root = path32__default.default.resolve(targetPath.trim() || ".");
   const result = await verifyEvidenceDirectory(root, {
     unexpectedFiles: options.unexpected ?? "fail"
   });
@@ -21888,6 +22238,147 @@ async function bundleVerifyCommand(targetPath, options = {}) {
     process.exitCode = 1;
   }
 }
+
+// packages/cli/src/bundle-open.ts
+init_advanced();
+function writeJson6(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+async function resolveHtmlPath(root) {
+  const candidates = [
+    path32__default.default.join(root, "evidence.html"),
+    root.toLowerCase().endsWith(".html") ? root : ""
+  ].filter(Boolean);
+  for (const candidate of candidates) {
+    try {
+      const info = await promises.stat(candidate);
+      if (info.isFile()) return candidate;
+    } catch {
+    }
+  }
+  throw new Error(
+    `No evidence.html found under ${root}. Pass a bundle directory or .html path.`
+  );
+}
+function openLocalFile(filePath) {
+  const fileUrl = url.pathToFileURL(filePath).href;
+  const platform = process.platform;
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "darwin" ? [filePath] : platform === "win32" ? ["/c", "start", "", filePath] : [filePath];
+  return new Promise((resolve) => {
+    try {
+      const child = child_process.spawn(command, args, {
+        detached: true,
+        stdio: "ignore"
+      });
+      child.on("error", (error) => {
+        resolve({
+          ok: false,
+          detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
+        });
+      });
+      child.unref();
+      resolve({ ok: true, detail: fileUrl });
+    } catch (error) {
+      resolve({
+        ok: false,
+        detail: `${error instanceof Error ? error.message : String(error)}; open manually: ${fileUrl}`
+      });
+    }
+  });
+}
+async function bundleOpenCommand(targetPath, options = {}) {
+  const root = path32__default.default.resolve(targetPath.trim() || ".");
+  try {
+    await promises.access(root);
+  } catch {
+    const message = `Evidence path not found: ${root}`;
+    if (options.json) {
+      console.log(writeJson6({ ok: false, error: message }).trimEnd());
+    } else {
+      console.error(`[AgentInspect] ${message}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  let verifyRoot = root;
+  try {
+    const info = await promises.stat(root);
+    if (info.isFile() && root.toLowerCase().endsWith(".html")) {
+      verifyRoot = path32__default.default.dirname(root);
+    }
+  } catch {
+  }
+  if (options.skipVerify !== true) {
+    const result = await verifyEvidenceDirectory(verifyRoot, {
+      unexpectedFiles: "fail"
+    });
+    if (!result.ok) {
+      if (options.json) {
+        console.log(
+          writeJson6({
+            ok: false,
+            error: "Evidence verify failed",
+            root: result.root,
+            issues: result.issues
+          }).trimEnd()
+        );
+      } else {
+        console.error(`Evidence verify: fail (${result.issues.length} issue(s))`);
+        for (const issue of result.issues) {
+          console.error(`- [${issue.severity}] ${issue.code}: ${issue.message}`);
+        }
+        console.error("Fix integrity issues or pass --skip-verify (not recommended).");
+      }
+      process.exitCode = 1;
+      return;
+    }
+  }
+  let htmlPath;
+  try {
+    htmlPath = await resolveHtmlPath(
+      root.toLowerCase().endsWith(".html") ? path32__default.default.dirname(root) : root
+    );
+    if (root.toLowerCase().endsWith(".html")) {
+      htmlPath = root;
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (options.json) {
+      console.log(writeJson6({ ok: false, error: message }).trimEnd());
+    } else {
+      console.error(`[AgentInspect] ${message}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    await promises.readFile(path32__default.default.join(path32__default.default.dirname(htmlPath), "evidence.json"), "utf-8");
+  } catch {
+  }
+  const opened = await openLocalFile(htmlPath);
+  if (options.json) {
+    console.log(
+      writeJson6({
+        ok: opened.ok,
+        path: htmlPath,
+        opened: opened.ok,
+        detail: opened.detail
+      }).trimEnd()
+    );
+  } else if (opened.ok) {
+    console.log(`Opened local Evidence: ${htmlPath}`);
+    console.log(`URL: ${opened.detail}`);
+  } else {
+    console.error(`[AgentInspect] Could not open browser automatically.`);
+    console.error(`Open this file locally: ${htmlPath}`);
+    console.error(opened.detail);
+  }
+  if (!opened.ok) {
+    process.exitCode = 0;
+  }
+}
 var CLIENTS = [
   "cursor",
   "claude-code",
@@ -21948,24 +22439,24 @@ function resolveTargetPath(client, projectLocal) {
   if (projectLocal) {
     switch (client) {
       case "cursor":
-        return path30__default.default.join(".cursor", "mcp.json");
+        return path32__default.default.join(".cursor", "mcp.json");
       case "claude-code":
-        return path30__default.default.join(".mcp.json");
+        return path32__default.default.join(".mcp.json");
       case "codex":
-        return path30__default.default.join(".codex", "config.toml.json");
+        return path32__default.default.join(".codex", "config.toml.json");
       case "gemini":
-        return path30__default.default.join(".gemini", "settings.json");
+        return path32__default.default.join(".gemini", "settings.json");
     }
   }
   switch (client) {
     case "cursor":
-      return path30__default.default.join("~", ".cursor", "mcp.json");
+      return path32__default.default.join("~", ".cursor", "mcp.json");
     case "claude-code":
-      return path30__default.default.join("~", ".claude.json");
+      return path32__default.default.join("~", ".claude.json");
     case "codex":
-      return path30__default.default.join("~", ".codex", "config.toml");
+      return path32__default.default.join("~", ".codex", "config.toml");
     case "gemini":
-      return path30__default.default.join("~", ".gemini", "settings.json");
+      return path32__default.default.join("~", ".gemini", "settings.json");
   }
 }
 async function mcpConfigureCommand(options) {
@@ -21989,8 +22480,8 @@ async function mcpConfigureCommand(options) {
   ];
   let wrote = false;
   if (!dryRun && projectLocal) {
-    const abs = path30__default.default.resolve(targetPath);
-    await promises.mkdir(path30__default.default.dirname(abs), { recursive: true });
+    const abs = path32__default.default.resolve(targetPath);
+    await promises.mkdir(path32__default.default.dirname(abs), { recursive: true });
     await promises.writeFile(abs, `${JSON.stringify(config, null, 2)}
 `, "utf8");
     wrote = true;
@@ -22038,7 +22529,7 @@ function stable8(value) {
     Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable8(record[key])])
   );
 }
-function writeJson6(value) {
+function writeJson7(value) {
   return `${JSON.stringify(stable8(value), null, 2)}
 `;
 }
@@ -22150,23 +22641,23 @@ function readManifestDocument(value) {
   };
 }
 function cwdRelative(filePath) {
-  const relative = path30__default.default.relative(process.cwd(), path30__default.default.resolve(filePath)).replace(/\\/g, "/");
-  if (relative === "" || relative.startsWith("../") || path30__default.default.isAbsolute(relative)) {
-    return path30__default.default.basename(filePath);
+  const relative = path32__default.default.relative(process.cwd(), path32__default.default.resolve(filePath)).replace(/\\/g, "/");
+  if (relative === "" || relative.startsWith("../") || path32__default.default.isAbsolute(relative)) {
+    return path32__default.default.basename(filePath);
   }
   return relative;
 }
 async function readReporterManifest(filePath) {
-  const absolute = path30__default.default.resolve(filePath);
+  const absolute = path32__default.default.resolve(filePath);
   const raw = await promises.readFile(absolute, "utf-8");
   const document = readManifestDocument(JSON.parse(raw));
   const manifest = document.manifest;
   const results = manifest.results.map((result) => ({
     testId: safeText(result.testId),
     name: safeText(result.name),
-    ...result.file === void 0 ? {} : { file: safeText(path30__default.default.basename(result.file)) },
+    ...result.file === void 0 ? {} : { file: safeText(path32__default.default.basename(result.file)) },
     status: result.status,
-    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path30__default.default.basename(result.tracePath)) },
+    ...result.tracePath === void 0 ? {} : { tracePath: safeText(path32__default.default.basename(result.tracePath)) },
     artifacts: result.artifacts,
     diagnostics: result.diagnostics
   }));
@@ -22305,20 +22796,20 @@ async function ciSummaryCommand(manifestPaths, options = {}) {
     return;
   }
   const markdown = renderMarkdown2(result);
-  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path30__default.default.resolve(options.output.trim()) : void 0;
+  const outputPath = options.output !== void 0 && options.output.trim() !== "" ? path32__default.default.resolve(options.output.trim()) : void 0;
   if (outputPath !== void 0) {
-    await promises.mkdir(path30__default.default.dirname(outputPath), { recursive: true });
+    await promises.mkdir(path32__default.default.dirname(outputPath), { recursive: true });
     await promises.writeFile(outputPath, markdown, "utf-8");
   }
   const summaryTarget = options.githubSummary ?? process.env.GITHUB_STEP_SUMMARY;
   if (summaryTarget !== void 0 && summaryTarget.trim() !== "") {
-    const summaryPath = path30__default.default.resolve(summaryTarget);
-    await promises.mkdir(path30__default.default.dirname(summaryPath), { recursive: true });
+    const summaryPath = path32__default.default.resolve(summaryTarget);
+    await promises.mkdir(path32__default.default.dirname(summaryPath), { recursive: true });
     await promises.appendFile(summaryPath, `
 ${markdown}`, "utf-8");
   }
   if (options.json === true) {
-    console.log(writeJson6(result).trimEnd());
+    console.log(writeJson7(result).trimEnd());
   } else if (outputPath !== void 0) {
     console.log(`Wrote AgentInspect CI summary to ${outputPath}`);
     console.log(`Status: ${result.status}`);
@@ -22456,7 +22947,7 @@ console.log("Trace written to .agent-inspect/");
 `;
   }
 }
-function githubWorkflowTemplate() {
+function githubWorkflowTemplate(demoPath) {
   return `name: AgentInspect artifacts
 
 on:
@@ -22473,19 +22964,32 @@ jobs:
         with:
           node-version: "22"
       - run: npm ci
-      - run: npm test
-      - name: Upload AgentInspect traces
+      - name: Run deterministic agent fixture
+        run: node ${demoPath}
+      - name: Trajectory check with Evidence on failure
+        run: >
+          npx --yes agent-inspect check --dir .agent-inspect
+          --preset trajectory
+          --evidence-on fail
+          --evidence-profile share
+          --evidence-format directory
+      - name: Verify share safety
+        if: always()
+        run: npx --yes agent-inspect verify-safe . --dir .agent-inspect
+      - name: Upload AgentInspect traces and Evidence
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: agent-inspect-traces
-          path: .agent-inspect/**/*.jsonl
+          path: |
+            .agent-inspect/**/*.jsonl
+            .agent-inspect/evidence/**
           if-no-files-found: ignore
 `;
 }
 async function planInit(options = {}) {
   const framework = normalizeFramework(options.framework);
-  const cwd = path30__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path32__default.default.resolve(options.cwd ?? process.cwd());
   const demoPath = framework === "custom" ? "examples/agent-inspect-demo.mjs" : `examples/agent-inspect-${framework}-demo.mjs`;
   const candidates = [
     { rel: CONFIG_FILE, content: configTemplate(framework) },
@@ -22495,12 +22999,12 @@ async function planInit(options = {}) {
   if (options.ci === "github") {
     candidates.push({
       rel: ".github/workflows/agent-inspect-artifacts.yml",
-      content: githubWorkflowTemplate()
+      content: githubWorkflowTemplate(demoPath)
     });
   }
   const files = [];
   for (const candidate of candidates) {
-    const abs = path30__default.default.join(cwd, candidate.rel);
+    const abs = path32__default.default.join(cwd, candidate.rel);
     try {
       await promises.access(abs);
       files.push({
@@ -22521,20 +23025,21 @@ async function writePlannedFiles(plan, cwd, options) {
     if (entry.action === "skip") {
       continue;
     }
-    const abs = path30__default.default.join(cwd, entry.path);
+    const abs = path32__default.default.join(cwd, entry.path);
     if (options.dryRun) {
       written.push(entry.path);
       continue;
     }
-    await promises.mkdir(path30__default.default.dirname(abs), { recursive: true });
-    const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate() : demoTemplate(plan.framework);
+    await promises.mkdir(path32__default.default.dirname(abs), { recursive: true });
+    const demoPath = plan.framework === "custom" ? "examples/agent-inspect-demo.mjs" : `examples/agent-inspect-${plan.framework}-demo.mjs`;
+    const content = entry.path === CONFIG_FILE ? configTemplate(plan.framework) : entry.path === GITKEEP ? "" : entry.path.endsWith(".yml") ? githubWorkflowTemplate(demoPath) : demoTemplate(plan.framework);
     await promises.writeFile(abs, content, "utf-8");
     written.push(entry.path);
   }
   return written;
 }
 async function initCommand(options = {}) {
-  const cwd = path30__default.default.resolve(options.cwd ?? process.cwd());
+  const cwd = path32__default.default.resolve(options.cwd ?? process.cwd());
   try {
     const plan = await planInit({ ...options, cwd });
     const toWrite = plan.files.filter((file) => file.action === "create").map((f) => f.path);
@@ -22626,7 +23131,7 @@ function envCheck(name, optional = true) {
   };
 }
 async function traceDirWritable(traceDir) {
-  const resolved = path30__default.default.resolve(traceDir);
+  const resolved = path32__default.default.resolve(traceDir);
   try {
     await promises.mkdir(resolved, { recursive: true });
     await promises.access(resolved, promises.constants.W_OK);
@@ -22647,10 +23152,10 @@ async function traceDirWritable(traceDir) {
   }
 }
 function readPackageVersionNearEntry(entryPath, packageName) {
-  let dir = path30__default.default.dirname(path30__default.default.resolve(entryPath));
-  const { root } = path30__default.default.parse(dir);
+  let dir = path32__default.default.dirname(path32__default.default.resolve(entryPath));
+  const { root } = path32__default.default.parse(dir);
   while (true) {
-    const candidate = path30__default.default.join(dir, "package.json");
+    const candidate = path32__default.default.join(dir, "package.json");
     if (fs.existsSync(candidate)) {
       try {
         const pkg = JSON.parse(fs.readFileSync(candidate, "utf8"));
@@ -22661,14 +23166,14 @@ function readPackageVersionNearEntry(entryPath, packageName) {
       }
     }
     if (dir === root) break;
-    const parent = path30__default.default.dirname(dir);
+    const parent = path32__default.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return void 0;
 }
 function resolveInstalledPackage(cwd, name) {
-  const require2 = module$1.createRequire(path30__default.default.join(cwd, "package.json"));
+  const require2 = module$1.createRequire(path32__default.default.join(cwd, "package.json"));
   try {
     const entry = require2.resolve(name);
     let version2;
@@ -22766,7 +23271,7 @@ function versionMismatchCheck(cwd) {
   };
 }
 async function runDoctorChecks(options = {}) {
-  const cwd = path30__default.default.resolve(options.cwd ?? process3__default.default.cwd());
+  const cwd = path32__default.default.resolve(options.cwd ?? process3__default.default.cwd());
   const traceDir = options.traceDir?.trim() || process3__default.default.env.AGENT_INSPECT_TRACE_DIR?.trim() || ".agent-inspect";
   const checks2 = [
     nodeVersionCheck(),
@@ -23006,7 +23511,7 @@ function parsePluginManifest(input3) {
   };
 }
 async function readPluginManifestFile(packageDir) {
-  const manifestPath = path30__default.default.join(packageDir, PLUGIN_MANIFEST_FILENAME);
+  const manifestPath = path32__default.default.join(packageDir, PLUGIN_MANIFEST_FILENAME);
   try {
     const raw = await promises.readFile(manifestPath, "utf8");
     const parsed = parsePluginManifest(JSON.parse(raw));
@@ -23081,7 +23586,7 @@ function createTraceDirectoryIndexer() {
 // packages/cli/src/plugins.ts
 async function readPackageName(packageDir) {
   try {
-    const raw = await promises.readFile(path30__default.default.join(packageDir, "package.json"), "utf8");
+    const raw = await promises.readFile(path32__default.default.join(packageDir, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.name === "string" ? parsed.name : void 0;
   } catch {
@@ -23089,7 +23594,7 @@ async function readPackageName(packageDir) {
   }
 }
 async function discoverPlugins(cwd = process.cwd()) {
-  const nodeModules = path30__default.default.join(cwd, "node_modules");
+  const nodeModules = path32__default.default.join(cwd, "node_modules");
   const found = [];
   let entries;
   try {
@@ -23100,7 +23605,7 @@ async function discoverPlugins(cwd = process.cwd()) {
   for (const entry of entries.sort()) {
     if (entry.startsWith("@")) continue;
     if (!isPluginPackageName(entry)) continue;
-    const packageDir = path30__default.default.join(nodeModules, entry);
+    const packageDir = path32__default.default.join(nodeModules, entry);
     const manifestRead = await readPluginManifestFile(packageDir);
     found.push({
       packageName: entry,
@@ -23113,7 +23618,7 @@ async function discoverPlugins(cwd = process.cwd()) {
   return found;
 }
 async function validatePluginPackage(packageRef, cwd = process.cwd()) {
-  const packageDir = path30__default.default.isAbsolute(packageRef) ? packageRef : path30__default.default.join(cwd, "node_modules", packageRef);
+  const packageDir = path32__default.default.isAbsolute(packageRef) ? packageRef : path32__default.default.join(cwd, "node_modules", packageRef);
   const packageName = await readPackageName(packageDir) ?? packageRef;
   const errors = [];
   const warnings = [];
@@ -23190,7 +23695,7 @@ async function pluginsValidateCommand(packageRef, cwd) {
 init_advanced();
 var INDEX_FILENAME = ".agent-inspect-index.json";
 function traceIndexPath(traceDir) {
-  return path30__default.default.join(traceDir, INDEX_FILENAME);
+  return path32__default.default.join(traceDir, INDEX_FILENAME);
 }
 function parseMaxEntries(raw) {
   if (raw === void 0 || raw.trim() === "") return void 0;
@@ -23336,7 +23841,7 @@ async function newestTraceMtimeMs2(traceDir) {
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
       try {
-        const s = await promises.stat(path30__default.default.join(traceDir, file));
+        const s = await promises.stat(path32__default.default.join(traceDir, file));
         if (s.mtimeMs > newest) newest = s.mtimeMs;
       } catch {
       }
@@ -23591,11 +24096,11 @@ function printJson5(value) {
   console.log(JSON.stringify(value, null, 2));
 }
 function resolveCwd(options) {
-  return path30__default.default.resolve(options.cwd ?? process.cwd());
+  return path32__default.default.resolve(options.cwd ?? process.cwd());
 }
 async function suiteInitCommand(options = {}) {
   const cwd = resolveCwd(options);
-  const configPath = path30__default.default.join(cwd, DEFAULT_CONFIG_FILENAME);
+  const configPath = path32__default.default.join(cwd, DEFAULT_CONFIG_FILENAME);
   const template = options.template?.trim();
   const suiteConfig = template !== void 0 && template !== "" ? resolveSuiteTemplate(template) : defaultSuiteConfigTemplate();
   if (options.dryRun) {
@@ -23714,13 +24219,13 @@ async function suiteListCommand(options = {}) {
 }
 async function writeSuiteArtifact(result, configOutputDir, options) {
   const cwd = resolveCwd(options);
-  const outputDir = path30__default.default.resolve(
+  const outputDir = path32__default.default.resolve(
     cwd,
     options.output ?? configOutputDir ?? DEFAULT_SUITE_ARTIFACTS_DIR
   );
   await promises.mkdir(outputDir, { recursive: true });
   const stamp = result.startedAt.replace(/[:.]/g, "-");
-  const filePath = path30__default.default.join(outputDir, `${result.suiteName}-${stamp}.json`);
+  const filePath = path32__default.default.join(outputDir, `${result.suiteName}-${stamp}.json`);
   await promises.writeFile(filePath, `${JSON.stringify(result, null, 2)}
 `, "utf-8");
   return filePath;
@@ -23778,7 +24283,7 @@ async function loadSuiteResultFromInput(options) {
   if (options.input === void 0 || options.input.trim() === "") {
     throw new Error("Pass --input <suite-run.json> from a prior suite run.");
   }
-  const inputPath = path30__default.default.resolve(cwd, options.input.trim());
+  const inputPath = path32__default.default.resolve(cwd, options.input.trim());
   const raw = await promises.readFile(inputPath, "utf-8");
   return JSON.parse(raw);
 }
@@ -23815,9 +24320,9 @@ function normalizeMetrics2(raw) {
 }
 async function writeArtifacts(result, outputDir) {
   await promises.mkdir(outputDir, { recursive: true });
-  const jsonPath = path30__default.default.join(outputDir, "cohort-results.json");
-  const markdownPath = path30__default.default.join(outputDir, "cohort-summary.md");
-  const htmlPath = path30__default.default.join(outputDir, "cohort-report.html");
+  const jsonPath = path32__default.default.join(outputDir, "cohort-results.json");
+  const markdownPath = path32__default.default.join(outputDir, "cohort-summary.md");
+  const htmlPath = path32__default.default.join(outputDir, "cohort-report.html");
   await promises.writeFile(jsonPath, `${renderCohortReport(result, { format: "json" })}
 `, "utf-8");
   await promises.writeFile(
@@ -23845,7 +24350,7 @@ async function cohortCommand(options = {}) {
     const format = options.format ?? (options.json ? "json" : "markdown");
     let artifacts;
     if (options.output !== void 0 && options.output.trim() !== "") {
-      artifacts = await writeArtifacts(result, path30__default.default.resolve(options.output.trim()));
+      artifacts = await writeArtifacts(result, path32__default.default.resolve(options.output.trim()));
     }
     if (options.json || format === "json") {
       console.log(
@@ -23918,11 +24423,11 @@ function parseDuration2(value) {
 async function writeArtifacts2(result, outputDir) {
   await promises.mkdir(outputDir, { recursive: true });
   const paths = {
-    jsonPath: path30__default.default.join(outputDir, "gate-results.json"),
-    markdownPath: path30__default.default.join(outputDir, "gate-summary.md"),
-    htmlPath: path30__default.default.join(outputDir, "gate-report.html"),
-    junitPath: path30__default.default.join(outputDir, "junit.xml"),
-    githubPath: path30__default.default.join(outputDir, "github-step-summary.md")
+    jsonPath: path32__default.default.join(outputDir, "gate-results.json"),
+    markdownPath: path32__default.default.join(outputDir, "gate-summary.md"),
+    htmlPath: path32__default.default.join(outputDir, "gate-report.html"),
+    junitPath: path32__default.default.join(outputDir, "junit.xml"),
+    githubPath: path32__default.default.join(outputDir, "github-step-summary.md")
   };
   await promises.writeFile(
     paths.jsonPath,
@@ -23990,7 +24495,57 @@ async function gateCommand(options = {}) {
     const result = await runGate(runs, gateOptions);
     let artifacts;
     if (options.output !== void 0 && options.output.trim() !== "") {
-      artifacts = await writeArtifacts2(result, path30__default.default.resolve(options.output.trim()));
+      artifacts = await writeArtifacts2(result, path32__default.default.resolve(options.output.trim()));
+    }
+    const failed = !result.ok;
+    if (shouldEmitEvidence(options.evidenceOn, failed)) {
+      try {
+        const runIds = runs.length > 0 ? runs.map((run) => run.runId) : result.suiteResult?.cases.map((item) => item.runId).filter((id) => typeof id === "string" && id.length > 0) ?? ["gate"];
+        const sourceContents = /* @__PURE__ */ new Map();
+        for (const run of runs) {
+          if (run.filePath) {
+            try {
+              sourceContents.set(run.runId, await promises.readFile(run.filePath, "utf-8"));
+            } catch {
+              sourceContents.set(run.runId, "");
+            }
+          }
+        }
+        const label = runIds[0] ?? "gate";
+        const outputDir = resolveEvidenceOutputDir(
+          options.evidenceDir,
+          `gate-${label}`
+        );
+        const written = await writeLocalEvidence({
+          outputDir,
+          runIds: runIds.length > 0 ? runIds : ["gate"],
+          sourceContents,
+          ...gateOptions.traceDir !== void 0 ? { dir: gateOptions.traceDir } : {},
+          failed,
+          checkResultsJson: `${JSON.stringify(
+            {
+              aggregateStatus: failed ? "UNSAFE" : "SAFE",
+              gate: result
+            },
+            null,
+            2
+          )}
+`,
+          summaryText: renderGateReport(result, { format: "markdown" }),
+          redactionProfile: parseEvidenceProfile(options.evidenceProfile),
+          format: parseEvidenceFormat(options.evidenceFormat)
+        });
+        if (!options.json && format !== "json") {
+          console.log(`Evidence: ${written}`);
+        }
+        if (artifacts !== void 0) {
+          artifacts = { ...artifacts, evidence: written };
+        }
+      } catch (error) {
+        console.error(
+          `[AgentInspect] evidence package skipped: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
     }
     if (options.json || format === "json") {
       console.log(JSON.stringify({ ...result, artifacts: artifacts ?? null }, null, 2));
@@ -24167,6 +24722,23 @@ function createCliProgram() {
     "--circuit <rule>",
     "run optional circuit rules (repeatable): same-tool-repetition, max-retries, ...",
     (value, previous = []) => [...previous, value]
+  ).addOption(
+    new commander.Option("--preset <name>", "additive check preset").choices(["trajectory", "safety", "comprehensive"])
+  ).addOption(
+    new commander.Option(
+      "--evidence-on <mode>",
+      "write local Evidence v2 (fail=on failure, always, never; no upload)"
+    ).choices(["fail", "always", "never"])
+  ).option("--evidence-dir <path>", "local Evidence output directory or base path").addOption(
+    new commander.Option(
+      "--evidence-profile <profile>",
+      "Evidence redaction profile (default share)"
+    ).choices(["local", "share", "strict"])
+  ).addOption(
+    new commander.Option(
+      "--evidence-format <format>",
+      "Evidence output format (default directory)"
+    ).choices(["directory", "html", "zip"])
   ).action((target, opts) => {
     runCommand(() => checkCommand(target, opts));
   });
@@ -24265,6 +24837,9 @@ function createCliProgram() {
   ).option("--json", "print deterministic JSON verify result").action((targetPath, opts) => {
     runCommand(() => bundleVerifyCommand(targetPath, opts));
   });
+  bundleCmd.command("open").description("Verify then open local Evidence HTML in the platform browser (no network)").argument("<path>", "evidence/bundle directory or evidence.html path").option("--skip-verify", "skip integrity verify before open (not recommended)").option("--json", "print deterministic JSON open result").action((targetPath, opts) => {
+    runCommand(() => bundleOpenCommand(targetPath, opts));
+  });
   program.command("ci-summary").description("Summarize local reporter artifact manifests for CI").argument("<manifest...>", "reporter artifact manifest JSON files").option("-o, --output <path>", "write Markdown summary to a local file").option("--github-summary <path>", "append Markdown summary to this local file, e.g. GITHUB_STEP_SUMMARY").option("--json", "print deterministic JSON summary").action((manifest, opts) => {
     runCommand(() => ciSummaryCommand(manifest, opts));
   });
@@ -24544,7 +25119,22 @@ function createCliProgram() {
   ).option("--format <format>", "markdown, json, html, junit, or github", "markdown").option(
     "-o, --output <dir>",
     "write gate-results.json, gate-summary.md, gate-report.html, junit.xml, github-step-summary.md"
-  ).option("--json", "print deterministic JSON result").action((opts) => {
+  ).option("--json", "print deterministic JSON result").addOption(
+    new commander.Option(
+      "--evidence-on <mode>",
+      "write local Evidence v2 (fail=on failure, always, never; no upload)"
+    ).choices(["fail", "always", "never"])
+  ).option("--evidence-dir <path>", "local Evidence output directory or base path").addOption(
+    new commander.Option(
+      "--evidence-profile <profile>",
+      "Evidence redaction profile (default share)"
+    ).choices(["local", "share", "strict"])
+  ).addOption(
+    new commander.Option(
+      "--evidence-format <format>",
+      "Evidence output format (default directory)"
+    ).choices(["directory", "html", "zip"])
+  ).action((opts) => {
     runCommand(() => gateCommand(opts));
   });
   return program;
@@ -24554,9 +25144,9 @@ function isPrimaryModule() {
   if (!entry) return false;
   const selfPath = url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
   try {
-    return fs.realpathSync(path30__default.default.resolve(entry)) === fs.realpathSync(path30__default.default.resolve(selfPath));
+    return fs.realpathSync(path32__default.default.resolve(entry)) === fs.realpathSync(path32__default.default.resolve(selfPath));
   } catch {
-    return path30__default.default.resolve(entry) === path30__default.default.resolve(selfPath);
+    return path32__default.default.resolve(entry) === path32__default.default.resolve(selfPath);
   }
 }
 if (isPrimaryModule()) {