agent-inspect 6.31.33 → 6.31.35

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 6.31.35
+
+### Patch Changes
+
+- 3cb8284: Bound and order tool-name diagnostics: cap codepoint annotations, skip pure non-Latin noise, keep bidi/control visible, and sort allowlist causes ahead of missing-tool consequences across rules (#522 follow-up). Add recipe-local refund ceiling/entity/approval (#527) and illustrative RETRIEVER→LLM OpenInference order examples via TraceCheckRule extension.
+
+## 6.31.34
+
+### Patch Changes
+
+- c0726d8: Detect underscore-adjacent Stripe keys across redact, credential-value, and verify-safe patterns (#528; thanks Frank). Align `gate --evidence-on` check-results `aggregateStatus` with residual artifact assessment while keeping gate pass/fail separate (#529; thanks Frank). Fail unfinished before-order occurrences even when a finished peer exists, and treat after-start without a terminal as order-relevant. Harden Gary/Nest saved verifiers, refuse ambiguous HTML lifecycle joins, and evaluate Roy UNPROVABLE positive controls.
+
 ## 6.31.33
 
 ### Patch Changes

package/README.md

@@ -213,7 +213,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.31.33** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.31.35** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/docs/LIMITATIONS.md

@@ -98,4 +98,26 @@ Visual demos: [SCREENSHOTS.md](./SCREENSHOTS.md) · [CLI.md](./CLI.md)
 
 - Designed for **developer machines** and **inner-loop debugging**, not petabyte log warehouses.
 
+## Trust boundary (four independent questions)
+
+AgentInspect answers local evidence questions. Treat these as **separate**:
+
+1. **Capture / coverage** — What events were recorded under the declared instrumentation boundary? Missing spans, uninstrumented SDK calls, and effects outside that boundary are not inventable from silence.
+2. **Trajectory contract** — Did a TraceContract / check preset pass on the selected run(s)? Pass/fail is rule evaluation over captured evidence, not proof of business correctness.
+3. **Residual artifact safety** — Do written share/strict artifacts pass the residual safety policy (`verify-safe` / Evidence assessment)? This is best-effort local policy, not a compliance certification or whole-org DLP guarantee.
+4. **Independent authorization / effect / origin** — Is there separate evidence of lawful authority, successful side effect, and trusted producer origin? AgentInspect does not supply those by default.
+
+Implications:
+
+- A recomputed **unsigned** Evidence manifest can verify **internal consistency** (listed files + hashes). It does **not** prove authenticity or producer identity.
+- A **signature** (if supplied externally) can authenticate bytes to a trusted signer. It still does **not** prove completeness, lawful authority, successful business effect, or absence of an uninstrumented side effect.
+- A recorded **approval-before-action** event is evidence that an approval was *recorded*. It is **not** proof that the approver had authority.
+- Signed receipts or durable journals (parked designs) do **not** create exactly-once side effects.
+
+Hypothetical approval evidence fields for a future recipe (not a shipped schema): distinct `decisionId`, `policyVersion`, `actorAuthorityRef`, `actionDigest`, `targetScope`, `decisionTime`, `executionId`, and a downstream `receiptId`. These are a proposed evidence set for discussion, not a banking integration.
+
+Parked larger designs (coverage registry, cross-run linkage, durable intent journal, signing/sealing, general value comparisons, data-flow causal explanations) stay out of incidental patches — see [implementation/active/PARKED-DESIGNS.md](./implementation/active/PARKED-DESIGNS.md).
+
+Related: [EVIDENCE-FORMAT.md](./EVIDENCE-FORMAT.md), [ADR-0012](./decisions/ADR-0012-evidence-contract-binding.md), [SAFE-TRACE-SHARING.md](./SAFE-TRACE-SHARING.md), [NETWORK-BEHAVIOR.md](./NETWORK-BEHAVIOR.md), [NO-EGRESS-POLICY.md](./NO-EGRESS-POLICY.md).
+
 For roadmap intent, see [ROADMAP.md](../ROADMAP.md) (direction only — not a delivery guarantee).

package/docs/SAFE-TRACE-SHARING.md

@@ -4,7 +4,7 @@
 
 AgentInspect traces, log-ingest outputs, and exports are local files. They may still contain sensitive metadata that you attached manually, collected from logs, or included through optional preview settings. Use this checklist before sharing an artifact in a GitHub issue, Discussion, PR, support thread, or public post.
 
-This guide is practical sharing guidance, not a guarantee that any artifact is safe to publish. Redaction profiles are **best-effort transformation**, not compliance-grade DLP or a safety certification. Always finish with `verify-safe` before sharing.
+This guide is practical sharing guidance, not a guarantee that any artifact is safe to publish. Redaction profiles are **best-effort transformation**, not compliance-grade DLP or a safety certification. Always finish with `verify-safe` before sharing. Passing residual safety is still only one of the [four trust-boundary questions](./LIMITATIONS.md#trust-boundary-four-independent-questions) — it does not prove capture completeness, contract truth, or independent authorization.
 
 Built-in profiles redact high-confidence credential forms (provider keys, JWTs, bearer tokens, and bounded `token=` / `api_key=` / `internal_token=` style key/value secrets). Broad or context-sensitive findings—such as private filesystem paths—may still appear under `verify-safe` and as residual status after `redact`. Org-specific patterns can use a local CLI `--policy` JSON file (`extraKeys` plus bounded literal/prefix patterns; no user regex) or programmatic custom detectors.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.31.33",
+  "version": "6.31.35",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",

package/packages/cli/dist/{chunk-AILSHDEF.mjs → chunk-RLFYFWIZ.mjs}

@@ -938,8 +938,9 @@ var HIGH_CONFIDENCE_CREDENTIAL_PATTERNS = [
   /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
   /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
   // Stripe secret / restricted keys use underscores (not sk-). Keep in sync with
-  // packages/redact/src/index.ts + packages/core/src/checks DEFAULT_SECRET_PATTERNS (#520).
-  /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+  // packages/redact/src/index.ts + packages/core/src/checks DEFAULT_SECRET_PATTERNS (#520/#528).
+  // Use non-alnum lookarounds so underscore-adjacent forms (acct_sk_live_…, …_eu) match.
+  /(?<![A-Za-z0-9])(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/,
   /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/,
   /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
   /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
@@ -7832,10 +7833,11 @@ var SAFE_USAGE_LEAF_KEYS = /* @__PURE__ */ new Set([
 var DEFAULT_SECRET_PATTERNS = [
   { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
   { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
-  // Stripe + Slack: keep in sync with packages/redact + credential-value-patterns (#520).
+  // Stripe + Slack: keep in sync with packages/redact + credential-value-patterns (#520/#528).
+  // Non-alnum lookarounds so underscore-adjacent forms (acct_sk_live_…, …_eu) match.
   {
     id: "stripe-key",
-    pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/
+    pattern: /(?<![A-Za-z0-9])(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}(?![A-Za-z0-9])/
   },
   { id: "slack-token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/ },
   { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
@@ -8009,11 +8011,27 @@ function eventTimestamp(finding, eventById) {
   const eventId = finding.evidence[0]?.eventId;
   return eventId ? eventById.get(eventId)?.timestamp ?? "" : "";
 }
+function isObservedToolPolicyFinding(finding) {
+  return finding.ruleId === "tool.usage" && finding.evidence[0]?.eventId !== void 0;
+}
+function isMissingToolConsequenceFinding(finding) {
+  if (finding.evidence[0]?.eventId !== void 0) return false;
+  if (finding.ruleId === "tool.usage" && /did not appear/.test(finding.message)) {
+    return true;
+  }
+  return finding.ruleId.startsWith("contract.tool.arguments") && /^No finished tool named /.test(finding.message);
+}
 function compareFindings(eventById) {
   return (a, b) => {
     if (SEVERITY_RANK[a.severity] !== SEVERITY_RANK[b.severity]) {
       return SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
     }
+    const aPolicy = isObservedToolPolicyFinding(a);
+    const bPolicy = isObservedToolPolicyFinding(b);
+    const aMissing = isMissingToolConsequenceFinding(a);
+    const bMissing = isMissingToolConsequenceFinding(b);
+    if (aPolicy && bMissing) return -1;
+    if (bPolicy && aMissing) return 1;
     const byRule = a.ruleId.localeCompare(b.ruleId);
     if (byRule !== 0) return byRule;
     if (STATUS_RANK[a.status] !== STATUS_RANK[b.status]) {
@@ -8149,20 +8167,43 @@ function failFinding(ruleId, message, evidence, expected, actual, meta) {
 function toolName(event) {
   return resolveCanonicalToolName(event);
 }
+var MAX_TOOL_NAME_CODEPOINT_DETAILS = 3;
+function isAsciiLetterCodePoint(codePoint) {
+  return codePoint >= 65 && codePoint <= 90 || codePoint >= 97 && codePoint <= 122;
+}
+function isRiskyToolNameCodePoint(codePoint) {
+  if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
+  return codePoint === 1564 || codePoint === 8203 || codePoint === 8204 || codePoint === 8205 || codePoint === 8206 || codePoint === 8207 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297 || codePoint === 65279;
+}
+function formatCodePointDetail(codePoint, index) {
+  return `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")} at index ${index}`;
+}
 function formatToolNameForMessage(name) {
+  let hasAsciiLetter = false;
+  let hasNonAscii = false;
+  let hasRisky = false;
   const details = [];
   for (let index = 0; index < name.length; ) {
     const codePoint = name.codePointAt(index);
     const width = codePoint > 65535 ? 2 : 1;
+    if (isAsciiLetterCodePoint(codePoint)) hasAsciiLetter = true;
+    const risky = isRiskyToolNameCodePoint(codePoint);
+    if (risky) hasRisky = true;
     if (codePoint > 127) {
-      details.push(
-        `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")} at index ${index}`
-      );
+      hasNonAscii = true;
+      details.push(formatCodePointDetail(codePoint, index));
+    } else if (risky) {
+      details.push(formatCodePointDetail(codePoint, index));
     }
     index += width;
   }
-  if (details.length === 0) return name;
-  return `"${name}" (contains ${details.join("; ")})`;
+  if (!hasRisky && !(hasAsciiLetter && hasNonAscii) || details.length === 0) {
+    return name;
+  }
+  const shown = details.slice(0, MAX_TOOL_NAME_CODEPOINT_DETAILS);
+  const remaining = details.length - shown.length;
+  const detailText = remaining > 0 ? `${shown.join("; ")}; and ${remaining} more` : shown.join("; ");
+  return `"${name}" (contains ${detailText})`;
 }
 function describeRunningEvent(event) {
   if (event.kind === "TOOL") {
@@ -8786,7 +8827,12 @@ function createStepOrderingRule(options) {
       const beforeRunning = semanticEvents(context).filter(
         (event) => event.kind === options.before.kind && event.status === "running" && stepEndpointName(event, options.before.kind) === options.before.name
       );
-      if (beforeEvents.length === 0 && afterEvents.length > 0 && beforeRunning.length > 0) {
+      const afterRunning = semanticEvents(context).filter(
+        (event) => event.kind === options.after.kind && event.status === "running" && stepEndpointName(event, options.after.kind) === options.after.name
+      );
+      const afterStarted = afterEvents.length > 0 || afterRunning.length > 0;
+      const afterEvidenceEvent = afterEvents[0] ?? afterRunning[0];
+      if (beforeRunning.length > 0 && afterStarted && afterEvidenceEvent !== void 0) {
         const endpointExpected2 = bothTools ? { before: options.before.name, after: options.after.name } : { before: options.before, after: options.after };
         return [
           failFinding(
@@ -8794,18 +8840,20 @@ function createStepOrderingRule(options) {
             `${subject} ${beforeLabel} started but never finished before ${afterLabel} ran.`,
             [
               ...beforeRunning.map((event) => eventEvidence3(event)),
-              eventEvidence3(afterEvents[0])
+              eventEvidence3(afterEvidenceEvent)
             ],
             { ...endpointExpected2, mode },
             {
               code: bothTools ? "tool.order.interval-unresolved" : "step.order.interval-unresolved",
               unfinishedBefore: true,
-              beforeStatus: "running"
+              beforeStatus: "running",
+              ...beforeEvents.length > 0 ? { finishedBeforeMasked: true } : {},
+              ...afterEvents.length === 0 ? { afterStatus: "running" } : {}
             }
           )
         ];
       }
-      if (beforeEvents.length === 0 || afterEvents.length === 0) {
+      if (beforeEvents.length === 0 || !afterStarted) {
         if (!requireEndpoints) return [];
         const findings = [];
         if (beforeEvents.length === 0) {
@@ -8829,7 +8877,7 @@ function createStepOrderingRule(options) {
             )
           );
         }
-        if (afterEvents.length === 0) {
+        if (!afterStarted) {
           const otherKinds = otherKindsForStepName(
             context,
             options.after.kind,
@@ -8852,9 +8900,15 @@ function createStepOrderingRule(options) {
         }
         return findings;
       }
-      const encounter = finishedEvents(context).filter(
-        (event) => event.kind === options.before.kind && stepEndpointName(event, options.before.kind) === options.before.name || event.kind === options.after.kind && stepEndpointName(event, options.after.kind) === options.after.name
-      );
+      const afterForOrder = afterEvents.length > 0 ? afterEvents : afterRunning;
+      const encounter = [
+        ...finishedEvents(context).filter(
+          (event) => event.kind === options.before.kind && stepEndpointName(event, options.before.kind) === options.before.name || event.kind === options.after.kind && stepEndpointName(event, options.after.kind) === options.after.name
+        ),
+        ...afterEvents.length === 0 ? afterRunning.filter(
+          (event) => !finishedEvents(context).some((finished) => finished.eventId === event.eventId)
+        ) : []
+      ];
       let beforeIndex;
       let afterIndex;
       for (const [position, event] of encounter.entries()) {
@@ -8885,7 +8939,7 @@ function createStepOrderingRule(options) {
         ];
       }
       const beforeEvent = beforeEvents[0];
-      const afterEvent = afterEvents[0];
+      const afterEvent = afterForOrder[0];
       const beforeEnd = eventEndMs(beforeEvent);
       const afterStart = eventStartMs(afterEvent);
       const endpointExpected = bothTools ? { before: options.before.name, after: options.after.name } : { before: options.before, after: options.after };
@@ -8971,7 +9025,7 @@ function createStepOrderingRule(options) {
             latestBefore = { event, end };
           }
         }
-        for (const event of afterEvents) {
+        for (const event of afterForOrder) {
           const start = eventStartMs(event);
           if (start === void 0) {
             missingAfterStarts += 1;
@@ -9000,7 +9054,7 @@ function createStepOrderingRule(options) {
         const tie = tiedEnd === tiedStart ? recordedTieOrder(
           context,
           beforeEvents.filter((event) => eventEndMs(event) === tiedEnd),
-          afterEvents.filter((event) => eventStartMs(event) === tiedStart)
+          afterForOrder.filter((event) => eventStartMs(event) === tiedStart)
         ) : void 0;
         if (latestBefore.end > earliestAfter.start || tie !== void 0 && tie.inOrder !== true) {
           return [
@@ -16171,5 +16225,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { ATTRIBUTION_CONFIDENCES, COHORT_METRIC_IDS, DEFAULT_REDACT_KEYS, DEFAULT_SUITE_ARTIFACTS_DIR, DELIVERY_CONFLICT_ATTR, DELIVERY_EVENT_BASE_ATTR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, IDENTITY_CONFLICT_ATTR, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, defineTraceContract, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, evaluateTraceContract, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isAttributionConfidence, isCredentialSensitiveKey, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToRunTrees, persistedInspectEventsToTraceEvents, projectLogicalEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, stringContainsHighConfidenceCredential, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-AILSHDEF.mjs.map
-//# sourceMappingURL=chunk-AILSHDEF.mjs.map
+//# sourceMappingURL=chunk-RLFYFWIZ.mjs.map
+//# sourceMappingURL=chunk-RLFYFWIZ.mjs.map