agent-inspect 6.31.3 → 6.31.5

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 6.31.5
+
+### Patch Changes
+
+- 909ea70: Strip userinfo credentials from common connection URIs (postgres, mysql, mongodb, redis, amqp, and TLS variants) under share/strict while keeping scheme, host, port, and database/queue path.
+
+## 6.31.4
+
+### Patch Changes
+
+- fc7e7ad: Match credential keys across snake, kebab, and header spellings (`api_key`, `x-api-key`, `access_token`, …) in share/strict export and `@agent-inspect/redact`.
+- fc7e7ad: URL-aware redaction keeps host/path while stripping http(s) userinfo and credential query/fragment params, residual-checks export after rewrite, and treats only _complete_ `[REDACTED]` / `[HASH:…]` placeholders as safe (marker prefixes cannot hide residual secrets). Postgres and other non-http URI userinfo remain tracked separately.
+- 98e0f30: Preserve multibyte UTF-8 across `tail --file` polling reads, and request restrictive POSIX creation modes (`0700` directories / `0600` JSONL) for new built-in raw traces with a `doctor` confidentiality warning. Existing paths are not rewritten.
+
 ## 6.31.3
 
 ### Patch Changes

package/README.md

@@ -213,7 +213,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.31.3** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.31.5** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/SECURITY.md

@@ -53,6 +53,8 @@ In scope:
 - Manual tracing writes local JSONL files (see `docs/SCHEMA.md`).
 - The CLI reads and renders local files.
 - Exports generate local strings/files only (Markdown/HTML/OpenInference/OTLP JSON); they do not upload anywhere.
+- On POSIX, **newly created** built-in raw trace directories request mode `0700` and new JSONL files request `0600`. Existing paths are **not** rewritten. Local-first custody does **not** replace host filesystem permissions, disk encryption, CI access controls, or retention policy, and does not claim compliance or guaranteed confidentiality.
+- For existing shared, synchronized, or CI trace directories, restrict manually (`chmod 700` on the directory; review JSONL files with `chmod 600`) and prefer a user-private location when possible.
 
 ## Redaction expectations
 

package/docs/GETTING-STARTED.md

@@ -287,6 +287,8 @@ agent-inspect view <runId> --tui
 - Persisted events are size-bounded by default (see `docs/API.md`).
 - Confidence labels are required to keep attribution honest.
 - AgentInspect is for local debugging, not production monitoring.
+- On POSIX, new built-in raw trace directories request `0700` and new JSONL files request `0600`. Pre-existing paths are not chmodded. Local-first does not replace host permissions, disk encryption, CI access controls, or retention policy.
+- `doctor` warns when an existing POSIX trace directory still has group/other permission bits; remediate with `chmod 700` on the directory and review JSONL files with `chmod 600`.
 
 ## 16. Next docs
 

package/docs/SAFE-TRACE-SHARING.md

@@ -43,6 +43,7 @@ For reviewer-reproducible trajectory checks (6.28+), prefer Evidence that includ
 - Inspect log-derived fields from `logs` / `tail` ingest configs, including custom `run-id`, `event`, `parent`, timestamp, and attribute mappings.
 - Avoid posting raw prompts, completions, tool inputs, or tool outputs in public threads unless the content is approved for public disclosure.
 - For cross-system correlation, retain a bounded identifier instead of copying the external record or payload. Follow [External reference metadata](./EXTERNAL-REFERENCES.md), and expect `share` / `strict` profiles to redact the named correlation fields.
+- `share` and `strict` rewrite http(s) URLs rather than dropping them: userinfo and credential-looking query or fragment params are replaced, identifier-like path segments become `[id]`, and scheme, host and path stay, so a retry on the same page is still recognizable. The same profiles also strip userinfo from common connection URIs (`postgres` / `postgresql`, `mysql` / `mariadb`, `mongodb` / `mongodb+srv`, `redis` / `rediss`, `amqp` / `amqps`) while keeping scheme, host, port, and database/queue path: `postgres://user:secret@db.example.com:5432/app_db` becomes `postgres://db.example.com:5432/app_db`. Other schemes still need a manual check.
 - Prefer Markdown export for issue or PR sharing when a summarized tree is enough.
 
 ## Remove or replace sensitive values

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.31.3",
+  "version": "6.31.5",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",

package/packages/cli/dist/{chunk-SJ6FRNOE.mjs → chunk-LKEPABND.mjs}

@@ -1,7 +1,7 @@
-import { readdir, stat, readFile, access } from 'fs/promises';
 import os from 'os';
 import path7 from 'path';
 import crypto2, { createHash, webcrypto } from 'crypto';
+import { readdir, stat, readFile, access } from 'fs/promises';
 import process2 from 'process';
 import tty from 'tty';
 import { AsyncLocalStorage } from 'async_hooks';
@@ -758,6 +758,80 @@ function parseTraceJsonl(raw, options = {}) {
   else if (saw10) format = "1.0";
   return { format, sourceEventCount, events: traceEvents, persisted, rows };
 }
+
+// packages/core/src/safety/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
+function normalizeSensitiveKey(value) {
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
+  [
+    "tokens",
+    "max_tokens",
+    "min_tokens",
+    "ls_max_tokens",
+    "token_count",
+    "token_limit",
+    "token_budget",
+    "input_tokens",
+    "output_tokens",
+    "total_tokens",
+    "cached_tokens",
+    "prompt_tokens",
+    "completion_tokens"
+  ].map(normalizeSensitiveKey)
+);
+var DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
+  "authorization",
+  "cookie",
+  "token",
+  "access_token",
+  "accesstoken",
+  "auth_token",
+  "authtoken",
+  "refresh_token",
+  "refreshtoken",
+  "id_token",
+  "idtoken",
+  "bearer_token",
+  "bearertoken",
+  "api_token",
+  "apitoken",
+  "apikey",
+  "api_key",
+  "password",
+  "secret",
+  "email"
+];
+function isTokenCredentialKey(normalized) {
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  if (normalized === "token") return true;
+  if (normalized.endsWith("tokens")) return false;
+  return normalized.endsWith("token");
+}
+function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
+  if (!key) return false;
+  const normalized = normalizeSensitiveKey(key);
+  if (!normalized) return false;
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
+  for (const sensitive of sensitiveKeys) {
+    const s = normalizeSensitiveKey(sensitive);
+    if (!s) continue;
+    if (s === "token") {
+      if (isTokenCredentialKey(normalized)) return true;
+      continue;
+    }
+    if (normalized === s) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
+  }
+  return false;
+}
+
+// packages/core/src/logs/redactor.ts
 var DEFAULT_REDACT_KEYS = [
   "authorization",
   "cookie",
@@ -781,7 +855,7 @@ function compileRules(rules, extraKeys) {
   const out = /* @__PURE__ */ new Map();
   const set = (r) => {
     const k = toKey(r.key);
-    out.set(k, { ...r, key: k });
+    out.set(k, { ...r, key: k, raw: r.raw ?? r.key });
   };
   for (const k of DEFAULT_REDACT_KEYS) {
     set({ key: k, strategy: "full" });
@@ -810,9 +884,13 @@ var Redactor = class {
   constructor(options) {
     this.#rules = compileRules(options?.rules, options?.extraKeys);
   }
+  /** Field names this redactor treats as sensitive, for value-level helpers. */
+  get sensitiveKeys() {
+    return this.#rules.map((rule) => rule.raw ?? rule.key);
+  }
   redactValue(key, value) {
     const k = toKey(key);
-    const rule = this.#rules.find((r) => r.key === k);
+    const rule = this.#rules.find((r) => r.key === k) ?? this.#rules.find((r) => isCredentialSensitiveKey(key, [r.raw ?? r.key]));
     if (!rule) {
       return this.#redactNested(value);
     }
@@ -852,7 +930,7 @@ var Redactor = class {
 };
 
 // packages/core/src/safety/credential-value-patterns.ts
-var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i;
+var KEY_VALUE_SECRET_PATTERN = /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i;
 var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
   /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
   /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
@@ -4932,78 +5010,6 @@ formatProgrammaticDiagnostic(
   "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED"
 );
 
-// packages/core/src/safety/sensitive-key.ts
-function keyHasExplicitSeparator(value) {
-  return /[_\-.]/.test(value);
-}
-function normalizeSensitiveKey(value) {
-  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-}
-var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
-  [
-    "tokens",
-    "max_tokens",
-    "min_tokens",
-    "ls_max_tokens",
-    "token_count",
-    "token_limit",
-    "token_budget",
-    "input_tokens",
-    "output_tokens",
-    "total_tokens",
-    "cached_tokens",
-    "prompt_tokens",
-    "completion_tokens"
-  ].map(normalizeSensitiveKey)
-);
-var DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
-  "authorization",
-  "cookie",
-  "token",
-  "access_token",
-  "accesstoken",
-  "auth_token",
-  "authtoken",
-  "refresh_token",
-  "refreshtoken",
-  "id_token",
-  "idtoken",
-  "bearer_token",
-  "bearertoken",
-  "api_token",
-  "apitoken",
-  "apikey",
-  "api_key",
-  "password",
-  "secret",
-  "email"
-];
-function isTokenCredentialKey(normalized) {
-  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
-  if (normalized === "token") return true;
-  if (normalized.endsWith("tokens")) return false;
-  return normalized.endsWith("token");
-}
-function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
-  if (!key) return false;
-  const normalized = normalizeSensitiveKey(key);
-  if (!normalized) return false;
-  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
-  const allowPrefixCompound = keyHasExplicitSeparator(key);
-  for (const sensitive of sensitiveKeys) {
-    const s = normalizeSensitiveKey(sensitive);
-    if (!s) continue;
-    if (s === "token") {
-      if (isTokenCredentialKey(normalized)) return true;
-      continue;
-    }
-    if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`)) return true;
-    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
-  }
-  return false;
-}
-
 // packages/core/src/checks/contract-scope.ts
 function diagnostic(code, message, ruleId) {
   return {
@@ -7301,7 +7307,7 @@ var DEFAULT_SECRET_PATTERNS = [
   // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
   {
     id: "key-value-secret",
-    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i
+    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=(?!\[(?:REDACTED(?::[^\]]*)?|HASH:[0-9a-f]{8})\](?![^\s"'\\&#?;/]))([^\s"'\\]{8,})/i
   }
 ];
 function compareStrings(a, b) {
@@ -14884,6 +14890,6 @@ function renderGateReport(result, options = {}) {
   return renderGateSummaryMarkdown(result);
 }
 
-export { ATTRIBUTION_CONFIDENCES, COHORT_METRIC_IDS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, defineTraceContract, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, evaluateTraceContract, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isAttributionConfidence, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, projectLogicalEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-SJ6FRNOE.mjs.map
-//# sourceMappingURL=chunk-SJ6FRNOE.mjs.map
+export { ATTRIBUTION_CONFIDENCES, COHORT_METRIC_IDS, DEFAULT_REDACT_KEYS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, defineTraceContract, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, evaluateTraceContract, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isAttributionConfidence, isCredentialSensitiveKey, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToTraceEvents, projectLogicalEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, stringContainsHighConfidenceCredential, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
+//# sourceMappingURL=chunk-LKEPABND.mjs.map
+//# sourceMappingURL=chunk-LKEPABND.mjs.map