agent-inspect 6.17.5 → 6.17.6

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 6.17.6
+
+### Patch Changes
+
+- 075dc87: Security containment: enforce Studio ingest byte limits, reject symlinks, stream and atomically stage imports (bundle / file-drop / GitHub / HTTP), remediate Vitest/nanoid and website/example advisories, add the default-workflow no-egress harness (#225), lock the published API surface snapshot (#211), correct Evidence format docs (no signing; required sourceHashes), and extend free-text redaction residual coverage.
+
 ## 6.17.5
 
 ### Patch Changes

package/README.md

@@ -210,7 +210,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.17.5** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.17.6** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.17.5",
+  "version": "6.17.6",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",
@@ -211,18 +211,18 @@
   },
   "dependencies": {
     "chalk": "^5.3.0",
-    "nanoid": "^5.0.9",
+    "nanoid": "^5.1.16",
     "commander": "^12.1.0"
   },
   "devDependencies": {
     "@changesets/cli": "^2.27.10",
     "@size-limit/preset-small-lib": "^11.1.6",
     "@types/node": "^22.10.2",
-    "@vitest/coverage-v8": "^2.1.8",
+    "@vitest/coverage-v8": "^3.2.7",
     "size-limit": "^11.1.6",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^3.2.7"
   },
   "scripts": {
     "clean": "pnpm -r exec -- node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",

package/packages/cli/dist/index.cjs

@@ -13,8 +13,9 @@ var readline = require('readline');
 var url = require('url');
 var module$1 = require('module');
 var commander = require('commander');
-var http = require('http');
 var child_process = require('child_process');
+var util = require('util');
+var http = require('http');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -12580,7 +12581,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.17.5";
+var version = "6.17.6";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -18456,6 +18457,7 @@ function mergeSafetyExtensions(result, read, options) {
 }
 
 // packages/cli/src/check.ts
+var execFileAsync = util.promisify(child_process.execFile);
 var DEFAULT_SELECT = ["run.status"];
 function uniqueSelectIds(ids) {
   const seen = /* @__PURE__ */ new Set();
@@ -18902,8 +18904,7 @@ async function loadConfig(configPath) {
       const raw = await promises.readFile(absolute, "utf-8");
       return parseCheckConfig(JSON.parse(raw));
     }
-    const mod = await import(url.pathToFileURL(absolute).href);
-    return parseCheckConfig("default" in mod ? mod.default : mod);
+    return parseCheckConfig(await importJsCheckConfig(absolute));
   } catch (error) {
     if (error instanceof CheckConfigError) throw error;
     const message = error instanceof Error ? error.message : String(error);
@@ -18913,6 +18914,46 @@ async function loadConfig(configPath) {
     );
   }
 }
+async function importJsCheckConfig(absolute) {
+  const href = url.pathToFileURL(absolute).href;
+  if (!process.env.VITEST) {
+    const mod = await import(
+      /* @vite-ignore */
+      href
+    );
+    return "default" in mod ? mod.default : mod;
+  }
+  const script = `
+const mod = await import(${JSON.stringify(href)});
+const value = "default" in mod ? mod.default : mod;
+process.stdout.write(JSON.stringify({ ok: true, value }));
+`;
+  const env2 = { ...process.env };
+  delete env2.NODE_OPTIONS;
+  delete env2.VITEST;
+  delete env2.VITEST_WORKER_ID;
+  const { stdout, stderr } = await execFileAsync(
+    process.execPath,
+    ["--input-type=module", "--eval", script],
+    {
+      encoding: "utf8",
+      maxBuffer: 4 * 1024 * 1024,
+      env: env2
+    }
+  );
+  try {
+    const parsed = JSON.parse(stdout);
+    if (parsed.ok !== true) {
+      throw new Error(stderr.trim() || "Check config module did not return a value");
+    }
+    return parsed.value;
+  } catch (error) {
+    if (stderr.trim()) {
+      throw new Error(stderr.trim());
+    }
+    throw error instanceof Error ? error : new Error(String(error));
+  }
+}
 function normalizeConfig(config) {
   if (config.checks === void 0) return {};
   if (typeof config.checks !== "object" || Array.isArray(config.checks)) {