@juspay/neurolink 12.14.7 → 12.14.8

package/dist/cli/commands/proxy.js

@@ -25,7 +25,8 @@ import { describeInstallFailure, getGlobalInstallArgs, isTransientInstallFailure
 import { startUpdaterWorkerSupervisor } from "../../proxy/updaterSupervisor.js";
 import { openProxyWorkerLog } from "../../proxy/workerLog.js";
 import { startRollingProxyServer } from "../../proxy/rollingProxyServer.js";
-import { startProxyRestartControl } from "../../proxy/restartControl.js";
+import { startProxyRestartControl, requestProxySupervisorTelemetry, } from "../../proxy/restartControl.js";
+import { getProxyProcessTelemetry } from "../../proxy/processTelemetry.js";
 import { isProxyAuxiliaryRequest } from "../../proxy/proxyRequestKind.js";
 import { spawnProxySocketWorker } from "../../proxy/rollingWorkerProcess.js";
 import { PROXY_ROLLING_SUPERVISOR_ENV, PROXY_SOCKET_WORKER_ENV, } from "../../proxy/rollingWorkerProtocol.js";
@@ -2076,6 +2077,10 @@ export async function createProxyStartApp(params) {
                 };
             })(),
             observability: {
+                process: getProxyProcessTelemetry(),
+                supervisor: supervisorState?.pid
+                    ? await requestProxySupervisorTelemetry(supervisorState.restartControl, supervisorState.pid)
+                    : { status: "not_applicable" },
                 lifecycle: getProxyLifecycleLoggerSnapshot(),
                 requestLogs: getRequestLoggerSnapshot(),
             },
@@ -2893,6 +2898,7 @@ async function runLaunchdProxySupervisor(argv, spinner) {
         restartControl = await startProxyRestartControl({
             stateDir: join(homedir(), ".neurolink"),
             server: rollingServer,
+            getTelemetry: getProxyProcessTelemetry,
             log: (message) => logger.warn(message),
             isUpdatePending: () => !!rollingReplacement || !!loadUpdateState()?.pendingRestartVersion,
             getInstalledVersion: async () => {

package/dist/proxy/bodyCaptureProcessing.js

@@ -2,6 +2,7 @@ import { join } from "node:path";
 import { mkdir, chmod, writeFile } from "node:fs/promises";
 import { createHash, randomUUID } from "node:crypto";
 import { promisify } from "node:util";
+import { sanitizeForLog } from "../utils/logSanitize.js";
 import { gzip as gzipCallback } from "node:zlib";
 const REQUEST_LOG_IO_TIMEOUT_MS = 5_000;
 /** Maximum redacted body bytes persisted per capture entry. */
@@ -43,6 +44,15 @@ function redactHeaders(headers) {
     return redacted;
 }
 const SENSITIVE_BODY_KEY = /^(?:password|access_token|refresh_token|api_key|apiKey|secret|authorization|token|credential|x-api-key)$/i;
+/** Error messages may contain nested JSON encoded as a string. */
+function redactNestedValue(key, value) {
+    if (SENSITIVE_BODY_KEY.test(key)) {
+        return "[REDACTED]";
+    }
+    return typeof value === "string"
+        ? sanitizeForLog(value.replace(SENSITIVE_BODY_KEYS, '$1"[REDACTED]"'), value.length)
+        : value;
+}
 /** Redact every value under a sensitive key, including objects and arrays. */
 function redactBody(body) {
     if (body === undefined || body === null) {
@@ -54,11 +64,44 @@ function redactBody(body) {
             value = JSON.parse(body);
         }
         catch {
-            // Non-JSON bodies (including SSE transcripts) keep the legacy fallback.
-            return body.replace(SENSITIVE_BODY_KEYS, '$1"[REDACTED]"');
+            if (/^(?:event|data):/m.test(body)) {
+                // Redact whole SSE data values, including nested credentials. Never
+                // retain a truncated/invalid JSON tail whose secret cannot be parsed.
+                return body
+                    .split(/\r\n\r\n|\n\n|\r\r/)
+                    .map((frame) => {
+                    const lines = frame.split(/\r\n|\n|\r/);
+                    const data = lines
+                        .filter((line) => line.startsWith("data:"))
+                        .map((line) => line.slice(5).trimStart())
+                        .join("\n");
+                    if (!data || data === "[DONE]") {
+                        return frame;
+                    }
+                    let redacted;
+                    try {
+                        redacted = JSON.stringify(JSON.parse(data), redactNestedValue);
+                    }
+                    catch {
+                        redacted = "[UNPARSEABLE DATA REDACTED]";
+                    }
+                    return [
+                        ...lines.filter((line) => !line.startsWith("data:")),
+                        `data: ${redacted}`,
+                    ].join("\n");
+                })
+                    .join("\n\n");
+            }
+            // Invalid or truncated structured JSON must not expose an unterminated
+            // credential value that a quoted-string regex cannot safely redact.
+            if (/^\s*[[{]/.test(body)) {
+                return "[UNPARSEABLE DATA REDACTED]";
+            }
+            // Plain-text bodies retain the existing credential-field redaction.
+            return sanitizeForLog(body.replace(SENSITIVE_BODY_KEYS, '$1"[REDACTED]"'), body.length);
         }
     }
-    return JSON.stringify(value, (key, nested) => SENSITIVE_BODY_KEY.test(key) ? "[REDACTED]" : nested);
+    return JSON.stringify(value, redactNestedValue);
 }
 /**
  * Restrict request and phase identifiers to characters safe for artifact
@@ -208,6 +251,7 @@ export async function processProxyBodyCapture(entry, logDir) {
     const headers = redactHeaders(entry.headers);
     const limit = logDir === null ? MAX_OTEL_CAPTURED_BODY_BYTES : MAX_CAPTURED_BODY_BYTES;
     const prepared = prepareRedactedBody(entry.body, limit);
+    prepared.truncated ||= entry.sourceTruncated === true;
     if (logDir === null) {
         return {
             headers,

package/dist/proxy/bodyCaptureWorker.js

@@ -1,5 +1,5 @@
 import { Worker } from "node:worker_threads";
-const MAX_PENDING = 16;
+const MAX_PENDING = 64;
 const MAX_PENDING_BYTES = 32 * 1024 * 1024;
 // Bound retained UTF-16 strings rather than a 3x UTF-8 guess. This accommodates
 // the observed 7.3 MB JSON requests while retaining a 32 MiB aggregate pool.
@@ -29,7 +29,7 @@ const pending = new Map();
  * Conservatively bound clone size and traversal work without invoking
  * getters or serializers.
  */
-function estimateCloneBytes(value) {
+function estimateCloneBytes(value, maxEntryBytes) {
     const stack = [value];
     const seen = new Set();
     let bytes = 0, nodes = 0;
@@ -37,8 +37,8 @@ function estimateCloneBytes(value) {
         if (++nodes > 100_000) {
             throw new Error("body_capture_traversal_limit");
         }
-        if (bytes > MAX_ENTRY_BYTES) {
-            throw new Error("body_capture_entry_too_large");
+        if (bytes > maxEntryBytes) {
+            return bytes;
         }
         const item = stack.pop();
         if (typeof item === "string") {
@@ -68,8 +68,8 @@ function estimateCloneBytes(value) {
             if (stack.length > 100_000) {
                 throw new Error("body_capture_traversal_limit");
             }
-            if (bytes > MAX_ENTRY_BYTES) {
-                throw new Error("body_capture_entry_too_large");
+            if (bytes > maxEntryBytes) {
+                return bytes;
             }
         }
     }
@@ -135,10 +135,13 @@ function getWorker() {
 /** Bounded bulk capture. Failures are indexed; never fall back to blocking work. */
 export async function captureProxyBody(entry, logDir, consume) {
     snapshot.attempted += 1;
+    // An OTel capture can use the existing byte pool when it is otherwise idle.
+    // Raising the slot count does not raise the aggregate retained-memory bound.
+    const maxEntryBytes = logDir === null ? MAX_PENDING_BYTES : MAX_ENTRY_BYTES;
     let bytes;
     let admissionError;
     try {
-        bytes = estimateCloneBytes(entry);
+        bytes = estimateCloneBytes(entry, maxEntryBytes);
     }
     catch (error) {
         bytes = Infinity;
@@ -152,12 +155,12 @@ export async function captureProxyBody(entry, logDir, consume) {
                 ? error.message
                 : "body_capture_unsupported_value";
     }
-    if (bytes > MAX_ENTRY_BYTES ||
+    if (bytes > maxEntryBytes ||
         snapshot.pending >= MAX_PENDING ||
         snapshot.pendingBytes + bytes > MAX_PENDING_BYTES ||
         Date.now() < retryAfter) {
         snapshot.rejected += 1;
-        const error = bytes > MAX_ENTRY_BYTES
+        const error = bytes > maxEntryBytes
             ? (admissionError ?? "body_capture_entry_too_large")
             : Date.now() < retryAfter
                 ? "body_worker_backoff"
@@ -170,7 +173,7 @@ export async function captureProxyBody(entry, logDir, consume) {
             error,
             stored: { bodyWriteFailed: true },
             admission: {
-                limitingResource: bytes > MAX_ENTRY_BYTES
+                limitingResource: bytes > maxEntryBytes
                     ? "entry"
                     : Date.now() < retryAfter
                         ? "worker"
@@ -178,6 +181,7 @@ export async function captureProxyBody(entry, logDir, consume) {
                             ? "captures"
                             : "bytes",
                 estimatedBytes: Number.isFinite(bytes) ? bytes : undefined,
+                maxEntryBytes,
                 pending: snapshot.pending,
                 pendingBytes: snapshot.pendingBytes,
                 maxPending: MAX_PENDING,

package/dist/proxy/claudeOutputObservation.d.ts

@@ -0,0 +1,9 @@
+import type { RequestLogEntry, SSETelemetry } from "../types/index.js";
+/** Content visible to the caller; thinking and empty text are not useful output. */
+export declare function hasUsefulClaudeContent(value: unknown): boolean;
+/** A complete JSON response becomes observable when its body has been read. */
+export declare function observeClaudeJsonOutput(metadata: Record<string, unknown>, value: unknown, at?: number): void;
+/** Keep unavailable observations distinct from a complete stream with no output. */
+export declare function observeClaudeStreamOutput(metadata: Record<string, unknown>, data: SSETelemetry): void;
+/** Final records always explain whether useful-output latency was observed. */
+export declare function claudeOutputLogFields(metadata: Record<string, unknown>, requestStartTime: number): Pick<RequestLogEntry, "firstUsefulOutputMs" | "firstUsefulOutputStatus" | "firstUsefulOutputEvent" | "firstUsefulOutputUnavailableReason">;

package/dist/proxy/claudeOutputObservation.js

@@ -0,0 +1,85 @@
+/** Content visible to the caller; thinking and empty text are not useful output. */
+export function hasUsefulClaudeContent(value) {
+    if (!value || typeof value !== "object") {
+        return false;
+    }
+    const block = value;
+    if (Array.isArray(block.content)) {
+        return block.content.some(hasUsefulClaudeContent);
+    }
+    if (block.type === "thinking" || block.type === "redacted_thinking") {
+        return false;
+    }
+    if (typeof block.text === "string" && block.text.trim().length > 0) {
+        return true;
+    }
+    if (typeof block.refusal === "string" && block.refusal.trim().length > 0) {
+        return true;
+    }
+    return ((block.type === "tool_use" || block.type === "server_tool_use") &&
+        typeof block.name === "string" &&
+        block.name.length > 0 &&
+        block.input !== undefined);
+}
+/** A complete JSON response becomes observable when its body has been read. */
+export function observeClaudeJsonOutput(metadata, value, at = Date.now()) {
+    if (!value ||
+        typeof value !== "object" ||
+        !Array.isArray(value.content)) {
+        metadata.firstUsefulOutputStatus = "not_observed";
+        metadata.firstUsefulOutputUnavailableReason = "unrecognized_response";
+        return;
+    }
+    if (hasUsefulClaudeContent(value)) {
+        metadata.firstUsefulOutputAt = at;
+        metadata.firstUsefulOutputStatus = "observed";
+        metadata.firstUsefulOutputEvent = "json_response.content";
+    }
+    else {
+        metadata.firstUsefulOutputStatus = "no_useful_output";
+        delete metadata.firstUsefulOutputAt;
+        delete metadata.firstUsefulOutputEvent;
+    }
+    delete metadata.firstUsefulOutputUnavailableReason;
+}
+/** Keep unavailable observations distinct from a complete stream with no output. */
+export function observeClaudeStreamOutput(metadata, data) {
+    delete metadata.firstUsefulOutputAt;
+    delete metadata.firstUsefulOutputEvent;
+    delete metadata.firstUsefulOutputUnavailableReason;
+    if (!data.observationIncomplete && data.firstUsefulOutputAt !== undefined) {
+        metadata.firstUsefulOutputAt = data.firstUsefulOutputAt;
+        metadata.firstUsefulOutputEvent = data.firstUsefulOutputEvent;
+        metadata.firstUsefulOutputStatus = "observed";
+    }
+    else if (!data.observationIncomplete && data.messageStopReceived) {
+        metadata.firstUsefulOutputStatus = "no_useful_output";
+    }
+    else {
+        metadata.firstUsefulOutputStatus = "not_observed";
+        metadata.firstUsefulOutputUnavailableReason = data.observationIncomplete
+            ? "incomplete_observation"
+            : "stream_incomplete";
+    }
+}
+/** Final records always explain whether useful-output latency was observed. */
+export function claudeOutputLogFields(metadata, requestStartTime) {
+    const at = metadata.firstUsefulOutputAt;
+    if (typeof at === "number" && Number.isFinite(at)) {
+        return {
+            firstUsefulOutputMs: Math.max(0, at - requestStartTime),
+            firstUsefulOutputStatus: "observed",
+            firstUsefulOutputEvent: typeof metadata.firstUsefulOutputEvent === "string"
+                ? metadata.firstUsefulOutputEvent
+                : "translated_output",
+        };
+    }
+    return metadata.firstUsefulOutputStatus === "no_useful_output"
+        ? { firstUsefulOutputStatus: "no_useful_output" }
+        : {
+            firstUsefulOutputStatus: "not_observed",
+            firstUsefulOutputUnavailableReason: typeof metadata.firstUsefulOutputUnavailableReason === "string"
+                ? metadata.firstUsefulOutputUnavailableReason
+                : "response_not_observed",
+        };
+}

package/dist/proxy/codexUsage.js

@@ -53,20 +53,22 @@ function usefulOutputItem(item) {
         if (item.type === "function_call") {
             return ("arguments" in item &&
                 typeof item.arguments === "string" &&
-                item.arguments.length > 0);
+                item.arguments.trim().length > 0);
         }
         if (item.type === "custom_tool_call") {
             return ("input" in item &&
                 typeof item.input === "string" &&
-                item.input.length > 0);
+                item.input.trim().length > 0);
         }
         if (item.type === "output_text") {
-            return ("text" in item && typeof item.text === "string" && item.text.length > 0);
+            return ("text" in item &&
+                typeof item.text === "string" &&
+                item.text.trim().length > 0);
         }
         if (item.type === "refusal") {
             return ("refusal" in item &&
                 typeof item.refusal === "string" &&
-                item.refusal.length > 0);
+                item.refusal.trim().length > 0);
         }
     }
     return ("content" in item &&
@@ -213,7 +215,7 @@ export function createCodexUsageTap() {
                     type === "response.refusal.delta" ||
                     type === "response.function_call_arguments.delta") &&
                     typeof event.delta === "string" &&
-                    event.delta.length > 0) {
+                    event.delta.trim().length > 0) {
                     if (evidence.firstUsefulOutputAt === undefined) {
                         evidence.firstUsefulOutputAt = Date.now();
                         evidence.firstUsefulOutputEvent = String(type);
@@ -232,22 +234,22 @@ export function createCodexUsageTap() {
                     completedResponse.output.some(usefulOutputItem);
                 const usefulDone = (type === "response.output_text.done" &&
                     typeof event.text === "string" &&
-                    event.text.length > 0) ||
+                    event.text.trim().length > 0) ||
                     (type === "response.refusal.done" &&
                         typeof event.refusal === "string" &&
-                        event.refusal.length > 0) ||
+                        event.refusal.trim().length > 0) ||
                     (type === "response.function_call_arguments.done" &&
                         typeof event.arguments === "string" &&
-                        event.arguments.length > 0) ||
+                        event.arguments.trim().length > 0) ||
                     (type === "response.custom_tool_call_input.done" &&
                         typeof event.input === "string" &&
-                        event.input.length > 0) ||
+                        event.input.trim().length > 0) ||
                     ((type === "response.content_part.added" ||
                         type === "response.content_part.done") &&
                         usefulOutputItem(event.part));
                 const usefulToolDelta = type === "response.custom_tool_call_input.delta" &&
                     typeof event.delta === "string" &&
-                    event.delta.length > 0;
+                    event.delta.trim().length > 0;
                 if (evidence.firstUsefulOutputAt === undefined &&
                     (usefulDone ||
                         usefulCompletion ||

package/dist/proxy/otelLogSink.js

@@ -26,7 +26,7 @@ const bodyDelivery = {
     pendingBytes: 0,
     highWaterPending: 0,
     highWaterBytes: 0,
-    maxPending: 16,
+    maxPending: 64,
     maxPendingBytes: 32 * 1024 * 1024,
 };
 /** Explicit opt-in; configuration never silently falls back to file logging. */

package/dist/proxy/processTelemetry.d.ts

@@ -0,0 +1,3 @@
+import type { ProxyProcessTelemetrySnapshot } from "../types/index.js";
+/** Inspect this process, not the launcher configuration intended for its successor. */
+export declare function getProxyProcessTelemetry(): ProxyProcessTelemetrySnapshot;

package/dist/proxy/processTelemetry.js

@@ -0,0 +1,25 @@
+import { fstatSync } from "node:fs";
+import { getProxyOtelLogSnapshot, isProxyOtelOnly } from "./otelLogSink.js";
+import { getProxyLifecycleLoggerSnapshot } from "./proxyLifecycle.js";
+/** Inspect this process, not the launcher configuration intended for its successor. */
+export function getProxyProcessTelemetry() {
+    const descriptor = (fd) => {
+        try {
+            return fstatSync(fd).isFile() ? "file" : "non_file";
+        }
+        catch {
+            return "unavailable";
+        }
+    };
+    const logs = getProxyOtelLogSnapshot();
+    return {
+        pid: process.pid,
+        checkedAt: new Date().toISOString(),
+        configuredSink: isProxyOtelOnly() ? "otel" : "file",
+        lifecycleSink: getProxyLifecycleLoggerSnapshot().sink ?? "unavailable",
+        otelInitialized: logs.initialized,
+        stdio: { stdout: descriptor(1), stderr: descriptor(2) },
+        exportDropped: logs.queues.reduce((n, q) => n + q.dropped, 0),
+        exportUnconfirmed: logs.queues.reduce((n, q) => n + q.exportUnconfirmed, 0),
+    };
+}

package/dist/proxy/rawStreamCapture.js

@@ -1,5 +1,9 @@
 /** Maximum bytes to capture before stopping accumulation (1 MB). */
 const MAX_CAPTURE_BYTES = 1024 * 1024;
+// Payload accounting across concurrent stream observers, independent of the
+// worker's clone/publication pool. Never retain an unbounded number of prefixes.
+const MAX_PENDING_CAPTURE_BYTES = 16 * 1024 * 1024;
+let pendingCaptureBytes = 0;
 const TRUNCATION_MARKER = "\n...[TRUNCATED]";
 export function createRawStreamCapture() {
     const decoder = new TextDecoder();
@@ -17,21 +21,13 @@ export function createRawStreamCapture() {
             return;
         }
         resolved = true;
-        const finalChunk = decoder.decode();
-        if (finalChunk) {
-            if (capturedBytes < MAX_CAPTURE_BYTES) {
-                const remainingBytes = MAX_CAPTURE_BYTES - capturedBytes;
-                chunks.push(finalChunk.slice(0, remainingBytes));
-                capturedBytes += Math.min(finalChunk.length, remainingBytes);
-            }
-            else if (!truncated) {
-                chunks.push(TRUNCATION_MARKER);
-                truncated = true;
-            }
-        }
+        const text = chunks.map((chunk) => decoder.decode(chunk, { stream: true })).join("") +
+            (truncated ? "" : decoder.decode());
+        pendingCaptureBytes -= capturedBytes;
+        chunks.length = 0;
         resolveCapture({
             totalBytes,
-            text: chunks.join(""),
+            text: text + (truncated ? TRUNCATION_MARKER : ""),
             truncated,
         });
     }
@@ -39,21 +35,16 @@ export function createRawStreamCapture() {
         transform(chunk, controller) {
             controller.enqueue(chunk);
             totalBytes += chunk.byteLength;
-            if (capturedBytes < MAX_CAPTURE_BYTES) {
-                const decoded = decoder.decode(chunk, { stream: true });
-                const remainingBytes = MAX_CAPTURE_BYTES - capturedBytes;
-                const slice = decoded.slice(0, remainingBytes);
+            if (!truncated && capturedBytes < MAX_CAPTURE_BYTES) {
+                const remainingBytes = Math.min(MAX_CAPTURE_BYTES - capturedBytes, Math.max(0, MAX_PENDING_CAPTURE_BYTES - pendingCaptureBytes));
+                // Buffer.slice is a view; copy to avoid retaining the whole wire chunk.
+                const slice = Uint8Array.from(chunk.subarray(0, remainingBytes));
                 chunks.push(slice);
-                capturedBytes += Math.min(decoded.length, remainingBytes);
-                if (decoded.length > remainingBytes && !truncated) {
-                    chunks.push(TRUNCATION_MARKER);
-                    truncated = true;
-                }
-            }
-            else if (!truncated) {
-                chunks.push(TRUNCATION_MARKER);
-                truncated = true;
+                capturedBytes += slice.byteLength;
+                pendingCaptureBytes += slice.byteLength;
+                truncated = slice.byteLength < chunk.byteLength;
             }
+            truncated ||= totalBytes > MAX_CAPTURE_BYTES;
         },
         flush() {
             settle();

package/dist/proxy/requestLogger.d.ts

@@ -35,6 +35,8 @@ export declare function prepareProxyBodyForLogging(body: unknown): {
     truncated: boolean;
     originalBytes?: number;
 };
+/** Cheap gate for response observers; avoid copying diagnostics on the serving path. */
+export declare function isProxyBodyCaptureEnabled(): boolean;
 /** Capture an owned request body with bounded processing and tracked index/export publication. */
 export declare function logBodyCapture(entry: ProxyBodyCaptureEntry): Promise<void>;
 /**

package/dist/proxy/requestLogger.js

@@ -514,9 +514,13 @@ function emitOtlpBodyLogRecord(entry, stored) {
         return undefined;
     });
 }
+/** Cheap gate for response observers; avoid copying diagnostics on the serving path. */
+export function isProxyBodyCaptureEnabled() {
+    return logEnabled && (Boolean(logDir) || isProxyOtelOnly());
+}
 /** Capture an owned request body with bounded processing and tracked index/export publication. */
 export async function logBodyCapture(entry) {
-    if (!logEnabled || (!logDir && !isProxyOtelOnly())) {
+    if (!isProxyBodyCaptureEnabled()) {
         return;
     }
     // Borrowed traffic is somebody else's conversation. Capturing it would leave

package/dist/proxy/restartControl.d.ts

@@ -1,4 +1,4 @@
-import type { ProxyRestartControlIdentity, ProxyRestartControlOptions, ProxyRestartResult } from "../types/index.js";
+import type { ProxyRestartControlIdentity, ProxyRestartControlOptions, ProxyRestartResult, ProxySupervisorTelemetry } from "../types/index.js";
 /**
  * Own restart completion in the supervisor, so a disconnected CLI cannot leave
  * admission closed. The control socket is private to the service's OS user.
@@ -8,5 +8,7 @@ export declare function startProxyRestartControl(options: ProxyRestartControlOpt
     identity: ProxyRestartControlIdentity;
     close: () => Promise<void>;
 }>;
+/** Query the private supervisor endpoint with a short, bounded read; never restart. */
+export declare function requestProxySupervisorTelemetry(identity: ProxyRestartControlIdentity | undefined, expectedPid: number): Promise<ProxySupervisorTelemetry>;
 /** Perform one local control operation; never fall back to killing a process. */
 export declare function requestProxyRestart(identity: ProxyRestartControlIdentity, check: boolean): Promise<ProxyRestartResult>;

package/dist/proxy/restartControl.js

@@ -1,8 +1,35 @@
 import { createServer, request } from "node:http";
-import { chmod, mkdir, rm } from "node:fs/promises";
+import { chmod, mkdir, rm, lstat } from "node:fs/promises";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
+const processTelemetrySchema = z.object({
+    pid: z.number().int().positive(),
+    checkedAt: z.string().datetime(),
+    configuredSink: z.enum(["otel", "file"]),
+    lifecycleSink: z.string(),
+    otelInitialized: z.boolean(),
+    stdio: z.object({
+        stdout: z.enum(["file", "non_file", "unavailable"]),
+        stderr: z.enum(["file", "non_file", "unavailable"]),
+    }),
+    exportDropped: z.number().int().nonnegative(),
+    exportUnconfirmed: z.number().int().nonnegative(),
+});
+/** A worker-only restart cannot repair inherited supervisor log descriptors. */
+function assertSupervisorLogging(status, snapshot) {
+    if (status.observability.requestLogs.diskEnabled === false &&
+        (!snapshot ||
+            snapshot.configuredSink !== "otel" ||
+            snapshot.lifecycleSink !== "otel" ||
+            !snapshot.otelInitialized ||
+            snapshot.stdio.stdout !== "non_file" ||
+            snapshot.stdio.stderr !== "non_file")) {
+        throw new Error(snapshot
+            ? "Supervisor logging is not OTel-only. Worker replacement cannot complete the logging cutover; activate the configured supervisor service first."
+            : "Supervisor telemetry is unavailable, so OTel-only logging cannot be proven. Activate the configured supervisor service first.");
+    }
+}
 const statusSchema = z.object({
     pid: z.number().int().positive(),
     version: z.string(),
@@ -99,6 +126,7 @@ export async function startProxyRestartControl(options) {
             }
             previousWorkerPid = active.pid;
             const status = statusSchema.parse(await options.getStatus());
+            assertSupervisorLogging(status, options.getTelemetry?.());
             if (status.pid !== previousWorkerPid ||
                 status.version !== active.version) {
                 throw new Error("Serving worker identity changed during preflight; retry the check.");
@@ -181,6 +209,26 @@ export async function startProxyRestartControl(options) {
             res.writeHead(400, { connection: "close" }).end();
             return;
         }
+        if (req.method === "GET" && req.url === "/telemetry") {
+            req.resume();
+            try {
+                const snapshot = options.getTelemetry?.();
+                if (!snapshot) {
+                    res.writeHead(404).end();
+                    return;
+                }
+                const payload = JSON.stringify(snapshot);
+                res.writeHead(200, {
+                    "content-type": "application/json",
+                    connection: "close",
+                });
+                res.end(payload);
+            }
+            catch {
+                res.writeHead(503, { connection: "close" }).end();
+            }
+            return;
+        }
         if (!((req.method === "GET" && req.url === "/check") ||
             (req.method === "POST" && req.url === "/restart"))) {
             res.writeHead(404).end();
@@ -238,6 +286,75 @@ export async function startProxyRestartControl(options) {
         },
     };
 }
+/** Query the private supervisor endpoint with a short, bounded read; never restart. */
+export async function requestProxySupervisorTelemetry(identity, expectedPid) {
+    if (!identity) {
+        return { status: "unavailable", reason: "supervisor_upgrade_required" };
+    }
+    try {
+        if (!identity.socketPath.endsWith(`/restart-${expectedPid}-${identity.instanceId}.sock`)) {
+            throw new Error("identity");
+        }
+        const socket = await lstat(identity.socketPath);
+        if (!socket.isSocket() ||
+            (socket.mode & 0o077) !== 0 ||
+            (process.getuid && socket.uid !== process.getuid())) {
+            throw new Error("socket");
+        }
+        const snapshot = await new Promise((resolve, reject) => {
+            const req = request({
+                socketPath: identity.socketPath,
+                path: "/telemetry",
+                method: "GET",
+                headers: {
+                    "x-neurolink-instance": identity.instanceId,
+                    connection: "close",
+                },
+            });
+            const timer = setTimeout(() => req.destroy(new Error("timeout")), 1000);
+            req.once("error", (error) => {
+                clearTimeout(timer);
+                reject(error);
+            });
+            req.once("response", (res) => {
+                let body = "";
+                res.setEncoding("utf8");
+                res.on("data", (chunk) => {
+                    body += chunk;
+                    if (body.length > 8192) {
+                        req.destroy(new Error("size"));
+                    }
+                });
+                res.once("error", (error) => {
+                    clearTimeout(timer);
+                    reject(error);
+                });
+                res.once("end", () => {
+                    clearTimeout(timer);
+                    try {
+                        if (res.statusCode !== 200) {
+                            throw new Error("unsupported");
+                        }
+                        const value = processTelemetrySchema.parse(JSON.parse(body));
+                        if (value.pid !== expectedPid ||
+                            Math.abs(Date.now() - Date.parse(value.checkedAt)) > 5000) {
+                            throw new Error("stale");
+                        }
+                        resolve(value);
+                    }
+                    catch (error) {
+                        reject(error);
+                    }
+                });
+            });
+            req.end();
+        });
+        return { status: "available", process: snapshot };
+    }
+    catch {
+        return { status: "unavailable", reason: "supervisor_telemetry_unverified" };
+    }
+}
 /** Perform one local control operation; never fall back to killing a process. */
 export async function requestProxyRestart(identity, check) {
     return new Promise((resolve, reject) => {