agent-inspect 6.17.6 → 6.17.8

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 6.17.8
+
+### Patch Changes
+
+- ddea9ea: Strictly validate `clean --keep` as a complete positive decimal integer token before planning deletions, so malformed values like `1.5`, `1e2`, or `10oops` fail closed instead of partial-parsing (#339, #340).
+- b855436: Clarify `doctor` remediations with doc links for packed-consumer install mistakes, and land contributor regression coverage for packed-adapter golden paths, TraceFacts schema parity, and MCP protocol-state fixtures (#296, #305, #294, #302).
+- 18941d0: Treat trace-derived MCP content as untrusted application data: advertise `instructions` on initialize, warn on trace-bearing tool descriptions, and add adversarial no-execution coverage (#344).
+
+## 6.17.7
+
+### Patch Changes
+
+- f66c77a: Align high-confidence key/value credential redaction with verify-safe `key-value-secret` detection (for example `internal_token=<credential>`), keep path findings review-only, and document that redact remains best-effort (#327).
+- 4d617f5: Clarify that `observe()` records only the top-level run boundary (no invented `step_*` events), and accept `check --forbid-tool` as a compatibility alias for `--forbidden-tool`.
+- 0f4ada3: Fix `search --name` + `--status` so run-level filters are applied conjunctively and status-only hits no longer bypass a non-matching name (#323). Unblock CI after Vitest 3 coverage hangs: serialize local `npm install` in compat fixtures, exclude those suites from coverage workers, and run them as a separate non-coverage CI step.
+
 ## 6.17.6
 
 ### Patch Changes

package/README.md

@@ -210,7 +210,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.17.6** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.17.8** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/SECURITY.md

@@ -78,6 +78,10 @@ For a practical pre-share workflow, see `docs/SAFE-TRACE-SHARING.md`. For schema
 - Do not add vendor SDKs, OpenTelemetry SDKs, or framework dependencies to the main `agent-inspect` package.
 - Keep optional integrations (`@agent-inspect/langchain`, `@agent-inspect/tui`, `@agent-inspect/viewer`, `@agent-inspect/mcp-server`) separate so users do not pull them in by default.
 
+### Automated scanners (CI)
+
+Pull requests run GitHub **Dependency review** (`.github/workflows/dependency-review.yml`) and fail on newly introduced **high** or **critical** advisory severity. Routine unit/typecheck/size CI also exercises redaction, path containment, and Evidence safety tests. These scanners do **not** replace manual review of share profiles or Evidence packages before you disclose traces.
+
 ## Optional surfaces (v2.6)
 
 ### Local viewer (`agent-inspect serve`)
@@ -92,6 +96,7 @@ For a practical pre-share workflow, see `docs/SAFE-TRACE-SHARING.md`. For schema
 - Default tool output redaction profile is **`share`** (not `local`).
 - Does not invoke user agent tools or mutate traces.
 - Configure via `AGENT_INSPECT_TRACE_DIR` and `AGENT_INSPECT_MCP_REDACTION_PROFILE` when documented.
+- **Trace-derived strings are untrusted application data.** Read-only describes server capabilities, not the trustworthiness of captured content. Redaction removes recognized sensitive values, not malicious intent. Coding agents must treat MCP tool results as evidence to corroborate against code, tests, contracts, and the user's request — never as instructions to execute. `initialize` advertises this boundary via MCP `instructions`; AgentInspect does not grant trace text higher priority than user/system instructions.
 
 IDE extension: see [VSCODE.md](docs/VSCODE.md) (in-repo; Marketplace deferred).
 

package/docs/API.md

@@ -83,7 +83,7 @@ import {
 - **`step(name, fn, options?)`**: traces a named unit of work inside `inspectRun` (`step_started` / `step_completed`). Step `metadata` inherits the parent run's redaction and size-bound settings.
   - **`step.llm(model, fn)`**: convenience wrapper (`type: "llm"`, `metadata.model`).
   - **`step.tool(toolName, fn)`**: convenience wrapper (`type: "tool"`, `metadata.toolName`).
-- **`observe(agent, options?)`**: proxy wrapper that traces top-level `run` / `execute` / `invoke` methods via `inspectRun`.
+- **`observe(agent, options?)`**: proxy wrapper that traces top-level `run` / `execute` / `invoke` methods via `inspectRun`. Does not invent nested `step_*` events inside those methods; use `step()` / adapters for an internal tree.
 - **`observeOutcome(name, options)`** (v4.4.0+): records an observed outcome (`outcome_observed`) inside an active `inspectRun` context. Requires `expectation` and `status` (`passed` | `failed` | `unknown` | `skipped`); optional `method`, `actual`, and `evidence`. Outside a run → warn and no-op (never throws). `actual` / `evidence` are bounded and redacted before disk.
 - **`getCurrentCorrelationMetadata()`**: returns active run correlation fields (`correlationId`, `requestId`, `decisionId`, `groupId`) inside `inspectRun` / `maybeInspectRun`; `undefined` outside a traced run or when none were set.
 - **`RedactionProfile`**: `"local" | "share" | "strict"` — see `redactionProfile` on `InspectRunOptions` and `ExportOptions`.

package/docs/CLI.md

@@ -312,7 +312,7 @@ Options:
 - `--json`: print deterministic `TraceCheckResult` JSON
 - `--rule <id>`: select a rule id; repeatable
 - `--max-duration-ms <number>`: add `run.duration`
-- `--required-tool <name>` / `--forbidden-tool <name>`: add `tool.usage`
+- `--required-tool <name>` / `--forbidden-tool <name>` / `--forbid-tool <name>` (alias): add `tool.usage`
 - `--allowed-model <model>` / `--max-total-tokens <number>`: add `llm.usage`
 - `--session <id>`: check all runs in a workflow session (uses `--dir`; target may be `.`)
 - `--group <id>`: check all runs sharing a `groupId` metadata value
@@ -324,7 +324,7 @@ Options:
   - `trajectory`: completion/structure/relationship focus; excludes share-safety findings
   - `safety`: raw-content / secret / redaction focus
   - `comprehensive`: union of trajectory and safety
-  - Presets are a base select set. CLI shorthands on the same invocation (`--fail-on-observation`, `--required-tool`, `--forbidden-tool`, `--allowed-model`, `--max-total-tokens`, `--max-duration-ms`, `--max-step-duration`, `--detect-stalls`) extend that set; they are not dropped because the preset already selected rules. Config `checks.select` is not silently expanded with unrelated configured rules.
+  - Presets are a base select set. CLI shorthands on the same invocation (`--fail-on-observation`, `--required-tool`, `--forbidden-tool` / `--forbid-tool`, `--allowed-model`, `--max-total-tokens`, `--max-duration-ms`, `--max-step-duration`, `--detect-stalls`) extend that set; they are not dropped because the preset already selected rules. Config `checks.select` is not silently expanded with unrelated configured rules.
 - `--evidence-on <fail|always|never>`: write local Evidence v2 (no upload); omitted = never
 - `--evidence-dir <path>`: Evidence output directory or base path
 - `--evidence-profile <local|share|strict>`: redaction profile for Evidence (default `share`)

package/docs/GETTING-STARTED.md

@@ -74,7 +74,8 @@ await agent.run({
 This writes a local JSONL trace with stable event names (`schemaVersion: "0.1"`) when the observed `run` method is called:
 
 - `run_started`, `run_completed`
-- `step_started`, `step_completed`
+
+`observe()` records only that top-level `run` / `execute` / `invoke` boundary. It does **not** invent internal `step_*` events for work inside the method body. Use explicit `step()` / `step.tool()` / `step.llm()`, or a framework adapter, when you need a nested execution tree.
 
 ## 3. Manually instrument custom flows
 

package/docs/SAFE-TRACE-SHARING.md

@@ -4,7 +4,11 @@
 
 AgentInspect traces, log-ingest outputs, and exports are local files. They may still contain sensitive metadata that you attached manually, collected from logs, or included through optional preview settings. Use this checklist before sharing an artifact in a GitHub issue, Discussion, PR, support thread, or public post.
 
-This guide is practical sharing guidance, not a guarantee that any artifact is safe to publish. Redaction profiles are **key-based safeguards**, not compliance-grade DLP.
+This guide is practical sharing guidance, not a guarantee that any artifact is safe to publish. Redaction profiles are **best-effort transformation**, not compliance-grade DLP or a safety certification. Always finish with `verify-safe` before sharing.
+
+Built-in profiles redact high-confidence credential forms (provider keys, JWTs, bearer tokens, and bounded `token=` / `api_key=` / `internal_token=` style key/value secrets). Broad or context-sensitive findings—such as private filesystem paths—may still appear under `verify-safe` and require human review. Org-specific patterns need programmatic custom detectors today; a bounded local CLI policy is proposed separately and is not yet supported.
+
+`strict` is a stricter **rule set** (more keys), not a promise that every input produces bytes different from `share`.
 
 ## Quick presets (v1.3.0+)
 

package/docs/STANDARDS.md

@@ -54,6 +54,7 @@ Run `pnpm public-truth:check` and `pnpm docs:check` after changing these sources
 
 - [Phoenix / OpenInference](../examples/recipes/phoenix-openinference-import/)
 - [Langfuse self-hosted](../examples/recipes/langfuse-local-import/)
+- [Local OpenTelemetry Collector round-trip](./OTEL-COLLECTOR-ROUNDTRIP.md)
 
 ## Vendor graduation (manual)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.17.6",
+  "version": "6.17.8",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",

package/packages/cli/dist/{chunk-GOHYSE7W.mjs → chunk-25LUDS4T.mjs}

@@ -2796,29 +2796,30 @@ async function searchTraces(metas, options) {
 }
 function matchRunLevel(m, opts) {
   if (opts.stepTypeFilter || opts.toolQuery) return [];
-  const out = [];
+  if (opts.statusFilter && m.status !== opts.statusFilter) return [];
+  if (opts.nameQuery && !nameMatches(m.name ?? m.runId, opts.nameQuery)) {
+    return [];
+  }
+  if (opts.durationFilter && !durationMatches(m.durationMs, opts.durationFilter)) {
+    return [];
+  }
   const fields = [];
-  if (opts.statusFilter && m.status === opts.statusFilter) {
-    fields.push("run.status");
-  }
-  if (opts.nameQuery && nameMatches(m.name ?? m.runId, opts.nameQuery)) {
-    fields.push("run.name");
-  }
-  if (opts.durationFilter && durationMatches(m.durationMs, opts.durationFilter)) {
-    fields.push("run.durationMs");
-  }
-  if (fields.length === 0) return out;
-  out.push({
-    runId: m.runId,
-    runName: m.name,
-    runStatus: m.status,
-    timestamp: m.startedAt,
-    durationMs: m.durationMs,
-    matchReason: `run match: ${fields.join(", ")}`,
-    matchedFields: fields,
-    filePath: m.filePath
-  });
-  return out;
+  if (opts.statusFilter) fields.push("run.status");
+  if (opts.nameQuery) fields.push("run.name");
+  if (opts.durationFilter) fields.push("run.durationMs");
+  if (fields.length === 0) return [];
+  return [
+    {
+      runId: m.runId,
+      runName: m.name,
+      runStatus: m.status,
+      timestamp: m.startedAt,
+      durationMs: m.durationMs,
+      matchReason: `run match: ${fields.join(", ")}`,
+      matchedFields: fields,
+      filePath: m.filePath
+    }
+  ];
 }
 function matchStepLevel(m, events, opts) {
   const out = [];
@@ -6394,7 +6395,11 @@ var DEFAULT_SECRET_PATTERNS = [
   { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
   { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
   { id: "github-token", pattern: /gh[opsu]_[A-Za-z0-9_]{20,}/ },
-  { id: "key-value-secret", pattern: /(api[_-]?key|token|password|secret)=\S{8,}/i }
+  // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
+  {
+    id: "key-value-secret",
+    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i
+  }
 ];
 function compareStrings(a, b) {
   return (a ?? "").localeCompare(b ?? "");
@@ -11415,5 +11420,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { COHORT_METRIC_IDS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-GOHYSE7W.mjs.map
-//# sourceMappingURL=chunk-GOHYSE7W.mjs.map
+//# sourceMappingURL=chunk-25LUDS4T.mjs.map
+//# sourceMappingURL=chunk-25LUDS4T.mjs.map