agent-inspect 6.29.0 → 6.29.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 6.29.1
+
+### Patch Changes
+
+- d723406: Post-6.29 hardening: regex-free redaction policy, OTLP GenAI declared-vs-emitted honesty, recovery fail-closed contracts, AI SDK overlap/close terminalization (open rows only), Evidence refuse unsafe expected/oneOf values with bind-before-HTML packaging, and CLI/recipe DX for anyOf vs retry paths.
+
 ## 6.29.0
 
 ### Minor Changes

package/README.md

@@ -212,7 +212,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.29.0** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.29.1** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/docs/CLI.md

@@ -49,6 +49,24 @@ Core commands:
 - `report` — markdown or HTML inspection report for a single run
 - `explain` — deterministic local facts/inferences for a trace, with dry-run payloads
 
+## 1.1 CLI vs TraceContract decision table (6.29.3)
+
+Use this table when choosing between CLI check shorthands and TraceContract rules.
+No new CLI commands were added for branching paths.
+
+| Need | Prefer |
+| ---- | ------ |
+| One tool must always run | CLI `--required-tool` / contract `tools.required` |
+| Tool must never run | CLI `--forbidden-tool` / contract `tools.forbidden` |
+| Legitimate alternate paths (OR) | TraceContract `alternatives.anyOf` (not CLI flags) |
+| Causal order between tools | TraceContract `requiredOrder` + `requiredOrderMode` |
+| Read recovery vs write fail-closed | TraceContract `retry.operations` + `sideEffectClass` |
+| Sensitive expected literals in Evidence | Contract binding safety (`unavailable` on credential-like expected); never silent complete packaging |
+| Share-safe offline review package | CLI `bundle` / Evidence CI helpers |
+
+See [TRACE-CONTRACTS.md](./TRACE-CONTRACTS.md) and recipe
+[sensitive-read-outbound-write-anyof](../examples/recipes/sensitive-read-outbound-write-anyof/).
+
 ## 2. Environment variables
 
 - **`AGENT_INSPECT_TRACE_DIR`**: default directory for manual trace files (`.jsonl`) when not passed via `--dir` (or API options).
@@ -446,7 +464,7 @@ Options:
 - `--profile <local|share|strict>`: redaction profile (default `share`)
 - `-o, --output <path>`: write redacted content to a file
 - `--json`: print deterministic JSON wrapper with findings
-- `--policy <path>`: local JSON redaction policy (`extraKeys` + bounded `literal` / `prefix` / `typed` patterns). No remote fetch; no secrets on argv. See [SAFETY-POLICY.md](SAFETY-POLICY.md).
+- `--policy <path>`: local JSON redaction policy (`extraKeys` + bounded `literal` / `prefix` patterns; no user regex since 6.29.1). No remote fetch; no secrets on argv. See [SAFETY-POLICY.md](SAFETY-POLICY.md).
 - `--fail-on-residual`: opt-in non-zero exit when residual safety is `UNSAFE` or `UNKNOWN` (default exit codes unchanged)
 
 After redaction, the command surfaces a **residual safety assessment** using the same local detector pipeline as `verify-safe`. Human mode prints a concise stderr warning when residual status is not `SAFE`. JSON mode adds an additive `residualAssessment` field (`status`, finding counts, codes only — never matched secret values). Residual status uses `SAFE` | `SAFE_WITH_WARNINGS` | `UNSAFE` | `UNKNOWN`. Supported AgentInspect traces get a full assessment; arbitrary JSON that is not a supported trace yields `UNKNOWN`. Redact never certifies safe sharing — finish with `verify-safe` before publishing.

package/docs/LIMITATIONS.md

@@ -26,7 +26,7 @@ This document states what AgentInspect **does not** provide today. It complement
 - **Subpath APIs:** `agent-inspect/writers`, `agent-inspect/readers`, and advanced helpers are available for local adoption from their owning subpaths. `createInspector()` is part of the small root API.
 - **Explicit writer ownership:** `createInspector()` does not print terminal lifecycle output or implicitly choose a disk writer. Use `fileWriter()` / `bufferedFileWriter()` / custom writers when persistence is desired.
 - **Diagnostic evidence, not an event-sourced runtime:** AgentInspect traces are local diagnostic evidence of what an agent did. They are **not** a write-ahead log, durable-before-effect journal, or application event-sourcing runtime. Buffered writers may lose a bounded tail of events on abrupt process termination. Call `flush()` / `close()` according to writer docs when you need the queue drained before exit; that lifecycle is deterministic and idempotent, but it is **not** an fsync / crash-durability guarantee.
-- **No standards upload:** OpenInference and OTLP JSON support is local read/export compatibility only. There is no OTLP gRPC/HTTP streaming sink, collector client, or hosted ingestion behavior.
+- **No standards upload:** OpenInference and OTLP JSON support is local read/export compatibility only. There is no OTLP gRPC/HTTP streaming sink, collector client, or hosted ingestion behavior. OTLP GenAI export is metadata/token-oriented (`OTEL_GEN_AI_SEMCONV_PIN`); it does not emit `gen_ai.prompt` / `gen_ai.completion` bodies.
 - **Conservative detection:** `agent-inspect open` does not silently accept arbitrary JSON. Unsupported or ambiguous inputs produce errors/warnings rather than guessed traces.
 - **Large inputs:** reader inputs are bounded and read into local memory. This is not a database index or production log warehouse.
 

package/docs/SAFE-TRACE-SHARING.md

@@ -6,7 +6,7 @@ AgentInspect traces, log-ingest outputs, and exports are local files. They may s
 
 This guide is practical sharing guidance, not a guarantee that any artifact is safe to publish. Redaction profiles are **best-effort transformation**, not compliance-grade DLP or a safety certification. Always finish with `verify-safe` before sharing.
 
-Built-in profiles redact high-confidence credential forms (provider keys, JWTs, bearer tokens, and bounded `token=` / `api_key=` / `internal_token=` style key/value secrets). Broad or context-sensitive findings—such as private filesystem paths—may still appear under `verify-safe` and as residual status after `redact`. Org-specific patterns can use a local CLI `--policy` JSON file (`extraKeys` plus bounded literal/prefix/typed patterns) or programmatic custom detectors.
+Built-in profiles redact high-confidence credential forms (provider keys, JWTs, bearer tokens, and bounded `token=` / `api_key=` / `internal_token=` style key/value secrets). Broad or context-sensitive findings—such as private filesystem paths—may still appear under `verify-safe` and as residual status after `redact`. Org-specific patterns can use a local CLI `--policy` JSON file (`extraKeys` plus bounded literal/prefix patterns; no user regex) or programmatic custom detectors.
 
 `strict` is a stricter **rule set** (more keys), not a promise that every input produces bytes different from `share`.
 

package/docs/STANDARDS.md

@@ -29,7 +29,7 @@ The fixture's top-level `version` is an **AgentInspect reference fixture revisio
 npx agent-inspect export <run-id> --format otlp-json --profile share
 ```
 
-GenAI attribute mapping follows `OTEL_GEN_AI_SEMCONV_PIN` (see exporters API). No gRPC collector included.
+GenAI attribute mapping follows `OTEL_GEN_AI_SEMCONV_PIN` (see exporters API). The pin lists only attributes the exporter may emit (operation name, request model, usage tokens). AgentInspect does **not** export `gen_ai.prompt` / `gen_ai.completion` bodies. No gRPC collector included.
 
 Fixture: [fixtures/standards/otlp-basic.json](../fixtures/standards/otlp-basic.json)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.29.0",
+  "version": "6.29.1",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",

package/packages/cli/dist/{chunk-D7PT6TXM.mjs → chunk-UK4HD5M3.mjs}

@@ -841,6 +841,30 @@ var Redactor = class {
   }
 };
 
+// packages/core/src/safety/credential-value-patterns.ts
+var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i;
+var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
+  /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
+  /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
+  /\b[a-z0-9_.-]+=[^;\s]+(?:;\s*[a-z0-9_.-]+=[^;\s]+)+/i,
+  /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
+  /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
+  /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
+  KEY_VALUE_SECRET_PATTERN
+];
+function stringContainsHighConfidenceCredential(value) {
+  for (const pattern of HIGH_CONFIDENCE_CREDENTIAL_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(value)) {
+      pattern.lastIndex = 0;
+      return true;
+    }
+  }
+  return false;
+}
+
 // packages/core/src/redaction-profiles.ts
 var SHARE_PROFILE_EXTRA_KEYS = [
   "userEmail",
@@ -7074,7 +7098,15 @@ function buildEmbeddedPayload(input) {
       redactionProfile: input.redactionProfile,
       verificationPolicy: input.verificationPolicy
     },
-    checkSummary: input.checkSummary
+    checkSummary: input.checkSummary,
+    ...input.contractBinding !== void 0 ? {
+      contract: {
+        status: input.contractBinding.status,
+        ...input.contractBinding.sha256 !== void 0 ? { sha256: input.contractBinding.sha256 } : {},
+        ...input.contractBinding.ruleCount !== void 0 ? { ruleCount: input.contractBinding.ruleCount } : {},
+        ...input.contractBinding.note !== void 0 ? { note: input.contractBinding.note } : {}
+      }
+    } : {}
   };
 }
 function buildEvidenceHtmlShell(input) {
@@ -7172,6 +7204,7 @@ ${nav}
     <p>Artifact status: <span class="badge ${statusClass(input.assessmentStatus)}">${escapeHtml(input.assessmentStatus)}</span>
     ${input.sourceStatus !== void 0 ? ` \xB7 Source status: <span class="badge ${statusClass(input.sourceStatus)}">${escapeHtml(input.sourceStatus)}</span>` : ""}</p>
     <p>Profile: <code>${escapeHtml(input.redactionProfile)}</code> \xB7 Verification: <code>${escapeHtml(input.verificationPolicy)}</code></p>
+    ${input.contractBinding !== void 0 ? `<p>Contract binding: <code>${escapeHtml(input.contractBinding.status)}</code>${input.contractBinding.ruleCount !== void 0 ? ` \xB7 Rules: <code>${escapeHtml(String(input.contractBinding.ruleCount))}</code>` : ""}${input.contractBinding.sha256 !== void 0 ? ` \xB7 Digest: <code>${escapeHtml(input.contractBinding.sha256.slice(0, 16))}\u2026</code>` : ""}</p>${input.contractBinding.note !== void 0 && input.contractBinding.note.trim() !== "" ? `<p class="muted">${escapeHtml(input.contractBinding.note)}</p>` : ""}` : ""}
     <p>Generator: <code>${escapeHtml(input.generatorName)}@${escapeHtml(input.generatorVersion)}</code>
     ${input.createdAt ? ` \xB7 Created: <code>${escapeHtml(input.createdAt)}</code>` : ""}</p>
     <h3>Runs</h3>
@@ -7964,6 +7997,39 @@ var EVIDENCE_CONTRACT_CANONICALIZATION_VERSION = "1";
 var EVIDENCE_CONTRACT_PARTIAL_NOTE = "Custom or programmatic rules are not serializable; Evidence records rule IDs only and does not claim complete reviewer replay.";
 var EVIDENCE_CONTRACT_UNAVAILABLE_NOTE = "No resolved TraceContract or check preset was packaged with this Evidence artifact.";
 var EVIDENCE_CONTRACT_ASSURANCE_NOTE = "Contract binding verifies packaged digest integrity only; it does not prove producer identity, trusted time, source completeness, semantic truth, or external acceptance.";
+var EVIDENCE_CONTRACT_UNSAFE_NOTE = "Resolved TraceContract contains high-confidence credential-like expected values; Evidence refuses complete packaging rather than silently redacting evaluated expectations.";
+function contractContainsUnsafeExpectedValues(value) {
+  return scanForExpectedFields(value, 0);
+}
+function scanForExpectedFields(value, depth) {
+  if (depth > 32) return false;
+  if (Array.isArray(value)) {
+    return value.some((item) => scanForExpectedFields(item, depth + 1));
+  }
+  if (value === null || typeof value !== "object") return false;
+  const record = value;
+  for (const [key, child] of Object.entries(record)) {
+    if (key === "expected" || key === "oneOf") {
+      if (valueTreeContainsCredential(child, depth + 1)) return true;
+      continue;
+    }
+    if (scanForExpectedFields(child, depth + 1)) return true;
+  }
+  return false;
+}
+function valueTreeContainsCredential(value, depth) {
+  if (depth > 32) return false;
+  if (typeof value === "string") {
+    return stringContainsHighConfidenceCredential(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some((item) => valueTreeContainsCredential(item, depth + 1));
+  }
+  if (value === null || typeof value !== "object") return false;
+  return Object.values(value).some(
+    (child) => valueTreeContainsCredential(child, depth + 1)
+  );
+}
 function serializeCanonicalJson(value) {
   return `${JSON.stringify(stableValue(value), null, 2)}
 `;
@@ -8097,6 +8163,32 @@ function buildEvidenceContractPackage(input) {
   if (unsupported.length > 0) {
     ruleIds = sortedUniqueStrings([...ruleIds, ...unsupported]);
   }
+  if (contractContainsUnsafeExpectedValues(resolved)) {
+    return {
+      binding: {
+        status: "unavailable",
+        source: input.source,
+        ...input.contractId !== void 0 ? { contractId: input.contractId } : {},
+        ...input.contractVersion !== void 0 ? { contractVersion: input.contractVersion } : {},
+        canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+        engineVersion: input.engineVersion,
+        ruleIds,
+        ...unsupported.length > 0 ? { unsupportedRuleIds: unsupported } : {},
+        note: input.note ?? EVIDENCE_CONTRACT_UNSAFE_NOTE
+      },
+      checkBinding: {
+        canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+        engineVersion: input.engineVersion,
+        evaluatedRuleIds: ruleIds,
+        bindingStatus: "unavailable",
+        ...unsupported.length > 0 ? { unsupportedRuleIds: unsupported } : {},
+        origin: {
+          source: input.source,
+          ...input.preset?.name ? { preset: input.preset.name } : {}
+        }
+      }
+    };
+  }
   const document = {
     canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
     kind,
@@ -8469,29 +8561,6 @@ function buildEvidenceCiPackage(input) {
     schemaVersions.add(version);
   }
   const createdAt = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  const evidenceHtml = buildEvidenceHtmlShell({
-    title: "AgentInspect evidence",
-    runIds: input.runIds,
-    assessmentStatus: input.assessmentStatus,
-    sourceStatus: input.sourceStatus,
-    redactionProfile: input.redactionProfile,
-    verificationPolicy: input.redactionProfile,
-    generatorName: "agent-inspect",
-    generatorVersion: input.generatorVersion,
-    createdAt,
-    summaryText: input.summaryText,
-    checkSummary: {
-      aggregateStatus: input.assessmentStatus,
-      runs: input.runIds.map((runId) => ({
-        runId,
-        status: input.assessmentStatus,
-        sourceStatus: input.sourceStatus,
-        errors: input.assessmentStatus === "UNSAFE" || input.assessmentStatus === "UNKNOWN" ? 1 : 0,
-        warnings: input.assessmentStatus === "SAFE WITH WARNINGS" ? 1 : 0,
-        findings: 0
-      }))
-    }
-  });
   let checkResultsJson = input.checkResultsJson;
   let contractBinding;
   let contractFileContent;
@@ -8514,6 +8583,37 @@ function buildEvidenceCiPackage(input) {
       bindCheckResultsToContract(parsed, packaged2.checkBinding)
     );
   }
+  const evidenceHtml = buildEvidenceHtmlShell({
+    title: "AgentInspect evidence",
+    runIds: input.runIds,
+    assessmentStatus: input.assessmentStatus,
+    sourceStatus: input.sourceStatus,
+    redactionProfile: input.redactionProfile,
+    verificationPolicy: input.redactionProfile,
+    generatorName: "agent-inspect",
+    generatorVersion: input.generatorVersion,
+    createdAt,
+    summaryText: input.summaryText,
+    checkSummary: {
+      aggregateStatus: input.assessmentStatus,
+      runs: input.runIds.map((runId) => ({
+        runId,
+        status: input.assessmentStatus,
+        sourceStatus: input.sourceStatus,
+        errors: input.assessmentStatus === "UNSAFE" || input.assessmentStatus === "UNKNOWN" ? 1 : 0,
+        warnings: input.assessmentStatus === "SAFE WITH WARNINGS" ? 1 : 0,
+        findings: 0
+      }))
+    },
+    ...contractBinding !== void 0 ? {
+      contractBinding: {
+        status: contractBinding.status,
+        ...contractBinding.sha256 !== void 0 ? { sha256: contractBinding.sha256 } : {},
+        ...contractBinding.note !== void 0 ? { note: contractBinding.note } : {},
+        ruleCount: contractBinding.ruleIds.length
+      }
+    } : {}
+  });
   const packaged = [
     { path: EVIDENCE_HTML_FILENAME, content: evidenceHtml },
     { path: "check-results.json", content: checkResultsJson },
@@ -12386,5 +12486,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { COHORT_METRIC_IDS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-D7PT6TXM.mjs.map
-//# sourceMappingURL=chunk-D7PT6TXM.mjs.map
+//# sourceMappingURL=chunk-UK4HD5M3.mjs.map
+//# sourceMappingURL=chunk-UK4HD5M3.mjs.map