agent-inspect 6.31.2 → 6.31.4

package/packages/core/dist/{chunk-CBPWLHNQ.mjs → chunk-PKDBFBJ7.mjs}

@@ -1,4 +1,5 @@
-import { OBSERVED_OUTCOME_METHODS, extractOutcomesFromPersistedEvents, outcomesMatchingStatus } from './chunk-BGF5JDJN.mjs';
+import { OBSERVED_OUTCOME_METHODS, extractOutcomesFromPersistedEvents, outcomesMatchingStatus } from './chunk-INE5IWLN.mjs';
+import { DEFAULT_CREDENTIAL_SENSITIVE_KEYS, isCredentialSensitiveKey } from './chunk-VLVCLAPB.mjs';
 import { formatProgrammaticDiagnostic } from './chunk-FWK3Q3OJ.mjs';
 import { isAttributionConfidence, ATTRIBUTION_CONFIDENCES, ATTRIBUTION_CONFIDENCE_RANK } from './chunk-EE5Z2GQ3.mjs';
 
@@ -935,78 +936,6 @@ function buildTraceFacts(input) {
   };
 }
 
-// packages/core/src/safety/sensitive-key.ts
-function keyHasExplicitSeparator(value) {
-  return /[_\-.]/.test(value);
-}
-function normalizeSensitiveKey(value) {
-  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-}
-var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
-  [
-    "tokens",
-    "max_tokens",
-    "min_tokens",
-    "ls_max_tokens",
-    "token_count",
-    "token_limit",
-    "token_budget",
-    "input_tokens",
-    "output_tokens",
-    "total_tokens",
-    "cached_tokens",
-    "prompt_tokens",
-    "completion_tokens"
-  ].map(normalizeSensitiveKey)
-);
-var DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
-  "authorization",
-  "cookie",
-  "token",
-  "access_token",
-  "accesstoken",
-  "auth_token",
-  "authtoken",
-  "refresh_token",
-  "refreshtoken",
-  "id_token",
-  "idtoken",
-  "bearer_token",
-  "bearertoken",
-  "api_token",
-  "apitoken",
-  "apikey",
-  "api_key",
-  "password",
-  "secret",
-  "email"
-];
-function isTokenCredentialKey(normalized) {
-  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
-  if (normalized === "token") return true;
-  if (normalized.endsWith("tokens")) return false;
-  return normalized.endsWith("token");
-}
-function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
-  if (!key) return false;
-  const normalized = normalizeSensitiveKey(key);
-  if (!normalized) return false;
-  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
-  const allowPrefixCompound = keyHasExplicitSeparator(key);
-  for (const sensitive of sensitiveKeys) {
-    const s = normalizeSensitiveKey(sensitive);
-    if (!s) continue;
-    if (s === "token") {
-      if (isTokenCredentialKey(normalized)) return true;
-      continue;
-    }
-    if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`)) return true;
-    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
-  }
-  return false;
-}
-
 // packages/core/src/checks/contract-scope.ts
 function diagnostic(code, message, ruleId) {
   return {
@@ -3492,7 +3421,7 @@ var DEFAULT_SECRET_PATTERNS = [
   // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
   {
     id: "key-value-secret",
-    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i
+    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i
   }
 ];
 function compareStrings(a, b) {
@@ -5520,5 +5449,5 @@ function runTraceChecks(input, options = {}) {
 }
 
 export { buildTraceFacts, createBaselineRegressionRule, createDecisionRule, createGuardrailRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRetrievalRule, createRunDepthRule, createRunDurationRule, createRunEventCountRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStepOrderingRule, createStructureCycleRule, createStructureIncompleteRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolFailureRule, createToolOrderingRule, createToolUsageRule, defineTraceContract, deriveFailureFacts, deriveRelationshipFacts, evaluateToolArgumentValue, evaluateTraceContract, evaluateTraceContractRead, explainTraceContract, extractSessionWorkflowMetadata, extractToolArgumentPayload, lintTraceContract, projectLogicalEvents, resolveCanonicalToolName, resolveJsonPointer, resolveTraceContractScope, runTraceChecks, sessionKeyForRun, summarizeSemanticParity, workflowMetadataForRun };
-//# sourceMappingURL=chunk-CBPWLHNQ.mjs.map
-//# sourceMappingURL=chunk-CBPWLHNQ.mjs.map
+//# sourceMappingURL=chunk-PKDBFBJ7.mjs.map
+//# sourceMappingURL=chunk-PKDBFBJ7.mjs.map