agent-inspect 6.17.5 → 6.17.7

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 6.17.7
+
+### Patch Changes
+
+- f66c77a: Align high-confidence key/value credential redaction with verify-safe `key-value-secret` detection (for example `internal_token=<credential>`), keep path findings review-only, and document that redact remains best-effort (#327).
+- 4d617f5: Clarify that `observe()` records only the top-level run boundary (no invented `step_*` events), and accept `check --forbid-tool` as a compatibility alias for `--forbidden-tool`.
+- 0f4ada3: Fix `search --name` + `--status` so run-level filters are applied conjunctively and status-only hits no longer bypass a non-matching name (#323). Unblock CI after Vitest 3 coverage hangs: serialize local `npm install` in compat fixtures, exclude those suites from coverage workers, and run them as a separate non-coverage CI step.
+
+## 6.17.6
+
+### Patch Changes
+
+- 075dc87: Security containment: enforce Studio ingest byte limits, reject symlinks, stream and atomically stage imports (bundle / file-drop / GitHub / HTTP), remediate Vitest/nanoid and website/example advisories, add the default-workflow no-egress harness (#225), lock the published API surface snapshot (#211), correct Evidence format docs (no signing; required sourceHashes), and extend free-text redaction residual coverage.
+
 ## 6.17.5
 
 ### Patch Changes

package/README.md

@@ -210,7 +210,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.17.5** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.17.7** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/docs/API.md

@@ -83,7 +83,7 @@ import {
 - **`step(name, fn, options?)`**: traces a named unit of work inside `inspectRun` (`step_started` / `step_completed`). Step `metadata` inherits the parent run's redaction and size-bound settings.
   - **`step.llm(model, fn)`**: convenience wrapper (`type: "llm"`, `metadata.model`).
   - **`step.tool(toolName, fn)`**: convenience wrapper (`type: "tool"`, `metadata.toolName`).
-- **`observe(agent, options?)`**: proxy wrapper that traces top-level `run` / `execute` / `invoke` methods via `inspectRun`.
+- **`observe(agent, options?)`**: proxy wrapper that traces top-level `run` / `execute` / `invoke` methods via `inspectRun`. Does not invent nested `step_*` events inside those methods; use `step()` / adapters for an internal tree.
 - **`observeOutcome(name, options)`** (v4.4.0+): records an observed outcome (`outcome_observed`) inside an active `inspectRun` context. Requires `expectation` and `status` (`passed` | `failed` | `unknown` | `skipped`); optional `method`, `actual`, and `evidence`. Outside a run → warn and no-op (never throws). `actual` / `evidence` are bounded and redacted before disk.
 - **`getCurrentCorrelationMetadata()`**: returns active run correlation fields (`correlationId`, `requestId`, `decisionId`, `groupId`) inside `inspectRun` / `maybeInspectRun`; `undefined` outside a traced run or when none were set.
 - **`RedactionProfile`**: `"local" | "share" | "strict"` — see `redactionProfile` on `InspectRunOptions` and `ExportOptions`.

package/docs/CLI.md

@@ -312,7 +312,7 @@ Options:
 - `--json`: print deterministic `TraceCheckResult` JSON
 - `--rule <id>`: select a rule id; repeatable
 - `--max-duration-ms <number>`: add `run.duration`
-- `--required-tool <name>` / `--forbidden-tool <name>`: add `tool.usage`
+- `--required-tool <name>` / `--forbidden-tool <name>` / `--forbid-tool <name>` (alias): add `tool.usage`
 - `--allowed-model <model>` / `--max-total-tokens <number>`: add `llm.usage`
 - `--session <id>`: check all runs in a workflow session (uses `--dir`; target may be `.`)
 - `--group <id>`: check all runs sharing a `groupId` metadata value
@@ -324,7 +324,7 @@ Options:
   - `trajectory`: completion/structure/relationship focus; excludes share-safety findings
   - `safety`: raw-content / secret / redaction focus
   - `comprehensive`: union of trajectory and safety
-  - Presets are a base select set. CLI shorthands on the same invocation (`--fail-on-observation`, `--required-tool`, `--forbidden-tool`, `--allowed-model`, `--max-total-tokens`, `--max-duration-ms`, `--max-step-duration`, `--detect-stalls`) extend that set; they are not dropped because the preset already selected rules. Config `checks.select` is not silently expanded with unrelated configured rules.
+  - Presets are a base select set. CLI shorthands on the same invocation (`--fail-on-observation`, `--required-tool`, `--forbidden-tool` / `--forbid-tool`, `--allowed-model`, `--max-total-tokens`, `--max-duration-ms`, `--max-step-duration`, `--detect-stalls`) extend that set; they are not dropped because the preset already selected rules. Config `checks.select` is not silently expanded with unrelated configured rules.
 - `--evidence-on <fail|always|never>`: write local Evidence v2 (no upload); omitted = never
 - `--evidence-dir <path>`: Evidence output directory or base path
 - `--evidence-profile <local|share|strict>`: redaction profile for Evidence (default `share`)

package/docs/GETTING-STARTED.md

@@ -74,7 +74,8 @@ await agent.run({
 This writes a local JSONL trace with stable event names (`schemaVersion: "0.1"`) when the observed `run` method is called:
 
 - `run_started`, `run_completed`
-- `step_started`, `step_completed`
+
+`observe()` records only that top-level `run` / `execute` / `invoke` boundary. It does **not** invent internal `step_*` events for work inside the method body. Use explicit `step()` / `step.tool()` / `step.llm()`, or a framework adapter, when you need a nested execution tree.
 
 ## 3. Manually instrument custom flows
 

package/docs/SAFE-TRACE-SHARING.md

@@ -4,7 +4,11 @@
 
 AgentInspect traces, log-ingest outputs, and exports are local files. They may still contain sensitive metadata that you attached manually, collected from logs, or included through optional preview settings. Use this checklist before sharing an artifact in a GitHub issue, Discussion, PR, support thread, or public post.
 
-This guide is practical sharing guidance, not a guarantee that any artifact is safe to publish. Redaction profiles are **key-based safeguards**, not compliance-grade DLP.
+This guide is practical sharing guidance, not a guarantee that any artifact is safe to publish. Redaction profiles are **best-effort transformation**, not compliance-grade DLP or a safety certification. Always finish with `verify-safe` before sharing.
+
+Built-in profiles redact high-confidence credential forms (provider keys, JWTs, bearer tokens, and bounded `token=` / `api_key=` / `internal_token=` style key/value secrets). Broad or context-sensitive findings—such as private filesystem paths—may still appear under `verify-safe` and require human review. Org-specific patterns need programmatic custom detectors today; a bounded local CLI policy is proposed separately and is not yet supported.
+
+`strict` is a stricter **rule set** (more keys), not a promise that every input produces bytes different from `share`.
 
 ## Quick presets (v1.3.0+)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.17.5",
+  "version": "6.17.7",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",
@@ -211,18 +211,18 @@
   },
   "dependencies": {
     "chalk": "^5.3.0",
-    "nanoid": "^5.0.9",
+    "nanoid": "^5.1.16",
     "commander": "^12.1.0"
   },
   "devDependencies": {
     "@changesets/cli": "^2.27.10",
     "@size-limit/preset-small-lib": "^11.1.6",
     "@types/node": "^22.10.2",
-    "@vitest/coverage-v8": "^2.1.8",
+    "@vitest/coverage-v8": "^3.2.7",
     "size-limit": "^11.1.6",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^3.2.7"
   },
   "scripts": {
     "clean": "pnpm -r exec -- node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",

package/packages/cli/dist/{chunk-GOHYSE7W.mjs → chunk-25LUDS4T.mjs}

@@ -2796,29 +2796,30 @@ async function searchTraces(metas, options) {
 }
 function matchRunLevel(m, opts) {
   if (opts.stepTypeFilter || opts.toolQuery) return [];
-  const out = [];
+  if (opts.statusFilter && m.status !== opts.statusFilter) return [];
+  if (opts.nameQuery && !nameMatches(m.name ?? m.runId, opts.nameQuery)) {
+    return [];
+  }
+  if (opts.durationFilter && !durationMatches(m.durationMs, opts.durationFilter)) {
+    return [];
+  }
   const fields = [];
-  if (opts.statusFilter && m.status === opts.statusFilter) {
-    fields.push("run.status");
-  }
-  if (opts.nameQuery && nameMatches(m.name ?? m.runId, opts.nameQuery)) {
-    fields.push("run.name");
-  }
-  if (opts.durationFilter && durationMatches(m.durationMs, opts.durationFilter)) {
-    fields.push("run.durationMs");
-  }
-  if (fields.length === 0) return out;
-  out.push({
-    runId: m.runId,
-    runName: m.name,
-    runStatus: m.status,
-    timestamp: m.startedAt,
-    durationMs: m.durationMs,
-    matchReason: `run match: ${fields.join(", ")}`,
-    matchedFields: fields,
-    filePath: m.filePath
-  });
-  return out;
+  if (opts.statusFilter) fields.push("run.status");
+  if (opts.nameQuery) fields.push("run.name");
+  if (opts.durationFilter) fields.push("run.durationMs");
+  if (fields.length === 0) return [];
+  return [
+    {
+      runId: m.runId,
+      runName: m.name,
+      runStatus: m.status,
+      timestamp: m.startedAt,
+      durationMs: m.durationMs,
+      matchReason: `run match: ${fields.join(", ")}`,
+      matchedFields: fields,
+      filePath: m.filePath
+    }
+  ];
 }
 function matchStepLevel(m, events, opts) {
   const out = [];
@@ -6394,7 +6395,11 @@ var DEFAULT_SECRET_PATTERNS = [
   { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
   { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
   { id: "github-token", pattern: /gh[opsu]_[A-Za-z0-9_]{20,}/ },
-  { id: "key-value-secret", pattern: /(api[_-]?key|token|password|secret)=\S{8,}/i }
+  // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
+  {
+    id: "key-value-secret",
+    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i
+  }
 ];
 function compareStrings(a, b) {
   return (a ?? "").localeCompare(b ?? "");
@@ -11415,5 +11420,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { COHORT_METRIC_IDS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-GOHYSE7W.mjs.map
-//# sourceMappingURL=chunk-GOHYSE7W.mjs.map
+//# sourceMappingURL=chunk-25LUDS4T.mjs.map
+//# sourceMappingURL=chunk-25LUDS4T.mjs.map