agent-inspect 6.8.0 → 6.9.0

package/packages/cli/dist/index.cjs

@@ -4105,8 +4105,9 @@ function buildBundleSummaryMarkdown(parts) {
     ""
   ];
   for (const run of checks2.runs) {
+    const source = run.sourceStatus !== void 0 && run.sourceStatus !== run.status ? `; source ${run.sourceStatus}` : "";
     lines.push(
-      `- \`${run.runId}\`: ${run.status} (${run.findings} finding(s), ${run.errors} error(s), ${run.warnings} warning(s))`
+      `- \`${run.runId}\`: artifact ${run.status}${source} (${run.findings} finding(s), ${run.errors} error(s), ${run.warnings} warning(s))`
     );
   }
   lines.push("", "## Redaction", "", `Total findings: ${redaction.totalFindings}`, "");
@@ -4691,7 +4692,11 @@ function normalizeFinding(rule, finding) {
     message: finding.message,
     ...finding.expected !== void 0 ? { expected: finding.expected } : {},
     ...finding.actual !== void 0 ? { actual: finding.actual } : {},
-    evidence: [...finding.evidence ?? []]
+    evidence: [...finding.evidence ?? []],
+    ...finding.category !== void 0 ? { category: finding.category } : {},
+    ...finding.confidence !== void 0 ? { confidence: finding.confidence } : {},
+    ...finding.detector !== void 0 ? { detector: finding.detector } : {},
+    ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
 function summarize(findings, diagnostics) {
@@ -4749,15 +4754,19 @@ function eventEvidence(event, path37) {
 function runEvidence(run) {
   return run ? [{ runId: run.runId, name: run.name, status: run.status }] : [];
 }
-function failFinding(ruleId, message, evidence, expected, actual) {
+function failFinding(ruleId, message, evidence, expected, actual, meta2) {
   return {
     ruleId,
-    severity: "error",
-    status: "fail",
+    severity: meta2?.severity ?? "error",
+    status: meta2?.status ?? "fail",
     message,
     ...expected !== void 0 ? { expected } : {},
     ...actual !== void 0 ? { actual } : {},
-    evidence: [...evidence]
+    evidence: [...evidence],
+    ...meta2?.category !== void 0 ? { category: meta2.category } : {},
+    ...meta2?.confidence !== void 0 ? { confidence: meta2.confidence } : {},
+    ...meta2?.detector !== void 0 ? { detector: meta2.detector } : {},
+    ...meta2?.action !== void 0 ? { action: meta2.action } : {}
   };
 }
 function toolName(event) {
@@ -4878,6 +4887,19 @@ function isRawContentKey(key, forbiddenKeys) {
   const normalized = normalizedKey(key);
   return forbiddenKeys.some((forbidden) => normalized === normalizedKey(forbidden));
 }
+function isSafeRawContentMetricPath(path37, key, safePathPrefixes) {
+  const leaf = normalizedKey(key ?? lastPathSegment(path37));
+  if (!SAFE_USAGE_LEAF_KEYS.has(leaf)) return false;
+  const parts = path37.split(".").filter(Boolean);
+  if (parts.length < 2) return false;
+  const parent = parts[parts.length - 2] ?? "";
+  const parentNorm = normalizedKey(parent);
+  return safePathPrefixes.some((prefix) => parentNorm === normalizedKey(prefix));
+}
+function isRawContentPath(path37, key, forbiddenKeys, safePathPrefixes) {
+  if (isSafeRawContentMetricPath(path37, key, safePathPrefixes)) return false;
+  return isRawContentKey(key ?? lastPathSegment(path37), forbiddenKeys);
+}
 function parentMarkedUnresolved(event) {
   if (booleanAttr(event, [
     "parentUnresolved",
@@ -5517,7 +5539,13 @@ function createSafetyRedactionRule(options = {}) {
               `Sensitive-looking field at ${entry.path} is not redacted.`,
               [eventEvidence(event, entry.path)],
               "redaction marker",
-              { path: entry.path, valueType: valueType(entry.value) }
+              { path: entry.path, valueType: valueType(entry.value) },
+              {
+                category: "credential",
+                confidence: "high",
+                detector: "safety.redaction",
+                action: "redact"
+              }
             )
           );
         }
@@ -5528,6 +5556,7 @@ function createSafetyRedactionRule(options = {}) {
 }
 function createSafetyRawContentRule(options = {}) {
   const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
+  const safePathPrefixes = options.safePathPrefixes ?? DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES;
   return {
     id: "safety.rawPrompt",
     category: "safety",
@@ -5537,14 +5566,20 @@ function createSafetyRawContentRule(options = {}) {
       for (const event of context.events) {
         for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
           const key = entry.key ?? lastPathSegment(entry.path);
-          if (!isRawContentKey(key, forbiddenKeys)) continue;
+          if (!isRawContentPath(entry.path, key, forbiddenKeys, safePathPrefixes)) continue;
           findings.push(
             failFinding(
               "safety.rawPrompt",
               `Raw content-like field ${entry.path} is present.`,
               [eventEvidence(event, entry.path)],
               "metadata-only trace fields",
-              { path: entry.path, valueType: valueType(entry.value) }
+              { path: entry.path, valueType: valueType(entry.value) },
+              {
+                category: "raw-content",
+                confidence: "high",
+                detector: "safety.rawPrompt",
+                action: "redact-or-omit"
+              }
             )
           );
         }
@@ -5576,7 +5611,13 @@ function createSafetySecretPatternRule(options = {}) {
                 `Secret-like pattern ${pattern.id} matched at ${entry.path}.`,
                 [eventEvidence(event, entry.path)],
                 "no secret-like strings",
-                { pattern: pattern.id, path: entry.path }
+                { pattern: pattern.id, path: entry.path },
+                {
+                  category: "credential",
+                  confidence: "high",
+                  detector: pattern.id,
+                  action: "redact"
+                }
               )
             );
             break;
@@ -5603,7 +5644,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `String at ${entry.path} exceeds ${options.maxStringLength} characters.`,
                 [eventEvidence(event, entry.path)],
                 { maxStringLength: options.maxStringLength },
-                { path: entry.path, length: entry.value.length }
+                { path: entry.path, length: entry.value.length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -5614,7 +5661,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `Array at ${entry.path} exceeds ${options.maxArrayLength} items.`,
                 [eventEvidence(event, entry.path)],
                 { maxArrayLength: options.maxArrayLength },
-                { path: entry.path, length: entry.value.length }
+                { path: entry.path, length: entry.value.length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -5625,7 +5678,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `Object at ${entry.path} exceeds ${options.maxObjectKeys} keys.`,
                 [eventEvidence(event, entry.path)],
                 { maxObjectKeys: options.maxObjectKeys },
-                { path: entry.path, keys: Object.keys(entry.value).length }
+                { path: entry.path, keys: Object.keys(entry.value).length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -5638,7 +5697,13 @@ function createSafetyOversizedAttributeRule(options) {
                   `Value at ${entry.path} exceeds ${options.maxSerializedBytes} serialized bytes.`,
                   [eventEvidence(event, entry.path)],
                   { maxSerializedBytes: options.maxSerializedBytes },
-                  { path: entry.path, bytes }
+                  { path: entry.path, bytes },
+                  {
+                    category: "size",
+                    confidence: "high",
+                    detector: "safety.oversizedAttribute",
+                    action: "truncate-or-omit"
+                  }
                 )
               );
             }
@@ -5855,7 +5920,7 @@ function runTraceChecks(input3, options = {}) {
     diagnostics
   };
 }
-var SEVERITY_RANK, STATUS_RANK, CONFIDENCE_RANK, DEFAULT_SENSITIVE_KEYS, DEFAULT_RAW_CONTENT_KEYS, DEFAULT_SECRET_PATTERNS;
+var SEVERITY_RANK, STATUS_RANK, CONFIDENCE_RANK, DEFAULT_SENSITIVE_KEYS, DEFAULT_RAW_CONTENT_KEYS, DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES, SAFE_USAGE_LEAF_KEYS, DEFAULT_SECRET_PATTERNS;
 var init_checks2 = __esm({
   "packages/core/src/checks/index.ts"() {
     init_outcomes();
@@ -5905,8 +5970,35 @@ var init_checks2 = __esm({
       "toolinput",
       "tool_input",
       "tooloutput",
-      "tool_output"
+      "tool_output",
+      // Framework / agent metadata that carries user or task text
+      "currenttask",
+      "current_task",
+      "task",
+      "userinput",
+      "user_input",
+      "requesttext",
+      "request_text",
+      "conversationtext",
+      "conversation_text"
     ];
+    DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES = ["tokenUsage", "usage"];
+    SAFE_USAGE_LEAF_KEYS = /* @__PURE__ */ new Set([
+      "input",
+      "output",
+      "total",
+      "cached",
+      "input_tokens",
+      "inputtokens",
+      "output_tokens",
+      "outputtokens",
+      "total_tokens",
+      "totaltokens",
+      "prompt_tokens",
+      "prompttokens",
+      "completion_tokens",
+      "completiontokens"
+    ]);
     DEFAULT_SECRET_PATTERNS = [
       { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
       { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
@@ -10069,7 +10161,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.8.0";
+var version = "6.9.0";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -14450,7 +14542,12 @@ var SHARE_PROFILE_EXTRA_KEYS2 = [
   "organizationId",
   "traceId",
   "spanId",
-  "parentSpanId"
+  "parentSpanId",
+  "currentTask",
+  "task",
+  "userInput",
+  "requestText",
+  "conversationText"
 ];
 var STRICT_PROFILE_EXTRA_KEYS2 = [
   "prompt",
@@ -14518,6 +14615,61 @@ function passesLuhn(value) {
   }
   return sum % 10 === 0;
 }
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var EPOCH_MS_RE = /^1[0-9]{12}$/;
+var EMAIL_RE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+function pathSuggestsNonCard(path37) {
+  const normalized = path37.toLowerCase().replace(/[^a-z0-9._]/g, "");
+  return /(^|\.)(tokenusage|usage)(\.|$)/.test(normalized) || /(startedat|endedat|durationms|timestamp|createdat|updatedat)(\.|$)/.test(normalized) || /(^|\.)(runid|traceid|spanid|eventid|sessionid|userid|parentid|requestid|correlationid)(\.|$)/.test(
+    normalized
+  ) || /(^|\.)ts(\.|$)/.test(normalized);
+}
+function isUuidLike(value) {
+  return UUID_RE.test(value.trim());
+}
+function isPlausibleCardCandidate(candidate, fullValue) {
+  const digits = digitsOnly(candidate);
+  if (digits.length < 13 || digits.length > 19) return false;
+  if (!passesLuhn(candidate)) return false;
+  const trimmed = fullValue.trim();
+  if (isUuidLike(trimmed)) return false;
+  if (EPOCH_MS_RE.test(digits) && digitsOnly(trimmed) === digits && /^\d+$/.test(trimmed)) {
+    return false;
+  }
+  const start = fullValue.indexOf(candidate);
+  if (start >= 0) {
+    const before = fullValue[start - 1];
+    const after = fullValue[start + candidate.length];
+    if (before && /[A-Za-z0-9_]/.test(before)) return false;
+    if (after && /[A-Za-z0-9_]/.test(after)) return false;
+  }
+  return true;
+}
+function looksLikePathOrPackageOrUrl(value) {
+  const trimmed = value.trim();
+  if (/^(?:[a-z][a-z0-9+.-]*:)?\/\//i.test(trimmed)) return true;
+  if (/^webpack:/i.test(trimmed)) return true;
+  if (/^@[A-Za-z0-9_.-]+\/[A-Za-z0-9_.@/-]+$/.test(trimmed)) return true;
+  if (/^[A-Za-z]:[\\/]/.test(trimmed) || /^[/\\]/.test(trimmed)) return true;
+  if (/[\\/]/.test(trimmed) && !/\s/.test(trimmed)) return true;
+  return false;
+}
+function emailMatchIsPathAdjacent(value, index, length) {
+  const before = value[index - 1];
+  const after = value[index + length];
+  return before === "/" || before === "\\" || after === "/" || after === "\\";
+}
+function valueContainsEmail(value) {
+  if (looksLikePathOrPackageOrUrl(value)) return false;
+  EMAIL_RE.lastIndex = 0;
+  for (const match of value.matchAll(EMAIL_RE)) {
+    const text = match[0] ?? "";
+    const index = match.index ?? 0;
+    if (emailMatchIsPathAdjacent(value, index, text.length)) continue;
+    return true;
+  }
+  return false;
+}
 var credentialDetectors = [
   patternDetector({
     id: "value.authorizationHeader",
@@ -14565,10 +14717,12 @@ var credentialDetectors = [
     matchKind: "value",
     detect(input3) {
       if (typeof input3.value !== "string") return [];
+      if (pathSuggestsNonCard(input3.path)) return [];
+      if (isUuidLike(input3.value)) return [];
       const candidatePattern = /(?:\d[ -]?){13,19}/g;
       for (const match of input3.value.matchAll(candidatePattern)) {
         const candidate = match[0] ?? "";
-        if (passesLuhn(candidate)) {
+        if (isPlausibleCardCandidate(candidate, input3.value)) {
           return [{ action: "replace", severity: "error", matchKind: "value" }];
         }
       }
@@ -14577,10 +14731,15 @@ var credentialDetectors = [
   }
 ];
 var identifierDetectors = [
-  patternDetector({
+  {
     id: "value.email",
-    pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i
-  }),
+    severity: "warning",
+    matchKind: "value",
+    detect(input3) {
+      if (typeof input3.value !== "string") return [];
+      return valueContainsEmail(input3.value) ? [{ action: "replace", severity: "warning", matchKind: "value" }] : [];
+    }
+  },
   patternDetector({
     id: "value.phone",
     pattern: /\b(?:\+\d{1,3}[\s.-]?)?(?:\(?\d{3}\)?[\s.-])\d{3}[\s.-]\d{4}\b/
@@ -14904,6 +15063,16 @@ function redactJsonlText(content, profile) {
   };
 }
 function redactDocument(content, profile) {
+  const trimmed = content.trim();
+  if (trimmed.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && ("schemaVersion" in parsed || "eventId" in parsed || "runId" in parsed)) {
+        return redactJsonlText(content, profile);
+      }
+    } catch {
+    }
+  }
   try {
     return redactJsonText(content, profile);
   } catch {
@@ -18399,8 +18568,6 @@ async function evalCommand(target, options = {}, stdin = process.stdin) {
   else if (options.markdown) console.log(renderEvalMarkdown(result).trimEnd());
   else printHuman2(result);
 }
-
-// packages/cli/src/safety.ts
 var BEST_EFFORT_NOTE = "Best-effort local safety verification only; not a compliance, privacy, security, or regulatory certification.";
 var DEFAULT_MAX_STRING_LENGTH = 16384;
 var DEFAULT_MAX_ARRAY_LENGTH = 1e3;
@@ -18458,7 +18625,7 @@ function resultFromParts(parts) {
   const diagnostics = [...parts.diagnostics ?? []];
   const warnings = [...parts.warnings ?? []];
   const unsupportedFields = [...parts.unsupportedFields ?? []];
-  const status = statusFrom(findings, diagnostics);
+  const status = parts.status ?? statusFrom(findings, diagnostics);
   return {
     ok: status === "SAFE" || status === "SAFE WITH WARNINGS",
     command: parts.command,
@@ -18474,7 +18641,17 @@ function resultFromParts(parts) {
     diagnostics,
     warnings,
     unsupportedFields,
-    note: BEST_EFFORT_NOTE
+    note: BEST_EFFORT_NOTE,
+    ...parts.sourceAssessment !== void 0 ? { sourceAssessment: parts.sourceAssessment } : {},
+    ...parts.artifactAssessment !== void 0 ? { artifactAssessment: parts.artifactAssessment } : {},
+    ...parts.redactionSummary !== void 0 ? { redactionSummary: parts.redactionSummary } : {}
+  };
+}
+function layerFromResult(result) {
+  return {
+    status: result.status,
+    summary: result.summary,
+    findings: result.findings
   };
 }
 function readErrorResult3(command, error) {
@@ -18538,6 +18715,21 @@ function flattenNodes2(nodes) {
 function detectorSeverity(finding) {
   return finding.severity;
 }
+function classifyRedactionDetector(detector) {
+  if (detector === "value.creditCard" || detector === "value.email" || detector === "value.phone") {
+    return { category: "personal-data", confidence: "high" };
+  }
+  if (detector === "value.ipv4" || detector === "value.ipv6") {
+    return { category: "identifier", confidence: "medium" };
+  }
+  if (detector.startsWith("value.") && (detector.includes("Token") || detector.includes("Key") || detector.includes("jwt") || detector.includes("authorization") || detector.includes("bearer") || detector.includes("cookie") || detector.includes("privateKey") || detector.includes("github") || detector.includes("aws") || detector.includes("provider"))) {
+    return { category: "credential", confidence: "high" };
+  }
+  if (detector.startsWith("key.")) {
+    return { category: "credential", confidence: "medium" };
+  }
+  return { category: "credential", confidence: "medium" };
+}
 function redactionDetectorFindings(read, runId) {
   const runs = runId === void 0 ? read.runs : read.runs.filter((run) => run.runId === runId);
   const out = [];
@@ -18548,6 +18740,7 @@ function redactionDetectorFindings(read, runId) {
       const result = redact(attrs, { profile: "share" });
       for (const finding of result.findings) {
         if (finding.action === "keep") continue;
+        const taxonomy = classifyRedactionDetector(finding.detector);
         out.push({
           ruleId: "safety.redactDetector",
           severity: detectorSeverity(finding),
@@ -18565,7 +18758,11 @@ function redactionDetectorFindings(read, runId) {
               ...node.event.status !== void 0 ? { status: node.event.status } : {},
               path: `attributes.${finding.path.replace(/^\$\.?/, "")}`
             }
-          ]
+          ],
+          category: taxonomy.category,
+          confidence: taxonomy.confidence,
+          detector: finding.detector,
+          action: finding.action
         });
       }
     }
@@ -18581,13 +18778,49 @@ function exitCodeFor3(result) {
   if (result.status === "UNSAFE") return 1;
   return 2;
 }
-function printJson3(result) {
-  console.log(JSON.stringify(stable4(result), null, 2));
+function explainFinding(finding, blocksBundle) {
+  const path37 = finding.evidence[0]?.path ?? "(unknown path)";
+  const category = finding.category ?? "structure";
+  const confidence = finding.confidence ?? "medium";
+  const detector = finding.detector ?? finding.ruleId;
+  const action = finding.action ?? "review";
+  const redactionHint = category === "credential" || category === "personal-data" || category === "raw-content" || action.includes("redact") ? "Usually removable by share/strict redaction before bundling." : "May require omitting the field, lowering limits, or an explicit local override.";
+  return [
+    `  Matched: detector=${detector}; path=${path37}; category=${category}`,
+    `  Why: ${finding.message}`,
+    `  Confidence: ${confidence}`,
+    `  Redaction: ${redactionHint}`,
+    `  Override: configure a custom redaction/detector rule locally (see docs/SAFETY-POLICY.md); do not weaken defaults globally.`,
+    `  Bundle gate: ${blocksBundle ? "blocks share-safe bundle unless --allow-unsafe" : "does not block by itself (warning/info)"}`
+  ];
+}
+function findingExplanation(finding) {
+  const blocks = finding.severity === "error" || finding.status === "fail";
+  return {
+    ruleId: finding.ruleId,
+    detector: finding.detector ?? finding.ruleId,
+    path: finding.evidence[0]?.path,
+    category: finding.category,
+    confidence: finding.confidence,
+    action: finding.action,
+    blocksBundle: blocks,
+    // Never include matched secret/PII values.
+    message: finding.message
+  };
 }
-function printHuman3(result) {
+function printHuman3(result, explain = false) {
   console.log(`Safety status: ${result.status}`);
   console.log(`Format: ${result.format}`);
   if (result.runId !== void 0) console.log(`Run: ${result.runId}`);
+  if (result.sourceAssessment !== void 0 && result.artifactAssessment !== void 0) {
+    console.log(`Source assessment: ${result.sourceAssessment.status}`);
+    console.log(`Artifact assessment: ${result.artifactAssessment.status}`);
+    if (result.redactionSummary !== void 0) {
+      console.log(
+        `Redaction: profile=${result.redactionSummary.profile}, findings=${result.redactionSummary.findings}`
+      );
+    }
+  }
   console.log(
     `Summary: ${result.summary.findings} finding(s), ${result.summary.warnings} warning(s), ${result.summary.errors} error(s)`
   );
@@ -18596,45 +18829,82 @@ function printHuman3(result) {
   }
   for (const finding of result.findings) {
     const path37 = finding.evidence[0]?.path;
-    console.log(`- ${finding.ruleId}: ${finding.message}${path37 ? ` (${path37})` : ""}`);
+    const taxonomy = finding.category !== void 0 || finding.confidence !== void 0 ? ` [${[finding.category, finding.confidence].filter(Boolean).join("/")}]` : "";
+    console.log(`- ${finding.ruleId}: ${finding.message}${path37 ? ` (${path37})` : ""}${taxonomy}`);
+    if (explain) {
+      const blocks = finding.severity === "error" || finding.status === "fail";
+      for (const line of explainFinding(finding, blocks)) {
+        console.log(line);
+      }
+    }
   }
   console.log(`Note: ${result.note}`);
 }
+function printJson3(result, explain = false) {
+  const payload = explain === true ? { ...result, explanations: result.findings.map(findingExplanation) } : result;
+  console.log(JSON.stringify(stable4(payload), null, 2));
+}
 async function safetyCommand(command, target, options, stdin) {
   let result;
   try {
-    const rules = buildSafetyRules(options);
     const input3 = await inputFromTarget(target, options, stdin);
     const read = await openTrace(input3, {
       ...options.format !== void 0 ? { format: options.format } : {}
     });
-    const checkResult = runTraceChecks(
-      { read },
-      {
-        rules,
-        ...options.run !== void 0 ? { runId: options.run } : {}
-      }
-    );
-    const detectorFindings = checkResult.diagnostics.length === 0 ? redactionDetectorFindings(read, checkResult.runId) : [];
-    result = resultFromParts({
-      command,
-      format: checkResult.format,
-      runId: checkResult.runId,
-      findings: [...checkResult.findings, ...detectorFindings],
-      diagnostics: [
-        ...checkResult.diagnostics.map(diagnosticFromCheck),
-        ...warningDiagnostics(read.warnings, read.unsupportedFields)
-      ],
-      warnings: read.warnings,
-      unsupportedFields: read.unsupportedFields
+    const source = assessOpenedTrace(read, {
+      ...options,
+      ...options.run !== void 0 ? { runId: options.run } : {}
     });
+    if (command === "scan") {
+      result = { ...source, command: "scan" };
+    } else {
+      const profile = options.redactionProfile ?? "share";
+      const rawContent = input3.type === "string" ? input3.content : input3.type === "file" ? await promises.readFile(input3.path, "utf-8") : void 0;
+      if (rawContent === void 0) {
+        result = {
+          ...source,
+          command: "verify-safe",
+          sourceAssessment: layerFromResult(source)
+        };
+      } else {
+        const redacted = redactTraceContent(rawContent, profile);
+        const artifactRead = await openTrace(
+          { type: "string", content: redacted.content },
+          { format: options.format ?? "agent-inspect-jsonl" }
+        );
+        const artifact = assessOpenedTrace(artifactRead, {
+          ...options,
+          ...options.run !== void 0 ? { runId: options.run } : {}
+        });
+        const detectors = [
+          ...new Set(redacted.findings.map((finding) => finding.detector))
+        ].sort((a, b) => a.localeCompare(b));
+        result = resultFromParts({
+          command: "verify-safe",
+          format: artifact.format,
+          runId: artifact.runId ?? source.runId,
+          findings: artifact.findings,
+          diagnostics: artifact.diagnostics,
+          warnings: artifact.warnings,
+          unsupportedFields: artifact.unsupportedFields,
+          status: artifact.status,
+          sourceAssessment: layerFromResult(source),
+          artifactAssessment: layerFromResult(artifact),
+          redactionSummary: {
+            profile,
+            findings: redacted.findings.length,
+            detectors
+          }
+        });
+      }
+    }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     result = message.startsWith("--") ? invalidArgumentResult(command, error) : readErrorResult3(command, error);
   }
   process.exitCode = exitCodeFor3(result);
-  if (options.json) printJson3(result);
-  else printHuman3(result);
+  if (options.json) printJson3(result, options.explain === true);
+  else printHuman3(result, options.explain === true);
 }
 function scanCommand(target, options = {}, stdin = process.stdin) {
   return safetyCommand("scan", target, options, stdin);
@@ -19116,15 +19386,8 @@ async function bundleCommand(runIdArg, options = {}) {
       process.exitCode = 1;
       return;
     }
-    const safety = assessOpenedTrace(read, { run: runId });
-    const status = safetyStatusFromAssess(safety.status);
-    checkRuns.push({
-      runId,
-      status,
-      errors: safety.summary.errors,
-      warnings: safety.summary.warnings,
-      findings: safety.summary.findings
-    });
+    const sourceSafety = assessOpenedTrace(read, { run: runId });
+    const sourceStatus = safetyStatusFromAssess(sourceSafety.status);
     const redacted = redactTraceContent(rawContent, toReportProfile(profile));
     redactedJsonlByRun.set(runId, redacted.content);
     combinedJsonl += redacted.content.endsWith("\n") ? redacted.content : `${redacted.content}
@@ -19137,6 +19400,34 @@ async function bundleCommand(runIdArg, options = {}) {
       findings: redacted.findings.length,
       detectors
     });
+    let artifactSafety = sourceSafety;
+    try {
+      const artifactRead = await openTrace(
+        { type: "string", content: redacted.content },
+        { format: "agent-inspect-jsonl" }
+      );
+      artifactSafety = assessOpenedTrace(artifactRead, { run: runId });
+    } catch {
+      artifactSafety = {
+        ...sourceSafety,
+        status: "UNKNOWN",
+        ok: false,
+        summary: {
+          findings: sourceSafety.summary.findings,
+          warnings: sourceSafety.summary.warnings,
+          errors: Math.max(1, sourceSafety.summary.errors)
+        }
+      };
+    }
+    const status = safetyStatusFromAssess(artifactSafety.status);
+    checkRuns.push({
+      runId,
+      status,
+      sourceStatus,
+      errors: artifactSafety.summary.errors,
+      warnings: artifactSafety.summary.warnings,
+      findings: artifactSafety.summary.findings
+    });
     const selected = read.runs.find((run) => run.runId === runId);
     const runReport = exportRunTree(selected ?? read.runs[0], {
       format: "html",
@@ -19165,13 +19456,13 @@ async function bundleCommand(runIdArg, options = {}) {
       console.log(
         writeJson4({
           ok: false,
-          error: `Bundle safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`,
+          error: `Bundle artifact safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`,
           checks: checks2
         }).trimEnd()
       );
     } else {
       console.error(
-        `[AgentInspect] bundle refused: safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`
+        `[AgentInspect] bundle refused: artifact safety status is ${checks2.aggregateStatus}. Pass --allow-unsafe to override.`
       );
     }
     process.exitCode = 1;
@@ -21516,7 +21807,7 @@ function createCliProgram() {
       "openinference-json",
       "otlp-json"
     ])
-  ).option("--run <run-id>", "select a run when the trace contains multiple runs").option("--json", "print deterministic JSON safety result").option("--max-string-length <number>", "unsafe threshold for string values").option("--max-array-length <number>", "unsafe threshold for array values").option("--max-object-keys <number>", "unsafe threshold for object key counts").option("--max-serialized-bytes <number>", "unsafe threshold for serialized values").action((target, opts) => {
+  ).option("--run <run-id>", "select a run when the trace contains multiple runs").option("--json", "print deterministic JSON safety result").option("--explain", "explain each finding (path, confidence, redaction, override, bundle gate)").option("--max-string-length <number>", "unsafe threshold for string values").option("--max-array-length <number>", "unsafe threshold for array values").option("--max-object-keys <number>", "unsafe threshold for object key counts").option("--max-serialized-bytes <number>", "unsafe threshold for serialized values").action((target, opts) => {
     runCommand(() => scanCommand(target, opts));
   });
   program.command("verify-safe").description("Best-effort local trace safety verification").argument("<trace-path-or-run-id>", "trace file, directory, stdin -, or run id").option("--dir <path>", "trace directory for run-id lookup").addOption(
@@ -21525,7 +21816,7 @@ function createCliProgram() {
       "openinference-json",
       "otlp-json"
     ])
-  ).option("--run <run-id>", "select a run when the trace contains multiple runs").option("--json", "print deterministic JSON safety result").option("--max-string-length <number>", "unsafe threshold for string values").option("--max-array-length <number>", "unsafe threshold for array values").option("--max-object-keys <number>", "unsafe threshold for object key counts").option("--max-serialized-bytes <number>", "unsafe threshold for serialized values").action((target, opts) => {
+  ).option("--run <run-id>", "select a run when the trace contains multiple runs").option("--json", "print deterministic JSON safety result").option("--explain", "explain each finding (path, confidence, redaction, override, bundle gate)").option("--max-string-length <number>", "unsafe threshold for string values").option("--max-array-length <number>", "unsafe threshold for array values").option("--max-object-keys <number>", "unsafe threshold for object key counts").option("--max-serialized-bytes <number>", "unsafe threshold for serialized values").action((target, opts) => {
     runCommand(() => verifySafeCommand(target, opts));
   });
   program.command("artifacts").description("Create safe local CI trace artifacts").argument("<trace-path-or-run-id>", "trace file, directory, stdin -, or run id").requiredOption("--output-dir <path>", "directory for generated artifacts").option("--dir <path>", "trace directory for run-id lookup").addOption(