agent-inspect 6.29.0 → 6.29.2

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 6.29.2
+
+### Patch Changes
+
+- 555052d: Published runtime and fidelity patches for the post-6.29.1 adoption train:
+
+  - Externalize `agent-inspect` from `@agent-inspect/mcp` so packed ESM/CJS consumers share the application `inspectRun` context (#413).
+  - Refuse `suite init` overwrite of an existing suite config (#411 / #412).
+  - Recognize nested manual `attributes.metadata.arguments|input|toolArguments` in tool-argument checks (#414).
+  - Persist bounded safe thrown error codes from manual instrumentation (#415).
+  - Normalize OpenAI Agents cached tokens from `input_tokens_details.cached_tokens` (#416).
+
+## 6.29.1
+
+### Patch Changes
+
+- d723406: Post-6.29 hardening: regex-free redaction policy, OTLP GenAI declared-vs-emitted honesty, recovery fail-closed contracts, AI SDK overlap/close terminalization (open rows only), Evidence refuse unsafe expected/oneOf values with bind-before-HTML packaging, and CLI/recipe DX for anyOf vs retry paths.
+
 ## 6.29.0
 
 ### Minor Changes

package/README.md

@@ -212,7 +212,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.29.0** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.29.2** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/docs/API.md

@@ -474,6 +474,10 @@ Public methods:
 
 `capture` is explicit and metadata-only. `onSuccess: "metadata-only"` records safe type/length/key-count summaries in `outputSummary`; `onError: "metadata-only"` records thrown-value type/name summaries. It does not store raw return values, prompts, outputs, or thrown objects. Use `"none"` to disable a capture side.
 
+Persisted step/run errors keep `name` and `message`. When present, a **bounded safe** `code` is also retained: finite numeric `code`/`status` values (for example HTTP `404`) or short strings matching letters, digits, underscore, hyphen, dot, and colon (max 128 characters). Response bodies, headers, multiline values, and arbitrary enumerable error properties are not persisted.
+
+Pass structured tool arguments for contracts via step `metadata.arguments` / `metadata.input` / `metadata.toolArguments` (or top-level attributes with the same keys). TraceContract tool-argument checks read those locations; they do not enable default raw capture.
+
 `traceDir` and `silent` on `createInspector()` are context metadata for compatibility with existing helpers. They do not configure persistence or terminal output. Prefer writer-owned output configuration such as `fileWriter({ dir })` or `fileWriter({ filePath })`.
 
 `createInspectorRuntime()` is available from `agent-inspect/advanced` as the low-level isolation primitive. Most users should prefer `createInspector()` and `inspector.getDiagnostics()`.

package/docs/CLI.md

@@ -49,6 +49,24 @@ Core commands:
 - `report` — markdown or HTML inspection report for a single run
 - `explain` — deterministic local facts/inferences for a trace, with dry-run payloads
 
+## 1.1 CLI vs TraceContract decision table (6.29.3)
+
+Use this table when choosing between CLI check shorthands and TraceContract rules.
+No new CLI commands were added for branching paths.
+
+| Need | Prefer |
+| ---- | ------ |
+| One tool must always run | CLI `--required-tool` / contract `tools.required` |
+| Tool must never run | CLI `--forbidden-tool` / contract `tools.forbidden` |
+| Legitimate alternate paths (OR) | TraceContract `alternatives.anyOf` (not CLI flags) |
+| Causal order between tools | TraceContract `requiredOrder` + `requiredOrderMode` |
+| Read recovery vs write fail-closed | TraceContract `retry.operations` + `sideEffectClass` |
+| Sensitive expected literals in Evidence | Contract binding safety (`unavailable` on credential-like expected); never silent complete packaging |
+| Share-safe offline review package | CLI `bundle` / Evidence CI helpers |
+
+See [TRACE-CONTRACTS.md](./TRACE-CONTRACTS.md) and recipe
+[sensitive-read-outbound-write-anyof](../examples/recipes/sensitive-read-outbound-write-anyof/).
+
 ## 2. Environment variables
 
 - **`AGENT_INSPECT_TRACE_DIR`**: default directory for manual trace files (`.jsonl`) when not passed via `--dir` (or API options).
@@ -446,7 +464,7 @@ Options:
 - `--profile <local|share|strict>`: redaction profile (default `share`)
 - `-o, --output <path>`: write redacted content to a file
 - `--json`: print deterministic JSON wrapper with findings
-- `--policy <path>`: local JSON redaction policy (`extraKeys` + bounded `literal` / `prefix` / `typed` patterns). No remote fetch; no secrets on argv. See [SAFETY-POLICY.md](SAFETY-POLICY.md).
+- `--policy <path>`: local JSON redaction policy (`extraKeys` + bounded `literal` / `prefix` patterns; no user regex since 6.29.1). No remote fetch; no secrets on argv. See [SAFETY-POLICY.md](SAFETY-POLICY.md).
 - `--fail-on-residual`: opt-in non-zero exit when residual safety is `UNSAFE` or `UNKNOWN` (default exit codes unchanged)
 
 After redaction, the command surfaces a **residual safety assessment** using the same local detector pipeline as `verify-safe`. Human mode prints a concise stderr warning when residual status is not `SAFE`. JSON mode adds an additive `residualAssessment` field (`status`, finding counts, codes only — never matched secret values). Residual status uses `SAFE` | `SAFE_WITH_WARNINGS` | `UNSAFE` | `UNKNOWN`. Supported AgentInspect traces get a full assessment; arbitrary JSON that is not a supported trace yields `UNKNOWN`. Redact never certifies safe sharing — finish with `verify-safe` before publishing.
@@ -961,6 +979,8 @@ Options (shared):
 
 - `--template <name>` — PM/QA template (v5.4+): `customer-support-agent`, `refund-agent`, `sales-assistant`, `browser-task-agent`, `mcp-tool-agent`, `workflow-agent`, `rag-answer-agent`, `human-approval-agent`
 
+`suite init` creates a new `agent-inspect.suite.json` and **refuses to overwrite** an existing file (valid, malformed, or empty). Edit or delete the existing config explicitly before recreating it. There is no `--force` flag.
+
 `run` also supports:
 
 - `-o, --output <dir>` — write JSON run artifact (default: `.agent-inspect/suite-runs`)

package/docs/LIMITATIONS.md

@@ -9,6 +9,7 @@ This document states what AgentInspect **does not** provide today. It complement
 - **No vendor upload pipeline**: no built-in Langfuse/Braintrust/New Relic/Datadog direct exporters as live sinks.
 - **No automatic universal instrumentation** of every framework: integration is explicit (manual traces, log ingest, optional adapters).
 - **No retry execution engine:** TraceContract `retry` rules (including additive `retry.operations[]` recovery oracles in 6.27) evaluate attempt identity and evidence only. AgentInspect does not retry tools, remediates nothing, and does not treat a client `idempotencyKey` as proof of exactly-once writes. Write-tool timeout/unknown completion is unevaluable without authoritative idempotency evidence; write-retry is not safe by default.
+- **Transport facts are source-boundary only:** HTTP status, server-advertised retry delay, selected delay, and their sources must be captured at the transport/fetch boundary. An MCP wrapper cannot recover facts already collapsed into an SDK error message.
 - **Omitted-payload digests** (`createOmittedPayloadCommitment`) are bounded (1 MiB preflight). Digests prove omitted bytes existed; they are not redaction or authorization.
 
 ## Correlation metadata (v1.3.0)
@@ -26,7 +27,7 @@ This document states what AgentInspect **does not** provide today. It complement
 - **Subpath APIs:** `agent-inspect/writers`, `agent-inspect/readers`, and advanced helpers are available for local adoption from their owning subpaths. `createInspector()` is part of the small root API.
 - **Explicit writer ownership:** `createInspector()` does not print terminal lifecycle output or implicitly choose a disk writer. Use `fileWriter()` / `bufferedFileWriter()` / custom writers when persistence is desired.
 - **Diagnostic evidence, not an event-sourced runtime:** AgentInspect traces are local diagnostic evidence of what an agent did. They are **not** a write-ahead log, durable-before-effect journal, or application event-sourcing runtime. Buffered writers may lose a bounded tail of events on abrupt process termination. Call `flush()` / `close()` according to writer docs when you need the queue drained before exit; that lifecycle is deterministic and idempotent, but it is **not** an fsync / crash-durability guarantee.
-- **No standards upload:** OpenInference and OTLP JSON support is local read/export compatibility only. There is no OTLP gRPC/HTTP streaming sink, collector client, or hosted ingestion behavior.
+- **No standards upload:** OpenInference and OTLP JSON support is local read/export compatibility only. There is no OTLP gRPC/HTTP streaming sink, collector client, or hosted ingestion behavior. OTLP GenAI export is metadata/token-oriented (`OTEL_GEN_AI_SEMCONV_PIN`); it does not emit `gen_ai.prompt` / `gen_ai.completion` bodies.
 - **Conservative detection:** `agent-inspect open` does not silently accept arbitrary JSON. Unsupported or ambiguous inputs produce errors/warnings rather than guessed traces.
 - **Large inputs:** reader inputs are bounded and read into local memory. This is not a database index or production log warehouse.
 

package/docs/NETWORK-BEHAVIOR.md

@@ -27,6 +27,14 @@ AgentInspect is **local-first**. Core tracing writes local files and does **not*
 4. Prefer **redact / verify-safe** before any share or ingest path.
 5. Redaction is best-effort, not certification.
 
+## Transport evidence (HTTP / fetch / MCP)
+
+Capture **HTTP status**, **server-advertised retry delay**, **selected delay**, and their **sources** at the transport or fetch boundary that observes them.
+
+An MCP client wrapper or SDK error string cannot recover facts already collapsed into a message such as `"fetch failed"` or `"429 Too Many Requests"`. If the application needs TraceFacts or contracts over status/retry behavior, instrument the fetch/transport layer (or an observer that reads response headers before they are discarded).
+
+AgentInspect does not invent transport facts from error message text.
+
 ## Enabling Studio ingest
 
 See [SELF-HOSTING.md](./SELF-HOSTING.md) and [`@agent-inspect/studio`](https://github.com/rajudandigam/agent-inspect/tree/main/packages/studio). HTTP ingest remains off until you configure token and binding.

package/docs/SAFE-TRACE-SHARING.md

@@ -6,7 +6,7 @@ AgentInspect traces, log-ingest outputs, and exports are local files. They may s
 
 This guide is practical sharing guidance, not a guarantee that any artifact is safe to publish. Redaction profiles are **best-effort transformation**, not compliance-grade DLP or a safety certification. Always finish with `verify-safe` before sharing.
 
-Built-in profiles redact high-confidence credential forms (provider keys, JWTs, bearer tokens, and bounded `token=` / `api_key=` / `internal_token=` style key/value secrets). Broad or context-sensitive findings—such as private filesystem paths—may still appear under `verify-safe` and as residual status after `redact`. Org-specific patterns can use a local CLI `--policy` JSON file (`extraKeys` plus bounded literal/prefix/typed patterns) or programmatic custom detectors.
+Built-in profiles redact high-confidence credential forms (provider keys, JWTs, bearer tokens, and bounded `token=` / `api_key=` / `internal_token=` style key/value secrets). Broad or context-sensitive findings—such as private filesystem paths—may still appear under `verify-safe` and as residual status after `redact`. Org-specific patterns can use a local CLI `--policy` JSON file (`extraKeys` plus bounded literal/prefix patterns; no user regex) or programmatic custom detectors.
 
 `strict` is a stricter **rule set** (more keys), not a promise that every input produces bytes different from `share`.
 

package/docs/STANDARDS.md

@@ -29,7 +29,7 @@ The fixture's top-level `version` is an **AgentInspect reference fixture revisio
 npx agent-inspect export <run-id> --format otlp-json --profile share
 ```
 
-GenAI attribute mapping follows `OTEL_GEN_AI_SEMCONV_PIN` (see exporters API). No gRPC collector included.
+GenAI attribute mapping follows `OTEL_GEN_AI_SEMCONV_PIN` (see exporters API). The pin lists only attributes the exporter may emit (operation name, request model, usage tokens). AgentInspect does **not** export `gen_ai.prompt` / `gen_ai.completion` bodies. No gRPC collector included.
 
 Fixture: [fixtures/standards/otlp-basic.json](../fixtures/standards/otlp-basic.json)
 

package/docs/TRACE-CONTRACTS.md

@@ -229,11 +229,22 @@ defineTraceContract({
 
 Missing structured argument evidence fails closed (`AI_CHECK_TOOL_ARGUMENT_EVIDENCE_UNAVAILABLE`). Findings never include full actual inputs.
 
+Manual instrumentation stores caller metadata under `attributes.metadata`. Tool-argument checks therefore also accept structured object/array evidence at:
+
+```text
+attributes.metadata.arguments
+attributes.metadata.input
+attributes.metadata.toolArguments
+```
+
+Precedence: top-level `attributes.arguments|input|toolArguments`, then nested metadata keys, then structured `inputSummary`. Preview strings are never parsed as JSON. This does not enable default raw argument capture.
+
 ### Capture capability matrix (tool-argument evidence)
 
 | Source | Structured input | Preview only | Digest only | Unavailable |
 | --- | :---: | :---: | :---: | :---: |
 | Manual `attributes.arguments` / `attributes.input` (object) | yes | — | — | — |
+| Manual `attributes.metadata.arguments` / `input` / `toolArguments` (object/array) | yes | — | — | — |
 | Manual `inputSummary` string | — | yes | — | for pointer checks |
 | AI SDK / LangChain metadata-only default | — | sometimes | — | typical |
 | OpenAI Agents metadata-only | — | sometimes | — | typical |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.29.0",
+  "version": "6.29.2",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",
@@ -235,7 +235,7 @@
     "test:all": "pnpm run typecheck && pnpm run linked-versions:check && pnpm run build && pnpm run test && pnpm run size",
     "prepublish:checks": "pnpm run typecheck && pnpm run test && pnpm run test:coverage && pnpm run build && pnpm run fixtures:check && pnpm run recipes:check && pnpm run size && pnpm run linked-versions:check && pnpm run repo:health && pnpm run pack:smoke",
     "pack:dry-run": "pnpm run build && npm pack --dry-run",
-    "pack:smoke": "pnpm run build && node scripts/package-smoke.mjs && node scripts/packed-openai-agents-e2e.mjs && node scripts/packed-ai-sdk-e2e.mjs && node scripts/packed-quickstart-e2e.mjs && node scripts/packed-semantic-loop-e2e.mjs && node scripts/packed-swarm-loop-e2e.mjs && node scripts/evidence-ci-golden-paths.mjs",
+    "pack:smoke": "pnpm run build && node scripts/package-smoke.mjs && node scripts/packed-openai-agents-e2e.mjs && node scripts/packed-ai-sdk-e2e.mjs && node scripts/packed-mcp-e2e.mjs && node scripts/packed-quickstart-e2e.mjs && node scripts/packed-semantic-loop-e2e.mjs && node scripts/packed-swarm-loop-e2e.mjs && node scripts/evidence-ci-golden-paths.mjs",
     "linked-versions:check": "node scripts/check-linked-versions.mjs",
     "docs:commands": "node scripts/validate-doc-commands.mjs",
     "docs:links": "node scripts/validate-doc-links.mjs",

package/packages/cli/dist/{chunk-D7PT6TXM.mjs → chunk-UK4HD5M3.mjs}

@@ -841,6 +841,30 @@ var Redactor = class {
   }
 };
 
+// packages/core/src/safety/credential-value-patterns.ts
+var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i;
+var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
+  /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
+  /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
+  /\b[a-z0-9_.-]+=[^;\s]+(?:;\s*[a-z0-9_.-]+=[^;\s]+)+/i,
+  /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
+  /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
+  /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
+  KEY_VALUE_SECRET_PATTERN
+];
+function stringContainsHighConfidenceCredential(value) {
+  for (const pattern of HIGH_CONFIDENCE_CREDENTIAL_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(value)) {
+      pattern.lastIndex = 0;
+      return true;
+    }
+  }
+  return false;
+}
+
 // packages/core/src/redaction-profiles.ts
 var SHARE_PROFILE_EXTRA_KEYS = [
   "userEmail",
@@ -7074,7 +7098,15 @@ function buildEmbeddedPayload(input) {
       redactionProfile: input.redactionProfile,
       verificationPolicy: input.verificationPolicy
     },
-    checkSummary: input.checkSummary
+    checkSummary: input.checkSummary,
+    ...input.contractBinding !== void 0 ? {
+      contract: {
+        status: input.contractBinding.status,
+        ...input.contractBinding.sha256 !== void 0 ? { sha256: input.contractBinding.sha256 } : {},
+        ...input.contractBinding.ruleCount !== void 0 ? { ruleCount: input.contractBinding.ruleCount } : {},
+        ...input.contractBinding.note !== void 0 ? { note: input.contractBinding.note } : {}
+      }
+    } : {}
   };
 }
 function buildEvidenceHtmlShell(input) {
@@ -7172,6 +7204,7 @@ ${nav}
     <p>Artifact status: <span class="badge ${statusClass(input.assessmentStatus)}">${escapeHtml(input.assessmentStatus)}</span>
     ${input.sourceStatus !== void 0 ? ` \xB7 Source status: <span class="badge ${statusClass(input.sourceStatus)}">${escapeHtml(input.sourceStatus)}</span>` : ""}</p>
     <p>Profile: <code>${escapeHtml(input.redactionProfile)}</code> \xB7 Verification: <code>${escapeHtml(input.verificationPolicy)}</code></p>
+    ${input.contractBinding !== void 0 ? `<p>Contract binding: <code>${escapeHtml(input.contractBinding.status)}</code>${input.contractBinding.ruleCount !== void 0 ? ` \xB7 Rules: <code>${escapeHtml(String(input.contractBinding.ruleCount))}</code>` : ""}${input.contractBinding.sha256 !== void 0 ? ` \xB7 Digest: <code>${escapeHtml(input.contractBinding.sha256.slice(0, 16))}\u2026</code>` : ""}</p>${input.contractBinding.note !== void 0 && input.contractBinding.note.trim() !== "" ? `<p class="muted">${escapeHtml(input.contractBinding.note)}</p>` : ""}` : ""}
     <p>Generator: <code>${escapeHtml(input.generatorName)}@${escapeHtml(input.generatorVersion)}</code>
     ${input.createdAt ? ` \xB7 Created: <code>${escapeHtml(input.createdAt)}</code>` : ""}</p>
     <h3>Runs</h3>
@@ -7964,6 +7997,39 @@ var EVIDENCE_CONTRACT_CANONICALIZATION_VERSION = "1";
 var EVIDENCE_CONTRACT_PARTIAL_NOTE = "Custom or programmatic rules are not serializable; Evidence records rule IDs only and does not claim complete reviewer replay.";
 var EVIDENCE_CONTRACT_UNAVAILABLE_NOTE = "No resolved TraceContract or check preset was packaged with this Evidence artifact.";
 var EVIDENCE_CONTRACT_ASSURANCE_NOTE = "Contract binding verifies packaged digest integrity only; it does not prove producer identity, trusted time, source completeness, semantic truth, or external acceptance.";
+var EVIDENCE_CONTRACT_UNSAFE_NOTE = "Resolved TraceContract contains high-confidence credential-like expected values; Evidence refuses complete packaging rather than silently redacting evaluated expectations.";
+function contractContainsUnsafeExpectedValues(value) {
+  return scanForExpectedFields(value, 0);
+}
+function scanForExpectedFields(value, depth) {
+  if (depth > 32) return false;
+  if (Array.isArray(value)) {
+    return value.some((item) => scanForExpectedFields(item, depth + 1));
+  }
+  if (value === null || typeof value !== "object") return false;
+  const record = value;
+  for (const [key, child] of Object.entries(record)) {
+    if (key === "expected" || key === "oneOf") {
+      if (valueTreeContainsCredential(child, depth + 1)) return true;
+      continue;
+    }
+    if (scanForExpectedFields(child, depth + 1)) return true;
+  }
+  return false;
+}
+function valueTreeContainsCredential(value, depth) {
+  if (depth > 32) return false;
+  if (typeof value === "string") {
+    return stringContainsHighConfidenceCredential(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some((item) => valueTreeContainsCredential(item, depth + 1));
+  }
+  if (value === null || typeof value !== "object") return false;
+  return Object.values(value).some(
+    (child) => valueTreeContainsCredential(child, depth + 1)
+  );
+}
 function serializeCanonicalJson(value) {
   return `${JSON.stringify(stableValue(value), null, 2)}
 `;
@@ -8097,6 +8163,32 @@ function buildEvidenceContractPackage(input) {
   if (unsupported.length > 0) {
     ruleIds = sortedUniqueStrings([...ruleIds, ...unsupported]);
   }
+  if (contractContainsUnsafeExpectedValues(resolved)) {
+    return {
+      binding: {
+        status: "unavailable",
+        source: input.source,
+        ...input.contractId !== void 0 ? { contractId: input.contractId } : {},
+        ...input.contractVersion !== void 0 ? { contractVersion: input.contractVersion } : {},
+        canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+        engineVersion: input.engineVersion,
+        ruleIds,
+        ...unsupported.length > 0 ? { unsupportedRuleIds: unsupported } : {},
+        note: input.note ?? EVIDENCE_CONTRACT_UNSAFE_NOTE
+      },
+      checkBinding: {
+        canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+        engineVersion: input.engineVersion,
+        evaluatedRuleIds: ruleIds,
+        bindingStatus: "unavailable",
+        ...unsupported.length > 0 ? { unsupportedRuleIds: unsupported } : {},
+        origin: {
+          source: input.source,
+          ...input.preset?.name ? { preset: input.preset.name } : {}
+        }
+      }
+    };
+  }
   const document = {
     canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
     kind,
@@ -8469,29 +8561,6 @@ function buildEvidenceCiPackage(input) {
     schemaVersions.add(version);
   }
   const createdAt = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  const evidenceHtml = buildEvidenceHtmlShell({
-    title: "AgentInspect evidence",
-    runIds: input.runIds,
-    assessmentStatus: input.assessmentStatus,
-    sourceStatus: input.sourceStatus,
-    redactionProfile: input.redactionProfile,
-    verificationPolicy: input.redactionProfile,
-    generatorName: "agent-inspect",
-    generatorVersion: input.generatorVersion,
-    createdAt,
-    summaryText: input.summaryText,
-    checkSummary: {
-      aggregateStatus: input.assessmentStatus,
-      runs: input.runIds.map((runId) => ({
-        runId,
-        status: input.assessmentStatus,
-        sourceStatus: input.sourceStatus,
-        errors: input.assessmentStatus === "UNSAFE" || input.assessmentStatus === "UNKNOWN" ? 1 : 0,
-        warnings: input.assessmentStatus === "SAFE WITH WARNINGS" ? 1 : 0,
-        findings: 0
-      }))
-    }
-  });
   let checkResultsJson = input.checkResultsJson;
   let contractBinding;
   let contractFileContent;
@@ -8514,6 +8583,37 @@ function buildEvidenceCiPackage(input) {
       bindCheckResultsToContract(parsed, packaged2.checkBinding)
     );
   }
+  const evidenceHtml = buildEvidenceHtmlShell({
+    title: "AgentInspect evidence",
+    runIds: input.runIds,
+    assessmentStatus: input.assessmentStatus,
+    sourceStatus: input.sourceStatus,
+    redactionProfile: input.redactionProfile,
+    verificationPolicy: input.redactionProfile,
+    generatorName: "agent-inspect",
+    generatorVersion: input.generatorVersion,
+    createdAt,
+    summaryText: input.summaryText,
+    checkSummary: {
+      aggregateStatus: input.assessmentStatus,
+      runs: input.runIds.map((runId) => ({
+        runId,
+        status: input.assessmentStatus,
+        sourceStatus: input.sourceStatus,
+        errors: input.assessmentStatus === "UNSAFE" || input.assessmentStatus === "UNKNOWN" ? 1 : 0,
+        warnings: input.assessmentStatus === "SAFE WITH WARNINGS" ? 1 : 0,
+        findings: 0
+      }))
+    },
+    ...contractBinding !== void 0 ? {
+      contractBinding: {
+        status: contractBinding.status,
+        ...contractBinding.sha256 !== void 0 ? { sha256: contractBinding.sha256 } : {},
+        ...contractBinding.note !== void 0 ? { note: contractBinding.note } : {},
+        ruleCount: contractBinding.ruleIds.length
+      }
+    } : {}
+  });
   const packaged = [
     { path: EVIDENCE_HTML_FILENAME, content: evidenceHtml },
     { path: "check-results.json", content: checkResultsJson },
@@ -12386,5 +12486,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { COHORT_METRIC_IDS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-D7PT6TXM.mjs.map
-//# sourceMappingURL=chunk-D7PT6TXM.mjs.map
+//# sourceMappingURL=chunk-UK4HD5M3.mjs.map
+//# sourceMappingURL=chunk-UK4HD5M3.mjs.map