@bli-cockpit/telemetry-core 0.1.19 → 0.1.22

package/dist/evidence-upload.js

@@ -19,11 +19,22 @@ export const RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES = RAW_EVIDENCE_UPLOAD_MAX_C
 // by Vercel's ~4.5MB request-body limit (see header comment). 192 chunks
 // * 3 MiB gives a 576 MiB protocol ceiling above the current file cap.
 export const RAW_EVIDENCE_UPLOAD_MAX_CHUNK_COUNT = 192;
-// Final-object cap. The commit route still assembles and redaction-scans text
-// in memory, so keep this below V8's string ceiling with practical headroom for
-// buffers and redaction copies. 256 MiB covers the largest observed fleet
-// session (118 MiB) with >2x headroom. Raising it requires a streaming commit.
-export const RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES = 256 * 1024 * 1024;
+// Final-object cap. The server's Supabase project-level (global) storage
+// limit was raised from 50 MiB to 512 MiB on 2026-07-04 (BLI-2528; see
+// docs/runbooks/cockpit-stuck-evidence-uploads.md) after that ceiling silently
+// rejected every larger raw-evidence object for 57 days, so this constant must
+// track the server's real ceiling rather than trail it. It cannot simply BE
+// 512 MiB, though: the commit route (apps/dashboard .../evidence/upload/commit)
+// still assembles the object into one Buffer and calls
+// `assembled.toString("utf8")` for the secret-content scan, and 512 MiB
+// (536,870,912 bytes) is 24 bytes PAST V8's `MAX_STRING_LENGTH`
+// (536,870,888 on Node 22 / this repo's pinned runtime) — a file at the literal
+// 512 MiB ceiling would crash the commit route with a RangeError instead of
+// committing, the same silent-loss failure mode BLI-2528 was about. 500 MiB
+// keeps ~12.6 MiB of real headroom under that hard ceiling for the
+// Buffer.concat + string-conversion overhead, while still fitting the chunk
+// protocol's 576 MiB ceiling (192 chunks * 3 MiB).
+export const RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES = 500 * 1024 * 1024;
 export const RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN = 25;
 export const CODEX_SESSION_REPORT_MAX_SESSIONS = 200;
 const SafeLabelSchema = z

package/dist/secret-guards.js

@@ -48,6 +48,41 @@ const SECRET_NAME_PATTERN_SOURCE = [
     "client[_-]?secret",
     "secret[_-]?access[_-]?key",
 ].join("|");
+/**
+ * Credential names live INSIDE longer identifiers, so `\b` is the wrong fence
+ * (BLI-3116).
+ *
+ * Every name fragment above used to be wrapped in `\b(?:…)\b`. Underscore is a
+ * word character, so there is no word boundary between `AWS_` and `SECRET`:
+ * `AWS_SECRET_ACCESS_KEY=AKIA…` — the most common real spelling of the most
+ * common real leak — never matched and uploaded unmasked from every fleet
+ * machine, while the bare `SECRET_ACCESS_KEY=…` matched fine. The same hole hid
+ * `AZURE_OPENAI_API_KEY`, `VITE_SUPABASE_ANON_KEY`, `GITHUB_ACCESS_TOKEN`,
+ * `MY_APP_CLIENT_SECRET` and every other prefixed spelling: the bug was the
+ * fence, not the vocabulary, so the whole list is fenced differently now.
+ *
+ * `_`, `-` and `.` are identifier JOINERS here, not boundaries:
+ *
+ * - leading `(?<![A-Za-z0-9])` — the fragment may begin right after a joiner or
+ *   at a real boundary, but a letter or digit immediately before it still
+ *   blocks the match (`notapikey=…` stays out, as before).
+ * - trailing `[A-Za-z0-9_-]{0,40}` — a bounded identifier tail, so
+ *   `OPENAI_API_KEY_2=…` and `AWS_SECRET_ACCESS_KEY_ID=…` are seen too.
+ *
+ * Prose is unaffected because the assignment requirement below is unchanged:
+ * "rotate your secret access key" has no `=`/`:` + opaque value and is not a
+ * leak. The guard's job is assignments, not vocabulary.
+ */
+const SECRET_NAME_MATCH_SOURCE = `(?<![A-Za-z0-9])(?:${SECRET_NAME_PATTERN_SOURCE})[A-Za-z0-9_-]{0,40}`;
+/**
+ * The assignment operator, with the closing quote of a JSON/YAML key allowed
+ * before it. Found while auditing the fence above: `{"aws_secret_access_key":
+ * "…"}` never matched either, because the name was followed by `"` and the
+ * pattern demanded `[:=]` immediately. Transcripts are JSONL, so this is the
+ * shape a leaked credential most often has on the way in. The sibling redactor
+ * in harvest-analysis (`study/prepare.ts`) already allowed it; this one did not.
+ */
+const SECRET_ASSIGNMENT_SOURCE = `["']?\\s*[:=]\\s*["']?`;
 /**
  * Credential names that are only a leak when assigned a value (D13). The value
  * shape mirrors the long-standing generic pattern: an assignment operator
@@ -55,10 +90,18 @@ const SECRET_NAME_PATTERN_SOURCE = [
  * `GRANT ... TO service_role` (no assignment) do not match; the same name with
  * an assigned value does.
  */
-const SECRET_NAME_WITH_VALUE_PATTERN = new RegExp(`\\b(?:${SECRET_NAME_PATTERN_SOURCE})\\b\\s*[:=]\\s*["']?[A-Za-z0-9_./+=-]{12,}`, "i");
+const SECRET_NAME_WITH_VALUE_PATTERN = new RegExp(`${SECRET_NAME_MATCH_SOURCE}${SECRET_ASSIGNMENT_SOURCE}[A-Za-z0-9_./+=-]{12,}`, "i");
 /**
  * Self-identifying secret values — blocked regardless of context because the
  * token shape itself is the credential, with no benign reading.
+ *
+ * `\b` is deliberately KEPT here, unlike the name fragments above (BLI-3116).
+ * These patterns are whole tokens, not fragments of a longer identifier: a
+ * `ghp_`/`sk-`/`AKIA…` run that continues into surrounding alphanumerics is not
+ * that provider's token, and unanchoring them would mask ordinary identifiers
+ * (`chart_m0_2024_revenue…`) for no safety gain. A real leak of any of these
+ * shapes is preceded by a quote, whitespace, `=`, `:` or `/` — all of which
+ * `\b` already admits.
  */
 const SECRET_VALUE_PATTERNS = [
     /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
@@ -126,7 +169,10 @@ export const RawEvidenceRedactionMetadataSchema = z
     sanitized_byte_size: z.number().int().nonnegative().optional(),
 })
     .strict();
-const SECRET_ASSIGNMENT_REDACTION_PATTERN = new RegExp(`(\\b(?:${SECRET_NAME_PATTERN_SOURCE})\\b\\s*[:=]\\s*["']?)([A-Za-z0-9_./+=-]{12,})`, "gi");
+// Same fence as the detector (BLI-3116) — the two must agree or a prefixed
+// name would be detected and then left unredacted, which costs whole sessions
+// (see findSecretRedactionMatches).
+const SECRET_ASSIGNMENT_REDACTION_PATTERN = new RegExp(`(${SECRET_NAME_MATCH_SOURCE}${SECRET_ASSIGNMENT_SOURCE})([A-Za-z0-9_./+=-]{12,})`, "gi");
 const SECRET_REDACTION_RULES = [
     {
         ruleId: "credential_assignment",

package/dist/upload-failure-class.d.ts

@@ -34,6 +34,49 @@ export declare const NO_UPLOAD_ATTEMPT_RECORDED = "no_upload_attempt_recorded";
 export declare const STORAGE_REJECTED_OBJECT_TOO_LARGE = "storage_rejected_object_too_large";
 /** Storage refused the finished object because of its declared media type. */
 export declare const STORAGE_REJECTED_MEDIA_TYPE = "storage_rejected_media_type";
+/**
+ * The commit route never survived the object (BLI-3067).
+ *
+ * Fires when the commit call answers `>= 500` with a body that is not the
+ * route's JSON envelope — an HTML error page from the platform. The handler
+ * always answers `{ code, message, … }`, so a non-JSON 5xx means the serverless
+ * process was killed mid-assembly (out of memory, or a hard wall-clock timeout)
+ * and no catch ran, no ledger reason was written and no server log line exists.
+ *
+ * It is a distinct label because the operator-visible difference is total: a
+ * refusal means the server looked at these bytes and said no, this means the
+ * server died holding them. The collector composes the observed status onto the
+ * end (`commit_crashed_platform_http_502`) so a gateway timeout can still be
+ * told from an out-of-memory; `classifyUploadFailure` strips that suffix.
+ */
+export declare const COMMIT_CRASHED_PLATFORM = "commit_crashed_platform";
+/**
+ * The collector deliberately did not offer this object on this sync.
+ *
+ * Fires in the delivery-backoff partition: an object whose delivery keeps
+ * failing is retried on a 15-minute-to-6-hour schedule (~4 attempts a day)
+ * instead of on every sync, after one object failed 1,030 times in nine days
+ * (BLI-3066). The held object is reported as a failed outcome carrying this
+ * label rather than quietly omitted — a hold that read as success is exactly
+ * the green-status-hiding-missing-collection failure the fleet contract
+ * forbids.
+ *
+ * Not `withheld_by_policy`: nothing was refused and nothing needs a human. The
+ * hold expires on a clock, so it is transient in the strict sense — the next
+ * eligible sync offers the same bytes again.
+ */
+export declare const DELIVERY_BACKOFF_HOLDING = "delivery_backoff_holding";
+/**
+ * The listed reason a composed label is a variant of, or the label unchanged.
+ *
+ * The collector appends the observed status to some labels so an operator can
+ * tell a 502 from a 500 (`commit_crashed_platform_http_502`). Stripping it is
+ * deliberately NOT pattern matching on the label's words: the suffix is only
+ * removed when what remains is a reason somebody has already classified by
+ * hand, so `commit_failed_http_503` — whose stem nobody has reasoned about —
+ * still classifies as `unknown`, exactly as before.
+ */
+export declare function baseUploadFailureReason(reason: string): string;
 /** Classify a persisted upload reason. Unlisted reasons stay `unknown`. */
 export declare function classifyUploadFailure(reason: string | null | undefined): UploadFailureClass;
 /**

package/dist/upload-failure-class.js

@@ -13,6 +13,12 @@
 // future reason somebody adds, which is the same class of guessing the person
 // resolver refuses to do. An unlisted reason is `unknown` and stays visible
 // until a human decides which bucket it belongs in.
+//
+// The one concession is a trailing `_http_<status>`, which the collector
+// appends to some labels so an operator can tell a 502 from a 500. It is
+// stripped only when the remaining stem is itself a listed reason — see
+// `baseUploadFailureReason` — so the table still decides everything and an
+// unreasoned-about stem stays `unknown`.
 /**
  * The reason written when nothing in the pipeline explained itself.
  *
@@ -34,6 +40,38 @@ export const NO_UPLOAD_ATTEMPT_RECORDED = "no_upload_attempt_recorded";
 export const STORAGE_REJECTED_OBJECT_TOO_LARGE = "storage_rejected_object_too_large";
 /** Storage refused the finished object because of its declared media type. */
 export const STORAGE_REJECTED_MEDIA_TYPE = "storage_rejected_media_type";
+/**
+ * The commit route never survived the object (BLI-3067).
+ *
+ * Fires when the commit call answers `>= 500` with a body that is not the
+ * route's JSON envelope — an HTML error page from the platform. The handler
+ * always answers `{ code, message, … }`, so a non-JSON 5xx means the serverless
+ * process was killed mid-assembly (out of memory, or a hard wall-clock timeout)
+ * and no catch ran, no ledger reason was written and no server log line exists.
+ *
+ * It is a distinct label because the operator-visible difference is total: a
+ * refusal means the server looked at these bytes and said no, this means the
+ * server died holding them. The collector composes the observed status onto the
+ * end (`commit_crashed_platform_http_502`) so a gateway timeout can still be
+ * told from an out-of-memory; `classifyUploadFailure` strips that suffix.
+ */
+export const COMMIT_CRASHED_PLATFORM = "commit_crashed_platform";
+/**
+ * The collector deliberately did not offer this object on this sync.
+ *
+ * Fires in the delivery-backoff partition: an object whose delivery keeps
+ * failing is retried on a 15-minute-to-6-hour schedule (~4 attempts a day)
+ * instead of on every sync, after one object failed 1,030 times in nine days
+ * (BLI-3066). The held object is reported as a failed outcome carrying this
+ * label rather than quietly omitted — a hold that read as success is exactly
+ * the green-status-hiding-missing-collection failure the fleet contract
+ * forbids.
+ *
+ * Not `withheld_by_policy`: nothing was refused and nothing needs a human. The
+ * hold expires on a clock, so it is transient in the strict sense — the next
+ * eligible sync offers the same bytes again.
+ */
+export const DELIVERY_BACKOFF_HOLDING = "delivery_backoff_holding";
 const UPLOAD_FAILURE_CLASSES = {
     // Budgets and locks: the file was fine and the run simply ran out of room or
     // was beaten to it. The next pass has room.
@@ -51,6 +89,16 @@ const UPLOAD_FAILURE_CLASSES = {
     // now name themselves instead of going silent. Transient because the object
     // was never offered a chance to upload — nothing about it was refused.
     begin_batch_server_error: "transient",
+    // The platform killed the commit process before the route could answer
+    // (BLI-3067). Transient for the same reason as the batch error above: nothing
+    // decided anything about these bytes, so the next attempt is not a repeat of
+    // a refusal. It is bounded rather than infinite because a repeatedly failing
+    // object falls into delivery backoff after the first failure, so a genuinely
+    // un-committable object costs ~4 attempts a day instead of 96.
+    [COMMIT_CRASHED_PLATFORM]: "transient",
+    // Held on purpose by that same backoff. The bytes are staged and eligible;
+    // the clock has not come round yet.
+    [DELIVERY_BACKOFF_HOLDING]: "transient",
     // The file itself is the problem, and it will be the same size and the same
     // shape on the next pass. Retrying is a promise nobody can keep.
     file_too_large: "deterministic",
@@ -77,11 +125,34 @@ const UPLOAD_FAILURE_CLASSES = {
     // The server-side name for the same guard, returned by the commit route.
     secret_guard_rejected: "withheld_by_policy",
 };
+const HTTP_STATUS_SUFFIX = /_http_\d{3}$/u;
+/**
+ * The listed reason a composed label is a variant of, or the label unchanged.
+ *
+ * The collector appends the observed status to some labels so an operator can
+ * tell a 502 from a 500 (`commit_crashed_platform_http_502`). Stripping it is
+ * deliberately NOT pattern matching on the label's words: the suffix is only
+ * removed when what remains is a reason somebody has already classified by
+ * hand, so `commit_failed_http_503` — whose stem nobody has reasoned about —
+ * still classifies as `unknown`, exactly as before.
+ */
+export function baseUploadFailureReason(reason) {
+    const stem = reason.replace(HTTP_STATUS_SUFFIX, "");
+    if (stem === reason)
+        return reason;
+    return Object.hasOwn(UPLOAD_FAILURE_CLASSES, stem) ? stem : reason;
+}
 /** Classify a persisted upload reason. Unlisted reasons stay `unknown`. */
 export function classifyUploadFailure(reason) {
     if (!reason)
         return "unknown";
-    return UPLOAD_FAILURE_CLASSES[reason] ?? "unknown";
+    const label = baseUploadFailureReason(reason);
+    // `hasOwn` rather than a bare index: a reason called `constructor` or
+    // `toString` would otherwise resolve to an inherited property and answer
+    // something that is not an UploadFailureClass at all.
+    if (!Object.hasOwn(UPLOAD_FAILURE_CLASSES, label))
+        return "unknown";
+    return UPLOAD_FAILURE_CLASSES[label] ?? "unknown";
 }
 /**
  * Whether repeating the identical attempt could plausibly succeed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/telemetry-core",
-  "version": "0.1.19",
+  "version": "0.1.22",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",