@aexhq/cli 0.22.0 → 0.23.0

package/dist/cli.mjs

@@ -162,6 +162,7 @@ var MODEL_PROVIDER_IDS = {
   "claude-haiku-4-5": { anthropic: "claude-haiku-4-5" },
   "claude-3-5-haiku-latest": { anthropic: "claude-3-5-haiku-latest" },
   "claude-3-5-sonnet-latest": { anthropic: "claude-3-5-sonnet-latest" },
+  "claude-sonnet-4-6": { anthropic: "claude-sonnet-4-6" },
   "deepseek-v4-flash": { deepseek: "deepseek-v4-flash" },
   "deepseek-v4-pro": { deepseek: "deepseek-v4-pro" },
   "deepseek-chat": { deepseek: "deepseek-chat" },
@@ -901,7 +902,16 @@ var forbiddenStringPatterns = Object.freeze([
   { reason: "vault_id", regex: /\b(?:vault|vlt|secret)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i },
   {
     reason: "private_resource_handle",
-    regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i
+    // `<keyword><sep><id>` opaque handles (`session_a1B2c3D4e5`, `file_9f8e7d…`).
+    // The keyword set overlaps ordinary English (agent/file/skill/resource/…), so
+    // the bare shape also matched documentation prose that simply chains those
+    // words with `_`/`-` (`agent_decision_failure`, `file_grounded`,
+    // `session_handoff_contract`, `agent-judgment` — read straight out of a
+    // skill-pack doc in tool-result text). The `accept` predicate keeps the shape
+    // but requires the id segment to look minted rather than spelled — i.e. carry
+    // a digit — so genuine handles stay flagged while dictionary-word prose does not.
+    regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i,
+    accept: isMintedResourceHandle
   },
   {
     reason: "high_entropy_token",
@@ -931,6 +941,11 @@ function isHighEntropySecretRun(run) {
   }
   return highEntropyShannonBits(run) >= 3;
 }
+function isMintedResourceHandle(match) {
+  const separatorIndex = match.search(/[_:-]/);
+  const id = match.slice(separatorIndex + 1);
+  return /\d/.test(id);
+}
 function highEntropyCharClassCount(value) {
   let count = 0;
   if (/[a-z]/.test(value))

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-bfd0fb573fa113fe08d69fc50f246c821bfc9e0acd9bddd6e92775d38120e201  cli.mjs
+37cb8db75fb0852134f1feae2b14bcea847d968f9fe13862c508f916366d1f85  cli.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/cli",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aexhq/aex.git"
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "fflate": "^0.8.2",
-    "@aexhq/contracts": "0.22.0"
+    "@aexhq/contracts": "0.23.0"
   },
   "devDependencies": {
     "esbuild": "^0.28.0"