agent-inspect 6.29.5 → 6.29.6

package/packages/cli/dist/index.cjs

@@ -5814,6 +5814,18 @@ function limitFindings(findings, maxFindings) {
 function hasRedactionMarker(value, markers) {
   return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
 }
+function isFullyRedactedValue(value, markers = ["[REDACTED]", "[REDACTED:"]) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return false;
+  if (/^\[HASH:[A-Za-z0-9_-]+\]$/.test(trimmed)) return true;
+  if (/^\[REDACTED:[^\]]*\]$/.test(trimmed)) return true;
+  for (const marker of markers) {
+    if (marker.endsWith(":")) continue;
+    if (trimmed === marker) return true;
+  }
+  return false;
+}
 function isSensitiveKey(key, sensitiveKeys) {
   return isCredentialSensitiveKey(key, sensitiveKeys);
 }
@@ -6132,8 +6144,26 @@ function createToolUsageRule(options) {
       const findings = [];
       for (const required of options.required ?? []) {
         if (!nameSet.has(required)) {
+          const otherKinds = [
+            ...new Set(
+              context.events.filter((event) => {
+                const kind = typeof event.kind === "string" ? event.kind.toUpperCase() : "";
+                if (kind === "TOOL") return false;
+                return resolveCanonicalToolName(event) === required || event.name === required || event.name === `tool:${required}` || event.name.endsWith(`:${required}`);
+              }).map(
+                (event) => typeof event.kind === "string" ? event.kind.toUpperCase() : "UNKNOWN"
+              )
+            )
+          ].sort();
+          const hint = otherKinds.length > 0 ? ` Required name appears under non-TOOL kind(s): ${otherKinds.join(", ")}. tools.required / requiredOrder match TOOL events only.` : "";
           findings.push(
-            failFinding("tool.usage", `Required tool ${required} did not appear.`, runEvidence(context.selectedRun), required, names)
+            failFinding(
+              "tool.usage",
+              `Required tool ${required} did not appear.${hint}`,
+              runEvidence(context.selectedRun),
+              required,
+              names
+            )
           );
         }
       }
@@ -6498,6 +6528,7 @@ function createSafetyRedactionRule(options = {}) {
 function createSafetyRawContentRule(options = {}) {
   const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
   const safePathPrefixes = options.safePathPrefixes ?? DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES;
+  const markers = options.redactedMarkers ?? ["[REDACTED]", "[REDACTED:"];
   return {
     id: "safety.rawPrompt",
     category: "safety",
@@ -6508,6 +6539,7 @@ function createSafetyRawContentRule(options = {}) {
         for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
           const key = entry.key ?? lastPathSegment(entry.path);
           if (!isRawContentPath(entry.path, key, forbiddenKeys, safePathPrefixes)) continue;
+          if (isFullyRedactedValue(entry.value, markers)) continue;
           findings.push(
             failFinding(
               "safety.rawPrompt",
@@ -13779,7 +13811,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.29.5";
+var version = "6.29.6";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -27025,7 +27057,7 @@ function createCliProgram() {
     "add run.maxStepDuration (e.g. 30s, 5m)"
   ).option("--require-completed", "add run.requireCompleted").option("--detect-stalls", "add run.stall for running or incomplete events").option(
     "--fail-on-observation <status>",
-    "fail when observed outcomes match status (passed, failed, unknown, skipped; comma-separated)"
+    "outcome gate: require \u22651 OUTCOME and fail when status matches (passed,failed,unknown,skipped; comma-separated). Does not invent outcomes from tool/LLM/run success; use --preset trajectory for structural checks"
   ).option("--session <id>", "check all runs in a workflow session (requires --dir)").option("--group <id>", "check all runs sharing a groupId (requires --dir)").option(
     "--correlate-group",
     "when using --session, also match synthetic group: session keys"
@@ -27038,7 +27070,7 @@ function createCliProgram() {
     "run optional circuit rules (repeatable): same-tool-repetition, max-retries, ...",
     (value, previous = []) => [...previous, value]
   ).addOption(
-    new commander.Option("--preset <name>", "additive check preset").choices(["trajectory", "safety", "comprehensive", "behavioral-session"])
+    new commander.Option("--preset <name>", "additive check preset (trajectory=structure only; safety=share checks; not interchangeable)").choices(["trajectory", "safety", "comprehensive", "behavioral-session"])
   ).addOption(
     new commander.Option(
       "--evidence-on <mode>",