agent-inspect 6.17.2 → 6.17.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 6.17.4
+
+### Patch Changes
+
+- c4b0f03: Fix camelCase / kebab / dot compound credential key redaction (`userPassword`, `clientSecret`) while keeping token-config keys and camelCase topic fields (`emailNote`) un-key-redacted.
+
+## 6.17.3
+
+### Patch Changes
+
+- 737bb03: Docs updates (README mark/loop, case-study template, Evidence retention guidance, support reproduction), TraceFacts/Evidence/OTLP/CLI regression tests, and exclude the RUN boundary from `run.slowestNode`.
+
 ## 6.17.2
 
 ### Patch Changes

package/README.md

@@ -1,11 +1,8 @@
 <p align="center">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/rajudandigam/agent-inspect/main/docs/assets/agent-inspect-logo-dark.svg?sanitize=true">
-    <img src="https://raw.githubusercontent.com/rajudandigam/agent-inspect/main/docs/assets/agent-inspect-logo.svg?sanitize=true" width="240" alt="AgentInspect">
-  </picture>
+  <img src="https://raw.githubusercontent.com/rajudandigam/agent-inspect/main/docs/assets/agent-inspect-logo-mark.svg?sanitize=true" width="56" height="56" alt="AgentInspect">
 </p>
-
-<p align="center"><strong>Local-first evidence for TypeScript AI agents</strong></p>
+<p align="center"><strong>agent-inspect</strong></p>
+<p align="center">Local-first evidence for TypeScript AI agents</p>
 
 <h1 align="center">
   See what your agent did.<br>
@@ -47,7 +44,7 @@ npm install agent-inspect
 Agent code rarely fails as one function call. It plans, retrieves, calls tools, invokes a model, retries, and produces side effects. Flat logs show fragments. AgentInspect keeps the run as local JSONL and gives you one evidence loop from the same trace.
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/rajudandigam/agent-inspect/main/docs/assets/showcase/diagrams/value-loop.svg" alt="Capture or import one local trace, then debug the run, prevent trajectory regressions, and prepare share-checked evidence" width="900">
+  <img src="https://raw.githubusercontent.com/rajudandigam/agent-inspect/main/docs/assets/readme-product-loop.svg?sanitize=true" alt="Capture one local trace, then debug, prevent, and share from the same evidence loop" width="900">
 </p>
 
 ## One trace. Three jobs.
@@ -213,7 +210,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.17.2** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.17.3** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/docs/ADAPTER-CONFORMANCE.md

@@ -58,6 +58,30 @@ This is an internal official-adapter gate, not a third-party certification progr
 
 An adapter can be documented as supported only after no-network fixtures cover run, step, tool, LLM, error, streaming, and metadata-bound expectations for that framework path.
 
+## Third-party adapter conformance CI
+
+The gate above is the internal official-adapter gate, not a third-party certification program. Third-party adapter authors run the **public** conformance helper from [`@agent-inspect/adapter-sdk`](https://www.npmjs.com/package/@agent-inspect/adapter-sdk) in their own CI:
+
+```ts
+import { runAdapterConformance } from "@agent-inspect/adapter-sdk";
+
+const result = await runAdapterConformance({
+  adapterId: "my-adapter",
+  events, // PersistedInspectEvent[] your adapter emits
+  expectedKinds: ["RUN", "LLM"],
+  forbiddenRawStrings: ["super-secret-key"], // must not leak into events
+});
+// assert result.ok in your test runner
+```
+
+A copyable GitHub Actions template lives at [`examples/adapter-sdk/third-party-conformance-ci.yml`](../examples/adapter-sdk/third-party-conformance-ci.yml). Copy it to `.github/workflows/agent-inspect-conformance.yml` in your adapter repo and adjust the install/build/test commands. The template:
+
+- runs on a Node LTS matrix (18 / 20 / 22),
+- requires **no provider keys** and makes **no network calls** (conformance is metadata-only),
+- keeps the framework SDK as a peer dependency of your adapter, never of AgentInspect core.
+
+See the runnable examples under [`examples/adapter-sdk/`](../examples/adapter-sdk/) for adapters that call `runAdapterConformance` end to end.
+
 ## v3.2 adoption evidence refresh
 
 - [AI-SDK-ADOPTION.md](./AI-SDK-ADOPTION.md) — blessed AI SDK path (`generateText`, `streamText`, Next.js recipe, troubleshooting)

package/docs/CI-ARTIFACTS.md

@@ -86,8 +86,9 @@ Recipes:
 
 - [examples/recipes/deterministic-ci-checks](../examples/recipes/deterministic-ci-checks/README.md) for v1.8 `check`, baseline, safe artifact, and step-summary workflows.
 - [examples/recipes/github-actions-artifact](../examples/recipes/github-actions-artifact/README.md) for share-safe trace exports and reporter manifest summaries.
+- [examples/recipes/github-actions-gate](../examples/recipes/github-actions-gate/README.md) for a retained broken-to-fixed suite/gate pilot with separate Evidence v2 artifacts.
 
-Sample workflows: [deterministic checks workflow](../examples/recipes/deterministic-ci-checks/workflow-example.yml), [share-safe export workflow](../examples/recipes/github-actions-artifact/workflow-example.yml)
+Sample workflows: [deterministic checks workflow](../examples/recipes/deterministic-ci-checks/workflow-example.yml), [share-safe export workflow](../examples/recipes/github-actions-artifact/workflow-example.yml), [retained gate workflow](../examples/recipes/github-actions-gate/workflow-example.yml)
 
 ```yaml
 - uses: actions/upload-artifact@v4

package/docs/OPENAI-AGENTS-LOCAL.md

@@ -41,6 +41,20 @@ setTraceProcessors([
 
 - [openai-agents-local-processor](../../examples/recipes/openai-agents-local-processor/)
 
+## No-key packed consumer check
+
+The repository includes a packed-consumer check that installs the root and
+OpenAI Agents adapter tarballs into a temporary project. It drives deterministic
+tracing fixtures without `OPENAI_API_KEY` or a live provider call, writes a local
+trace, and inspects it through the packed AgentInspect CLI.
+
+```bash
+pnpm build
+node scripts/packed-openai-agents-e2e.mjs
+```
+
+The check is also included in `pnpm pack:smoke`.
+
 ## Troubleshooting
 
 | Symptom | Check |

package/docs/SAFE-TRACE-SHARING.md

@@ -28,12 +28,15 @@ Manual traces redact common sensitive keys **before disk** by default. Pass `red
 
 ## Before sharing
 
+When a maintainer or support responder needs reproducible evidence, follow the [safe support reproduction workflow](./SUPPORT-REPRODUCTION.md) to create and review a minimized Evidence bundle. Do not attach a raw trace directory.
+
 - Use **`--redaction-profile share`** for PR/issue attachments; use **`strict`** when sharing outside your team.
 - **Review** the exported file — profiles do not detect all sensitive data.
 - Treat traces written with `redact: false` as sensitive. Review every event before sharing them outside your team.
 - Inspect manual metadata passed to `inspectRun()`, `step()`, `step.tool()`, `step.llm()`, or `observe()`.
 - Inspect log-derived fields from `logs` / `tail` ingest configs, including custom `run-id`, `event`, `parent`, timestamp, and attribute mappings.
 - Avoid posting raw prompts, completions, tool inputs, or tool outputs in public threads unless the content is approved for public disclosure.
+- For cross-system correlation, retain a bounded identifier instead of copying the external record or payload. Follow [External reference metadata](./EXTERNAL-REFERENCES.md), and expect `share` / `strict` profiles to redact the named correlation fields.
 - Prefer Markdown export for issue or PR sharing when a summarized tree is enough.
 
 ## Remove or replace sensitive values

package/docs/SCREENSHOTS.md

@@ -21,7 +21,8 @@ Curated terminal recordings and diagrams for AgentInspect **6.17.x**. They show
 | [debug-tree.gif](assets/showcase/gif/debug-tree.gif) | Debug — `list` then inspect a local run |
 | [check-pass-fail.gif](assets/showcase/gif/check-pass-fail.gif) | Prevent — `check --preset trajectory` plus shorthands, pass then fail |
 | [evidence-bundle.gif](assets/showcase/gif/evidence-bundle.gif) | Share — `bundle --profile share` then `bundle verify` (relative `./evidence`) |
-| [value-loop.svg](assets/showcase/diagrams/value-loop.svg) | Capture once → debug, prevent, share |
+| [readme-product-loop.svg](assets/readme-product-loop.svg) | README loop: one local trace → debug → prevent → share |
+| [value-loop.svg](assets/showcase/diagrams/value-loop.svg) | Alternate stacked Debug / Prevent / Share diagram |
 
 The check tape is named for the `check` command, not `gate`.
 

package/docs/SELF-HOSTING.md

@@ -125,6 +125,8 @@ Postgres URLs are reserved for team deployments and are **not required** for loc
 
 ## Related docs
 
+- [STUDIO-IMPORT-BUNDLE.md](./STUDIO-IMPORT-BUNDLE.md) — walkthrough: share-safe bundle → local Studio
+- [STUDIO-IMPORT-GITHUB-ARTIFACT.md](./STUDIO-IMPORT-GITHUB-ARTIFACT.md) — walkthrough: GitHub Actions artifact → local Studio
 - [SELF-HOSTED-STUDIO-V6.0.md](./proposals/SELF-HOSTED-STUDIO-V6.0.md)
 - [CLIENT-HOSTED-INGESTION-V6.1.md](./proposals/CLIENT-HOSTED-INGESTION-V6.1.md)
 - [LOCAL-TRACE-WORKSPACE.md](./proposals/LOCAL-TRACE-WORKSPACE.md)

package/docs/STANDARDS.md

@@ -21,6 +21,8 @@ Shape validation is **compatible**; semantic checks add field-level warnings for
 
 Fixture: [fixtures/standards/openinference-basic.json](../fixtures/standards/openinference-basic.json)
 
+The fixture's top-level `version` is an **AgentInspect reference fixture revision**, not an upstream OpenInference version.
+
 ## OTLP JSON (experimental)
 
 ```bash
@@ -31,10 +33,23 @@ GenAI attribute mapping follows `OTEL_GEN_AI_SEMCONV_PIN` (see exporters API). N
 
 Fixture: [fixtures/standards/otlp-basic.json](../fixtures/standards/otlp-basic.json)
 
+The fixture's `scope.version` is an **AgentInspect test-scope fixture revision**, not the `OTEL_GEN_AI_SEMCONV_PIN` and not an upstream OpenTelemetry version.
+
 ## Graduation guide
 
 Full path from local export through review to optional customer-owned import: [STANDARDS-GRADUATION.md](./STANDARDS-GRADUATION.md).
 
+That guide is the canonical source for standards known-loss boundaries, including kind degradation, bounded metadata, no chain-of-thought capture, and snapshot limitations.
+
+## Maintaining tested provenance
+
+- When the OTLP mapping changes, update `OTEL_GEN_AI_SEMCONV_PIN` in [`packages/core/src/exporters/semconv.ts`](../packages/core/src/exporters/semconv.ts) and any explicit tested-version claims together.
+- When the OTLP reference shape changes, update its test-scope fixture revision in [`fixtures/standards/otlp-basic.json`](../fixtures/standards/otlp-basic.json) and any repeated fixture revision together.
+- When the OpenInference reference shape changes, update the top-level fixture revision in [`fixtures/standards/openinference-basic.json`](../fixtures/standards/openinference-basic.json) and any repeated fixture revision together. The value remains an AgentInspect fixture revision, not an upstream version.
+- Keep known-loss behavior canonical in [`STANDARDS-GRADUATION.md`](./STANDARDS-GRADUATION.md) and update its validation alongside any intentional exporter behavior change.
+
+Run `pnpm public-truth:check` and `pnpm docs:check` after changing these sources.
+
 ## Import recipes
 
 - [Phoenix / OpenInference](../examples/recipes/phoenix-openinference-import/)

package/docs/SUPPORT-LEVELS.md

@@ -37,6 +37,29 @@ Canonical maturity labels for AgentInspect public packages and major surfaces (6
 
 Part of the fixed AgentInspect release line — see the npm badge for the current version.
 
+> Every level in this matrix must be one of the Definitions levels above, and `docs/product/PUBLIC-PRODUCT-FACTS.json` `matchers.status` must match the matchers row here. `pnpm public-truth:check` enforces both; update the doc and the facts file together.
+
+## Changing a level
+
+A level is stated in two places, and they must not disagree: the row above, and
+the `**Support level:**` line in the package's own README (which is what npm
+shows). `pnpm package-readmes:check` enforces the agreement and runs as part of
+`pnpm docs:check`.
+
+To promote or demote a surface:
+
+1. Edit the row in the matrix above.
+2. Edit the `**Support level:**` line in each affected `packages/*/README.md`.
+3. Run `pnpm package-readmes:check`.
+
+The check also reports packages whose level is **unenforced** — those the matrix
+above does not name, so the README is their only source. Adding a row that names
+the package (in backticks) puts it under enforcement.
+
+It rejects an absolute "no network" claim from any surface
+[NETWORK-BEHAVIOR.md](./NETWORK-BEHAVIOR.md) records as making network calls, so
+a promotion that changes network behavior cannot leave a stale guarantee on npm.
+
 ## Public package groups (presentation only)
 
 Physical packages stay the fixed group of 18. Outreach/install kits group them as:

package/docs/assets/agent-inspect-logo-mark.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" role="img" aria-label="AgentInspect">
+  <defs>
+    <linearGradient id="ai-mark" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#4f46e5"/>
+      <stop offset="100%" stop-color="#6366f1"/>
+    </linearGradient>
+  </defs>
+  <rect width="48" height="48" rx="12" fill="url(#ai-mark)"/>
+  <path d="M16 16h16M16 24h12M16 32h16" stroke="#fff" stroke-width="2.5" stroke-linecap="round"/>
+  <circle cx="36" cy="24" r="5" fill="none" stroke="#fff" stroke-width="2"/>
+  <path d="M39.5 27.5L44 32" stroke="#fff" stroke-width="2.5" stroke-linecap="round"/>
+</svg>

package/docs/assets/readme-product-loop.svg

@@ -1,4 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="900" height="150" viewBox="0 0 900 150" role="img" aria-label="AgentInspect evidence loop: capture or import, understand causality, enforce expectations, verify and bundle, review locally or in customer-owned Studio">
+<svg xmlns="http://www.w3.org/2000/svg" width="900" height="150" viewBox="0 0 900 150" role="img" aria-label="Capture one local trace, then debug the run, prevent trajectory regressions, and share-checked evidence">
   <defs>
     <marker id="arr" markerWidth="8" markerHeight="8" refX="6" refY="3" orient="auto">
       <path d="M0,0 L6,3 L0,6 Z" fill="#64748b"/>
@@ -6,30 +6,21 @@
   </defs>
   <rect width="900" height="150" fill="#ffffff"/>
   <g font-family="ui-sans-serif, system-ui, -apple-system, Segoe UI, sans-serif">
-    <rect x="10" y="24" width="150" height="78" rx="12" fill="#eef2ff" stroke="#6366f1" stroke-width="1.5"/>
-    <text x="85" y="52" text-anchor="middle" font-size="13" font-weight="600" fill="#312e81">Capture / import</text>
-    <text x="85" y="72" text-anchor="middle" font-size="10" fill="#475569">JSONL, adapters,</text>
-    <text x="85" y="86" text-anchor="middle" font-size="10" fill="#475569">logs, standards</text>
-    <path d="M168 63h22" stroke="#64748b" stroke-width="2" marker-end="url(#arr)"/>
-    <rect x="198" y="24" width="150" height="78" rx="12" fill="#ecfdf5" stroke="#10b981" stroke-width="1.5"/>
-    <text x="273" y="52" text-anchor="middle" font-size="13" font-weight="600" fill="#064e3b">Understand</text>
-    <text x="273" y="72" text-anchor="middle" font-size="10" fill="#475569">tree, timeline,</text>
-    <text x="273" y="86" text-anchor="middle" font-size="10" fill="#475569">report, diff</text>
-    <path d="M356 63h22" stroke="#64748b" stroke-width="2" marker-end="url(#arr)"/>
-    <rect x="386" y="24" width="150" height="78" rx="12" fill="#fff7ed" stroke="#f59e0b" stroke-width="1.5"/>
-    <text x="461" y="52" text-anchor="middle" font-size="13" font-weight="600" fill="#78350f">Enforce</text>
-    <text x="461" y="72" text-anchor="middle" font-size="10" fill="#475569">checks, contracts,</text>
-    <text x="461" y="86" text-anchor="middle" font-size="10" fill="#475569">suites, CI gates</text>
-    <path d="M544 63h22" stroke="#64748b" stroke-width="2" marker-end="url(#arr)"/>
-    <rect x="574" y="24" width="150" height="78" rx="12" fill="#f8fafc" stroke="#64748b" stroke-width="1.5"/>
-    <text x="649" y="52" text-anchor="middle" font-size="13" font-weight="600" fill="#0f172a">Verify / bundle</text>
-    <text x="649" y="72" text-anchor="middle" font-size="10" fill="#475569">redact, verify-safe,</text>
-    <text x="649" y="86" text-anchor="middle" font-size="10" fill="#475569">offline bundle</text>
-    <path d="M732 63h22" stroke="#64748b" stroke-width="2" marker-end="url(#arr)"/>
-    <rect x="762" y="24" width="128" height="78" rx="12" fill="#f5f3ff" stroke="#7c3aed" stroke-width="1.5"/>
-    <text x="826" y="52" text-anchor="middle" font-size="13" font-weight="600" fill="#4c1d95">Review</text>
-    <text x="826" y="72" text-anchor="middle" font-size="10" fill="#475569">local or Studio</text>
-    <text x="826" y="86" text-anchor="middle" font-size="10" fill="#475569">Beta (yours)</text>
-    <text x="450" y="132" text-anchor="middle" font-size="12" fill="#64748b">No account · no default upload · metadata-only by default · optional customer-owned Studio</text>
+    <rect x="16" y="28" width="188" height="78" rx="12" fill="#eef2ff" stroke="#6366f1" stroke-width="1.5"/>
+    <text x="110" y="58" text-anchor="middle" font-size="13" font-weight="600" fill="#312e81">One local trace</text>
+    <text x="110" y="78" text-anchor="middle" font-size="11" fill="#475569">JSONL you own</text>
+    <path d="M212 67h28" stroke="#64748b" stroke-width="2" marker-end="url(#arr)"/>
+    <rect x="248" y="28" width="188" height="78" rx="12" fill="#ecfdf5" stroke="#10b981" stroke-width="1.5"/>
+    <text x="342" y="58" text-anchor="middle" font-size="13" font-weight="600" fill="#064e3b">Debug</text>
+    <text x="342" y="78" text-anchor="middle" font-size="11" fill="#475569">view · report · explain</text>
+    <path d="M444 67h28" stroke="#64748b" stroke-width="2" marker-end="url(#arr)"/>
+    <rect x="480" y="28" width="188" height="78" rx="12" fill="#fff7ed" stroke="#f59e0b" stroke-width="1.5"/>
+    <text x="574" y="58" text-anchor="middle" font-size="13" font-weight="600" fill="#78350f">Prevent</text>
+    <text x="574" y="78" text-anchor="middle" font-size="11" fill="#475569">check · contract · CI</text>
+    <path d="M676 67h28" stroke="#64748b" stroke-width="2" marker-end="url(#arr)"/>
+    <rect x="712" y="28" width="172" height="78" rx="12" fill="#f5f3ff" stroke="#7c3aed" stroke-width="1.5"/>
+    <text x="798" y="58" text-anchor="middle" font-size="13" font-weight="600" fill="#4c1d95">Share</text>
+    <text x="798" y="78" text-anchor="middle" font-size="11" fill="#475569">redact · bundle · verify</text>
+    <text x="450" y="132" text-anchor="middle" font-size="12" fill="#64748b">Capture once. Debug, prevent, and share from the same local trace.</text>
   </g>
 </svg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.17.2",
+  "version": "6.17.4",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",
@@ -181,6 +181,7 @@
     "docs/VSCODE.md",
     "docs/assets/agent-inspect-logo.svg",
     "docs/assets/agent-inspect-logo-dark.svg",
+    "docs/assets/agent-inspect-logo-mark.svg",
     "docs/assets/readme-product-loop.svg"
   ],
   "sideEffects": false,
@@ -234,13 +235,14 @@
     "test:all": "pnpm run typecheck && pnpm run linked-versions:check && pnpm run build && pnpm run test && pnpm run size",
     "prepublish:checks": "pnpm run typecheck && pnpm run test && pnpm run test:coverage && pnpm run build && pnpm run fixtures:check && pnpm run recipes:check && pnpm run size && pnpm run linked-versions:check && pnpm run repo:health && pnpm run pack:smoke",
     "pack:dry-run": "pnpm run build && npm pack --dry-run",
-    "pack:smoke": "pnpm run build && node scripts/package-smoke.mjs && node scripts/packed-quickstart-e2e.mjs && node scripts/packed-semantic-loop-e2e.mjs && node scripts/packed-swarm-loop-e2e.mjs && node scripts/evidence-ci-golden-paths.mjs",
+    "pack:smoke": "pnpm run build && node scripts/package-smoke.mjs && node scripts/packed-openai-agents-e2e.mjs && node scripts/packed-quickstart-e2e.mjs && node scripts/packed-semantic-loop-e2e.mjs && node scripts/packed-swarm-loop-e2e.mjs && node scripts/evidence-ci-golden-paths.mjs",
     "linked-versions:check": "node scripts/check-linked-versions.mjs",
     "docs:commands": "node scripts/validate-doc-commands.mjs",
     "docs:links": "node scripts/validate-doc-links.mjs",
     "public-truth:check": "node scripts/validate-public-truth.mjs",
     "ai-assets:check": "node scripts/validate-ai-assets.mjs",
-    "docs:check": "pnpm run docs:commands && pnpm run docs:links && pnpm run public-truth:check && pnpm run ai-assets:check && pnpm run repo:health && pnpm run demo:verify",
+    "package-readmes:check": "node scripts/validate-package-readmes.mjs",
+    "docs:check": "pnpm run docs:commands && pnpm run docs:links && pnpm run public-truth:check && pnpm run ai-assets:check && pnpm run package-readmes:check && pnpm run repo:health && pnpm run demo:verify",
     "repo:health": "node scripts/validate-repo-health.mjs",
     "demo:generate": "node scripts/demo-generate.mjs",
     "demo:verify": "node scripts/demo-verify.mjs",

package/packages/cli/dist/{chunk-FXGWXSFV.mjs → chunk-YX6RFLV5.mjs}

@@ -2412,7 +2412,12 @@ function countErrorNodes(nodes) {
   return nodes.filter((entry) => entry.node.event.status === "error").length;
 }
 function slowestNode(nodes) {
-  return nodes.filter((entry) => entry.node.event.durationMs !== void 0).sort((a, b) => {
+  return nodes.filter(
+    (entry) => entry.node.event.durationMs !== void 0 && // The RUN boundary spans the whole run, so its duration always dominates
+    // and shadows every real step. Rank actual work nodes only, matching the
+    // stats slowest-step ranking, which never counts the run envelope.
+    entry.node.event.kind !== "RUN"
+  ).sort((a, b) => {
     const delta = (b.node.event.durationMs ?? 0) - (a.node.event.durationMs ?? 0);
     return delta !== 0 ? delta : a.index - b.index;
   })[0];
@@ -6232,8 +6237,11 @@ formatProgrammaticDiagnostic(
 );
 
 // packages/core/src/safety/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
   [
@@ -6285,6 +6293,7 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
   const normalized = normalizeSensitiveKey(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey(sensitive);
     if (!s) continue;
@@ -6293,7 +6302,8 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }
@@ -11336,5 +11346,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { COHORT_METRIC_IDS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-FXGWXSFV.mjs.map
-//# sourceMappingURL=chunk-FXGWXSFV.mjs.map
+//# sourceMappingURL=chunk-YX6RFLV5.mjs.map
+//# sourceMappingURL=chunk-YX6RFLV5.mjs.map