@glasstrace/sdk 1.3.1 → 1.3.3

package/dist/{chunk-3TU62WD6.js → chunk-YG3X7TUI.js}

@@ -139,4 +139,4 @@ export {
   installConsoleCapture,
   sdkLog
 };
-//# sourceMappingURL=chunk-3TU62WD6.js.map
+//# sourceMappingURL=chunk-YG3X7TUI.js.map

package/dist/chunk-YG3X7TUI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/nudge/error-nudge.ts","../src/console-capture.ts"],"sourcesContent":["import { resolveConfig, isProductionDisabled } from \"../env-detection.js\";\n\n/**\n * Module-level flag ensuring the MCP-connection nudge fires at most once\n * per process.\n */\nlet hasFired = false;\n\n/**\n * Module-level flag ensuring the Server Action nudge fires at most once\n * per process (DISC-1253).\n */\nlet hasFiredServerAction = false;\n\n/**\n * Strips control characters (except space) from a string to prevent\n * terminal escape sequence injection via error summaries written to stderr.\n */\nfunction sanitize(input: string): string {\n  // eslint-disable-next-line no-control-regex\n  return input.replace(/[\\x00-\\x1f\\x7f]/g, \"\");\n}\n\n/**\n * Checks whether the MCP marker file exists using synchronous filesystem\n * APIs. Returns `false` when `node:fs` or `node:path` cannot be resolved\n * (non-Node environments) or on any I/O error.\n */\nfunction markerFileExists(): boolean {\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-require-imports, glasstrace/no-unguarded-node-require -- guarded by the surrounding try/catch in `markerFileExists`; throw returns `false`, the nudge proceeds as if no marker exists (DISC-1555).\n    const fs = require(\"node:fs\") as typeof import(\"node:fs\");\n    // eslint-disable-next-line @typescript-eslint/no-require-imports, glasstrace/no-unguarded-node-require -- guarded by the same try/catch as the preceding `node:fs` require (DISC-1555).\n    const path = require(\"node:path\") as typeof import(\"node:path\");\n    const markerPath = path.join(process.cwd(), \".glasstrace\", \"mcp-connected\");\n    return fs.existsSync(markerPath);\n  } catch {\n    // node:fs/node:path unavailable, permission denied, ENOENT from\n    // cwd(), or other error — treat as not connected\n    return false;\n  }\n}\n\n/**\n * Shows a one-time stderr nudge when the SDK captures its first error\n * and the MCP connection marker file is absent.\n *\n * The nudge is suppressed when:\n * - It has already fired in this process\n * - The `.glasstrace/mcp-connected` marker file exists at the project root\n * - The environment is detected as production (and force-enable is off)\n *\n * Uses `process.stderr.write()` instead of `console.error()` to avoid\n * being captured by OpenTelemetry console instrumentation.\n */\nexport function maybeShowMcpNudge(errorSummary: string): void {\n  if (hasFired) {\n    return;\n  }\n\n  // Production check — suppress silently, but remember the decision\n  // so subsequent calls fast-exit via hasFired without re-running I/O.\n  const config = resolveConfig();\n  if (isProductionDisabled(config)) {\n    hasFired = true;\n    return;\n  }\n\n  // Check for MCP connection marker file.\n  if (markerFileExists()) {\n    hasFired = true;\n    return;\n  }\n\n  // Fire the nudge exactly once\n  hasFired = true;\n\n  const safe = sanitize(errorSummary);\n  process.stderr.write(\n    `[glasstrace] Error captured: ${safe}\\n` +\n      `  Debug with AI: ask your agent \"What's the latest Glasstrace error?\"\\n` +\n      `  Not connected? Run: npx glasstrace mcp add\\n`,\n  );\n}\n\n/**\n * Shows a one-time stderr nudge when the SDK detects a Next.js Server\n * Action trace whose originating request had no Glasstrace browser\n * extension correlation header (`x-gt-cid`) — meaning the extension was\n * not active for that request and the specific Server Action identifier\n * could not be captured (DISC-1253).\n *\n * The nudge is suppressed when:\n * - It has already fired in this process\n * - The environment is detected as production (and force-enable is off)\n * - `GLASSTRACE_SUPPRESS_ACTION_NUDGE=1` is set\n *\n * Routes through `process.stderr.write()` — identical transport to the\n * existing MCP nudge — so it is not captured by OpenTelemetry console\n * instrumentation and plays nicely with existing error-nudge tests.\n */\nexport function maybeShowServerActionNudge(): void {\n  if (hasFiredServerAction) {\n    return;\n  }\n\n  // User opt-out takes precedence over every other check so we never\n  // re-run I/O when silenced.\n  if (process.env.GLASSTRACE_SUPPRESS_ACTION_NUDGE === \"1\") {\n    hasFiredServerAction = true;\n    return;\n  }\n\n  // Production check — suppress silently, but remember the decision so\n  // subsequent calls fast-exit via hasFiredServerAction without re-running\n  // resolveConfig.\n  const config = resolveConfig();\n  if (isProductionDisabled(config)) {\n    hasFiredServerAction = true;\n    return;\n  }\n\n  hasFiredServerAction = true;\n\n  process.stderr.write(\n    `[glasstrace] Detected a Next.js Server Action trace. Install the ` +\n      `Glasstrace browser extension to capture the Server Action identifier ` +\n      `for precise action-level debugging. https://glasstrace.dev/ext\\n`,\n  );\n}\n\n/**\n * Test-only hook: resets both nudge guards so independent tests can\n * reload module state without relying on `vi.resetModules()` side effects.\n * Kept internal — not exported from the SDK barrel.\n */\nexport function __resetNudgeStateForTests(): void {\n  hasFired = false;\n  hasFiredServerAction = false;\n}\n","/**\n * Console error/warn capture module.\n *\n * When enabled, monkey-patches `console.error` and `console.warn` to record\n * their output as OTel span events on the currently active span. SDK-internal\n * log messages (prefixed with \"[glasstrace]\") are never captured.\n */\n\nimport { maybeShowMcpNudge } from \"./nudge/error-nudge.js\";\n\n/**\n * Module-level flag to suppress capture of SDK-internal log messages.\n * Set to `true` before calling `console.warn`/`console.error` from SDK code,\n * then reset to `false` immediately after.\n */\nexport let isGlasstraceLog = false;\n\n/** Saved reference to the original `console.error`. */\nlet originalError: typeof console.error | null = null;\n\n/** Saved reference to the original `console.warn`. */\nlet originalWarn: typeof console.warn | null = null;\n\n/** Whether the console capture is currently installed. */\nlet installed = false;\n\n/** Cached OTel API module reference, resolved at install time. */\nlet otelApi: typeof import(\"@opentelemetry/api\") | null = null;\n\n/**\n * Formats console arguments into a single string for span event attributes.\n * Uses best-effort serialization: strings pass through, Errors preserve their\n * stack trace, and other values are JSON-stringified with a String() fallback.\n */\nfunction formatArgs(args: unknown[]): string {\n  return args\n    .map((arg) => {\n      if (typeof arg === \"string\") return arg;\n      if (arg instanceof Error) return arg.stack ?? arg.message;\n      try {\n        return JSON.stringify(arg);\n      } catch {\n        return String(arg);\n      }\n    })\n    .join(\" \");\n}\n\n/**\n * Returns `true` if the first argument is a string starting with \"[glasstrace]\".\n * Used to skip capture of SDK-internal log messages without requiring every\n * call site to set the `isGlasstraceLog` flag.\n */\nfunction isSdkMessage(args: unknown[]): boolean {\n  return typeof args[0] === \"string\" && args[0].startsWith(\"[glasstrace]\");\n}\n\n/**\n * Installs console capture by replacing `console.error` and `console.warn`\n * with wrappers that record span events on the active OTel span.\n *\n * Must be called after OTel is configured so the API module is available.\n * Safe to call multiple times; subsequent calls are no-ops.\n */\nexport async function installConsoleCapture(): Promise<void> {\n  if (installed) return;\n\n  // Resolve OTel API at install time via dynamic import so that:\n  // 1. tsup inlines @opentelemetry/api into the bundle (it's in noExternal)\n  // 2. vitest's vi.doMock can intercept this import for testing\n  try {\n    otelApi = await import(\"@opentelemetry/api\");\n  } catch {\n    otelApi = null;\n  }\n\n  originalError = console.error;\n  originalWarn = console.warn;\n  installed = true;\n\n  console.error = (...args: unknown[]) => {\n    // Always call the original first to preserve developer experience\n    originalError!.apply(console, args);\n\n    // Skip SDK-internal messages and flagged messages\n    if (isGlasstraceLog || isSdkMessage(args)) return;\n\n    if (otelApi) {\n      const span = otelApi.trace.getSpan(otelApi.context.active());\n      if (span) {\n        const formattedMessage = formatArgs(args);\n        span.addEvent(\"console.error\", {\n          \"console.message\": formattedMessage,\n        });\n        // Show one-time MCP connection nudge on first captured error\n        try {\n          maybeShowMcpNudge(formattedMessage);\n        } catch {\n          // Never allow the monkey-patched console.error wrapper to throw\n        }\n      }\n    }\n  };\n\n  console.warn = (...args: unknown[]) => {\n    originalWarn!.apply(console, args);\n\n    if (isGlasstraceLog || isSdkMessage(args)) return;\n\n    if (otelApi) {\n      const span = otelApi.trace.getSpan(otelApi.context.active());\n      if (span) {\n        span.addEvent(\"console.warn\", {\n          \"console.message\": formatArgs(args),\n        });\n      }\n    }\n  };\n}\n\n/**\n * Restores the original `console.error` and `console.warn` methods.\n * Primarily intended for use in tests.\n */\nexport function uninstallConsoleCapture(): void {\n  if (!installed) return;\n\n  if (originalError) console.error = originalError;\n  if (originalWarn) console.warn = originalWarn;\n\n  originalError = null;\n  originalWarn = null;\n  otelApi = null;\n  installed = false;\n}\n\n/**\n * Logs a message from SDK-internal code without triggering console capture.\n *\n * Use this helper in new SDK code instead of bare `console.warn(...)` calls\n * to prevent SDK log messages from being recorded as user-facing span events.\n *\n * @param level - The console log level to use.\n * @param message - The message to log.\n */\nexport function sdkLog(level: \"warn\" | \"info\" | \"error\", message: string): void {\n  isGlasstraceLog = true;\n  try {\n    console[level](message);\n  } finally {\n    isGlasstraceLog = false;\n  }\n}\n"],"mappings":";;;;;;;;;AAMA,IAAI,WAAW;AAMf,IAAI,uBAAuB;AAM3B,SAAS,SAAS,OAAuB;AAEvC,SAAO,MAAM,QAAQ,oBAAoB,EAAE;AAC7C;AAOA,SAAS,mBAA4B;AACnC,MAAI;AAEF,UAAM,KAAK,UAAQ,SAAS;AAE5B,UAAM,OAAO,UAAQ,WAAW;AAChC,UAAM,aAAa,KAAK,KAAK,QAAQ,IAAI,GAAG,eAAe,eAAe;AAC1E,WAAO,GAAG,WAAW,UAAU;AAAA,EACjC,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAcO,SAAS,kBAAkB,cAA4B;AAC5D,MAAI,UAAU;AACZ;AAAA,EACF;AAIA,QAAM,SAAS,cAAc;AAC7B,MAAI,qBAAqB,MAAM,GAAG;AAChC,eAAW;AACX;AAAA,EACF;AAGA,MAAI,iBAAiB,GAAG;AACtB,eAAW;AACX;AAAA,EACF;AAGA,aAAW;AAEX,QAAM,OAAO,SAAS,YAAY;AAClC,UAAQ,OAAO;AAAA,IACb,gCAAgC,IAAI;AAAA;AAAA;AAAA;AAAA,EAGtC;AACF;AAkBO,SAAS,6BAAmC;AACjD,MAAI,sBAAsB;AACxB;AAAA,EACF;AAIA,MAAI,QAAQ,IAAI,qCAAqC,KAAK;AACxD,2BAAuB;AACvB;AAAA,EACF;AAKA,QAAM,SAAS,cAAc;AAC7B,MAAI,qBAAqB,MAAM,GAAG;AAChC,2BAAuB;AACvB;AAAA,EACF;AAEA,yBAAuB;AAEvB,UAAQ,OAAO;AAAA,IACb;AAAA;AAAA,EAGF;AACF;;;AClHO,IAAI,kBAAkB;AAG7B,IAAI,gBAA6C;AAGjD,IAAI,eAA2C;AAG/C,IAAI,YAAY;AAGhB,IAAI,UAAsD;AAO1D,SAAS,WAAW,MAAyB;AAC3C,SAAO,KACJ,IAAI,CAAC,QAAQ;AACZ,QAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAI,eAAe,MAAO,QAAO,IAAI,SAAS,IAAI;AAClD,QAAI;AACF,aAAO,KAAK,UAAU,GAAG;AAAA,IAC3B,QAAQ;AACN,aAAO,OAAO,GAAG;AAAA,IACnB;AAAA,EACF,CAAC,EACA,KAAK,GAAG;AACb;AAOA,SAAS,aAAa,MAA0B;AAC9C,SAAO,OAAO,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,EAAE,WAAW,cAAc;AACzE;AASA,eAAsB,wBAAuC;AAC3D,MAAI,UAAW;AAKf,MAAI;AACF,cAAU,MAAM,OAAO,mBAAoB;AAAA,EAC7C,QAAQ;AACN,cAAU;AAAA,EACZ;AAEA,kBAAgB,QAAQ;AACxB,iBAAe,QAAQ;AACvB,cAAY;AAEZ,UAAQ,QAAQ,IAAI,SAAoB;AAEtC,kBAAe,MAAM,SAAS,IAAI;AAGlC,QAAI,mBAAmB,aAAa,IAAI,EAAG;AAE3C,QAAI,SAAS;AACX,YAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,QAAQ,OAAO,CAAC;AAC3D,UAAI,MAAM;AACR,cAAM,mBAAmB,WAAW,IAAI;AACxC,aAAK,SAAS,iBAAiB;AAAA,UAC7B,mBAAmB;AAAA,QACrB,CAAC;AAED,YAAI;AACF,4BAAkB,gBAAgB;AAAA,QACpC,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,OAAO,IAAI,SAAoB;AACrC,iBAAc,MAAM,SAAS,IAAI;AAEjC,QAAI,mBAAmB,aAAa,IAAI,EAAG;AAE3C,QAAI,SAAS;AACX,YAAM,OAAO,QAAQ,MAAM,QAAQ,QAAQ,QAAQ,OAAO,CAAC;AAC3D,UAAI,MAAM;AACR,aAAK,SAAS,gBAAgB;AAAA,UAC5B,mBAAmB,WAAW,IAAI;AAAA,QACpC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AA2BO,SAAS,OAAO,OAAkC,SAAuB;AAC9E,oBAAkB;AAClB,MAAI;AACF,YAAQ,KAAK,EAAE,OAAO;AAAA,EACxB,UAAE;AACA,sBAAkB;AAAA,EACpB;AACF;","names":[]}

package/dist/cli/init.cjs

@@ -14454,7 +14454,7 @@ function createAnonApiKey() {
 function createBuildHash(hash2) {
   return BuildHashSchema.parse(hash2);
 }
-var DevApiKeySchema, AnonApiKeySchema, SessionIdSchema, BuildHashSchema, SdkDiagnosticCodeSchema, CaptureConfigSchema, SdkCachedConfigSchema, GlasstraceOptionsSchema, GlasstraceEnvVarsSchema, ImportGraphPayloadSchema, SdkHealthReportSchema, TierLimitsSchema, SdkInitResponseSchema, DiscoveryResponseSchema, SourceMapUploadResponseSchema, PresignedUploadRequestSchema, PresignedUploadResponseSchema, SourceMapManifestRequestSchema, SourceMapManifestResponseSchema, K;
+var DevApiKeySchema, AnonApiKeySchema, SessionIdSchema, BuildHashSchema, SdkDiagnosticCodeSchema, CaptureConfigSchema, SdkCachedConfigSchema, GlasstraceOptionsSchema, GlasstraceEnvVarsSchema, MAX_SOURCE_MAP_FILE_PATH_LENGTH, MAX_SOURCE_MAP_FILE_SIZE, MAX_SOURCE_MAP_FILE_COUNT, MAX_PRESIGNED_CLIENT_TOKEN_LENGTH, MAX_PRESIGNED_PATHNAME_LENGTH, ImportGraphPayloadSchema, SdkHealthReportSchema, TierLimitsSchema, SdkInitResponseSchema, DiscoveryResponseSchema, SourceMapUploadResponseSchema, PresignedUploadRequestSchema, PresignedUploadResponseSchema, SourceMapManifestRequestSchema, SourceMapManifestResponseSchema, K;
 var init_dist = __esm({
   "../protocol/dist/index.js"() {
     "use strict";
@@ -14505,6 +14505,11 @@ var init_dist = __esm({
       NODE_ENV: external_exports.string().optional(),
       VERCEL_ENV: external_exports.string().optional()
     });
+    MAX_SOURCE_MAP_FILE_PATH_LENGTH = 512;
+    MAX_SOURCE_MAP_FILE_SIZE = 50 * 1024 * 1024;
+    MAX_SOURCE_MAP_FILE_COUNT = 100;
+    MAX_PRESIGNED_CLIENT_TOKEN_LENGTH = 2048;
+    MAX_PRESIGNED_PATHNAME_LENGTH = 1024;
     ImportGraphPayloadSchema = external_exports.object({
       buildHash: BuildHashSchema,
       graph: external_exports.record(external_exports.string(), external_exports.array(external_exports.string()))
@@ -14551,35 +14556,68 @@ var init_dist = __esm({
       buildHash: BuildHashSchema,
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          sizeBytes: external_exports.number().int().positive()
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          sizeBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `sizeBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          )
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     PresignedUploadResponseSchema = external_exports.object({
       uploadId: external_exports.string().uuid(),
       expiresAt: external_exports.number().int().nonnegative(),
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          clientToken: external_exports.string().min(1),
-          pathname: external_exports.string().min(1),
-          maxBytes: external_exports.number().int().positive(),
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          clientToken: external_exports.string().min(1).max(
+            MAX_PRESIGNED_CLIENT_TOKEN_LENGTH,
+            `clientToken length exceeds maximum of ${MAX_PRESIGNED_CLIENT_TOKEN_LENGTH} characters`
+          ),
+          pathname: external_exports.string().min(1).max(
+            MAX_PRESIGNED_PATHNAME_LENGTH,
+            `pathname length exceeds maximum of ${MAX_PRESIGNED_PATHNAME_LENGTH} characters`
+          ),
+          maxBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `maxBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          ),
           /** Vercel Blob access mode — explicit in the contract per DISC-756. */
           access: external_exports.enum(["public"])
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     SourceMapManifestRequestSchema = external_exports.object({
       uploadId: external_exports.string().uuid(),
       buildHash: BuildHashSchema,
       files: external_exports.array(
         external_exports.object({
-          filePath: external_exports.string().min(1),
-          sizeBytes: external_exports.number().int().positive(),
+          filePath: external_exports.string().min(1).max(
+            MAX_SOURCE_MAP_FILE_PATH_LENGTH,
+            `filePath length exceeds maximum of ${MAX_SOURCE_MAP_FILE_PATH_LENGTH} characters`
+          ),
+          sizeBytes: external_exports.number().int().positive().max(
+            MAX_SOURCE_MAP_FILE_SIZE,
+            `sizeBytes exceeds maximum of ${MAX_SOURCE_MAP_FILE_SIZE} bytes (${MAX_SOURCE_MAP_FILE_SIZE / (1024 * 1024)} MiB)`
+          ),
           blobUrl: external_exports.string().url()
         })
-      ).min(1).max(100)
+      ).min(1).max(
+        MAX_SOURCE_MAP_FILE_COUNT,
+        `files array exceeds maximum of ${MAX_SOURCE_MAP_FILE_COUNT} entries`
+      )
     });
     SourceMapManifestResponseSchema = external_exports.object({
       success: external_exports.literal(true),
@@ -18828,7 +18866,7 @@ async function verifyAnonKeyRegistration(projectRoot) {
   }
   const baseConfig = resolveConfig({ apiKey: devKey });
   const config2 = { ...baseConfig, apiKey: devKey };
-  const sdkVersion = true ? "1.3.1" : "0.0.0-dev";
+  const sdkVersion = true ? "1.3.3" : "0.0.0-dev";
   const result = await verifyInitReachable(config2, anonKey, sdkVersion);
   if (result.ok) {
     return { outcome: "verified" };