agent-inspect 6.31.33 → 6.31.34

package/packages/cli/dist/index.cjs

@@ -269,8 +269,9 @@ var init_credential_value_patterns = __esm({
       /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
       /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
       // Stripe secret / restricted keys use underscores (not sk-). Keep in sync with
-      // packages/redact/src/index.ts + packages/core/src/checks DEFAULT_SECRET_PATTERNS (#520).
-      /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+      // packages/redact/src/index.ts + packages/core/src/checks DEFAULT_SECRET_PATTERNS (#520/#528).
+      // Use non-alnum lookarounds so underscore-adjacent forms (acct_sk_live_…, …_eu) match.
+      /(?<![A-Za-z0-9])(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/,
       /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/,
       /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
       /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
@@ -6505,7 +6506,12 @@ function createStepOrderingRule(options) {
       const beforeRunning = semanticEvents(context).filter(
         (event) => event.kind === options.before.kind && event.status === "running" && stepEndpointName(event, options.before.kind) === options.before.name
       );
-      if (beforeEvents.length === 0 && afterEvents.length > 0 && beforeRunning.length > 0) {
+      const afterRunning = semanticEvents(context).filter(
+        (event) => event.kind === options.after.kind && event.status === "running" && stepEndpointName(event, options.after.kind) === options.after.name
+      );
+      const afterStarted = afterEvents.length > 0 || afterRunning.length > 0;
+      const afterEvidenceEvent = afterEvents[0] ?? afterRunning[0];
+      if (beforeRunning.length > 0 && afterStarted && afterEvidenceEvent !== void 0) {
         const endpointExpected2 = bothTools ? { before: options.before.name, after: options.after.name } : { before: options.before, after: options.after };
         return [
           failFinding(
@@ -6513,18 +6519,20 @@ function createStepOrderingRule(options) {
             `${subject} ${beforeLabel} started but never finished before ${afterLabel} ran.`,
             [
               ...beforeRunning.map((event) => eventEvidence(event)),
-              eventEvidence(afterEvents[0])
+              eventEvidence(afterEvidenceEvent)
             ],
             { ...endpointExpected2, mode },
             {
               code: bothTools ? "tool.order.interval-unresolved" : "step.order.interval-unresolved",
               unfinishedBefore: true,
-              beforeStatus: "running"
+              beforeStatus: "running",
+              ...beforeEvents.length > 0 ? { finishedBeforeMasked: true } : {},
+              ...afterEvents.length === 0 ? { afterStatus: "running" } : {}
             }
           )
         ];
       }
-      if (beforeEvents.length === 0 || afterEvents.length === 0) {
+      if (beforeEvents.length === 0 || !afterStarted) {
         if (!requireEndpoints) return [];
         const findings = [];
         if (beforeEvents.length === 0) {
@@ -6548,7 +6556,7 @@ function createStepOrderingRule(options) {
             )
           );
         }
-        if (afterEvents.length === 0) {
+        if (!afterStarted) {
           const otherKinds = otherKindsForStepName(
             context,
             options.after.kind,
@@ -6571,9 +6579,15 @@ function createStepOrderingRule(options) {
         }
         return findings;
       }
-      const encounter = finishedEvents(context).filter(
-        (event) => event.kind === options.before.kind && stepEndpointName(event, options.before.kind) === options.before.name || event.kind === options.after.kind && stepEndpointName(event, options.after.kind) === options.after.name
-      );
+      const afterForOrder = afterEvents.length > 0 ? afterEvents : afterRunning;
+      const encounter = [
+        ...finishedEvents(context).filter(
+          (event) => event.kind === options.before.kind && stepEndpointName(event, options.before.kind) === options.before.name || event.kind === options.after.kind && stepEndpointName(event, options.after.kind) === options.after.name
+        ),
+        ...afterEvents.length === 0 ? afterRunning.filter(
+          (event) => !finishedEvents(context).some((finished) => finished.eventId === event.eventId)
+        ) : []
+      ];
       let beforeIndex;
       let afterIndex;
       for (const [position, event] of encounter.entries()) {
@@ -6604,7 +6618,7 @@ function createStepOrderingRule(options) {
         ];
       }
       const beforeEvent = beforeEvents[0];
-      const afterEvent = afterEvents[0];
+      const afterEvent = afterForOrder[0];
       const beforeEnd = eventEndMs(beforeEvent);
       const afterStart = eventStartMs(afterEvent);
       const endpointExpected = bothTools ? { before: options.before.name, after: options.after.name } : { before: options.before, after: options.after };
@@ -6690,7 +6704,7 @@ function createStepOrderingRule(options) {
             latestBefore = { event, end };
           }
         }
-        for (const event of afterEvents) {
+        for (const event of afterForOrder) {
           const start = eventStartMs(event);
           if (start === void 0) {
             missingAfterStarts += 1;
@@ -6719,7 +6733,7 @@ function createStepOrderingRule(options) {
         const tie = tiedEnd === tiedStart ? recordedTieOrder(
           context,
           beforeEvents.filter((event) => eventEndMs(event) === tiedEnd),
-          afterEvents.filter((event) => eventStartMs(event) === tiedStart)
+          afterForOrder.filter((event) => eventStartMs(event) === tiedStart)
         ) : void 0;
         if (latestBefore.end > earliestAfter.start || tie !== void 0 && tie.inOrder !== true) {
           return [
@@ -7684,10 +7698,11 @@ var init_checks2 = __esm({
     DEFAULT_SECRET_PATTERNS = [
       { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
       { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
-      // Stripe + Slack: keep in sync with packages/redact + credential-value-patterns (#520).
+      // Stripe + Slack: keep in sync with packages/redact + credential-value-patterns (#520/#528).
+      // Non-alnum lookarounds so underscore-adjacent forms (acct_sk_live_…, …_eu) match.
       {
         id: "stripe-key",
-        pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/
+        pattern: /(?<![A-Za-z0-9])(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/
       },
       { id: "slack-token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/ },
       { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
@@ -17464,7 +17479,7 @@ var init_src = __esm({
 });
 
 // package.json
-var version = "6.31.33";
+var version = "6.31.34";
 
 // packages/cli/src/list.ts
 init_advanced();
@@ -19692,11 +19707,25 @@ function attemptIdOf3(event) {
   }
   return void 0;
 }
+function operationIdOf(event) {
+  const direct = event.attributes?.operationId;
+  if (typeof direct === "string" && direct.trim() !== "") return direct;
+  const meta2 = event.attributes?.metadata;
+  if (meta2 && typeof meta2 === "object" && !Array.isArray(meta2)) {
+    const nested = meta2.operationId;
+    if (typeof nested === "string" && nested.trim() !== "") return nested;
+  }
+  return void 0;
+}
 function lifecycleKey(event) {
   if (event.kind === "RUN") return `run:${event.runId}`;
   const stepId = stepIdOf2(event);
-  if (stepId !== void 0) return `step:${stepId}`;
-  return `event:${event.eventId}`;
+  if (stepId === void 0) return `event:${event.eventId}`;
+  const attemptId = attemptIdOf3(event);
+  if (attemptId !== void 0) return `step:${stepId}:attempt:${attemptId}`;
+  const operationId = operationIdOf(event);
+  if (operationId !== void 0) return `step:${stepId}:op:${operationId}`;
+  return `step:${stepId}`;
 }
 function isTerminal(status) {
   return status === "ok" || status === "error";
@@ -19747,6 +19776,12 @@ function joinSiblingGroup(group) {
   const others = group.filter(
     (n) => !isTerminal(n.event.status) && n.event.status !== "running"
   );
+  const operationIds = new Set(
+    group.map((n) => operationIdOf(n.event)).filter((id) => id !== void 0)
+  );
+  if (operationIds.size > 1) {
+    return group;
+  }
   const terminalStatuses = new Set(terminals.map((n) => n.event.status));
   if (terminalStatuses.size > 1) {
     return group;
@@ -19758,19 +19793,22 @@ function joinSiblingGroup(group) {
   const out = [];
   for (const terminal of terminals) {
     const terminalAttempt = attemptIdOf3(terminal.event);
+    const terminalOp = operationIdOf(terminal.event);
     const terminalTs = eventTime3(terminal.event);
-    const candidate = runnings.find((r) => {
+    const candidates = runnings.filter((r) => {
       if (usedRunning.has(r.event.eventId)) return false;
       if (eventTime3(r.event) > terminalTs) return false;
+      const runningOp = operationIdOf(r.event);
+      if (terminalOp !== void 0 && runningOp !== void 0 && terminalOp !== runningOp) {
+        return false;
+      }
       const runningAttempt = attemptIdOf3(r.event);
       if (terminalAttempt !== void 0) {
         return runningAttempt === terminalAttempt;
       }
-      if (runningAttempt !== void 0) {
-        return true;
-      }
-      return true;
+      return runningAttempt === void 0;
     });
+    const candidate = candidates.length === 1 ? candidates[0] : void 0;
     if (candidate) {
       usedRunning.add(candidate.event.eventId);
       out.push(joinOnePair(candidate, terminal));
@@ -22660,10 +22698,11 @@ var credentialDetectors = [
     severity: "error"
   }),
   // Stripe secret/restricted keys (underscore form). Keep in sync with
-  // packages/core/src/safety/credential-value-patterns.ts + checks DEFAULT_SECRET_PATTERNS (#520).
+  // packages/core/src/safety/credential-value-patterns.ts + checks DEFAULT_SECRET_PATTERNS (#520/#528).
+  // Non-alnum lookarounds so underscore-adjacent forms (acct_sk_live_…, …_eu) match.
   patternDetector({
     id: "value.stripeSecretKey",
-    pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+    pattern: /(?<![A-Za-z0-9])(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/,
     severity: "error"
   }),
   patternDetector({
@@ -24444,6 +24483,21 @@ function stableJson2(value) {
   return `${JSON.stringify(value, null, 2)}
 `;
 }
+function alignCheckResultsAggregateStatus(checkResultsJson, assessmentStatus) {
+  let parsed;
+  try {
+    parsed = JSON.parse(checkResultsJson);
+  } catch {
+    return stableJson2({
+      aggregateStatus: assessmentStatus,
+      raw: checkResultsJson
+    });
+  }
+  return stableJson2({
+    ...parsed,
+    aggregateStatus: assessmentStatus
+  });
+}
 async function writeLocalEvidence(input3) {
   const profile = input3.redactionProfile ?? "share";
   const format = input3.format ?? "directory";
@@ -24482,6 +24536,10 @@ async function writeLocalEvidence(input3) {
     format: "agent-inspect-jsonl"
   });
   const assessmentStatus = residualStatusToEvidenceSafe(residual.status);
+  const checkResultsJson = alignCheckResultsAggregateStatus(
+    input3.checkResultsJson,
+    assessmentStatus
+  );
   const evidencePackage = buildEvidenceCiPackage({
     generatorVersion: version,
     runIds: input3.runIds,
@@ -24489,7 +24547,7 @@ async function writeLocalEvidence(input3) {
     redactedTraceJsonl: combined,
     redactionProfile: profile,
     assessmentStatus,
-    checkResultsJson: input3.checkResultsJson,
+    checkResultsJson,
     ...input3.summaryText !== void 0 ? { summaryText: input3.summaryText } : {},
     ...input3.contractPackage !== void 0 ? { contractPackage: input3.contractPackage } : {}
   });
@@ -24550,12 +24608,12 @@ async function writeLocalEvidence(input3) {
   return baseDir;
 }
 function checkResultToEvidenceJson(result, runIds) {
-  const status = result.status === "pass" ? "SAFE" : result.status === "fail" ? "UNSAFE" : "UNKNOWN";
   return stableJson2({
-    aggregateStatus: status,
+    aggregateStatus: "UNKNOWN",
+    checkStatus: result.status,
     runs: runIds.map((runId) => ({
       runId,
-      status,
+      checkStatus: result.status,
       errors: result.summary.errors,
       warnings: result.summary.warnings,
       findings: result.findings.length,
@@ -32608,10 +32666,12 @@ async function gateCommand(options = {}) {
           runIds: runIds.length > 0 ? runIds : ["gate"],
           sourceContents,
           ...gateOptions.traceDir !== void 0 ? { dir: gateOptions.traceDir } : {},
-          failed,
+          // aggregateStatus is filled from residual assessment before hashing (#529).
+          // Gate pass/fail stays in `gate` / process.exitCode, not aggregateStatus.
           checkResultsJson: `${JSON.stringify(
             {
-              aggregateStatus: failed ? "UNSAFE" : "SAFE",
+              aggregateStatus: "UNKNOWN",
+              gateStatus: failed ? "fail" : "pass",
               gate: result
             },
             null,