agent-inspect 6.29.4 → 6.29.6

package/packages/core/dist/checks.cjs

@@ -10,6 +10,23 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 var path__default = /*#__PURE__*/_interopDefault(path);
 var os__default = /*#__PURE__*/_interopDefault(os);
 
+// packages/core/src/types/inspect-event.ts
+var ATTRIBUTION_CONFIDENCES = [
+  "unknown",
+  "heuristic",
+  "correlated",
+  "explicit"
+];
+function isAttributionConfidence(value) {
+  return typeof value === "string" && ATTRIBUTION_CONFIDENCES.includes(value);
+}
+var ATTRIBUTION_CONFIDENCE_RANK = {
+  unknown: 0,
+  heuristic: 1,
+  correlated: 2,
+  explicit: 3
+};
+
 // packages/core/src/diagnostics/programmatic.ts
 var PROGRAMMATIC_DIAGNOSTIC_SPECS = Object.freeze({
   AI_TRACE_INPUT_INVALID: {
@@ -2021,16 +2038,6 @@ function eventTime2(event) {
 function sortByTime2(events) {
   return [...events].sort((a, b) => eventTime2(a).localeCompare(eventTime2(b)));
 }
-function hasIdempotencyEvidence2(event) {
-  const workflow = workflowFor2(event);
-  if (typeof workflow.idempotencyKey === "string" && workflow.idempotencyKey.trim() !== "") {
-    return true;
-  }
-  const attrs2 = event.attributes ?? {};
-  if (attrs2.noSideEffect === true) return true;
-  if (attrs2.sideEffect === false) return true;
-  return false;
-}
 function errorCodeOf(event) {
   if (typeof event.error?.code === "string" && event.error.code.trim() !== "") {
     return event.error.code.trim();
@@ -2287,13 +2294,13 @@ function evaluateRecoveryOperations(events, operations) {
       }
       if (sideEffectClass === "write") {
         for (const event of ordered) {
-          if (isUnevaluableWriteCompletion(event) && !hasIdempotencyEvidence2(event)) {
+          if (isUnevaluableWriteCompletion(event)) {
             findings.push(
               fail3(
                 "contract.retry.operations.write-completion-unevaluable",
-                `Write tool ${operation.tool} has timeout/unknown completion without authoritative idempotency evidence.`,
+                `Write tool ${operation.tool} has timeout/unknown/running completion that cannot be verified as an authoritative write result.`,
                 [eventEvidence2(event)],
-                "idempotencyKey|authoritative completion",
+                "authoritative write completion observation",
                 {
                   code: "AI_CHECK_RECOVERY_WRITE_COMPLETION_UNAVAILABLE",
                   status: event.status
@@ -2437,7 +2444,7 @@ function evaluateRecoveryOperations(events, operations) {
       if (dependency?.consumerKind === "LLM") {
         const successForDependency = latest?.status === "ok" ? latest : identityUnavailable ? void 0 : lastOk;
         if (successForDependency) {
-          if (sideEffectClass === "write" && isUnevaluableWriteCompletion(successForDependency) && !hasIdempotencyEvidence2(successForDependency)) {
+          if (sideEffectClass === "write" && isUnevaluableWriteCompletion(successForDependency)) {
             findings.push(
               fail3(
                 "contract.retry.operations.successful-result-dependency",
@@ -3489,12 +3496,7 @@ var STATUS_RANK = {
   warning: 1,
   pass: 2
 };
-var CONFIDENCE_RANK = {
-  unknown: 0,
-  heuristic: 1,
-  correlated: 2,
-  explicit: 3
-};
+var CONFIDENCE_RANK = ATTRIBUTION_CONFIDENCE_RANK;
 var DEFAULT_SENSITIVE_KEYS = DEFAULT_CREDENTIAL_SENSITIVE_KEYS;
 var DEFAULT_RAW_CONTENT_KEYS = [
   "body",
@@ -3979,6 +3981,18 @@ function limitFindings(findings, maxFindings) {
 function hasRedactionMarker(value, markers) {
   return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
 }
+function isFullyRedactedValue(value, markers = ["[REDACTED]", "[REDACTED:"]) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return false;
+  if (/^\[HASH:[A-Za-z0-9_-]+\]$/.test(trimmed)) return true;
+  if (/^\[REDACTED:[^\]]*\]$/.test(trimmed)) return true;
+  for (const marker of markers) {
+    if (marker.endsWith(":")) continue;
+    if (trimmed === marker) return true;
+  }
+  return false;
+}
 function isSensitiveKey(key, sensitiveKeys) {
   return isCredentialSensitiveKey(key, sensitiveKeys);
 }
@@ -4333,8 +4347,26 @@ function createToolUsageRule(options) {
       const findings = [];
       for (const required of options.required ?? []) {
         if (!nameSet.has(required)) {
+          const otherKinds = [
+            ...new Set(
+              context.events.filter((event) => {
+                const kind = typeof event.kind === "string" ? event.kind.toUpperCase() : "";
+                if (kind === "TOOL") return false;
+                return resolveCanonicalToolName(event) === required || event.name === required || event.name === `tool:${required}` || event.name.endsWith(`:${required}`);
+              }).map(
+                (event) => typeof event.kind === "string" ? event.kind.toUpperCase() : "UNKNOWN"
+              )
+            )
+          ].sort();
+          const hint = otherKinds.length > 0 ? ` Required name appears under non-TOOL kind(s): ${otherKinds.join(", ")}. tools.required / requiredOrder match TOOL events only.` : "";
           findings.push(
-            failFinding("tool.usage", `Required tool ${required} did not appear.`, runEvidence(context.selectedRun), required, names)
+            failFinding(
+              "tool.usage",
+              `Required tool ${required} did not appear.${hint}`,
+              runEvidence(context.selectedRun),
+              required,
+              names
+            )
           );
         }
       }
@@ -4763,6 +4795,12 @@ function createStructureCycleRule() {
   };
 }
 function createStructureRelationshipRule(options = {}) {
+  if (options.minConfidence !== void 0 && !isAttributionConfidence(options.minConfidence)) {
+    throw new TypeError(
+      `createStructureRelationshipRule: minConfidence must be one of: ${ATTRIBUTION_CONFIDENCES.join(", ")}.`
+    );
+  }
+  const minConfidence = options.minConfidence;
   return {
     id: "structure.relationship",
     category: "structure",
@@ -4770,18 +4808,21 @@ function createStructureRelationshipRule(options = {}) {
     evaluate(context) {
       const byId = eventMap(semanticEvents(context));
       const findings = [];
-      const minConfidence = options.minConfidence;
       for (const event of semanticEvents(context)) {
-        if (minConfidence && CONFIDENCE_RANK[event.confidence] < CONFIDENCE_RANK[minConfidence]) {
-          findings.push(
-            failFinding(
-              "structure.relationship",
-              `Event confidence ${event.confidence} is below ${minConfidence}.`,
-              [eventEvidence3(event, "confidence")],
-              { minConfidence },
-              event.confidence
-            )
-          );
+        if (minConfidence) {
+          const eventRank = CONFIDENCE_RANK[event.confidence] ?? CONFIDENCE_RANK.unknown;
+          const minRank = CONFIDENCE_RANK[minConfidence];
+          if (eventRank < minRank) {
+            findings.push(
+              failFinding(
+                "structure.relationship",
+                `Event confidence ${event.confidence} is below ${minConfidence}.`,
+                [eventEvidence3(event, "confidence")],
+                { minConfidence },
+                event.confidence
+              )
+            );
+          }
         }
         if (!event.parentId) continue;
         if (event.parentId === event.eventId) {
@@ -5048,6 +5089,7 @@ function createSafetyRedactionRule(options = {}) {
 function createSafetyRawContentRule(options = {}) {
   const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
   const safePathPrefixes = options.safePathPrefixes ?? DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES;
+  const markers = options.redactedMarkers ?? ["[REDACTED]", "[REDACTED:"];
   return {
     id: "safety.rawPrompt",
     category: "safety",
@@ -5058,6 +5100,7 @@ function createSafetyRawContentRule(options = {}) {
         for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
           const key = entry.key ?? lastPathSegment(entry.path);
           if (!isRawContentPath(entry.path, key, forbiddenKeys, safePathPrefixes)) continue;
+          if (isFullyRedactedValue(entry.value, markers)) continue;
           findings.push(
             failFinding(
               "safety.rawPrompt",
@@ -5453,6 +5496,8 @@ function runTraceChecks(input, options = {}) {
   };
 }
 
+exports.ATTRIBUTION_CONFIDENCES = ATTRIBUTION_CONFIDENCES;
+exports.ATTRIBUTION_CONFIDENCE_RANK = ATTRIBUTION_CONFIDENCE_RANK;
 exports.PROGRAMMATIC_DIAGNOSTIC_SPECS = PROGRAMMATIC_DIAGNOSTIC_SPECS;
 exports.buildTraceFacts = buildTraceFacts;
 exports.createBaselineRegressionRule = createBaselineRegressionRule;
@@ -5489,6 +5534,7 @@ exports.evaluateTraceContractRead = evaluateTraceContractRead;
 exports.explainTraceContract = explainTraceContract;
 exports.extractToolArgumentPayload = extractToolArgumentPayload;
 exports.formatProgrammaticDiagnostic = formatProgrammaticDiagnostic;
+exports.isAttributionConfidence = isAttributionConfidence;
 exports.lintTraceContract = lintTraceContract;
 exports.projectLogicalEvents = projectLogicalEvents;
 exports.resolveCanonicalToolName = resolveCanonicalToolName;