agent-inspect 6.31.3 → 6.31.4

package/packages/cli/dist/index.cjs

@@ -13,6 +13,7 @@ var readline = require('readline');
 var url = require('url');
 var module$1 = require('module');
 var commander = require('commander');
+var string_decoder = require('string_decoder');
 var child_process = require('child_process');
 var util = require('util');
 var http = require('http');
@@ -66,6 +67,83 @@ var init_correlation_metadata = __esm({
     ];
   }
 });
+
+// packages/core/src/safety/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
+function normalizeSensitiveKey(value) {
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function isTokenCredentialKey(normalized) {
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  if (normalized === "token") return true;
+  if (normalized.endsWith("tokens")) return false;
+  return normalized.endsWith("token");
+}
+function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
+  if (!key) return false;
+  const normalized = normalizeSensitiveKey(key);
+  if (!normalized) return false;
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
+  for (const sensitive of sensitiveKeys) {
+    const s = normalizeSensitiveKey(sensitive);
+    if (!s) continue;
+    if (s === "token") {
+      if (isTokenCredentialKey(normalized)) return true;
+      continue;
+    }
+    if (normalized === s) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
+  }
+  return false;
+}
+var NON_CREDENTIAL_TOKEN_CONFIG_KEYS, DEFAULT_CREDENTIAL_SENSITIVE_KEYS;
+var init_sensitive_key = __esm({
+  "packages/core/src/safety/sensitive-key.ts"() {
+    NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
+      [
+        "tokens",
+        "max_tokens",
+        "min_tokens",
+        "ls_max_tokens",
+        "token_count",
+        "token_limit",
+        "token_budget",
+        "input_tokens",
+        "output_tokens",
+        "total_tokens",
+        "cached_tokens",
+        "prompt_tokens",
+        "completion_tokens"
+      ].map(normalizeSensitiveKey)
+    );
+    DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
+      "authorization",
+      "cookie",
+      "token",
+      "access_token",
+      "accesstoken",
+      "auth_token",
+      "authtoken",
+      "refresh_token",
+      "refreshtoken",
+      "id_token",
+      "idtoken",
+      "bearer_token",
+      "bearertoken",
+      "api_token",
+      "apitoken",
+      "apikey",
+      "api_key",
+      "password",
+      "secret",
+      "email"
+    ];
+  }
+});
 function isRecord(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -80,7 +158,7 @@ function compileRules(rules, extraKeys) {
   const out = /* @__PURE__ */ new Map();
   const set = (r) => {
     const k = toKey(r.key);
-    out.set(k, { ...r, key: k });
+    out.set(k, { ...r, key: k, raw: r.raw ?? r.key });
   };
   for (const k of DEFAULT_REDACT_KEYS) {
     set({ key: k, strategy: "full" });
@@ -107,6 +185,7 @@ function compileRules(rules, extraKeys) {
 var DEFAULT_REDACT_KEYS, Redactor;
 var init_redactor = __esm({
   "packages/core/src/logs/redactor.ts"() {
+    init_sensitive_key();
     DEFAULT_REDACT_KEYS = [
       "authorization",
       "cookie",
@@ -121,9 +200,13 @@ var init_redactor = __esm({
       constructor(options) {
         this.#rules = compileRules(options?.rules, options?.extraKeys);
       }
+      /** Field names this redactor treats as sensitive, for value-level helpers. */
+      get sensitiveKeys() {
+        return this.#rules.map((rule) => rule.raw ?? rule.key);
+      }
       redactValue(key, value) {
         const k = toKey(key);
-        const rule = this.#rules.find((r) => r.key === k);
+        const rule = this.#rules.find((r) => r.key === k) ?? this.#rules.find((r) => isCredentialSensitiveKey(key, [r.raw ?? r.key]));
         if (!rule) {
           return this.#redactNested(value);
         }
@@ -178,7 +261,7 @@ function stringContainsHighConfidenceCredential(value) {
 var KEY_VALUE_SECRET_PATTERN, HIGH_CONFIDENCE_CREDENTIAL_PATTERNS;
 var init_credential_value_patterns = __esm({
   "packages/core/src/safety/credential-value-patterns.ts"() {
-    KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i;
+    KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i;
     HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
       /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
       /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
@@ -829,6 +912,10 @@ var init_nanoid = __esm({
     POOL_SIZE_MULTIPLIER = 128;
   }
 });
+var init_trace_filesystem = __esm({
+  "packages/core/src/trace-filesystem.ts"() {
+  }
+});
 
 // packages/core/src/utils/duration.ts
 function parseDuration(duration) {
@@ -979,6 +1066,7 @@ function warn(message, error) {
 var DEFAULT_TRACE_DIR_NAME, RUNS_DIR_NAME, FALLBACK_TRACE_DIR, MAX_NAME_LENGTH;
 var init_utils = __esm({
   "packages/core/src/utils.ts"() {
+    init_trace_filesystem();
     init_duration();
     DEFAULT_TRACE_DIR_NAME = ".agent-inspect";
     RUNS_DIR_NAME = "runs";
@@ -1149,6 +1237,7 @@ var init_storage = __esm({
     init_types();
     init_trace_event_safety();
     init_read_trace();
+    init_trace_filesystem();
     init_utils();
   }
 });
@@ -4662,83 +4751,6 @@ var init_programmatic = __esm({
   }
 });
 
-// packages/core/src/safety/sensitive-key.ts
-function keyHasExplicitSeparator(value) {
-  return /[_\-.]/.test(value);
-}
-function normalizeSensitiveKey(value) {
-  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-}
-function isTokenCredentialKey(normalized) {
-  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
-  if (normalized === "token") return true;
-  if (normalized.endsWith("tokens")) return false;
-  return normalized.endsWith("token");
-}
-function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
-  if (!key) return false;
-  const normalized = normalizeSensitiveKey(key);
-  if (!normalized) return false;
-  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
-  const allowPrefixCompound = keyHasExplicitSeparator(key);
-  for (const sensitive of sensitiveKeys) {
-    const s = normalizeSensitiveKey(sensitive);
-    if (!s) continue;
-    if (s === "token") {
-      if (isTokenCredentialKey(normalized)) return true;
-      continue;
-    }
-    if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`)) return true;
-    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
-  }
-  return false;
-}
-var NON_CREDENTIAL_TOKEN_CONFIG_KEYS, DEFAULT_CREDENTIAL_SENSITIVE_KEYS;
-var init_sensitive_key = __esm({
-  "packages/core/src/safety/sensitive-key.ts"() {
-    NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
-      [
-        "tokens",
-        "max_tokens",
-        "min_tokens",
-        "ls_max_tokens",
-        "token_count",
-        "token_limit",
-        "token_budget",
-        "input_tokens",
-        "output_tokens",
-        "total_tokens",
-        "cached_tokens",
-        "prompt_tokens",
-        "completion_tokens"
-      ].map(normalizeSensitiveKey)
-    );
-    DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
-      "authorization",
-      "cookie",
-      "token",
-      "access_token",
-      "accesstoken",
-      "auth_token",
-      "authtoken",
-      "refresh_token",
-      "refreshtoken",
-      "id_token",
-      "idtoken",
-      "bearer_token",
-      "bearertoken",
-      "api_token",
-      "apitoken",
-      "apikey",
-      "api_key",
-      "password",
-      "secret",
-      "email"
-    ];
-  }
-});
-
 // packages/core/src/checks/logical-events.ts
 function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -7350,7 +7362,7 @@ var init_checks2 = __esm({
       // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
       {
         id: "key-value-secret",
-        pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i
+        pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i
       }
     ];
   }
@@ -16153,7 +16165,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.31.3";
+var version = "6.31.4";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -17757,6 +17769,7 @@ async function followFile(filePath, options, onLine, shouldStop) {
     await readFileOnce(filePath, onLine);
     return;
   }
+  let decoder = new string_decoder.StringDecoder("utf-8");
   pos = st.size;
   while (!shouldStop()) {
     let next;
@@ -17770,6 +17783,7 @@ async function followFile(filePath, options, onLine, shouldStop) {
       pos = 0;
       carry = "";
       lineNumber = 0;
+      decoder = new string_decoder.StringDecoder("utf-8");
     }
     if (next.size > pos) {
       const fh = await promises.open(filePath, "r");
@@ -17778,7 +17792,7 @@ async function followFile(filePath, options, onLine, shouldStop) {
         const buf = Buffer.allocUnsafe(Number(len));
         const { bytesRead } = await fh.read(buf, 0, buf.length, pos);
         pos += bytesRead;
-        const chunk = carry + buf.toString("utf-8", 0, bytesRead);
+        const chunk = carry + decoder.write(buf.subarray(0, bytesRead));
         const parts = chunk.split(/\r?\n/);
         carry = parts.pop() ?? "";
         for (const p of parts) {
@@ -17943,6 +17957,103 @@ var EXPORT_PAYLOAD_VERSION = "0.1.2";
 
 // packages/core/src/exporters/redact-export.ts
 init_redactor();
+init_credential_value_patterns();
+
+// packages/core/src/safety/url-redaction.ts
+init_sensitive_key();
+var HTTP_URL = /^https?:\/\/[^\s]+$/i;
+var UUID_SEGMENT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var HEX_SEGMENT = /^[0-9a-f]{12,}$/i;
+var NUMERIC_SEGMENT = /^\d{5,}$/;
+var OPAQUE_SEGMENT = /^[A-Za-z0-9_-]{20,}$/;
+function looksLikeHttpUrl(value) {
+  return HTTP_URL.test(value.trim());
+}
+function parseHttpUrl(value) {
+  try {
+    const url = new URL(value.trim());
+    return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isIdentifierSegment(segment) {
+  if (UUID_SEGMENT.test(segment)) return true;
+  if (HEX_SEGMENT.test(segment)) return true;
+  if (NUMERIC_SEGMENT.test(segment)) return true;
+  return OPAQUE_SEGMENT.test(segment) && /\d/.test(segment) && /[A-Za-z]/.test(segment);
+}
+function decodeParam(value) {
+  try {
+    return decodeURIComponent(value.replace(/\+/g, " "));
+  } catch {
+    return value;
+  }
+}
+function redactParams(raw, options, replacement) {
+  let redacted = false;
+  const parts = raw.split("&").map((part) => {
+    if (part.length === 0) return part;
+    const separator = part.indexOf("=");
+    if (separator < 0) return part;
+    const rawKey = part.slice(0, separator);
+    const rawValue = part.slice(separator + 1);
+    const key = decodeParam(rawKey);
+    const value = decodeParam(rawValue);
+    if (isCredentialSensitiveKey(key, options.sensitiveKeys) || options.isSensitiveValue(value)) {
+      redacted = true;
+      return `${rawKey}=${replacement}`;
+    }
+    return part;
+  });
+  return { value: parts.join("&"), redacted };
+}
+function redactUrlString(value, options) {
+  const unchanged = {
+    value,
+    credentialRedacted: false,
+    identifiersMasked: false
+  };
+  if (!looksLikeHttpUrl(value)) return unchanged;
+  const url = parseHttpUrl(value);
+  if (!url) return unchanged;
+  const replacement = options.replacement ?? "[REDACTED]";
+  const idPlaceholder = options.idPlaceholder ?? "[id]";
+  let credentialRedacted = url.username.length > 0 || url.password.length > 0;
+  let identifiersMasked = false;
+  let pathname = url.pathname;
+  if (options.maskPathIds === true) {
+    pathname = url.pathname.split("/").map((segment) => {
+      if (segment.length === 0 || !isIdentifierSegment(decodeParam(segment))) {
+        return segment;
+      }
+      identifiersMasked = true;
+      return idPlaceholder;
+    }).join("/");
+  }
+  let search = "";
+  if (url.search.length > 1) {
+    const params = redactParams(url.search.slice(1), options, replacement);
+    if (params.redacted) credentialRedacted = true;
+    search = `?${params.value}`;
+  } else if (url.search.length === 1) {
+    search = "?";
+  }
+  let hash = url.hash;
+  if (url.hash.includes("=")) {
+    const params = redactParams(url.hash.slice(1), options, replacement);
+    if (params.redacted) credentialRedacted = true;
+    hash = `#${params.value}`;
+  }
+  if (!credentialRedacted && !identifiersMasked) return unchanged;
+  return {
+    value: `${url.protocol}//${url.host}${pathname}${search}${hash}`,
+    credentialRedacted,
+    identifiersMasked
+  };
+}
+
+// packages/core/src/exporters/redact-export.ts
 init_redaction_profiles();
 function isRecord15(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -17960,21 +18071,34 @@ function deepClone(value) {
   }
   return out;
 }
-function boundAttributeValues(record, maxMetadataValueLength, maxPreviewLength, seen, depth) {
+function boundAttributeValues(record, sensitiveKeys, maxMetadataValueLength, maxPreviewLength, seen, depth) {
   if (depth > 32) {
     return { truncated: true, reason: "maxDepth" };
   }
   const out = {};
   for (const [key, value] of Object.entries(record)) {
-    out[key] = boundValue(value, key, maxMetadataValueLength, maxPreviewLength, seen, depth);
+    out[key] = boundValue(
+      value,
+      key,
+      sensitiveKeys,
+      maxMetadataValueLength,
+      maxPreviewLength,
+      seen,
+      depth
+    );
   }
   return out;
 }
-function boundValue(value, key, maxMetadataValueLength, maxPreviewLength, seen, depth) {
+function boundValue(value, key, sensitiveKeys, maxMetadataValueLength, maxPreviewLength, seen, depth) {
   if (value === null || typeof value !== "object") {
     if (typeof value === "string") {
+      const rewritten = redactUrlString(value, {
+        sensitiveKeys,
+        isSensitiveValue: stringContainsHighConfidenceCredential,
+        maskPathIds: true
+      }).value;
       return truncateStringForProfile(
-        value,
+        stringContainsHighConfidenceCredential(rewritten) ? "[REDACTED]" : rewritten,
         key,
         maxMetadataValueLength,
         maxPreviewLength
@@ -17989,6 +18113,7 @@ function boundValue(value, key, maxMetadataValueLength, maxPreviewLength, seen,
       (item, index) => boundValue(
         item,
         String(index),
+        sensitiveKeys,
         maxMetadataValueLength,
         maxPreviewLength,
         seen,
@@ -17998,6 +18123,7 @@ function boundValue(value, key, maxMetadataValueLength, maxPreviewLength, seen,
   }
   return boundAttributeValues(
     value,
+    sensitiveKeys,
     maxMetadataValueLength,
     maxPreviewLength,
     seen,
@@ -18012,6 +18138,7 @@ function redactEventAttributes(attrs, redactor, maxMetadataValueLength, maxPrevi
   const seen = /* @__PURE__ */ new WeakSet();
   const bounded = boundAttributeValues(
     redacted,
+    [...DEFAULT_REDACT_KEYS, ...redactor.sensitiveKeys],
     maxMetadataValueLength,
     maxPreviewLength,
     seen,
@@ -20150,7 +20277,7 @@ function isCredentialSensitiveKey2(key, sensitiveKeys) {
 }
 
 // packages/redact/src/key-value-secret.ts
-var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})`;
+var KEY_VALUE_SECRET_PATTERN_SOURCE = String.raw`\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})`;
 var KEY_VALUE_SECRET_PATTERN2 = new RegExp(
   KEY_VALUE_SECRET_PATTERN_SOURCE,
   "i"
@@ -20160,6 +20287,99 @@ function valueContainsKeyValueSecret(value) {
   return KEY_VALUE_SECRET_PATTERN2.test(value);
 }
 
+// packages/redact/src/url-redaction.ts
+var HTTP_URL2 = /^https?:\/\/[^\s]+$/i;
+var UUID_SEGMENT2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var HEX_SEGMENT2 = /^[0-9a-f]{12,}$/i;
+var NUMERIC_SEGMENT2 = /^\d{5,}$/;
+var OPAQUE_SEGMENT2 = /^[A-Za-z0-9_-]{20,}$/;
+function looksLikeHttpUrl2(value) {
+  return HTTP_URL2.test(value.trim());
+}
+function parseHttpUrl2(value) {
+  try {
+    const url = new URL(value.trim());
+    return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isIdentifierSegment2(segment) {
+  if (UUID_SEGMENT2.test(segment)) return true;
+  if (HEX_SEGMENT2.test(segment)) return true;
+  if (NUMERIC_SEGMENT2.test(segment)) return true;
+  return OPAQUE_SEGMENT2.test(segment) && /\d/.test(segment) && /[A-Za-z]/.test(segment);
+}
+function decodeParam2(value) {
+  try {
+    return decodeURIComponent(value.replace(/\+/g, " "));
+  } catch {
+    return value;
+  }
+}
+function redactParams2(raw, options, replacement) {
+  let redacted = false;
+  const parts = raw.split("&").map((part) => {
+    if (part.length === 0) return part;
+    const separator = part.indexOf("=");
+    if (separator < 0) return part;
+    const rawKey = part.slice(0, separator);
+    const rawValue = part.slice(separator + 1);
+    const key = decodeParam2(rawKey);
+    const value = decodeParam2(rawValue);
+    if (isCredentialSensitiveKey2(key, options.sensitiveKeys) || options.isSensitiveValue(value)) {
+      redacted = true;
+      return `${rawKey}=${replacement}`;
+    }
+    return part;
+  });
+  return { value: parts.join("&"), redacted };
+}
+function redactUrlString2(value, options) {
+  const unchanged = {
+    value,
+    credentialRedacted: false,
+    identifiersMasked: false
+  };
+  if (!looksLikeHttpUrl2(value)) return unchanged;
+  const url = parseHttpUrl2(value);
+  if (!url) return unchanged;
+  const replacement = options.replacement ?? "[REDACTED]";
+  const idPlaceholder = options.idPlaceholder ?? "[id]";
+  let credentialRedacted = url.username.length > 0 || url.password.length > 0;
+  let identifiersMasked = false;
+  let pathname = url.pathname;
+  if (options.maskPathIds === true) {
+    pathname = url.pathname.split("/").map((segment) => {
+      if (segment.length === 0 || !isIdentifierSegment2(decodeParam2(segment))) {
+        return segment;
+      }
+      identifiersMasked = true;
+      return idPlaceholder;
+    }).join("/");
+  }
+  let search = "";
+  if (url.search.length > 1) {
+    const params = redactParams2(url.search.slice(1), options, replacement);
+    if (params.redacted) credentialRedacted = true;
+    search = `?${params.value}`;
+  } else if (url.search.length === 1) {
+    search = "?";
+  }
+  let hash = url.hash;
+  if (url.hash.includes("=")) {
+    const params = redactParams2(url.hash.slice(1), options, replacement);
+    if (params.redacted) credentialRedacted = true;
+    hash = `#${params.value}`;
+  }
+  if (!credentialRedacted && !identifiersMasked) return unchanged;
+  return {
+    value: `${url.protocol}//${url.host}${pathname}${search}${hash}`,
+    credentialRedacted,
+    identifiersMasked
+  };
+}
+
 // packages/redact/src/index.ts
 var DEFAULT_REDACT_KEYS2 = [
   "authorization",
@@ -20226,7 +20446,9 @@ function findCompiledKeyRule(key, rules) {
   const exact = toKey2(key);
   const direct = rules.find((candidate) => candidate.key === exact);
   if (direct) return direct;
-  return rules.find((candidate) => isCredentialSensitiveKey2(key, [candidate.key]));
+  return rules.find(
+    (candidate) => isCredentialSensitiveKey2(key, [candidate.raw ?? candidate.key])
+  );
 }
 function stableHash2(value) {
   const hash = crypto__default.default.createHash("sha256").update(value, "utf8").digest("hex");
@@ -20425,7 +20647,7 @@ function compileRules2(rules, extraKeys) {
   const out = /* @__PURE__ */ new Map();
   const set = (rule) => {
     const key = toKey2(rule.key);
-    out.set(key, { ...rule, key });
+    out.set(key, { ...rule, key, raw: rule.raw ?? rule.key });
   };
   for (const key of DEFAULT_REDACT_KEYS2) {
     set({ key, strategy: "full" });
@@ -20504,6 +20726,7 @@ function createRedactionProfile(profile = "local") {
 }
 var Redactor2 = class {
   #rules;
+  #sensitiveKeys;
   #detectors;
   #profile;
   #replacement;
@@ -20516,6 +20739,7 @@ var Redactor2 = class {
       ...resolved.extraKeys,
       ...options?.extraKeys ?? []
     ]);
+    this.#sensitiveKeys = this.#rules.map((rule) => rule.raw ?? rule.key);
     this.#detectors = [
       ...builtInDetectorsForProfile(this.#profile),
       ...options?.detectors ?? []
@@ -20549,6 +20773,14 @@ var Redactor2 = class {
   #recordFinding(state, finding) {
     if (this.#collectFindings) state.findings.push(finding);
   }
+  #detect(value, key, path44) {
+    for (const detector of this.#detectors) {
+      for (const detection of detector.detect({ path: path44, key, value })) {
+        if ((detection.action ?? "replace") !== "keep") return { detector, detection };
+      }
+    }
+    return void 0;
+  }
   #redactValue(value, key, path44, depth, state) {
     if (depth > this.#maxDepth) {
       this.#recordFinding(
@@ -20567,6 +20799,43 @@ var Redactor2 = class {
         return applyRule(rule, value, this.#replacement);
       }
     }
+    if (typeof value === "string" && looksLikeHttpUrl2(value)) {
+      const url = redactUrlString2(value, {
+        sensitiveKeys: this.#sensitiveKeys,
+        isSensitiveValue: (candidate) => this.#detect(candidate, key, path44) !== void 0,
+        replacement: this.#replacement,
+        maskPathIds: this.#profile !== "local"
+      });
+      if (url.value !== value) {
+        this.#recordFinding(
+          state,
+          makeFinding(
+            path44,
+            url.credentialRedacted ? "value.urlCredential" : "value.urlIdentifier",
+            "replace",
+            "value",
+            url.credentialRedacted ? "error" : "warning"
+          )
+        );
+        const residual = this.#detect(
+          url.value.split(this.#replacement).join(""),
+          key,
+          path44
+        );
+        if (residual === void 0) return url.value;
+        this.#recordFinding(
+          state,
+          makeFinding(
+            path44,
+            residual.detector.id,
+            "replace",
+            residual.detection.matchKind ?? residual.detector.matchKind ?? "custom",
+            residual.detection.severity ?? residual.detector.severity ?? "warning"
+          )
+        );
+        return this.#replacement;
+      }
+    }
     for (const detector of this.#detectors) {
       const detections = detector.detect({ path: path44, key, value });
       for (const detection of detections) {
@@ -28582,7 +28851,7 @@ function envCheck(name, optional = true) {
 async function traceDirWritable(traceDir) {
   const resolved = path33__default.default.resolve(traceDir);
   try {
-    await promises.mkdir(resolved, { recursive: true });
+    await promises.mkdir(resolved, { recursive: true, mode: 448 });
     await promises.access(resolved, promises.constants.W_OK);
     return {
       id: "trace-dir-writable",
@@ -28600,6 +28869,44 @@ async function traceDirWritable(traceDir) {
     };
   }
 }
+async function traceDirPermissions(traceDir) {
+  const resolved = path33__default.default.resolve(traceDir);
+  if (process3__default.default.platform === "win32") {
+    return {
+      id: "trace-dir-permissions",
+      status: "skipped",
+      message: "POSIX confidentiality mode check skipped on Windows.",
+      evidence: resolved
+    };
+  }
+  try {
+    const st = await promises.stat(resolved);
+    const mode = st.mode & 511;
+    const octal = mode.toString(8).padStart(3, "0");
+    if ((mode & 63) !== 0) {
+      return {
+        id: "trace-dir-permissions",
+        status: "warn",
+        message: `Trace directory allows group/other access (mode ${octal}): ${resolved}`,
+        remediation: `Restrict with chmod 700 on the directory and review existing JSONL files with chmod 600. AgentInspect does not rewrite existing modes. See ${DOCS_BASE}/GETTING-STARTED.md`,
+        evidence: `mode=${octal}`
+      };
+    }
+    return {
+      id: "trace-dir-permissions",
+      status: "pass",
+      message: `Trace directory mode is restrictive (${octal}): ${resolved}`,
+      evidence: `mode=${octal}`
+    };
+  } catch (error) {
+    return {
+      id: "trace-dir-permissions",
+      status: "skipped",
+      message: `Could not inspect trace directory permissions: ${resolved}`,
+      evidence: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
 function readPackageVersionNearEntry(entryPath, packageName) {
   let dir = path33__default.default.dirname(path33__default.default.resolve(entryPath));
   const { root } = path33__default.default.parse(dir);
@@ -28731,6 +29038,7 @@ async function runDoctorChecks(options = {}) {
       evidence: version
     },
     await traceDirWritable(traceDir),
+    await traceDirPermissions(traceDir),
     envCheck("AGENT_INSPECT"),
     envCheck("AGENT_INSPECT_TRACE_DIR"),
     versionMismatchCheck(cwd)