@narumitw/pi-langfuse 0.51.1 → 0.52.0

package/dist/index.ts

@@ -3,11 +3,235 @@
 import {
   DEFAULT_BASE_URL,
   createLangfuseRuntimeFromBackend,
-  getLangfuseRuntimeInternal,
-  loadLangfuseConfig,
-  normalizeLangfuseConfig,
-  writeLangfuseConfig
-} from "./chunks/chunk-DBQAWNKG.ts";
+  getLangfuseRuntimeInternal
+} from "./chunks/chunk-N7WSLB5Q.ts";
+
+// src/config.ts
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+var CONFIG_FILE_NAME = "pi-langfuse.json";
+function langfuseConfigPath() {
+  return join(getAgentDir(), CONFIG_FILE_NAME);
+}
+var configSaveQueues = /* @__PURE__ */ new Map();
+function writeLangfuseConfig(patch, path = langfuseConfigPath()) {
+  const previous = configSaveQueues.get(path) ?? Promise.resolve();
+  const operation = previous.then(() => writeLangfuseConfigNow(patch, path));
+  const tail = operation.then(
+    () => void 0,
+    () => void 0
+  );
+  configSaveQueues.set(path, tail);
+  void tail.then(() => {
+    if (configSaveQueues.get(path) === tail) configSaveQueues.delete(path);
+  });
+  return operation;
+}
+async function writeLangfuseConfigNow(patch, path) {
+  const currentDocument = await readLangfuseDocumentForUpdate(path);
+  const normalized = normalizeLangfuseConfig({ ...currentDocument, ...patch });
+  if (!normalized.ok) throw new Error(normalized.reason);
+  const {
+    publicKey: _publicKey,
+    secretKey: _secretKey,
+    baseUrl: _baseUrl,
+    environment: _environment,
+    release: _release,
+    userId: _userId,
+    captureContent: _captureContent,
+    ...unknownFields
+  } = currentDocument;
+  const nextDocument = { ...unknownFields, ...normalized.config };
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(tempPath, `${JSON.stringify(nextDocument, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384
+    });
+    await chmod(tempPath, 384);
+    await rename(tempPath, path);
+    return normalized.config;
+  } catch (error) {
+    await rm(tempPath, { force: true }).catch(() => void 0);
+    throw error;
+  }
+}
+async function readLangfuseDocumentForUpdate(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ENOENT") return {};
+    throw new Error(
+      `Cannot update ${CONFIG_FILE_NAME} because the existing file is malformed or unreadable; repair it first.`
+    );
+  }
+  const normalized = normalizeLangfuseConfig(parsed);
+  if (!normalized.ok) {
+    throw new Error(
+      `Cannot update ${CONFIG_FILE_NAME} because the existing file has invalid recognized fields; repair it first.`
+    );
+  }
+  return { ...parsed };
+}
+async function loadLangfuseConfig(path = langfuseConfigPath()) {
+  await configSaveQueues.get(path);
+  const warnings = [];
+  const permissionFailure = await ensurePrivatePermissions(path, warnings);
+  if (permissionFailure) {
+    return {
+      ok: false,
+      path,
+      warnings,
+      reason: `Refusing to load credentials: ${permissionFailure}`
+    };
+  }
+  let text;
+  try {
+    text = await readFile(path, "utf8");
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ENOENT") {
+      return { ok: false, path, warnings, reason: `Configuration file not found: ${path}` };
+    }
+    return {
+      ok: false,
+      path,
+      warnings,
+      reason: `Failed to read ${path}: ${formatError(error)}`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return {
+      ok: false,
+      path,
+      warnings,
+      reason: `Failed to parse ${path} as JSON; repair the file before retrying.`
+    };
+  }
+  const normalized = normalizeLangfuseConfig(parsed);
+  if (!normalized.ok) return { ok: false, path, warnings, reason: normalized.reason };
+  return { ok: true, config: normalized.config, path, warnings };
+}
+function normalizeLangfuseConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { ok: false, reason: "pi-langfuse.json must contain a JSON object." };
+  }
+  const input = value;
+  const publicKey = normalizeString(input.publicKey);
+  const secretKey = normalizeString(input.secretKey);
+  if (!publicKey) {
+    return { ok: false, reason: "pi-langfuse.json requires a literal publicKey string." };
+  }
+  if (!secretKey) {
+    return { ok: false, reason: "pi-langfuse.json requires a literal secretKey string." };
+  }
+  if (isInterpolation(publicKey)) {
+    return {
+      ok: false,
+      reason: "pi-langfuse.json publicKey must be literal; environment and command interpolation are not supported."
+    };
+  }
+  if (isInterpolation(secretKey)) {
+    return {
+      ok: false,
+      reason: "pi-langfuse.json secretKey must be literal; environment and command interpolation are not supported."
+    };
+  }
+  const rawBaseUrl = input.baseUrl === void 0 ? DEFAULT_BASE_URL : normalizeString(input.baseUrl);
+  if (!rawBaseUrl) {
+    return { ok: false, reason: "pi-langfuse.json baseUrl must be a non-empty string." };
+  }
+  const baseUrl = normalizeBaseUrl(rawBaseUrl);
+  if (!baseUrl) {
+    return {
+      ok: false,
+      reason: "pi-langfuse.json baseUrl must use HTTP or HTTPS without credentials, a query, or a fragment."
+    };
+  }
+  if (input.captureContent !== void 0 && typeof input.captureContent !== "boolean") {
+    return { ok: false, reason: "pi-langfuse.json captureContent must be a boolean." };
+  }
+  const environment = optionalString(input.environment, "environment");
+  if (!environment.ok) return environment;
+  if (environment.value && (environment.value.length > 40 || !/^(?!langfuse)[a-z0-9_-]+$/u.test(environment.value))) {
+    return {
+      ok: false,
+      reason: "pi-langfuse.json environment must be at most 40 lowercase letters, numbers, hyphens, or underscores and must not start with langfuse."
+    };
+  }
+  const release = optionalString(input.release, "release");
+  if (!release.ok) return release;
+  const userId = optionalString(input.userId, "userId");
+  if (!userId.ok) return userId;
+  if (userId.value && userId.value.length > 200) {
+    return { ok: false, reason: "pi-langfuse.json userId must be at most 200 characters." };
+  }
+  return {
+    ok: true,
+    config: {
+      publicKey,
+      secretKey,
+      baseUrl,
+      ...environment.value ? { environment: environment.value } : {},
+      ...release.value ? { release: release.value } : {},
+      ...userId.value ? { userId: userId.value } : {},
+      captureContent: input.captureContent ?? true
+    }
+  };
+}
+async function ensurePrivatePermissions(path, warnings) {
+  try {
+    const file = await stat(path);
+    if ((file.mode & 511) !== 384) {
+      await chmod(path, 384);
+      const repaired = await stat(path);
+      if ((repaired.mode & 511) !== 384) {
+        throw new Error(`permissions remained ${(repaired.mode & 511).toString(8)}`);
+      }
+      warnings.push(`Restricted ${path} permissions to 0600.`);
+    }
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ENOENT") return void 0;
+    const failure = `Failed to enforce 0600 permissions for ${path}: ${formatError(error)}`;
+    warnings.push(failure);
+    return failure;
+  }
+  return void 0;
+}
+function normalizeBaseUrl(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+    if (url.username || url.password || url.search || url.hash) return void 0;
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return void 0;
+  }
+}
+function optionalString(value, name) {
+  if (value === void 0) return { ok: true };
+  const normalized = normalizeString(value);
+  return normalized ? { ok: true, value: normalized } : { ok: false, reason: `pi-langfuse.json ${name} must be a non-empty string.` };
+}
+function normalizeString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function isInterpolation(value) {
+  return value.startsWith("$") || value.startsWith("!");
+}
+function isNodeError(error) {
+  return error instanceof Error && "code" in error;
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
 
 // src/git.ts
 var GIT_LOOKUP_TIMEOUT_MS = 1e3;
@@ -71,8 +295,8 @@ var TRUNCATED = "[truncated: content budget exceeded]";
 var BASE64_DATA_URI = /data:[^,\s"'`]*;base64,[^\s"'`]*/gi;
 var BASE64_DATA_URI_OMITTED = "[base64 data URI omitted]";
 var OPAQUE_SIGNATURE_KEYS = /* @__PURE__ */ new Set(["thinkingSignature", "textSignature", "thoughtSignature"]);
-function sanitizeTraceValue(value) {
-  const budget = { remaining: MAX_CAPTURE_BYTES };
+function sanitizeTraceValue(value, redactCredentialFields = false) {
+  const budget = { remaining: MAX_CAPTURE_BYTES, redactCredentialFields };
   const sanitized = sanitize(value, /* @__PURE__ */ new WeakSet(), 0, budget);
   return serializedBytes(sanitized) <= MAX_CAPTURE_BYTES ? sanitized : TRUNCATED;
 }
@@ -135,7 +359,11 @@ function sanitize(value, active, depth, budget) {
         const sanitizedKey = sanitizeString(key, keyBudget);
         budget.remaining -= byteLength(sanitizedKey) + 4;
         const property = readProperty(record, key);
-        if (redactData && key === "data") {
+        if (budget.redactCredentialFields && /^(?:(?:x[-_])?api[-_]?(?:key|token|secret)|authorization|proxy[-_]?authorization|cookies?|password|credentials?|secret|token|bearer|client[-_]?secret|private[-_]?key|secret[-_]?key|public[-_]?key|access[-_]?token|refresh[-_]?token)$/iu.test(
+          key
+        )) {
+          output[sanitizedKey] = consume("[credential field omitted]", budget);
+        } else if (redactData && key === "data") {
           output[sanitizedKey] = consume("[base64 omitted]", budget);
         } else if (!property.ok) output[sanitizedKey] = consume("[unreadable property]", budget);
         else output[sanitizedKey] = sanitize(property.value, active, depth + 1, budget);
@@ -1317,7 +1545,7 @@ function createLangfuseExtension(dependencies = {}) {
         loadingConfig = result.config;
         const createBackend = dependencies.createBackend;
         const ownsRuntime = createBackend !== void 0;
-        const runtime = createBackend ? createLangfuseRuntimeFromBackend(await createBackend(result.config)) : await (await import("./chunks/runtime-6ZHLVC3A.ts")).createLangfuseRuntime({ config: result.config, env: false });
+        const runtime = createBackend ? createLangfuseRuntimeFromBackend(await createBackend(result.config)) : await (await import("./chunks/runtime-GLRAF7FE.ts")).createLangfuseRuntime({ config: result.config, env: false });
         if (isCurrent() || !runtimeConfigForShutdown) runtimeConfigForShutdown = result.config;
         if (isCurrent()) {
           activeConfig = result.config;
@@ -1338,14 +1566,14 @@ function createLangfuseExtension(dependencies = {}) {
       onInitializationError(error, ctx) {
         const config = loadingConfig;
         loadingConfig = void 0;
-        initializationError = `Langfuse tracing could not start: ${formatError(error, config)}`;
+        initializationError = `Langfuse tracing could not start: ${formatError2(error, config)}`;
         ctx.ui.notify(initializationError, "warning");
       },
       beforeSessionDispose: async () => {
         await configWriteQueue;
       },
       onShutdownError(error, ctx) {
-        ctx.ui.notify(`Langfuse shutdown export failed: ${formatError(error, shutdownConfig)}`, "error");
+        ctx.ui.notify(`Langfuse shutdown export failed: ${formatError2(error, shutdownConfig)}`, "error");
       },
       flushOnReplacement: true,
       shutdownRuntimeOnQuit: true
@@ -1392,7 +1620,7 @@ function createLangfuseExtension(dependencies = {}) {
               ctx.ui.notify("Langfuse traces flushed for this session.", "info");
             } catch (error) {
               if (menuGeneration !== sessionGeneration) return { kind: "close" };
-              ctx.ui.notify(`Langfuse flush failed: ${formatError(error, menuConfig)}`, "error");
+              ctx.ui.notify(`Langfuse flush failed: ${formatError2(error, menuConfig)}`, "error");
             }
             return { kind: "close" };
           },
@@ -1422,7 +1650,7 @@ function createLangfuseExtension(dependencies = {}) {
               );
             } catch (error) {
               if (menuGeneration !== sessionGeneration) return { kind: "close" };
-              ctx.ui.notify(`Failed to save Langfuse config: ${formatError(error, next)}`, "error");
+              ctx.ui.notify(`Failed to save Langfuse config: ${formatError2(error, next)}`, "error");
             }
             return { kind: "close" };
           },
@@ -1528,7 +1756,7 @@ function formatConfigError(result) {
   const setupHint = result.reason.startsWith("Configuration file not found:") ? " Run /langfuse and choose Set up Langfuse." : "";
   return `Langfuse tracing is disabled: ${result.reason}${setupHint}`;
 }
-function formatError(error, config) {
+function formatError2(error, config) {
   let message = error instanceof Error ? error.message : String(error);
   const secrets = [config?.publicKey, config?.secretKey].filter((secret) => Boolean(secret)).sort((left, right) => right.length - left.length);
   for (const secret of secrets) {
@@ -1538,9 +1766,9 @@ function formatError(error, config) {
 }
 var langfuse_default = createLangfuseExtension();
 
-// src/public-api.ts
+// src/runtime-api.ts
 async function createLangfuseRuntime(options = {}) {
-  const runtime = await import("./chunks/runtime-6ZHLVC3A.ts");
+  const runtime = await import("./chunks/runtime-GLRAF7FE.ts");
   return runtime.createLangfuseRuntime(options);
 }
 export {