agent-inspect 6.31.16 → 6.31.17

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 6.31.17
+
+### Patch Changes
+
+- dc9aaf2: Harden sensitive-key complete-marker handling so arbitrary `[REDACTED:…]` / `[HASH:…]` payloads are re-scrubbed (library-emitted markers only), and ship the already-merged Windows `--policy` drive-path fix.
+
 ## 6.31.16
 
 ### Patch Changes

package/README.md

@@ -213,7 +213,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.31.16** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.31.17** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/SECURITY.md

@@ -62,6 +62,7 @@ AgentInspect aims to be safe-by-default for **log-derived attributes** and **exp
 
 - Log ingestion applies redaction to parsed attributes using configured rules (with conservative defaults).
 - Exporters default to redacted output and bounded attribute previews.
+- Sensitive-key complete-marker bypass trusts only library-emitted placeholders (`[REDACTED]`, `[HASH:<8 hex>]`, `[HASH:unknown]`). Arbitrary `[REDACTED:…]` / `[HASH:…]` strings are re-scrubbed. Report residual marker-grammar gaps via a private advisory when possible.
 
 Important limitations:
 

package/docs/COMPARE.md

@@ -100,6 +100,16 @@ AgentInspect avoids SDK/collector setup for local debugging:
 - Use OpenTelemetry when you need organization-wide production telemetry pipelines.
 - Local OTLP JSON export can help bridge later, but AgentInspect is not an OpenTelemetry SDK replacement.
 
+## AgentInspect vs OrcaReplay
+
+OrcaReplay is a local CLI that records an agent run at the model-provider boundary and serves the recorded turns back later without contacting the provider.
+
+AgentInspect is local-first CLI debugging:
+
+- Use AgentInspect to inspect and gate a run's trajectory; the two capture at different layers, so a run can be captured by both at once — AgentInspect instruments inside the process and produces an execution tree, while OrcaReplay proxies the provider connection and records the bytes on the wire.
+- If you reach for OrcaReplay, two limits are worth knowing: a matching replay is not a determinism result, and replay blocks model-provider egress only — it is not a sandbox, so recorded tool calls still execute and a tool that opens its own connection still reaches the network.
+- AgentInspect does not replay a recorded run; the README lists "a replay engine" among the things it is not.
+
 ## Quick decision table
 
 | Need | AgentInspect fit |
@@ -112,6 +122,7 @@ AgentInspect avoids SDK/collector setup for local debugging:
 | Share-safe local redaction copy | Good fit |
 | Existing structured logs to trees | Good fit |
 | VS Code trace review (in-repo extension) | Good fit; Marketplace listing separate |
+| Offline replay of a recorded run | Not the goal |
 | Production dashboards | Not the goal |
 | Hosted eval datasets | Not the goal |
 | Prompt management | Not the goal |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.31.16",
+  "version": "6.31.17",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",

package/packages/cli/dist/{chunk-ZAYVAHIH.mjs → chunk-USZJEEME.mjs}

@@ -930,7 +930,7 @@ var Redactor = class {
 };
 
 // packages/core/src/safety/credential-value-patterns.ts
-var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i;
+var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED|HASH:(?:[0-9a-f]{8}|unknown))\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i;
 var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
   /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
   /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
@@ -7525,7 +7525,7 @@ var DEFAULT_SECRET_PATTERNS = [
   // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
   {
     id: "key-value-secret",
-    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i
+    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED|HASH:(?:[0-9a-f]{8}|unknown))\](?![^\s"'\\&#?]))([^\s"'\\]{8,})/i
   }
 ];
 function compareStrings(a, b) {
@@ -7966,8 +7966,8 @@ function isFullyRedactedValue(value, markers = ["[REDACTED]", "[REDACTED:"]) {
   if (typeof value !== "string") return false;
   const trimmed = value.trim();
   if (trimmed.length === 0) return false;
-  if (/^\[HASH:[A-Za-z0-9_-]+\]$/.test(trimmed)) return true;
-  if (/^\[REDACTED:[^\]]*\]$/.test(trimmed)) return true;
+  if (trimmed === "[HASH:unknown]") return true;
+  if (/^\[HASH:[0-9a-f]{8}\]$/.test(trimmed)) return true;
   for (const marker of markers) {
     if (marker.endsWith(":")) continue;
     if (trimmed === marker) return true;
@@ -15547,5 +15547,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { ATTRIBUTION_CONFIDENCES, COHORT_METRIC_IDS, DEFAULT_REDACT_KEYS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, defineTraceContract, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, evaluateTraceContract, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isAttributionConfidence, isCredentialSensitiveKey, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToRunTrees, persistedInspectEventsToTraceEvents, projectLogicalEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, stringContainsHighConfidenceCredential, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-ZAYVAHIH.mjs.map
-//# sourceMappingURL=chunk-ZAYVAHIH.mjs.map
+//# sourceMappingURL=chunk-USZJEEME.mjs.map
+//# sourceMappingURL=chunk-USZJEEME.mjs.map