@foam-ai/node 0.1.0-alpha.4 → 0.1.0-alpha.6

package/dist/network-capture/http.js

@@ -46,7 +46,7 @@ function observeDirectHeaders(args, headers) {
         append(rawKey, value);
     }
 }
-/** Replaces a method with a wrapped version; returns an undo that restores it unless someone else re-patched it. */
+// pcga11:Replaces a method with a wrapped version; returns an undo that restores it unless someone else re-patched it.
 function swapMethod(target, key, wrap) {
     const original = target[key];
     const wrapped = wrap(original);
@@ -56,7 +56,7 @@ function swapMethod(target, key, wrap) {
             target[key] = original;
     };
 }
-/** Wraps writeHead (when present) to record inline headers; returns an undo. */
+// Wraps writeHead (when present) to record inline headers; returns an undo.
 function swapWriteHead(target, directHeaders, afterWriteHead) {
     const original = target.writeHead;
     if (!original)
@@ -75,7 +75,7 @@ function swapWriteHead(target, directHeaders, afterWriteHead) {
             target.writeHead = original;
     };
 }
-/** Attaches one-shot listeners; returns an undo that removes all of them. */
+// Attaches one-shot listeners; returns an undo that removes all of them.
 function listenOnce(target, listeners) {
     for (const [event, listener] of listeners)
         target.once(event, listener);
@@ -97,11 +97,13 @@ function observeWritableHeaders(message, span, direction, directHeaders) {
     });
     const restoreWriteHead = swapWriteHead(target, directHeaders, applyHeaders);
     let removeListeners = () => { };
-    const cleanup = () => {
+    // Runs inside the customer's EventEmitter emit; a throw here would surface
+    // as an uncaughtException in their app.
+    const cleanup = () => (0, utils_js_1.safely)(() => {
         restoreEnd();
         restoreWriteHead();
         removeListeners();
-    };
+    });
     removeListeners = listenOnce(target, [
         ["finish", cleanup],
         ["close", cleanup],
@@ -121,8 +123,8 @@ function observeReadable(message, collector) {
         });
         return result;
     });
-    const onComplete = () => collector.finalize(true);
-    const onIncomplete = () => collector.finalize(false);
+    const onComplete = () => (0, utils_js_1.safely)(() => collector.finalize(true));
+    const onIncomplete = () => (0, utils_js_1.safely)(() => collector.finalize(false));
     const removeListeners = listenOnce(target, [
         ["end", onComplete],
         ["aborted", onIncomplete],
@@ -156,8 +158,8 @@ function observeWritable(message, collector, directHeaders) {
         }
     });
     const restoreWriteHead = swapWriteHead(target, directHeaders);
-    const onComplete = () => collector.finalize(true);
-    const onIncomplete = () => collector.finalize(false);
+    const onComplete = () => (0, utils_js_1.safely)(() => collector.finalize(true));
+    const onIncomplete = () => (0, utils_js_1.safely)(() => collector.finalize(false));
     const removeListeners = listenOnce(target, [
         ["finish", onComplete],
         ["close", onIncomplete],
@@ -170,19 +172,14 @@ function observeWritable(message, collector, directHeaders) {
         removeListeners();
     });
 }
-/**
- * Instruments one HTTP message (either side, either direction) on a span:
- * records headers as `http.<direction>.header.*` attributes and, when enabled,
- * captures the body via a BodyCollector.
- */
+// pcga11: Instruments one HTTP message on a span:
+// - records headers as `http.<direction>.header.*` attributes
+// - captures the body via a BodyCollector when enabled.
 function hookMessage(span, message, direction, bodyCaptureEnabled) {
-    // Duck-type: only outgoing messages (ClientRequest/ServerResponse) have write/end.
+    // pcga11: Duck-type: only outgoing messages (ClientRequest/ServerResponse) have write/end.
     if ("write" in message && "end" in message) {
-        // A writable request is an outgoing client call; a writable response is served by us.
         const side = direction === "request" ? "client" : "server";
-        // Collects headers passed inline to writeHead(), which don't show up in getHeaders().
         const directHeaders = new Map();
-        // Eagerly record whatever headers exist right now; late-set headers are handled below.
         (0, collector_js_1.setHeaderAttributes)(span, direction, outgoingHeaders(message, directHeaders));
         const collector = bodyCaptureEnabled
             ? // Headers are passed as a lazy callback so late-set headers are seen at finalize time.
@@ -192,32 +189,33 @@ function hookMessage(span, message, direction, bodyCaptureEnabled) {
         if (collector)
             observeWritable(message, collector, directHeaders);
         else if (span.isRecording()) {
-            // No body capture: still patch end/writeHead so late-set headers land on the span.
             observeWritableHeaders(message, span, direction, directHeaders);
         }
     }
     else {
-        // Inverse of the writable case: a request arriving at us means we are the server.
         const side = direction === "request" ? "server" : "client";
-        // Incoming message: headers are fully parsed by Node before the hook runs, so snapshot once.
         const headers = incomingHeaders(message);
         (0, collector_js_1.setHeaderAttributes)(span, direction, headers);
         const collector = bodyCaptureEnabled
             ? collector_js_1.BodyCollector.create(span, side, direction, () => headers)
             : undefined;
-        // Patch the stream's push() to copy body chunks as they arrive from the socket.
         if (collector)
             observeReadable(message, collector);
     }
 }
-/** Builds OTel HTTP request/response hooks that record headers as span attributes and stream bodies as log events. */
+// pcga11: Creates network capture hooks for node:http / node:https. Wraps instance
+// methods: push(), write(), and end() on IncomingMessage / ClientRequest /
+// ServerResponse. This works for all Node versions Foam supports.
 function createNetworkCaptureHooks(bodyCaptureEnabled = true) {
+    // OTel guards hook errors today, but Foam's no-crash guarantee must not
+    // depend on that: any failure here is swallowed and the request proceeds
+    // as if Foam were not installed.
     return {
         requestHook(span, request) {
-            hookMessage(span, request, "request", bodyCaptureEnabled);
+            (0, utils_js_1.safely)(() => hookMessage(span, request, "request", bodyCaptureEnabled));
         },
         responseHook(span, response) {
-            hookMessage(span, response, "response", bodyCaptureEnabled);
+            (0, utils_js_1.safely)(() => hookMessage(span, response, "response", bodyCaptureEnabled));
         },
     };
 }

package/dist/network-capture/index.js

@@ -1,6 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createUndiciNetworkCaptureHooks = exports.createNetworkCaptureHooks = void 0;
+// 
+// Advanced body capture uses three adapters across Foam's Node range:
+// 1. node:http / node:https — instance push(), write(), and end() wrapping
+//    (every supported Node version).
+// 2. Undici legacy — request:create plus instance onBodySent / onData
+//    (bundled fetch on Node 18.19, 20, 22, and 24.0–24.3, whose Undici is
+//    older than 7.11).
+// 3. Undici modern — bodyChunkSent / bodyChunkReceived channels (Undici
+//    7.11+, including Node 24.4+ and a separately installed undici). Future
+//    Node is chosen by capability: modern channels win when they fire.
 var http_js_1 = require("./http.js");
 Object.defineProperty(exports, "createNetworkCaptureHooks", { enumerable: true, get: function () { return http_js_1.createNetworkCaptureHooks; } });
 var undici_js_1 = require("./undici.js");

package/dist/network-capture/redact.d.ts

@@ -0,0 +1,9 @@
+export interface RedactionResult {
+    readonly text: string;
+    readonly changed: boolean;
+}
+export declare function isSensitiveBodyKey(key: string): boolean;
+export declare function isNdjsonMediaType(media: string): boolean;
+export declare function isJsonSequenceMediaType(media: string): boolean;
+export declare function isTextualBodyMediaType(media: string): boolean;
+export declare function redactBodyText(text: string, contentType: unknown): RedactionResult;

package/dist/network-capture/redact.js

@@ -0,0 +1,401 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSensitiveBodyKey = isSensitiveBodyKey;
+exports.isNdjsonMediaType = isNdjsonMediaType;
+exports.isJsonSequenceMediaType = isJsonSequenceMediaType;
+exports.isTextualBodyMediaType = isTextualBodyMediaType;
+exports.redactBodyText = redactBodyText;
+const constants_js_1 = require("../constants.js");
+const redaction_js_1 = require("../redaction.js");
+const NDJSON_MEDIA_TYPES = new Set([
+    "application/json-stream",
+    "application/jsonl",
+    "application/jsonlines",
+    "application/ndjson",
+    "application/stream+json",
+    "application/x-json-stream",
+    "application/x-jsonlines",
+    "application/x-ldjson",
+    "application/x-ndjson",
+]);
+const JSON_SEQUENCE_MEDIA_TYPES = new Set([
+    "application/json-seq",
+    "application/x-json-seq",
+]);
+const XML_MEDIA_TYPES = new Set([
+    "application/xml",
+    "text/html",
+    "text/xml",
+]);
+const YAML_MEDIA_TYPES = new Set([
+    "application/x-yaml",
+    "application/yaml",
+    "text/x-yaml",
+    "text/yaml",
+]);
+function rawHeader(value) {
+    const first = Array.isArray(value) ? value[0] : value;
+    return typeof first === "string" ? first : "";
+}
+function parseContentType(value) {
+    const raw = rawHeader(value);
+    const media = (raw.split(";", 1)[0] ?? "").trim().toLowerCase();
+    const params = new Map();
+    const pattern = /;\s*([^=;\s]+)\s*=\s*(?:"([^"]*)"|([^;]*))/g;
+    let match;
+    while ((match = pattern.exec(raw)) !== null) {
+        params.set(match[1].toLowerCase(), (match[2] ?? match[3] ?? "").trim());
+    }
+    return { media, params };
+}
+function isSensitiveBodyKey(key) {
+    return (0, redaction_js_1.keyMatch)(key) !== undefined;
+}
+function isNdjsonMediaType(media) {
+    return (NDJSON_MEDIA_TYPES.has(media) ||
+        media.endsWith("+ndjson") ||
+        media.endsWith("/ndjson"));
+}
+function isJsonSequenceMediaType(media) {
+    return JSON_SEQUENCE_MEDIA_TYPES.has(media) || media.endsWith("+json-seq");
+}
+function isTextualBodyMediaType(media) {
+    return (media.startsWith("text/") ||
+        media.startsWith("multipart/") ||
+        media.endsWith("/json") ||
+        media.endsWith("+json") ||
+        media.endsWith("/xml") ||
+        media.endsWith("+xml") ||
+        media.endsWith("/yaml") ||
+        media.endsWith("+yaml") ||
+        isNdjsonMediaType(media) ||
+        isJsonSequenceMediaType(media) ||
+        media === "application/x-www-form-urlencoded");
+}
+function redactNode(node, state) {
+    if (typeof node === "string") {
+        const value = (0, redaction_js_1.redactString)(node);
+        if (value !== node)
+            state.changed = true;
+        return value;
+    }
+    if (Array.isArray(node)) {
+        return node.map((item) => redactNode(item, state));
+    }
+    if (node !== null && typeof node === "object") {
+        const result = {};
+        for (const [key, value] of Object.entries(node)) {
+            const match = (0, redaction_js_1.keyMatch)(key);
+            if (match && value !== null && value !== undefined) {
+                result[key] = (0, redaction_js_1.maskForMatch)(match, value);
+                state.changed = true;
+            }
+            else {
+                result[key] = redactNode(value, state);
+            }
+        }
+        return result;
+    }
+    return node;
+}
+const JSON_PAIR_PATTERN = /"((?:[^"\\]|\\.)*)"(\s*:\s*)("(?:[^"\\]|\\.)*"?|-?\d[\d.eE+-]*|true|false|null)/g;
+function fallbackMask(kind) {
+    return kind === "secret" ? constants_js_1.FULL_MASK : constants_js_1.REDACTED_VALUE;
+}
+function redactJsonFallback(text) {
+    let changed = false;
+    const redacted = text.replace(JSON_PAIR_PATTERN, (match, key, separator) => {
+        const kind = (0, redaction_js_1.keyMatch)(key);
+        if (!kind)
+            return match;
+        changed = true;
+        return `"${key}"${separator}"${fallbackMask(kind)}"`;
+    });
+    return changed ? { text: redacted, changed } : { text, changed: false };
+}
+function redactJson(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return redactJsonFallback(text);
+    }
+    const state = { changed: false };
+    const redacted = redactNode(parsed, state);
+    return state.changed
+        ? { text: JSON.stringify(redacted), changed: true }
+        : { text, changed: false };
+}
+function redactByLine(text, redactLine) {
+    let changed = false;
+    const lines = text.split("\n").map((raw) => {
+        const hasCr = raw.endsWith("\r");
+        const line = hasCr ? raw.slice(0, -1) : raw;
+        if (!line)
+            return raw;
+        const result = redactLine(line);
+        if (!result.changed)
+            return raw;
+        changed = true;
+        return hasCr ? `${result.text}\r` : result.text;
+    });
+    return changed
+        ? { text: lines.join("\n"), changed: true }
+        : { text, changed: false };
+}
+function redactNdjson(text) {
+    return redactByLine(text, redactJson);
+}
+function redactJsonSequence(text) {
+    if (!text.includes("\u001e"))
+        return redactJson(text);
+    let changed = false;
+    const segments = text.split("\u001e");
+    const redacted = segments.map((segment, index) => {
+        if (index === 0 || !segment)
+            return segment;
+        const ending = segment.match(/(?:\r\n|\n|\r)$/)?.[0] ?? "";
+        const document = ending ? segment.slice(0, -ending.length) : segment;
+        const result = redactJson(document);
+        if (!result.changed)
+            return segment;
+        changed = true;
+        return `${result.text}${ending}`;
+    });
+    return changed
+        ? { text: redacted.join("\u001e"), changed: true }
+        : { text, changed: false };
+}
+function redactSseBlock(block) {
+    const lineEnding = block.match(/\r\n|\n|\r/)?.[0] ?? "\n";
+    const lines = block.split(/\r\n|\n|\r/);
+    const data = [];
+    lines.forEach((line, index) => {
+        const match = /^(data: ?)(.*)$/.exec(line);
+        if (match) {
+            data.push({ index, prefix: match[1], value: match[2] });
+        }
+    });
+    if (data.length === 0)
+        return { text: block, changed: false };
+    const payload = data.map((entry) => entry.value).join("\n");
+    const json = redactJson(payload);
+    const plain = json.changed ? json : redactPlainText(payload);
+    if (!plain.changed)
+        return { text: block, changed: false };
+    lines[data[0].index] = `${data[0].prefix}${plain.text}`;
+    for (let index = data.length - 1; index >= 1; index -= 1) {
+        lines.splice(data[index].index, 1);
+    }
+    return { text: lines.join(lineEnding), changed: true };
+}
+function redactSse(text) {
+    const separator = /(\r\n\r\n|\n\n|\r\r)/;
+    const parts = text.split(separator);
+    let changed = false;
+    for (let index = 0; index < parts.length; index += 2) {
+        const result = redactSseBlock(parts[index]);
+        if (result.changed) {
+            parts[index] = result.text;
+            changed = true;
+        }
+    }
+    return changed
+        ? { text: parts.join(""), changed: true }
+        : { text, changed: false };
+}
+function redactForm(text) {
+    const params = new URLSearchParams(text);
+    let changed = false;
+    for (const key of new Set(params.keys())) {
+        if (!(0, redaction_js_1.keyMatch)(key) && !(0, redaction_js_1.isSensitiveQueryKey)(key))
+            continue;
+        params.set(key, constants_js_1.REDACTED_VALUE);
+        changed = true;
+    }
+    return changed
+        ? { text: params.toString(), changed: true }
+        : { text, changed: false };
+}
+function localName(name) {
+    const separator = name.lastIndexOf(":");
+    return separator < 0 ? name : name.slice(separator + 1);
+}
+function escapePattern(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function redactXmlElements(text) {
+    let changed = false;
+    let cursor = 0;
+    let output = "";
+    const opening = /<([A-Za-z_][\w:.-]*)(?:\s[^>]*)?>/g;
+    let match;
+    while ((match = opening.exec(text)) !== null) {
+        if (match[0].endsWith("/>"))
+            continue;
+        const kind = (0, redaction_js_1.keyMatch)(localName(match[1]));
+        if (!kind)
+            continue;
+        const closing = new RegExp(`</${escapePattern(match[1])}\\s*>`, "g");
+        closing.lastIndex = opening.lastIndex;
+        const close = closing.exec(text);
+        output += text.slice(cursor, opening.lastIndex);
+        if (!close) {
+            output += fallbackMask(kind);
+            cursor = text.length;
+            changed = true;
+            break;
+        }
+        const value = text.slice(opening.lastIndex, close.index);
+        output += `${value.includes("<") ? fallbackMask(kind) : (0, redaction_js_1.maskForMatch)(kind, value)}${close[0]}`;
+        cursor = closing.lastIndex;
+        opening.lastIndex = cursor;
+        changed = true;
+    }
+    if (!changed)
+        return { text, changed: false };
+    return { text: output + text.slice(cursor), changed: true };
+}
+function redactXml(text) {
+    const elements = redactXmlElements(text);
+    let changed = elements.changed;
+    let output = elements.text;
+    output = output.replace(/(\s)([A-Za-z_:][\w:.-]*)(\s*=\s*)(["'])(.*?)\4/g, (match, spacing, name, separator, quote, value) => {
+        const kind = (0, redaction_js_1.keyMatch)(localName(name));
+        if (!kind)
+            return match;
+        changed = true;
+        return `${spacing}${name}${separator}${quote}${(0, redaction_js_1.maskForMatch)(kind, value)}${quote}`;
+    });
+    output = output.replace(/<input\b[^>]*>/gi, (tag) => {
+        const name = /\bname\s*=\s*(["'])(.*?)\1/i.exec(tag)?.[2];
+        if (!name || (!(0, redaction_js_1.keyMatch)(name) && !(0, redaction_js_1.isSensitiveQueryKey)(name)))
+            return tag;
+        const replaced = tag.replace(/(\bvalue\s*=\s*)(["'])(.*?)\2/i, `$1$2${constants_js_1.REDACTED_VALUE}$2`);
+        if (replaced === tag)
+            return tag;
+        changed = true;
+        return replaced;
+    });
+    return changed ? { text: output, changed: true } : { text, changed: false };
+}
+const YAML_PAIR = /^(\s*(?:-\s*)?)(["']?)([A-Za-z_][\w.-]*)\2(\s*:\s*)(.*)$/;
+function redactYaml(text) {
+    let blockSecret = false;
+    const result = redactByLine(text, (line) => {
+        const match = YAML_PAIR.exec(line);
+        if (!match)
+            return { text: line, changed: false };
+        const kind = (0, redaction_js_1.keyMatch)(match[3]);
+        if (!kind)
+            return { text: line, changed: false };
+        if (/^[>|]/.test(match[5].trim()))
+            blockSecret = true;
+        return {
+            text: `${match[1]}${match[2]}${match[3]}${match[2]}${match[4]}${(0, redaction_js_1.maskForMatch)(kind, match[5].trim().replace(/^(["'])(.*)\1$/, "$2"))}`,
+            changed: true,
+        };
+    });
+    return blockSecret ? { text: constants_js_1.REDACTED_VALUE, changed: true } : result;
+}
+function redactPlainText(text) {
+    const trimmed = text.trimStart();
+    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+        const json = redactJson(text);
+        if (json.changed)
+            return json;
+    }
+    const yaml = redactYaml(text);
+    if (yaml.changed)
+        return yaml;
+    const redacted = (0, redaction_js_1.redactString)(text);
+    return redacted === text
+        ? { text, changed: false }
+        : { text: redacted, changed: true };
+}
+function contentDispositionName(headers) {
+    const line = headers
+        .split(/\r\n|\n|\r/)
+        .find((header) => /^content-disposition\s*:/i.test(header));
+    return line ? /\bname\s*=\s*(?:"([^"]*)"|([^;\s]*))/i.exec(line)?.slice(1).find(Boolean) : undefined;
+}
+function partContentType(headers) {
+    return headers
+        .split(/\r\n|\n|\r/)
+        .find((header) => /^content-type\s*:/i.test(header))
+        ?.replace(/^[^:]+:\s*/, "");
+}
+function redactMultipart(text, boundary) {
+    if (!boundary || boundary.length > 70)
+        return { text, changed: false };
+    const marker = `--${boundary}`;
+    if (!text.includes(marker))
+        return { text, changed: false };
+    let changed = false;
+    const parts = text.split(marker);
+    for (let index = 1; index < parts.length; index += 1) {
+        const part = parts[index];
+        if (part.startsWith("--"))
+            continue;
+        const leading = part.match(/^(?:\r\n|\n|\r)/)?.[0] ?? "";
+        const content = leading ? part.slice(leading.length) : part;
+        const separator = /\r\n\r\n|\n\n|\r\r/.exec(content);
+        if (!separator?.index)
+            continue;
+        const headers = content.slice(0, separator.index);
+        const bodyWithEnding = content.slice(separator.index + separator[0].length);
+        const ending = bodyWithEnding.match(/(?:\r\n|\n|\r)$/)?.[0] ?? "";
+        const body = ending
+            ? bodyWithEnding.slice(0, -ending.length)
+            : bodyWithEnding;
+        const name = contentDispositionName(headers);
+        let result;
+        if (name && ((0, redaction_js_1.keyMatch)(name) || (0, redaction_js_1.isSensitiveQueryKey)(name))) {
+            result = { text: constants_js_1.REDACTED_VALUE, changed: true };
+        }
+        else if (/\bfilename\s*=/i.test(headers)) {
+            result = { text: body, changed: false };
+        }
+        else {
+            result = redactBodyText(body, partContentType(headers) ?? "text/plain");
+        }
+        if (!result.changed)
+            continue;
+        parts[index] = `${leading}${headers}${separator[0]}${result.text}${ending}`;
+        changed = true;
+    }
+    return changed
+        ? { text: parts.join(marker), changed: true }
+        : { text, changed: false };
+}
+function redactBodyText(text, contentType) {
+    const { media, params } = parseContentType(contentType);
+    if (media === "application/x-www-form-urlencoded")
+        return redactForm(text);
+    if (media === "text/event-stream")
+        return redactSse(text);
+    if (isJsonSequenceMediaType(media))
+        return redactJsonSequence(text);
+    if (isNdjsonMediaType(media))
+        return redactNdjson(text);
+    if (media.endsWith("/json") || media.endsWith("+json"))
+        return redactJson(text);
+    if (media.startsWith("multipart/")) {
+        return redactMultipart(text, params.get("boundary") ?? "");
+    }
+    if (XML_MEDIA_TYPES.has(media) ||
+        media.endsWith("/xml") ||
+        media.endsWith("+xml")) {
+        return redactXml(text);
+    }
+    if (YAML_MEDIA_TYPES.has(media) ||
+        media.endsWith("/yaml") ||
+        media.endsWith("+yaml")) {
+        return redactYaml(text);
+    }
+    if (media.startsWith("text/") || params.has("charset")) {
+        return redactPlainText(text);
+    }
+    return { text, changed: false };
+}

package/dist/network-capture/undici.d.ts

@@ -1,8 +1,4 @@
 import type { RequestHookFunction, ResponseHookFunction } from "@opentelemetry/instrumentation-undici";
-/**
- * Builds OTel Undici/fetch hooks. Headers use the same allowlist as Node HTTP.
- * Bodies are copied from diagnostics_channel chunks — never from fetch streams.
- */
 export declare function createUndiciNetworkCaptureHooks(bodyCaptureEnabled?: boolean): {
     requestHook: RequestHookFunction;
     responseHook: ResponseHookFunction;