@agent-inspect/mcp-server 6.31.5 → 6.31.7

package/dist/cli.cjs

@@ -218,7 +218,7 @@ var Redactor = class {
 };
 
 // packages/core/src/safety/credential-value-patterns.ts
-var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i;
+var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i;
 var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
   /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
   /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
@@ -1498,6 +1498,8 @@ function filterTraces(traces, options) {
 }
 
 // packages/core/src/timeline.ts
+var ROOT_TIMELINE_DEPTH = 0;
+var MAX_TIMELINE_DEPTH = 1e3;
 function finite(n) {
   return typeof n === "number" && Number.isFinite(n);
 }
@@ -1568,16 +1570,51 @@ function buildRunTimeline(events, options = {}) {
   const computeDepth = (stepId) => {
     const cached = depthCache.get(stepId);
     if (cached !== void 0) return cached;
-    const node = steps.get(stepId);
-    if (!node) return 0;
-    const parent = node.parentId;
-    if (typeof parent !== "string" || parent.trim() === "" || !steps.has(parent)) {
-      depthCache.set(stepId, 0);
-      return 0;
+    const ancestry = [];
+    const ancestryIndexes = /* @__PURE__ */ new Map();
+    let currentStepId = stepId;
+    let resolvedDepth;
+    while (resolvedDepth === void 0) {
+      const cachedDepth = depthCache.get(currentStepId);
+      if (cachedDepth !== void 0) {
+        resolvedDepth = cachedDepth;
+        continue;
+      }
+      const cycleStart = ancestryIndexes.get(currentStepId);
+      if (cycleStart !== void 0) {
+        const cycleStepIds = ancestry.splice(cycleStart);
+        for (const cycleStepId of cycleStepIds) {
+          depthCache.set(cycleStepId, ROOT_TIMELINE_DEPTH);
+        }
+        resolvedDepth = ROOT_TIMELINE_DEPTH;
+        continue;
+      }
+      const currentStep = steps.get(currentStepId);
+      if (!currentStep) {
+        resolvedDepth = ROOT_TIMELINE_DEPTH;
+        continue;
+      }
+      ancestryIndexes.set(currentStepId, ancestry.length);
+      ancestry.push(currentStepId);
+      const parentId = currentStep.parentId;
+      if (typeof parentId !== "string" || parentId.trim() === "" || !steps.has(parentId)) {
+        ancestry.pop();
+        depthCache.set(currentStepId, ROOT_TIMELINE_DEPTH);
+        resolvedDepth = ROOT_TIMELINE_DEPTH;
+        continue;
+      }
+      currentStepId = parentId;
     }
-    const d = Math.min(1e3, computeDepth(parent) + 1);
-    depthCache.set(stepId, d);
-    return d;
+    ancestry.reverse();
+    for (const ancestorStepId of ancestry) {
+      resolvedDepth = Math.min(MAX_TIMELINE_DEPTH, resolvedDepth + 1);
+      depthCache.set(ancestorStepId, resolvedDepth);
+    }
+    const resolvedStepDepth = depthCache.get(stepId);
+    if (resolvedStepDepth === void 0) {
+      throw new Error(`Failed to resolve timeline depth for step "${stepId}"`);
+    }
+    return resolvedStepDepth;
   };
   const entries = [];
   for (const [stepId, s] of steps.entries()) {
@@ -3361,7 +3398,7 @@ var DEFAULT_SECRET_PATTERNS = [
   // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
   {
     id: "key-value-secret",
-    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i
+    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i
   }
 ];
 function compareStrings(a, b) {
@@ -3676,9 +3713,6 @@ function limitFindings(findings, maxFindings) {
   if (maxFindings === void 0 || findings.length <= maxFindings) return findings;
   return findings.slice(0, Math.max(0, maxFindings));
 }
-function hasRedactionMarker(value, markers) {
-  return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
-}
 function isFullyRedactedValue(value, markers = ["[REDACTED]", "[REDACTED:"]) {
   if (typeof value !== "string") return false;
   const trimmed = value.trim();
@@ -3763,7 +3797,7 @@ function createSafetyRedactionRule(options = {}) {
       for (const event of context.events) {
         for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
           if (!isSensitiveKey(entry.key ?? lastPathSegment(entry.path), sensitiveKeys)) continue;
-          if (typeof entry.value === "string" && hasRedactionMarker(entry.value, markers)) continue;
+          if (isFullyRedactedValue(entry.value, markers)) continue;
           findings.push(
             failFinding(
               "safety.redaction",
@@ -5055,6 +5089,23 @@ function persistedInspectEventToInspectEvent(event) {
   if (event.durationMs !== void 0 && Number.isFinite(event.durationMs) && event.durationMs >= 0) {
     out.durationMs = event.durationMs;
   }
+  if (event.startedAt !== void 0) {
+    const started = parseIsoToMs3(event.startedAt);
+    if (!started.invalidTimestamp) {
+      attrs2.startedAtMs = started.ms;
+      out.timestamp = started.ms;
+    }
+  }
+  if (event.endedAt !== void 0) {
+    const ended = parseIsoToMs3(event.endedAt);
+    if (!ended.invalidTimestamp) {
+      attrs2.endedAtMs = ended.ms;
+      if (out.durationMs === void 0 && typeof attrs2.startedAtMs === "number" && ended.ms >= attrs2.startedAtMs) {
+        out.durationMs = ended.ms - attrs2.startedAtMs;
+      }
+    }
+  }
+  out.attributes = compactAttributes3(attrs2);
   return out;
 }
 function persistedInspectEventsToInspectEvents(events, options) {
@@ -6116,20 +6167,38 @@ function extractOtlpDocument(root) {
 function mapOtlpStatus(status) {
   if (!isRecord10(status)) return void 0;
   const rawCode = status.code;
-  if (typeof rawCode !== "string") return void 0;
-  switch (rawCode.toUpperCase()) {
-    case "STATUS_CODE_OK":
-    case "OK":
-      return "ok";
-    case "STATUS_CODE_ERROR":
-    case "ERROR":
-      return "error";
-    case "STATUS_CODE_UNSET":
-    case "UNSET":
-      return "unknown";
-    default:
-      return "unknown";
+  if (typeof rawCode === "number" && Number.isFinite(rawCode)) {
+    switch (rawCode) {
+      case 0:
+        return "unknown";
+      case 1:
+        return "ok";
+      case 2:
+        return "error";
+      default:
+        return "unknown";
+    }
+  }
+  if (typeof rawCode === "string") {
+    const trimmed = rawCode.trim();
+    if (/^\d+$/.test(trimmed)) {
+      return mapOtlpStatus({ code: Number(trimmed) });
+    }
+    switch (trimmed.toUpperCase()) {
+      case "STATUS_CODE_OK":
+      case "OK":
+        return "ok";
+      case "STATUS_CODE_ERROR":
+      case "ERROR":
+        return "error";
+      case "STATUS_CODE_UNSET":
+      case "UNSET":
+        return "unknown";
+      default:
+        return "unknown";
+    }
   }
+  return void 0;
 }
 function readOtlpKind(attributes, pathPrefix) {
   const warnings = [];
@@ -6717,6 +6786,8 @@ var CONNECTION_PROTOCOLS = /* @__PURE__ */ new Set([
   "amqps:"
 ]);
 var CONNECTION_URI = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s]+$/i;
+var CONNECTION_USERINFO = /^(postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/([^@/?#]+)@(.+)$/i;
+var CONNECTION_HAS_USERINFO = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^@/?#]+@/i;
 var UUID_SEGMENT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HEX_SEGMENT = /^[0-9a-f]{12,}$/i;
 var NUMERIC_SEGMENT = /^\d{5,}$/;
@@ -6740,6 +6811,28 @@ function parseRedactableUrl(value) {
     return void 0;
   }
 }
+function redactConnectionUserinfoFallback(value, replacement) {
+  const trimmed = value.trim();
+  const match = CONNECTION_USERINFO.exec(trimmed);
+  if (match) {
+    const [, scheme, , rest] = match;
+    if (scheme && rest && rest.length > 0) {
+      return {
+        value: `${scheme}://${rest}`,
+        credentialRedacted: true,
+        identifiersMasked: false
+      };
+    }
+  }
+  if (looksLikeConnectionUri(trimmed) && CONNECTION_HAS_USERINFO.test(trimmed)) {
+    return {
+      value: replacement,
+      credentialRedacted: true,
+      identifiersMasked: false
+    };
+  }
+  return void 0;
+}
 function isHttpProtocol(protocol) {
   return protocol === "http:" || protocol === "https:";
 }
@@ -6781,9 +6874,11 @@ function redactUrlString(value, options) {
     identifiersMasked: false
   };
   if (!looksLikeUrlForRedaction(value)) return unchanged;
-  const url = parseRedactableUrl(value);
-  if (!url) return unchanged;
   const replacement = options.replacement ?? "[REDACTED]";
+  const url = parseRedactableUrl(value);
+  if (!url) {
+    return redactConnectionUserinfoFallback(value, replacement) ?? unchanged;
+  }
   const idPlaceholder = options.idPlaceholder ?? "[id]";
   const http = isHttpProtocol(url.protocol);
   let credentialRedacted = url.username.length > 0 || url.password.length > 0;
@@ -7355,6 +7450,10 @@ function exportOpenInference(tree, options) {
     warnings
   };
 }
+var OTLP_STATUS_CODE_UNSET = 0;
+var OTLP_STATUS_CODE_OK = 1;
+var OTLP_STATUS_CODE_ERROR = 2;
+var OTLP_SPAN_KIND_INTERNAL = 1;
 function hexFrom2(seed, byteLen) {
   return crypto__default.default.createHash("sha256").update(seed, "utf8").digest("hex").slice(0, byteLen * 2);
 }
@@ -7367,7 +7466,19 @@ function stringAttr2(key, value) {
   return { key, value: { stringValue: value } };
 }
 function intAttr(key, value) {
-  return { key, value: { intValue: String(value) } };
+  return { key, value: { intValue: String(Math.trunc(value)) } };
+}
+function doubleAttr(key, value) {
+  return { key, value: { doubleValue: value } };
+}
+function boolAttr(key, value) {
+  return { key, value: { boolValue: value } };
+}
+function numberAttr(key, value) {
+  if (Number.isFinite(value) && !Number.isInteger(value)) {
+    return doubleAttr(key, value);
+  }
+  return intAttr(key, value);
 }
 function genAiOperationName(kind) {
   switch (kind) {
@@ -7381,10 +7492,27 @@ function genAiOperationName(kind) {
       return void 0;
   }
 }
+function resolveSpanTimes(ev) {
+  const startedAtMs = typeof ev.attributes?.startedAtMs === "number" && Number.isFinite(ev.attributes.startedAtMs) ? ev.attributes.startedAtMs : void 0;
+  const endedAtMs = typeof ev.attributes?.endedAtMs === "number" && Number.isFinite(ev.attributes.endedAtMs) ? ev.attributes.endedAtMs : void 0;
+  const startMs = startedAtMs ?? ev.timestamp;
+  const startNs = String(unixNano2(startMs));
+  if (endedAtMs !== void 0) {
+    return { startNs, endNs: String(unixNano2(endedAtMs)) };
+  }
+  if (ev.durationMs !== void 0 && Number.isFinite(ev.durationMs)) {
+    return {
+      startNs,
+      endNs: String(unixNano2(startMs) + unixNano2(ev.durationMs))
+    };
+  }
+  return { startNs };
+}
 function exportOtlpJson(tree, options) {
   const warnings = [
     "OTLP JSON export uses OTel GenAI-aligned attributes where applicable; experimental until verified against specific collectors.",
-    "Not OTLP gRPC/protobuf \u2014 JSON mapping only. Generated locally; no network upload."
+    "Not OTLP gRPC/protobuf \u2014 JSON mapping only. Generated locally; no network upload.",
+    "Status and span kind use OTLP numeric enums (StatusCode 0/1/2, SpanKind INTERNAL=1)."
   ];
   const traceId = hexFrom2(`trace:${tree.runId}`, 16);
   const includeAttributes = options?.includeAttributes ?? false;
@@ -7396,11 +7524,7 @@ function exportOtlpJson(tree, options) {
     const ev = n.event;
     const spanId = hexFrom2(`${tree.runId}:${ev.eventId}`, 8);
     const parentSpanId = ev.parentId ? hexFrom2(`${tree.runId}:${ev.parentId}`, 8) : void 0;
-    const startNs = String(unixNano2(ev.timestamp));
-    let endNs;
-    if (ev.durationMs !== void 0 && Number.isFinite(ev.durationMs)) {
-      endNs = String(unixNano2(ev.timestamp) + unixNano2(ev.durationMs));
-    }
+    const { startNs, endNs } = resolveSpanTimes(ev);
     const attrs2 = [
       stringAttr2("agent_inspect.kind", ev.kind),
       stringAttr2("agent_inspect.confidence", ev.confidence),
@@ -7430,29 +7554,28 @@ function exportOtlpJson(tree, options) {
     if (includeAttributes && meta && typeof meta === "object") {
       for (const [k, v] of Object.entries(meta)) {
         if (k === "tokens" || k === "model") continue;
-        if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
-          attrs2.push(
-            stringAttr2(
-              `agent_inspect.preview.${k}`,
-              typeof v === "string" ? v.slice(0, maxLen) : String(v)
-            )
-          );
+        if (typeof v === "string") {
+          attrs2.push(stringAttr2(`agent_inspect.preview.${k}`, v.slice(0, maxLen)));
+        } else if (typeof v === "number" && Number.isFinite(v)) {
+          attrs2.push(numberAttr(`agent_inspect.preview.${k}`, v));
+        } else if (typeof v === "boolean") {
+          attrs2.push(boolAttr(`agent_inspect.preview.${k}`, v));
         }
       }
     }
-    let statusCode = "STATUS_CODE_UNSET";
+    let statusCode = OTLP_STATUS_CODE_UNSET;
     let statusMessage;
     if (ev.status === "error") {
-      statusCode = "STATUS_CODE_ERROR";
+      statusCode = OTLP_STATUS_CODE_ERROR;
       statusMessage = meta && typeof meta.error === "object" && meta.error !== null ? String(meta.error.message ?? "error").slice(0, maxLen) : "error";
     } else if (ev.status === "ok") {
-      statusCode = "STATUS_CODE_OK";
+      statusCode = OTLP_STATUS_CODE_OK;
     }
     const spanJson = {
       traceId,
       spanId,
       name: ev.name,
-      kind: "SPAN_KIND_INTERNAL",
+      kind: OTLP_SPAN_KIND_INTERNAL,
       startTimeUnixNano: startNs,
       attributes: attrs2,
       status: {
@@ -7575,7 +7698,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
 }
 
 // packages/redact/src/key-value-secret.ts
-var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})`;
 var KEY_VALUE_SECRET_PATTERN2 = new RegExp(
   KEY_VALUE_SECRET_PATTERN_SOURCE,
   "i"
@@ -7600,6 +7723,8 @@ var CONNECTION_PROTOCOLS2 = /* @__PURE__ */ new Set([
   "amqps:"
 ]);
 var CONNECTION_URI2 = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^\s]+$/i;
+var CONNECTION_USERINFO2 = /^(postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/([^@/?#]+)@(.+)$/i;
+var CONNECTION_HAS_USERINFO2 = /^(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?):\/\/[^@/?#]+@/i;
 var UUID_SEGMENT2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var HEX_SEGMENT2 = /^[0-9a-f]{12,}$/i;
 var NUMERIC_SEGMENT2 = /^\d{5,}$/;
@@ -7623,6 +7748,28 @@ function parseRedactableUrl2(value) {
     return void 0;
   }
 }
+function redactConnectionUserinfoFallback2(value, replacement) {
+  const trimmed = value.trim();
+  const match = CONNECTION_USERINFO2.exec(trimmed);
+  if (match) {
+    const [, scheme, , rest] = match;
+    if (scheme && rest && rest.length > 0) {
+      return {
+        value: `${scheme}://${rest}`,
+        credentialRedacted: true,
+        identifiersMasked: false
+      };
+    }
+  }
+  if (looksLikeConnectionUri2(trimmed) && CONNECTION_HAS_USERINFO2.test(trimmed)) {
+    return {
+      value: replacement,
+      credentialRedacted: true,
+      identifiersMasked: false
+    };
+  }
+  return void 0;
+}
 function isHttpProtocol2(protocol) {
   return protocol === "http:" || protocol === "https:";
 }
@@ -7664,9 +7811,11 @@ function redactUrlString2(value, options) {
     identifiersMasked: false
   };
   if (!looksLikeUrlForRedaction2(value)) return unchanged;
-  const url = parseRedactableUrl2(value);
-  if (!url) return unchanged;
   const replacement = options.replacement ?? "[REDACTED]";
+  const url = parseRedactableUrl2(value);
+  if (!url) {
+    return redactConnectionUserinfoFallback2(value, replacement) ?? unchanged;
+  }
   const idPlaceholder = options.idPlaceholder ?? "[id]";
   const http = isHttpProtocol2(url.protocol);
   let credentialRedacted = url.username.length > 0 || url.password.length > 0;