@bli-cockpit/telemetry-core 0.1.17 → 0.1.19

package/dist/evidence-upload.d.ts

@@ -377,6 +377,78 @@ export declare const RawEvidenceUploadCommitResponseSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type RawEvidenceUploadCommitResponse = z.infer<typeof RawEvidenceUploadCommitResponseSchema>;
+/**
+ * The collector giving up on an object it already opened (BLI-2539).
+ *
+ * `begin` writes a ledger row for every object in the batch, then chunks go one
+ * object at a time. When one object's chunks fail its siblings still finish, so
+ * the production shape is a single failure among committed rows rather than a
+ * truncated batch. The collector knows exactly why that object died — it
+ * composes labels like `chunk_0_failed_http_500` — and until this route existed
+ * it had nowhere to send them: begin/chunk/commit has no call meaning "I quit".
+ * The row stayed `pending` with a null reason until a drain relabelled it
+ * `staging_incomplete`, which describes the shape and not the cause. 275 rows
+ * reached that state by 2026-08-14.
+ *
+ * The reason is a label, never free text or an error body: it lands in
+ * `status_reason`, which is read by `classifyUploadFailure`, and an unlisted
+ * label classifies as `unknown` rather than being guessed into a bucket. That
+ * is also what keeps these rows recoverable — `unknown` is not permanent, so
+ * the row stays open (still `pending`, staged chunks intact) and the next
+ * `begin` resumes it. Only a reason classified permanent fails the row closed.
+ */
+export declare const RawEvidenceUploadAbortRequestSchema: z.ZodObject<{
+    schema_version: z.ZodLiteral<"ambient-raw-evidence-upload-abort.v1">;
+    generated_at: z.ZodString;
+    provenance: z.ZodObject<{
+        capture_source: z.ZodEnum<{
+            unknown: "unknown";
+            codex_jsonl: "codex_jsonl";
+            codex_otel: "codex_otel";
+            car_state: "car_state";
+            git_state: "git_state";
+            github_state: "github_state";
+            linear_state: "linear_state";
+            mcp_local: "mcp_local";
+            claude_jsonl: "claude_jsonl";
+            claude_hooks: "claude_hooks";
+            manual_event: "manual_event";
+            collector_runtime: "collector_runtime";
+        }>;
+        capture_adapter_version: z.ZodString;
+        collector_version: z.ZodString;
+        repo: z.ZodString;
+        branch: z.ZodString;
+        repo_label: z.ZodOptional<z.ZodString>;
+        repo_fingerprint: z.ZodOptional<z.ZodString>;
+        repo_origin_url: z.ZodOptional<z.ZodString>;
+        worktree_label: z.ZodOptional<z.ZodString>;
+        worktree_fingerprint: z.ZodOptional<z.ZodString>;
+        worktree_is_primary: z.ZodOptional<z.ZodBoolean>;
+        operator_id: z.ZodString;
+        session_id: z.ZodString;
+        work_context_id: z.ZodString;
+    }, z.core.$strict>;
+    upload_id: z.ZodString;
+    object_key: z.ZodString;
+    reason: z.ZodString;
+    uploaded_chunk_count: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type RawEvidenceUploadAbortRequest = z.infer<typeof RawEvidenceUploadAbortRequestSchema>;
+export declare const RawEvidenceUploadAbortResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    status: z.ZodEnum<{
+        reason_recorded: "reason_recorded";
+        aborted: "aborted";
+        already_terminal: "already_terminal";
+    }>;
+    upload_id: z.ZodString;
+    object_key: z.ZodString;
+    status_reason: z.ZodString;
+    retryable: z.ZodBoolean;
+    will_reopen: z.ZodBoolean;
+}, z.core.$strict>;
+export type RawEvidenceUploadAbortResponse = z.infer<typeof RawEvidenceUploadAbortResponseSchema>;
 /**
  * Codex session attribution report.
  *

package/dist/evidence-upload.js

@@ -154,6 +154,72 @@ export const RawEvidenceUploadCommitResponseSchema = z
     redaction: RawEvidenceRedactionMetadataSchema.optional(),
 })
     .strict();
+/**
+ * The collector giving up on an object it already opened (BLI-2539).
+ *
+ * `begin` writes a ledger row for every object in the batch, then chunks go one
+ * object at a time. When one object's chunks fail its siblings still finish, so
+ * the production shape is a single failure among committed rows rather than a
+ * truncated batch. The collector knows exactly why that object died — it
+ * composes labels like `chunk_0_failed_http_500` — and until this route existed
+ * it had nowhere to send them: begin/chunk/commit has no call meaning "I quit".
+ * The row stayed `pending` with a null reason until a drain relabelled it
+ * `staging_incomplete`, which describes the shape and not the cause. 275 rows
+ * reached that state by 2026-08-14.
+ *
+ * The reason is a label, never free text or an error body: it lands in
+ * `status_reason`, which is read by `classifyUploadFailure`, and an unlisted
+ * label classifies as `unknown` rather than being guessed into a bucket. That
+ * is also what keeps these rows recoverable — `unknown` is not permanent, so
+ * the row stays open (still `pending`, staged chunks intact) and the next
+ * `begin` resumes it. Only a reason classified permanent fails the row closed.
+ */
+export const RawEvidenceUploadAbortRequestSchema = z
+    .object({
+    schema_version: z.literal("ambient-raw-evidence-upload-abort.v1"),
+    generated_at: IsoDateTimeSchema,
+    provenance: CaptureProvenanceSchema,
+    upload_id: NonEmptyStringSchema,
+    object_key: NonEmptyStringSchema,
+    reason: SafeLabelSchema,
+    // How far the object actually got before the collector gave up. The server
+    // already knows the received chunk count; this is what the CLIENT believed,
+    // and a disagreement between the two is itself worth being able to see.
+    uploaded_chunk_count: z.number().int().nonnegative().optional(),
+})
+    .strict();
+export const RawEvidenceUploadAbortResponseSchema = z
+    .object({
+    ok: z.literal(true),
+    // `reason_recorded` is the ordinary answer: the reason landed on the
+    // still-open row, whose staged chunks stay resumable by the next `begin`.
+    // `aborted` means the reason was classified permanent and the row failed
+    // closed. `already_terminal` covers a row the server had already settled —
+    // a drain that ran first, or a duplicate abort after a retry. Reporting
+    // these back distinguishes "we recorded your reason" from "someone beat
+    // you to it", which a bare 200 would hide.
+    status: z.enum(["reason_recorded", "aborted", "already_terminal"]),
+    upload_id: NonEmptyStringSchema,
+    object_key: NonEmptyStringSchema,
+    status_reason: SafeLabelSchema,
+    // Two booleans because the underlying questions are not each other's
+    // negation, and one field would have to lie about half of them.
+    //
+    // `retryable` is `isRetryableUploadFailure`: is repeating this KNOWN to
+    // help? An unclassified reason answers no — refusing to promise something
+    // nobody has reasoned about.
+    //
+    // `will_reopen` is `!isPermanentUploadFailure`: is this row still open (or
+    // re-openable) for the next `begin`? An unclassified reason answers yes —
+    // refusing to abandon an object over a word it cannot read.
+    //
+    // So a composed transport label like `chunk_0_failed_http_500` comes back
+    // `retryable: false, will_reopen: true`, which is the honest pair: we are
+    // not claiming a retry succeeds, and we are not writing the row off.
+    retryable: z.boolean(),
+    will_reopen: z.boolean(),
+})
+    .strict();
 /**
  * Codex session attribution report.
  *

package/dist/secret-guards.js

@@ -225,7 +225,30 @@ export function redactSecretLikeContent(value, options = {}) {
     });
     return { redacted: true, text, metadata };
 }
+/**
+ * Every region the detector considers a secret, redacted — precisely where a
+ * rule can pinpoint the value, coarsely where none can.
+ *
+ * `containsSecretLikeContent` and `SECRET_REDACTION_RULES` are two lists that
+ * have to agree, and nothing used to make them. When the detector matched and
+ * no rule produced a range, `redactSecretLikeContent` reported
+ * `redacted: false`, and the caller dropped the entire session file
+ * (`secret_like_content_guard`). Drift between the lists cost whole sessions:
+ * 78 fleet-wide as of 2026-08-14, 3 of Viet's 17 Claude sessions.
+ *
+ * The two lists can still drift — regexes are like that — but drift now costs
+ * precision instead of evidence. A detector hit with no matching rule redacts
+ * the whole matched span, so `redactSecretLikeContent` always reports the
+ * redaction it performed and the transcript survives with the value removed.
+ */
 function findSecretRedactionMatches(value) {
+    const accepted = acceptNonOverlapping(secretRuleCandidates(value));
+    const uncovered = detectorFallbackCandidates(value).filter((candidate) => !overlapsAny(candidate, accepted));
+    if (uncovered.length === 0)
+        return accepted;
+    return acceptNonOverlapping([...accepted, ...uncovered]);
+}
+function secretRuleCandidates(value) {
     const candidates = [];
     SECRET_REDACTION_RULES.forEach((rule, priority) => {
         const pattern = cloneGlobalPattern(rule.pattern);
@@ -248,7 +271,36 @@ function findSecretRedactionMatches(value) {
             });
         }
     });
-    candidates.sort((a, b) => {
+    return candidates;
+}
+/**
+ * Ranked below every real rule, so a rule that can name the credential always
+ * wins and the coarse span is only used where nothing else reached.
+ */
+function detectorFallbackCandidates(value) {
+    const candidates = [];
+    const basePriority = SECRET_REDACTION_RULES.length;
+    SECRET_LIKE_CONTENT_PATTERNS.forEach((pattern, offset) => {
+        for (const match of value.matchAll(cloneGlobalPattern(pattern))) {
+            const fullMatch = match[0];
+            const matchIndex = match.index;
+            if (!fullMatch || matchIndex === undefined)
+                continue;
+            candidates.push({
+                start: matchIndex,
+                end: matchIndex + fullMatch.length,
+                ruleId: "unnamed_secret_shape",
+                priority: basePriority + offset,
+            });
+        }
+    });
+    return candidates;
+}
+function overlapsAny(candidate, accepted) {
+    return accepted.some((other) => candidate.start < other.end && other.start < candidate.end);
+}
+function acceptNonOverlapping(candidates) {
+    const ordered = [...candidates].sort((a, b) => {
         if (a.start !== b.start)
             return a.start - b.start;
         if (a.priority !== b.priority)
@@ -257,7 +309,7 @@ function findSecretRedactionMatches(value) {
     });
     const accepted = [];
     let lastEnd = -1;
-    for (const candidate of candidates) {
+    for (const candidate of ordered) {
         if (candidate.start < lastEnd)
             continue;
         accepted.push(candidate);

package/dist/upload-failure-class.js

@@ -45,6 +45,12 @@ const UPLOAD_FAILURE_CLASSES = {
     collection_failed: "transient",
     file_read_failed: "transient",
     git_diff_failed: "transient",
+    // `begin` opens a ledger row per object in a loop with no transaction, so a
+    // throw partway through leaves the earlier rows written while the client sees
+    // one 500 for the batch (BLI-2539: 12 such batches in production). Those rows
+    // now name themselves instead of going silent. Transient because the object
+    // was never offered a chance to upload — nothing about it was refused.
+    begin_batch_server_error: "transient",
     // The file itself is the problem, and it will be the same size and the same
     // shape on the next pass. Retrying is a promise nobody can keep.
     file_too_large: "deterministic",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/telemetry-core",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",