agent-inspect 6.31.30 → 6.31.32

package/packages/cli/dist/index.cjs

@@ -268,6 +268,10 @@ var init_credential_value_patterns = __esm({
       /\b[a-z0-9_.-]+=[^;\s]+(?:;\s*[a-z0-9_.-]+=[^;\s]+)+/i,
       /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
       /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
+      // Stripe secret / restricted keys use underscores (not sk-). Keep in sync with
+      // packages/redact/src/index.ts + packages/core/src/checks DEFAULT_SECRET_PATTERNS (#520).
+      /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+      /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/,
       /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
       /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
       /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
@@ -5933,6 +5937,56 @@ function eventEndMs(event) {
   }
   return void 0;
 }
+function rowIndexByEventId(events) {
+  const index = /* @__PURE__ */ new Map();
+  for (const [position, event] of events.entries()) {
+    if (!index.has(event.eventId)) index.set(event.eventId, position);
+  }
+  return index;
+}
+function recordedRowSpan(rowIndex, event) {
+  const sourceIds = "sourceEventIds" in event && Array.isArray(event.sourceEventIds) ? event.sourceEventIds : [event.eventId];
+  const rows = [];
+  for (const id of sourceIds) {
+    const row = typeof id === "string" ? rowIndex.get(id) : void 0;
+    if (row === void 0) return void 0;
+    rows.push(row);
+  }
+  if (rows.length === 0) return void 0;
+  return { first: Math.min(...rows), last: Math.max(...rows) };
+}
+function recordedTieOrder(context, tiedBefore, tiedAfter) {
+  const rowIndex = rowIndexByEventId(context.events);
+  let lastFinished;
+  let firstStarted;
+  for (const event of tiedBefore) {
+    const span = recordedRowSpan(rowIndex, event);
+    if (span === void 0) return { inOrder: void 0 };
+    if (lastFinished === void 0 || span.last > lastFinished.row) {
+      lastFinished = { event, row: span.last };
+    }
+  }
+  for (const event of tiedAfter) {
+    const span = recordedRowSpan(rowIndex, event);
+    if (span === void 0) return { inOrder: void 0 };
+    if (firstStarted === void 0 || span.first < firstStarted.row) {
+      firstStarted = { event, row: span.first };
+    }
+  }
+  if (lastFinished === void 0 || firstStarted === void 0) return { inOrder: void 0 };
+  return {
+    inOrder: lastFinished.row < firstStarted.row,
+    lastFinishedBefore: lastFinished.event,
+    firstStartedAfter: firstStarted.event
+  };
+}
+function tieResolution(order) {
+  return order.inOrder === void 0 ? "recorded-order-unavailable" : "recorded-order";
+}
+function tieMessage(order, beforeLabel, afterLabel) {
+  if (order === void 0 || order.inOrder === true) return "";
+  return order.inOrder === void 0 ? " Their timestamps tie at the same millisecond and the recorded event order could not be resolved." : ` Their timestamps tie at the same millisecond; the recorded event order shows ${afterLabel} started before ${beforeLabel} finished.`;
+}
 function normalizedKey(value) {
   return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
@@ -6512,16 +6566,18 @@ function createStepOrderingRule(options) {
             )
           ];
         }
-        if (beforeEnd > afterStart) {
+        const tie = beforeEnd === afterStart ? recordedTieOrder(context, [beforeEvent], [afterEvent]) : void 0;
+        if (beforeEnd > afterStart || tie !== void 0 && tie.inOrder !== true) {
           return [
             failFinding(
               ruleId,
-              `${subject} ${beforeLabel} must finish before ${afterLabel} starts.`,
+              `${subject} ${beforeLabel} must finish before ${afterLabel} starts.${tieMessage(tie, beforeLabel, afterLabel)}`,
               [eventEvidence(beforeEvent), eventEvidence(afterEvent)],
               expected,
               {
                 beforeEndedAt: new Date(beforeEnd).toISOString(),
-                afterStartedAt: new Date(afterStart).toISOString()
+                afterStartedAt: new Date(afterStart).toISOString(),
+                ...tie !== void 0 ? { resolvedBy: tieResolution(tie) } : {}
               }
             )
           ];
@@ -6584,16 +6640,27 @@ function createStepOrderingRule(options) {
             )
           ];
         }
-        if (latestBefore.end > earliestAfter.start) {
+        const tiedEnd = latestBefore.end;
+        const tiedStart = earliestAfter.start;
+        const tie = tiedEnd === tiedStart ? recordedTieOrder(
+          context,
+          beforeEvents.filter((event) => eventEndMs(event) === tiedEnd),
+          afterEvents.filter((event) => eventStartMs(event) === tiedStart)
+        ) : void 0;
+        if (latestBefore.end > earliestAfter.start || tie !== void 0 && tie.inOrder !== true) {
           return [
             failFinding(
               ruleId,
-              bothTools ? `Every ${options.before.name} tool call must finish before any ${options.after.name} tool call starts.` : `Every ${beforeLabel} must finish before any ${afterLabel} starts.`,
-              [eventEvidence(latestBefore.event), eventEvidence(earliestAfter.event)],
+              (bothTools ? `Every ${options.before.name} tool call must finish before any ${options.after.name} tool call starts.` : `Every ${beforeLabel} must finish before any ${afterLabel} starts.`) + tieMessage(tie, beforeLabel, afterLabel),
+              [
+                eventEvidence(tie?.lastFinishedBefore ?? latestBefore.event),
+                eventEvidence(tie?.firstStartedAfter ?? earliestAfter.event)
+              ],
               expected,
               {
                 latestBeforeEndedAt: new Date(latestBefore.end).toISOString(),
-                earliestAfterStartedAt: new Date(earliestAfter.start).toISOString()
+                earliestAfterStartedAt: new Date(earliestAfter.start).toISOString(),
+                ...tie !== void 0 ? { resolvedBy: tieResolution(tie) } : {}
               }
             )
           ];
@@ -7540,6 +7607,12 @@ var init_checks2 = __esm({
     DEFAULT_SECRET_PATTERNS = [
       { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
       { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
+      // Stripe + Slack: keep in sync with packages/redact + credential-value-patterns (#520).
+      {
+        id: "stripe-key",
+        pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/
+      },
+      { id: "slack-token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/ },
       { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
       { id: "github-token", pattern: /gh[opsu]_[A-Za-z0-9_]{20,}/ },
       // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
@@ -17304,7 +17377,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.31.30";
+var version = "6.31.32";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -19522,6 +19595,16 @@ function stepIdOf2(event) {
   const value = event.attributes?.stepId;
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
+function attemptIdOf3(event) {
+  const direct = event.attributes?.attemptId;
+  if (typeof direct === "string" && direct.trim() !== "") return direct;
+  const meta2 = event.attributes?.metadata;
+  if (meta2 && typeof meta2 === "object" && !Array.isArray(meta2)) {
+    const nested = meta2.attemptId;
+    if (typeof nested === "string" && nested.trim() !== "") return nested;
+  }
+  return void 0;
+}
 function lifecycleKey(event) {
   if (event.kind === "RUN") return `run:${event.runId}`;
   const stepId = stepIdOf2(event);
@@ -19531,6 +19614,9 @@ function lifecycleKey(event) {
 function isTerminal(status) {
   return status === "ok" || status === "error";
 }
+function eventTime3(event) {
+  return typeof event.timestamp === "number" ? event.timestamp : 0;
+}
 function cloneNode(node) {
   return {
     event: {
@@ -19541,37 +19627,87 @@ function cloneNode(node) {
     depth: node.depth
   };
 }
+function joinOnePair(start, terminal) {
+  const childMap = /* @__PURE__ */ new Map();
+  if (start) {
+    for (const child of start.children) {
+      childMap.set(child.event.eventId, child);
+    }
+  }
+  for (const child of terminal.children) {
+    childMap.set(child.event.eventId, child);
+  }
+  return {
+    event: {
+      ...terminal.event,
+      name: start?.event.name ?? terminal.event.name,
+      kind: start?.event.kind ?? terminal.event.kind,
+      ...start && attemptIdOf3(terminal.event) === void 0 && attemptIdOf3(start.event) ? {
+        attributes: {
+          ...terminal.event.attributes,
+          attemptId: attemptIdOf3(start.event)
+        }
+      } : {}
+    },
+    children: presentSiblingNodes([...childMap.values()]),
+    depth: terminal.depth
+  };
+}
 function joinSiblingGroup(group) {
   if (group.length <= 1) return group;
-  const terminals = group.filter((n) => isTerminal(n.event.status));
-  const runnings = group.filter((n) => n.event.status === "running");
+  const terminals = group.filter((n) => isTerminal(n.event.status)).sort((a, b) => eventTime3(a.event) - eventTime3(b.event));
+  const runnings = group.filter((n) => n.event.status === "running").sort((a, b) => eventTime3(a.event) - eventTime3(b.event));
+  const others = group.filter(
+    (n) => !isTerminal(n.event.status) && n.event.status !== "running"
+  );
   const terminalStatuses = new Set(terminals.map((n) => n.event.status));
   if (terminalStatuses.size > 1) {
     return group;
   }
-  if (terminals.length >= 1) {
-    const terminal = terminals[terminals.length - 1];
-    const start = runnings[0];
-    const childMap = /* @__PURE__ */ new Map();
-    for (const n of group) {
-      for (const child of n.children) {
-        childMap.set(child.event.eventId, child);
+  if (terminals.length > 1 && terminals.every((t) => attemptIdOf3(t.event) === void 0) && runnings.every((r) => attemptIdOf3(r.event) === void 0)) {
+    return group;
+  }
+  const usedRunning = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const terminal of terminals) {
+    const terminalAttempt = attemptIdOf3(terminal.event);
+    const terminalTs = eventTime3(terminal.event);
+    const candidate = runnings.find((r) => {
+      if (usedRunning.has(r.event.eventId)) return false;
+      if (eventTime3(r.event) > terminalTs) return false;
+      const runningAttempt = attemptIdOf3(r.event);
+      if (terminalAttempt !== void 0) {
+        return runningAttempt === terminalAttempt;
+      }
+      if (runningAttempt !== void 0) {
+        return true;
       }
+      return true;
+    });
+    if (candidate) {
+      usedRunning.add(candidate.event.eventId);
+      out.push(joinOnePair(candidate, terminal));
+    } else {
+      out.push({
+        ...terminal,
+        children: presentSiblingNodes(terminal.children)
+      });
     }
-    return [
-      {
-        event: {
-          ...terminal.event,
-          name: start?.event.name ?? terminal.event.name,
-          kind: start?.event.kind ?? terminal.event.kind,
-          ...start?.event.timestamp !== void 0 && terminal.event.durationMs === void 0 ? {} : {}
-        },
-        children: presentSiblingNodes([...childMap.values()]),
-        depth: terminal.depth
-      }
-    ];
   }
-  return group;
+  for (const running of runnings) {
+    if (usedRunning.has(running.event.eventId)) continue;
+    out.push({
+      ...running,
+      children: presentSiblingNodes(running.children)
+    });
+  }
+  for (const other of others) {
+    out.push({
+      ...other,
+      children: presentSiblingNodes(other.children)
+    });
+  }
+  return out;
 }
 function presentSiblingNodes(nodes) {
   const prepared = nodes.map((n) => ({
@@ -22436,6 +22572,18 @@ var credentialDetectors = [
     pattern: /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
     severity: "error"
   }),
+  // Stripe secret/restricted keys (underscore form). Keep in sync with
+  // packages/core/src/safety/credential-value-patterns.ts + checks DEFAULT_SECRET_PATTERNS (#520).
+  patternDetector({
+    id: "value.stripeSecretKey",
+    pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.slackToken",
+    pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/,
+    severity: "error"
+  }),
   patternDetector({
     id: "value.githubToken",
     pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
@@ -24201,8 +24349,9 @@ function parseEvidenceFormat(value) {
     `Unsupported --evidence-format "${value}". Use directory, html, or zip.`
   );
 }
-function toAssessmentStatus(failed) {
-  return failed ? "UNSAFE" : "SAFE";
+function residualStatusToEvidenceSafe(status) {
+  if (status === "SAFE_WITH_WARNINGS") return "SAFE WITH WARNINGS";
+  return status;
 }
 function stableJson2(value) {
   return `${JSON.stringify(value, null, 2)}
@@ -24242,7 +24391,10 @@ async function writeLocalEvidence(input3) {
     combined += redacted.content.endsWith("\n") ? redacted.content : `${redacted.content}
 `;
   }
-  const assessmentStatus = toAssessmentStatus(input3.failed);
+  const residual = await assessResidualFromContent(combined, {
+    format: "agent-inspect-jsonl"
+  });
+  const assessmentStatus = residualStatusToEvidenceSafe(residual.status);
   const evidencePackage = buildEvidenceCiPackage({
     generatorVersion: version,
     runIds: input3.runIds,