@jackwener/opencli 1.7.8 → 1.7.10

package/dist/src/observation/artifact.js

@@ -0,0 +1,260 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { redactValue } from './redaction.js';
+import { pruneTraceArtifacts, traceExpiresAt } from './retention.js';
+import { CliError, getErrorMessage } from '../errors.js';
+import { log } from '../logger.js';
+import { PKG_VERSION } from '../version.js';
+function baseOpenCliDir() {
+    return process.env.OPENCLI_CONFIG_DIR || path.join(os.homedir(), '.opencli');
+}
+function safeSegment(value) {
+    const safe = (value || 'default').replace(/[^a-zA-Z0-9_-]+/g, '_');
+    return safe || 'default';
+}
+export function getTraceDirectory(contextId, traceId, baseDir = baseOpenCliDir()) {
+    return path.join(baseDir, 'profiles', safeSegment(contextId), 'traces', safeSegment(traceId));
+}
+export function exportObservationSession(session, opts = {}) {
+    const dir = getTraceDirectory(session.scope.contextId, session.id, opts.baseDir);
+    const status = opts.status ?? (opts.error === undefined ? 'success' : 'failure');
+    const createdAt = new Date().toISOString();
+    fs.mkdirSync(dir, { recursive: true });
+    fs.mkdirSync(path.join(dir, 'screenshots'), { recursive: true });
+    fs.mkdirSync(path.join(dir, 'state'), { recursive: true });
+    const originalEvents = session.events();
+    const sanitizedEvents = originalEvents.map((event) => redactObservationEvent(event));
+    const traceLines = [];
+    const networkLines = [];
+    const consoleLines = [];
+    let screenshotIndex = 0;
+    let stateIndex = 0;
+    for (let i = 0; i < sanitizedEvents.length; i++) {
+        const originalEvent = originalEvents[i];
+        const event = sanitizedEvents[i];
+        const serializable = { ...event };
+        if (event.stream === 'screenshot' && originalEvent.stream === 'screenshot' && typeof originalEvent.data === 'string') {
+            const ext = event.format === 'jpeg' ? 'jpg' : 'png';
+            const file = `screenshots/${String(++screenshotIndex).padStart(4, '0')}.${ext}`;
+            fs.writeFileSync(path.join(dir, file), originalEvent.data, 'base64');
+            serializable.path = file;
+            delete serializable.data;
+        }
+        if (event.stream === 'state' && serializable.snapshot !== undefined) {
+            const file = `state/${String(++stateIndex).padStart(4, '0')}.json`;
+            fs.writeFileSync(path.join(dir, file), JSON.stringify(serializable.snapshot, null, 2), 'utf-8');
+            serializable.snapshotPath = file;
+            delete serializable.snapshot;
+        }
+        const line = JSON.stringify(serializable);
+        traceLines.push(line);
+        if (event.stream === 'network')
+            networkLines.push(line);
+        if (event.stream === 'console')
+            consoleLines.push(line);
+    }
+    fs.writeFileSync(path.join(dir, 'trace.jsonl'), traceLines.join('\n') + (traceLines.length ? '\n' : ''), 'utf-8');
+    fs.writeFileSync(path.join(dir, 'network.jsonl'), networkLines.join('\n') + (networkLines.length ? '\n' : ''), 'utf-8');
+    fs.writeFileSync(path.join(dir, 'console.jsonl'), consoleLines.join('\n') + (consoleLines.length ? '\n' : ''), 'utf-8');
+    const summaryPath = path.join(dir, 'summary.md');
+    fs.writeFileSync(summaryPath, renderSummary(session, sanitizedEvents, {
+        error: opts.error,
+        status,
+        dir,
+        createdAt,
+        retentionPolicy: opts.retentionPolicy,
+    }), 'utf-8');
+    const receiptPath = path.join(dir, 'receipt.json');
+    const resultBase = { traceId: session.id, dir, summaryPath, receiptPath };
+    const receipt = buildTraceReceipt(resultBase, status, opts.error, {
+        createdAt,
+        scope: session.scope,
+        retentionPolicy: opts.retentionPolicy,
+    });
+    fs.writeFileSync(receiptPath, JSON.stringify(receipt, null, 2), 'utf-8');
+    pruneTraceArtifactsBestEffort(path.dirname(dir), dir, opts.retentionPolicy);
+    return { ...resultBase, receipt };
+}
+function redactObservationEvent(event) {
+    return redactValue(event);
+}
+export function buildTraceReceipt(result, status, error, opts = {}) {
+    const maybeCliError = error instanceof CliError ? error : undefined;
+    const createdAt = opts.createdAt ?? new Date().toISOString();
+    return {
+        schemaVersion: 1,
+        opencliVersion: PKG_VERSION,
+        traceId: result.traceId,
+        traceDir: result.dir,
+        summaryPath: result.summaryPath,
+        receiptPath: result.receiptPath,
+        status,
+        createdAt,
+        expiresAt: traceExpiresAt(createdAt, opts.retentionPolicy),
+        ...(opts.scope ? { scope: opts.scope } : {}),
+        ...(error === undefined ? {} : {
+            error: {
+                ...(error instanceof Error ? { name: error.name } : {}),
+                ...(maybeCliError ? { code: maybeCliError.code, hint: maybeCliError.hint, exitCode: maybeCliError.exitCode } : {}),
+                message: String(redactValue(getErrorMessage(error))),
+            },
+        }),
+    };
+}
+function pruneTraceArtifactsBestEffort(tracesDir, protectedTraceDir, retentionPolicy) {
+    try {
+        pruneTraceArtifacts(tracesDir, {
+            policy: retentionPolicy,
+            protectedTraceDirs: [protectedTraceDir],
+            warn: (message) => log.warn(`[trace] ${message}`),
+        });
+    }
+    catch (err) {
+        log.warn(`[trace] Failed to prune trace artifacts: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+function renderSummary(session, events, opts) {
+    const counts = events.reduce((acc, event) => {
+        acc[event.stream] = (acc[event.stream] ?? 0) + 1;
+        return acc;
+    }, {});
+    const error = serializeSummaryError(opts.error);
+    const errorEvents = events.filter((event) => event.stream === 'error').slice(-20).reverse();
+    const failedNetwork = events
+        .filter((event) => event.stream === 'network')
+        .filter((event) => event.status === undefined || event.status === 0 || event.status >= 400)
+        .slice(-20)
+        .reverse();
+    const suspiciousConsole = events
+        .filter((event) => event.stream === 'console')
+        .filter((event) => /^(error|warning|warn|assert)$/i.test(event.level))
+        .slice(-20)
+        .reverse();
+    const actions = events
+        .filter((event) => event.stream === 'action')
+        .slice(-30);
+    const lines = [
+        '---',
+        'schemaVersion: 1',
+        `opencliVersion: ${yamlScalar(PKG_VERSION)}`,
+        `traceId: ${yamlScalar(session.id)}`,
+        `status: ${opts.status}`,
+        `contextId: ${yamlScalar(session.scope.contextId ?? 'default')}`,
+        `workspace: ${yamlScalar(session.scope.workspace)}`,
+        ...(session.scope.target ? [`target: ${yamlScalar(session.scope.target)}`] : []),
+        ...(session.scope.site ? [`site: ${yamlScalar(session.scope.site)}`] : []),
+        ...(session.scope.command ? [`command: ${yamlScalar(session.scope.command)}`] : []),
+        ...(session.scope.adapterSourcePath ? [`adapterSourcePath: ${yamlScalar(session.scope.adapterSourcePath)}`] : []),
+        ...(session.scope.adapterSourcePath ? [`adapterSourcePathExists: ${fs.existsSync(session.scope.adapterSourcePath)}`] : []),
+        `traceDir: ${yamlScalar(opts.dir)}`,
+        `startedAt: ${yamlScalar(new Date(session.startedAt).toISOString())}`,
+        `exportedAt: ${yamlScalar(opts.createdAt)}`,
+        `expiresAt: ${yamlScalar(traceExpiresAt(opts.createdAt, opts.retentionPolicy))}`,
+        ...(error ? [
+            `errorCode: ${yamlScalar(error.code ?? 'UNKNOWN')}`,
+            `errorMessage: ${yamlScalar(error.message)}`,
+        ] : []),
+        '---',
+        '',
+        '# OpenCLI Trace Summary',
+        '',
+        '## How To Use',
+        '',
+        '- Start with this summary, then inspect `trace.jsonl` only when the evidence below is insufficient.',
+        '- For adapter repair policy and retry limits, use the `opencli-autofix` skill.',
+        '- `adapterSourcePathExists: false` means the path is a best-effort hint, not a confirmed editable file.',
+        '',
+        '## Error',
+        '',
+        ...renderErrorSection(error, errorEvents),
+        '',
+        '## Failed Network',
+        '',
+        ...renderNetworkSection(failedNetwork),
+        '',
+        '## Suspicious Console',
+        '',
+        ...renderConsoleSection(suspiciousConsole),
+        '',
+        '## Action Timeline',
+        '',
+        ...renderActionSection(actions),
+        '',
+        '## Event Counts',
+        '',
+        ...Object.entries(counts).map(([stream, count]) => `- ${stream}: ${count}`),
+        '',
+        '## Artifact Files',
+        '',
+        '- `trace.jsonl`: full redacted event timeline',
+        '- `network.jsonl`: redacted network events',
+        '- `console.jsonl`: redacted console events',
+        '- `state/`: final state snapshots when available',
+        '- `screenshots/`: final screenshots when available',
+        '',
+    ];
+    return lines.join('\n');
+}
+function serializeSummaryError(error) {
+    if (error === undefined)
+        return undefined;
+    if (error instanceof CliError) {
+        return {
+            code: error.code,
+            message: String(redactValue(error.message)),
+            ...(error.hint ? { hint: String(redactValue(error.hint)) } : {}),
+        };
+    }
+    return { message: String(redactValue(getErrorMessage(error))) };
+}
+function yamlScalar(value) {
+    return JSON.stringify(value);
+}
+function renderErrorSection(error, errorEvents) {
+    const lines = [];
+    if (error) {
+        lines.push(`- ${error.code ?? 'UNKNOWN'}: ${error.message}`);
+        if (error.hint)
+            lines.push(`- hint: ${error.hint}`);
+    }
+    for (const event of errorEvents) {
+        if (event.stream !== 'error')
+            continue;
+        lines.push(`- ${formatTs(event.ts)} ${event.code ?? 'ERROR'}: ${event.message}`);
+    }
+    return lines.length ? lines : ['- none'];
+}
+function renderNetworkSection(events) {
+    if (!events.length)
+        return ['- none'];
+    return events.map((event) => {
+        const status = event.status ?? 'unknown';
+        const method = event.method ?? 'GET';
+        const contentType = event.contentType ? ` ${event.contentType}` : '';
+        return `- ${formatTs(event.ts)} ${status} ${method} ${event.url}${contentType}`;
+    });
+}
+function renderConsoleSection(events) {
+    if (!events.length)
+        return ['- none'];
+    return events.map((event) => `- ${formatTs(event.ts)} ${event.level}: ${trimLine(event.text, 240)}`);
+}
+function renderActionSection(events) {
+    if (!events.length)
+        return ['- none'];
+    return events.map((event) => {
+        const phase = event.phase ? ` ${event.phase}` : '';
+        const data = event.data && Object.keys(event.data).length
+            ? ` ${trimLine(JSON.stringify(redactValue(event.data)), 240)}`
+            : '';
+        return `- ${formatTs(event.ts)} ${event.name}${phase}${data}`;
+    });
+}
+function formatTs(ts) {
+    return new Date(ts).toISOString();
+}
+function trimLine(value, max) {
+    const compact = value.replace(/\s+/g, ' ').trim();
+    return compact.length > max ? `${compact.slice(0, max)}...` : compact;
+}

package/dist/src/observation/artifact.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/observation/artifact.test.js

@@ -0,0 +1,121 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { buildTraceReceipt, exportObservationSession, getTraceDirectory } from './artifact.js';
+import { ObservationSession } from './session.js';
+describe('observation artifact', () => {
+    let baseDir;
+    beforeEach(() => {
+        baseDir = fs.mkdtempSync(path.join(os.tmpdir(), 'opencli-trace-'));
+    });
+    afterEach(() => {
+        fs.rmSync(baseDir, { recursive: true, force: true });
+    });
+    it('writes artifacts under profile-scoped trace directory', () => {
+        const session = new ObservationSession({
+            id: 'trace-1',
+            scope: {
+                contextId: 'work',
+                workspace: 'site:demo',
+                site: 'demo',
+                command: 'demo/run',
+                adapterSourcePath: '/tmp/clis/demo/run.js',
+            },
+            now: () => 1_700_000_000_000,
+        });
+        session.record({ stream: 'action', name: 'command', phase: 'start' });
+        session.record({ stream: 'screenshot', format: 'png', data: Buffer.from('png-bytes').toString('base64'), label: 'final' });
+        session.record({
+            stream: 'network',
+            url: 'https://api.test/data?token=secret',
+            method: 'GET',
+            status: 500,
+            requestHeaders: { authorization: 'Bearer secret' },
+            responseBody: { ok: false },
+        });
+        session.record({ stream: 'console', level: 'error', text: 'boom password=supersecret' });
+        const result = exportObservationSession(session, { baseDir, error: new Error('failed') });
+        expect(result.dir).toBe(getTraceDirectory('work', 'trace-1', baseDir));
+        expect(fs.existsSync(path.join(result.dir, 'trace.jsonl'))).toBe(true);
+        expect(fs.existsSync(path.join(result.dir, 'network.jsonl'))).toBe(true);
+        expect(fs.existsSync(path.join(result.dir, 'console.jsonl'))).toBe(true);
+        expect(fs.existsSync(result.receiptPath)).toBe(true);
+        expect(fs.readFileSync(path.join(result.dir, 'screenshots', '0001.png'), 'utf-8')).toBe('png-bytes');
+        const trace = fs.readFileSync(path.join(result.dir, 'trace.jsonl'), 'utf-8');
+        expect(trace).toContain('token=[REDACTED]');
+        expect(trace).toContain('"authorization":"[REDACTED]"');
+        expect(trace).not.toContain('supersecret');
+        const summary = fs.readFileSync(result.summaryPath, 'utf-8');
+        expect(summary).toContain('schemaVersion: 1');
+        expect(summary).toContain('opencliVersion:');
+        expect(summary).toContain('expiresAt:');
+        expect(summary).toContain('status: failure');
+        expect(summary).toContain('contextId: "work"');
+        expect(summary).toContain('adapterSourcePath: "/tmp/clis/demo/run.js"');
+        expect(summary).toContain('adapterSourcePathExists: false');
+        expect(summary).toContain('## Failed Network');
+        expect(summary).toContain('500 GET https://api.test/data?token=[REDACTED]');
+        expect(summary).toContain('network: 1');
+        const receipt = JSON.parse(fs.readFileSync(result.receiptPath, 'utf-8'));
+        expect(receipt).toMatchObject({
+            schemaVersion: 1,
+            opencliVersion: expect.any(String),
+            traceId: 'trace-1',
+            traceDir: result.dir,
+            summaryPath: result.summaryPath,
+            receiptPath: result.receiptPath,
+            status: 'failure',
+            expiresAt: expect.any(String),
+            scope: {
+                contextId: 'work',
+                workspace: 'site:demo',
+                site: 'demo',
+                command: 'demo/run',
+                adapterSourcePath: '/tmp/clis/demo/run.js',
+            },
+            error: { message: 'failed' },
+        });
+    });
+    it('builds a compact trace receipt', () => {
+        const receipt = buildTraceReceipt({
+            traceId: 'trace-1',
+            dir: '/tmp/opencli/profiles/work/traces/trace-1',
+            summaryPath: '/tmp/opencli/profiles/work/traces/trace-1/summary.md',
+            receiptPath: '/tmp/opencli/profiles/work/traces/trace-1/receipt.json',
+        }, 'failure', new Error('failed with token=secret'), {
+            createdAt: '2026-05-03T00:00:00.000Z',
+            retentionPolicy: { maxAgeDays: 7 },
+        });
+        expect(receipt).toMatchObject({
+            schemaVersion: 1,
+            opencliVersion: expect.any(String),
+            traceId: 'trace-1',
+            traceDir: '/tmp/opencli/profiles/work/traces/trace-1',
+            receiptPath: '/tmp/opencli/profiles/work/traces/trace-1/receipt.json',
+            status: 'failure',
+            expiresAt: '2026-05-10T00:00:00.000Z',
+        });
+        expect(receipt.error?.message).toContain('token=[REDACTED]');
+    });
+    it('prunes older traces after export while protecting the exported trace', () => {
+        const oldTraceDir = getTraceDirectory('work', 'old-trace', baseDir);
+        fs.mkdirSync(oldTraceDir, { recursive: true });
+        fs.writeFileSync(path.join(oldTraceDir, 'receipt.json'), JSON.stringify({
+            createdAt: '2026-04-01T00:00:00.000Z',
+        }), 'utf-8');
+        fs.writeFileSync(path.join(oldTraceDir, 'trace.jsonl'), '{}\n', 'utf-8');
+        const session = new ObservationSession({
+            id: 'new-trace',
+            scope: { contextId: 'work', workspace: 'site:demo' },
+            now: () => Date.parse('2026-05-03T00:00:00.000Z'),
+        });
+        session.record({ stream: 'action', name: 'command', phase: 'start' });
+        const result = exportObservationSession(session, {
+            baseDir,
+            retentionPolicy: { maxAgeDays: 365, maxCountPerProfile: 1, maxBytesPerProfile: '500MB' },
+        });
+        expect(fs.existsSync(oldTraceDir)).toBe(false);
+        expect(fs.existsSync(result.dir)).toBe(true);
+    });
+});

package/dist/src/observation/events.d.ts

@@ -0,0 +1,89 @@
+export type ObservationStream = 'action' | 'network' | 'console' | 'screenshot' | 'state' | 'error';
+export interface ObservationScope {
+    contextId?: string;
+    workspace: string;
+    target?: string;
+    site?: string;
+    command?: string;
+    adapterSourcePath?: string;
+}
+interface BaseObservationEvent {
+    id: string;
+    ts: number;
+    stream: ObservationStream;
+}
+export interface ActionObservationEvent extends BaseObservationEvent {
+    stream: 'action';
+    name: string;
+    phase?: 'start' | 'end' | 'error';
+    data?: Record<string, unknown>;
+}
+export interface NetworkObservationEvent extends BaseObservationEvent {
+    stream: 'network';
+    url: string;
+    method?: string;
+    status?: number;
+    contentType?: string;
+    size?: number;
+    requestHeaders?: Record<string, unknown>;
+    responseHeaders?: Record<string, unknown>;
+    requestBody?: unknown;
+    responseBody?: unknown;
+}
+export interface ConsoleObservationEvent extends BaseObservationEvent {
+    stream: 'console';
+    level: string;
+    text: string;
+    source?: string;
+}
+export interface ScreenshotObservationEvent extends BaseObservationEvent {
+    stream: 'screenshot';
+    format: 'png' | 'jpeg';
+    data: string;
+    label?: string;
+}
+export interface StateObservationEvent extends BaseObservationEvent {
+    stream: 'state';
+    url?: string | null;
+    target?: string;
+    snapshot?: unknown;
+    label?: string;
+}
+export interface ErrorObservationEvent extends BaseObservationEvent {
+    stream: 'error';
+    code?: string;
+    message: string;
+    stack?: string;
+    hint?: string;
+}
+export type ObservationEvent = ActionObservationEvent | NetworkObservationEvent | ConsoleObservationEvent | ScreenshotObservationEvent | StateObservationEvent | ErrorObservationEvent;
+export type ObservationEventInput = ObservationEvent extends infer T ? T extends ObservationEvent ? Omit<T, 'id' | 'ts'> & Partial<Pick<T, 'id' | 'ts'>> : never : never;
+export interface ObservationExportResult {
+    traceId: string;
+    dir: string;
+    summaryPath: string;
+    receiptPath: string;
+    receipt: ObservationTraceReceipt;
+}
+export type ObservationExportStatus = 'success' | 'failure';
+export interface ObservationTraceReceipt {
+    schemaVersion: 1;
+    opencliVersion: string;
+    traceId: string;
+    traceDir: string;
+    summaryPath: string;
+    receiptPath: string;
+    status: ObservationExportStatus;
+    createdAt: string;
+    /** Advisory only; actual deletion is governed by current trace retention budgets. */
+    expiresAt?: string;
+    scope?: ObservationScope;
+    error?: {
+        name?: string;
+        code?: string;
+        message: string;
+        hint?: string;
+        exitCode?: number;
+    };
+}
+export {};

package/dist/src/observation/events.js

@@ -0,0 +1 @@
+export {};

package/dist/src/observation/index.d.ts

@@ -0,0 +1,7 @@
+export * from './events.js';
+export * from './ring-buffer.js';
+export * from './redaction.js';
+export * from './session.js';
+export * from './manager.js';
+export * from './artifact.js';
+export * from './retention.js';

package/dist/src/observation/index.js

@@ -0,0 +1,7 @@
+export * from './events.js';
+export * from './ring-buffer.js';
+export * from './redaction.js';
+export * from './session.js';
+export * from './manager.js';
+export * from './artifact.js';
+export * from './retention.js';

package/dist/src/observation/manager.d.ts

@@ -0,0 +1,9 @@
+import { ObservationSession, type ObservationSessionOptions } from './session.js';
+import type { ObservationScope } from './events.js';
+export declare class ObservationManager {
+    private readonly sessions;
+    start(opts: ObservationSessionOptions): ObservationSession;
+    get(id: string): ObservationSession | undefined;
+    stop(id: string): ObservationSession | undefined;
+    findByScope(scope: ObservationScope): ObservationSession[];
+}

package/dist/src/observation/manager.js

@@ -0,0 +1,27 @@
+import { ObservationSession } from './session.js';
+export class ObservationManager {
+    sessions = new Map();
+    start(opts) {
+        const session = new ObservationSession(opts);
+        this.sessions.set(session.id, session);
+        return session;
+    }
+    get(id) {
+        return this.sessions.get(id);
+    }
+    stop(id) {
+        const session = this.sessions.get(id);
+        this.sessions.delete(id);
+        return session;
+    }
+    findByScope(scope) {
+        return [...this.sessions.values()].filter((session) => scopeMatches(session.scope, scope));
+    }
+}
+function scopeMatches(actual, expected) {
+    return actual.workspace === expected.workspace
+        && (expected.contextId === undefined || actual.contextId === expected.contextId)
+        && (expected.target === undefined || actual.target === expected.target)
+        && (expected.site === undefined || actual.site === expected.site)
+        && (expected.command === undefined || actual.command === expected.command);
+}

package/dist/src/observation/manager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/observation/manager.test.js

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+import { ObservationManager } from './manager.js';
+describe('ObservationManager', () => {
+    it('indexes sessions by id and scope', () => {
+        const manager = new ObservationManager();
+        const work = manager.start({ id: 'work-1', scope: { contextId: 'work', workspace: 'site:x', target: 'tab-1' } });
+        manager.start({ id: 'personal-1', scope: { contextId: 'personal', workspace: 'site:x', target: 'tab-2' } });
+        expect(manager.get('work-1')).toBe(work);
+        expect(manager.findByScope({ contextId: 'work', workspace: 'site:x' }).map((session) => session.id)).toEqual(['work-1']);
+        expect(manager.stop('work-1')).toBe(work);
+        expect(manager.get('work-1')).toBeUndefined();
+    });
+});

package/dist/src/observation/redaction.d.ts

@@ -0,0 +1,11 @@
+export interface RedactionOptions {
+    allowlist?: string[];
+    maxStringLength?: number;
+    maxDepth?: number;
+    maxArrayItems?: number;
+    maxObjectFields?: number;
+}
+export declare function redactUrl(url: string): string;
+export declare function redactHeaders(headers: Record<string, unknown> | undefined, opts?: RedactionOptions): Record<string, unknown> | undefined;
+export declare function redactText(text: string, opts?: RedactionOptions): string;
+export declare function redactValue(value: unknown, opts?: RedactionOptions, keyHint?: string, depth?: number): unknown;

package/dist/src/observation/redaction.js

@@ -0,0 +1,81 @@
+const DEFAULT_REDACTION = '[REDACTED]';
+const SENSITIVE_HEADER_NAMES = new Set([
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'proxy-authorization',
+    'x-api-key',
+    'x-auth-token',
+    'x-csrf-token',
+    'x-xsrf-token',
+]);
+const SENSITIVE_FIELD_PATTERN = /(password|passwd|pwd|token|secret|authorization|cookie|set-cookie|api[_-]?key|access[_-]?token|refresh[_-]?token|session[_-]?id|csrf|xsrf)/i;
+const SENSITIVE_URL_PARAMS = /([?&])(token|key|secret|password|auth|access_token|api_key|session_id|csrf|xsrf)=[^&]*/gi;
+export function redactUrl(url) {
+    return url.replace(SENSITIVE_URL_PARAMS, '$1$2=[REDACTED]');
+}
+export function redactHeaders(headers, opts = {}) {
+    if (!headers)
+        return headers;
+    const allow = new Set((opts.allowlist ?? []).map((key) => key.toLowerCase()));
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        out[key] = SENSITIVE_HEADER_NAMES.has(lower) && !allow.has(lower)
+            ? DEFAULT_REDACTION
+            : redactValue(value, opts, key);
+    }
+    return out;
+}
+export function redactText(text, opts = {}) {
+    const max = opts.maxStringLength ?? 50_000;
+    let out = text
+        .replace(/Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi, 'Bearer [REDACTED]')
+        .replace(/(["'])(password|passwd|pwd|token|secret|api_key|apikey|access_token|session_id)\1\s*:\s*(["'])(.*?)\3/gi, '$1$2$1:$3[REDACTED]$3')
+        .replace(/(token|secret|password|api_key|apikey|access_token|session_id)[=:]\s*['"]?[^'"\s,;}&]+['"]?/gi, '$1=[REDACTED]')
+        .replace(/(cookie[=:]\s*)[^\n;]{3,}/gi, '$1[REDACTED]')
+        .replace(/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, '[REDACTED_JWT]');
+    if (out.length > max)
+        out = out.slice(0, max) + `\n...[truncated, ${out.length - max} chars omitted]`;
+    return out;
+}
+export function redactValue(value, opts = {}, keyHint, depth = 0) {
+    const allow = new Set((opts.allowlist ?? []).map((key) => key.toLowerCase()));
+    if (keyHint && SENSITIVE_FIELD_PATTERN.test(keyHint) && !allow.has(keyHint.toLowerCase())) {
+        return DEFAULT_REDACTION;
+    }
+    if (typeof value === 'string') {
+        return keyHint === 'url' ? redactUrl(value) : redactText(value, opts);
+    }
+    if (value === null || typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    const maxDepth = opts.maxDepth ?? 5;
+    if (depth >= maxDepth)
+        return '[truncated: max depth reached]';
+    if (Array.isArray(value)) {
+        const max = opts.maxArrayItems ?? 100;
+        const items = value.slice(0, max).map((item) => redactValue(item, opts, undefined, depth + 1));
+        if (value.length > max)
+            items.push(`[truncated, ${value.length - max} items omitted]`);
+        return items;
+    }
+    if (typeof value === 'object') {
+        const entries = Object.entries(value);
+        const max = opts.maxObjectFields ?? 100;
+        const out = {};
+        for (const [key, child] of entries.slice(0, max)) {
+            if (key.toLowerCase() === 'url' && typeof child === 'string')
+                out[key] = redactUrl(child);
+            else if (key.toLowerCase().includes('headers') && child && typeof child === 'object' && !Array.isArray(child)) {
+                out[key] = redactHeaders(child, opts);
+            }
+            else {
+                out[key] = redactValue(child, opts, key, depth + 1);
+            }
+        }
+        if (entries.length > max)
+            out.__truncated__ = `[${entries.length - max} fields omitted]`;
+        return out;
+    }
+    return value;
+}

package/dist/src/observation/redaction.test.d.ts

@@ -0,0 +1 @@
+export {};