agent-inspect 6.29.0 → 6.29.1

package/packages/cli/dist/index.cjs

@@ -165,8 +165,31 @@ var init_redactor = __esm({
 });
 
 // packages/core/src/safety/credential-value-patterns.ts
+function stringContainsHighConfidenceCredential(value) {
+  for (const pattern of HIGH_CONFIDENCE_CREDENTIAL_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(value)) {
+      pattern.lastIndex = 0;
+      return true;
+    }
+  }
+  return false;
+}
+var KEY_VALUE_SECRET_PATTERN, HIGH_CONFIDENCE_CREDENTIAL_PATTERNS;
 var init_credential_value_patterns = __esm({
   "packages/core/src/safety/credential-value-patterns.ts"() {
+    KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i;
+    HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
+      /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
+      /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
+      /\b[a-z0-9_.-]+=[^;\s]+(?:;\s*[a-z0-9_.-]+=[^;\s]+)+/i,
+      /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
+      /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
+      /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
+      /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+      /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
+      KEY_VALUE_SECRET_PATTERN
+    ];
   }
 });
 
@@ -6972,9 +6995,16 @@ var init_control_rules = __esm({
   }
 });
 
+// packages/core/src/checks/canonical-equality.ts
+var init_canonical_equality = __esm({
+  "packages/core/src/checks/canonical-equality.ts"() {
+  }
+});
+
 // packages/core/src/checks/tool-arguments.ts
 var init_tool_arguments = __esm({
   "packages/core/src/checks/tool-arguments.ts"() {
+    init_canonical_equality();
   }
 });
 
@@ -6989,6 +7019,7 @@ var init_retry_safety = __esm({
 // packages/core/src/checks/recovery-operations.ts
 var init_recovery_operations = __esm({
   "packages/core/src/checks/recovery-operations.ts"() {
+    init_canonical_equality();
     init_logical_events();
     init_tool_arguments();
     init_retry_safety();
@@ -7196,6 +7227,38 @@ var init_contract = __esm({
 });
 
 // packages/core/src/evidence/contract-binding.ts
+function contractContainsUnsafeExpectedValues(value) {
+  return scanForExpectedFields(value, 0);
+}
+function scanForExpectedFields(value, depth) {
+  if (depth > 32) return false;
+  if (Array.isArray(value)) {
+    return value.some((item) => scanForExpectedFields(item, depth + 1));
+  }
+  if (value === null || typeof value !== "object") return false;
+  const record = value;
+  for (const [key, child] of Object.entries(record)) {
+    if (key === "expected" || key === "oneOf") {
+      if (valueTreeContainsCredential(child, depth + 1)) return true;
+      continue;
+    }
+    if (scanForExpectedFields(child, depth + 1)) return true;
+  }
+  return false;
+}
+function valueTreeContainsCredential(value, depth) {
+  if (depth > 32) return false;
+  if (typeof value === "string") {
+    return stringContainsHighConfidenceCredential(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some((item) => valueTreeContainsCredential(item, depth + 1));
+  }
+  if (value === null || typeof value !== "object") return false;
+  return Object.values(value).some(
+    (child) => valueTreeContainsCredential(child, depth + 1)
+  );
+}
 function serializeCanonicalJson(value) {
   return `${JSON.stringify(stableValue(value), null, 2)}
 `;
@@ -7329,6 +7392,32 @@ function buildEvidenceContractPackage(input3) {
   if (unsupported.length > 0) {
     ruleIds = sortedUniqueStrings([...ruleIds, ...unsupported]);
   }
+  if (contractContainsUnsafeExpectedValues(resolved)) {
+    return {
+      binding: {
+        status: "unavailable",
+        source: input3.source,
+        ...input3.contractId !== void 0 ? { contractId: input3.contractId } : {},
+        ...input3.contractVersion !== void 0 ? { contractVersion: input3.contractVersion } : {},
+        canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+        engineVersion: input3.engineVersion,
+        ruleIds,
+        ...unsupported.length > 0 ? { unsupportedRuleIds: unsupported } : {},
+        note: input3.note ?? EVIDENCE_CONTRACT_UNSAFE_NOTE
+      },
+      checkBinding: {
+        canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
+        engineVersion: input3.engineVersion,
+        evaluatedRuleIds: ruleIds,
+        bindingStatus: "unavailable",
+        ...unsupported.length > 0 ? { unsupportedRuleIds: unsupported } : {},
+        origin: {
+          source: input3.source,
+          ...input3.preset?.name ? { preset: input3.preset.name } : {}
+        }
+      }
+    };
+  }
   const document = {
     canonicalizationVersion: EVIDENCE_CONTRACT_CANONICALIZATION_VERSION,
     kind,
@@ -7468,16 +7557,18 @@ function verifyEvidenceContractBinding(parts) {
   }
   return issues;
 }
-var EVIDENCE_CONTRACT_CANONICALIZATION_VERSION, EVIDENCE_CONTRACT_PARTIAL_NOTE, EVIDENCE_CONTRACT_UNAVAILABLE_NOTE, EVIDENCE_CONTRACT_ASSURANCE_NOTE;
+var EVIDENCE_CONTRACT_CANONICALIZATION_VERSION, EVIDENCE_CONTRACT_PARTIAL_NOTE, EVIDENCE_CONTRACT_UNAVAILABLE_NOTE, EVIDENCE_CONTRACT_ASSURANCE_NOTE, EVIDENCE_CONTRACT_UNSAFE_NOTE;
 var init_contract_binding = __esm({
   "packages/core/src/evidence/contract-binding.ts"() {
     init_contract();
+    init_credential_value_patterns();
     init_hash();
     init_types4();
     EVIDENCE_CONTRACT_CANONICALIZATION_VERSION = "1";
     EVIDENCE_CONTRACT_PARTIAL_NOTE = "Custom or programmatic rules are not serializable; Evidence records rule IDs only and does not claim complete reviewer replay.";
     EVIDENCE_CONTRACT_UNAVAILABLE_NOTE = "No resolved TraceContract or check preset was packaged with this Evidence artifact.";
     EVIDENCE_CONTRACT_ASSURANCE_NOTE = "Contract binding verifies packaged digest integrity only; it does not prove producer identity, trusted time, source completeness, semantic truth, or external acceptance.";
+    EVIDENCE_CONTRACT_UNSAFE_NOTE = "Resolved TraceContract contains high-confidence credential-like expected values; Evidence refuses complete packaging rather than silently redacting evaluated expectations.";
   }
 });
 
@@ -7826,7 +7917,15 @@ function buildEmbeddedPayload(input3) {
       redactionProfile: input3.redactionProfile,
       verificationPolicy: input3.verificationPolicy
     },
-    checkSummary: input3.checkSummary
+    checkSummary: input3.checkSummary,
+    ...input3.contractBinding !== void 0 ? {
+      contract: {
+        status: input3.contractBinding.status,
+        ...input3.contractBinding.sha256 !== void 0 ? { sha256: input3.contractBinding.sha256 } : {},
+        ...input3.contractBinding.ruleCount !== void 0 ? { ruleCount: input3.contractBinding.ruleCount } : {},
+        ...input3.contractBinding.note !== void 0 ? { note: input3.contractBinding.note } : {}
+      }
+    } : {}
   };
 }
 function buildEvidenceHtmlShell(input3) {
@@ -7924,6 +8023,7 @@ ${nav}
     <p>Artifact status: <span class="badge ${statusClass(input3.assessmentStatus)}">${escapeHtml(input3.assessmentStatus)}</span>
     ${input3.sourceStatus !== void 0 ? ` \xB7 Source status: <span class="badge ${statusClass(input3.sourceStatus)}">${escapeHtml(input3.sourceStatus)}</span>` : ""}</p>
     <p>Profile: <code>${escapeHtml(input3.redactionProfile)}</code> \xB7 Verification: <code>${escapeHtml(input3.verificationPolicy)}</code></p>
+    ${input3.contractBinding !== void 0 ? `<p>Contract binding: <code>${escapeHtml(input3.contractBinding.status)}</code>${input3.contractBinding.ruleCount !== void 0 ? ` \xB7 Rules: <code>${escapeHtml(String(input3.contractBinding.ruleCount))}</code>` : ""}${input3.contractBinding.sha256 !== void 0 ? ` \xB7 Digest: <code>${escapeHtml(input3.contractBinding.sha256.slice(0, 16))}\u2026</code>` : ""}</p>${input3.contractBinding.note !== void 0 && input3.contractBinding.note.trim() !== "" ? `<p class="muted">${escapeHtml(input3.contractBinding.note)}</p>` : ""}` : ""}
     <p>Generator: <code>${escapeHtml(input3.generatorName)}@${escapeHtml(input3.generatorVersion)}</code>
     ${input3.createdAt ? ` \xB7 Created: <code>${escapeHtml(input3.createdAt)}</code>` : ""}</p>
     <h3>Runs</h3>
@@ -9015,29 +9115,6 @@ function buildEvidenceCiPackage(input3) {
     schemaVersions.add(version2);
   }
   const createdAt = input3.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  const evidenceHtml = buildEvidenceHtmlShell({
-    title: "AgentInspect evidence",
-    runIds: input3.runIds,
-    assessmentStatus: input3.assessmentStatus,
-    sourceStatus: input3.sourceStatus,
-    redactionProfile: input3.redactionProfile,
-    verificationPolicy: input3.redactionProfile,
-    generatorName: "agent-inspect",
-    generatorVersion: input3.generatorVersion,
-    createdAt,
-    summaryText: input3.summaryText,
-    checkSummary: {
-      aggregateStatus: input3.assessmentStatus,
-      runs: input3.runIds.map((runId) => ({
-        runId,
-        status: input3.assessmentStatus,
-        sourceStatus: input3.sourceStatus,
-        errors: input3.assessmentStatus === "UNSAFE" || input3.assessmentStatus === "UNKNOWN" ? 1 : 0,
-        warnings: input3.assessmentStatus === "SAFE WITH WARNINGS" ? 1 : 0,
-        findings: 0
-      }))
-    }
-  });
   let checkResultsJson = input3.checkResultsJson;
   let contractBinding;
   let contractFileContent;
@@ -9060,6 +9137,37 @@ function buildEvidenceCiPackage(input3) {
       bindCheckResultsToContract(parsed, packaged2.checkBinding)
     );
   }
+  const evidenceHtml = buildEvidenceHtmlShell({
+    title: "AgentInspect evidence",
+    runIds: input3.runIds,
+    assessmentStatus: input3.assessmentStatus,
+    sourceStatus: input3.sourceStatus,
+    redactionProfile: input3.redactionProfile,
+    verificationPolicy: input3.redactionProfile,
+    generatorName: "agent-inspect",
+    generatorVersion: input3.generatorVersion,
+    createdAt,
+    summaryText: input3.summaryText,
+    checkSummary: {
+      aggregateStatus: input3.assessmentStatus,
+      runs: input3.runIds.map((runId) => ({
+        runId,
+        status: input3.assessmentStatus,
+        sourceStatus: input3.sourceStatus,
+        errors: input3.assessmentStatus === "UNSAFE" || input3.assessmentStatus === "UNKNOWN" ? 1 : 0,
+        warnings: input3.assessmentStatus === "SAFE WITH WARNINGS" ? 1 : 0,
+        findings: 0
+      }))
+    },
+    ...contractBinding !== void 0 ? {
+      contractBinding: {
+        status: contractBinding.status,
+        ...contractBinding.sha256 !== void 0 ? { sha256: contractBinding.sha256 } : {},
+        ...contractBinding.note !== void 0 ? { note: contractBinding.note } : {},
+        ruleCount: contractBinding.ruleIds.length
+      }
+    } : {}
+  });
   const packaged = [
     { path: EVIDENCE_HTML_FILENAME, content: evidenceHtml },
     { path: "check-results.json", content: checkResultsJson },
@@ -13648,7 +13756,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.29.0";
+var version = "6.29.1";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -17641,13 +17749,13 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
 
 // packages/redact/src/key-value-secret.ts
 var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})`;
-var KEY_VALUE_SECRET_PATTERN = new RegExp(
+var KEY_VALUE_SECRET_PATTERN2 = new RegExp(
   KEY_VALUE_SECRET_PATTERN_SOURCE,
   "i"
 );
 function valueContainsKeyValueSecret(value) {
-  KEY_VALUE_SECRET_PATTERN.lastIndex = 0;
-  return KEY_VALUE_SECRET_PATTERN.test(value);
+  KEY_VALUE_SECRET_PATTERN2.lastIndex = 0;
+  return KEY_VALUE_SECRET_PATTERN2.test(value);
 }
 
 // packages/redact/src/index.ts
@@ -18116,15 +18224,14 @@ var REDACTION_POLICY_LIMITS = {
   maxPatterns: 32,
   maxPatternLength: 128,
   maxPatternIdLength: 64,
-  maxTypedQuantifier: 64
+  /** Maximum policy file size before parse (bytes). */
+  maxPolicyFileBytes: 64 * 1024
 };
-var SAFE_TYPED_PATTERN = /^[A-Za-z0-9_@./:=<>\-[\]()|+*?{},\\\s^$]+$/;
+var ALLOWED_TOP_LEVEL = /* @__PURE__ */ new Set(["version", "extraKeys", "patterns"]);
+var ALLOWED_PATTERN_FIELDS = /* @__PURE__ */ new Set(["id", "type", "value", "severity"]);
 function isRecord17(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 function rejectRemotePolicyPath(policyPath) {
   const trimmed = policyPath.trim();
   if (/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) {
@@ -18153,43 +18260,23 @@ function validateExtraKey(key, index) {
   }
   return key;
 }
-function assertBoundedTypedPattern(pattern, label) {
-  if (pattern.length === 0) throw new Error(`${label} must be non-empty.`);
-  if (pattern.length > REDACTION_POLICY_LIMITS.maxPatternLength) {
-    throw new Error(
-      `${label} exceeds max length ${REDACTION_POLICY_LIMITS.maxPatternLength}.`
-    );
-  }
-  if (!SAFE_TYPED_PATTERN.test(pattern)) {
-    throw new Error(
-      `${label} contains unsupported characters for bounded typed patterns.`
-    );
-  }
-  if (/\(\?/.test(pattern) || /\\[1-9]/.test(pattern)) {
-    throw new Error(
-      `${label} rejects lookaround, backreferences, and nested quantifiers.`
-    );
-  }
-  if (/\([^)]*[+*{][^)]*\)[+*{]/.test(pattern) || /\[[^\]]*[+*{][^\]]*\][+*{]/.test(pattern)) {
-    throw new Error(`${label} rejects nested quantifiers.`);
-  }
-  if (/\.[*+]/.test(pattern) || /[*+]\{/.test(pattern)) {
-    throw new Error(`${label} rejects unbounded .* / .+ style quantifiers.`);
-  }
-  for (const match of pattern.matchAll(/\{(\d+)(?:,(\d*))?\}/g)) {
-    const min = Number(match[1]);
-    const maxRaw = match[2];
-    const max = maxRaw === void 0 || maxRaw === "" ? min : Number(maxRaw);
-    if (!Number.isFinite(min) || !Number.isFinite(max) || min > REDACTION_POLICY_LIMITS.maxTypedQuantifier || max > REDACTION_POLICY_LIMITS.maxTypedQuantifier) {
-      throw new Error(
-        `${label} quantifiers must be <= ${REDACTION_POLICY_LIMITS.maxTypedQuantifier}.`
-      );
+function rejectUnknownFields(record, allowed, label) {
+  for (const key of Object.keys(record)) {
+    if (!allowed.has(key)) {
+      throw new Error(`${label} rejects unknown field "${key}".`);
     }
   }
 }
 function compilePatternDetector(input3, index) {
   const label = `patterns[${index}]`;
   if (!isRecord17(input3)) throw new Error(`${label} must be an object.`);
+  const typeEarly = input3.type;
+  if (typeEarly === "typed") {
+    throw new Error(
+      `${label}.type "typed" is no longer supported (removed in 6.29.1). Use type "literal" or "prefix" with a fixed value; arbitrary regex patterns are not accepted.`
+    );
+  }
+  rejectUnknownFields(input3, ALLOWED_PATTERN_FIELDS, label);
   const idRaw = input3.id;
   if (typeof idRaw !== "string" || idRaw.trim() === "") {
     throw new Error(`${label}.id must be a non-empty string.`);
@@ -18204,48 +18291,35 @@ function compilePatternDetector(input3, index) {
     throw new Error(`${label}.id must be an identifier-like detector id.`);
   }
   const type = input3.type;
-  if (type !== "literal" && type !== "prefix" && type !== "typed") {
-    throw new Error(`${label}.type must be literal, prefix, or typed.`);
+  if (type !== "literal" && type !== "prefix") {
+    throw new Error(`${label}.type must be literal or prefix.`);
+  }
+  if (input3.pattern !== void 0) {
+    throw new Error(
+      `${label}.pattern is not accepted; use .value with type literal or prefix.`
+    );
   }
   const severity = parseSeverity(input3.severity, label);
-  let source;
-  if (type === "typed") {
-    if (typeof input3.pattern !== "string") {
-      throw new Error(`${label}.pattern must be a string for typed patterns.`);
-    }
-    assertBoundedTypedPattern(input3.pattern, `${label}.pattern`);
-    source = input3.pattern;
-  } else {
-    if (typeof input3.value !== "string") {
-      throw new Error(`${label}.value must be a string for ${type} patterns.`);
-    }
-    if (input3.value.length === 0) {
-      throw new Error(`${label}.value must be non-empty.`);
-    }
-    if (input3.value.length > REDACTION_POLICY_LIMITS.maxPatternLength) {
-      throw new Error(
-        `${label}.value exceeds max length ${REDACTION_POLICY_LIMITS.maxPatternLength}.`
-      );
-    }
-    const escaped = escapeRegExp(input3.value);
-    source = type === "prefix" ? `^${escaped}` : escaped;
+  if (typeof input3.value !== "string") {
+    throw new Error(`${label}.value must be a string for ${type} patterns.`);
   }
-  let regex;
-  try {
-    regex = new RegExp(source);
-  } catch (error) {
+  if (input3.value.length === 0) {
+    throw new Error(`${label}.value must be non-empty.`);
+  }
+  if (input3.value.length > REDACTION_POLICY_LIMITS.maxPatternLength) {
     throw new Error(
-      `${label} failed to compile: ${error instanceof Error ? error.message : String(error)}`
+      `${label}.value exceeds max length ${REDACTION_POLICY_LIMITS.maxPatternLength}.`
     );
   }
+  const needle = input3.value;
+  const match = type === "prefix" ? (haystack) => haystack.startsWith(needle) : (haystack) => haystack.includes(needle);
   return {
     id: `policy.${id}`,
     severity,
     matchKind: "custom",
     detect({ value }) {
       if (typeof value !== "string") return [];
-      regex.lastIndex = 0;
-      return regex.test(value) ? [{ action: "replace", severity, matchKind: "custom" }] : [];
+      return match(value) ? [{ action: "replace", severity, matchKind: "custom" }] : [];
     }
   };
 }
@@ -18253,6 +18327,7 @@ function compileRedactionPolicy(raw, policyPath) {
   if (!isRecord17(raw)) {
     throw new Error(`Redaction policy must be a JSON object (${policyPath}).`);
   }
+  rejectUnknownFields(raw, ALLOWED_TOP_LEVEL, "Redaction policy");
   const diagnostics = [];
   if (raw.version !== void 0 && raw.version !== 1) {
     throw new Error(`Unsupported redaction policy version (supported: 1).`);
@@ -18316,14 +18391,38 @@ function compileRedactionPolicy(raw, policyPath) {
 async function loadRedactionPolicy(policyPath) {
   rejectRemotePolicyPath(policyPath);
   const resolved = path33__default.default.resolve(policyPath);
-  let text;
+  let fileStat;
+  try {
+    fileStat = await promises.stat(resolved);
+  } catch (error) {
+    throw new Error(
+      `Failed to read --policy file "${resolved}": ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (!fileStat.isFile()) {
+    throw new Error(
+      `--policy must be a regular local JSON file (not a directory or special file): "${resolved}".`
+    );
+  }
+  if (fileStat.size > REDACTION_POLICY_LIMITS.maxPolicyFileBytes) {
+    throw new Error(
+      `--policy file exceeds max size ${REDACTION_POLICY_LIMITS.maxPolicyFileBytes} bytes.`
+    );
+  }
+  let buffer;
   try {
-    text = await promises.readFile(resolved, "utf-8");
+    buffer = await promises.readFile(resolved);
   } catch (error) {
     throw new Error(
       `Failed to read --policy file "${resolved}": ${error instanceof Error ? error.message : String(error)}`
     );
   }
+  if (buffer.byteLength > REDACTION_POLICY_LIMITS.maxPolicyFileBytes) {
+    throw new Error(
+      `--policy file exceeds max size ${REDACTION_POLICY_LIMITS.maxPolicyFileBytes} bytes.`
+    );
+  }
+  const text = buffer.toString("utf-8");
   let parsed;
   try {
     parsed = JSON.parse(text);