agent-inspect 1.2.0 → 1.3.0

package/packages/cli/dist/index.mjs

@@ -467,7 +467,7 @@ function stableHash(value) {
   const h = crypto.createHash("sha256").update(value, "utf8").digest("hex");
   return h.slice(0, 8);
 }
-function compileRules(rules) {
+function compileRules(rules, extraKeys) {
   const out = /* @__PURE__ */ new Map();
   const set = (r) => {
     const k = toKey(r.key);
@@ -476,6 +476,11 @@ function compileRules(rules) {
   for (const k of DEFAULT_REDACT_KEYS) {
     set({ key: k, strategy: "full" });
   }
+  for (const k of extraKeys ?? []) {
+    if (typeof k === "string" && k.length > 0) {
+      set({ key: k, strategy: "full" });
+    }
+  }
   for (const r of rules ?? []) {
     if (typeof r === "string") {
       set({ key: r, strategy: "full" });
@@ -493,7 +498,7 @@ function compileRules(rules) {
 var Redactor = class {
   #rules;
   constructor(options) {
-    this.#rules = compileRules(options?.rules);
+    this.#rules = compileRules(options?.rules, options?.extraKeys);
   }
   redactValue(key, value) {
     const k = toKey(key);
@@ -1195,6 +1200,91 @@ function warn(message, error) {
   }
   console.warn(`${base}: ${formatError(error).message}`);
 }
+
+// packages/core/src/redaction-profiles.ts
+var SHARE_PROFILE_EXTRA_KEYS = [
+  "userEmail",
+  "customerEmail",
+  "phone",
+  "phoneNumber",
+  "address",
+  "ip",
+  "ipAddress",
+  "sessionId",
+  "requestId",
+  "correlationId",
+  "decisionId",
+  "groupId",
+  "customerId",
+  "userId",
+  "accountId",
+  "tenantId",
+  "orgId",
+  "organizationId",
+  "traceId",
+  "spanId",
+  "parentSpanId"
+];
+var STRICT_PROFILE_EXTRA_KEYS = [
+  "prompt",
+  "completion",
+  "input",
+  "output",
+  "inputPreview",
+  "outputPreview",
+  "message",
+  "messages",
+  "transcript",
+  "context",
+  "document",
+  "documents",
+  "chunk",
+  "chunks",
+  "retrieval",
+  "query"
+];
+function resolveRedactionProfile(profile = "local") {
+  switch (profile) {
+    case "local":
+      return { profile: "local", extraKeys: [] };
+    case "share":
+      return {
+        profile: "share",
+        extraKeys: SHARE_PROFILE_EXTRA_KEYS,
+        maxMetadataValueLengthCap: 500,
+        maxPreviewLengthCap: 200
+      };
+    case "strict":
+      return {
+        profile: "strict",
+        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS, ...STRICT_PROFILE_EXTRA_KEYS],
+        maxMetadataValueLengthCap: 200,
+        maxPreviewLengthCap: 80
+      };
+    default:
+      return { profile: "local", extraKeys: [] };
+  }
+}
+function isPreviewKey(key) {
+  return key.toLowerCase().includes("preview");
+}
+function applyProfileMetadataCaps(maxMetadataValueLength, maxPreviewLength, resolved) {
+  let meta = maxMetadataValueLength;
+  let preview = maxPreviewLength;
+  if (resolved.maxMetadataValueLengthCap !== void 0) {
+    meta = Math.min(meta, resolved.maxMetadataValueLengthCap);
+  }
+  if (resolved.maxPreviewLengthCap !== void 0) {
+    preview = Math.min(preview, resolved.maxPreviewLengthCap);
+  }
+  return { maxMetadataValueLength: meta, maxPreviewLength: preview };
+}
+function truncateStringForProfile(value, key, maxMetadataValueLength, maxPreviewLength) {
+  const max = isPreviewKey(key) ? maxPreviewLength : maxMetadataValueLength;
+  if (max <= 0) return "\u2026";
+  if (value.length <= max) return value;
+  return `${value.slice(0, max)}\u2026`;
+}
 function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1345,7 +1435,7 @@ var DEFAULT_MAX_EVENT_BYTES = 65536;
 function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isPreviewKey(key) {
+function isPreviewKey2(key) {
   return key.toLowerCase().includes("preview");
 }
 function truncateString(value, maxLen) {
@@ -1362,11 +1452,28 @@ function resolveTraceSafetyOptions(options) {
   {
     redactEnabled = true;
   }
+  const profile = options?.redactionProfile ?? "local";
+  const resolvedProfile = resolveRedactionProfile(profile);
+  const userMaxMetadata = "undefined" === "number" && Number.isFinite(options.maxMetadataValueLength) && options.maxMetadataValueLength >= 0 ? Math.floor(options.maxMetadataValueLength) : void 0;
+  const userMaxPreview = "undefined" === "number" && Number.isFinite(options.maxPreviewLength) && options.maxPreviewLength >= 0 ? Math.floor(options.maxPreviewLength) : void 0;
+  let maxMetadataValueLength = userMaxMetadata ?? DEFAULT_MAX_METADATA_VALUE_LENGTH;
+  let maxPreviewLength = userMaxPreview ?? DEFAULT_MAX_PREVIEW_LENGTH;
+  if (redactEnabled && profile !== "local") {
+    const capped = applyProfileMetadataCaps(
+      maxMetadataValueLength,
+      maxPreviewLength,
+      resolvedProfile
+    );
+    maxMetadataValueLength = capped.maxMetadataValueLength;
+    maxPreviewLength = capped.maxPreviewLength;
+  }
   return {
     redactEnabled,
     redactionRules,
-    maxMetadataValueLength: "undefined" === "number" && Number.isFinite(options.maxMetadataValueLength) && options.maxMetadataValueLength >= 0 ? Math.floor(options.maxMetadataValueLength) : DEFAULT_MAX_METADATA_VALUE_LENGTH,
-    maxPreviewLength: "undefined" === "number" && Number.isFinite(options.maxPreviewLength) && options.maxPreviewLength >= 0 ? Math.floor(options.maxPreviewLength) : DEFAULT_MAX_PREVIEW_LENGTH,
+    redactionProfile: profile,
+    profileExtraKeys: redactEnabled ? resolvedProfile.extraKeys : [],
+    maxMetadataValueLength,
+    maxPreviewLength,
     maxEventBytes: "undefined" === "number" && Number.isFinite(options.maxEventBytes) && options.maxEventBytes > 0 ? Math.floor(options.maxEventBytes) : DEFAULT_MAX_EVENT_BYTES
   };
 }
@@ -1374,7 +1481,7 @@ function boundMetadataValue(key, value, opts, seen, depth) {
   if (depth > 32) return "[MaxDepth]";
   if (value === null || typeof value !== "object") {
     if (typeof value === "string") {
-      const max = isPreviewKey(key) ? opts.maxPreviewLength : opts.maxMetadataValueLength;
+      const max = isPreviewKey2(key) ? opts.maxPreviewLength : opts.maxMetadataValueLength;
       return truncateString(value, max);
     }
     return value;
@@ -1400,7 +1507,10 @@ function boundMetadataValue(key, value, opts, seen, depth) {
 }
 function redactMetadata(metadata, opts) {
   if (!opts.redactEnabled) return { ...metadata };
-  const redactor = new Redactor({ rules: opts.redactionRules });
+  const redactor = new Redactor({
+    rules: opts.redactionRules,
+    extraKeys: opts.profileExtraKeys
+  });
   return redactor.redactRecord(metadata);
 }
 function prepareMetadataForDisk(metadata, opts) {
@@ -3207,6 +3317,134 @@ Object.assign(stepImpl, {
 // packages/core/src/exporters/types.ts
 var EXPORT_PAYLOAD_VERSION = "0.1.2";
 
+// packages/core/src/exporters/redact-export.ts
+function isRecord9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepClone(value) {
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => deepClone(item));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = deepClone(v);
+  }
+  return out;
+}
+function boundAttributeValues(record, maxMetadataValueLength, maxPreviewLength, seen, depth) {
+  if (depth > 32) {
+    return { truncated: true, reason: "maxDepth" };
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(record)) {
+    out[key] = boundValue(value, key, maxMetadataValueLength, maxPreviewLength, seen, depth);
+  }
+  return out;
+}
+function boundValue(value, key, maxMetadataValueLength, maxPreviewLength, seen, depth) {
+  if (value === null || typeof value !== "object") {
+    if (typeof value === "string") {
+      return truncateStringForProfile(
+        value,
+        key,
+        maxMetadataValueLength,
+        maxPreviewLength
+      );
+    }
+    return value;
+  }
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.slice(0, 50).map(
+      (item, index) => boundValue(
+        item,
+        String(index),
+        maxMetadataValueLength,
+        maxPreviewLength,
+        seen,
+        depth + 1
+      )
+    );
+  }
+  return boundAttributeValues(
+    value,
+    maxMetadataValueLength,
+    maxPreviewLength,
+    seen,
+    depth + 1
+  );
+}
+function redactEventAttributes(attrs, redactor, maxMetadataValueLength, maxPreviewLength) {
+  if (!attrs || Object.keys(attrs).length === 0) {
+    return attrs;
+  }
+  const redacted = redactor.redactRecord(attrs);
+  const seen = /* @__PURE__ */ new WeakSet();
+  const bounded = boundAttributeValues(
+    redacted,
+    maxMetadataValueLength,
+    maxPreviewLength,
+    seen,
+    0
+  );
+  const err = bounded.error;
+  if (isRecord9(err) && typeof err.message === "string") {
+    bounded.error = {
+      ...err,
+      message: truncateStringForProfile(
+        err.message,
+        "message",
+        maxMetadataValueLength,
+        maxPreviewLength
+      ),
+      ...typeof err.stack === "string" ? {
+        stack: truncateStringForProfile(
+          err.stack,
+          "stack",
+          maxMetadataValueLength,
+          maxPreviewLength
+        )
+      } : {}
+    };
+  }
+  return bounded;
+}
+function redactRunTreeForExport(tree, options) {
+  const profile = options?.redactionProfile ?? "local";
+  if (profile === "local") {
+    return deepClone(tree);
+  }
+  const resolved = resolveRedactionProfile(profile);
+  const { maxMetadataValueLength, maxPreviewLength } = applyProfileMetadataCaps(
+    2e3,
+    500,
+    resolved
+  );
+  const redactor = new Redactor({ extraKeys: resolved.extraKeys });
+  const clone = deepClone(tree);
+  function walk(nodes) {
+    for (const node of nodes) {
+      if (node.event.attributes !== void 0) {
+        node.event.attributes = redactEventAttributes(
+          node.event.attributes,
+          redactor,
+          maxMetadataValueLength,
+          maxPreviewLength
+        );
+      }
+      if (node.children.length > 0) {
+        walk(node.children);
+      }
+    }
+  }
+  walk(clone.children);
+  return clone;
+}
+
 // packages/core/src/exporters/html-exporter.ts
 function renderTreeHtml(nodes, ulClass = "tree") {
   if (nodes.length === 0) return "";
@@ -3941,20 +4179,22 @@ function mergeExportDefaults(options) {
     includeErrors: options.includeErrors ?? true,
     pretty: options.pretty,
     redacted: options.redacted,
-    maxAttributeLength: options.maxAttributeLength
+    maxAttributeLength: options.maxAttributeLength,
+    redactionProfile: options.redactionProfile ?? "local"
   };
 }
 function exportRunTree(tree, options) {
   const opts = mergeExportDefaults(options);
+  const exportTree = opts.redactionProfile === "local" ? tree : redactRunTreeForExport(tree, { redactionProfile: opts.redactionProfile });
   switch (opts.format) {
     case "markdown":
-      return exportMarkdown(tree, opts);
+      return exportMarkdown(exportTree, opts);
     case "html":
-      return exportHtml(tree, opts);
+      return exportHtml(exportTree, opts);
     case "openinference":
-      return exportOpenInference(tree, opts);
+      return exportOpenInference(exportTree, opts);
     case "otlp-json":
-      return exportOtlpJson(tree, opts);
+      return exportOtlpJson(exportTree, opts);
     default: {
       const _x = opts.format;
       throw new Error(`Unsupported export format: ${String(_x)}`);
@@ -4790,6 +5030,15 @@ async function tail(options = {}) {
     process.exitCode = 1;
   }
 }
+function parseRedactionProfile(s) {
+  const v = (s ?? "local").trim().toLowerCase();
+  if (v === "local" || v === "share" || v === "strict") {
+    return v;
+  }
+  throw new Error(
+    `Unsupported --redaction-profile "${s ?? ""}". Use local, share, or strict.`
+  );
+}
 function parseExportFormat(s) {
   const v = (s ?? "markdown").trim().toLowerCase();
   if (v === "markdown" || v === "html" || v === "openinference" || v === "otlp-json") {
@@ -4807,8 +5056,10 @@ async function exportCommand(runId, options = {}) {
     return;
   }
   let format;
+  let redactionProfile;
   try {
     format = parseExportFormat(options.format);
+    redactionProfile = parseRedactionProfile(options.redactionProfile);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     console.error(msg);
@@ -4847,7 +5098,8 @@ Trace directory: ${traceDir}`);
     includeErrors: options.noErrors === true ? false : true,
     pretty: true,
     redacted: true,
-    maxAttributeLength: 500
+    maxAttributeLength: 500,
+    redactionProfile
   };
   const result = exportRunTree(tree, exportOpts);
   const validation = options.validate === true ? validateExport(result) : void 0;
@@ -5080,7 +5332,12 @@ function createCliProgram() {
       "openinference",
       "otlp-json"
     ])
-  ).option("-o, --output <path>", "write export to file (creates parent dirs)").option("--json", "emit JSON wrapper about the export (includes content when writing to stdout)").option("--validate", "validate exported payload shape after generation").option("--include-attributes", "include bounded attributes (review before sharing)").option("--no-metadata", "omit summary / metadata sections").option("--no-errors", "omit error sections").action((runId, opts) => {
+  ).option("-o, --output <path>", "write export to file (creates parent dirs)").option("--json", "emit JSON wrapper about the export (includes content when writing to stdout)").option("--validate", "validate exported payload shape after generation").option("--include-attributes", "include bounded attributes (review before sharing)").option("--no-metadata", "omit summary / metadata sections").option("--no-errors", "omit error sections").addOption(
+    new Option(
+      "--redaction-profile <profile>",
+      "redaction profile for exported copies: local, share, strict (default: local)"
+    ).choices(["local", "share", "strict"])
+  ).action((runId, opts) => {
     runCommand(() => exportCommand(runId, opts));
   });
   program.command("diff").description("Compare two local AgentInspect JSONL traces (read-only)").argument("<left-run-id>", "first run id").argument("<right-run-id>", "second run id").option("--dir <path>", "trace directory").option("--json", "print diff result as JSON").option("--ignore-duration", "omit duration comparisons").option(