@neat.is/core 0.10.6-dev.20261009 → 0.10.6-dev.20261010

package/dist/index.cjs

@@ -25483,12 +25483,22 @@ init_cjs_shims();
 // src/connectors/kubernetes/client.ts
 init_cjs_shims();
 var import_node_https = require("https");
+var K8S_RATE_LIMIT = { capacity: 120, refillMs: 1e3 };
 function deploymentsPath(namespace) {
   return `/apis/apps/v1/namespaces/${namespace}/deployments`;
 }
 function podsPath(namespace) {
   return `/api/v1/namespaces/${namespace}/pods`;
 }
+function podLogPath(namespace, podName, opts = {}) {
+  const params = new URLSearchParams();
+  if (opts.container) params.set("container", opts.container);
+  if (typeof opts.tailLines === "number" && Number.isFinite(opts.tailLines)) params.set("tailLines", String(Math.trunc(opts.tailLines)));
+  if (typeof opts.limitBytes === "number" && Number.isFinite(opts.limitBytes)) params.set("limitBytes", String(Math.trunc(opts.limitBytes)));
+  if (opts.previous) params.set("previous", "true");
+  const qs = params.toString();
+  return `${podsPath(namespace)}/${podName}/log${qs ? `?${qs}` : ""}`;
+}
 function makeK8sFetchImpl(transport) {
   const agent = new import_node_https.Agent({
     ...transport.ca ? { ca: transport.ca } : {},
@@ -25539,7 +25549,7 @@ async function listResource(transport, namespace, path82, opts = {}) {
     { method: "GET", headers: { ...transport.token ? bearerAuthHeader(transport.token) : {}, Accept: "application/json" } },
     // accountKey: the (cluster, namespace) pair — an identifier, safe to log, the
     // rate-limit bucket for one namespace on one cluster (ADR-131).
-    { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
+    { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, rateLimit: K8S_RATE_LIMIT, fetchImpl }
   );
   if (!res.ok) {
     throw new Error(`kubernetes ${path82} failed: ${res.status} ${res.statusText}`);
@@ -25560,6 +25570,28 @@ async function fetchDeployments(transport, namespace, opts = {}) {
 async function fetchPods(transport, namespace, opts = {}) {
   return listResource(transport, namespace, podsPath(namespace), opts);
 }
+async function fetchPodLog(transport, namespace, podName, opts = {}) {
+  const base = opts.apiUrl ?? transport.server;
+  const path82 = podLogPath(namespace, podName, {
+    ...opts.container ? { container: opts.container } : {},
+    ...opts.tailLines !== void 0 ? { tailLines: opts.tailLines } : {},
+    ...opts.limitBytes !== void 0 ? { limitBytes: opts.limitBytes } : {},
+    ...opts.previous ? { previous: true } : {}
+  });
+  const url = `${base.replace(/\/$/, "")}${path82}`;
+  const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
+  try {
+    const res = await junctionFetch(
+      url,
+      { method: "GET", headers: { ...transport.token ? bearerAuthHeader(transport.token) : {}, Accept: "text/plain" } },
+      { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, rateLimit: K8S_RATE_LIMIT, fetchImpl }
+    );
+    if (!res.ok) return void 0;
+    return await res.text();
+  } catch {
+    return void 0;
+  }
+}
 
 // src/connectors/kubernetes/kubeconfig.ts
 init_cjs_shims();
@@ -25667,6 +25699,123 @@ function parseK8sTargetName(targetName) {
   return { serviceName, fault };
 }
 
+// src/connectors/kubernetes/process-context.ts
+init_cjs_shims();
+var DEFAULT_MAX_LOG_LINES = 50;
+var DEFAULT_MAX_LOG_BYTES2 = 2 * 1024;
+var DEFAULT_MAX_ENTRIES = 64;
+var DEFAULT_MAX_VALUE_CHARS = 512;
+var REDACTED = "***REDACTED***";
+var SECRET_KEY_RE = /TOKEN|SECRET|KEY|PASSW(?:OR)?D|PWD|(?:^|[^A-Z])PASS(?:$|[^A-Z])|CREDENTIAL|(?:^|[^A-Z])AUTH|PRIVATE|DSN|COOKIE|SESSION|SALT|SIGNATURE|CERT|CONN(?:ECTION)?_?STR/i;
+function isSecretKey(name) {
+  return SECRET_KEY_RE.test(name);
+}
+var PRIVATE_KEY_BLOCK_RE = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g;
+var PRIVATE_KEY_TAIL_RE = /(?:^[A-Za-z0-9+/=]{32,}\r?\n)+-----END [A-Z ]*PRIVATE KEY-----/gm;
+var URL_USERINFO_RE = /([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^\s/@]*)@/g;
+var SECRET_PAIR_RE = /((?:^|[\s?&;,{("'])[A-Za-z0-9_.-]*?(?:passw(?:or)?d|pwd|(?<![a-z])pass(?![a-z])|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?key|credentials?|(?<![a-z])auth(?![a-z])|(?<![a-z])dsn(?![a-z]))[A-Za-z0-9_.-]*["']?\s*[=:]\s*["']?)([^\s&;,"'})]+)/gi;
+var AUTH_SCHEME_RE = /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/g;
+var KNOWN_TOKEN_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9]{20,}|\bgithub_pat_[A-Za-z0-9_]{20,}|\bsk_(?:live|test)_[A-Za-z0-9]{10,}|\bxox[abprs]-[A-Za-z0-9-]{10,}|\bglpat-[A-Za-z0-9_-]{16,}|\bAIza[0-9A-Za-z_-]{30,}|\bneat_pat_[A-Za-z0-9_-]{16,}/g;
+function redactText(text) {
+  return text.replace(PRIVATE_KEY_BLOCK_RE, REDACTED).replace(PRIVATE_KEY_TAIL_RE, REDACTED).replace(URL_USERINFO_RE, (_m, scheme, userinfo) => {
+    const colon = userinfo.indexOf(":");
+    return colon > 0 ? `${scheme}${userinfo.slice(0, colon)}:${REDACTED}@` : `${scheme}${REDACTED}@`;
+  }).replace(SECRET_PAIR_RE, (_m, key) => `${key}${REDACTED}`).replace(AUTH_SCHEME_RE, (_m, scheme) => `${scheme} ${REDACTED}`).replace(KNOWN_TOKEN_RE, REDACTED);
+}
+function redactValue(name, value) {
+  if (isSecretKey(name)) return REDACTED;
+  return redactText(value);
+}
+function redactArg(arg) {
+  const eq = /^(--?)?([A-Za-z0-9_.-]+)=([\s\S]*)$/.exec(arg);
+  if (eq && isSecretKey(eq[2])) {
+    return `${eq[1] ?? ""}${eq[2]}=${REDACTED}`;
+  }
+  return redactText(arg);
+}
+function isSecretFlag(arg) {
+  const m = /^--?([A-Za-z0-9_.-]+)$/.exec(arg);
+  return m !== null && isSecretKey(m[1]);
+}
+function capValue(s, max = DEFAULT_MAX_VALUE_CHARS) {
+  return s.length > max ? `${s.slice(0, max)}\u2026` : s;
+}
+function describeEnvVar(ev) {
+  const name = typeof ev.name === "string" ? ev.name : "";
+  if (name.length === 0) return void 0;
+  if (typeof ev.value === "string") {
+    return `${name}=${capValue(redactValue(name, ev.value))}`;
+  }
+  const from = ev.valueFrom;
+  if (from) {
+    if (from.secretKeyRef) {
+      const ref = typeof from.secretKeyRef.name === "string" && from.secretKeyRef.name.length > 0 ? from.secretKeyRef.name : "<unnamed>";
+      return `${name}=<from secret ${ref}>`;
+    }
+    if (from.configMapKeyRef) {
+      const ref = typeof from.configMapKeyRef.name === "string" && from.configMapKeyRef.name.length > 0 ? from.configMapKeyRef.name : "<unnamed>";
+      const key = typeof from.configMapKeyRef.key === "string" && from.configMapKeyRef.key.length > 0 ? ` key ${from.configMapKeyRef.key}` : "";
+      return `${name}=<from configMap ${ref}${key}>`;
+    }
+    if (from.fieldRef && typeof from.fieldRef.fieldPath === "string" && from.fieldRef.fieldPath.length > 0) {
+      return `${name}=<from field ${from.fieldRef.fieldPath}>`;
+    }
+    if (from.resourceFieldRef && typeof from.resourceFieldRef.resource === "string" && from.resourceFieldRef.resource.length > 0) {
+      return `${name}=<from resource ${from.resourceFieldRef.resource}>`;
+    }
+    return `${name}=<from reference>`;
+  }
+  return `${name}=`;
+}
+function buildContainerEnv(container) {
+  const out = [];
+  for (const ev of container.env ?? []) {
+    const d = describeEnvVar(ev);
+    if (d !== void 0) out.push(d);
+    if (out.length >= DEFAULT_MAX_ENTRIES) break;
+  }
+  return out;
+}
+function buildContainerArgs(container) {
+  const raw = [];
+  for (const c of container.command ?? []) if (typeof c === "string") raw.push(c);
+  for (const a of container.args ?? []) if (typeof a === "string") raw.push(a);
+  const out = [];
+  for (let i = 0; i < raw.length && out.length < DEFAULT_MAX_ENTRIES; i++) {
+    const arg = raw[i];
+    out.push(capValue(redactArg(arg)));
+    const next = raw[i + 1];
+    if (isSecretFlag(arg) && next !== void 0 && !next.startsWith("-") && out.length < DEFAULT_MAX_ENTRIES) {
+      out.push(REDACTED);
+      i++;
+    }
+  }
+  return out;
+}
+function capProcessLog(text, maxLines = DEFAULT_MAX_LOG_LINES, maxBytes = DEFAULT_MAX_LOG_BYTES2) {
+  const trimmed = text.replace(/\s+$/, "");
+  if (trimmed.length === 0) return "";
+  const lines = trimmed.split("\n");
+  const tail = lines.length > maxLines ? lines.slice(lines.length - maxLines) : lines;
+  let out = tail.join("\n");
+  if (out.length > maxBytes) out = out.slice(out.length - maxBytes);
+  return out;
+}
+function buildProcessContext(input) {
+  const out = {};
+  if (typeof input.log === "string") {
+    const capped = capProcessLog(redactText(input.log));
+    if (capped.length > 0) out.processLog = capped;
+  }
+  if (input.container) {
+    const args = buildContainerArgs(input.container);
+    if (args.length > 0) out.containerArgs = args;
+    const env = buildContainerEnv(input.container);
+    if (env.length > 0) out.containerEnv = env;
+  }
+  return out;
+}
+
 // src/connectors/kubernetes/map.ts
 function serviceNameFor(deployment, config) {
   const name = deployment.metadata?.name ?? "";
@@ -25684,6 +25833,9 @@ function podsForDeployment(deployment, pods) {
 function nowIso2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function podLogKey(podName, container) {
+  return container ? `${podName}\0${container}` : podName;
+}
 function podLevelFault(deployment, pods) {
   const name = deployment.metadata?.name ?? "";
   const owned = podsForDeployment(deployment, pods);
@@ -25701,7 +25853,9 @@ function podLevelFault(deployment, pods) {
           fault: "image-pull",
           message: `Deployment ${name} cannot pull image ${image} (${reason})`,
           timestamp: pod.status?.startTime ?? nowIso2(),
-          attributes: attrs
+          attributes: attrs,
+          pod,
+          ...typeof cs.name === "string" && cs.name.length > 0 ? { container: cs.name } : {}
         };
       }
       if (reason === CRASH_LOOP_REASON && !crash) crash = { cs, pod };
@@ -25723,11 +25877,47 @@ function podLevelFault(deployment, pods) {
       fault: "crash-loop",
       message: `Deployment ${name} is crashlooping (restarts: ${restarts}); ${detail}`,
       timestamp: term?.finishedAt ?? pod.status?.startTime ?? nowIso2(),
-      attributes: attrs
+      attributes: attrs,
+      pod,
+      ...typeof cs.name === "string" && cs.name.length > 0 ? { container: cs.name } : {}
     };
   }
   return null;
 }
+function faultedContainer(finding) {
+  const containers = finding.pod?.spec?.containers;
+  if (!Array.isArray(containers) || containers.length === 0) return void 0;
+  if (finding.container) {
+    const named2 = containers.find((c) => c.name === finding.container);
+    if (named2) return named2;
+  }
+  return containers.length === 1 ? containers[0] : void 0;
+}
+function mergeProcessContext(finding, logs) {
+  const container = faultedContainer(finding);
+  const podName = finding.pod?.metadata?.name;
+  const log = logs && podName ? logs.get(podLogKey(podName, finding.container)) : void 0;
+  if (!container && log === void 0) return;
+  const ctx = buildProcessContext({
+    ...log !== void 0 ? { log } : {},
+    ...container ? { container } : {}
+  });
+  if (ctx.processLog !== void 0) finding.attributes["k8s.processLog"] = ctx.processLog;
+  if (ctx.containerArgs !== void 0) finding.attributes["k8s.containerArgs"] = ctx.containerArgs;
+  if (ctx.containerEnv !== void 0) finding.attributes["k8s.containerEnv"] = ctx.containerEnv;
+}
+function faultedPods(deployments, pods, config) {
+  const out = [];
+  const expectedZero = config.expectedZero ? new Set(config.expectedZero) : void 0;
+  for (const deployment of deployments) {
+    const finding = classifyDeployment(deployment, pods, expectedZero);
+    if (!finding || finding.fault !== "crash-loop") continue;
+    const podName = finding.pod?.metadata?.name;
+    if (typeof podName !== "string" || podName.length === 0) continue;
+    out.push({ podName, ...finding.container ? { container: finding.container } : {} });
+  }
+  return out;
+}
 function classifyDeployment(deployment, pods, expectedZero) {
   const name = deployment.metadata?.name ?? "";
   const desired = typeof deployment.spec?.replicas === "number" ? deployment.spec.replicas : 1;
@@ -25755,12 +25945,13 @@ function classifyDeployment(deployment, pods, expectedZero) {
     attributes: { "k8s.desiredReplicas": desired, "k8s.readyReplicas": ready }
   };
 }
-function mapDeploymentToSignal(deployment, pods, config) {
+function mapDeploymentToSignal(deployment, pods, config, logs) {
   const name = deployment.metadata?.name;
   if (typeof name !== "string" || name.length === 0) return null;
   const expectedZero = config.expectedZero ? new Set(config.expectedZero) : void 0;
   const finding = classifyDeployment(deployment, pods, expectedZero);
   if (!finding) return null;
+  mergeProcessContext(finding, logs);
   const serviceName = serviceNameFor(deployment, config);
   const namespace = deployment.metadata?.namespace ?? config.namespace;
   const attributes = {
@@ -25813,12 +26004,12 @@ function deployStateSignal(deployment, pods, config) {
     deployState: observedDeployState(deployment, pods)
   };
 }
-function mapWorkloadsToSignals(deployments, pods, config) {
+function mapWorkloadsToSignals(deployments, pods, config, logs) {
   const out = [];
   for (const deployment of deployments) {
     const deployState = deployStateSignal(deployment, pods, config);
     if (deployState) out.push(deployState);
-    const incident = mapDeploymentToSignal(deployment, pods, config);
+    const incident = mapDeploymentToSignal(deployment, pods, config, logs);
     if (incident) out.push(incident);
   }
   return out;
@@ -25917,6 +26108,8 @@ async function startK8sSubstratePolling(input) {
 }
 
 // src/connectors/kubernetes/index.ts
+var PROCESS_LOG_TAIL_LINES = 200;
+var PROCESS_LOG_LIMIT_BYTES = 64 * 1024;
 var KubernetesConnector = class {
   constructor(config, fetchImpl) {
     this.config = config;
@@ -25937,7 +26130,25 @@ var KubernetesConnector = class {
       fetchDeployments(transport, namespace, opts),
       fetchPods(transport, namespace, opts)
     ]);
-    return mapWorkloadsToSignals(deployments, pods, this.config);
+    const logs = await this.fetchFaultedPodLogs(transport, namespace, deployments, pods, opts);
+    return mapWorkloadsToSignals(deployments, pods, this.config, logs);
+  }
+  async fetchFaultedPodLogs(transport, namespace, deployments, pods, opts) {
+    const logs = /* @__PURE__ */ new Map();
+    const targets = faultedPods(deployments, pods, this.config);
+    await Promise.all(
+      targets.map(async (t) => {
+        const text = await fetchPodLog(transport, namespace, t.podName, {
+          ...t.container ? { container: t.container } : {},
+          tailLines: PROCESS_LOG_TAIL_LINES,
+          limitBytes: PROCESS_LOG_LIMIT_BYTES,
+          previous: true,
+          ...opts
+        });
+        if (typeof text === "string" && text.length > 0) logs.set(podLogKey(t.podName, t.container), text);
+      })
+    );
+    return logs;
   }
 };
 function createKubernetesConnector(graph, config, fetchImpl) {