@miphamai/cli 0.11.0 → 0.13.0

package/src/core/inference-hook.ts

@@ -0,0 +1,224 @@
+import { createHmac, randomUUID } from 'node:crypto'
+import type {
+  InferenceHookConfig,
+  InferenceCheckRequest,
+  InferenceCheckResponse,
+  Message,
+} from '../shared/index.ts'
+
+// ── Result type ──
+
+export interface InferenceVerdict {
+  allowed: boolean
+  reason?: string
+}
+
+// ── Public API ──
+
+/**
+ * Build the inference-check request payload from current conversation state.
+ *
+ * Follows Claude Inference Hooks protocol:
+ * - Sends all messages EXCEPT system role (never expose system prompts)
+ * - Includes recent tool calls with result previews (truncated to 2000 chars)
+ * - Omits tool definitions and raw file/image content
+ */
+export function buildRequest(
+  messages: Message[],
+  sessionId: string,
+  provider: string,
+  model: string,
+  organizationId?: string,
+): InferenceCheckRequest {
+  // Filter: exclude system messages, flatten content blocks to text
+  const serialized: Array<{ role: string; content: string }> = []
+  for (const msg of messages) {
+    if (msg.role === 'system') continue
+    serialized.push({
+      role: msg.role,
+      content: typeof msg.content === 'string' ? msg.content : JSON.stringify(msg.content),
+    })
+  }
+
+  // Extract tool calls from the message history
+  const toolCalls = extractToolCalls(messages)
+
+  return {
+    type: 'inference_check',
+    id: `evt_${randomUUID()}`,
+    created_at: new Date().toISOString(),
+    data: {
+      type: 'pre_inference',
+      session_id: sessionId,
+      organization_id: organizationId || undefined,
+      provider,
+      model,
+      messages: serialized,
+      tool_calls: toolCalls,
+    },
+  }
+}
+
+/**
+ * Send the inference-check request to the DLP server and return the verdict.
+ *
+ * On network error or timeout, applies the configured `on_failure` strategy:
+ * - 'fail-closed': block the request (security-first)
+ * - 'fail-open': allow the request (availability-first)
+ */
+export async function sendInferenceCheck(
+  config: InferenceHookConfig,
+  request: InferenceCheckRequest,
+): Promise<InferenceVerdict> {
+  const body = JSON.stringify(request)
+
+  // Build signature header
+  const signature = signPayload(config.signing_secret, body)
+
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    'User-Agent': `MiphamCode/${getVersion()}`,
+    ...(config.headers || {}),
+  }
+
+  if (signature) {
+    headers['X-Mipham-Signature'] = signature
+  }
+
+  try {
+    const response = await fetch(config.endpoint, {
+      method: 'POST',
+      headers,
+      body,
+      signal: AbortSignal.timeout(config.timeout),
+    })
+
+    const responseBody = await response.text()
+
+    if (response.status === 200) {
+      // Parse verdict — treat any non-deny as allow
+      try {
+        const parsed = JSON.parse(responseBody) as InferenceCheckResponse
+        if (parsed.verdict === 'deny') {
+          return { allowed: false, reason: parsed.reason || 'Blocked by DLP policy' }
+        }
+        return { allowed: true }
+      } catch {
+        // Unparseable response — treat as allow (server acknowledged receipt)
+        return { allowed: true }
+      }
+    }
+
+    // 403 = explicit deny
+    if (response.status === 403) {
+      try {
+        const parsed = JSON.parse(responseBody) as InferenceCheckResponse
+        return { allowed: false, reason: parsed.reason || 'Blocked by DLP policy' }
+      } catch {
+        return { allowed: false, reason: `DLP server denied (403): ${responseBody.slice(0, 200)}` }
+      }
+    }
+
+    // Other non-2xx: apply failure posture
+    if (config.on_failure === 'fail-closed') {
+      return {
+        allowed: false,
+        reason: `DLP server returned ${response.status}: ${responseBody.slice(0, 200)}`,
+      }
+    }
+    return { allowed: true }
+  } catch (err) {
+    // Network error or timeout
+    if (config.on_failure === 'fail-closed') {
+      const msg = err instanceof Error ? err.message : String(err)
+      return {
+        allowed: false,
+        reason: `DLP server unreachable: ${msg}`,
+      }
+    }
+    // fail-open: allow through
+    return { allowed: true }
+  }
+}
+
+/**
+ * Check if inference hook is configured and should be used.
+ */
+export function isInferenceHookEnabled(config?: InferenceHookConfig): boolean {
+  return !!(config?.endpoint && config.endpoint.length > 0)
+}
+
+// ── Internal helpers ──
+
+/**
+ * Extract tool calls and their results from the entire message history.
+ * Scans for tool_use/tool_result pairs across all messages.
+ * Each result_preview is truncated to 2000 characters.
+ */
+function extractToolCalls(
+  messages: Message[],
+): Array<{ name: string; input: Record<string, unknown>; result_preview: string }> {
+  // Collect tool results first (keyed by tool_use_id)
+  const toolResults = new Map<string, string>()
+  for (const msg of messages) {
+    if (Array.isArray(msg.content)) {
+      for (const block of msg.content) {
+        if (block.type === 'tool_result') {
+          toolResults.set(block.tool_use_id, block.content || '')
+        }
+      }
+    }
+  }
+
+  // Extract tool_use blocks with their result previews
+  const calls: Array<{
+    name: string
+    input: Record<string, unknown>
+    result_preview: string
+  }> = []
+
+  for (const msg of messages) {
+    if (Array.isArray(msg.content)) {
+      for (const block of msg.content) {
+        if (block.type === 'tool_use') {
+          const resultPreview = toolResults.get(block.id) || ''
+          calls.push({
+            name: block.name,
+            input: block.input,
+            result_preview: resultPreview.slice(0, 2000),
+          })
+        }
+      }
+    }
+  }
+
+  return calls
+}
+
+/**
+ * Sign the request body using HMAC-SHA256.
+ * Follows Standard Webhooks specification:
+ *   X-Mipham-Signature: t=<unix_timestamp>,v1=<hmac_sha256_hex>
+ * Returns empty string if no signing secret is configured.
+ */
+function signPayload(secret: string, body: string): string {
+  if (!secret) return ''
+  const timestamp = Math.floor(Date.now() / 1000).toString()
+  const signedPayload = `${timestamp}.${body}`
+  const signature = createHmac('sha256', secret).update(signedPayload).digest('hex')
+  return `t=${timestamp},v1=${signature}`
+}
+
+/**
+ * Get the current package version for the User-Agent header.
+ */
+function getVersion(): string {
+  try {
+    // Dynamic import to avoid circular deps — the shared package-info
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const pkg = require('../../package.json') as { version?: string }
+    return pkg.version || '0.0.0'
+  } catch {
+    return '0.0.0'
+  }
+}

package/src/core/metrics.ts

@@ -0,0 +1,364 @@
+/**
+ * Lightweight Prometheus-compatible metrics registry for mipham-code.
+ *
+ * Provides Counter, Gauge, and Histogram metric types compatible with
+ * the Python shared/metrics.py module in MegaSystem.  Metrics are
+ * collected in-memory and can be exported in Prometheus text format
+ * or JSON.
+ *
+ * Usage:
+ *   import { getMetrics } from '../core/metrics.js'
+ *
+ *   const m = getMetrics()
+ *   m.cliInvocations.inc()
+ *   m.toolCalls.inc({ tool_name: 'bash' })
+ *   m.modelRequestDuration.observe(150.0, { provider: 'anthropic' })
+ *
+ * Endpoints (via ArtifactServer):
+ *   GET /metrics      — Prometheus text format
+ *   GET /metrics/json — JSON format
+ */
+
+// ── Metric types ──────────────────────────────────────────────────────────
+
+export interface MetricLabels {
+  [key: string]: string
+}
+
+/** Format labels into Prometheus {...} string. */
+function formatLabels(labels?: MetricLabels): string {
+  if (!labels || Object.keys(labels).length === 0) return ''
+  const parts = Object.entries(labels)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([k, v]) => `${k}="${v.replace(/"/g, '\\"')}"`)
+  return `{${parts.join(',')}}`
+}
+
+// ── Counter ──────────────────────────────────────────────────────────────
+
+export class Counter {
+  readonly name: string
+  readonly help: string
+  readonly labels: MetricLabels
+  private _value = 0
+
+  constructor(name: string, help: string, labels?: MetricLabels) {
+    this.name = name
+    this.help = help
+    this.labels = labels ?? {}
+  }
+
+  inc(amount = 1): void {
+    this._value += amount
+  }
+
+  get value(): number {
+    return this._value
+  }
+
+  /** Full metric name with labels for dedup key. */
+  get key(): string {
+    return this.name + formatLabels(this.labels)
+  }
+
+  toPrometheus(): string {
+    const labelStr = formatLabels(this.labels)
+    return `${this.name}${labelStr} ${this._value}`
+  }
+
+  toJSON(): object {
+    return {
+      name: this.name,
+      type: 'counter',
+      help: this.help,
+      labels: this.labels,
+      value: this._value,
+    }
+  }
+}
+
+// ── Gauge ────────────────────────────────────────────────────────────────
+
+export class Gauge {
+  readonly name: string
+  readonly help: string
+  readonly labels: MetricLabels
+  private _value = 0
+
+  constructor(name: string, help: string, labels?: MetricLabels) {
+    this.name = name
+    this.help = help
+    this.labels = labels ?? {}
+  }
+
+  inc(amount = 1): void {
+    this._value += amount
+  }
+
+  dec(amount = 1): void {
+    this._value -= amount
+  }
+
+  set(value: number): void {
+    this._value = value
+  }
+
+  get value(): number {
+    return this._value
+  }
+
+  get key(): string {
+    return this.name + formatLabels(this.labels)
+  }
+
+  toPrometheus(): string {
+    const labelStr = formatLabels(this.labels)
+    return `${this.name}${labelStr} ${this._value}`
+  }
+
+  toJSON(): object {
+    return {
+      name: this.name,
+      type: 'gauge',
+      help: this.help,
+      labels: this.labels,
+      value: this._value,
+    }
+  }
+}
+
+// ── Histogram ────────────────────────────────────────────────────────────
+
+const DEFAULT_BUCKETS = [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
+
+export class Histogram {
+  readonly name: string
+  readonly help: string
+  readonly labels: MetricLabels
+  readonly buckets: number[]
+  private _count = 0
+  private _sum = 0
+  private _bucketCounts: number[]
+
+  constructor(name: string, help: string, buckets?: number[], labels?: MetricLabels) {
+    this.name = name
+    this.help = help
+    this.labels = labels ?? {}
+    this.buckets = buckets ?? DEFAULT_BUCKETS
+    this._bucketCounts = new Array(this.buckets.length).fill(0)
+  }
+
+  observe(value: number): void {
+    this._count++
+    this._sum += value
+    for (let i = 0; i < this.buckets.length; i++) {
+      if (value <= (this.buckets[i] ?? Infinity)) {
+        this._bucketCounts[i] = (this._bucketCounts[i] ?? 0) + 1
+      }
+    }
+  }
+
+  get count(): number {
+    return this._count
+  }
+
+  get sum(): number {
+    return this._sum
+  }
+
+  get key(): string {
+    return this.name + formatLabels(this.labels)
+  }
+
+  toPrometheus(): string {
+    const labelStr = formatLabels(this.labels)
+    const lines: string[] = []
+
+    // _bucket values
+    for (let i = 0; i < this.buckets.length; i++) {
+      const bucketLabel = formatLabels({
+        ...this.labels,
+        le: String(this.buckets[i]),
+      })
+      lines.push(`${this.name}_bucket${bucketLabel} ${this._bucketCounts[i]}`)
+    }
+    // +Inf bucket
+    const infLabel = formatLabels({ ...this.labels, le: '+Inf' })
+    lines.push(`${this.name}_bucket${infLabel} ${this._count}`)
+
+    // _sum and _count
+    lines.push(`${this.name}_sum${labelStr} ${this._sum}`)
+    lines.push(`${this.name}_count${labelStr} ${this._count}`)
+
+    return lines.join('\n')
+  }
+
+  toJSON(): object {
+    const bucketResults: { le: string; count: number }[] = []
+    for (let i = 0; i < this.buckets.length; i++) {
+      bucketResults.push({ le: String(this.buckets[i]), count: this._bucketCounts[i] ?? 0 })
+    }
+    bucketResults.push({ le: '+Inf', count: this._count })
+    return {
+      name: this.name,
+      type: 'histogram',
+      help: this.help,
+      labels: this.labels,
+      count: this._count,
+      sum: this._sum,
+      buckets: bucketResults,
+    }
+  }
+}
+
+// ── MetricsRegistry ──────────────────────────────────────────────────────
+
+export class MetricsRegistry {
+  private _counters = new Map<string, Counter>()
+  private _gauges = new Map<string, Gauge>()
+  private _histograms = new Map<string, Histogram>()
+
+  // ── Predefined metrics ─────────────────────────────────────────
+
+  /** CLI invocation counter. Incremented on each CLI startup. */
+  readonly cliInvocations: Counter
+
+  /** Tool call counter, labelled by tool_name.  Callers use .inc({tool_name}). */
+  readonly toolCalls: Counter
+
+  /** Model API request counter, labelled by provider and model. */
+  readonly modelRequests: Counter
+
+  /** Model API request error counter, labelled by provider and error type. */
+  readonly modelRequestErrors: Counter
+
+  /** Model API request latency histogram (milliseconds). */
+  readonly modelRequestDurationMs: Histogram
+
+  /** Active CLI sessions gauge. */
+  readonly activeSessions: Gauge
+
+  constructor() {
+    // Pre-register standard metrics
+    this.cliInvocations = this.counter(
+      'mipham_code_cli_invocations_total',
+      'Number of CLI invocations',
+    )
+
+    this.toolCalls = this.counter('mipham_code_tool_calls_total', 'Number of tool invocations')
+
+    this.modelRequests = this.counter(
+      'mipham_code_model_requests_total',
+      'Number of model API requests',
+    )
+
+    this.modelRequestErrors = this.counter(
+      'mipham_code_model_request_errors_total',
+      'Number of model API request errors',
+    )
+
+    this.modelRequestDurationMs = this.histogram(
+      'mipham_code_model_request_duration_ms',
+      'Model API request duration in milliseconds',
+      [50, 100, 250, 500, 1000, 2500, 5000, 10000, 30000, 60000],
+    )
+
+    this.activeSessions = this.gauge('mipham_code_active_sessions', 'Number of active CLI sessions')
+  }
+
+  // ── Factory methods ─────────────────────────────────────────────
+
+  counter(name: string, help: string, labels?: MetricLabels): Counter {
+    const c = new Counter(name, help, labels)
+    if (this._counters.has(c.key)) return this._counters.get(c.key)!
+    this._counters.set(c.key, c)
+    return c
+  }
+
+  gauge(name: string, help: string, labels?: MetricLabels): Gauge {
+    const g = new Gauge(name, help, labels)
+    if (this._gauges.has(g.key)) return this._gauges.get(g.key)!
+    this._gauges.set(g.key, g)
+    return g
+  }
+
+  histogram(name: string, help: string, buckets?: number[], labels?: MetricLabels): Histogram {
+    const h = new Histogram(name, help, buckets, labels)
+    if (this._histograms.has(h.key)) return this._histograms.get(h.key)!
+    this._histograms.set(h.key, h)
+    return h
+  }
+
+  // ── Export ──────────────────────────────────────────────────────
+
+  /** Export all metrics in Prometheus text format. */
+  toPrometheusText(): string {
+    const lines: string[] = []
+    const seen = new Set<string>()
+
+    for (const c of this._counters.values()) {
+      if (!seen.has(c.name)) {
+        lines.push(`# HELP ${c.name} ${c.help}`)
+        lines.push(`# TYPE ${c.name} counter`)
+        seen.add(c.name)
+      }
+      lines.push(c.toPrometheus())
+    }
+
+    for (const g of this._gauges.values()) {
+      if (!seen.has(g.name)) {
+        lines.push(`# HELP ${g.name} ${g.help}`)
+        lines.push(`# TYPE ${g.name} gauge`)
+        seen.add(g.name)
+      }
+      lines.push(g.toPrometheus())
+    }
+
+    for (const h of this._histograms.values()) {
+      if (!seen.has(h.name)) {
+        lines.push(`# HELP ${h.name} ${h.help}`)
+        lines.push(`# TYPE ${h.name} histogram`)
+        seen.add(h.name)
+      }
+      lines.push(h.toPrometheus())
+    }
+
+    return lines.join('\n') + '\n'
+  }
+
+  /** Export all metrics as JSON. */
+  toJSON(): object {
+    return {
+      counters: Array.from(this._counters.values()).map((c) => c.toJSON()),
+      gauges: Array.from(this._gauges.values()).map((g) => g.toJSON()),
+      histograms: Array.from(this._histograms.values()).map((h) => h.toJSON()),
+    }
+  }
+
+  /** Reset all metrics (useful for testing). */
+  reset(): void {
+    this._counters.clear()
+    this._gauges.clear()
+    this._histograms.clear()
+  }
+}
+
+// ── Singleton ────────────────────────────────────────────────────────────
+
+let _instance: MetricsRegistry | null = null
+
+/** Get the global MetricsRegistry singleton. */
+export function getMetrics(): MetricsRegistry {
+  if (!_instance) {
+    _instance = new MetricsRegistry()
+  }
+  return _instance
+}
+
+/** Reset the singleton (useful for testing). */
+export function resetMetrics(): void {
+  if (_instance) {
+    _instance.reset()
+    _instance = null
+  }
+}