@agent-inspect/mcp-server 6.17.3 → 6.17.5

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { runReadOnlyMcpServer } from './chunk-RAYFTVFK.mjs';
+import { runReadOnlyMcpServer } from './chunk-GMXH2CU3.mjs';
 import { readFileSync } from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';

package/dist/index.cjs

@@ -2632,8 +2632,11 @@ function formatProgrammaticDiagnostic(code, detail) {
 }
 
 // packages/core/src/safety/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
   [
@@ -2685,6 +2688,7 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
   const normalized = normalizeSensitiveKey(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey(sensitive);
     if (!s) continue;
@@ -2693,7 +2697,8 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }
@@ -3178,10 +3183,11 @@ function emptySummary() {
     passed: 0,
     failed: 0,
     warnings: 0,
-    errors: 0
+    errors: 0,
+    rulesEvaluated: 0
   };
 }
-function errorResult(input, diagnostics, selectedRun) {
+function errorResult(input, diagnostics, selectedRun, ruleExecutions = []) {
   return {
     ok: false,
     status: "error",
@@ -3189,10 +3195,12 @@ function errorResult(input, diagnostics, selectedRun) {
     ...selectedRun ? { runId: selectedRun.runId } : {},
     summary: {
       ...emptySummary(),
-      errors: diagnostics.filter((item) => item.severity === "error").length
+      errors: diagnostics.filter((item) => item.severity === "error").length,
+      rulesEvaluated: ruleExecutions.length
     },
     findings: [],
-    diagnostics: [...diagnostics]
+    diagnostics: [...diagnostics],
+    ruleExecutions: [...ruleExecutions]
   };
 }
 function flattenNodes(nodes) {
@@ -3348,7 +3356,7 @@ function normalizeFinding(rule, finding) {
     ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
-function summarize(findings, diagnostics) {
+function summarize(findings, diagnostics, rulesEvaluated) {
   return {
     passed: findings.filter((finding) => finding.status === "pass").length,
     failed: findings.filter(
@@ -3357,9 +3365,21 @@ function summarize(findings, diagnostics) {
     warnings: findings.filter(
       (finding) => finding.status === "warning" || finding.severity === "warning"
     ).length,
-    errors: diagnostics.filter((item) => item.severity === "error").length
+    errors: diagnostics.filter((item) => item.severity === "error").length,
+    rulesEvaluated
   };
 }
+function classifyRuleExecution(findings, threw) {
+  if (findings.some((finding) => finding.status === "fail" && finding.severity === "error")) {
+    return "fail";
+  }
+  if (findings.some(
+    (finding) => finding.status === "warning" || finding.severity === "warning"
+  )) {
+    return "warning";
+  }
+  return "pass";
+}
 function eventEvidence(event, path16) {
   return {
     runId: event.runId,
@@ -3725,6 +3745,18 @@ function runTraceChecks(input, options = {}) {
   if (rules.diagnostics.length > 0) {
     return errorResult(input, rules.diagnostics, selected.run);
   }
+  if (rules.rules.length === 0) {
+    return errorResult(
+      input,
+      [
+        diagnostic(
+          "AI_CHECK_NO_RULES_EVALUATED",
+          "No trace check rules were evaluated. Configure at least one rule, contract, or CLI check option."
+        )
+      ],
+      selected.run
+    );
+  }
   const facts = buildFacts(input, selected.run);
   const context = {
     ...facts,
@@ -3733,22 +3765,38 @@ function runTraceChecks(input, options = {}) {
   };
   const diagnostics = [];
   const findings = [];
+  const ruleExecutions = [];
   for (const rule of rules.rules) {
     try {
-      findings.push(...rule.evaluate(context).map((finding) => normalizeFinding(rule, finding)));
+      const ruleFindings = rule.evaluate(context).map((finding) => normalizeFinding(rule, finding));
+      findings.push(...ruleFindings);
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: classifyRuleExecution(ruleFindings, false),
+        findingCount: ruleFindings.length,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
         diagnostic("AI_CHECK_INTERNAL_ERROR", `Rule ${rule.id} failed: ${message}`, rule.id)
       );
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: "error",
+        findingCount: 0,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     }
   }
   if (diagnostics.length > 0) {
-    return errorResult(input, diagnostics, selected.run);
+    return errorResult(input, diagnostics, selected.run, ruleExecutions);
   }
   const eventById = new Map(input.read.events.map((event) => [event.eventId, event]));
   const sortedFindings = findings.sort(compareFindings(eventById));
-  const summary = summarize(sortedFindings, diagnostics);
+  const summary = summarize(sortedFindings, diagnostics, ruleExecutions.length);
   const status = summary.failed > 0 ? "fail" : "pass";
   return {
     ok: status === "pass",
@@ -3757,7 +3805,8 @@ function runTraceChecks(input, options = {}) {
     ...selected.run ? { runId: selected.run.runId } : {},
     summary,
     findings: sortedFindings,
-    diagnostics
+    diagnostics,
+    ruleExecutions
   };
 }
 
@@ -6644,8 +6693,11 @@ function exportRunTree(tree, options) {
 }
 
 // packages/redact/src/sensitive-key.ts
+function keyHasExplicitSeparator2(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey2(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 var NON_CREDENTIAL_TOKEN_CONFIG_KEYS2 = new Set(
   [
@@ -6675,6 +6727,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
   const normalized = normalizeSensitiveKey2(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS2.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator2(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey2(sensitive);
     if (!s) continue;
@@ -6683,7 +6736,8 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }