apidepth 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d59e0f9e95678afd4a0f9ce173de1b63ac893ab01cbc68fc1d6bbcedc44bfaad
-  data.tar.gz: 29524e4a1687cafb241caa6c07dbb2c1139ef2e44bc92f8ded25dc15c1305a92
+  metadata.gz: 69006b5a613f60527b41de94536502c71526d9e9dd274625c7f235d03624d194
+  data.tar.gz: 76941c29e08ec0c4a40e310a017f57f9c32f1c90cc37820ce794834c90ad8d15
 SHA512:
-  metadata.gz: a4a88ac5df80e6af2987cfa29d354c67c5275c02e30caacbae086558d2a0ee1fe1304a42c11b679b2ec6a1358a1cd0e69c3969a5d9d400c246723592df448599
-  data.tar.gz: 2005a0c7164ed0b20da0e1013cdc250be7d09f66fdfdd65f465168f38f4a105bfa6370e3a98bef015502f7cb2ba961a99189a6232e0098eb47ca11c588d90ed4
+  metadata.gz: d5e0babbb150df6d38aa32c83df843da7d7991c8fd17be37010d1454eaef8a936b878c4efdc8eb3373d714c70e75a124a99ada7d3fa43e248c4eb464920f833c
+  data.tar.gz: fd034d845f43a8f34af26f6cf99067ec51c690168744d379d19727de2c383ea88a8e9ffd89dbdc8ffc79b6fbd2e73fa29f684b1415c7708c1c88bc78ee01f52b

data/lib/apidepth/model_name_extractor.rb

@@ -1,5 +1,4 @@
 # lib/apidepth/model_name_extractor.rb
-require "json"
 require "set"
 #
 # Extracts the model name from AI vendor JSON response bodies.
@@ -19,7 +18,12 @@ require "set"
 #
 # Streaming safety: streamed responses have Content-Type: text/event-stream, not
 # application/json. The content-type guard exits early before any body read.
-# The 8KB truncation is a belt-and-suspenders guard against unusually large bodies.
+#
+# Extraction strategy (RUBY-018): scan for the JSON "model": "<value>" field
+# with a linear regex rather than JSON.parse-ing a truncated body. Embeddings
+# and batch responses place `model` AFTER a large `data` array, so the old
+# parse-after-8KB-truncate approach produced invalid JSON and silently dropped
+# the model. The regex finds the first structural model field wherever it sits.
 
 module Apidepth
   module ModelNameExtractor
@@ -31,20 +35,33 @@ module Apidepth
       api.cohere.com
     ].to_set.freeze
 
-    MAX_BODY_BYTES = 8_192
+    # Upper bound on how far into the body we scan for the model field. 256 KB
+    # comfortably covers realistic embeddings/batch responses (a few-input OpenAI
+    # embeddings body is ~23 KB) while bounding work on pathologically large bodies.
+    MODEL_SCAN_MAX_BYTES = 262_144
+
+    # Matches a structural JSON "model": "<value>" pair. Escaped quotes inside
+    # string values appear as \" so this never matches a "model" mentioned inside
+    # another JSON string. First match wins (the top-level model field).
+    MODEL_RE = /"model"\s*:\s*"([^"]+)"/.freeze
 
     def self.extract(host, response)
       return nil unless Apidepth.configuration.capture_model_names
-      return nil unless AI_VENDOR_HOSTS.include?(host)
+      # Case-insensitive host match (RUBY-019): DNS hostnames are case-insensitive,
+      # so a vendor declared with mixed case (e.g. via extra_vendors) still matches.
+      return nil unless AI_VENDOR_HOSTS.include?(host.to_s.downcase)
       return nil unless response["content-type"]&.include?("application/json")
 
       body = response.body
       return nil if body.nil? || body.empty?
 
-      parsed = JSON.parse(body.byteslice(0, MAX_BODY_BYTES), symbolize_names: true)
-      model = parsed[:model]
-      model.is_a?(String) && !model.empty? ? model : nil
-    rescue JSON::ParserError, Encoding::UndefinedConversionError, TypeError
+      scan = body.byteslice(0, MODEL_SCAN_MAX_BYTES).to_s.dup.force_encoding("UTF-8")
+      match = MODEL_RE.match(scan)
+      match && !match[1].empty? ? match[1] : nil
+    rescue StandardError
+      # Covers malformed/invalid-encoding bodies and non-buffered streaming
+      # bodies (e.g. Net::ReadAdapter, which has no #empty?). Returning nil keeps
+      # the surrounding telemetry event intact rather than dropping it (RUBY-017).
       nil
     end
   end

data/lib/apidepth/vendor_registry.rb

@@ -58,12 +58,22 @@ module Apidepth
       }
     }.freeze
 
+    # Generic fallbacks applied after vendor-specific patterns. Canonical across
+    # all SDKs (XSDK-NORM) — see apidepth-collector/tests/fixtures/endpoint_cases.json.
+    # The :token rule requires at least one digit (?=[a-z0-9]*\d) so 24+ char
+    # readable slugs are left intact while opaque IDs/tokens — which effectively
+    # always contain a digit — are collapsed. UUID is case-insensitive.
     GENERIC_PATTERNS = [
-      [%r{/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}}, "/:uuid"],
-      [%r{/\d{4,}},        "/:id"],
-      [%r{/[a-z0-9]{24,}}, "/:token"]
+      [%r{/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}}i, "/:uuid"],
+      [%r{/\d{4,}}, "/:id"],
+      [%r{/(?=[a-z0-9]*\d)[a-z0-9]{24,}}i, "/:token"]
     ].freeze
 
+    # Upper bound on path length we run the generic normalizers against. Realistic
+    # paths are well under 4 KB; above this we skip normalization because the
+    # :token lookahead is O(n^2) worst-case on a long digit-free alnum run.
+    GENERIC_MAX_PATH = 4096
+
     # True when the runtime supports Regexp.timeout (introduced in Ruby 3.2).
     # Used by apply_vendor_normalizers to enable ReDoS protection when available.
     RUBY_GTE_3_2 = Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("3.2")
@@ -157,7 +167,13 @@ module Apidepth
                 next
               end
 
-              [Regexp.new(match), rule["replace"].to_s]
+              # ReDoS protection: bake a per-pattern timeout into the Regexp at
+              # compile time on Ruby >= 3.2 (RUBY-020). This bounds match time for
+              # a pathological pattern from a compromised/misconfigured registry
+              # without mutating the process-global Regexp.timeout on every request
+              # (which would impose the limit on unrelated regexes in other threads).
+              compiled = RUBY_GTE_3_2 ? Regexp.new(match, timeout: 0.001) : Regexp.new(match)
+              [compiled, rule["replace"].to_s]
             rescue RegexpError => e
               Apidepth.logger&.warn(
                 "[Apidepth] Skipping invalid pattern for #{Apidepth.sanitize_log(slug)} " \
@@ -179,25 +195,23 @@ module Apidepth
       # broader catch-alls (e.g. /v1/:resource/:id). A less-specific rule placed
       # earlier will shadow any more-specific rules that follow it.
       #
-      # ReDoS protection: on Ruby >= 3.2 we apply a per-match timeout of 1ms so
-      # that a pathological pattern from a compromised or misconfigured registry
-      # cannot stall the request thread indefinitely. On older Ruby, Regexp.timeout
-      # is not available — use a trusted, internally-reviewed registry source.
+      # ReDoS protection: each compiled pattern carries its own 1ms timeout (set
+      # in build_patterns on Ruby >= 3.2), so a pathological pattern from a
+      # compromised or misconfigured registry cannot stall the request thread
+      # indefinitely — without touching the process-global Regexp.timeout
+      # (RUBY-020). On older Ruby the timeout is absent; use a trusted,
+      # internally-reviewed registry source. A Regexp::TimeoutError that trips
+      # here propagates to identify's caller, which already rescues StandardError.
       def apply_vendor_normalizers(rules, path)
-        if RUBY_GTE_3_2
-          saved_timeout = Regexp.timeout
-          Regexp.timeout = 0.001
-        end
-
         rules.each do |pattern, replacement|
           return path.gsub(pattern, replacement) if path.match?(pattern)
         end
         path
-      ensure
-        Regexp.timeout = saved_timeout if RUBY_GTE_3_2
       end
 
       def apply_generic_normalizers(path)
+        return path if path.length > GENERIC_MAX_PATH
+
         GENERIC_PATTERNS.reduce(path) do |p, (pattern, replacement)|
           p.gsub(pattern, replacement)
         end

data/lib/apidepth/version.rb

@@ -1,5 +1,5 @@
 # lib/apidepth/version.rb
 
 module Apidepth
-  VERSION = "0.5.0".freeze
+  VERSION = "0.5.1".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: apidepth
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Apidepth
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-03 00:00:00.000000000 Z
+date: 2026-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json