@neat.is/core 0.10.6-dev.20261008 → 0.10.6-dev.20261010

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   routeSpanToProject,
   startDaemon
-} from "./chunk-EMFX3V77.js";
+} from "./chunk-52SCEPEW.js";
 import {
   buildApi,
   checkCompatibility,
@@ -25,7 +25,7 @@ import {
   startStalenessLoop,
   stitchTrace,
   thresholdForEdgeType
-} from "./chunk-6QMWJAWR.js";
+} from "./chunk-H2BAPN33.js";
 import {
   ProjectNameCollisionError,
   addProject,

package/dist/neatd.cjs

@@ -18008,10 +18008,11 @@ function locusOf(graph, ev) {
   const rawLine = ev.attributes?.[CODE_LINENO_ATTR2];
   const line = typeof rawLine === "number" ? rawLine : Number(rawLine);
   const node = graph.hasNode(ev.affectedNode) ? graph.getNodeAttributes(ev.affectedNode) : void 0;
+  const symbol = node?.type === "SymbolNode" ? node.qualname : void 0;
   return {
     file,
     ...Number.isFinite(line) ? { lineStart: line, lineEnd: line } : {},
-    ...node?.name ? { symbol: node.name } : {},
+    ...symbol ? { symbol } : {},
     service: node?.service ?? ev.service,
     provenance: import_types61.Provenance.OBSERVED
   };
@@ -18107,7 +18108,8 @@ function buildIncidentCard(graph, errorEvent, incidents, policies) {
   const policyCards = applicable.map((p) => ({
     policyName: p.policyName,
     severity: p.severity,
-    message: p.reason
+    message: p.reason,
+    onViolation: p.onViolation
   }));
   const divergences = inGraph ? computeDivergences(graph, { node: affected, incidents }).divergences.map((d) => ({
     type: d.type,
@@ -18134,8 +18136,111 @@ function buildIncidentCard(graph, errorEvent, incidents, policies) {
     ...divergences.length > 0 ? { divergence: divergences } : {},
     headline: renderHeadline(graph, errorEvent, locus, rootCause?.node ?? null)
   };
+  card.grade = gradeIncidentCard(card);
   return import_types61.IncidentCardSchema.parse(card);
 }
+var GRADE_PRIORS_VERSION = "sniper-architecture-priors-2026-10-08";
+var GRADE_WEIGHTS = {
+  evidence: 3,
+  locus: 2,
+  tests: 2,
+  reach: 1.5,
+  kind: 1.5,
+  chain: 1,
+  recur: 1,
+  div: 1
+};
+var PROVENANCE_WEIGHT = {
+  OBSERVED: 1,
+  EXTRACTED: 0.8,
+  INFERRED: 0.4,
+  FRONTIER: 0.3,
+  STALE: 0.2
+};
+var REACH_NODES_MAX = 50;
+var TIMEOUT = /timeout|timed out|deadline/i;
+var round2 = (n) => Math.round(n * 1e4) / 1e4;
+function factor(name, value, evidence, reason) {
+  return {
+    value: value === null ? null : round2(value),
+    weight: GRADE_WEIGHTS[name],
+    evidence,
+    ...reason ? { reason } : {}
+  };
+}
+function gradeIncidentCard(card) {
+  const rc = card.rootCause;
+  const chain = rc?.chain ?? [];
+  const gates = {
+    policyNotBlock: {
+      passed: !(card.policies ?? []).some((p) => p.onViolation === "block"),
+      evidence: ["policies[].onViolation"]
+    },
+    notSymptomOnly: {
+      passed: rc?.classification !== "symptom-only",
+      evidence: ["rootCause.classification"]
+    },
+    locusResolves: { passed: card.locus !== null, evidence: ["locus"] }
+  };
+  const gamma = Object.values(gates).every((g) => g.passed) ? 1 : 0;
+  const carrying = chain.some((h) => h.carriesSignal === true) ? chain.filter((h) => h.carriesSignal === true) : chain;
+  const hopWeights = carrying.map((h) => PROVENANCE_WEIGHT[h.provenance]);
+  const evidence = hopWeights.length === 0 ? factor("evidence", null, ["rootCause.chain[].provenance"], "no root-cause chain on the card") : hopWeights.some((w) => w === void 0) ? factor("evidence", null, ["rootCause.chain[].provenance"], "a chain hop has a provenance with no weight") : factor("evidence", Math.min(...hopWeights), ["rootCause.chain[].provenance"]);
+  const locus = card.locus ? factor("locus", card.locus.symbol ? 1 : 0.6, ["locus.symbol", "locus.file"]) : factor("locus", null, ["locus"], "no locus on the card (the locus gate fails)");
+  const tests = factor(
+    "tests",
+    null,
+    [],
+    "the card carries no test-file classification or test-to-symbol edges"
+  );
+  const reach = card.blastRadius ? factor(
+    "reach",
+    Math.max(0, 1 - card.blastRadius.totalAffected / REACH_NODES_MAX),
+    ["blastRadius.totalAffected"],
+    `nodes in the blast radius against a prior bound of ${REACH_NODES_MAX}`
+  ) : factor("reach", null, ["blastRadius"], "no blast radius on the card");
+  const timeout = TIMEOUT.test(`${card.exceptionType ?? ""} ${card.message}`);
+  const kindValue = timeout ? 0.3 : card.incidentKind === "exception" ? 1 : card.incidentKind === "5xx" || card.incidentKind === "status-error" ? 0.7 : card.incidentKind === "connector" ? 0.6 : 0.4;
+  const kind = factor("kind", kindValue, ["incidentKind", "exceptionType", "message"]);
+  const chainFactor = rc ? factor(
+    "chain",
+    1 / (1 + 0.25 * (Math.max(1, chain.length - 1) - 1)),
+    ["rootCause.chain"]
+  ) : factor("chain", null, ["rootCause"], "no root cause on the card");
+  const occurrences = card.count ?? 1;
+  const recurValue = Math.min(1, Math.log(1 + occurrences) / Math.log(11));
+  const recur = factor(
+    "recur",
+    recurValue,
+    ["count"],
+    card.count === void 0 ? "no coalesced count; one recorded occurrence" : void 0
+  );
+  const div = factor("div", (card.divergence ?? []).length > 0 ? 1 : 0.7, ["divergence"]);
+  const factors = { evidence, locus, tests, reach, kind, chain: chainFactor, recur, div };
+  let weighted = 0;
+  let total = 0;
+  for (const f of Object.values(factors)) {
+    if (f.value === null) continue;
+    weighted += f.weight * f.value;
+    total += f.weight;
+  }
+  const C = round2(weighted / total);
+  const G = round2(gamma * C);
+  const band = gamma === 0 || G < 0.5 ? "out" : G >= 0.75 ? "full" : "diagnose-only";
+  return {
+    G,
+    gamma,
+    gates,
+    C,
+    factors,
+    band,
+    urgency: {
+      value: null,
+      reason: "f_fresh needs the time of the last OBSERVED signal at the node, which the card does not carry"
+    },
+    priorsVersion: GRADE_PRIORS_VERSION
+  };
+}
 
 // src/ask.ts
 init_cjs_shims();
@@ -25272,12 +25377,22 @@ init_cjs_shims();
 // src/connectors/kubernetes/client.ts
 init_cjs_shims();
 var import_node_https = require("https");
+var K8S_RATE_LIMIT = { capacity: 120, refillMs: 1e3 };
 function deploymentsPath(namespace) {
   return `/apis/apps/v1/namespaces/${namespace}/deployments`;
 }
 function podsPath(namespace) {
   return `/api/v1/namespaces/${namespace}/pods`;
 }
+function podLogPath(namespace, podName, opts = {}) {
+  const params = new URLSearchParams();
+  if (opts.container) params.set("container", opts.container);
+  if (typeof opts.tailLines === "number" && Number.isFinite(opts.tailLines)) params.set("tailLines", String(Math.trunc(opts.tailLines)));
+  if (typeof opts.limitBytes === "number" && Number.isFinite(opts.limitBytes)) params.set("limitBytes", String(Math.trunc(opts.limitBytes)));
+  if (opts.previous) params.set("previous", "true");
+  const qs = params.toString();
+  return `${podsPath(namespace)}/${podName}/log${qs ? `?${qs}` : ""}`;
+}
 function makeK8sFetchImpl(transport) {
   const agent = new import_node_https.Agent({
     ...transport.ca ? { ca: transport.ca } : {},
@@ -25328,7 +25443,7 @@ async function listResource(transport, namespace, path84, opts = {}) {
     { method: "GET", headers: { ...transport.token ? bearerAuthHeader(transport.token) : {}, Accept: "application/json" } },
     // accountKey: the (cluster, namespace) pair — an identifier, safe to log, the
     // rate-limit bucket for one namespace on one cluster (ADR-131).
-    { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
+    { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, rateLimit: K8S_RATE_LIMIT, fetchImpl }
   );
   if (!res.ok) {
     throw new Error(`kubernetes ${path84} failed: ${res.status} ${res.statusText}`);
@@ -25349,6 +25464,28 @@ async function fetchDeployments(transport, namespace, opts = {}) {
 async function fetchPods(transport, namespace, opts = {}) {
   return listResource(transport, namespace, podsPath(namespace), opts);
 }
+async function fetchPodLog(transport, namespace, podName, opts = {}) {
+  const base = opts.apiUrl ?? transport.server;
+  const path84 = podLogPath(namespace, podName, {
+    ...opts.container ? { container: opts.container } : {},
+    ...opts.tailLines !== void 0 ? { tailLines: opts.tailLines } : {},
+    ...opts.limitBytes !== void 0 ? { limitBytes: opts.limitBytes } : {},
+    ...opts.previous ? { previous: true } : {}
+  });
+  const url = `${base.replace(/\/$/, "")}${path84}`;
+  const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
+  try {
+    const res = await junctionFetch(
+      url,
+      { method: "GET", headers: { ...transport.token ? bearerAuthHeader(transport.token) : {}, Accept: "text/plain" } },
+      { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, rateLimit: K8S_RATE_LIMIT, fetchImpl }
+    );
+    if (!res.ok) return void 0;
+    return await res.text();
+  } catch {
+    return void 0;
+  }
+}
 
 // src/connectors/kubernetes/kubeconfig.ts
 init_cjs_shims();
@@ -25456,6 +25593,123 @@ function parseK8sTargetName(targetName) {
   return { serviceName, fault };
 }
 
+// src/connectors/kubernetes/process-context.ts
+init_cjs_shims();
+var DEFAULT_MAX_LOG_LINES = 50;
+var DEFAULT_MAX_LOG_BYTES2 = 2 * 1024;
+var DEFAULT_MAX_ENTRIES = 64;
+var DEFAULT_MAX_VALUE_CHARS = 512;
+var REDACTED = "***REDACTED***";
+var SECRET_KEY_RE = /TOKEN|SECRET|KEY|PASSW(?:OR)?D|PWD|(?:^|[^A-Z])PASS(?:$|[^A-Z])|CREDENTIAL|(?:^|[^A-Z])AUTH|PRIVATE|DSN|COOKIE|SESSION|SALT|SIGNATURE|CERT|CONN(?:ECTION)?_?STR/i;
+function isSecretKey(name) {
+  return SECRET_KEY_RE.test(name);
+}
+var PRIVATE_KEY_BLOCK_RE = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g;
+var PRIVATE_KEY_TAIL_RE = /(?:^[A-Za-z0-9+/=]{32,}\r?\n)+-----END [A-Z ]*PRIVATE KEY-----/gm;
+var URL_USERINFO_RE = /([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^\s/@]*)@/g;
+var SECRET_PAIR_RE = /((?:^|[\s?&;,{("'])[A-Za-z0-9_.-]*?(?:passw(?:or)?d|pwd|(?<![a-z])pass(?![a-z])|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?key|credentials?|(?<![a-z])auth(?![a-z])|(?<![a-z])dsn(?![a-z]))[A-Za-z0-9_.-]*["']?\s*[=:]\s*["']?)([^\s&;,"'})]+)/gi;
+var AUTH_SCHEME_RE = /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/g;
+var KNOWN_TOKEN_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9]{20,}|\bgithub_pat_[A-Za-z0-9_]{20,}|\bsk_(?:live|test)_[A-Za-z0-9]{10,}|\bxox[abprs]-[A-Za-z0-9-]{10,}|\bglpat-[A-Za-z0-9_-]{16,}|\bAIza[0-9A-Za-z_-]{30,}|\bneat_pat_[A-Za-z0-9_-]{16,}/g;
+function redactText(text) {
+  return text.replace(PRIVATE_KEY_BLOCK_RE, REDACTED).replace(PRIVATE_KEY_TAIL_RE, REDACTED).replace(URL_USERINFO_RE, (_m, scheme, userinfo) => {
+    const colon = userinfo.indexOf(":");
+    return colon > 0 ? `${scheme}${userinfo.slice(0, colon)}:${REDACTED}@` : `${scheme}${REDACTED}@`;
+  }).replace(SECRET_PAIR_RE, (_m, key) => `${key}${REDACTED}`).replace(AUTH_SCHEME_RE, (_m, scheme) => `${scheme} ${REDACTED}`).replace(KNOWN_TOKEN_RE, REDACTED);
+}
+function redactValue(name, value) {
+  if (isSecretKey(name)) return REDACTED;
+  return redactText(value);
+}
+function redactArg(arg) {
+  const eq = /^(--?)?([A-Za-z0-9_.-]+)=([\s\S]*)$/.exec(arg);
+  if (eq && isSecretKey(eq[2])) {
+    return `${eq[1] ?? ""}${eq[2]}=${REDACTED}`;
+  }
+  return redactText(arg);
+}
+function isSecretFlag(arg) {
+  const m = /^--?([A-Za-z0-9_.-]+)$/.exec(arg);
+  return m !== null && isSecretKey(m[1]);
+}
+function capValue(s, max = DEFAULT_MAX_VALUE_CHARS) {
+  return s.length > max ? `${s.slice(0, max)}\u2026` : s;
+}
+function describeEnvVar(ev) {
+  const name = typeof ev.name === "string" ? ev.name : "";
+  if (name.length === 0) return void 0;
+  if (typeof ev.value === "string") {
+    return `${name}=${capValue(redactValue(name, ev.value))}`;
+  }
+  const from = ev.valueFrom;
+  if (from) {
+    if (from.secretKeyRef) {
+      const ref = typeof from.secretKeyRef.name === "string" && from.secretKeyRef.name.length > 0 ? from.secretKeyRef.name : "<unnamed>";
+      return `${name}=<from secret ${ref}>`;
+    }
+    if (from.configMapKeyRef) {
+      const ref = typeof from.configMapKeyRef.name === "string" && from.configMapKeyRef.name.length > 0 ? from.configMapKeyRef.name : "<unnamed>";
+      const key = typeof from.configMapKeyRef.key === "string" && from.configMapKeyRef.key.length > 0 ? ` key ${from.configMapKeyRef.key}` : "";
+      return `${name}=<from configMap ${ref}${key}>`;
+    }
+    if (from.fieldRef && typeof from.fieldRef.fieldPath === "string" && from.fieldRef.fieldPath.length > 0) {
+      return `${name}=<from field ${from.fieldRef.fieldPath}>`;
+    }
+    if (from.resourceFieldRef && typeof from.resourceFieldRef.resource === "string" && from.resourceFieldRef.resource.length > 0) {
+      return `${name}=<from resource ${from.resourceFieldRef.resource}>`;
+    }
+    return `${name}=<from reference>`;
+  }
+  return `${name}=`;
+}
+function buildContainerEnv(container) {
+  const out = [];
+  for (const ev of container.env ?? []) {
+    const d = describeEnvVar(ev);
+    if (d !== void 0) out.push(d);
+    if (out.length >= DEFAULT_MAX_ENTRIES) break;
+  }
+  return out;
+}
+function buildContainerArgs(container) {
+  const raw = [];
+  for (const c of container.command ?? []) if (typeof c === "string") raw.push(c);
+  for (const a of container.args ?? []) if (typeof a === "string") raw.push(a);
+  const out = [];
+  for (let i = 0; i < raw.length && out.length < DEFAULT_MAX_ENTRIES; i++) {
+    const arg = raw[i];
+    out.push(capValue(redactArg(arg)));
+    const next = raw[i + 1];
+    if (isSecretFlag(arg) && next !== void 0 && !next.startsWith("-") && out.length < DEFAULT_MAX_ENTRIES) {
+      out.push(REDACTED);
+      i++;
+    }
+  }
+  return out;
+}
+function capProcessLog(text, maxLines = DEFAULT_MAX_LOG_LINES, maxBytes = DEFAULT_MAX_LOG_BYTES2) {
+  const trimmed = text.replace(/\s+$/, "");
+  if (trimmed.length === 0) return "";
+  const lines = trimmed.split("\n");
+  const tail = lines.length > maxLines ? lines.slice(lines.length - maxLines) : lines;
+  let out = tail.join("\n");
+  if (out.length > maxBytes) out = out.slice(out.length - maxBytes);
+  return out;
+}
+function buildProcessContext(input) {
+  const out = {};
+  if (typeof input.log === "string") {
+    const capped = capProcessLog(redactText(input.log));
+    if (capped.length > 0) out.processLog = capped;
+  }
+  if (input.container) {
+    const args = buildContainerArgs(input.container);
+    if (args.length > 0) out.containerArgs = args;
+    const env = buildContainerEnv(input.container);
+    if (env.length > 0) out.containerEnv = env;
+  }
+  return out;
+}
+
 // src/connectors/kubernetes/map.ts
 function serviceNameFor(deployment, config) {
   const name = deployment.metadata?.name ?? "";
@@ -25473,6 +25727,9 @@ function podsForDeployment(deployment, pods) {
 function nowIso2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function podLogKey(podName, container) {
+  return container ? `${podName}\0${container}` : podName;
+}
 function podLevelFault(deployment, pods) {
   const name = deployment.metadata?.name ?? "";
   const owned = podsForDeployment(deployment, pods);
@@ -25490,7 +25747,9 @@ function podLevelFault(deployment, pods) {
           fault: "image-pull",
           message: `Deployment ${name} cannot pull image ${image} (${reason})`,
           timestamp: pod.status?.startTime ?? nowIso2(),
-          attributes: attrs
+          attributes: attrs,
+          pod,
+          ...typeof cs.name === "string" && cs.name.length > 0 ? { container: cs.name } : {}
         };
       }
       if (reason === CRASH_LOOP_REASON && !crash) crash = { cs, pod };
@@ -25512,11 +25771,47 @@ function podLevelFault(deployment, pods) {
       fault: "crash-loop",
       message: `Deployment ${name} is crashlooping (restarts: ${restarts}); ${detail}`,
       timestamp: term?.finishedAt ?? pod.status?.startTime ?? nowIso2(),
-      attributes: attrs
+      attributes: attrs,
+      pod,
+      ...typeof cs.name === "string" && cs.name.length > 0 ? { container: cs.name } : {}
     };
   }
   return null;
 }
+function faultedContainer(finding) {
+  const containers = finding.pod?.spec?.containers;
+  if (!Array.isArray(containers) || containers.length === 0) return void 0;
+  if (finding.container) {
+    const named2 = containers.find((c) => c.name === finding.container);
+    if (named2) return named2;
+  }
+  return containers.length === 1 ? containers[0] : void 0;
+}
+function mergeProcessContext(finding, logs) {
+  const container = faultedContainer(finding);
+  const podName = finding.pod?.metadata?.name;
+  const log = logs && podName ? logs.get(podLogKey(podName, finding.container)) : void 0;
+  if (!container && log === void 0) return;
+  const ctx = buildProcessContext({
+    ...log !== void 0 ? { log } : {},
+    ...container ? { container } : {}
+  });
+  if (ctx.processLog !== void 0) finding.attributes["k8s.processLog"] = ctx.processLog;
+  if (ctx.containerArgs !== void 0) finding.attributes["k8s.containerArgs"] = ctx.containerArgs;
+  if (ctx.containerEnv !== void 0) finding.attributes["k8s.containerEnv"] = ctx.containerEnv;
+}
+function faultedPods(deployments, pods, config) {
+  const out = [];
+  const expectedZero = config.expectedZero ? new Set(config.expectedZero) : void 0;
+  for (const deployment of deployments) {
+    const finding = classifyDeployment(deployment, pods, expectedZero);
+    if (!finding || finding.fault !== "crash-loop") continue;
+    const podName = finding.pod?.metadata?.name;
+    if (typeof podName !== "string" || podName.length === 0) continue;
+    out.push({ podName, ...finding.container ? { container: finding.container } : {} });
+  }
+  return out;
+}
 function classifyDeployment(deployment, pods, expectedZero) {
   const name = deployment.metadata?.name ?? "";
   const desired = typeof deployment.spec?.replicas === "number" ? deployment.spec.replicas : 1;
@@ -25544,12 +25839,13 @@ function classifyDeployment(deployment, pods, expectedZero) {
     attributes: { "k8s.desiredReplicas": desired, "k8s.readyReplicas": ready }
   };
 }
-function mapDeploymentToSignal(deployment, pods, config) {
+function mapDeploymentToSignal(deployment, pods, config, logs) {
   const name = deployment.metadata?.name;
   if (typeof name !== "string" || name.length === 0) return null;
   const expectedZero = config.expectedZero ? new Set(config.expectedZero) : void 0;
   const finding = classifyDeployment(deployment, pods, expectedZero);
   if (!finding) return null;
+  mergeProcessContext(finding, logs);
   const serviceName = serviceNameFor(deployment, config);
   const namespace = deployment.metadata?.namespace ?? config.namespace;
   const attributes = {
@@ -25602,12 +25898,12 @@ function deployStateSignal(deployment, pods, config) {
     deployState: observedDeployState(deployment, pods)
   };
 }
-function mapWorkloadsToSignals(deployments, pods, config) {
+function mapWorkloadsToSignals(deployments, pods, config, logs) {
   const out = [];
   for (const deployment of deployments) {
     const deployState = deployStateSignal(deployment, pods, config);
     if (deployState) out.push(deployState);
-    const incident = mapDeploymentToSignal(deployment, pods, config);
+    const incident = mapDeploymentToSignal(deployment, pods, config, logs);
     if (incident) out.push(incident);
   }
   return out;
@@ -25706,6 +26002,8 @@ async function startK8sSubstratePolling(input) {
 }
 
 // src/connectors/kubernetes/index.ts
+var PROCESS_LOG_TAIL_LINES = 200;
+var PROCESS_LOG_LIMIT_BYTES = 64 * 1024;
 var KubernetesConnector = class {
   constructor(config, fetchImpl) {
     this.config = config;
@@ -25726,7 +26024,25 @@ var KubernetesConnector = class {
       fetchDeployments(transport, namespace, opts),
       fetchPods(transport, namespace, opts)
     ]);
-    return mapWorkloadsToSignals(deployments, pods, this.config);
+    const logs = await this.fetchFaultedPodLogs(transport, namespace, deployments, pods, opts);
+    return mapWorkloadsToSignals(deployments, pods, this.config, logs);
+  }
+  async fetchFaultedPodLogs(transport, namespace, deployments, pods, opts) {
+    const logs = /* @__PURE__ */ new Map();
+    const targets = faultedPods(deployments, pods, this.config);
+    await Promise.all(
+      targets.map(async (t) => {
+        const text = await fetchPodLog(transport, namespace, t.podName, {
+          ...t.container ? { container: t.container } : {},
+          tailLines: PROCESS_LOG_TAIL_LINES,
+          limitBytes: PROCESS_LOG_LIMIT_BYTES,
+          previous: true,
+          ...opts
+        });
+        if (typeof text === "string" && text.length > 0) logs.set(podLogKey(t.podName, t.container), text);
+      })
+    );
+    return logs;
   }
 };
 function createKubernetesConnector(graph, config, fetchImpl) {