agent-inspect 6.8.0 → 6.10.0

package/packages/cli/dist/{chunk-TO4VENHV.mjs → chunk-36IJ76LH.mjs}

@@ -1,7 +1,7 @@
 import { readdir, stat, readFile, access } from 'fs/promises';
 import os from 'os';
 import path5 from 'path';
-import crypto2, { webcrypto } from 'crypto';
+import crypto2, { createHash, webcrypto } from 'crypto';
 import process2 from 'process';
 import tty from 'tty';
 import { AsyncLocalStorage } from 'async_hooks';
@@ -3443,12 +3443,12 @@ function buildCriticalPath(runs, handoffs) {
     handoffs.filter((edge) => edge.confidence === "explicit").map((edge) => edge.from)
   );
   const ordered = [...runs].sort(compareRuns);
-  const path12 = [];
+  const path14 = [];
   const visited = /* @__PURE__ */ new Set();
   const pushRun = (run, confidence, source) => {
     if (visited.has(run.runId)) return;
     visited.add(run.runId);
-    path12.push({
+    path14.push({
       runId: run.runId,
       name: run.name,
       startedAt: run.startedAt,
@@ -3473,7 +3473,7 @@ function buildCriticalPath(runs, handoffs) {
     const confidence = explicitTargets.has(run.runId) || explicitSources.has(run.runId) ? "explicit" : "correlated";
     pushRun(run, confidence, confidence === "explicit" ? "manual" : "inferred");
   }
-  return path12;
+  return path14;
 }
 function metaRunIdMatches(run, token, runById) {
   const meta = extractSessionWorkflowMetadata(run.metadata);
@@ -3804,8 +3804,9 @@ function buildBundleSummaryMarkdown(parts) {
     ""
   ];
   for (const run of checks.runs) {
+    const source = run.sourceStatus !== void 0 && run.sourceStatus !== run.status ? `; source ${run.sourceStatus}` : "";
     lines.push(
-      `- \`${run.runId}\`: ${run.status} (${run.findings} finding(s), ${run.errors} error(s), ${run.warnings} warning(s))`
+      `- \`${run.runId}\`: artifact ${run.status}${source} (${run.findings} finding(s), ${run.errors} error(s), ${run.warnings} warning(s))`
     );
   }
   lines.push("", "## Redaction", "", `Total findings: ${redaction.totalFindings}`, "");
@@ -3846,13 +3847,13 @@ function assertBundlePathContained(outputDir, relativePath) {
   }
   return resolved;
 }
-function normalizeBundleOutputPath(out) {
+function normalizeBundleOutputPath(out, options) {
   const trimmed = out.trim();
   if (trimmed === "") {
     throw new Error("--out requires a non-empty path.");
   }
   const resolved = path5.resolve(trimmed);
-  if (resolved.toLowerCase().endsWith(".zip")) {
+  if (options?.preserveZipExtension !== true && resolved.toLowerCase().endsWith(".zip")) {
     return resolved.slice(0, -4);
   }
   return resolved;
@@ -3863,6 +3864,1721 @@ function defaultBundleOutputPath(runIds) {
   return path5.resolve(`agent-inspect-bundle-${label}-${stamp}`);
 }
 
+// packages/core/src/evidence/types.ts
+var EVIDENCE_FORMAT_VERSION = "1.0";
+var EVIDENCE_ASSESSMENT_NOTE = "Best-effort local safety verification only; not a compliance certification.";
+var EVIDENCE_MANIFEST_FILENAME = "evidence.json";
+var SHA256_RE = /^[a-f0-9]{64}$/i;
+function sha256Hex(data) {
+  const hash = createHash("sha256");
+  if (typeof data === "string") {
+    hash.update(data, "utf8");
+  } else {
+    hash.update(data);
+  }
+  return hash.digest("hex");
+}
+function isSha256Hex(value) {
+  return SHA256_RE.test(value);
+}
+function sha256Equals(expected, actual) {
+  if (!isSha256Hex(expected) || !isSha256Hex(actual)) {
+    return false;
+  }
+  const a = expected.toLowerCase();
+  const b = actual.toLowerCase();
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function assertEvidenceRelativePath(relativePath) {
+  if (typeof relativePath !== "string" || relativePath.trim() === "") {
+    throw new Error("Evidence file path must be a non-empty relative path.");
+  }
+  const trimmed = relativePath.trim().replaceAll("\\", "/");
+  if (path5.isAbsolute(trimmed) || trimmed.startsWith("/")) {
+    throw new Error(`Evidence file path must be relative: ${relativePath}`);
+  }
+  const parts = trimmed.split("/").filter((part) => part !== "");
+  if (parts.length === 0) {
+    throw new Error(`Evidence file path must be relative: ${relativePath}`);
+  }
+  for (const part of parts) {
+    if (part === "." || part === "..") {
+      throw new Error(`Evidence file path must not contain "." or "..": ${relativePath}`);
+    }
+  }
+  return parts.join("/");
+}
+
+// packages/core/src/evidence/manifest.ts
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable(record[key])])
+  );
+}
+function serializeEvidenceManifest(manifest) {
+  return `${JSON.stringify(stable(manifest), null, 2)}
+`;
+}
+function inferEvidenceFileRole(relativePath) {
+  const normalized = assertEvidenceRelativePath(relativePath);
+  const base = normalized.includes("/") ? normalized.slice(normalized.lastIndexOf("/") + 1) : normalized;
+  if (base === "evidence.html" || base === "trace.html" || base.endsWith(".html")) {
+    return "report";
+  }
+  if (base === "trace.jsonl" || base.endsWith(".jsonl")) {
+    return "redacted-trace";
+  }
+  if (base === "check-results.json") {
+    return "checks";
+  }
+  if (base === "redaction-report.json") {
+    return "redaction-report";
+  }
+  if (base === "summary.md") {
+    return "summary";
+  }
+  return "other";
+}
+function buildEvidenceFileEntries(files) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const relativePath = assertEvidenceRelativePath(file.path);
+    if (relativePath === EVIDENCE_MANIFEST_FILENAME) {
+      throw new Error(
+        `Do not include ${EVIDENCE_MANIFEST_FILENAME} in packaged file hashes (self-hash is undefined).`
+      );
+    }
+    if (byPath.has(relativePath)) {
+      throw new Error(`Duplicate evidence file path: ${relativePath}`);
+    }
+    byPath.set(relativePath, {
+      path: relativePath,
+      sha256: sha256Hex(file.content),
+      role: file.role ?? inferEvidenceFileRole(relativePath)
+    });
+  }
+  return [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path));
+}
+function buildEvidenceManifest(parts) {
+  const runIds = [...parts.runIds];
+  if (runIds.length === 0) {
+    throw new Error("Evidence manifest requires at least one run id.");
+  }
+  for (const item of parts.sourceHashes) {
+    if (!runIds.includes(item.runId)) {
+      throw new Error(`sourceHashes runId "${item.runId}" is not listed in source.runIds.`);
+    }
+    if (item.algorithm !== "sha256") {
+      throw new Error(`Unsupported source hash algorithm: ${item.algorithm}`);
+    }
+  }
+  const assessment = {
+    status: parts.assessmentStatus,
+    note: parts.note ?? EVIDENCE_ASSESSMENT_NOTE
+  };
+  if (parts.sourceStatus !== void 0) {
+    assessment.sourceStatus = parts.sourceStatus;
+  }
+  return {
+    evidenceFormatVersion: EVIDENCE_FORMAT_VERSION,
+    generator: {
+      name: parts.generatorName ?? "agent-inspect",
+      version: parts.generatorVersion
+    },
+    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    source: {
+      runIds,
+      traceSchemaVersions: [...parts.traceSchemaVersions].sort((a, b) => a.localeCompare(b)),
+      sourceHashes: [...parts.sourceHashes].sort((a, b) => a.runId.localeCompare(b.runId))
+    },
+    policy: {
+      redactionProfile: parts.redactionProfile,
+      verificationPolicy: parts.verificationPolicy ?? parts.redactionProfile
+    },
+    assessment,
+    files: buildEvidenceFileEntries(parts.files)
+  };
+}
+function validateEvidenceManifest(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Evidence manifest must be a JSON object.");
+  }
+  const record = value;
+  if (record.evidenceFormatVersion !== EVIDENCE_FORMAT_VERSION) {
+    throw new Error(
+      `Unsupported evidenceFormatVersion: ${String(record.evidenceFormatVersion)}`
+    );
+  }
+  const generator = record.generator;
+  if (generator === null || typeof generator !== "object" || Array.isArray(generator) || typeof generator.name !== "string" || typeof generator.version !== "string") {
+    throw new Error("Evidence manifest requires generator.name and generator.version.");
+  }
+  const source = record.source;
+  if (source === null || typeof source !== "object" || Array.isArray(source)) {
+    throw new Error("Evidence manifest requires source.");
+  }
+  const sourceRecord = source;
+  if (!Array.isArray(sourceRecord.runIds) || sourceRecord.runIds.length === 0) {
+    throw new Error("Evidence manifest source.runIds must be a non-empty array.");
+  }
+  if (!Array.isArray(sourceRecord.traceSchemaVersions)) {
+    throw new Error("Evidence manifest source.traceSchemaVersions must be an array.");
+  }
+  if (!Array.isArray(sourceRecord.sourceHashes)) {
+    throw new Error("Evidence manifest source.sourceHashes must be an array.");
+  }
+  const policy = record.policy;
+  if (policy === null || typeof policy !== "object" || Array.isArray(policy)) {
+    throw new Error("Evidence manifest requires policy.");
+  }
+  const assessment = record.assessment;
+  if (assessment === null || typeof assessment !== "object" || Array.isArray(assessment) || typeof assessment.status !== "string") {
+    throw new Error("Evidence manifest requires assessment.status.");
+  }
+  if (!Array.isArray(record.files) || record.files.length === 0) {
+    throw new Error("Evidence manifest files must be a non-empty array.");
+  }
+  for (const file of record.files) {
+    if (file === null || typeof file !== "object" || Array.isArray(file)) {
+      throw new Error("Evidence manifest file entries must be objects.");
+    }
+    const entry = file;
+    if (typeof entry.path !== "string") {
+      throw new Error("Evidence file entry requires path.");
+    }
+    assertEvidenceRelativePath(entry.path);
+    if (typeof entry.sha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.sha256)) {
+      throw new Error(`Evidence file entry requires sha256 hex for ${entry.path}.`);
+    }
+  }
+  return value;
+}
+function parseEvidenceManifestJson(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Evidence manifest is not valid JSON: ${message}`);
+  }
+  return validateEvidenceManifest(parsed);
+}
+function collectTraceSchemaVersions(jsonl) {
+  const versions = /* @__PURE__ */ new Set();
+  for (const line of jsonl.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed === "") continue;
+    try {
+      const row = JSON.parse(trimmed);
+      if (typeof row.schemaVersion === "string" && row.schemaVersion.trim() !== "") {
+        versions.add(row.schemaVersion.trim());
+      }
+    } catch {
+    }
+  }
+  return [...versions].sort((a, b) => a.localeCompare(b));
+}
+
+// packages/core/src/exporters/helpers.ts
+var REDACT_SUBSTRINGS = [
+  "authorization",
+  "cookie",
+  "token",
+  "apikey",
+  "password",
+  "secret",
+  "email"
+];
+function shouldRedactKey(key) {
+  const k = key.toLowerCase();
+  for (const s of REDACT_SUBSTRINGS) {
+    if (k.includes(s)) return true;
+  }
+  return false;
+}
+function safeString(value, maxLength) {
+  if (value === null || value === void 0) return "";
+  let s;
+  if (typeof value === "string") s = value;
+  else if (typeof value === "number" || typeof value === "boolean") s = String(value);
+  else s = stableJson(value, false);
+  if (maxLength !== void 0 && maxLength >= 0 && s.length > maxLength) {
+    return `${s.slice(0, maxLength)}\u2026`;
+  }
+  return s;
+}
+function escapeMarkdown(value) {
+  return value.replace(/\|/g, "\\|").replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\n/g, " ");
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function sortKeysDeep(input) {
+  if (input === null || typeof input !== "object") return input;
+  if (Array.isArray(input)) return input.map(sortKeysDeep);
+  const o = input;
+  const out = {};
+  for (const k of Object.keys(o).sort()) {
+    out[k] = sortKeysDeep(o[k]);
+  }
+  return out;
+}
+function stableJson(value, pretty) {
+  const sorted = sortKeysDeep(value);
+  return pretty === true ? JSON.stringify(sorted, null, 2) : JSON.stringify(sorted);
+}
+function compactAttributes(attrs, options) {
+  if (attrs === void 0) return {};
+  const maxLen = options?.maxLength ?? 500;
+  const redacted = options?.redacted ?? true;
+  const out = {};
+  for (const key of Object.keys(attrs).sort()) {
+    if (redacted && shouldRedactKey(key)) {
+      out[key] = "[REDACTED]";
+      continue;
+    }
+    const v = attrs[key];
+    out[key] = compactValue(v, maxLen, redacted);
+  }
+  return out;
+}
+function compactValue(value, maxLen, redacted) {
+  if (value === null || typeof value !== "object") {
+    return typeof value === "string" ? safeString(value, maxLen) : value;
+  }
+  if (Array.isArray(value)) {
+    const arr = value.slice(0, 20).map((x) => compactValue(x, maxLen, redacted));
+    if (value.length > 20) arr.push(`\u2026(+${value.length - 20} more)`);
+    return arr;
+  }
+  const o = value;
+  const inner = {};
+  for (const k of Object.keys(o)) {
+    if (redacted && shouldRedactKey(k)) inner[k] = "[REDACTED]";
+    else inner[k] = compactValue(o[k], maxLen, redacted);
+  }
+  return inner;
+}
+function flattenTree(tree) {
+  const out = [];
+  function walk(nodes) {
+    for (const n of nodes) {
+      out.push(n);
+      if (n.children.length > 0) walk(n.children);
+    }
+  }
+  walk(tree.children);
+  return out;
+}
+function zeroKinds() {
+  return {
+    RUN: 0,
+    AGENT: 0,
+    LLM: 0,
+    TOOL: 0,
+    CHAIN: 0,
+    RETRIEVER: 0,
+    DECISION: 0,
+    RESULT: 0,
+    ERROR: 0,
+    LOGIC: 0,
+    LOG: 0,
+    OUTCOME: 0
+  };
+}
+
+// packages/core/src/evidence/views.ts
+function renderTreeHtml(nodes, ulClass = "tree") {
+  if (nodes.length === 0) return "";
+  const parts = [`<ul class="${ulClass}">`];
+  for (const n of nodes) {
+    const ev = n.event;
+    const status = ev.status ?? "?";
+    const dur = ev.durationMs !== void 0 && Number.isFinite(ev.durationMs) ? `${ev.durationMs}ms` : "-";
+    const errClass = ev.status === "error" ? " is-error" : "";
+    parts.push(`<li class="tree-node${errClass}">`);
+    parts.push(
+      `<span class="nm">${escapeHtml(ev.name)}</span> <span class="meta">[${escapeHtml(ev.kind)}] ${escapeHtml(status)} (${escapeHtml(dur)})</span>`
+    );
+    if (n.children.length > 0) {
+      parts.push(renderTreeHtml(n.children, "tree nested"));
+    }
+    parts.push("</li>");
+  }
+  parts.push("</ul>");
+  return parts.join("");
+}
+function buildEvidenceTreeViewHtml(trees) {
+  if (trees.length === 0) {
+    return `<p class="muted">No execution trees available.</p>`;
+  }
+  const parts = [];
+  for (const tree of trees) {
+    parts.push(`<article class="run-block">`);
+    parts.push(`<h3><code>${escapeHtml(tree.runId)}</code></h3>`);
+    if (tree.name) {
+      parts.push(`<p class="muted">Name: ${escapeHtml(tree.name)}</p>`);
+    }
+    parts.push(
+      `<p>Status: <strong>${escapeHtml(String(tree.status ?? "unknown"))}</strong>${tree.durationMs !== void 0 ? ` \xB7 ${escapeHtml(String(tree.durationMs))}ms` : ""}</p>`
+    );
+    parts.push(
+      tree.children.length > 0 ? renderTreeHtml(tree.children) : `<p class="muted">No steps recorded.</p>`
+    );
+    parts.push(`</article>`);
+  }
+  return parts.join("\n");
+}
+function timelineRows(tree) {
+  const flat = flattenTree(tree);
+  const origin = tree.startedAt ?? flat.reduce((min, n) => {
+    const t = n.event.timestamp;
+    if (!Number.isFinite(t)) return min;
+    return min === void 0 ? t : Math.min(min, t);
+  }, void 0) ?? 0;
+  return flat.filter((n) => n.event.kind !== "RUN").map((n) => {
+    const started = Number.isFinite(n.event.timestamp) ? n.event.timestamp : origin;
+    const durationMs = n.event.durationMs !== void 0 && Number.isFinite(n.event.durationMs) ? Math.max(0, n.event.durationMs) : 0;
+    return {
+      name: n.event.name,
+      kind: n.event.kind,
+      status: n.event.status ?? "?",
+      offsetMs: Math.max(0, started - origin),
+      durationMs,
+      isError: n.event.status === "error"
+    };
+  }).sort((a, b) => a.offsetMs - b.offsetMs || a.name.localeCompare(b.name));
+}
+function buildEvidenceTimelineViewHtml(trees) {
+  if (trees.length === 0) {
+    return `<p class="muted">No timeline data available.</p>`;
+  }
+  const parts = [];
+  for (const tree of trees) {
+    const rows = timelineRows(tree);
+    const maxEnd = rows.reduce(
+      (max, row) => Math.max(max, row.offsetMs + Math.max(row.durationMs, 1)),
+      1
+    );
+    parts.push(`<article class="run-block">`);
+    parts.push(`<h3><code>${escapeHtml(tree.runId)}</code></h3>`);
+    if (rows.length === 0) {
+      parts.push(`<p class="muted">No step timings recorded.</p>`);
+    } else {
+      parts.push(`<div class="waterfall" role="list">`);
+      for (const row of rows) {
+        const left = row.offsetMs / maxEnd * 100;
+        const width = Math.max(0.8, Math.max(row.durationMs, 1) / maxEnd * 100);
+        const err = row.isError ? " is-error" : "";
+        parts.push(
+          `<div class="wf-row${err}" role="listitem"><div class="wf-label"><span class="nm">${escapeHtml(row.name)}</span> <span class="meta">[${escapeHtml(row.kind)}] ${escapeHtml(row.status)} \xB7 ${escapeHtml(String(row.durationMs))}ms @+${escapeHtml(String(row.offsetMs))}ms</span></div><div class="wf-track"><span class="wf-bar" style="left:${left.toFixed(2)}%;width:${width.toFixed(2)}%"></span></div></div>`
+        );
+      }
+      parts.push(`</div>`);
+    }
+    parts.push(`</article>`);
+  }
+  return parts.join("\n");
+}
+function findNodeByEventId(nodes, eventId) {
+  for (const node of nodes) {
+    if (node.event.eventId === eventId) return node;
+    const child = findNodeByEventId(node.children, eventId);
+    if (child) return child;
+  }
+  return void 0;
+}
+function buildAncestorChain(tree, failure) {
+  const chain = [failure];
+  let parentId = failure.event.parentId;
+  const guard = /* @__PURE__ */ new Set([failure.event.eventId]);
+  while (parentId && !guard.has(parentId)) {
+    guard.add(parentId);
+    const parent = findNodeByEventId(tree.children, parentId);
+    if (!parent) break;
+    chain.unshift(parent);
+    parentId = parent.event.parentId;
+  }
+  return chain;
+}
+function buildEvidenceCausalFailureViewHtml(trees) {
+  if (trees.length === 0) {
+    return `<p class="muted">No runs available for causal analysis.</p>`;
+  }
+  const parts = [];
+  for (const tree of trees) {
+    parts.push(`<article class="run-block">`);
+    parts.push(`<h3><code>${escapeHtml(tree.runId)}</code></h3>`);
+    const errors = flattenTree(tree).filter((n) => n.event.status === "error" || n.event.kind === "ERROR").sort((a, b) => a.event.timestamp - b.event.timestamp);
+    if (errors.length === 0) {
+      parts.push(
+        `<p class="muted">No error-status events found. Run status: <strong>${escapeHtml(String(tree.status ?? "unknown"))}</strong>.</p>`
+      );
+      parts.push(`</article>`);
+      continue;
+    }
+    const first = errors[0];
+    const chain = buildAncestorChain(tree, first);
+    parts.push(`<p>First error by timestamp:</p>`);
+    parts.push(`<ol class="causal-chain">`);
+    for (const node of chain) {
+      const isTip = node.event.eventId === first.event.eventId;
+      const msg = typeof node.event.attributes?.message === "string" ? node.event.attributes.message : typeof node.event.attributes?.error === "string" ? node.event.attributes.error : void 0;
+      parts.push(
+        `<li class="${isTip ? "causal-tip" : ""}"><span class="nm">${escapeHtml(node.event.name)}</span> <span class="meta">[${escapeHtml(node.event.kind)}] ${escapeHtml(node.event.status ?? "?")} \xB7 ${escapeHtml(node.event.eventId)}</span>${msg ? `<div class="causal-msg">${escapeHtml(msg.slice(0, 400))}</div>` : ""}</li>`
+      );
+    }
+    parts.push(`</ol>`);
+    if (errors.length > 1) {
+      parts.push(
+        `<p class="muted">${escapeHtml(String(errors.length - 1))} additional error event(s) not shown in the primary chain.</p>`
+      );
+    }
+    parts.push(`</article>`);
+  }
+  return parts.join("\n");
+}
+var EVIDENCE_VIEW_CSS = `
+ul.tree{list-style:none;padding-left:1rem;margin:.5rem 0}
+ul.tree.nested{padding-left:1.25rem;border-left:1px solid var(--line);margin:.25rem 0}
+.tree-node.is-error .nm,.wf-row.is-error .nm,.causal-tip .nm{color:var(--unsafe)}
+.waterfall{display:flex;flex-direction:column;gap:.45rem;max-width:52rem}
+.wf-row{display:grid;grid-template-columns:minmax(10rem,18rem) 1fr;gap:.6rem;align-items:center}
+.wf-track{position:relative;height:.7rem;background:#e8e8e4;border-radius:.25rem;overflow:hidden}
+.wf-bar{position:absolute;top:0;bottom:0;background:var(--accent);border-radius:.25rem}
+.wf-row.is-error .wf-bar{background:var(--unsafe)}
+.causal-chain{max-width:44rem}
+.causal-msg{margin:.25rem 0 0;color:var(--muted);font-size:.92rem}
+.run-block{margin:0 0 1.25rem;padding-bottom:1rem;border-bottom:1px solid var(--line)}
+.run-block:last-child{border-bottom:0}
+@media (max-width:720px){
+  .wf-row{grid-template-columns:1fr}
+}
+`.trim();
+
+// packages/core/src/evidence/html-shell.ts
+var EVIDENCE_HTML_FILENAME = "evidence.html";
+var EVIDENCE_HTML_NOTE = "Generated locally by AgentInspect. Share-checked evidence for review \u2014 not a compliance or security certification.";
+var EVIDENCE_VIEW_IDS = [
+  "summary",
+  "tree",
+  "timeline",
+  "causal",
+  "tools-llm",
+  "outcomes",
+  "contracts",
+  "circuit",
+  "diff",
+  "safety",
+  "provenance"
+];
+function statusClass(status) {
+  if (status === "SAFE") return "st-safe";
+  if (status === "SAFE WITH WARNINGS") return "st-warn";
+  if (status === "UNSAFE") return "st-unsafe";
+  return "st-unknown";
+}
+function viewLabel(id) {
+  switch (id) {
+    case "summary":
+      return "Summary";
+    case "tree":
+      return "Tree";
+    case "timeline":
+      return "Timeline";
+    case "causal":
+      return "Causal failure";
+    case "tools-llm":
+      return "Tools / LLM";
+    case "outcomes":
+      return "Outcomes";
+    case "contracts":
+      return "Contracts / checks";
+    case "circuit":
+      return "Circuit / guardrails";
+    case "diff":
+      return "Diff";
+    case "safety":
+      return "Safety / redaction";
+    case "provenance":
+      return "Provenance";
+    default: {
+      const _exhaustive = id;
+      return _exhaustive;
+    }
+  }
+}
+function encodeEmbeddedEvidenceJson(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
+}
+function buildEmbeddedPayload(input) {
+  return {
+    evidenceFormatVersion: input.evidenceFormatVersion ?? "1.0",
+    generator: {
+      name: input.generatorName,
+      version: input.generatorVersion
+    },
+    createdAt: input.createdAt,
+    runIds: [...input.runIds],
+    assessment: {
+      status: input.assessmentStatus,
+      ...input.sourceStatus !== void 0 ? { sourceStatus: input.sourceStatus } : {}
+    },
+    policy: {
+      redactionProfile: input.redactionProfile,
+      verificationPolicy: input.verificationPolicy
+    },
+    checkSummary: input.checkSummary
+  };
+}
+function buildEvidenceHtmlShell(input) {
+  if (input.runIds.length === 0) {
+    throw new Error("Evidence HTML shell requires at least one run id.");
+  }
+  const maxChars = input.maxEmbeddedJsonChars ?? 64 * 1024;
+  let embedded = encodeEmbeddedEvidenceJson(buildEmbeddedPayload(input));
+  if (embedded.length > maxChars) {
+    embedded = encodeEmbeddedEvidenceJson({
+      truncated: true,
+      evidenceFormatVersion: input.evidenceFormatVersion ?? "1.0",
+      runIds: [...input.runIds],
+      assessment: { status: input.assessmentStatus },
+      note: "Embedded payload truncated to bound; open evidence.json / trace files for full detail."
+    });
+  }
+  const title = escapeHtml(input.title ?? "AgentInspect evidence");
+  const runList = input.runIds.map((id) => `<li><code>${escapeHtml(id)}</code></li>`).join("");
+  const summaryBody = input.summaryText !== void 0 && input.summaryText.trim() !== "" ? `<pre class="summary-md">${escapeHtml(input.summaryText)}</pre>` : `<p class="muted">Open <code>summary.md</code> in this bundle for the full text summary.</p>`;
+  const checkRows = input.checkSummary?.runs.map(
+    (run) => `<tr><td><code>${escapeHtml(run.runId)}</code></td><td class="${statusClass(run.status)}">${escapeHtml(run.status)}</td><td>${run.errors}</td><td>${run.warnings}</td><td>${run.findings}</td></tr>`
+  ).join("") ?? "";
+  const nav = EVIDENCE_VIEW_IDS.map(
+    (id) => `<a class="nav-link" href="#view-${id}" data-view="${id}">${escapeHtml(viewLabel(id))}</a>`
+  ).join("\n");
+  const stubPanels = EVIDENCE_VIEW_IDS.filter((id) => id !== "summary").map((id) => {
+    const body = input.viewBodies?.[id];
+    if (body !== void 0 && body.trim() !== "") {
+      return `  <section id="view-${id}" class="panel" hidden>
+    <h2>${escapeHtml(viewLabel(id))}</h2>
+    ${body}
+  </section>`;
+    }
+    return `  <section id="view-${id}" class="panel" hidden>
+    <h2>${escapeHtml(viewLabel(id))}</h2>
+    <p class="muted">This view will be filled in a later AgentInspect 6.10 release. The shell is offline-ready.</p>
+  </section>`;
+  }).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"/>
+<meta name="referrer" content="no-referrer"/>
+<title>${title}</title>
+<style>
+:root{--bg:#f7f7f5;--fg:#1a1a1a;--muted:#5c5c5c;--line:#d8d8d4;--accent:#0b5fff;--safe:#0a7a3e;--warn:#9a6700;--unsafe:#b42318;--unknown:#5c5c5c}
+*{box-sizing:border-box}
+body{margin:0;font-family:ui-sans-serif,system-ui,-apple-system,Segoe UI,sans-serif;background:var(--bg);color:var(--fg);line-height:1.5}
+a{color:var(--accent)}
+header{padding:1.25rem 1.5rem;border-bottom:1px solid var(--line);background:#fff}
+header h1{margin:0 0 .35rem;font-size:1.35rem}
+.note{margin:0;color:var(--muted);font-size:.92rem;max-width:52rem}
+.layout{display:grid;grid-template-columns:14rem 1fr;min-height:70vh}
+nav{padding:1rem;border-right:1px solid var(--line);background:#fff}
+nav .nav-link{display:block;padding:.4rem .55rem;margin:0 0 .2rem;border-radius:.35rem;text-decoration:none;color:inherit}
+nav .nav-link:hover,nav .nav-link:focus{background:#eef3ff;outline:2px solid var(--accent);outline-offset:1px}
+main{padding:1.25rem 1.5rem}
+.panel[hidden]{display:none}
+.badge{display:inline-block;padding:.15rem .55rem;border-radius:.3rem;font-size:.85rem;font-weight:600}
+.st-safe{color:var(--safe)}.st-warn{color:var(--warn)}.st-unsafe{color:var(--unsafe)}.st-unknown{color:var(--unknown)}
+table{border-collapse:collapse;width:100%;max-width:48rem;background:#fff}
+th,td{border:1px solid var(--line);padding:.4rem .55rem;text-align:left;vertical-align:top}
+th{background:#f0f0ec}
+.summary-md,pre.data{white-space:pre-wrap;word-break:break-word;background:#fff;border:1px solid var(--line);padding:.75rem;max-width:52rem}
+.muted{color:var(--muted)}
+ul.runs{margin:.4rem 0 1rem;padding-left:1.2rem}
+@media print{
+  nav{display:none}
+  .layout{display:block}
+  .panel[hidden]{display:block!important;page-break-before:always}
+  header{border:0}
+}
+@media (max-width:720px){
+  .layout{grid-template-columns:1fr}
+  nav{border-right:0;border-bottom:1px solid var(--line);display:flex;flex-wrap:wrap;gap:.25rem}
+}
+${EVIDENCE_VIEW_CSS}
+</style>
+</head>
+<body>
+<header>
+  <h1>${title}</h1>
+  <p class="note">${escapeHtml(EVIDENCE_HTML_NOTE)}</p>
+</header>
+<div class="layout">
+<nav aria-label="Evidence views">
+${nav}
+</nav>
+<main id="main">
+  <section id="view-summary" class="panel" tabindex="-1">
+    <h2>Summary</h2>
+    <p>Artifact status: <span class="badge ${statusClass(input.assessmentStatus)}">${escapeHtml(input.assessmentStatus)}</span>
+    ${input.sourceStatus !== void 0 ? ` \xB7 Source status: <span class="badge ${statusClass(input.sourceStatus)}">${escapeHtml(input.sourceStatus)}</span>` : ""}</p>
+    <p>Profile: <code>${escapeHtml(input.redactionProfile)}</code> \xB7 Verification: <code>${escapeHtml(input.verificationPolicy)}</code></p>
+    <p>Generator: <code>${escapeHtml(input.generatorName)}@${escapeHtml(input.generatorVersion)}</code>
+    ${input.createdAt ? ` \xB7 Created: <code>${escapeHtml(input.createdAt)}</code>` : ""}</p>
+    <h3>Runs</h3>
+    <ul class="runs">${runList}</ul>
+    ${checkRows ? `<h3>Check summary</h3>
+    <table>
+      <thead><tr><th>runId</th><th>artifact</th><th>errors</th><th>warnings</th><th>findings</th></tr></thead>
+      <tbody>${checkRows}</tbody>
+    </table>` : ""}
+    <h3>Text summary</h3>
+    ${summaryBody}
+  </section>
+${stubPanels}
+</main>
+</div>
+<script type="application/json" id="ai-evidence-data">${embedded}</script>
+<script>
+(function(){
+  var links=document.querySelectorAll("nav .nav-link");
+  var panels=document.querySelectorAll("main .panel");
+  function show(id){
+    for(var i=0;i<panels.length;i++){
+      var p=panels[i];
+      var on=p.id==="view-"+id;
+      if(on){p.removeAttribute("hidden");}else{p.setAttribute("hidden","");}
+    }
+    for(var j=0;j<links.length;j++){
+      var a=links[j];
+      if(a.getAttribute("data-view")===id){a.setAttribute("aria-current","page");}
+      else{a.removeAttribute("aria-current");}
+    }
+  }
+  for(var k=0;k<links.length;k++){
+    links[k].addEventListener("click",function(ev){
+      var id=ev.currentTarget.getAttribute("data-view");
+      if(!id)return;
+      ev.preventDefault();
+      if(history.replaceState){history.replaceState(null,"","#view-"+id);}
+      show(id);
+      var panel=document.getElementById("view-"+id);
+      if(panel)panel.focus();
+    });
+  }
+  var hash=(location.hash||"").replace(/^#view-/,"");
+  var initial="summary";
+  for(var n=0;n<links.length;n++){
+    if(links[n].getAttribute("data-view")===hash){initial=hash;break;}
+  }
+  show(initial);
+})();
+</script>
+</body>
+</html>
+`;
+}
+
+// packages/core/src/diff/renderer.ts
+function formatPath(path14) {
+  if (path14 === void 0 || path14.path.length === 0) {
+    return "(run)";
+  }
+  return path14.path.map((s) => s.name).join(" > ");
+}
+function formatValue(v, verbose) {
+  if (v === void 0) return "(undefined)";
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean") return String(v);
+  const s = JSON.stringify(v);
+  if (verbose || s.length <= 120) return s;
+  return `${s.slice(0, 117)}...`;
+}
+function renderRunDiff(result, options) {
+  const json = options?.json === true;
+  const verbose = options?.verbose === true;
+  const color = options?.color === true;
+  if (json) {
+    return JSON.stringify(result, null, 2);
+  }
+  const sev = (s, level) => {
+    if (!color) return s;
+    if (level === "error") return source_default.red(s);
+    if (level === "warning") return source_default.yellow(s);
+    return source_default.gray(s);
+  };
+  const lines = [];
+  const { summary } = result;
+  lines.push("Run diff");
+  lines.push(`Left:  ${summary.leftRunId}`);
+  lines.push(`Right: ${summary.rightRunId}`);
+  lines.push("");
+  lines.push("Summary:");
+  lines.push(`  Differences: ${summary.totalDifferences}`);
+  lines.push(`  Errors: ${summary.errors}`);
+  lines.push(`  Warnings: ${summary.warnings}`);
+  lines.push(`  Info: ${summary.info}`);
+  lines.push("");
+  const fd = summary.firstDivergence;
+  const firstKind = result.differences[0]?.kind;
+  if (fd !== void 0) {
+    lines.push("First divergence:");
+    const where = formatPath(fd.path);
+    const displayKind = firstKind ?? fd.kind;
+    lines.push(`  ${displayKind} at ${where}`);
+    if (fd.left !== void 0 || fd.right !== void 0) {
+      lines.push(`    left: ${formatValue(fd.left, verbose)}`);
+      lines.push(`    right: ${formatValue(fd.right, verbose)}`);
+    }
+    lines.push("");
+  }
+  lines.push("Differences:");
+  if (result.differences.length === 0) {
+    lines.push("  (none)");
+    return lines.join("\n");
+  }
+  const showSides = (kind) => verbose || [
+    "run-status",
+    "step-status",
+    "error",
+    "duration",
+    "step-type",
+    "structure",
+    "step-added",
+    "step-removed"
+  ].includes(kind);
+  for (const d of result.differences) {
+    const tag = sev(`[${d.severity}]`, d.severity);
+    const pathStr = d.path !== void 0 ? ` ${formatPath(d.path)}` : "";
+    lines.push(`  ${tag} ${d.kind}${pathStr}`);
+    lines.push(`    ${d.message}`);
+    if (d.left !== void 0 || d.right !== void 0) {
+      if (showSides(d.kind)) {
+        lines.push(`    left: ${formatValue(d.left, verbose)}`);
+        lines.push(`    right: ${formatValue(d.right, verbose)}`);
+      }
+    }
+  }
+  return lines.join("\n");
+}
+
+// packages/core/src/diff/comparable.ts
+function extractOutputPreview(meta) {
+  if (meta === void 0) return void 0;
+  if ("outputPreview" in meta) return meta.outputPreview;
+  if ("resultPreview" in meta) return meta.resultPreview;
+  return void 0;
+}
+function mapStepStatus(s) {
+  if (s === void 0) return "running";
+  return s;
+}
+function manualTraceEventsToComparableRun(events) {
+  const started = events.find((e) => e.event === "run_started");
+  if (!started || started.event !== "run_started") {
+    throw new Error("Invalid trace: missing run_started");
+  }
+  const rs = started;
+  const runId = rs.runId;
+  const completedAll = events.filter((e) => e.event === "run_completed");
+  const lastCompleted = completedAll[completedAll.length - 1];
+  let runStatus;
+  if (lastCompleted === void 0) runStatus = "running";
+  else runStatus = lastCompleted.status;
+  const durationMs = lastCompleted !== void 0 && Number.isFinite(lastCompleted.durationMs) ? lastCompleted.durationMs : void 0;
+  const steps = /* @__PURE__ */ new Map();
+  let order = 0;
+  for (const e of events) {
+    if (e.event !== "step_started") continue;
+    const s = e;
+    const meta = s.metadata ? { ...s.metadata } : void 0;
+    steps.set(s.stepId, {
+      id: s.stepId,
+      parentId: s.parentId,
+      name: s.name,
+      type: s.type,
+      order: order++,
+      timestamp: s.timestamp,
+      metadata: meta
+    });
+  }
+  for (const e of events) {
+    if (e.event !== "step_completed") continue;
+    const acc = steps.get(e.stepId);
+    if (!acc) continue;
+    acc.status = e.status;
+    acc.durationMs = e.durationMs;
+    if (e.error?.message) acc.errorMsg = e.error.message;
+    const extra = e;
+    if (extra.metadata !== void 0 && typeof extra.metadata === "object") {
+      acc.metadata = { ...acc.metadata ?? {}, ...extra.metadata };
+    }
+  }
+  const nodes = /* @__PURE__ */ new Map();
+  for (const acc of steps.values()) {
+    let meta = acc.metadata ? { ...acc.metadata } : void 0;
+    if (acc.parentId !== void 0 && !steps.has(acc.parentId)) {
+      meta = { ...meta ?? {}, agent_inspect_diff_parent_missing: true };
+    }
+    const outputPreview = extractOutputPreview(meta);
+    if (meta !== void 0 && ("outputPreview" in meta || "resultPreview" in meta)) {
+      delete meta.outputPreview;
+      delete meta.resultPreview;
+    }
+    const sc = {
+      id: acc.id,
+      name: acc.name,
+      type: acc.type,
+      status: mapStepStatus(acc.status),
+      durationMs: acc.durationMs,
+      error: acc.errorMsg,
+      metadata: meta && Object.keys(meta).length > 0 ? meta : void 0,
+      outputPreview,
+      children: []
+    };
+    nodes.set(acc.id, sc);
+  }
+  const roots = [];
+  const sortByOrder = (a, b) => {
+    const oa = steps.get(a.id)?.order ?? 0;
+    const ob = steps.get(b.id)?.order ?? 0;
+    return oa - ob;
+  };
+  for (const acc of steps.values()) {
+    const node = nodes.get(acc.id);
+    if (acc.parentId !== void 0 && nodes.has(acc.parentId)) {
+      nodes.get(acc.parentId).children.push(node);
+    } else {
+      roots.push(node);
+    }
+  }
+  roots.sort(sortByOrder);
+  for (const n of nodes.values()) {
+    n.children.sort(sortByOrder);
+  }
+  return {
+    runId,
+    name: rs.name,
+    status: runStatus,
+    durationMs,
+    steps: roots
+  };
+}
+
+// packages/core/src/diff/engine.ts
+var DEFAULT_THRESHOLD_MS = 0;
+function pathSeg(step, index) {
+  return { index, name: step.name, stepId: step.id };
+}
+function buildPath(segments) {
+  return { path: [...segments] };
+}
+function pairSteps(left, right) {
+  const usedRight = /* @__PURE__ */ new Set();
+  const pairs = [];
+  for (let i = 0; i < left.length; i++) {
+    const L = left[i];
+    let R = right.find((r) => !usedRight.has(r.id) && r.id === L.id);
+    if (R === void 0 && i < right.length && !usedRight.has(right[i].id)) {
+      const cand = right[i];
+      if (cand.name === L.name && (cand.type ?? "") === (L.type ?? "")) {
+        R = cand;
+      }
+    }
+    if (R === void 0) {
+      R = right.find(
+        (r) => !usedRight.has(r.id) && r.name === L.name && (r.type ?? "") === (L.type ?? "")
+      );
+    }
+    if (R !== void 0) {
+      usedRight.add(R.id);
+      pairs.push([L, R]);
+    } else {
+      pairs.push([L, void 0]);
+    }
+  }
+  for (const R of right) {
+    if (!usedRight.has(R.id)) {
+      pairs.push([void 0, R]);
+    }
+  }
+  return pairs;
+}
+function compareLeafSteps(L, R, segments, opts, out) {
+  const path14 = buildPath(segments);
+  if (L.name !== R.name) {
+    out.push({
+      kind: "structure",
+      severity: "warning",
+      message: "Step name differs",
+      path: path14,
+      left: L.name,
+      right: R.name
+    });
+  }
+  if ((L.type ?? "") !== (R.type ?? "")) {
+    out.push({
+      kind: "step-type",
+      severity: "warning",
+      message: "Step type differs",
+      path: path14,
+      left: L.type,
+      right: R.type
+    });
+  }
+  if ((L.status ?? "") !== (R.status ?? "")) {
+    out.push({
+      kind: "step-status",
+      severity: "warning",
+      message: "Step status differs",
+      path: path14,
+      left: L.status,
+      right: R.status
+    });
+  }
+  const le = L.error ?? "";
+  const re = R.error ?? "";
+  if (le !== re) {
+    out.push({
+      kind: "error",
+      severity: "error",
+      message: "Step error message differs",
+      path: path14,
+      left: le || void 0,
+      right: re || void 0
+    });
+  }
+  if (!opts.ignoreDuration) {
+    const ld = L.durationMs;
+    const rd = R.durationMs;
+    const th = opts.durationThresholdMs;
+    let differs = false;
+    if (ld === void 0 && rd === void 0) differs = false;
+    else if (ld === void 0 || rd === void 0) differs = true;
+    else differs = Math.abs(ld - rd) > th;
+    if (differs) {
+      out.push({
+        kind: "duration",
+        severity: "info",
+        message: "Step duration differs",
+        path: path14,
+        left: ld,
+        right: rd
+      });
+    }
+  }
+  const lm = stableJson(L.metadata ?? {});
+  const rm = stableJson(R.metadata ?? {});
+  if (lm !== rm) {
+    out.push({
+      kind: "metadata",
+      severity: "info",
+      message: "Step metadata differs",
+      path: path14,
+      left: L.metadata,
+      right: R.metadata
+    });
+  }
+  const lo = stableJson(L.outputPreview ?? null);
+  const ro = stableJson(R.outputPreview ?? null);
+  if (lo !== ro) {
+    out.push({
+      kind: "output",
+      severity: "info",
+      message: "Output preview differs",
+      path: path14,
+      left: L.outputPreview,
+      right: R.outputPreview
+    });
+  }
+}
+function compareRecursive(L, R, segments, opts, out) {
+  compareLeafSteps(L, R, segments, opts, out);
+  const pairs = pairSteps(L.children, R.children);
+  let ci = 0;
+  for (const [lch, rch] of pairs) {
+    if (lch !== void 0 && rch !== void 0) {
+      compareRecursive(lch, rch, [...segments, pathSeg(lch, ci)], opts, out);
+    } else if (lch !== void 0) {
+      out.push({
+        kind: "step-removed",
+        severity: "warning",
+        message: `Step only in left run: ${lch.name}`,
+        path: buildPath([...segments, pathSeg(lch, ci)]),
+        left: lch.id,
+        right: void 0
+      });
+    } else if (rch !== void 0) {
+      out.push({
+        kind: "step-added",
+        severity: "warning",
+        message: `Step only in right run: ${rch.name}`,
+        path: buildPath([...segments, pathSeg(rch, ci)]),
+        left: void 0,
+        right: rch.id
+      });
+    }
+    ci += 1;
+  }
+}
+function mergeDiffDefaults(options) {
+  return {
+    ignoreDuration: options?.ignoreDuration ?? false,
+    durationThresholdMs: options?.durationThresholdMs !== void 0 ? options.durationThresholdMs : DEFAULT_THRESHOLD_MS,
+    focus: options?.focus ?? "all",
+    check: options?.check ?? "all"
+  };
+}
+function kindMatchesFilter(kind, merged) {
+  const { focus, check } = merged;
+  if (check !== "all") {
+    if (check === "structure") {
+      if (!["step-added", "step-removed", "structure", "step-type"].includes(kind)) return false;
+    } else if (check === "outputs") {
+      if (!["metadata", "output"].includes(kind)) return false;
+    } else if (check === "errors") {
+      if (!["run-status", "step-status", "error"].includes(kind)) return false;
+    } else if (check === "timing") {
+      if (kind !== "duration") return false;
+    }
+  }
+  if (focus !== "all") {
+    if (focus === "errors") {
+      if (!["run-status", "step-status", "error"].includes(kind)) return false;
+    } else if (focus === "structure") {
+      if (!["step-added", "step-removed", "structure", "step-type"].includes(kind)) return false;
+    } else if (focus === "outputs") {
+      if (!["metadata", "output"].includes(kind)) return false;
+    }
+  }
+  return true;
+}
+function diffRuns(left, right, options) {
+  const merged = mergeDiffDefaults(options);
+  const opts = {
+    ignoreDuration: merged.ignoreDuration,
+    durationThresholdMs: merged.durationThresholdMs
+  };
+  const raw = [];
+  if ((left.status ?? "") !== (right.status ?? "")) {
+    raw.push({
+      kind: "run-status",
+      severity: "warning",
+      message: "Run completion status differs",
+      left: left.status,
+      right: right.status
+    });
+  }
+  if (!merged.ignoreDuration) {
+    const ld = left.durationMs;
+    const rd = right.durationMs;
+    const th = merged.durationThresholdMs;
+    let differs = false;
+    if (ld === void 0 && rd === void 0) differs = false;
+    else if (ld === void 0 || rd === void 0) differs = true;
+    else differs = Math.abs(ld - rd) > th;
+    if (differs) {
+      raw.push({
+        kind: "duration",
+        severity: "info",
+        message: "Run duration differs",
+        left: ld,
+        right: rd
+      });
+    }
+  }
+  const pairs = pairSteps(left.steps, right.steps);
+  let idx = 0;
+  for (const [ls, rs] of pairs) {
+    if (ls !== void 0 && rs !== void 0) {
+      compareRecursive(ls, rs, [pathSeg(ls, idx)], opts, raw);
+      idx += 1;
+    } else if (ls !== void 0) {
+      raw.push({
+        kind: "step-removed",
+        severity: "warning",
+        message: `Step only in left run: ${ls.name}`,
+        path: buildPath([pathSeg(ls, idx)]),
+        left: ls.id,
+        right: void 0
+      });
+      idx += 1;
+    } else if (rs !== void 0) {
+      raw.push({
+        kind: "step-added",
+        severity: "warning",
+        message: `Step only in right run: ${rs.name}`,
+        path: buildPath([pathSeg(rs, idx)]),
+        left: void 0,
+        right: rs.id
+      });
+      idx += 1;
+    }
+  }
+  const differences = raw.filter((d) => kindMatchesFilter(d.kind, merged));
+  let errors = 0;
+  let warnings = 0;
+  let info = 0;
+  for (const d of differences) {
+    if (d.severity === "error") errors += 1;
+    else if (d.severity === "warning") warnings += 1;
+    else info += 1;
+  }
+  const firstVisible = differences[0];
+  const firstDivergence = firstVisible !== void 0 ? {
+    kind: "first-divergence",
+    severity: firstVisible.severity,
+    message: `First divergence: ${firstVisible.message}`,
+    path: firstVisible.path,
+    left: firstVisible.left,
+    right: firstVisible.right
+  } : void 0;
+  const summary = {
+    leftRunId: left.runId,
+    rightRunId: right.runId,
+    totalDifferences: differences.length,
+    errors,
+    warnings,
+    info,
+    firstDivergence
+  };
+  return { summary, differences };
+}
+
+// packages/core/src/diff/index.ts
+function diffTraceEvents(leftEvents, rightEvents, options) {
+  const left = manualTraceEventsToComparableRun(leftEvents);
+  const right = manualTraceEventsToComparableRun(rightEvents);
+  return diffRuns(left, right, options);
+}
+
+// packages/core/src/evidence/views-contract.ts
+function boundMessage(message, max = 200) {
+  const trimmed = message.trim();
+  if (trimmed.length <= max) return trimmed;
+  return `${trimmed.slice(0, max)}\u2026`;
+}
+function buildEvidenceContractsViewHtml(input) {
+  const rows = input.runs.map(
+    (run) => `<tr><td><code>${escapeHtml(run.runId)}</code></td><td>${escapeHtml(run.status)}</td><td>${escapeHtml(run.sourceStatus ?? "\u2014")}</td><td>${run.errors}</td><td>${run.warnings}</td><td>${run.findings}</td></tr>`
+  ).join("");
+  const findings = input.findingSummaries ?? [];
+  const findingRows = findings.length === 0 ? `<p class="muted">No structured check findings recorded for the redacted artifact.</p>` : `<table>
+  <thead><tr><th>runId</th><th>severity</th><th>rule</th><th>category</th><th>detector</th><th>message</th></tr></thead>
+  <tbody>${findings.map(
+    (f) => `<tr><td><code>${escapeHtml(f.runId)}</code></td><td>${escapeHtml(f.severity)}</td><td><code>${escapeHtml(f.ruleId)}</code></td><td>${escapeHtml(f.category ?? "\u2014")}</td><td>${escapeHtml(f.detector ?? "\u2014")}</td><td>${escapeHtml(boundMessage(f.message))}</td></tr>`
+  ).join("")}</tbody>
+</table>`;
+  return `<p>Aggregate artifact status: <strong>${escapeHtml(input.aggregateStatus)}</strong></p>
+<table>
+  <thead><tr><th>runId</th><th>artifact</th><th>source</th><th>errors</th><th>warnings</th><th>findings</th></tr></thead>
+  <tbody>${rows}</tbody>
+</table>
+<h3>Finding summaries</h3>
+${findingRows}
+<p class="muted">TraceContract / check details are best-effort local results \u2014 not a compliance certification.</p>`;
+}
+function buildEvidenceOutcomesViewHtml(runs) {
+  if (runs.length === 0) {
+    return `<p class="muted">No runs available for outcome extraction.</p>`;
+  }
+  const parts = [];
+  for (const run of runs) {
+    const forRun = run.events.filter((event) => event.runId === run.runId);
+    const summary = summarizeObservedOutcomes(extractOutcomesFromPersistedEvents(forRun));
+    parts.push(`<article class="run-block">`);
+    parts.push(`<h3><code>${escapeHtml(run.runId)}</code></h3>`);
+    parts.push(renderObservedOutcomesHtml(summary));
+    parts.push(`</article>`);
+  }
+  return parts.join("\n");
+}
+function buildEvidenceDiffViewHtml(parts) {
+  if (parts === void 0 || parts.leftEvents.length === 0 || parts.rightEvents.length === 0) {
+    return `<p class="muted">No baseline/candidate pair was supplied for this evidence bundle. Attach two runs (or a reporter baseline) to populate this view.</p>`;
+  }
+  try {
+    const left = persistedInspectEventsToTraceEvents(
+      parts.leftEvents.filter((e) => e.runId === parts.leftRunId)
+    );
+    const right = persistedInspectEventsToTraceEvents(
+      parts.rightEvents.filter((e) => e.runId === parts.rightRunId)
+    );
+    if (left.length === 0 || right.length === 0) {
+      return `<p class="muted">Could not normalize both runs for diff (missing v0.1-compatible events).</p>`;
+    }
+    const result = diffTraceEvents(left, right);
+    const text = renderRunDiff(result, { color: false, verbose: false });
+    return `<p>Comparing <code>${escapeHtml(parts.leftRunId)}</code> \u2192 <code>${escapeHtml(parts.rightRunId)}</code></p>
+<pre class="summary-md">${escapeHtml(text)}</pre>`;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return `<p class="muted">Diff unavailable: ${escapeHtml(message)}</p>`;
+  }
+}
+
+// packages/core/src/evidence/views-safety.ts
+function buildEvidenceSafetyViewHtml(input) {
+  const findingRows = (input.findingSummaries ?? []).length === 0 ? `<p class="muted">No safety findings on the redacted artifact.</p>` : `<table>
+  <thead><tr><th>runId</th><th>severity</th><th>category</th><th>detector</th><th>action</th><th>message</th></tr></thead>
+  <tbody>${(input.findingSummaries ?? []).map((f) => {
+    const msg = f.message.length > 160 ? `${f.message.slice(0, 160)}\u2026` : f.message;
+    return `<tr><td><code>${escapeHtml(f.runId)}</code></td><td>${escapeHtml(f.severity)}</td><td>${escapeHtml(f.category ?? "\u2014")}</td><td>${escapeHtml(f.detector ?? "\u2014")}</td><td>${escapeHtml(f.action ?? "\u2014")}</td><td>${escapeHtml(msg)}</td></tr>`;
+  }).join("")}</tbody>
+</table>`;
+  const redactionBlock = input.redaction === void 0 ? `<p class="muted">No redaction report attached.</p>` : `<p>Total redaction findings: <strong>${input.redaction.totalFindings}</strong></p>
+<ul>${input.redaction.runs.map(
+    (run) => `<li><code>${escapeHtml(run.runId)}</code>: ${run.findings} finding(s); detectors: ${escapeHtml(run.detectors.join(", ") || "none")}</li>`
+  ).join("")}</ul>`;
+  return `<p>Artifact status: <strong>${escapeHtml(String(input.artifactStatus))}</strong>
+  ${input.sourceStatus !== void 0 ? ` \xB7 Source status: <strong>${escapeHtml(String(input.sourceStatus))}</strong>` : ""}</p>
+<p>Redaction profile: <code>${escapeHtml(input.redactionProfile)}</code> \xB7 Verification: <code>${escapeHtml(input.verificationPolicy)}</code></p>
+<h3>Redaction</h3>
+${redactionBlock}
+<h3>Safety findings (artifact)</h3>
+${findingRows}
+<p class="muted">Best-effort local verification only \u2014 not a compliance certification. Gate sharing on artifact status.</p>`;
+}
+function buildEvidenceProvenanceViewHtml(input) {
+  const hashes = input.sourceHashes.length === 0 ? `<p class="muted">No source hashes recorded.</p>` : `<table>
+  <thead><tr><th>runId</th><th>algorithm</th><th>hash</th></tr></thead>
+  <tbody>${input.sourceHashes.map(
+    (h) => `<tr><td><code>${escapeHtml(h.runId)}</code></td><td>${escapeHtml(h.algorithm)}</td><td><code>${escapeHtml(h.hash)}</code></td></tr>`
+  ).join("")}</tbody>
+</table>`;
+  const files = input.packagedFiles.length === 0 ? `<p class="muted">No packaged files listed.</p>` : `<ul>${input.packagedFiles.map(
+    (f) => `<li><code>${escapeHtml(f.path)}</code>${f.role ? ` <span class="meta">(${escapeHtml(f.role)})</span>` : ""}</li>`
+  ).join("")}</ul>`;
+  return `<p>Generator: <code>${escapeHtml(input.generatorName)}@${escapeHtml(input.generatorVersion)}</code>
+  \xB7 Evidence format: <code>${escapeHtml(input.evidenceFormatVersion)}</code>
+  ${input.createdAt ? ` \xB7 Created: <code>${escapeHtml(input.createdAt)}</code>` : ""}</p>
+<p>Runs: ${input.runIds.map((id) => `<code>${escapeHtml(id)}</code>`).join(", ")}</p>
+<p>Trace schema versions: ${input.traceSchemaVersions.length > 0 ? input.traceSchemaVersions.map((v) => `<code>${escapeHtml(v)}</code>`).join(", ") : '<span class="muted">unknown</span>'}</p>
+<h3>Source hashes (pre-redaction input)</h3>
+${hashes}
+<h3>Packaged files</h3>
+${files}
+<p class="muted">${escapeHtml(input.note ?? "Reader/mapping losses are reported elsewhere when present; relationships are never invented without confidence policy.")}</p>`;
+}
+function buildEvidenceToolsLlmViewHtml(trees) {
+  if (trees.length === 0) {
+    return `<p class="muted">No runs available for tool/LLM metadata.</p>`;
+  }
+  const parts = [];
+  for (const tree of trees) {
+    const nodes = flattenTree(tree).filter(
+      (n) => n.event.kind === "TOOL" || n.event.kind === "LLM" || n.event.kind === "AGENT"
+    );
+    parts.push(`<article class="run-block">`);
+    parts.push(`<h3><code>${escapeHtml(tree.runId)}</code></h3>`);
+    if (nodes.length === 0) {
+      parts.push(`<p class="muted">No TOOL/LLM/AGENT events in this run.</p>`);
+    } else {
+      parts.push(`<table>
+  <thead><tr><th>name</th><th>kind</th><th>status</th><th>durationMs</th></tr></thead>
+  <tbody>${nodes.map((n) => {
+        const dur = n.event.durationMs !== void 0 && Number.isFinite(n.event.durationMs) ? String(n.event.durationMs) : "\u2014";
+        return `<tr><td>${escapeHtml(n.event.name)}</td><td>${escapeHtml(n.event.kind)}</td><td>${escapeHtml(n.event.status ?? "?")}</td><td>${escapeHtml(dur)}</td></tr>`;
+      }).join("")}</tbody>
+</table>`);
+    }
+    parts.push(`</article>`);
+  }
+  return parts.join("\n");
+}
+function buildEvidenceCircuitViewHtml(parts) {
+  const findings = parts?.findings ?? [];
+  if (findings.length === 0) {
+    return `<p class="muted">No circuit or guardrail findings were attached to this evidence bundle.</p>`;
+  }
+  return `<table>
+  <thead><tr><th>runId</th><th>name</th><th>status</th><th>detail</th></tr></thead>
+  <tbody>${findings.map(
+    (f) => `<tr><td><code>${escapeHtml(f.runId)}</code></td><td>${escapeHtml(f.name)}</td><td>${escapeHtml(f.status)}</td><td>${escapeHtml(f.detail ?? "\u2014")}</td></tr>`
+  ).join("")}</tbody>
+</table>`;
+}
+
+// packages/core/src/evidence/zip.ts
+var CRC_TABLE = (() => {
+  const table = new Uint32Array(256);
+  for (let n = 0; n < 256; n += 1) {
+    let c = n;
+    for (let k = 0; k < 8; k += 1) {
+      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+    }
+    table[n] = c >>> 0;
+  }
+  return table;
+})();
+function crc32(data) {
+  let crc = 4294967295;
+  for (let i = 0; i < data.length; i += 1) {
+    crc = CRC_TABLE[(crc ^ data[i]) & 255] ^ crc >>> 8;
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function toBytes(content) {
+  return typeof content === "string" ? Buffer.from(content, "utf8") : content;
+}
+function u16(value) {
+  const buf = Buffer.alloc(2);
+  buf.writeUInt16LE(value >>> 0, 0);
+  return buf;
+}
+function u32(value) {
+  const buf = Buffer.alloc(4);
+  buf.writeUInt32LE(value >>> 0, 0);
+  return buf;
+}
+function buildZipArchive(entries) {
+  if (entries.length === 0) {
+    throw new Error("ZIP archive requires at least one entry.");
+  }
+  const locals = [];
+  const centrals = [];
+  let offset = 0;
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const name = assertEvidenceRelativePath(entry.path);
+    if (seen.has(name)) {
+      throw new Error(`Duplicate ZIP entry path: ${name}`);
+    }
+    seen.add(name);
+    const nameBytes = Buffer.from(name, "utf8");
+    const data = toBytes(entry.content);
+    const checksum = crc32(data);
+    const size = data.byteLength;
+    const local = Buffer.concat([
+      u32(67324752),
+      u16(20),
+      // version needed
+      u16(0),
+      // flags
+      u16(0),
+      // method STORE
+      u16(0),
+      // time
+      u16(0),
+      // date
+      u32(checksum),
+      u32(size),
+      u32(size),
+      u16(nameBytes.length),
+      u16(0),
+      // extra length
+      nameBytes,
+      Buffer.from(data)
+    ]);
+    const central = Buffer.concat([
+      u32(33639248),
+      u16(20),
+      // version made by
+      u16(20),
+      // version needed
+      u16(0),
+      u16(0),
+      u16(0),
+      u16(0),
+      u32(checksum),
+      u32(size),
+      u32(size),
+      u16(nameBytes.length),
+      u16(0),
+      u16(0),
+      u16(0),
+      u16(0),
+      u32(0),
+      u32(offset),
+      nameBytes
+    ]);
+    locals.push(local);
+    centrals.push(central);
+    offset += local.length;
+  }
+  const centralDir = Buffer.concat(centrals);
+  const end = Buffer.concat([
+    u32(101010256),
+    u16(0),
+    u16(0),
+    u16(entries.length),
+    u16(entries.length),
+    u32(centralDir.length),
+    u32(offset),
+    u16(0)
+  ]);
+  return Buffer.concat([...locals, centralDir, end]);
+}
+async function listFilesRecursive(root) {
+  const out = [];
+  async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const abs = path5.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(abs);
+      } else if (entry.isFile()) {
+        const rel = path5.relative(root, abs).split(path5.sep).join("/");
+        out.push(rel);
+      }
+    }
+  }
+  await walk(root);
+  return out.sort((a, b) => a.localeCompare(b));
+}
+async function verifyEvidenceDirectory(rootPath, options = {}) {
+  const unexpectedMode = options.unexpectedFiles ?? "fail";
+  const root = path5.resolve(rootPath);
+  const issues = [];
+  let rootStat;
+  try {
+    rootStat = await stat(root);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      status: "fail",
+      root,
+      issues: [{ code: "io_error", severity: "error", message: `Cannot read path: ${message}` }],
+      checkedFiles: 0
+    };
+  }
+  if (!rootStat.isDirectory()) {
+    return {
+      ok: false,
+      status: "fail",
+      root,
+      issues: [
+        {
+          code: "io_error",
+          severity: "error",
+          message: "Evidence verify expects a directory containing evidence.json (unpack ZIP first)."
+        }
+      ],
+      checkedFiles: 0
+    };
+  }
+  const manifestPath = path5.join(root, EVIDENCE_MANIFEST_FILENAME);
+  let manifestText;
+  try {
+    manifestText = await readFile(manifestPath, "utf-8");
+  } catch {
+    return {
+      ok: false,
+      status: "fail",
+      root,
+      issues: [
+        {
+          code: "manifest_missing",
+          severity: "error",
+          message: `Missing ${EVIDENCE_MANIFEST_FILENAME}`,
+          path: EVIDENCE_MANIFEST_FILENAME
+        }
+      ],
+      checkedFiles: 0
+    };
+  }
+  let manifest;
+  try {
+    manifest = parseEvidenceManifestJson(manifestText);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      status: "fail",
+      root,
+      issues: [
+        {
+          code: "manifest_invalid",
+          severity: "error",
+          message,
+          path: EVIDENCE_MANIFEST_FILENAME
+        }
+      ],
+      checkedFiles: 0
+    };
+  }
+  if (!manifest.assessment?.status) {
+    issues.push({
+      code: "assessment_missing",
+      severity: "error",
+      message: "Manifest assessment.status is required."
+    });
+  }
+  if (!manifest.generator?.name || !manifest.generator?.version) {
+    issues.push({
+      code: "provenance_missing",
+      severity: "error",
+      message: "Manifest generator.name and generator.version are required."
+    });
+  }
+  if (!manifest.source?.runIds?.length) {
+    issues.push({
+      code: "provenance_missing",
+      severity: "error",
+      message: "Manifest source.runIds must be non-empty."
+    });
+  }
+  const listed = /* @__PURE__ */ new Set();
+  for (const file of manifest.files) {
+    let rel;
+    try {
+      rel = assertEvidenceRelativePath(file.path);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      issues.push({
+        code: "path_unsafe",
+        severity: "error",
+        message,
+        path: file.path
+      });
+      continue;
+    }
+    if (rel === EVIDENCE_MANIFEST_FILENAME) {
+      issues.push({
+        code: "manifest_invalid",
+        severity: "error",
+        message: `${EVIDENCE_MANIFEST_FILENAME} must not list itself in files[].`,
+        path: rel
+      });
+      continue;
+    }
+    listed.add(rel);
+    const abs = path5.join(root, ...rel.split("/"));
+    let bytes;
+    try {
+      bytes = await readFile(abs);
+    } catch {
+      issues.push({
+        code: "file_missing",
+        severity: "error",
+        message: `Listed file missing: ${rel}`,
+        path: rel
+      });
+      continue;
+    }
+    const actual = sha256Hex(bytes);
+    if (!sha256Equals(file.sha256, actual)) {
+      issues.push({
+        code: "hash_mismatch",
+        severity: "error",
+        message: `SHA-256 mismatch for ${rel}`,
+        path: rel
+      });
+    }
+  }
+  let onDisk = [];
+  try {
+    onDisk = await listFilesRecursive(root);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    issues.push({ code: "io_error", severity: "error", message });
+  }
+  for (const rel of onDisk) {
+    if (rel === EVIDENCE_MANIFEST_FILENAME) continue;
+    if (listed.has(rel)) continue;
+    if (unexpectedMode === "ignore") continue;
+    issues.push({
+      code: "file_unexpected",
+      severity: unexpectedMode === "warn" ? "warning" : "error",
+      message: `Unexpected file not listed in manifest: ${rel}`,
+      path: rel
+    });
+  }
+  const hasError = issues.some((issue) => issue.severity === "error");
+  return {
+    ok: !hasError,
+    status: hasError ? "fail" : "pass",
+    root,
+    manifest,
+    issues,
+    checkedFiles: listed.size
+  };
+}
+
+// packages/core/src/evidence/ci.ts
+function asMap(value) {
+  if (value instanceof Map) return new Map(value);
+  return new Map(Object.entries(value));
+}
+function buildEvidenceCiPackage(input) {
+  const sources = asMap(input.sourceContents);
+  const sourceHashes = input.runIds.map((runId) => ({
+    runId,
+    algorithm: "sha256",
+    hash: sha256Hex(sources.get(runId) ?? "")
+  }));
+  const schemaVersions = /* @__PURE__ */ new Set();
+  for (const content of sources.values()) {
+    for (const version of collectTraceSchemaVersions(content)) {
+      schemaVersions.add(version);
+    }
+  }
+  for (const version of collectTraceSchemaVersions(input.redactedTraceJsonl)) {
+    schemaVersions.add(version);
+  }
+  const createdAt = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const evidenceHtml = buildEvidenceHtmlShell({
+    title: "AgentInspect evidence",
+    runIds: input.runIds,
+    assessmentStatus: input.assessmentStatus,
+    sourceStatus: input.sourceStatus,
+    redactionProfile: input.redactionProfile,
+    verificationPolicy: input.redactionProfile,
+    generatorName: "agent-inspect",
+    generatorVersion: input.generatorVersion,
+    createdAt,
+    summaryText: input.summaryText,
+    checkSummary: {
+      aggregateStatus: input.assessmentStatus,
+      runs: input.runIds.map((runId) => ({
+        runId,
+        status: input.assessmentStatus,
+        sourceStatus: input.sourceStatus,
+        errors: input.assessmentStatus === "UNSAFE" || input.assessmentStatus === "UNKNOWN" ? 1 : 0,
+        warnings: input.assessmentStatus === "SAFE WITH WARNINGS" ? 1 : 0,
+        findings: 0
+      }))
+    }
+  });
+  const packaged = [
+    { path: EVIDENCE_HTML_FILENAME, content: evidenceHtml },
+    { path: "check-results.json", content: input.checkResultsJson },
+    { path: "trace.jsonl", content: input.redactedTraceJsonl }
+  ];
+  const manifest = buildEvidenceManifest({
+    generatorVersion: input.generatorVersion,
+    runIds: input.runIds,
+    traceSchemaVersions: [...schemaVersions].sort((a, b) => a.localeCompare(b)),
+    sourceHashes,
+    redactionProfile: input.redactionProfile,
+    verificationPolicy: input.redactionProfile,
+    assessmentStatus: input.assessmentStatus,
+    sourceStatus: input.sourceStatus,
+    files: packaged,
+    createdAt,
+    note: EVIDENCE_ASSESSMENT_NOTE
+  });
+  return {
+    "evidence.html": evidenceHtml,
+    "evidence.json": serializeEvidenceManifest(manifest),
+    "check-results.json": input.checkResultsJson,
+    "trace.jsonl": input.redactedTraceJsonl,
+    manifest
+  };
+}
+
 // packages/core/src/suite/types.ts
 var DEFAULT_SUITE_CONFIG_NAMES = [
   "agent-inspect.suite.json",
@@ -4180,8 +5896,35 @@ var DEFAULT_RAW_CONTENT_KEYS = [
   "toolinput",
   "tool_input",
   "tooloutput",
-  "tool_output"
+  "tool_output",
+  // Framework / agent metadata that carries user or task text
+  "currenttask",
+  "current_task",
+  "task",
+  "userinput",
+  "user_input",
+  "requesttext",
+  "request_text",
+  "conversationtext",
+  "conversation_text"
 ];
+var DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES = ["tokenUsage", "usage"];
+var SAFE_USAGE_LEAF_KEYS = /* @__PURE__ */ new Set([
+  "input",
+  "output",
+  "total",
+  "cached",
+  "input_tokens",
+  "inputtokens",
+  "output_tokens",
+  "outputtokens",
+  "total_tokens",
+  "totaltokens",
+  "prompt_tokens",
+  "prompttokens",
+  "completion_tokens",
+  "completiontokens"
+]);
 var DEFAULT_SECRET_PATTERNS = [
   { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
   { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
@@ -4359,7 +6102,11 @@ function normalizeFinding(rule, finding) {
     message: finding.message,
     ...finding.expected !== void 0 ? { expected: finding.expected } : {},
     ...finding.actual !== void 0 ? { actual: finding.actual } : {},
-    evidence: [...finding.evidence ?? []]
+    evidence: [...finding.evidence ?? []],
+    ...finding.category !== void 0 ? { category: finding.category } : {},
+    ...finding.confidence !== void 0 ? { confidence: finding.confidence } : {},
+    ...finding.detector !== void 0 ? { detector: finding.detector } : {},
+    ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
 function summarize(findings, diagnostics) {
@@ -4401,7 +6148,7 @@ function stripPrefix(name, prefixes) {
   }
   return name;
 }
-function eventEvidence(event, path12) {
+function eventEvidence(event, path14) {
   return {
     runId: event.runId,
     eventId: event.eventId,
@@ -4411,21 +6158,25 @@ function eventEvidence(event, path12) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...path12 ? { path: path12 } : {}
+    ...path14 ? { path: path14 } : {}
   };
 }
 function runEvidence(run) {
   return run ? [{ runId: run.runId, name: run.name, status: run.status }] : [];
 }
-function failFinding(ruleId, message, evidence, expected, actual) {
+function failFinding(ruleId, message, evidence, expected, actual, meta) {
   return {
     ruleId,
-    severity: "error",
-    status: "fail",
+    severity: meta?.severity ?? "error",
+    status: meta?.status ?? "fail",
     message,
     ...expected !== void 0 ? { expected } : {},
     ...actual !== void 0 ? { actual } : {},
-    evidence: [...evidence]
+    evidence: [...evidence],
+    ...meta?.category !== void 0 ? { category: meta.category } : {},
+    ...meta?.confidence !== void 0 ? { confidence: meta.confidence } : {},
+    ...meta?.detector !== void 0 ? { detector: meta.detector } : {},
+    ...meta?.action !== void 0 ? { action: meta.action } : {}
   };
 }
 function toolName(event) {
@@ -4474,9 +6225,9 @@ function eventEndMs(event) {
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function lastPathSegment(path12) {
-  const parts = path12.split(".");
-  return parts[parts.length - 1] ?? path12;
+function lastPathSegment(path14) {
+  const parts = path14.split(".");
+  return parts[parts.length - 1] ?? path14;
 }
 function valueType(value) {
   if (Array.isArray(value)) return "array";
@@ -4490,12 +6241,12 @@ function serializedByteLength(value) {
     return void 0;
   }
 }
-function pushValueEntries(entries, event, value, path12, key, depth = 0) {
-  entries.push({ event, path: path12, key, value });
+function pushValueEntries(entries, event, value, path14, key, depth = 0) {
+  entries.push({ event, path: path14, key, value });
   if (depth >= 8) return;
   if (Array.isArray(value)) {
     for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path12}.${index}`, String(index), depth + 1);
+      pushValueEntries(entries, event, item, `${path14}.${index}`, String(index), depth + 1);
     }
     return;
   }
@@ -4505,7 +6256,7 @@ function pushValueEntries(entries, event, value, path12, key, depth = 0) {
       entries,
       event,
       value[nestedKey],
-      `${path12}.${nestedKey}`,
+      `${path14}.${nestedKey}`,
       nestedKey,
       depth + 1
     );
@@ -4546,6 +6297,19 @@ function isRawContentKey(key, forbiddenKeys) {
   const normalized = normalizedKey(key);
   return forbiddenKeys.some((forbidden) => normalized === normalizedKey(forbidden));
 }
+function isSafeRawContentMetricPath(path14, key, safePathPrefixes) {
+  const leaf = normalizedKey(key ?? lastPathSegment(path14));
+  if (!SAFE_USAGE_LEAF_KEYS.has(leaf)) return false;
+  const parts = path14.split(".").filter(Boolean);
+  if (parts.length < 2) return false;
+  const parent = parts[parts.length - 2] ?? "";
+  const parentNorm = normalizedKey(parent);
+  return safePathPrefixes.some((prefix) => parentNorm === normalizedKey(prefix));
+}
+function isRawContentPath(path14, key, forbiddenKeys, safePathPrefixes) {
+  if (isSafeRawContentMetricPath(path14, key, safePathPrefixes)) return false;
+  return isRawContentKey(key ?? lastPathSegment(path14), forbiddenKeys);
+}
 function parentMarkedUnresolved(event) {
   if (booleanAttr(event, [
     "parentUnresolved",
@@ -4586,9 +6350,9 @@ function eventDurationMs(event) {
 }
 function treeShape(nodes) {
   const lines = [];
-  const visit = (node, path12) => {
-    lines.push(`${path12}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
-    node.children.forEach((child, index) => visit(child, `${path12}.${index}`));
+  const visit = (node, path14) => {
+    lines.push(`${path14}:${node.event.kind}:${node.event.name}:${node.event.status ?? "unknown"}`);
+    node.children.forEach((child, index) => visit(child, `${path14}.${index}`));
   };
   nodes.forEach((node, index) => visit(node, String(index)));
   return lines;
@@ -4637,9 +6401,9 @@ function retrievalShape(context) {
 function guardrailShape(context) {
   return guardrailEvents(context).map((event) => signalName(event, ["guardrailName", "guardrail", "guardrailId"], ["guardrail:"])).sort((a, b) => a.localeCompare(b));
 }
-function firstEvidenceForKind(context, kind, path12) {
+function firstEvidenceForKind(context, kind, path14) {
   const event = context.events.find((candidate) => candidate.kind === kind);
-  return event ? [eventEvidence(event, path12)] : runEvidence(context.selectedRun);
+  return event ? [eventEvidence(event, path14)] : runEvidence(context.selectedRun);
 }
 function baselineDiffFinding(message, evidence, expected, actual) {
   return failFinding("baseline.regression", message, evidence, expected, actual);
@@ -4989,13 +6753,13 @@ function createStructureCycleRule() {
       const seenCycles = /* @__PURE__ */ new Set();
       const findings = [];
       for (const event of [...context.events].sort((a, b) => a.eventId.localeCompare(b.eventId))) {
-        const path12 = [];
+        const path14 = [];
         const seenAt = /* @__PURE__ */ new Map();
         let current = event;
         while (current) {
           const existing = seenAt.get(current.eventId);
           if (existing !== void 0) {
-            const cycle = path12.slice(existing);
+            const cycle = path14.slice(existing);
             const key = cycle.map((item) => item.eventId).sort().join("\0");
             if (!seenCycles.has(key)) {
               seenCycles.add(key);
@@ -5011,8 +6775,8 @@ function createStructureCycleRule() {
             }
             break;
           }
-          seenAt.set(current.eventId, path12.length);
-          path12.push(current);
+          seenAt.set(current.eventId, path14.length);
+          path14.push(current);
           current = current.parentId ? byId.get(current.parentId) : void 0;
         }
       }
@@ -5185,7 +6949,13 @@ function createSafetyRedactionRule(options = {}) {
               `Sensitive-looking field at ${entry.path} is not redacted.`,
               [eventEvidence(event, entry.path)],
               "redaction marker",
-              { path: entry.path, valueType: valueType(entry.value) }
+              { path: entry.path, valueType: valueType(entry.value) },
+              {
+                category: "credential",
+                confidence: "high",
+                detector: "safety.redaction",
+                action: "redact"
+              }
             )
           );
         }
@@ -5196,6 +6966,7 @@ function createSafetyRedactionRule(options = {}) {
 }
 function createSafetyRawContentRule(options = {}) {
   const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
+  const safePathPrefixes = options.safePathPrefixes ?? DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES;
   return {
     id: "safety.rawPrompt",
     category: "safety",
@@ -5205,14 +6976,20 @@ function createSafetyRawContentRule(options = {}) {
       for (const event of context.events) {
         for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
           const key = entry.key ?? lastPathSegment(entry.path);
-          if (!isRawContentKey(key, forbiddenKeys)) continue;
+          if (!isRawContentPath(entry.path, key, forbiddenKeys, safePathPrefixes)) continue;
           findings.push(
             failFinding(
               "safety.rawPrompt",
               `Raw content-like field ${entry.path} is present.`,
               [eventEvidence(event, entry.path)],
               "metadata-only trace fields",
-              { path: entry.path, valueType: valueType(entry.value) }
+              { path: entry.path, valueType: valueType(entry.value) },
+              {
+                category: "raw-content",
+                confidence: "high",
+                detector: "safety.rawPrompt",
+                action: "redact-or-omit"
+              }
             )
           );
         }
@@ -5244,7 +7021,13 @@ function createSafetySecretPatternRule(options = {}) {
                 `Secret-like pattern ${pattern.id} matched at ${entry.path}.`,
                 [eventEvidence(event, entry.path)],
                 "no secret-like strings",
-                { pattern: pattern.id, path: entry.path }
+                { pattern: pattern.id, path: entry.path },
+                {
+                  category: "credential",
+                  confidence: "high",
+                  detector: pattern.id,
+                  action: "redact"
+                }
               )
             );
             break;
@@ -5271,7 +7054,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `String at ${entry.path} exceeds ${options.maxStringLength} characters.`,
                 [eventEvidence(event, entry.path)],
                 { maxStringLength: options.maxStringLength },
-                { path: entry.path, length: entry.value.length }
+                { path: entry.path, length: entry.value.length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -5282,7 +7071,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `Array at ${entry.path} exceeds ${options.maxArrayLength} items.`,
                 [eventEvidence(event, entry.path)],
                 { maxArrayLength: options.maxArrayLength },
-                { path: entry.path, length: entry.value.length }
+                { path: entry.path, length: entry.value.length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -5293,7 +7088,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `Object at ${entry.path} exceeds ${options.maxObjectKeys} keys.`,
                 [eventEvidence(event, entry.path)],
                 { maxObjectKeys: options.maxObjectKeys },
-                { path: entry.path, keys: Object.keys(entry.value).length }
+                { path: entry.path, keys: Object.keys(entry.value).length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -5306,7 +7107,13 @@ function createSafetyOversizedAttributeRule(options) {
                   `Value at ${entry.path} exceeds ${options.maxSerializedBytes} serialized bytes.`,
                   [eventEvidence(event, entry.path)],
                   { maxSerializedBytes: options.maxSerializedBytes },
-                  { path: entry.path, bytes }
+                  { path: entry.path, bytes },
+                  {
+                    category: "size",
+                    confidence: "high",
+                    detector: "safety.oversizedAttribute",
+                    action: "truncate-or-omit"
+                  }
                 )
               );
             }
@@ -5626,7 +7433,7 @@ function mapErrorInfo(error) {
 function mapTokenUsageFromMetadata(metadata) {
   return normalizeTokenUsage(metadata?.tokens);
 }
-function compactAttributes(entries) {
+function compactAttributes2(entries) {
   const out = {};
   for (const [key, value] of Object.entries(entries)) {
     if (value !== void 0) {
@@ -5644,7 +7451,7 @@ function traceEventToPersistedInspectEvent(event, options) {
     case "run_started": {
       const tsStart = toIsoTimestamp(event.startTime);
       const correlation = extractCorrelationMetadata(event.metadata);
-      const attributes = compactAttributes({
+      const attributes = compactAttributes2({
         legacyEvent: "run_started",
         metadata: event.metadata !== void 0 ? { ...event.metadata } : void 0,
         correlationId: correlation?.correlationId,
@@ -5670,7 +7477,7 @@ function traceEventToPersistedInspectEvent(event, options) {
     case "run_completed": {
       const tsEnd = toIsoTimestamp(event.endTime);
       const { persisted: error, errorStack } = mapErrorInfo(event.error);
-      const attributes = compactAttributes({
+      const attributes = compactAttributes2({
         legacyEvent: "run_completed",
         errorStack,
         invalidTimestamp: tsMain.invalidTimestamp || tsEnd.invalidTimestamp ? true : void 0
@@ -5694,7 +7501,7 @@ function traceEventToPersistedInspectEvent(event, options) {
     case "step_started": {
       const tsStart = toIsoTimestamp(event.startTime);
       const tokenUsage = mapTokenUsageFromMetadata(event.metadata);
-      const attributes = compactAttributes({
+      const attributes = compactAttributes2({
         legacyEvent: "step_started",
         stepId: event.stepId,
         stepType: event.type,
@@ -5725,7 +7532,7 @@ function traceEventToPersistedInspectEvent(event, options) {
     case "step_completed": {
       const tsEnd = toIsoTimestamp(event.endTime);
       const { persisted: error, errorStack } = mapErrorInfo(event.error);
-      const attributes = compactAttributes({
+      const attributes = compactAttributes2({
         legacyEvent: "step_completed",
         stepId: event.stepId,
         errorStack,
@@ -5749,7 +7556,7 @@ function traceEventToPersistedInspectEvent(event, options) {
     }
     case "outcome_observed": {
       const tsObserved = toIsoTimestamp(event.observedAt);
-      const attributes = compactAttributes({
+      const attributes = compactAttributes2({
         legacyEvent: "outcome_observed",
         outcomeId: event.outcomeId,
         outcomeStatus: event.status,
@@ -5884,7 +7691,7 @@ var TreeBuilder = class {
 };
 
 // packages/core/src/persisted/to-inspect-event.ts
-function compactAttributes2(entries) {
+function compactAttributes3(entries) {
   const out = {};
   for (const [key, value] of Object.entries(entries)) {
     if (value !== void 0) {
@@ -5993,7 +7800,7 @@ function persistedInspectEventToInspectEvent(event) {
     timestamp: ts.ms,
     confidence: event.confidence,
     source: mapPersistedSourceToInspect(event),
-    attributes: compactAttributes2(attrs)
+    attributes: compactAttributes3(attrs)
   };
   if (event.parentId !== void 0) {
     out.parentId = event.parentId;
@@ -8466,114 +10273,6 @@ async function analyzeCohort(runsInput, options) {
   };
 }
 
-// packages/core/src/exporters/helpers.ts
-var REDACT_SUBSTRINGS = [
-  "authorization",
-  "cookie",
-  "token",
-  "apikey",
-  "password",
-  "secret",
-  "email"
-];
-function shouldRedactKey(key) {
-  const k = key.toLowerCase();
-  for (const s of REDACT_SUBSTRINGS) {
-    if (k.includes(s)) return true;
-  }
-  return false;
-}
-function safeString(value, maxLength) {
-  if (value === null || value === void 0) return "";
-  let s;
-  if (typeof value === "string") s = value;
-  else if (typeof value === "number" || typeof value === "boolean") s = String(value);
-  else s = stableJson(value, false);
-  if (maxLength !== void 0 && maxLength >= 0 && s.length > maxLength) {
-    return `${s.slice(0, maxLength)}\u2026`;
-  }
-  return s;
-}
-function escapeMarkdown(value) {
-  return value.replace(/\|/g, "\\|").replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\n/g, " ");
-}
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function sortKeysDeep(input) {
-  if (input === null || typeof input !== "object") return input;
-  if (Array.isArray(input)) return input.map(sortKeysDeep);
-  const o = input;
-  const out = {};
-  for (const k of Object.keys(o).sort()) {
-    out[k] = sortKeysDeep(o[k]);
-  }
-  return out;
-}
-function stableJson(value, pretty) {
-  const sorted = sortKeysDeep(value);
-  return pretty === true ? JSON.stringify(sorted, null, 2) : JSON.stringify(sorted);
-}
-function compactAttributes3(attrs, options) {
-  if (attrs === void 0) return {};
-  const maxLen = options?.maxLength ?? 500;
-  const redacted = options?.redacted ?? true;
-  const out = {};
-  for (const key of Object.keys(attrs).sort()) {
-    if (redacted && shouldRedactKey(key)) {
-      out[key] = "[REDACTED]";
-      continue;
-    }
-    const v = attrs[key];
-    out[key] = compactValue(v, maxLen, redacted);
-  }
-  return out;
-}
-function compactValue(value, maxLen, redacted) {
-  if (value === null || typeof value !== "object") {
-    return typeof value === "string" ? safeString(value, maxLen) : value;
-  }
-  if (Array.isArray(value)) {
-    const arr = value.slice(0, 20).map((x) => compactValue(x, maxLen, redacted));
-    if (value.length > 20) arr.push(`\u2026(+${value.length - 20} more)`);
-    return arr;
-  }
-  const o = value;
-  const inner = {};
-  for (const k of Object.keys(o)) {
-    if (redacted && shouldRedactKey(k)) inner[k] = "[REDACTED]";
-    else inner[k] = compactValue(o[k], maxLen, redacted);
-  }
-  return inner;
-}
-function flattenTree(tree) {
-  const out = [];
-  function walk(nodes) {
-    for (const n of nodes) {
-      out.push(n);
-      if (n.children.length > 0) walk(n.children);
-    }
-  }
-  walk(tree.children);
-  return out;
-}
-function zeroKinds() {
-  return {
-    RUN: 0,
-    AGENT: 0,
-    LLM: 0,
-    TOOL: 0,
-    CHAIN: 0,
-    RETRIEVER: 0,
-    DECISION: 0,
-    RESULT: 0,
-    ERROR: 0,
-    LOGIC: 0,
-    LOG: 0,
-    OUTCOME: 0
-  };
-}
-
 // packages/core/src/cohort/render.ts
 function formatRate(value) {
   if (value === void 0) return "n/a";
@@ -9054,6 +10753,6 @@ function renderGateReport(result, options = {}) {
   return renderGateSummaryMarkdown(result);
 }
 
-export { COHORT_METRIC_IDS, DEFAULT_SUITE_ARTIFACTS_DIR, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, bundleFailsOnSafety, bundleRunAssetRelativePath, compactAttributes3 as compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, enrichSessionRunRecord, escapeHtml, escapeMarkdown, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, source_default, stableJson, summarizeObservedOutcomes, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, zeroKinds };
-//# sourceMappingURL=chunk-TO4VENHV.mjs.map
-//# sourceMappingURL=chunk-TO4VENHV.mjs.map
+export { COHORT_METRIC_IDS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, summarizeObservedOutcomes, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
+//# sourceMappingURL=chunk-36IJ76LH.mjs.map
+//# sourceMappingURL=chunk-36IJ76LH.mjs.map