@agent-inspect/mcp 6.19.0 → 6.20.0

package/dist/index.mjs

@@ -130,6 +130,33 @@ var Redactor = class {
   }
 };
 
+// packages/core/src/safety/credential-value-patterns.ts
+var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i;
+var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
+  /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
+  /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
+  /\b[a-z0-9_.-]+=[^;\s]+(?:;\s*[a-z0-9_.-]+=[^;\s]+)+/i,
+  /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
+  /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
+  /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
+  KEY_VALUE_SECRET_PATTERN
+];
+function stringContainsHighConfidenceCredential(value) {
+  for (const pattern of HIGH_CONFIDENCE_CREDENTIAL_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(value)) {
+      pattern.lastIndex = 0;
+      return true;
+    }
+  }
+  return false;
+}
+function redactHighConfidenceCredentialsInString(value, replacement = "[REDACTED]") {
+  return stringContainsHighConfidenceCredential(value) ? replacement : value;
+}
+
 // packages/core/src/redaction-profiles.ts
 var SHARE_PROFILE_EXTRA_KEYS = [
   "userEmail",
@@ -635,9 +662,38 @@ function getEventMetadata(event) {
   }
   return void 0;
 }
+function prepareTraceEventErrorForDisk(event, opts) {
+  if (event.event !== "run_completed" && event.event !== "step_completed" || !event.error) {
+    return event;
+  }
+  if (!opts.redactEnabled) return event;
+  const redactor = new Redactor({
+    rules: opts.redactionRules,
+    extraKeys: opts.profileExtraKeys
+  });
+  const nextError = { ...event.error };
+  let changed = false;
+  if (typeof nextError.message === "string") {
+    const keyRedacted = redactor.redactValue("message", nextError.message);
+    const message = typeof keyRedacted === "string" ? redactHighConfidenceCredentialsInString(keyRedacted) : "[REDACTED]";
+    if (message !== nextError.message) {
+      nextError.message = message.length > 0 ? message : "Unknown error";
+      changed = true;
+    }
+  }
+  if (typeof nextError.stack === "string") {
+    const scrubbedStack = redactHighConfidenceCredentialsInString(nextError.stack);
+    if (scrubbedStack !== nextError.stack) {
+      nextError.stack = scrubbedStack;
+      changed = true;
+    }
+  }
+  if (!changed) return event;
+  return { ...event, error: nextError };
+}
 function prepareTraceEventForDisk(event, opts) {
   try {
-    let working = { ...event };
+    let working = prepareTraceEventErrorForDisk({ ...event }, opts);
     const rawMetadata = getEventMetadata(working);
     if (rawMetadata !== void 0) {
       const safe = prepareMetadataForDisk(rawMetadata, opts);