agent-inspect 6.17.6 → 6.17.8

package/packages/cli/dist/index.cjs

@@ -3020,29 +3020,30 @@ async function searchTraces(metas, options) {
 }
 function matchRunLevel(m, opts) {
   if (opts.stepTypeFilter || opts.toolQuery) return [];
-  const out = [];
+  if (opts.statusFilter && m.status !== opts.statusFilter) return [];
+  if (opts.nameQuery && !nameMatches(m.name ?? m.runId, opts.nameQuery)) {
+    return [];
+  }
+  if (opts.durationFilter && !durationMatches(m.durationMs, opts.durationFilter)) {
+    return [];
+  }
   const fields = [];
-  if (opts.statusFilter && m.status === opts.statusFilter) {
-    fields.push("run.status");
-  }
-  if (opts.nameQuery && nameMatches(m.name ?? m.runId, opts.nameQuery)) {
-    fields.push("run.name");
-  }
-  if (opts.durationFilter && durationMatches(m.durationMs, opts.durationFilter)) {
-    fields.push("run.durationMs");
-  }
-  if (fields.length === 0) return out;
-  out.push({
-    runId: m.runId,
-    runName: m.name,
-    runStatus: m.status,
-    timestamp: m.startedAt,
-    durationMs: m.durationMs,
-    matchReason: `run match: ${fields.join(", ")}`,
-    matchedFields: fields,
-    filePath: m.filePath
-  });
-  return out;
+  if (opts.statusFilter) fields.push("run.status");
+  if (opts.nameQuery) fields.push("run.name");
+  if (opts.durationFilter) fields.push("run.durationMs");
+  if (fields.length === 0) return [];
+  return [
+    {
+      runId: m.runId,
+      runName: m.name,
+      runStatus: m.status,
+      timestamp: m.startedAt,
+      durationMs: m.durationMs,
+      matchReason: `run match: ${fields.join(", ")}`,
+      matchedFields: fields,
+      filePath: m.filePath
+    }
+  ];
 }
 function matchStepLevel(m, events, opts) {
   const out = [];
@@ -8418,7 +8419,11 @@ var init_checks2 = __esm({
       { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
       { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
       { id: "github-token", pattern: /gh[opsu]_[A-Za-z0-9_]{20,}/ },
-      { id: "key-value-secret", pattern: /(api[_-]?key|token|password|secret)=\S{8,}/i }
+      // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
+      {
+        id: "key-value-secret",
+        pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i
+      }
     ];
   }
 });
@@ -12581,7 +12586,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.17.6";
+var version = "6.17.8";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -12736,13 +12741,14 @@ async function list(options = {}) {
 
 // packages/cli/src/clean.ts
 init_advanced();
+var DECIMAL_INTEGER_PATTERN = /^\d+$/;
 function parseKeep(raw) {
   const trimmed = typeof raw === "string" ? raw.trim() : "";
-  if (trimmed === "") {
+  if (!DECIMAL_INTEGER_PATTERN.test(trimmed)) {
     throw new Error(`Invalid --keep value: ${raw}. Provide a positive integer.`);
   }
-  const n = Number.parseInt(trimmed, 10);
-  if (!Number.isFinite(n) || n <= 0) {
+  const n = Number(trimmed);
+  if (!Number.isSafeInteger(n) || n <= 0) {
     throw new Error(`Invalid --keep value: ${raw}. Provide a positive integer.`);
   }
   return n;
@@ -16528,6 +16534,17 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
   return false;
 }
 
+// packages/redact/src/key-value-secret.ts
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN = new RegExp(
+  KEY_VALUE_SECRET_PATTERN_SOURCE,
+  "i"
+);
+function valueContainsKeyValueSecret(value) {
+  KEY_VALUE_SECRET_PATTERN.lastIndex = 0;
+  return KEY_VALUE_SECRET_PATTERN.test(value);
+}
+
 // packages/redact/src/index.ts
 var DEFAULT_REDACT_KEYS2 = [
   "authorization",
@@ -16734,6 +16751,15 @@ var credentialDetectors = [
     pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
     severity: "error"
   }),
+  {
+    id: "value.keyValueSecret",
+    severity: "error",
+    matchKind: "value",
+    detect(input3) {
+      if (typeof input3.value !== "string") return [];
+      return valueContainsKeyValueSecret(input3.value) ? [{ action: "replace", severity: "error", matchKind: "value" }] : [];
+    }
+  },
   {
     id: "value.creditCard",
     severity: "error",
@@ -18470,12 +18496,30 @@ function uniqueSelectIds(ids) {
   }
   return out;
 }
+function resolveForbiddenToolOptions(options) {
+  const merged = [...options.forbiddenTool ?? [], ...options.forbidTool ?? []];
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const name of merged) {
+    if (seen.has(name)) continue;
+    seen.add(name);
+    out.push(name);
+  }
+  return out;
+}
+function withResolvedForbiddenTools(options) {
+  return {
+    ...options,
+    forbiddenTool: resolveForbiddenToolOptions(options),
+    forbidTool: void 0
+  };
+}
 function cliShorthandSelectIds(options) {
   const ids = [];
   if (options.failOnObservation !== void 0 && options.failOnObservation.trim() !== "") {
     ids.push("outcome.status");
   }
-  if ((options.requiredTool?.length ?? 0) > 0 || (options.forbiddenTool?.length ?? 0) > 0) {
+  if ((options.requiredTool?.length ?? 0) > 0 || (options.forbiddenTool?.length ?? 0) > 0 || (options.forbidTool?.length ?? 0) > 0) {
     ids.push("tool.usage");
   }
   if ((options.allowedModel?.length ?? 0) > 0 || options.maxTotalTokens !== void 0) {
@@ -19196,6 +19240,7 @@ function readErrorResult(error) {
   );
 }
 async function checkCommand(target, options = {}, stdin = process.stdin) {
+  options = withResolvedForbiddenTools(options);
   let result;
   let phase = "config";
   let evidenceRead;
@@ -23603,6 +23648,9 @@ async function initCommand(options = {}) {
     process.exitCode = 1;
   }
 }
+var DOCS_BASE = "https://github.com/rajudandigam/agent-inspect/blob/main/docs";
+var AGENT_INSPECT_NOT_RESOLVABLE_MESSAGE = "agent-inspect does not resolve from this project. A global CLI install is not enough \u2014 the package must be a dependency here.";
+var AGENT_INSPECT_NOT_RESOLVABLE_REMEDIATION = `Install it in this project: npm install agent-inspect (or pnpm add agent-inspect). See ${DOCS_BASE}/FIRST-TRACE-IN-5-MINUTES.md`;
 var OPTIONAL_PACKAGES = {
   custom: [],
   "ai-sdk": ["@agent-inspect/ai-sdk"],
@@ -23617,7 +23665,7 @@ function nodeVersionCheck() {
       id: "node-version",
       status: "fail",
       message: `Node ${process3__default.default.versions.node} is below the supported minimum (20).`,
-      remediation: "Upgrade to Node 20 LTS or newer.",
+      remediation: `Upgrade to Node 20 LTS or newer, then reinstall. See ${DOCS_BASE}/GETTING-STARTED.md`,
       evidence: process3__default.default.versions.node
     };
   }
@@ -23661,7 +23709,7 @@ async function traceDirWritable(traceDir) {
       id: "trace-dir-writable",
       status: "fail",
       message: `Trace directory is not writable: ${resolved}`,
-      remediation: "Create the directory or set AGENT_INSPECT_TRACE_DIR to a writable path.",
+      remediation: `Create the directory or set AGENT_INSPECT_TRACE_DIR to a writable path. See ${DOCS_BASE}/GETTING-STARTED.md`,
       evidence: error instanceof Error ? error.message : String(error)
     };
   }
@@ -23724,8 +23772,8 @@ function importSmoke(cwd) {
     results.push({
       id: "import-agent-inspect",
       status: "warn",
-      message: "agent-inspect is not installed in the current project.",
-      remediation: "Run npm install agent-inspect (or pnpm add agent-inspect)."
+      message: AGENT_INSPECT_NOT_RESOLVABLE_MESSAGE,
+      remediation: AGENT_INSPECT_NOT_RESOLVABLE_REMEDIATION
     });
     results.push({
       id: "import-agent-inspect-cjs",
@@ -23774,8 +23822,8 @@ function versionMismatchCheck(cwd) {
     return {
       id: "version-alignment",
       status: "warn",
-      message: `CLI version ${version} differs from local agent-inspect@${root.version}.`,
-      remediation: "Align versions with npm install agent-inspect@latest",
+      message: `CLI version ${version} differs from local agent-inspect@${root.version}. A packed consumer can hit this when npx uses a cached global CLI.`,
+      remediation: `Align versions with npm install agent-inspect@${version}, or run via the local binary. See ${DOCS_BASE}/KNOWN-ISSUES.md`,
       evidence: `cli=${version};local=${root.version}`
     };
   }
@@ -25224,6 +25272,9 @@ function createCliProgram() {
   ]).option("--forbidden-tool <name>", "forbid a tool name (repeatable)", (value, previous = []) => [
     ...previous,
     value
+  ]).option("--forbid-tool <name>", "alias for --forbidden-tool (repeatable)", (value, previous = []) => [
+    ...previous,
+    value
   ]).option("--allowed-model <model>", "allow an LLM model (repeatable)", (value, previous = []) => [
     ...previous,
     value