agent-inspect 6.31.15 → 6.31.17

package/packages/cli/dist/index.cjs

@@ -261,7 +261,7 @@ function stringContainsHighConfidenceCredential(value) {
 var KEY_VALUE_SECRET_PATTERN, HIGH_CONFIDENCE_CREDENTIAL_PATTERNS;
 var init_credential_value_patterns = __esm({
   "packages/core/src/safety/credential-value-patterns.ts"() {
-    KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i;
+    KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED|HASH:(?:[0-9a-f]{8}|unknown))\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i;
     HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
       /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
       /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
@@ -5994,8 +5994,8 @@ function isFullyRedactedValue(value, markers = ["[REDACTED]", "[REDACTED:"]) {
   if (typeof value !== "string") return false;
   const trimmed = value.trim();
   if (trimmed.length === 0) return false;
-  if (/^\[HASH:[A-Za-z0-9_-]+\]$/.test(trimmed)) return true;
-  if (/^\[REDACTED:[^\]]*\]$/.test(trimmed)) return true;
+  if (trimmed === "[HASH:unknown]") return true;
+  if (/^\[HASH:[0-9a-f]{8}\]$/.test(trimmed)) return true;
   for (const marker of markers) {
     if (marker.endsWith(":")) continue;
     if (trimmed === marker) return true;
@@ -7540,7 +7540,7 @@ var init_checks2 = __esm({
       // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
       {
         id: "key-value-secret",
-        pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i
+        pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED|HASH:(?:[0-9a-f]{8}|unknown))\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i
       }
     ];
   }
@@ -16829,7 +16829,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.31.15";
+var version = "6.31.17";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -21415,7 +21415,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
 }
 
 // packages/redact/src/key-value-secret.ts
-var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED|HASH:(?:[0-9a-f]{8}|unknown))\](?![^\s"'\\&#?]))([^\s"'\\]{8,})`;
 var KEY_VALUE_SECRET_PATTERN2 = new RegExp(
   KEY_VALUE_SECRET_PATTERN_SOURCE,
   "i"
@@ -21872,8 +21872,8 @@ function isCompleteRedactionMarker(value, replacement = "[REDACTED]") {
   const trimmed = value.trim();
   if (trimmed.length === 0) return false;
   if (trimmed === replacement) return true;
-  if (/^\[HASH:[A-Za-z0-9_-]+\]$/.test(trimmed)) return true;
-  if (/^\[REDACTED:[^\]]*\]$/.test(trimmed)) return true;
+  if (trimmed === "[HASH:unknown]") return true;
+  if (/^\[HASH:[0-9a-f]{8}\]$/.test(trimmed)) return true;
   return false;
 }
 function applyRule(rule, value, replacement) {
@@ -22106,6 +22106,9 @@ function isRecord18(value) {
 }
 function rejectRemotePolicyPath(policyPath) {
   const trimmed = policyPath.trim();
+  if (/^[a-z]:[\\/]/i.test(trimmed)) {
+    return;
+  }
   if (/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) {
     throw new Error(
       `--policy must be a local JSON file path (got a URL-like value). Remote policy fetch is not supported.`