@agent-inspect/mcp-server 6.17.2 → 6.17.4

package/README.md

@@ -42,6 +42,12 @@ npx @agent-inspect/mcp-server --dir .agent-inspect
 | `compare_runs` | Structural diff |
 | `create_share_checked_evidence` | Share-gated Evidence package |
 
+### First causal failure ambiguity
+
+Unlinked failures remain unrelated. `get_first_causal_failure` does not infer
+causal parents from event adjacency or timing alone, so ambiguous relationships
+remain explicit rather than being fabricated.
+
 Results are redacted (share profile by default), bounded, and deterministic for the same inputs.
 
 ## Privacy

package/dist/{chunk-RAYFTVFK.mjs → chunk-PPA3VJQG.mjs}

@@ -2622,8 +2622,11 @@ function formatProgrammaticDiagnostic(code, detail) {
 }
 
 // packages/core/src/safety/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
   [
@@ -2675,6 +2678,7 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
   const normalized = normalizeSensitiveKey(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey(sensitive);
     if (!s) continue;
@@ -2683,7 +2687,8 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }
@@ -6634,8 +6639,11 @@ function exportRunTree(tree, options) {
 }
 
 // packages/redact/src/sensitive-key.ts
+function keyHasExplicitSeparator2(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey2(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 var NON_CREDENTIAL_TOKEN_CONFIG_KEYS2 = new Set(
   [
@@ -6665,6 +6673,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
   const normalized = normalizeSensitiveKey2(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS2.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator2(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey2(sensitive);
     if (!s) continue;
@@ -6673,7 +6682,8 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }
@@ -7949,5 +7959,5 @@ async function runReadOnlyMcpServer(options = {}) {
 }
 
 export { MCP_MAX_REQUEST_BYTES, MCP_PROTOCOL_VERSION, READ_ONLY_TOOLS, callReadOnlyTool, createMcpServerContext, handleMcpProtocolLine, runReadOnlyMcpServer };
-//# sourceMappingURL=chunk-RAYFTVFK.mjs.map
-//# sourceMappingURL=chunk-RAYFTVFK.mjs.map
+//# sourceMappingURL=chunk-PPA3VJQG.mjs.map
+//# sourceMappingURL=chunk-PPA3VJQG.mjs.map