@agent-inspect/mcp-server 6.7.5 → 6.9.0

package/dist/index.mjs

@@ -4,7 +4,7 @@ import path from 'path';
 import { fileURLToPath } from 'url';
 import { AsyncLocalStorage } from 'async_hooks';
 import crypto from 'crypto';
-import { readdir, stat, readFile } from 'fs/promises';
+import { readFile, readdir, stat } from 'fs/promises';
 import os from 'os';
 import 'nanoid';
 import 'chalk';
@@ -1871,8 +1871,35 @@ var DEFAULT_RAW_CONTENT_KEYS = [
   "toolinput",
   "tool_input",
   "tooloutput",
-  "tool_output"
+  "tool_output",
+  // Framework / agent metadata that carries user or task text
+  "currenttask",
+  "current_task",
+  "task",
+  "userinput",
+  "user_input",
+  "requesttext",
+  "request_text",
+  "conversationtext",
+  "conversation_text"
 ];
+var DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES = ["tokenUsage", "usage"];
+var SAFE_USAGE_LEAF_KEYS = /* @__PURE__ */ new Set([
+  "input",
+  "output",
+  "total",
+  "cached",
+  "input_tokens",
+  "inputtokens",
+  "output_tokens",
+  "outputtokens",
+  "total_tokens",
+  "totaltokens",
+  "prompt_tokens",
+  "prompttokens",
+  "completion_tokens",
+  "completiontokens"
+]);
 var DEFAULT_SECRET_PATTERNS = [
   { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
   { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
@@ -2050,7 +2077,11 @@ function normalizeFinding(rule, finding) {
     message: finding.message,
     ...finding.expected !== void 0 ? { expected: finding.expected } : {},
     ...finding.actual !== void 0 ? { actual: finding.actual } : {},
-    evidence: [...finding.evidence ?? []]
+    evidence: [...finding.evidence ?? []],
+    ...finding.category !== void 0 ? { category: finding.category } : {},
+    ...finding.confidence !== void 0 ? { confidence: finding.confidence } : {},
+    ...finding.detector !== void 0 ? { detector: finding.detector } : {},
+    ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
 function summarize(findings, diagnostics) {
@@ -2081,15 +2112,19 @@ function eventEvidence(event, path14) {
 function runEvidence(run) {
   return run ? [{ runId: run.runId, name: run.name, status: run.status }] : [];
 }
-function failFinding(ruleId, message, evidence, expected, actual) {
+function failFinding(ruleId, message, evidence, expected, actual, meta) {
   return {
     ruleId,
-    severity: "error",
-    status: "fail",
+    severity: meta?.severity ?? "error",
+    status: meta?.status ?? "fail",
     message,
     ...expected !== void 0 ? { expected } : {},
     ...actual !== void 0 ? { actual } : {},
-    evidence: [...evidence]
+    evidence: [...evidence],
+    ...meta?.category !== void 0 ? { category: meta.category } : {},
+    ...meta?.confidence !== void 0 ? { confidence: meta.confidence } : {},
+    ...meta?.detector !== void 0 ? { detector: meta.detector } : {},
+    ...meta?.action !== void 0 ? { action: meta.action } : {}
   };
 }
 function isRecord6(value) {
@@ -2170,6 +2205,19 @@ function isRawContentKey(key, forbiddenKeys) {
   const normalized = normalizedKey(key);
   return forbiddenKeys.some((forbidden) => normalized === normalizedKey(forbidden));
 }
+function isSafeRawContentMetricPath(path14, key, safePathPrefixes) {
+  const leaf = normalizedKey(key ?? lastPathSegment(path14));
+  if (!SAFE_USAGE_LEAF_KEYS.has(leaf)) return false;
+  const parts = path14.split(".").filter(Boolean);
+  if (parts.length < 2) return false;
+  const parent = parts[parts.length - 2] ?? "";
+  const parentNorm = normalizedKey(parent);
+  return safePathPrefixes.some((prefix) => parentNorm === normalizedKey(prefix));
+}
+function isRawContentPath(path14, key, forbiddenKeys, safePathPrefixes) {
+  if (isSafeRawContentMetricPath(path14, key, safePathPrefixes)) return false;
+  return isRawContentKey(key ?? lastPathSegment(path14), forbiddenKeys);
+}
 function createRunStatusRule(options = {}) {
   const expected = options.expected ?? "ok";
   const allowIncomplete = options.allowIncomplete === true;
@@ -2228,7 +2276,13 @@ function createSafetyRedactionRule(options = {}) {
               `Sensitive-looking field at ${entry.path} is not redacted.`,
               [eventEvidence(event, entry.path)],
               "redaction marker",
-              { path: entry.path, valueType: valueType(entry.value) }
+              { path: entry.path, valueType: valueType(entry.value) },
+              {
+                category: "credential",
+                confidence: "high",
+                detector: "safety.redaction",
+                action: "redact"
+              }
             )
           );
         }
@@ -2239,6 +2293,7 @@ function createSafetyRedactionRule(options = {}) {
 }
 function createSafetyRawContentRule(options = {}) {
   const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
+  const safePathPrefixes = options.safePathPrefixes ?? DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES;
   return {
     id: "safety.rawPrompt",
     category: "safety",
@@ -2248,14 +2303,20 @@ function createSafetyRawContentRule(options = {}) {
       for (const event of context.events) {
         for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
           const key = entry.key ?? lastPathSegment(entry.path);
-          if (!isRawContentKey(key, forbiddenKeys)) continue;
+          if (!isRawContentPath(entry.path, key, forbiddenKeys, safePathPrefixes)) continue;
           findings.push(
             failFinding(
               "safety.rawPrompt",
               `Raw content-like field ${entry.path} is present.`,
               [eventEvidence(event, entry.path)],
               "metadata-only trace fields",
-              { path: entry.path, valueType: valueType(entry.value) }
+              { path: entry.path, valueType: valueType(entry.value) },
+              {
+                category: "raw-content",
+                confidence: "high",
+                detector: "safety.rawPrompt",
+                action: "redact-or-omit"
+              }
             )
           );
         }
@@ -2287,7 +2348,13 @@ function createSafetySecretPatternRule(options = {}) {
                 `Secret-like pattern ${pattern.id} matched at ${entry.path}.`,
                 [eventEvidence(event, entry.path)],
                 "no secret-like strings",
-                { pattern: pattern.id, path: entry.path }
+                { pattern: pattern.id, path: entry.path },
+                {
+                  category: "credential",
+                  confidence: "high",
+                  detector: pattern.id,
+                  action: "redact"
+                }
               )
             );
             break;
@@ -2314,7 +2381,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `String at ${entry.path} exceeds ${options.maxStringLength} characters.`,
                 [eventEvidence(event, entry.path)],
                 { maxStringLength: options.maxStringLength },
-                { path: entry.path, length: entry.value.length }
+                { path: entry.path, length: entry.value.length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -2325,7 +2398,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `Array at ${entry.path} exceeds ${options.maxArrayLength} items.`,
                 [eventEvidence(event, entry.path)],
                 { maxArrayLength: options.maxArrayLength },
-                { path: entry.path, length: entry.value.length }
+                { path: entry.path, length: entry.value.length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -2336,7 +2415,13 @@ function createSafetyOversizedAttributeRule(options) {
                 `Object at ${entry.path} exceeds ${options.maxObjectKeys} keys.`,
                 [eventEvidence(event, entry.path)],
                 { maxObjectKeys: options.maxObjectKeys },
-                { path: entry.path, keys: Object.keys(entry.value).length }
+                { path: entry.path, keys: Object.keys(entry.value).length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
               )
             );
           }
@@ -2349,7 +2434,13 @@ function createSafetyOversizedAttributeRule(options) {
                   `Value at ${entry.path} exceeds ${options.maxSerializedBytes} serialized bytes.`,
                   [eventEvidence(event, entry.path)],
                   { maxSerializedBytes: options.maxSerializedBytes },
-                  { path: entry.path, bytes }
+                  { path: entry.path, bytes },
+                  {
+                    category: "size",
+                    confidence: "high",
+                    detector: "safety.oversizedAttribute",
+                    action: "truncate-or-omit"
+                  }
                 )
               );
             }
@@ -5623,43 +5714,6 @@ function exportRunTree(tree, options) {
     }
   }
 }
-
-// packages/mcp-server/src/assess-trace.ts
-var DEFAULT_MAX_STRING_LENGTH = 16384;
-var DEFAULT_MAX_ARRAY_LENGTH = 1e3;
-var DEFAULT_MAX_OBJECT_KEYS = 200;
-var DEFAULT_MAX_SERIALIZED_BYTES = 128 * 1024;
-function buildMcpSafetyRules() {
-  return [
-    createSafetyRawContentRule(),
-    createSafetyRedactionRule(),
-    createSafetySecretPatternRule(),
-    createSafetyOversizedAttributeRule({
-      maxStringLength: DEFAULT_MAX_STRING_LENGTH,
-      maxArrayLength: DEFAULT_MAX_ARRAY_LENGTH,
-      maxObjectKeys: DEFAULT_MAX_OBJECT_KEYS,
-      maxSerializedBytes: DEFAULT_MAX_SERIALIZED_BYTES
-    })
-  ];
-}
-function statusFrom(findings, hasErrors) {
-  if (hasErrors) return "UNKNOWN";
-  if (findings.some((item) => item.severity === "error")) return "UNSAFE";
-  if (findings.some((item) => item.severity === "warning")) return "SAFE WITH WARNINGS";
-  return "SAFE";
-}
-function assessTraceForMcp(read, runId) {
-  const rules = buildMcpSafetyRules();
-  const checkResult = runTraceChecks({ read }, { rules, runId });
-  const hasErrors = checkResult.diagnostics.some((item) => item.severity === "error");
-  const status = statusFrom(checkResult.findings, hasErrors);
-  return {
-    status,
-    errors: checkResult.diagnostics.filter((item) => item.severity === "error").length + checkResult.findings.filter((item) => item.severity === "error").length,
-    warnings: checkResult.diagnostics.filter((item) => item.severity === "warning").length + checkResult.findings.filter((item) => item.severity === "warning").length,
-    findings: checkResult.findings.length
-  };
-}
 var DEFAULT_REDACT_KEYS2 = [
   "authorization",
   "cookie",
@@ -5690,7 +5744,12 @@ var SHARE_PROFILE_EXTRA_KEYS2 = [
   "organizationId",
   "traceId",
   "spanId",
-  "parentSpanId"
+  "parentSpanId",
+  "currentTask",
+  "task",
+  "userInput",
+  "requestText",
+  "conversationText"
 ];
 var STRICT_PROFILE_EXTRA_KEYS2 = [
   "prompt",
@@ -5758,6 +5817,61 @@ function passesLuhn(value) {
   }
   return sum % 10 === 0;
 }
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var EPOCH_MS_RE = /^1[0-9]{12}$/;
+var EMAIL_RE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+function pathSuggestsNonCard(path14) {
+  const normalized = path14.toLowerCase().replace(/[^a-z0-9._]/g, "");
+  return /(^|\.)(tokenusage|usage)(\.|$)/.test(normalized) || /(startedat|endedat|durationms|timestamp|createdat|updatedat)(\.|$)/.test(normalized) || /(^|\.)(runid|traceid|spanid|eventid|sessionid|userid|parentid|requestid|correlationid)(\.|$)/.test(
+    normalized
+  ) || /(^|\.)ts(\.|$)/.test(normalized);
+}
+function isUuidLike(value) {
+  return UUID_RE.test(value.trim());
+}
+function isPlausibleCardCandidate(candidate, fullValue) {
+  const digits = digitsOnly(candidate);
+  if (digits.length < 13 || digits.length > 19) return false;
+  if (!passesLuhn(candidate)) return false;
+  const trimmed = fullValue.trim();
+  if (isUuidLike(trimmed)) return false;
+  if (EPOCH_MS_RE.test(digits) && digitsOnly(trimmed) === digits && /^\d+$/.test(trimmed)) {
+    return false;
+  }
+  const start = fullValue.indexOf(candidate);
+  if (start >= 0) {
+    const before = fullValue[start - 1];
+    const after = fullValue[start + candidate.length];
+    if (before && /[A-Za-z0-9_]/.test(before)) return false;
+    if (after && /[A-Za-z0-9_]/.test(after)) return false;
+  }
+  return true;
+}
+function looksLikePathOrPackageOrUrl(value) {
+  const trimmed = value.trim();
+  if (/^(?:[a-z][a-z0-9+.-]*:)?\/\//i.test(trimmed)) return true;
+  if (/^webpack:/i.test(trimmed)) return true;
+  if (/^@[A-Za-z0-9_.-]+\/[A-Za-z0-9_.@/-]+$/.test(trimmed)) return true;
+  if (/^[A-Za-z]:[\\/]/.test(trimmed) || /^[/\\]/.test(trimmed)) return true;
+  if (/[\\/]/.test(trimmed) && !/\s/.test(trimmed)) return true;
+  return false;
+}
+function emailMatchIsPathAdjacent(value, index, length) {
+  const before = value[index - 1];
+  const after = value[index + length];
+  return before === "/" || before === "\\" || after === "/" || after === "\\";
+}
+function valueContainsEmail(value) {
+  if (looksLikePathOrPackageOrUrl(value)) return false;
+  EMAIL_RE.lastIndex = 0;
+  for (const match of value.matchAll(EMAIL_RE)) {
+    const text = match[0] ?? "";
+    const index = match.index ?? 0;
+    if (emailMatchIsPathAdjacent(value, index, text.length)) continue;
+    return true;
+  }
+  return false;
+}
 var credentialDetectors = [
   patternDetector({
     id: "value.authorizationHeader",
@@ -5805,10 +5919,12 @@ var credentialDetectors = [
     matchKind: "value",
     detect(input) {
       if (typeof input.value !== "string") return [];
+      if (pathSuggestsNonCard(input.path)) return [];
+      if (isUuidLike(input.value)) return [];
       const candidatePattern = /(?:\d[ -]?){13,19}/g;
       for (const match of input.value.matchAll(candidatePattern)) {
         const candidate = match[0] ?? "";
-        if (passesLuhn(candidate)) {
+        if (isPlausibleCardCandidate(candidate, input.value)) {
           return [{ action: "replace", severity: "error", matchKind: "value" }];
         }
       }
@@ -5817,10 +5933,15 @@ var credentialDetectors = [
   }
 ];
 var identifierDetectors = [
-  patternDetector({
+  {
     id: "value.email",
-    pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i
-  }),
+    severity: "warning",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      return valueContainsEmail(input.value) ? [{ action: "replace", severity: "warning", matchKind: "value" }] : [];
+    }
+  },
   patternDetector({
     id: "value.phone",
     pattern: /\b(?:\+\d{1,3}[\s.-]?)?(?:\(?\d{3}\)?[\s.-])\d{3}[\s.-]\d{4}\b/
@@ -6038,6 +6159,92 @@ function redact(value, options) {
   return createRedactor(options).redact(value);
 }
 
+// packages/mcp-server/src/assess-trace.ts
+var DEFAULT_MAX_STRING_LENGTH = 16384;
+var DEFAULT_MAX_ARRAY_LENGTH = 1e3;
+var DEFAULT_MAX_OBJECT_KEYS = 200;
+var DEFAULT_MAX_SERIALIZED_BYTES = 128 * 1024;
+function buildMcpSafetyRules() {
+  return [
+    createSafetyRawContentRule(),
+    createSafetyRedactionRule(),
+    createSafetySecretPatternRule(),
+    createSafetyOversizedAttributeRule({
+      maxStringLength: DEFAULT_MAX_STRING_LENGTH,
+      maxArrayLength: DEFAULT_MAX_ARRAY_LENGTH,
+      maxObjectKeys: DEFAULT_MAX_OBJECT_KEYS,
+      maxSerializedBytes: DEFAULT_MAX_SERIALIZED_BYTES
+    })
+  ];
+}
+function statusFrom(findings, hasErrors) {
+  if (hasErrors) return "UNKNOWN";
+  if (findings.some((item) => item.severity === "error")) return "UNSAFE";
+  if (findings.some((item) => item.severity === "warning")) return "SAFE WITH WARNINGS";
+  return "SAFE";
+}
+function redactJsonl(content, profile) {
+  const trimmed = content.trim();
+  if (trimmed.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && ("schemaVersion" in parsed || "eventId" in parsed || "runId" in parsed)) {
+      } else {
+        const result = redact(parsed, { profile });
+        return `${JSON.stringify(result.value)}
+`;
+      }
+    } catch {
+    }
+  }
+  const lines = content.split(/\r?\n/);
+  const out = [];
+  for (const line of lines) {
+    if (line.trim() === "") continue;
+    const parsed = JSON.parse(line);
+    const result = redact(parsed, { profile });
+    out.push(JSON.stringify(result.value));
+  }
+  return out.length === 0 ? "" : `${out.join("\n")}
+`;
+}
+function assessTraceForMcp(read, runId) {
+  const rules = buildMcpSafetyRules();
+  const checkResult = runTraceChecks({ read }, { rules, runId });
+  const hasErrors = checkResult.diagnostics.some((item) => item.severity === "error");
+  const status = statusFrom(checkResult.findings, hasErrors);
+  return {
+    status,
+    errors: checkResult.diagnostics.filter((item) => item.severity === "error").length + checkResult.findings.filter((item) => item.severity === "error").length,
+    warnings: checkResult.diagnostics.filter((item) => item.severity === "warning").length + checkResult.findings.filter((item) => item.severity === "warning").length,
+    findings: checkResult.findings.length
+  };
+}
+async function assessTraceArtifactForMcp(options) {
+  const source = assessTraceForMcp(options.read, options.runId);
+  try {
+    const raw = await readFile(options.filePath, "utf-8");
+    const redacted = redactJsonl(raw, options.profile);
+    const artifactRead = await openTrace(
+      { type: "string", content: redacted },
+      { format: "agent-inspect-jsonl" }
+    );
+    const artifact = assessTraceForMcp(artifactRead, options.runId);
+    return {
+      ...artifact,
+      sourceStatus: source.status
+    };
+  } catch {
+    return {
+      status: "UNKNOWN",
+      errors: Math.max(1, source.errors),
+      warnings: source.warnings,
+      findings: source.findings,
+      sourceStatus: source.status
+    };
+  }
+}
+
 // packages/mcp-server/src/prepare-result.ts
 var DEFAULT_MCP_RESULT_MAX_BYTES = 512 * 1024;
 function stableStringify(value) {
@@ -6396,16 +6603,21 @@ async function callReadOnlyTool(context, name, args = {}) {
     }
     case "create_share_safe_bundle": {
       const runId = String(args.runId ?? "");
-      const { read } = await openRunTrace(context, runId);
+      const { meta, read } = await openRunTrace(context, runId);
       const run = read.runs.find((item) => item.runId === runId) ?? read.runs[0];
       if (!run) return errorResult2(`Run tree not found: ${runId}`);
-      const safety = assessTraceForMcp(read, runId);
+      const profile = redactionProfileForExport(context);
+      const safety = await assessTraceArtifactForMcp({
+        read,
+        runId,
+        filePath: meta.filePath,
+        profile
+      });
       if (bundleFailsOnSafety(safety.status)) {
         return errorResult2(
-          `Share-safe bundle refused: safety status is ${safety.status}. Resolve findings before export.`
+          `Share-safe bundle refused: artifact safety status is ${safety.status}. Resolve findings before export.`
         );
       }
-      const profile = redactionProfileForExport(context);
       const markdown = exportMarkdown(run, {
         redacted: true});
       const tree = exportRunTree(run, {
@@ -6423,6 +6635,7 @@ async function callReadOnlyTool(context, name, args = {}) {
             {
               runId,
               status: safety.status,
+              ...safety.sourceStatus !== void 0 ? { sourceStatus: safety.sourceStatus } : {},
               errors: safety.errors,
               warnings: safety.warnings,
               findings: safety.findings