agent-inspect 6.31.33 → 6.31.34

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 6.31.34
+
+### Patch Changes
+
+- c0726d8: Detect underscore-adjacent Stripe keys across redact, credential-value, and verify-safe patterns (#528; thanks Frank). Align `gate --evidence-on` check-results `aggregateStatus` with residual artifact assessment while keeping gate pass/fail separate (#529; thanks Frank). Fail unfinished before-order occurrences even when a finished peer exists, and treat after-start without a terminal as order-relevant. Harden Gary/Nest saved verifiers, refuse ambiguous HTML lifecycle joins, and evaluate Roy UNPROVABLE positive controls.
+
 ## 6.31.33
 
 ### Patch Changes

package/README.md

@@ -213,7 +213,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.31.33** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.31.34** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.31.33",
+  "version": "6.31.34",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",

package/packages/cli/dist/{chunk-AILSHDEF.mjs → chunk-6TXW53UR.mjs}

@@ -938,8 +938,9 @@ var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
   /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
   /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
   // Stripe secret / restricted keys use underscores (not sk-). Keep in sync with
-  // packages/redact/src/index.ts + packages/core/src/checks DEFAULT_SECRET_PATTERNS (#520).
-  /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+  // packages/redact/src/index.ts + packages/core/src/checks DEFAULT_SECRET_PATTERNS (#520/#528).
+  // Use non-alnum lookarounds so underscore-adjacent forms (acct_sk_live_…, …_eu) match.
+  /(?<![A-Za-z0-9])(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/,
   /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/,
   /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
   /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
@@ -7832,10 +7833,11 @@ var SAFE_USAGE_LEAF_KEYS = /* @__PURE__ */ new Set([
 var DEFAULT_SECRET_PATTERNS = [
   { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
   { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
-  // Stripe + Slack: keep in sync with packages/redact + credential-value-patterns (#520).
+  // Stripe + Slack: keep in sync with packages/redact + credential-value-patterns (#520/#528).
+  // Non-alnum lookarounds so underscore-adjacent forms (acct_sk_live_…, …_eu) match.
   {
     id: "stripe-key",
-    pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/
+    pattern: /(?<![A-Za-z0-9])(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/
   },
   { id: "slack-token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/ },
   { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
@@ -8786,7 +8788,12 @@ function createStepOrderingRule(options) {
       const beforeRunning = semanticEvents(context).filter(
         (event) => event.kind === options.before.kind && event.status === "running" && stepEndpointName(event, options.before.kind) === options.before.name
       );
-      if (beforeEvents.length === 0 && afterEvents.length > 0 && beforeRunning.length > 0) {
+      const afterRunning = semanticEvents(context).filter(
+        (event) => event.kind === options.after.kind && event.status === "running" && stepEndpointName(event, options.after.kind) === options.after.name
+      );
+      const afterStarted = afterEvents.length > 0 || afterRunning.length > 0;
+      const afterEvidenceEvent = afterEvents[0] ?? afterRunning[0];
+      if (beforeRunning.length > 0 && afterStarted && afterEvidenceEvent !== void 0) {
         const endpointExpected2 = bothTools ? { before: options.before.name, after: options.after.name } : { before: options.before, after: options.after };
         return [
           failFinding(
@@ -8794,18 +8801,20 @@ function createStepOrderingRule(options) {
             `${subject} ${beforeLabel} started but never finished before ${afterLabel} ran.`,
             [
               ...beforeRunning.map((event) => eventEvidence3(event)),
-              eventEvidence3(afterEvents[0])
+              eventEvidence3(afterEvidenceEvent)
             ],
             { ...endpointExpected2, mode },
             {
               code: bothTools ? "tool.order.interval-unresolved" : "step.order.interval-unresolved",
               unfinishedBefore: true,
-              beforeStatus: "running"
+              beforeStatus: "running",
+              ...beforeEvents.length > 0 ? { finishedBeforeMasked: true } : {},
+              ...afterEvents.length === 0 ? { afterStatus: "running" } : {}
             }
           )
         ];
       }
-      if (beforeEvents.length === 0 || afterEvents.length === 0) {
+      if (beforeEvents.length === 0 || !afterStarted) {
         if (!requireEndpoints) return [];
         const findings = [];
         if (beforeEvents.length === 0) {
@@ -8829,7 +8838,7 @@ function createStepOrderingRule(options) {
             )
           );
         }
-        if (afterEvents.length === 0) {
+        if (!afterStarted) {
           const otherKinds = otherKindsForStepName(
             context,
             options.after.kind,
@@ -8852,9 +8861,15 @@ function createStepOrderingRule(options) {
         }
         return findings;
       }
-      const encounter = finishedEvents(context).filter(
-        (event) => event.kind === options.before.kind && stepEndpointName(event, options.before.kind) === options.before.name || event.kind === options.after.kind && stepEndpointName(event, options.after.kind) === options.after.name
-      );
+      const afterForOrder = afterEvents.length > 0 ? afterEvents : afterRunning;
+      const encounter = [
+        ...finishedEvents(context).filter(
+          (event) => event.kind === options.before.kind && stepEndpointName(event, options.before.kind) === options.before.name || event.kind === options.after.kind && stepEndpointName(event, options.after.kind) === options.after.name
+        ),
+        ...afterEvents.length === 0 ? afterRunning.filter(
+          (event) => !finishedEvents(context).some((finished) => finished.eventId === event.eventId)
+        ) : []
+      ];
       let beforeIndex;
       let afterIndex;
       for (const [position, event] of encounter.entries()) {
@@ -8885,7 +8900,7 @@ function createStepOrderingRule(options) {
         ];
       }
       const beforeEvent = beforeEvents[0];
-      const afterEvent = afterEvents[0];
+      const afterEvent = afterForOrder[0];
       const beforeEnd = eventEndMs(beforeEvent);
       const afterStart = eventStartMs(afterEvent);
       const endpointExpected = bothTools ? { before: options.before.name, after: options.after.name } : { before: options.before, after: options.after };
@@ -8971,7 +8986,7 @@ function createStepOrderingRule(options) {
             latestBefore = { event, end };
           }
         }
-        for (const event of afterEvents) {
+        for (const event of afterForOrder) {
           const start = eventStartMs(event);
           if (start === void 0) {
             missingAfterStarts += 1;
@@ -9000,7 +9015,7 @@ function createStepOrderingRule(options) {
         const tie = tiedEnd === tiedStart ? recordedTieOrder(
           context,
           beforeEvents.filter((event) => eventEndMs(event) === tiedEnd),
-          afterEvents.filter((event) => eventStartMs(event) === tiedStart)
+          afterForOrder.filter((event) => eventStartMs(event) === tiedStart)
         ) : void 0;
         if (latestBefore.end > earliestAfter.start || tie !== void 0 && tie.inOrder !== true) {
           return [
@@ -16171,5 +16186,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { ATTRIBUTION_CONFIDENCES, COHORT_METRIC_IDS, DEFAULT_REDACT_KEYS, DEFAULT_SUITE_ARTIFACTS_DIR, DELIVERY_CONFLICT_ATTR, DELIVERY_EVENT_BASE_ATTR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, IDENTITY_CONFLICT_ATTR, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, defineTraceContract, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, evaluateTraceContract, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isAttributionConfidence, isCredentialSensitiveKey, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToRunTrees, persistedInspectEventsToTraceEvents, projectLogicalEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, stringContainsHighConfidenceCredential, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-AILSHDEF.mjs.map
-//# sourceMappingURL=chunk-AILSHDEF.mjs.map
+//# sourceMappingURL=chunk-6TXW53UR.mjs.map
+//# sourceMappingURL=chunk-6TXW53UR.mjs.map