@newrelic/preflight 1.67.3 → 1.68.0

package/dist/index.js

@@ -9,7 +9,7 @@ import { AlertSnapshotCollector } from './alerts/alert-snapshot-collector.js';
 import { LocalAlertEngine } from './alerts/local-alert-engine.js';
 import { parseLocalAlertRules } from './alerts/local-alert-rule.js';
 import { OsNotifier } from './alerts/os-notifier.js';
-import { DEFAULT_STORAGE_PATH, loadMcpConfig, redactSensitive } from './config.js';
+import { DEFAULT_STORAGE_PATH, digestWebhookUrlOverride, loadMcpConfig, redactSensitive, } from './config.js';
 import { checkBasicAuthToken } from './dashboard/basic-auth.js';
 import { DashboardServer } from './dashboard/dashboard-server.js';
 import { LiveEventBus } from './dashboard/index.js';
@@ -25,6 +25,8 @@ import { isSyntheticSessionId, readJobState, readTranscriptTitle, resolveFromBre
 import { SubagentWatcher } from './hooks/subagent-watcher.js';
 import { WorkflowWatcher } from './hooks/workflow-watcher.js';
 import { migrateStoragePath } from './install/migrate.js';
+import { createHeadlessInstaller } from './install/headless-install.js';
+import { areHooksInstalledAtAnyScope } from './install/install-helper.js';
 import { checkNodeVersion } from './install/node-version-check.js';
 import { localDateKey } from './lib/date.js';
 import { repoNameFromRemote } from './lib/git-remote.js';
@@ -39,8 +41,7 @@ import { isTokenEventForThisProcess, shouldApplyCostEstimate, } from './metrics/
 import { ContextCompositionTracker } from './metrics/context-composition-tracker.js';
 import { ContextTrackerRegistry } from './metrics/context-tracker.js';
 import { ContextWindowTracker } from './metrics/context-window-tracker.js';
-import { applyPricingOverlay } from './metrics/pricing-overlay.js';
-import { startPricingRefresh } from './metrics/pricing-refresh.js';
+import { initModelPricing } from './metrics/pricing-init.js';
 import { buildCostForecastFromInputs } from './metrics/cost-forecast.js';
 import { CostPerOutcomeAnalyzer } from './metrics/cost-per-outcome.js';
 import { buildCostTrackerSeed } from './metrics/cost-tracker-seed.js';
@@ -70,7 +71,7 @@ import { TrendAnalyzer } from './metrics/trend-analyzer.js';
 import { TurnCostAttributor } from './metrics/turn-cost-attributor.js';
 import { TurnTracker } from './metrics/turn-tracker.js';
 import { WorkflowRunTracker } from './metrics/workflow-run-tracker.js';
-import { createDefaultRegistry, GenericMcpAdapter } from './platforms/index.js';
+import { ClaudeCodeAdapter, createDefaultRegistry, GenericMcpAdapter } from './platforms/index.js';
 import { ProxyManager } from './proxy/index.js';
 import { AuditTrailManager } from './security/audit-trail.js';
 import { createServer } from './server.js';
@@ -86,8 +87,9 @@ import { initMcpTracer } from './tracing/mcp-tracer.js';
 import { SessionSpan } from './tracing/session-span.js';
 import { TaskSpanTracker } from './tracing/task-span-tracker.js';
 import { emitToolCallSpan } from './tracing/tool-call-span.js';
+import { nrIngestOptionsFromConfig, sendAuditRecord } from './transport/audit-record-sender.js';
 import { NrIngestManager } from './transport/nr-ingest.js';
-import { UNFORWARDED_SESSIONS_HINT, UnforwardedSessionMonitor, detectCloudForwardingGap, } from './transport/unforwarded-session-monitor.js';
+import { unforwardedSessionsHint, UnforwardedSessionMonitor, detectCloudForwardingGap, } from './transport/unforwarded-session-monitor.js';
 import { HomelabAccumulator, HomelabForwarder } from './homelab/index.js';
 import { VERSION } from './version.js';
 export { loadMcpConfig, redactSensitive } from './config.js';
@@ -566,13 +568,6 @@ export function parseArgs(argv) {
         validate,
     };
 }
-function initModelPricing(config) {
-    applyPricingOverlay(config.customPricingFile);
-    void startPricingRefresh({
-        enabled: config.pricingRefresh,
-        cachePath: resolve(config.storagePath, 'pricing-cache.json'),
-    });
-}
 async function main() {
     const nodeVersionError = checkNodeVersion();
     if (nodeVersionError) {
@@ -799,6 +794,21 @@ async function main() {
     process.on('SIGTERM', handleSignal);
     if (options.stdio || options.local) {
         let sessionTraceId;
+        // Sends the install's audit record at install time: a pending session that
+        // never resolves never builds a live ingest manager to send it later.
+        const buildHeadlessInstaller = () => createHeadlessInstaller({
+            allowHeadlessInstall: config.allowHeadlessInstall,
+            getAuditTrail: () => mcpServer?.auditTrailManager,
+            onAuditRecord: (record) => {
+                sendAuditRecord(record, {
+                    config: config,
+                    liveIngest: nrIngest,
+                    sessionTraceId,
+                }).catch((err) => {
+                    logger.warn('Failed to send the hook install audit event', { error: String(err) });
+                });
+            },
+        });
         // True when the synchronous resolution chain below succeeded ONLY via
         // the cwd fallback — the collision-prone source (shared by every
         // session that ever ran in this directory), unlike the ppid breadcrumb
@@ -889,7 +899,14 @@ async function main() {
                 process.env.NR_AI_MODE = 'local';
                 config = loadConfigOrDie(options);
                 unforwardedSessionMonitor = new UnforwardedSessionMonitor({ gap });
-                logger.warn(`Cloud export is configured (mode='${gap.requestedMode}') but this --local process has no ${gap.missingField}; sessions it drains will not reach New Relic`, { reason: gap.reason, requestedMode: gap.requestedMode, hint: UNFORWARDED_SESSIONS_HINT });
+                const problem = gap.reason === 'secret-helper-failed'
+                    ? `could not read ${gap.missingField} from its helper command`
+                    : `has no ${gap.missingField}`;
+                logger.warn(`Cloud export is configured (mode='${gap.requestedMode}') but this --local process ${problem}; sessions it drains will not reach New Relic`, {
+                    reason: gap.reason,
+                    requestedMode: gap.requestedMode,
+                    hint: unforwardedSessionsHint(gap.reason),
+                });
             }
             if (!config.enabled) {
                 logger.info('Server disabled via config — exiting');
@@ -921,8 +938,12 @@ async function main() {
         // dashboard owner's GC pass can tell which buffer files still have a live
         // owner. Removed in the shutdown handler below. Skipped during the
         // provisional window — the real heartbeat is written after resolution.
-        if (options.stdio && !isProvisional)
-            localStore.writeHeartbeat();
+        if (options.stdio && !isProvisional) {
+            localStore.writeHeartbeat(process.pid, process.argv.slice(1), process.cwd(), {
+                value: config.companionMode,
+                source: config.companionModeSource,
+            });
+        }
         localStoreForShutdown = localStore;
         // Migrate any pre-existing events from the legacy shared `buffer.jsonl` into
         // per-session files. Idempotent and a no-op on fresh installs.
@@ -1703,30 +1724,11 @@ async function main() {
         // AiMcpToolCall/etc. event is silently dropped — see issue #320.
         let warnedMissingIngest = false;
         if (config.mode !== 'local' && !isProvisional) {
-            if (!config.licenseKey || !config.accountId) {
-                throw new Error('licenseKey and accountId must be defined. ' +
-                    'This should have been caught by config validation. ' +
-                    'Check that mode is not "local" or that cloud credentials are configured.');
-            }
             nrIngest = new NrIngestManager({
-                licenseKey: config.licenseKey,
-                transportOptions: {
-                    accountId: config.accountId,
-                    collectorHost: config.collectorHost,
-                },
-                developer: config.developer,
-                appName: config.appName,
-                teamId: config.teamId,
-                projectId: config.projectId,
-                orgId: config.orgId,
-                repoUrl: config.repoUrl,
-                companionMode: config.companionMode,
-                tiers: config.tiers,
+                ...nrIngestOptionsFromConfig(config),
                 sessionTracker,
                 localStore,
                 auditTrail,
-                eventHarvestIntervalMs: config.harvestIntervalMs.events,
-                metricHarvestIntervalMs: config.harvestIntervalMs.metrics,
                 costTracker,
                 efficiencyScorer,
                 feedbackCollector,
@@ -2656,7 +2658,10 @@ async function main() {
             // Replace the current LocalStore with one scoped to the real id.
             const realLocalStore = new LocalStore(config.storagePath, realId);
             realLocalStore.initialize();
-            realLocalStore.writeHeartbeat();
+            realLocalStore.writeHeartbeat(process.pid, process.argv.slice(1), process.cwd(), {
+                value: config.companionMode,
+                source: config.companionModeSource,
+            });
             localStoreForShutdown = realLocalStore;
             try {
                 realLocalStore.migrateLegacyBuffer();
@@ -2688,29 +2693,11 @@ async function main() {
                 });
             }
             if (config.mode !== 'local') {
-                if (!config.licenseKey || !config.accountId) {
-                    throw new Error('licenseKey and accountId must be defined for non-local mode. ' +
-                        'This should have been caught by config validation.');
-                }
                 nrIngest = new NrIngestManager({
-                    licenseKey: config.licenseKey,
-                    transportOptions: {
-                        accountId: config.accountId,
-                        collectorHost: config.collectorHost,
-                    },
-                    developer: config.developer,
-                    appName: config.appName,
-                    teamId: config.teamId,
-                    projectId: config.projectId,
-                    orgId: config.orgId,
-                    repoUrl: config.repoUrl,
-                    companionMode: config.companionMode,
-                    tiers: config.tiers,
+                    ...nrIngestOptionsFromConfig(config),
                     sessionTracker: sessionTracker,
                     localStore: realLocalStore,
                     auditTrail,
-                    eventHarvestIntervalMs: config.harvestIntervalMs.events,
-                    metricHarvestIntervalMs: config.harvestIntervalMs.metrics,
                     costTracker,
                     efficiencyScorer,
                     feedbackCollector,
@@ -2737,13 +2724,17 @@ async function main() {
                 accountId: config.accountId ?? null,
                 licenseKeyMasked: config.licenseKey ? maskCredential(config.licenseKey) : null,
                 nrApiKeyMasked: config.nrApiKey ? maskCredential(config.nrApiKey) : null,
+                secretSources: config.secretSources,
                 region: config.collectorHost ?? 'us',
                 storagePath: config.storagePath,
                 dashboardUrl: `http://${config.dashboard.host}:${config.dashboard.port}`,
                 configFilePath,
                 companionMode: config.companionMode,
+                allowHeadlessInstall: config.allowHeadlessInstall,
+                companionModeSource: config.companionModeSource,
             };
             registerTools(mcpServer.server, {
+                headlessInstaller: buildHeadlessInstaller(),
                 sessionTracker: sessionTracker,
                 costTracker,
                 budgetTracker,
@@ -2788,6 +2779,7 @@ async function main() {
                 nrApiKey: config.nrApiKey,
                 collectorHost: config.collectorHost,
                 configFilePath,
+                digestWebhookUrlOverride: digestWebhookUrlOverride(config),
                 configSummary,
             });
             // The client cached tools/list during the pending window, when only the
@@ -2899,12 +2891,22 @@ async function main() {
                         accountId: config.accountId ?? null,
                         licenseKeyMasked: config.licenseKey ? maskCredential(config.licenseKey) : null,
                         nrApiKeyMasked: config.nrApiKey ? maskCredential(config.nrApiKey) : null,
+                        secretSources: config.secretSources,
                         region: config.collectorHost ?? 'us',
                         storagePath: config.storagePath,
                         dashboardUrl: `http://${config.dashboard.host}:${config.dashboard.port}`,
                         configFilePath: pendingConfigFilePath,
                         companionMode: config.companionMode,
+                        allowHeadlessInstall: config.allowHeadlessInstall,
+                        companionModeSource: config.companionModeSource,
                     },
+                    // A Claude Code session with no hooks never resolves, so this is
+                    // where the opt-in install has to work. Other stdio clients have no
+                    // Claude Code hooks to install or report missing.
+                    ...(createDefaultRegistry().getActive() instanceof ClaudeCodeAdapter && {
+                        hooksInstalledFn: () => areHooksInstalledAtAnyScope(),
+                        headlessInstaller: buildHeadlessInstaller(),
+                    }),
                 });
                 logger.info('Dashboard started early; awaiting session_id resolution (breadcrumb poll)');
                 sessionResolutionAbort = new AbortController();
@@ -2963,13 +2965,17 @@ async function main() {
                     accountId: config.accountId ?? null,
                     licenseKeyMasked: config.licenseKey ? maskCredential(config.licenseKey) : null,
                     nrApiKeyMasked: config.nrApiKey ? maskCredential(config.nrApiKey) : null,
+                    secretSources: config.secretSources,
                     region: config.collectorHost ?? 'us',
                     storagePath: config.storagePath,
                     dashboardUrl: `http://${config.dashboard.host}:${config.dashboard.port}`,
                     configFilePath,
                     companionMode: config.companionMode,
+                    allowHeadlessInstall: config.allowHeadlessInstall,
+                    companionModeSource: config.companionModeSource,
                 };
                 registerTools(mcpServer.server, {
+                    headlessInstaller: buildHeadlessInstaller(),
                     sessionTracker,
                     costTracker,
                     budgetTracker,
@@ -3014,6 +3020,7 @@ async function main() {
                     nrApiKey: config.nrApiKey,
                     collectorHost: config.collectorHost,
                     configFilePath,
+                    digestWebhookUrlOverride: digestWebhookUrlOverride(config),
                     configSummary,
                 });
                 // Harmless if the client hasn't listed yet, and necessary if it listed
@@ -3069,11 +3076,7 @@ async function main() {
         // load-time validation), so this mirrors that guard rather than
         // re-deriving it.
         if (config.mode !== 'local') {
-            if (!config.licenseKey || !config.accountId) {
-                throw new Error('licenseKey and accountId must be defined. ' +
-                    'This should have been caught by config validation. ' +
-                    'Check that mode is not "local" or that cloud credentials are configured.');
-            }
+            const configOptions = nrIngestOptionsFromConfig(config);
             // Unscoped LocalStore (mirrors --local mode) — proxy mode multiplexes
             // many concurrent clients, so there's no single session id to scope a
             // buffer file to. Passing it into NrIngestManager gives AuditTrailManager
@@ -3089,23 +3092,9 @@ async function main() {
             // to handle a missing tracker.
             const apiFailureTracker = new ApiFailureTracker();
             nrIngest = new NrIngestManager({
-                licenseKey: config.licenseKey,
-                transportOptions: {
-                    accountId: config.accountId,
-                    collectorHost: config.collectorHost,
-                },
-                developer: config.developer,
-                appName: config.appName,
-                teamId: config.teamId,
-                projectId: config.projectId,
-                orgId: config.orgId,
-                repoUrl: config.repoUrl,
-                companionMode: config.companionMode,
-                tiers: config.tiers,
+                ...configOptions,
                 sessionTracker: new SessionTracker(sessionTraceId),
                 localStore: proxyLocalStore,
-                eventHarvestIntervalMs: config.harvestIntervalMs.events,
-                metricHarvestIntervalMs: config.harvestIntervalMs.metrics,
                 apiFailureTracker,
                 sessionTraceId,
                 // Proxy mode has no single coherent session — sessionTracker above is