@ironbee-ai/cli 0.13.0 → 0.14.0

package/dist/otel/daemon/process.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * IronBee — read a raw `*.request.json` body file and build its
+ * `session_context` event. Handles the security gate (path must be inside
+ * `.ironbee/otel`), the partial-write guard (size vs `body_length`), and
+ * identity resolution (session_id / project_name / model / base fields). Returns
+ * the built event + the owning project dir, or `null` to skip.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.processBodyFile = processBodyFile;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const logger_1 = require("../../lib/logger");
+const util_1 = require("../context/util");
+const classify_1 = require("../context/classify");
+const build_1 = require("../context/build");
+const paths_1 = require("./paths");
+const PARTIAL_WRITE_RETRIES = 3;
+const PARTIAL_WRITE_DELAY_MS = 50;
+function delay(ms) {
+    return new Promise((resolve) => { setTimeout(resolve, ms); });
+}
+function isObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function readJsonObject(path) {
+    try {
+        const parsed = JSON.parse((0, fs_1.readFileSync)(path, "utf8"));
+        return isObject(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The model the request was actually sent with — `body.model` is the ground
+ * truth and is always present on a real Messages request. Preferred over the
+ * OTLP event's `model` attribute, which is empty on the catch-up path
+ * (`orphanMeta`) and which the collector rejects (empty `model` → HTTP 400).
+ */
+function modelFromBody(body) {
+    if (isObject(body) && typeof body.model === "string" && body.model.length > 0) {
+        return body.model;
+    }
+    return null;
+}
+/** Recover `session_id` from the body's double-encoded `metadata.user_id` (catch-up fallback). */
+function sessionIdFromBody(body) {
+    if (!isObject(body) || !isObject(body.metadata)) {
+        return null;
+    }
+    const userId = body.metadata.user_id;
+    if (typeof userId !== "string") {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(userId);
+        if (isObject(parsed) && typeof parsed.session_id === "string") {
+            return parsed.session_id;
+        }
+    }
+    catch {
+        // malformed → no fallback
+    }
+    return null;
+}
+/** Best-effort read of base fields from the session's state.json (may be absent). */
+function readSessionState(projectDir, sessionId) {
+    const j = readJsonObject((0, path_1.join)(projectDir, ".ironbee", "sessions", sessionId, "state.json"));
+    if (!j) {
+        return {};
+    }
+    const out = {};
+    if (typeof j.userEmail === "string") {
+        out.user_email = j.userEmail;
+    }
+    if (j.usageType === "api" || j.usageType === "subscription") {
+        out.usage_type = j.usageType;
+    }
+    if (typeof j.usagePlan === "string") {
+        out.usage_plan = j.usagePlan;
+    }
+    if (typeof j.projectName === "string") {
+        out.projectName = j.projectName;
+    }
+    return out;
+}
+/**
+ * Read + build. Returns `null` (skip) on: a path outside `.ironbee/otel`
+ * (security gate), a missing / unreadable file, unparseable JSON, or no
+ * resolvable session_id.
+ */
+async function processBodyFile(meta) {
+    const projectDir = (0, paths_1.projectDirFromBodyRef)(meta.body_ref);
+    if (projectDir === null) {
+        logger_1.logger.warn(`otel: refusing body_ref outside a .ironbee/otel dir: ${meta.body_ref}`);
+        return null;
+    }
+    // Read with a partial-write guard: a size mismatch vs body_length means the
+    // write was still in flight when the event fired → brief retry.
+    let content = null;
+    for (let attempt = 0; attempt < PARTIAL_WRITE_RETRIES; attempt++) {
+        try {
+            content = (0, fs_1.readFileSync)(meta.body_ref, "utf8");
+        }
+        catch {
+            return null; // gone / unreadable
+        }
+        if (meta.body_length === null || (0, util_1.byteLen)(content) === meta.body_length || attempt === PARTIAL_WRITE_RETRIES - 1) {
+            break;
+        }
+        await delay(PARTIAL_WRITE_DELAY_MS);
+    }
+    if (content === null) {
+        return null;
+    }
+    let body;
+    try {
+        body = JSON.parse(content);
+    }
+    catch {
+        logger_1.logger.debug(`otel: unparseable body file ${meta.body_ref}`);
+        return null;
+    }
+    const sessionId = meta.session_id ?? sessionIdFromBody(body);
+    if (!sessionId) {
+        logger_1.logger.debug(`otel: no session_id for ${meta.body_ref}; skipping`);
+        return null;
+    }
+    const state = readSessionState(projectDir, sessionId);
+    const projectName = meta.project_name ?? state.projectName ?? (0, path_1.basename)(projectDir);
+    const classification = (0, classify_1.classifyRequestBody)(body);
+    const scMeta = {
+        session_id: sessionId,
+        project_name: projectName,
+        // Prefer the body's authoritative model; the event attr is "" on catch-up.
+        model: modelFromBody(body) ?? meta.model,
+        query_source: meta.query_source,
+        sequence_number: meta.sequence_number,
+        timestamp: meta.timestamp,
+        request_uuid: (0, paths_1.requestUuidFromBodyRef)(meta.body_ref),
+        user_email: state.user_email,
+        usage_type: state.usage_type,
+        usage_plan: state.usage_plan,
+    };
+    const event = (0, build_1.buildSessionContextEvent)(scMeta, classification);
+    return { event, projectDir, bodyRef: meta.body_ref };
+}
+//# sourceMappingURL=process.js.map

package/dist/otel/daemon/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../../src/otel/daemon/process.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA2GH,0CA0DC;AAnKD,2BAAkC;AAClC,+BAAsC;AACtC,6CAA0C;AAC1C,0CAA0C;AAC1C,kDAAiF;AACjF,4CAAgF;AAGhF,mCAAwE;AAExE,MAAM,qBAAqB,GAAW,CAAC,CAAC;AACxC,MAAM,sBAAsB,GAAW,EAAE,CAAC;AAe1C,SAAS,KAAK,CAAC,EAAU;IACrB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAmB,EAAQ,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IACxB,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAChC,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAa;IAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,SAAS,iBAAiB,CAAC,IAAa;IACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,UAAU,CAAC;QAC7B,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,0BAA0B;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,UAAkB,EAAE,SAAiB;IAC3D,MAAM,CAAC,GAAmC,cAAc,CACpD,IAAA,WAAI,EAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CACpE,CAAC;IACF,IAAI,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QAC1D,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,IAAwB;IAC1D,MAAM,UAAU,GAAkB,IAAA,6BAAqB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACtB,eAAM,CAAC,IAAI,CAAC,wDAAwD,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,IAAI,OAAO,GAAW,CAAC,EAAE,OAAO,GAAG,qBAAqB,EAAE,OAAO,EAAE,EAAE,CAAC;QACvE,IAAI,CAAC;YACD,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC,CAAC,oBAAoB;QACrC,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAA,cAAO,EAAC,OAAO,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,OAAO,KAAK,qBAAqB,GAAG,CAAC,EAAE,CAAC;YAC9G,MAAM;QACV,CAAC;QACD,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,eAAM,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAkB,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,eAAM,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,QAAQ,YAAY,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAsB,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACzE,MAAM,WAAW,GAAW,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,IAAI,IAAA,eAAQ,EAAC,UAAU,CAAC,CAAC;IAC3F,MAAM,cAAc,GAA0B,IAAA,8BAAmB,EAAC,IAAI,CAAC,CAAC;IAExE,MAAM,MAAM,GAAuB;QAC/B,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,2EAA2E;QAC3E,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAA,8BAAsB,EAAC,IAAI,CAAC,QAAQ,CAAC;QACnD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC/B,CAAC;IACF,MAAM,KAAK,GAAwB,IAAA,gCAAwB,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACpF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AACzD,CAAC"}

package/dist/otel/daemon/reprocess.d.ts

@@ -0,0 +1,27 @@
+/**
+ * IronBee — OTEL orphan body reprocessing (catch-up + on-demand retry).
+ *
+ * Scans every registered project's `<project>/.ironbee/otel/` for leftover
+ * `*.request.json` files (requests whose announcing OTLP event was dropped while
+ * the daemon was down, or whose forward failed) and resubmits each to the
+ * forward pipeline. Orphan `*.response.json` files are deleted outright (the
+ * response is disposable).
+ */
+import { ApiRequestBodyMeta } from "../context/extract";
+/** Minimal sink the scan submits to (ForwardPipeline satisfies it structurally). */
+export interface OrphanSubmitter {
+    submit(meta: ApiRequestBodyMeta): void;
+}
+/**
+ * Count unprocessed `*.request.json` files across registered projects' otel dirs
+ * (the on-disk undelivered backlog) for `/health`'s `orphan_files`. Fully
+ * defensive — any read error contributes 0 rather than throwing.
+ */
+export declare function countOrphanFiles(): number;
+/**
+ * Resubmit every unprocessed `*.request.json` across registered projects and
+ * sweep orphan `*.response.json`. Returns the number of request files
+ * resubmitted. Synchronous scan; `submit` itself is fire-and-forget.
+ */
+export declare function reprocessOrphans(pipeline: OrphanSubmitter): number;
+//# sourceMappingURL=reprocess.d.ts.map

package/dist/otel/daemon/reprocess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reprocess.d.ts","sourceRoot":"","sources":["../../../src/otel/daemon/reprocess.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC5B,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAoBzC;AAiBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CA0ClE"}

package/dist/otel/daemon/reprocess.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * IronBee — OTEL orphan body reprocessing (catch-up + on-demand retry).
+ *
+ * Scans every registered project's `<project>/.ironbee/otel/` for leftover
+ * `*.request.json` files (requests whose announcing OTLP event was dropped while
+ * the daemon was down, or whose forward failed) and resubmits each to the
+ * forward pipeline. Orphan `*.response.json` files are deleted outright (the
+ * response is disposable).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.countOrphanFiles = countOrphanFiles;
+exports.reprocessOrphans = reprocessOrphans;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const projects_registry_1 = require("../../lib/projects-registry");
+const logger_1 = require("../../lib/logger");
+/**
+ * Count unprocessed `*.request.json` files across registered projects' otel dirs
+ * (the on-disk undelivered backlog) for `/health`'s `orphan_files`. Fully
+ * defensive — any read error contributes 0 rather than throwing.
+ */
+function countOrphanFiles() {
+    let projects;
+    try {
+        projects = (0, projects_registry_1.listProjects)();
+    }
+    catch {
+        return 0;
+    }
+    let count = 0;
+    for (const proj of projects) {
+        try {
+            for (const name of (0, fs_1.readdirSync)((0, path_1.join)(proj.path, ".ironbee", "otel"))) {
+                if (name.endsWith(".request.json")) {
+                    count += 1;
+                }
+            }
+        }
+        catch {
+            // no otel dir for this project — skip
+        }
+    }
+    return count;
+}
+/** Catch-up meta for a file with no announcing event: timestamp = file mtime. */
+function orphanMeta(bodyRef, mtimeMs) {
+    return {
+        body_ref: bodyRef,
+        sequence_number: null,
+        model: "",
+        query_source: null,
+        body_length: null,
+        session_id: null,
+        project_name: null,
+        timestamp: mtimeMs,
+        from_catchup: true,
+    };
+}
+/**
+ * Resubmit every unprocessed `*.request.json` across registered projects and
+ * sweep orphan `*.response.json`. Returns the number of request files
+ * resubmitted. Synchronous scan; `submit` itself is fire-and-forget.
+ */
+function reprocessOrphans(pipeline) {
+    let projects;
+    try {
+        projects = (0, projects_registry_1.listProjects)();
+    }
+    catch (e) {
+        logger_1.logger.debug(`otel: reprocess could not read project registry: ${e instanceof Error ? e.message : String(e)}`);
+        return 0;
+    }
+    let submitted = 0;
+    for (const proj of projects) {
+        const otelDir = (0, path_1.join)(proj.path, ".ironbee", "otel");
+        let names;
+        try {
+            names = (0, fs_1.readdirSync)(otelDir);
+        }
+        catch {
+            continue; // no otel dir for this project
+        }
+        for (const name of names) {
+            const full = (0, path_1.join)(otelDir, name);
+            if (name.endsWith(".request.json")) {
+                let mtimeMs = Date.now();
+                try {
+                    mtimeMs = (0, fs_1.statSync)(full).mtimeMs;
+                }
+                catch {
+                    continue;
+                }
+                pipeline.submit(orphanMeta(full, mtimeMs));
+                submitted += 1;
+            }
+            else if (name.endsWith(".response.json")) {
+                try {
+                    (0, fs_1.unlinkSync)(full);
+                }
+                catch {
+                    // disposable in v1; ignore
+                }
+            }
+        }
+    }
+    if (submitted > 0) {
+        logger_1.logger.debug(`otel: reprocess resubmitted ${submitted} orphan request bodies`);
+    }
+    return submitted;
+}
+//# sourceMappingURL=reprocess.js.map

package/dist/otel/daemon/reprocess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reprocess.js","sourceRoot":"","sources":["../../../src/otel/daemon/reprocess.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAkBH,4CAoBC;AAsBD,4CA0CC;AApGD,2BAAuD;AACvD,+BAA4B;AAC5B,mEAAyE;AACzE,6CAA0C;AAQ1C;;;;GAIG;AACH,SAAgB,gBAAgB;IAC5B,IAAI,QAAwB,CAAC;IAC7B,IAAI,CAAC;QACD,QAAQ,GAAG,IAAA,gCAAY,GAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,CAAC;IACb,CAAC;IACD,IAAI,KAAK,GAAW,CAAC,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAClE,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBACjC,KAAK,IAAI,CAAC,CAAC;gBACf,CAAC;YACL,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,sCAAsC;QAC1C,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,OAAe,EAAE,OAAe;IAChD,OAAO;QACH,QAAQ,EAAE,OAAO;QACjB,eAAe,EAAE,IAAI;QACrB,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,OAAO;QAClB,YAAY,EAAE,IAAI;KACrB,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,QAAyB;IACtD,IAAI,QAAwB,CAAC;IAC7B,IAAI,CAAC;QACD,QAAQ,GAAG,IAAA,gCAAY,GAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAClB,eAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,OAAO,CAAC,CAAC;IACb,CAAC;IAED,IAAI,SAAS,GAAW,CAAC,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAW,IAAA,WAAI,EAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACD,KAAK,GAAG,IAAA,gBAAW,EAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,SAAS,CAAC,+BAA+B;QAC7C,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,GAAW,IAAA,WAAI,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACjC,IAAI,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACD,OAAO,GAAG,IAAA,aAAQ,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACL,SAAS;gBACb,CAAC;gBACD,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC3C,SAAS,IAAI,CAAC,CAAC;YACnB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC;oBACD,IAAA,eAAU,EAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACL,2BAA2B;gBAC/B,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAChB,eAAM,CAAC,KAAK,CAAC,+BAA+B,SAAS,wBAAwB,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/dist/otel/log-handler.d.ts

@@ -0,0 +1,37 @@
+/**
+ * IronBee — OTEL log signal handler
+ *
+ * Decodes the OTLP/HTTP JSON logs envelope (resourceLogs → scopeLogs →
+ * logRecords), filters down to the event names we care about, and prints each
+ * surviving record to the console. In `OTEL_LOG_RAW_API_BODIES=file:<dir>`
+ * mode the raw Anthropic Messages API bodies live on disk; a `body_ref`
+ * attribute points at the file, which this handler reads and renders inline.
+ *
+ * Only `handleLogs` is consumed by `collector.ts`; everything else is internal.
+ */
+import { ApiRequestBodyMeta } from "./context/extract";
+/**
+ * Log event names (the `event.name` attribute Claude Code sets on each record)
+ * the collector actually processes — every other event is ignored (noop). Kept
+ * deliberately narrow: the raw API request/response bodies are all we want
+ * today. Add an entry here to start surfacing another event.
+ */
+export declare const HANDLED_LOG_EVENTS: ReadonlySet<string>;
+/**
+ * Handle one OTLP/HTTP JSON logs request body. Throws on invalid JSON (the
+ * collector maps that to HTTP 400); printing failures are caught and logged so
+ * one malformed record never takes the server down.
+ */
+/** Minimal sink the live daemon routes request bodies to (ForwardPipeline satisfies it). */
+export interface OTELLogSink {
+    submit(meta: ApiRequestBodyMeta): void;
+}
+/**
+ * Handle one OTLP/HTTP JSON logs request body. With a `sink` (the live daemon),
+ * `api_request_body` records are submitted to the forward pipeline and
+ * `api_response_body` files are deleted; without one (dev / direct callers),
+ * handled records are pretty-printed to the console. Throws on invalid JSON
+ * (the collector maps that to HTTP 400).
+ */
+export declare function handleLogs(raw: Buffer, sink?: OTELLogSink): void;
+//# sourceMappingURL=log-handler.d.ts.map

package/dist/otel/log-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-handler.d.ts","sourceRoot":"","sources":["../../src/otel/log-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,OAAO,EAA6B,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGlF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAGjD,CAAC;AA8QH;;;;GAIG;AACH,4FAA4F;AAC5F,MAAM,WAAW,WAAW;IACxB,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC1C;AA4CD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAYhE"}

package/dist/otel/log-handler.js

@@ -0,0 +1,332 @@
+"use strict";
+/**
+ * IronBee — OTEL log signal handler
+ *
+ * Decodes the OTLP/HTTP JSON logs envelope (resourceLogs → scopeLogs →
+ * logRecords), filters down to the event names we care about, and prints each
+ * surviving record to the console. In `OTEL_LOG_RAW_API_BODIES=file:<dir>`
+ * mode the raw Anthropic Messages API bodies live on disk; a `body_ref`
+ * attribute points at the file, which this handler reads and renders inline.
+ *
+ * Only `handleLogs` is consumed by `collector.ts`; everything else is internal.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANDLED_LOG_EVENTS = void 0;
+exports.handleLogs = handleLogs;
+const fs_1 = require("fs");
+const output_1 = require("../lib/output");
+const extract_1 = require("./context/extract");
+const paths_1 = require("./daemon/paths");
+/**
+ * Log event names (the `event.name` attribute Claude Code sets on each record)
+ * the collector actually processes — every other event is ignored (noop). Kept
+ * deliberately narrow: the raw API request/response bodies are all we want
+ * today. Add an entry here to start surfacing another event.
+ */
+exports.HANDLED_LOG_EVENTS = new Set([
+    "api_request_body",
+    "api_response_body",
+]);
+/**
+ * Attribute Claude Code sets in `OTEL_LOG_RAW_API_BODIES=file:<dir>` mode on
+ * the `api_request_body` / `api_response_body` events. Its value is an
+ * absolute path to a `.request.json` / `.response.json` file holding the
+ * untruncated body; the handler reads that file and surfaces the body.
+ */
+const BODY_REF_KEY = "body_ref";
+/**
+ * Max characters of a resolved `body_ref` body (or any long attribute value)
+ * printed to the console before truncation. Claude Code's file-mode raw API
+ * bodies carry the full conversation history and can be hundreds of KB, so a
+ * cap keeps the terminal usable. Override with `OTEL_BODY_PRINT_LIMIT` (chars;
+ * `0` = unlimited). The full body always remains on disk at the `body_ref`.
+ */
+const DEFAULT_BODY_PRINT_LIMIT = 8192;
+/** Resolve the console body-print cap once, honoring `OTEL_BODY_PRINT_LIMIT`. */
+function resolveBodyPrintLimit() {
+    const raw = process.env.OTEL_BODY_PRINT_LIMIT;
+    if (raw === undefined || raw === "") {
+        return DEFAULT_BODY_PRINT_LIMIT;
+    }
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : DEFAULT_BODY_PRINT_LIMIT;
+}
+const BODY_PRINT_LIMIT = resolveBodyPrintLimit();
+// ---------------------------------------------------------------------------
+// OTLP/JSON value decoding
+// ---------------------------------------------------------------------------
+/** Collapse an OTLP `AnyValue` to a plain JS value (recursing into arrays / kvlists). */
+function decodeAnyValue(value) {
+    if (!value) {
+        return undefined;
+    }
+    if (value.stringValue !== undefined) {
+        return value.stringValue;
+    }
+    if (value.boolValue !== undefined) {
+        return value.boolValue;
+    }
+    if (value.intValue !== undefined) {
+        // int64 arrives as a decimal string; keep a number when it round-trips safely.
+        const n = Number(value.intValue);
+        return Number.isSafeInteger(n) ? n : value.intValue;
+    }
+    if (value.doubleValue !== undefined) {
+        return value.doubleValue;
+    }
+    if (value.bytesValue !== undefined) {
+        return value.bytesValue;
+    }
+    if (value.arrayValue) {
+        const values = value.arrayValue.values ?? [];
+        return values.map((v) => decodeAnyValue(v));
+    }
+    if (value.kvlistValue) {
+        return decodeAttributes(value.kvlistValue.values ?? []);
+    }
+    return undefined;
+}
+/** Turn an OTLP `KeyValue[]` (resource / scope / record attributes) into a plain object. */
+function decodeAttributes(attrs) {
+    const out = {};
+    for (const kv of attrs) {
+        if (kv && typeof kv.key === "string") {
+            out[kv.key] = decodeAnyValue(kv.value);
+        }
+    }
+    return out;
+}
+/** Cheaply read a record's event name (the `event.name` attribute, else the body string). */
+function extractEventName(record) {
+    for (const kv of record.attributes ?? []) {
+        if (kv.key === "event.name" && kv.value?.stringValue !== undefined) {
+            return kv.value.stringValue;
+        }
+    }
+    if (record.body?.stringValue !== undefined) {
+        return record.body.stringValue;
+    }
+    return "";
+}
+/** Epoch-nanoseconds string → ISO timestamp; falls back to "now" / the raw value. */
+function nanoToIso(nano) {
+    if (!nano) {
+        return new Date().toISOString();
+    }
+    try {
+        const ms = Number(BigInt(nano) / 1000000n);
+        return new Date(ms).toISOString();
+    }
+    catch {
+        return nano;
+    }
+}
+/** Map an OTEL `severityNumber` to its text band when `severityText` is absent. */
+function severityFromNumber(n) {
+    if (n === undefined) {
+        return "INFO";
+    }
+    if (n <= 4) {
+        return "TRACE";
+    }
+    if (n <= 8) {
+        return "DEBUG";
+    }
+    if (n <= 12) {
+        return "INFO";
+    }
+    if (n <= 16) {
+        return "WARN";
+    }
+    if (n <= 20) {
+        return "ERROR";
+    }
+    return "FATAL";
+}
+/** Render a decoded value for a single console line, capped at the body-print limit. */
+function formatScalar(value) {
+    if (value === null || value === undefined) {
+        return output_1.pc.dim("null");
+    }
+    const text = typeof value === "object" ? JSON.stringify(value) : String(value);
+    return truncateForConsole(text);
+}
+/** Truncate `text` to BODY_PRINT_LIMIT chars (0 = unlimited) with a footer noting the omission. */
+function truncateForConsole(text) {
+    if (BODY_PRINT_LIMIT <= 0 || text.length <= BODY_PRINT_LIMIT) {
+        return text;
+    }
+    const omitted = text.length - BODY_PRINT_LIMIT;
+    return `${text.slice(0, BODY_PRINT_LIMIT)}${output_1.pc.dim(`… (+${omitted} chars truncated)`)}`;
+}
+/** Pretty-print JSON when parseable; otherwise return the raw string unchanged. */
+function prettyJsonMaybe(raw) {
+    try {
+        return JSON.stringify(JSON.parse(raw), null, 2);
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * Resolve a `body_ref` attribute: read the file Claude Code wrote in
+ * `OTEL_LOG_RAW_API_BODIES=file:<dir>` mode and print its (pretty-printed,
+ * capped) contents under the event. Read failures degrade to a warning — the
+ * collector keeps running and the path is still printed for manual inspection.
+ */
+function printBodyRef(ref) {
+    console.log(`      ${output_1.pc.dim(`${BODY_REF_KEY}:`)} ${ref}`);
+    let raw;
+    try {
+        raw = (0, fs_1.readFileSync)(ref, "utf-8");
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.log(`        ${output_1.pc.yellow(`⚠ could not read body file: ${msg}`)}`);
+        return;
+    }
+    const rendered = truncateForConsole(prettyJsonMaybe(raw));
+    for (const line of rendered.split("\n")) {
+        console.log(`        ${output_1.pc.dim("│")} ${line}`);
+    }
+}
+// ---------------------------------------------------------------------------
+// Console rendering
+// ---------------------------------------------------------------------------
+/** Print every key/value of an attribute object at the given indent. */
+function printAttributes(attrs, indent) {
+    for (const key of Object.keys(attrs)) {
+        console.log(`${indent}${output_1.pc.dim(`${key}:`)} ${formatScalar(attrs[key])}`);
+    }
+}
+/** One-line label for an instrumentation scope (`name@version`). */
+function formatScope(scope) {
+    if (!scope || !scope.name) {
+        return output_1.pc.dim("(unnamed)");
+    }
+    return scope.version ? `${scope.name}@${scope.version}` : scope.name;
+}
+/** Print a single log record (header + body + every event attribute) at record indent. */
+function printLogRecord(record) {
+    const ts = nanoToIso(record.timeUnixNano ?? record.observedTimeUnixNano);
+    const severity = record.severityText ?? severityFromNumber(record.severityNumber);
+    const attrs = decodeAttributes(record.attributes ?? []);
+    const body = decodeAnyValue(record.body);
+    const eventName = extractEventName(record) || "(log record)";
+    console.log(`    ${output_1.pc.dim(ts)} ${output_1.pc.cyan(severity.padEnd(5))} ${output_1.pc.bold(eventName)}`);
+    if (body !== undefined && body !== eventName) {
+        console.log(`      ${output_1.pc.dim("body:")} ${formatScalar(body)}`);
+    }
+    for (const key of Object.keys(attrs)) {
+        if (key === "event.name") {
+            continue;
+        }
+        if (key === BODY_REF_KEY && typeof attrs[key] === "string") {
+            printBodyRef(attrs[key]);
+            continue;
+        }
+        console.log(`      ${output_1.pc.dim(`${key}:`)} ${formatScalar(attrs[key])}`);
+    }
+}
+/**
+ * Render the OTLP hierarchy resource → scope → record. Each handled record is
+ * printed beneath its full resource attribute set and its owning scope, so the
+ * surrounding context (service identity, SDK / OS / host info, scope name) is
+ * always visible. A resource whose every record is ignored produces no output.
+ */
+function printLogsPayload(payload) {
+    for (const rl of payload.resourceLogs ?? []) {
+        // Filter to handled events first, grouped by scope.
+        const scopes = [];
+        let total = 0;
+        for (const sl of rl.scopeLogs ?? []) {
+            const records = (sl.logRecords ?? []).filter((r) => exports.HANDLED_LOG_EVENTS.has(extractEventName(r)));
+            if (records.length > 0) {
+                scopes.push({ scope: sl.scope, records });
+                total += records.length;
+            }
+        }
+        if (total === 0) {
+            continue;
+        }
+        const resourceAttrs = decodeAttributes(rl.resource?.attributes ?? []);
+        const serviceName = String(resourceAttrs["service.name"] ?? "unknown-service");
+        console.log(output_1.pc.dim("─".repeat(60)));
+        console.log(`${output_1.pc.bold((0, output_1.orange)("OTEL"))} ${output_1.pc.dim("logs from")} ${output_1.pc.bold(serviceName)}`
+            + ` ${output_1.pc.dim(`(${total} record${total === 1 ? "" : "s"})`)}`);
+        if (Object.keys(resourceAttrs).length > 0) {
+            console.log(`  ${output_1.pc.dim("resource:")}`);
+            printAttributes(resourceAttrs, "    ");
+        }
+        for (const s of scopes) {
+            console.log(`  ${output_1.pc.dim("scope:")} ${formatScope(s.scope)}`);
+            for (const record of s.records) {
+                printLogRecord(record);
+            }
+        }
+    }
+}
+/** Read a string attribute off a log record. */
+function recordStringAttr(record, key) {
+    for (const kv of record.attributes ?? []) {
+        if (kv && kv.key === key && typeof kv.value?.stringValue === "string") {
+            return kv.value.stringValue;
+        }
+    }
+    return undefined;
+}
+/** Consume-once delete of an `api_response_body` file (v1 derives nothing from it). */
+function deleteResponseBody(record) {
+    const ref = recordStringAttr(record, "body_ref");
+    if (ref && (0, paths_1.isInsideOTELDir)(ref)) {
+        try {
+            (0, fs_1.unlinkSync)(ref);
+        }
+        catch {
+            // gone already / race — fine
+        }
+    }
+}
+/** Route handled records to the forward pipeline (live daemon path). */
+function routeToSink(payload, sink) {
+    for (const rl of payload.resourceLogs ?? []) {
+        const resourceAttrs = rl.resource?.attributes ?? [];
+        for (const sl of rl.scopeLogs ?? []) {
+            for (const record of sl.logRecords ?? []) {
+                const name = extractEventName(record);
+                if (name === "api_request_body") {
+                    const meta = (0, extract_1.extractApiRequestBodyMeta)(record, resourceAttrs);
+                    if (meta) {
+                        sink.submit(meta);
+                    }
+                }
+                else if (name === "api_response_body") {
+                    deleteResponseBody(record);
+                }
+            }
+        }
+    }
+}
+/**
+ * Handle one OTLP/HTTP JSON logs request body. With a `sink` (the live daemon),
+ * `api_request_body` records are submitted to the forward pipeline and
+ * `api_response_body` files are deleted; without one (dev / direct callers),
+ * handled records are pretty-printed to the console. Throws on invalid JSON
+ * (the collector maps that to HTTP 400).
+ */
+function handleLogs(raw, sink) {
+    const payload = JSON.parse(raw.toString("utf-8"));
+    try {
+        if (sink) {
+            routeToSink(payload, sink);
+        }
+        else {
+            printLogsPayload(payload);
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        output_1.log.error(`otel: failed to handle log records: ${msg}`);
+    }
+}
+//# sourceMappingURL=log-handler.js.map