@agent-inspect/mcp-server 6.31.5 → 6.31.6

package/dist/cli.cjs

@@ -218,7 +218,7 @@ var Redactor = class {
 };
 
 // packages/core/src/safety/credential-value-patterns.ts
-var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i;
+var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i;
 var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
   /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
   /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
@@ -3361,7 +3361,7 @@ var DEFAULT_SECRET_PATTERNS = [
   // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
   {
     id: "key-value-secret",
-    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i
+    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i
   }
 ];
 function compareStrings(a, b) {
@@ -3676,9 +3676,6 @@ function limitFindings(findings, maxFindings) {
   if (maxFindings === void 0 || findings.length <= maxFindings) return findings;
   return findings.slice(0, Math.max(0, maxFindings));
 }
-function hasRedactionMarker(value, markers) {
-  return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
-}
 function isFullyRedactedValue(value, markers = ["[REDACTED]", "[REDACTED:"]) {
   if (typeof value !== "string") return false;
   const trimmed = value.trim();
@@ -3763,7 +3760,7 @@ function createSafetyRedactionRule(options = {}) {
       for (const event of context.events) {
         for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
           if (!isSensitiveKey(entry.key ?? lastPathSegment(entry.path), sensitiveKeys)) continue;
-          if (typeof entry.value === "string" && hasRedactionMarker(entry.value, markers)) continue;
+          if (isFullyRedactedValue(entry.value, markers)) continue;
           findings.push(
             failFinding(
               "safety.redaction",
@@ -6717,6 +6714,8 @@ var CONNECTION_PROTOCOLS = /* @__PURE__ */ new Set([
   "amqps:"
 ]);
 var CONNECTION_URI = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s]+$/i;
+var CONNECTION_USERINFO = /^(postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/([^@/?#]+)@(.+)$/i;
+var CONNECTION_HAS_USERINFO = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^@/?#]+@/i;
 var UUID_SEGMENT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HEX_SEGMENT = /^[0-9a-f]{12,}$/i;
 var NUMERIC_SEGMENT = /^\d{5,}$/;
@@ -6740,6 +6739,28 @@ function parseRedactableUrl(value) {
     return void 0;
   }
 }
+function redactConnectionUserinfoFallback(value, replacement) {
+  const trimmed = value.trim();
+  const match = CONNECTION_USERINFO.exec(trimmed);
+  if (match) {
+    const [, scheme, , rest] = match;
+    if (scheme && rest && rest.length > 0) {
+      return {
+        value: `${scheme}://${rest}`,
+        credentialRedacted: true,
+        identifiersMasked: false
+      };
+    }
+  }
+  if (looksLikeConnectionUri(trimmed) && CONNECTION_HAS_USERINFO.test(trimmed)) {
+    return {
+      value: replacement,
+      credentialRedacted: true,
+      identifiersMasked: false
+    };
+  }
+  return void 0;
+}
 function isHttpProtocol(protocol) {
   return protocol === "http:" || protocol === "https:";
 }
@@ -6781,9 +6802,11 @@ function redactUrlString(value, options) {
     identifiersMasked: false
   };
   if (!looksLikeUrlForRedaction(value)) return unchanged;
-  const url = parseRedactableUrl(value);
-  if (!url) return unchanged;
   const replacement = options.replacement ?? "[REDACTED]";
+  const url = parseRedactableUrl(value);
+  if (!url) {
+    return redactConnectionUserinfoFallback(value, replacement) ?? unchanged;
+  }
   const idPlaceholder = options.idPlaceholder ?? "[id]";
   const http = isHttpProtocol(url.protocol);
   let credentialRedacted = url.username.length > 0 || url.password.length > 0;
@@ -7575,7 +7598,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
 }
 
 // packages/redact/src/key-value-secret.ts
-var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})`;
 var KEY_VALUE_SECRET_PATTERN2 = new RegExp(
   KEY_VALUE_SECRET_PATTERN_SOURCE,
   "i"
@@ -7600,6 +7623,8 @@ var CONNECTION_PROTOCOLS2 = /* @__PURE__ */ new Set([
   "amqps:"
 ]);
 var CONNECTION_URI2 = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s]+$/i;
+var CONNECTION_USERINFO2 = /^(postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/([^@/?#]+)@(.+)$/i;
+var CONNECTION_HAS_USERINFO2 = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^@/?#]+@/i;
 var UUID_SEGMENT2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HEX_SEGMENT2 = /^[0-9a-f]{12,}$/i;
 var NUMERIC_SEGMENT2 = /^\d{5,}$/;
@@ -7623,6 +7648,28 @@ function parseRedactableUrl2(value) {
     return void 0;
   }
 }
+function redactConnectionUserinfoFallback2(value, replacement) {
+  const trimmed = value.trim();
+  const match = CONNECTION_USERINFO2.exec(trimmed);
+  if (match) {
+    const [, scheme, , rest] = match;
+    if (scheme && rest && rest.length > 0) {
+      return {
+        value: `${scheme}://${rest}`,
+        credentialRedacted: true,
+        identifiersMasked: false
+      };
+    }
+  }
+  if (looksLikeConnectionUri2(trimmed) && CONNECTION_HAS_USERINFO2.test(trimmed)) {
+    return {
+      value: replacement,
+      credentialRedacted: true,
+      identifiersMasked: false
+    };
+  }
+  return void 0;
+}
 function isHttpProtocol2(protocol) {
   return protocol === "http:" || protocol === "https:";
 }
@@ -7664,9 +7711,11 @@ function redactUrlString2(value, options) {
     identifiersMasked: false
   };
   if (!looksLikeUrlForRedaction2(value)) return unchanged;
-  const url = parseRedactableUrl2(value);
-  if (!url) return unchanged;
   const replacement = options.replacement ?? "[REDACTED]";
+  const url = parseRedactableUrl2(value);
+  if (!url) {
+    return redactConnectionUserinfoFallback2(value, replacement) ?? unchanged;
+  }
   const idPlaceholder = options.idPlaceholder ?? "[id]";
   const http = isHttpProtocol2(url.protocol);
   let credentialRedacted = url.username.length > 0 || url.password.length > 0;