@atbash/sdk 0.10.10-dev.0 → 0.10.12-dev.0

package/dist/index.mjs

@@ -3216,6 +3216,10 @@ var callCounter = null;
 var durationHistogram = null;
 var defaultSource = "sdk";
 function isTelemetryOptedOut() {
+  const disabled = process.env.ATBASH_TELEMETRY_DISABLED?.trim().toLowerCase();
+  if (disabled && ["1", "true", "yes", "on"].includes(disabled)) {
+    return true;
+  }
   try {
     const home2 = process.env.HOME || homedir2() || "";
     const filePath = join2(home2, ".config", "atbash", "telemetry.json");
@@ -3236,14 +3240,14 @@ function setupTelemetry(config2) {
   if (!config2.enabled) return;
   if (meterProvider) return;
   if (isTelemetryOptedOut()) return;
+  if (!config2.endpoint || !config2.getAuthHeaders) return;
+  if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(config2.endpoint)) return;
   defaultSource = config2.source ?? "sdk";
-  const apiKey = process.env.HONEYCOMB_API_KEY ?? native.HONEYCOMB_KEY;
-  if (!apiKey) return;
+  const proxyUrl = `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`;
+  const getAuthHeaders = config2.getAuthHeaders;
   const exporter = new OTLPMetricExporter({
-    url: "https://api.honeycomb.io/v1/metrics",
-    headers: {
-      "x-honeycomb-team": apiKey
-    }
+    url: proxyUrl,
+    headers: async () => getAuthHeaders()
   });
   const reader = new PeriodicExportingMetricReader({
     exporter,
@@ -3418,6 +3422,16 @@ var Atbash = class _Atbash {
         verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
+    try {
+      setupTelemetry({
+        enabled: true,
+        source: "sdk",
+        endpoint: this.endpoint,
+        getAuthHeaders: () => this.authHeaders()
+      });
+    } catch (err) {
+      this.logger.warn?.("[atbash] telemetry setup failed \u2014 continuing without metrics", { error: String(err) });
+    }
   }
   /**
    * Say which environment this build talks to, once per process.
@@ -3931,19 +3945,25 @@ var Atbash = class _Atbash {
     });
   }
   /* ── risk-engine batched (action-dispatched POST) ──────────────────────── */
-  getAgentDetail(agentPubkey) {
-    return this.track(
-      "getAgentDetail",
-      agentPubkey,
-      () => this.riskEnginePost({ action: "agent-detail-batch", agent: agentPubkey })
-    );
+  async getAgentDetail(agentPubkey, options = {}) {
+    return this.track("getAgentDetail", agentPubkey, async () => {
+      const network = await this.resolveAgentLookupNetwork(options);
+      return this.riskEnginePost(
+        { action: "agent-detail-batch", agent: agentPubkey },
+        network
+      );
+    });
   }
-  async getAgentPolicy(agentPubkey) {
+  async getAgentPolicy(agentPubkey, options = {}) {
     return this.track("getAgentPolicy", agentPubkey, async () => {
-      const raw2 = await this.riskEnginePost({
-        action: "agent-policy-batch",
-        agent: agentPubkey
-      });
+      const network = await this.resolveAgentLookupNetwork(options);
+      const raw2 = await this.riskEnginePost(
+        {
+          action: "agent-policy-batch",
+          agent: agentPubkey
+        },
+        network
+      );
       return {
         policy: String(raw2.policy ?? ""),
         isJailed: Boolean(raw2.is_jailed),
@@ -4100,6 +4120,20 @@ var Atbash = class _Atbash {
     if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
     return this.blockchainRid;
   }
+  /**
+   * Resolve the dashboard chain used by agent metadata/policy reads.
+   * Explicit per-call network overrides win; otherwise use the supplied org
+   * or the client's configured default org. A custom BRID is intentionally
+   * left untouched because it cannot be represented by the dashboard's
+   * public/private query selector.
+   */
+  async resolveAgentLookupNetwork(options) {
+    if (options.chainOpts?.network) return options.chainOpts.network;
+    if (options.chainOpts?.blockchainRid) return void 0;
+    const orgName = options.orgName ?? this.orgName;
+    if (!orgName) return void 0;
+    return (await this.resolveChainForOrg(orgName)).network;
+  }
   /**
    * Get-or-create a Bearer token for dashboard reads. The token is a
    * signed `log_tool_call` op (locally signed, never submitted) — the
@@ -4142,10 +4176,11 @@ var Atbash = class _Atbash {
     if (resp.status !== 200) throw await this.httpError(resp);
     return this.json(resp);
   }
-  async riskEnginePost(body) {
+  async riskEnginePost(body, network) {
     let resp;
     try {
-      resp = await this.http.post("/api/risk-engine", body, this.authHeaders());
+      const path7 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
+      resp = await this.http.post(path7, body, this.authHeaders());
     } catch (err) {
       throw this.transportError(err);
     }
@@ -4416,7 +4451,8 @@ async function scanMemory(entry, auth, opts) {
   const result = await atbash.judgeAction(request.prompt, request.context, {
     toolName: opts?.toolName ?? "memory_write",
     toolArgsJson: opts?.toolArgsJson ?? JSON.stringify({ key: entry.key, source: entry.source }),
-    mode: "memory-scan"
+    mode: "memory-scan",
+    orgName: opts?.orgName
   });
   if (result.verdict === "No verdict" && result.status !== "logged") {
     throw new Error(