@agent-inspect/eval 6.14.0 → 6.14.2

package/dist/index.cjs

@@ -221,6 +221,53 @@ function runCircuits(events, options = {}) {
   const ok = !results.some((result) => result.status === "open" && result.severity === "error");
   return { ok, results };
 }
+
+// packages/redact/src/sensitive-key.ts
+function normalizeSensitiveKey(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+}
+var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
+  [
+    "tokens",
+    "max_tokens",
+    "min_tokens",
+    "ls_max_tokens",
+    "token_count",
+    "token_limit",
+    "token_budget",
+    "input_tokens",
+    "output_tokens",
+    "total_tokens",
+    "cached_tokens",
+    "prompt_tokens",
+    "completion_tokens"
+  ].map(normalizeSensitiveKey)
+);
+function isTokenCredentialKey(normalized) {
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  if (normalized === "token") return true;
+  if (normalized.endsWith("tokens")) return false;
+  return normalized.endsWith("token");
+}
+function isCredentialSensitiveKey(key, sensitiveKeys) {
+  if (!key) return false;
+  const normalized = normalizeSensitiveKey(key);
+  if (!normalized) return false;
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  for (const sensitive of sensitiveKeys) {
+    const s = normalizeSensitiveKey(sensitive);
+    if (!s) continue;
+    if (s === "token") {
+      if (isTokenCredentialKey(normalized)) return true;
+      continue;
+    }
+    if (normalized === s) return true;
+    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+  }
+  return false;
+}
+
+// packages/redact/src/index.ts
 var DEFAULT_REDACT_KEYS = [
   "authorization",
   "cookie",
@@ -282,6 +329,12 @@ function isRecord(value) {
 function toKey(key) {
   return key.toLowerCase();
 }
+function findCompiledKeyRule(key, rules) {
+  const exact = toKey(key);
+  const direct = rules.find((candidate) => candidate.key === exact);
+  if (direct) return direct;
+  return rules.find((candidate) => isCredentialSensitiveKey(key, [candidate.key]));
+}
 function stableHash(value) {
   const hash = crypto__default.default.createHash("sha256").update(value, "utf8").digest("hex");
   return hash.slice(0, 8);
@@ -603,7 +656,7 @@ var Redactor = class {
       return "[Truncated]";
     }
     if (key !== void 0) {
-      const rule = this.#rules.find((candidate) => candidate.key === toKey(key));
+      const rule = findCompiledKeyRule(key, this.#rules);
       if (rule) {
         this.#recordFinding(
           state,