@hue-run/sdk 0.11.2 → 0.11.3

package/dist/evals/simulation.js

@@ -1,8 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { join } from "node:path";
 import { HueEnvironmentError } from "../environment/client.js";
 import { HueApiError } from "./client.js";
-import { CheckpointStore } from "./checkpoint.js";
+import { CheckpointStore, checkpointPath, checkpointSegment } from "./checkpoint.js";
 import { MAX_ENVIRONMENT_STEPS } from "./environment-evidence.js";
 import { aggregateBounds, digest, json } from "./json.js";
 import { normalizeScorerDefinitionForPublication } from "./scorer-publication.js";
@@ -404,7 +403,7 @@ export async function runSimulation(options) {
         let bindings = options.localScorers ?? [];
         if (!attempt.experimentId) {
             const resolved = await resolveExperiment(options, definition, attempt.idempotencyKey);
-            attempt.experimentId = resolved.experimentId;
+            attempt.experimentId = checkpointSegment(resolved.experimentId, "experiment id");
             bindings = resolved.bindings;
             attempt.stage = "running";
             await store.write("active-attempt", attempt);
@@ -417,7 +416,7 @@ export async function runSimulation(options) {
                 ...(options.localScorers ?? []),
             ];
         }
-        const experimentId = attempt.experimentId;
+        const experimentId = checkpointSegment(attempt.experimentId, "experiment id");
         const runUrl = new URL(`/experiments/${experimentId}`, options.client.baseUrl).toString();
         await options.onProgress?.({ type: "run_created", experimentId, runUrl });
         const requested = requestedConfiguration
@@ -427,7 +426,10 @@ export async function runSimulation(options) {
             client: options.client,
             hue: options.hue,
             experimentId,
-            checkpointDirectory: join(store.directory, `experiment-${experimentId}`),
+            checkpointDirectory: checkpointPath(store.directory, [
+                `experiment-${experimentId}`,
+                "experiment id",
+            ]),
             persistResultContent: options.persistResultContent,
             traceEvidence: options.traceEvidence,
             ...(options.traceNotAccepted ? { traceNotAccepted: options.traceNotAccepted } : {}),

package/dist/provider-tools.d.ts

@@ -31,7 +31,9 @@ export interface HostedToolActivity {
 /**
  * A provider's error text as a failed call exports it under content capture: credentials
  * scrubbed first, then at most 1,024 code points with `…` marking a cut, lone surrogates
- * replaced and NUL removed. The Python SDK produces the same text.
+ * replaced and NUL removed. Only the first 16,384 code points are scrubbed, and what that cut
+ * interrupts (a quoted value, a URL, a prefixed token) is redacted to it. The Python SDK
+ * produces the same text.
  */
 export declare function providerErrorDescription(value: string): string;
 /**

package/dist/provider-tools.js

@@ -74,11 +74,13 @@ function codePoints(text, count) {
 /**
  * A provider's error text as a failed call exports it under content capture: credentials
  * scrubbed first, then at most 1,024 code points with `…` marking a cut, lone surrogates
- * replaced and NUL removed. The Python SDK produces the same text.
+ * replaced and NUL removed. Only the first 16,384 code points are scrubbed, and what that cut
+ * interrupts (a quoted value, a URL, a prefixed token) is redacted to it. The Python SDK
+ * produces the same text.
  */
 export function providerErrorDescription(value) {
     const scanned = codePoints(value.toWellFormed().replaceAll("\u0000", ""), MAX_ERROR_SCAN);
-    const bounded = codePoints(scrubCredentialText(scanned.text), MAX_ERROR_TEXT);
+    const bounded = codePoints(scrubCredentialText(scanned.text, scanned.cut), MAX_ERROR_TEXT);
     return bounded.cut || scanned.cut ? `${bounded.text}…` : bounded.text;
 }
 /** An OpenAI MCP call's `error`: its text, or an error object's string `message`. */

package/dist/tool-definitions.d.ts

@@ -1,3 +1,6 @@
+/** Whether a field name names a credential: one of `credentialKeys`, or a name ending in `token`,
+ * `secret`, `password`, `apikey` or `credential`, ignoring case, `-` and `_`. */
+export declare function isCredentialKey(key: string): boolean;
 /**
  * Removes credentials from free text a provider returned, such as an MCP call's error message,
  * with the rules tool definitions use, extended for text: each `http`, `https`, `ws`, `wss` or
@@ -6,10 +9,18 @@
  * becomes `[redacted]` when it has an `@`, `?` or `#`; a token with a known credential prefix
  * (`hue_sk_`, `sk-`, `xoxb-`, `ya29.` and others), the credential after an authorization scheme
  * (`Bearer`, `Basic`, `Token`), the whole value of an `Authorization` header, and the value of a
- * `key=value` or `key: value` pair whose key names a credential (quoted, escaped-quoted or bare)
- * become `[redacted]`.
+ * `key=value`, `key: value` or `key => value` pair whose key names a credential (quoted,
+ * escaped-quoted, bare, or a whole `[…]` or `{…}`) become `[redacted]`. A JSON or `%` escape
+ * (`\n`, `\u0022`, `%20`) ends a word as a space does. A quote that does not close on its line
+ * runs to the end of the line, and a URL's quoted query value is replaced whole. `cut` says the
+ * text was cut from a longer one, so a URL or prefixed token that runs to its end is replaced
+ * whole, as is the word of scheme characters it ends in, which may start a URL's scheme. Only the
+ * first 16,384 code points are read: a longer text is cut there, and `…` marks it.
  */
-export declare function scrubCredentialText(text: string): string;
+export declare function scrubCredentialText(text: string, cut?: boolean): string;
+/** `scrubCredentialText` without its bound on the text's length, for tests that time long texts;
+ * callers use `scrubCredentialText`. */
+export declare function scrubCredentialTextUnbounded(text: string, cut?: boolean): string;
 /**
  * Removes hosted-tool credentials from an exported attribute value, before the caller's `redact`.
  * Tool definitions come from OpenTelemetry GenAI (`gen_ai.tool.definitions`), AI SDK 6