agent-inspect 6.14.1 → 6.15.0

package/packages/cli/dist/index.cjs

@@ -6354,6 +6354,136 @@ var init_resolve2 = __esm({
   }
 });
 
+// packages/core/src/diagnostics/programmatic.ts
+function formatProgrammaticDiagnostic(code, detail) {
+  const spec = PROGRAMMATIC_DIAGNOSTIC_SPECS[code];
+  const summary = detail?.trim() ? detail.trim() : spec.summary;
+  return `${code}: ${summary} Remediation: ${spec.remediation}`;
+}
+var PROGRAMMATIC_DIAGNOSTIC_SPECS;
+var init_programmatic = __esm({
+  "packages/core/src/diagnostics/programmatic.ts"() {
+    PROGRAMMATIC_DIAGNOSTIC_SPECS = Object.freeze({
+      AI_TRACE_INPUT_INVALID: {
+        code: "AI_TRACE_INPUT_INVALID",
+        summary: 'Expected { type: "file", path }, { type: "directory", path }, { type: "string", content }, { type: "buffer", content }, or { type: "stdin" }.',
+        remediation: "For a file path, use openTraceFile(path).",
+        relatedCodes: ["invalid_input"]
+      },
+      AI_TRACE_FORMAT_UNSUPPORTED: {
+        code: "AI_TRACE_FORMAT_UNSUPPORTED",
+        summary: "No trace reader could detect the input format.",
+        remediation: "Pass an AgentInspect JSONL file via openTraceFile, or set options.format to a registered reader.",
+        relatedCodes: ["unsupported_format"]
+      },
+      AI_TRACE_FORMAT_AMBIGUOUS: {
+        code: "AI_TRACE_FORMAT_AMBIGUOUS",
+        summary: "Multiple trace readers matched the input with equal confidence.",
+        remediation: "Set options.format explicitly to disambiguate the reader.",
+        relatedCodes: ["ambiguous_format"]
+      },
+      AI_TRACE_FACTS_INPUT_NOT_NORMALIZED: {
+        code: "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED",
+        summary: "TraceFacts requires TraceReadResult or PersistedInspectEvent[].",
+        remediation: "Use openTraceFile() to normalize a JSONL trace first."
+      },
+      AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED: {
+        code: "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
+        summary: "Multiple runs are available; select a run before executing checks.",
+        remediation: "Pass options.runId or TraceCheckInput.selectedRun.",
+        relatedCodes: ["AI_CHECK_RUN_SELECTION_REQUIRED"]
+      },
+      AI_TRACE_RELATIONSHIP_SELF_PARENT: {
+        code: "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+        summary: "A parentId equals its own event/step id.",
+        remediation: "Reject at capture (AI_LANGGRAPH_SELF_PARENT_REJECTED) or drop via logical projection; do not invent replacement parents.",
+        relatedCodes: [
+          "AI_LANGGRAPH_SELF_PARENT_REJECTED",
+          "AI_LOGICAL_SELF_PARENT_REMOVED"
+        ]
+      },
+      AI_TRACE_RELATIONSHIP_CYCLE: {
+        code: "AI_TRACE_RELATIONSHIP_CYCLE",
+        summary: "Trace contains a parentId cycle.",
+        remediation: "Use visibility-first tree linking for legacy fixtures; prefer acyclic capture for new adapter output.",
+        relatedCodes: ["structure.cycle"]
+      }
+    });
+  }
+});
+
+// packages/core/src/safety/sensitive-key.ts
+function normalizeSensitiveKey(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+}
+function isTokenCredentialKey(normalized) {
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  if (normalized === "token") return true;
+  if (normalized.endsWith("tokens")) return false;
+  return normalized.endsWith("token");
+}
+function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
+  if (!key) return false;
+  const normalized = normalizeSensitiveKey(key);
+  if (!normalized) return false;
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  for (const sensitive of sensitiveKeys) {
+    const s = normalizeSensitiveKey(sensitive);
+    if (!s) continue;
+    if (s === "token") {
+      if (isTokenCredentialKey(normalized)) return true;
+      continue;
+    }
+    if (normalized === s) return true;
+    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+  }
+  return false;
+}
+var NON_CREDENTIAL_TOKEN_CONFIG_KEYS, DEFAULT_CREDENTIAL_SENSITIVE_KEYS;
+var init_sensitive_key = __esm({
+  "packages/core/src/safety/sensitive-key.ts"() {
+    NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
+      [
+        "tokens",
+        "max_tokens",
+        "min_tokens",
+        "ls_max_tokens",
+        "token_count",
+        "token_limit",
+        "token_budget",
+        "input_tokens",
+        "output_tokens",
+        "total_tokens",
+        "cached_tokens",
+        "prompt_tokens",
+        "completion_tokens"
+      ].map(normalizeSensitiveKey)
+    );
+    DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
+      "authorization",
+      "cookie",
+      "token",
+      "access_token",
+      "accesstoken",
+      "auth_token",
+      "authtoken",
+      "refresh_token",
+      "refreshtoken",
+      "id_token",
+      "idtoken",
+      "bearer_token",
+      "bearertoken",
+      "api_token",
+      "apitoken",
+      "apikey",
+      "api_key",
+      "password",
+      "secret",
+      "email"
+    ];
+  }
+});
+
 // packages/core/src/checks/logical-events.ts
 function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -6549,6 +6679,26 @@ function projectLogicalEvents(events) {
       }
     }
     if (!remapped) {
+      if (originalParentId === event.eventId) {
+        diagnostics.push({
+          code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+          message: formatProgrammaticDiagnostic(
+            "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+            `Removed self-parent edge on ${event.eventId}.`
+          ),
+          eventIds: [event.eventId]
+        });
+        const { parentId: _drop, ...rest } = event;
+        normalized.push({
+          ...rest,
+          projection: {
+            ...event.projection,
+            parentNormalized: true,
+            originalParentId
+          }
+        });
+        continue;
+      }
       if (!logicalById.has(originalParentId) && !logicalByRawId.has(originalParentId)) {
         const mapping = event.attributes?.parentMapping;
         const unresolved = mapping === "unresolved" || event.attributes?.parentUnresolved === true || event.attributes?.unresolvedParent === true || // LangGraph/framework scaffolding sentinel labels are not event ids.
@@ -6564,6 +6714,26 @@ function projectLogicalEvents(events) {
       normalized.push(event);
       continue;
     }
+    if (nextParent === event.eventId) {
+      diagnostics.push({
+        code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+        message: formatProgrammaticDiagnostic(
+          "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+          `Removed self-parent edge on ${event.eventId} (was ${originalParentId}).`
+        ),
+        eventIds: [event.eventId]
+      });
+      const { parentId: _drop, ...rest } = event;
+      normalized.push({
+        ...rest,
+        projection: {
+          ...event.projection,
+          parentNormalized: true,
+          originalParentId
+        }
+      });
+      continue;
+    }
     diagnostics.push({
       code: "AI_LOGICAL_PARENT_REMAPPED",
       message: `Remapped parent ${originalParentId} \u2192 ${nextParent} for ${event.eventId}.`,
@@ -6614,6 +6784,7 @@ function pickString(record, keys) {
 }
 var init_logical_events = __esm({
   "packages/core/src/checks/logical-events.ts"() {
+    init_programmatic();
   }
 });
 
@@ -6642,7 +6813,11 @@ function summarizeSemanticParity(events) {
 }
 var init_trace_facts = __esm({
   "packages/core/src/checks/trace-facts.ts"() {
+    init_programmatic();
     init_logical_events();
+    formatProgrammaticDiagnostic(
+      "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED"
+    );
   }
 });
 
@@ -6753,7 +6928,13 @@ function resolveSelectedRun(input3, runId) {
   if (input3.read.runs.length === 0) {
     return {
       diagnostics: [
-        diagnostic3("AI_CHECK_RUN_SELECTION_REQUIRED", "No runs are available for checks.")
+        diagnostic3(
+          "AI_CHECK_RUN_SELECTION_REQUIRED",
+          formatProgrammaticDiagnostic(
+            "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
+            "No runs are available for checks."
+          )
+        )
       ]
     };
   }
@@ -6761,7 +6942,7 @@ function resolveSelectedRun(input3, runId) {
     diagnostics: [
       diagnostic3(
         "AI_CHECK_RUN_SELECTION_REQUIRED",
-        "Multiple runs are available; select a run before executing checks."
+        formatProgrammaticDiagnostic("AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED")
       )
     ]
   };
@@ -7017,9 +7198,7 @@ function hasRedactionMarker(value, markers) {
   return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
 }
 function isSensitiveKey(key, sensitiveKeys) {
-  if (!key) return false;
-  const normalized = normalizedKey(key);
-  return sensitiveKeys.some((sensitive) => normalized.includes(normalizedKey(sensitive)));
+  return isCredentialSensitiveKey(key, sensitiveKeys);
 }
 function isRawContentKey(key, forbiddenKeys) {
   if (!key) return false;
@@ -7342,7 +7521,7 @@ function createToolUsageRule(options) {
         }
       }
       const forbidden = new Set(options.forbidden ?? []);
-      const allowed = options.allowed ? new Set(options.allowed) : void 0;
+      const allowed = options.allowed?.length ? new Set(options.allowed) : void 0;
       for (const event of tools) {
         const name = toolName(event);
         if (forbidden.has(name)) {
@@ -7378,9 +7557,9 @@ function createLlmUsageRule(options) {
     evaluate(context) {
       const llms = finishedEvents(context, "LLM");
       const findings = [];
-      const allowedModels = options.allowedModels ? new Set(options.allowedModels) : void 0;
-      const allowedProviders = options.allowedProviders ? new Set(options.allowedProviders) : void 0;
-      const finishReasons = options.finishReasons ? new Set(options.finishReasons) : void 0;
+      const allowedModels = options.allowedModels?.length ? new Set(options.allowedModels) : void 0;
+      const allowedProviders = options.allowedProviders?.length ? new Set(options.allowedProviders) : void 0;
+      const finishReasons = options.finishReasons?.length ? new Set(options.finishReasons) : void 0;
       if (options.maxCalls !== void 0 && llms.length > options.maxCalls) {
         findings.push(
           failFinding(
@@ -7492,7 +7671,7 @@ function createStructureCycleRule() {
               findings.push(
                 failFinding(
                   "structure.cycle",
-                  "Trace contains a parentId cycle.",
+                  formatProgrammaticDiagnostic("AI_TRACE_RELATIONSHIP_CYCLE"),
                   cycle.map((item) => eventEvidence(item, "parentId")),
                   "acyclic parentId graph",
                   cycle.map((item) => item.eventId).sort()
@@ -8059,10 +8238,14 @@ function runTraceChecks(input3, options = {}) {
 var SEVERITY_RANK, STATUS_RANK, CONFIDENCE_RANK, DEFAULT_SENSITIVE_KEYS, DEFAULT_RAW_CONTENT_KEYS, DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES, SAFE_USAGE_LEAF_KEYS, DEFAULT_SECRET_PATTERNS;
 var init_checks2 = __esm({
   "packages/core/src/checks/index.ts"() {
+    init_programmatic();
     init_outcomes();
+    init_sensitive_key();
     init_logical_events();
     init_logical_events();
     init_trace_facts();
+    init_programmatic();
+    init_sensitive_key();
     init_contract();
     SEVERITY_RANK = {
       error: 0,
@@ -8080,16 +8263,7 @@ var init_checks2 = __esm({
       correlated: 2,
       explicit: 3
     };
-    DEFAULT_SENSITIVE_KEYS = [
-      "authorization",
-      "cookie",
-      "token",
-      "apikey",
-      "api_key",
-      "password",
-      "secret",
-      "email"
-    ];
+    DEFAULT_SENSITIVE_KEYS = DEFAULT_CREDENTIAL_SENSITIVE_KEYS;
     DEFAULT_RAW_CONTENT_KEYS = [
       "body",
       "headers",
@@ -8434,6 +8608,20 @@ var init_from_trace_event = __esm({
 function inc(map, key) {
   map[key] = (map[key] ?? 0) + 1;
 }
+function confidenceRank(confidence) {
+  switch (confidence) {
+    case "unknown":
+      return 0;
+    case "heuristic":
+      return 1;
+    case "correlated":
+      return 2;
+    case "explicit":
+      return 3;
+    default:
+      return 0;
+  }
+}
 function computeRunStatus(events) {
   let runTerminal;
   let sawRunEvent = false;
@@ -8454,6 +8642,84 @@ function computeRunStatus(events) {
   }
   return hasRunning ? "running" : "ok";
 }
+function linkNodesVisibilityFirst(nodes) {
+  let selfParentCount = 0;
+  let unresolvedParentCount = 0;
+  let normalizedEdgeCount = 0;
+  let cycleCount = 0;
+  const pending = [];
+  for (const node of nodes.values()) {
+    const parentId = node.event.parentId;
+    if (!parentId) continue;
+    if (parentId === node.event.eventId) {
+      selfParentCount += 1;
+      normalizedEdgeCount += 1;
+      continue;
+    }
+    if (!nodes.has(parentId)) {
+      unresolvedParentCount += 1;
+      continue;
+    }
+    pending.push({
+      childId: node.event.eventId,
+      parentId,
+      childTimestamp: node.event.timestamp,
+      childConfidence: node.event.confidence
+    });
+  }
+  pending.sort((a, b) => {
+    const conf = confidenceRank(b.childConfidence) - confidenceRank(a.childConfidence);
+    if (conf !== 0) return conf;
+    return a.childTimestamp - b.childTimestamp;
+  });
+  const parentOf = /* @__PURE__ */ new Map();
+  for (const edge of pending) {
+    parentOf.set(edge.childId, edge.parentId);
+    let cursor = edge.parentId;
+    const seen = /* @__PURE__ */ new Set([edge.childId]);
+    let cyclic = false;
+    while (cursor) {
+      if (seen.has(cursor)) {
+        cyclic = true;
+        break;
+      }
+      seen.add(cursor);
+      cursor = parentOf.get(cursor);
+    }
+    if (cyclic) {
+      parentOf.delete(edge.childId);
+      cycleCount += 1;
+      normalizedEdgeCount += 1;
+    }
+  }
+  for (const [childId, parentId] of parentOf) {
+    nodes.get(parentId).children.push(nodes.get(childId));
+  }
+  const roots = [];
+  for (const node of nodes.values()) {
+    if (!parentOf.has(node.event.eventId)) {
+      roots.push(node);
+    }
+  }
+  const assignDepth = (n, depth, stack) => {
+    if (stack.has(n.event.eventId)) return;
+    n.depth = depth;
+    stack.add(n.event.eventId);
+    for (const c of n.children) assignDepth(c, depth + 1, stack);
+    stack.delete(n.event.eventId);
+  };
+  for (const r of roots) assignDepth(r, 0, /* @__PURE__ */ new Set());
+  return {
+    roots,
+    summary: {
+      rootCount: roots.length,
+      selfParentCount,
+      cycleCount,
+      unresolvedParentCount,
+      normalizedEdgeCount
+    }
+  };
+}
 var TreeBuilder;
 var init_tree_builder = __esm({
   "packages/core/src/logs/tree-builder.ts"() {
@@ -8474,20 +8740,7 @@ var init_tree_builder = __esm({
           for (const e of sorted) {
             nodes.set(e.eventId, { event: e, children: [], depth: 0 });
           }
-          const roots = [];
-          for (const node of nodes.values()) {
-            const parentId = node.event.parentId;
-            if (parentId && nodes.has(parentId)) {
-              nodes.get(parentId).children.push(node);
-            } else {
-              roots.push(node);
-            }
-          }
-          const assignDepth = (n, depth) => {
-            n.depth = depth;
-            for (const c of n.children) assignDepth(c, depth + 1);
-          };
-          for (const r of roots) assignDepth(r, 0);
+          const { roots, summary } = linkNodesVisibilityFirst(nodes);
           const confidenceBreakdown = {
             explicit: 0,
             correlated: 0,
@@ -8515,7 +8768,8 @@ var init_tree_builder = __esm({
             metadata: {
               totalEvents: sorted.length,
               confidenceBreakdown,
-              kinds
+              kinds,
+              relationshipSummary: summary
             }
           });
         }
@@ -8683,6 +8937,35 @@ var init_tree_bridge = __esm({
     init_to_inspect_event();
   }
 });
+function isTraceInput(input3) {
+  if (typeof input3 !== "object" || input3 === null || Array.isArray(input3)) {
+    return false;
+  }
+  const record = input3;
+  switch (record.type) {
+    case "file":
+    case "directory":
+      return typeof record.path === "string";
+    case "string":
+      return typeof record.content === "string";
+    case "buffer":
+      return Buffer.isBuffer(record.content);
+    case "stdin":
+      return true;
+    default:
+      return false;
+  }
+}
+function assertTraceInput(input3) {
+  if (isTraceInput(input3)) return;
+  throw new TraceReadError("invalid_input", TRACE_INPUT_INVALID_MESSAGE, [
+    {
+      code: "AI_TRACE_INPUT_INVALID",
+      message: TRACE_INPUT_INVALID_MESSAGE,
+      severity: "error"
+    }
+  ]);
+}
 function normalizeCandidate(reader, candidate) {
   const confidence = Number.isFinite(candidate.confidence) ? Math.max(0, Math.min(1, candidate.confidence)) : 0;
   return {
@@ -9829,6 +10112,7 @@ function mapOtlpEventsToPersisted(document) {
   };
 }
 async function detectTraceFormat(input3, options = {}) {
+  assertTraceInput(input3);
   const readers = options.readers ?? DEFAULT_TRACE_READERS;
   if (options.format !== void 0) {
     const reader = findReaderByFormat(options.format, readers);
@@ -9925,19 +10209,20 @@ async function detectTraceFormat(input3, options = {}) {
   };
 }
 async function readTrace(input3, options = {}) {
+  assertTraceInput(input3);
   const readers = options.readers ?? DEFAULT_TRACE_READERS;
   const detection = await detectTraceFormat(input3, options);
   if (detection.status === "unsupported" || detection.format === void 0) {
     throw new TraceReadError(
       "unsupported_format",
-      "No trace reader could detect the input format.",
+      formatProgrammaticDiagnostic("AI_TRACE_FORMAT_UNSUPPORTED"),
       detection.warnings
     );
   }
   if (detection.status === "ambiguous") {
     throw new TraceReadError(
       "ambiguous_format",
-      "Multiple trace readers matched the input with equal confidence.",
+      formatProgrammaticDiagnostic("AI_TRACE_FORMAT_AMBIGUOUS"),
       detection.warnings
     );
   }
@@ -9945,7 +10230,10 @@ async function readTrace(input3, options = {}) {
   if (!reader) {
     throw new TraceReadError(
       "unsupported_format",
-      `No trace reader is registered for format "${detection.format}".`,
+      formatProgrammaticDiagnostic(
+        "AI_TRACE_FORMAT_UNSUPPORTED",
+        `No trace reader is registered for format "${detection.format}".`
+      ),
       detection.warnings
     );
   }
@@ -9974,12 +10262,13 @@ async function readTrace(input3, options = {}) {
 function openTrace(input3, options = {}) {
   return readTrace(input3, options);
 }
-var DEFAULT_MAX_TRACE_INPUT_BYTES, MIN_DETECTION_CONFIDENCE, AMBIGUOUS_CONFIDENCE_DELTA, resolvedInputCache, OPENINFERENCE_READER_FORMAT, OTLP_READER_FORMAT, OPENINFERENCE_SPAN_KEYS, OPENINFERENCE_SENSITIVE_ATTRIBUTE_KEYS, OTLP_SPAN_KEYS, TraceReadError, openInferenceJsonReader, otlpJsonReader, agentInspectJsonlReader, DEFAULT_TRACE_READERS;
+var DEFAULT_MAX_TRACE_INPUT_BYTES, MIN_DETECTION_CONFIDENCE, AMBIGUOUS_CONFIDENCE_DELTA, resolvedInputCache, OPENINFERENCE_READER_FORMAT, OTLP_READER_FORMAT, OPENINFERENCE_SPAN_KEYS, OPENINFERENCE_SENSITIVE_ATTRIBUTE_KEYS, OTLP_SPAN_KEYS, TraceReadError, TRACE_INPUT_INVALID_MESSAGE, openInferenceJsonReader, otlpJsonReader, agentInspectJsonlReader, DEFAULT_TRACE_READERS;
 var init_readers = __esm({
   "packages/core/src/readers/index.ts"() {
     init_read_trace();
     init_from_trace_event();
     init_tree_bridge();
+    init_programmatic();
     DEFAULT_MAX_TRACE_INPUT_BYTES = 10 * 1024 * 1024;
     MIN_DETECTION_CONFIDENCE = 0.5;
     AMBIGUOUS_CONFIDENCE_DELTA = 0.05;
@@ -10053,6 +10342,9 @@ var init_readers = __esm({
         this.warnings = warnings;
       }
     };
+    TRACE_INPUT_INVALID_MESSAGE = formatProgrammaticDiagnostic(
+      "AI_TRACE_INPUT_INVALID"
+    );
     openInferenceJsonReader = {
       format: OPENINFERENCE_READER_FORMAT,
       name: "OpenInference JSON",
@@ -12193,7 +12485,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.14.1";
+var version = "6.15.0";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -12523,6 +12815,7 @@ init_tree_bridge();
 
 // packages/core/src/entries/readers.ts
 init_readers();
+init_programmatic();
 
 // packages/cli/src/read-run.ts
 function mapReaderFormat(format) {
@@ -15540,7 +15833,7 @@ async function searchCommand(options = {}) {
     }
     console.log(`Search results (${results.length})`);
     for (const r of results) {
-      const step = r.stepName !== void 0 ? ` | ${r.stepType ?? "step"}:${r.stepName}` : "";
+      const step = r.stepName !== void 0 ? ` | ${formatStepLabel(r.stepType ?? "step", r.stepName)}` : "";
       const dur = r.durationMs !== void 0 ? ` | ${r.durationMs}ms` : "";
       console.log(
         `${r.runId}${step} | ${r.runStatus}${dur} | ${r.matchReason}`
@@ -16083,6 +16376,53 @@ async function reportCommand(runId, options = {}) {
 
 // packages/cli/src/redact.ts
 init_advanced();
+
+// packages/redact/src/sensitive-key.ts
+function normalizeSensitiveKey2(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+}
+var NON_CREDENTIAL_TOKEN_CONFIG_KEYS2 = new Set(
+  [
+    "tokens",
+    "max_tokens",
+    "min_tokens",
+    "ls_max_tokens",
+    "token_count",
+    "token_limit",
+    "token_budget",
+    "input_tokens",
+    "output_tokens",
+    "total_tokens",
+    "cached_tokens",
+    "prompt_tokens",
+    "completion_tokens"
+  ].map(normalizeSensitiveKey2)
+);
+function isTokenCredentialKey2(normalized) {
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS2.has(normalized)) return false;
+  if (normalized === "token") return true;
+  if (normalized.endsWith("tokens")) return false;
+  return normalized.endsWith("token");
+}
+function isCredentialSensitiveKey2(key, sensitiveKeys) {
+  if (!key) return false;
+  const normalized = normalizeSensitiveKey2(key);
+  if (!normalized) return false;
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS2.has(normalized)) return false;
+  for (const sensitive of sensitiveKeys) {
+    const s = normalizeSensitiveKey2(sensitive);
+    if (!s) continue;
+    if (s === "token") {
+      if (isTokenCredentialKey2(normalized)) return true;
+      continue;
+    }
+    if (normalized === s) return true;
+    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+  }
+  return false;
+}
+
+// packages/redact/src/index.ts
 var DEFAULT_REDACT_KEYS2 = [
   "authorization",
   "cookie",
@@ -16144,6 +16484,12 @@ function isRecord15(value) {
 function toKey2(key) {
   return key.toLowerCase();
 }
+function findCompiledKeyRule(key, rules) {
+  const exact = toKey2(key);
+  const direct = rules.find((candidate) => candidate.key === exact);
+  if (direct) return direct;
+  return rules.find((candidate) => isCredentialSensitiveKey2(key, [candidate.key]));
+}
 function stableHash2(value) {
   const hash = crypto__default.default.createHash("sha256").update(value, "utf8").digest("hex");
   return hash.slice(0, 8);
@@ -16465,7 +16811,7 @@ var Redactor2 = class {
       return "[Truncated]";
     }
     if (key !== void 0) {
-      const rule = this.#rules.find((candidate) => candidate.key === toKey2(key));
+      const rule = findCompiledKeyRule(key, this.#rules);
       if (rule) {
         this.#recordFinding(
           state,