@newrelic/preflight 1.67.3 → 1.69.0

package/dist/index.js

@@ -9,7 +9,7 @@ import { AlertSnapshotCollector } from './alerts/alert-snapshot-collector.js';
 import { LocalAlertEngine } from './alerts/local-alert-engine.js';
 import { parseLocalAlertRules } from './alerts/local-alert-rule.js';
 import { OsNotifier } from './alerts/os-notifier.js';
-import { DEFAULT_STORAGE_PATH, loadMcpConfig, redactSensitive } from './config.js';
+import { DEFAULT_STORAGE_PATH, digestWebhookUrlOverride, loadMcpConfig, redactSensitive, } from './config.js';
 import { checkBasicAuthToken } from './dashboard/basic-auth.js';
 import { DashboardServer } from './dashboard/dashboard-server.js';
 import { LiveEventBus } from './dashboard/index.js';
@@ -21,10 +21,13 @@ import { CopilotUsageWatcher } from './hooks/copilot-usage-watcher.js';
 import { HookEventProcessor } from './hooks/index.js';
 import { isPlatformDetectionFellBack } from './hooks/platform-detection-health.js';
 import { ParentTranscriptWatcher } from './hooks/parent-transcript-watcher.js';
+import { BilledTurnLedger, pruneBilledTurns } from './hooks/billed-turn-ledger.js';
 import { isSyntheticSessionId, readJobState, readTranscriptTitle, resolveFromBreadcrumb, resolveFromCwd, resolveFromJobDir, resolveSessionId, resolveSessionName, watchCwdBreadcrumbForCorrection, watchPpidBreadcrumb, } from './hooks/session-resolver.js';
 import { SubagentWatcher } from './hooks/subagent-watcher.js';
 import { WorkflowWatcher } from './hooks/workflow-watcher.js';
 import { migrateStoragePath } from './install/migrate.js';
+import { createHeadlessInstaller } from './install/headless-install.js';
+import { areHooksInstalledAtAnyScope } from './install/install-helper.js';
 import { checkNodeVersion } from './install/node-version-check.js';
 import { localDateKey } from './lib/date.js';
 import { repoNameFromRemote } from './lib/git-remote.js';
@@ -39,8 +42,7 @@ import { isTokenEventForThisProcess, shouldApplyCostEstimate, } from './metrics/
 import { ContextCompositionTracker } from './metrics/context-composition-tracker.js';
 import { ContextTrackerRegistry } from './metrics/context-tracker.js';
 import { ContextWindowTracker } from './metrics/context-window-tracker.js';
-import { applyPricingOverlay } from './metrics/pricing-overlay.js';
-import { startPricingRefresh } from './metrics/pricing-refresh.js';
+import { initModelPricing } from './metrics/pricing-init.js';
 import { buildCostForecastFromInputs } from './metrics/cost-forecast.js';
 import { CostPerOutcomeAnalyzer } from './metrics/cost-per-outcome.js';
 import { buildCostTrackerSeed } from './metrics/cost-tracker-seed.js';
@@ -61,6 +63,7 @@ import { QualityProxyTracker } from './metrics/quality-proxy-tracker.js';
 import { RecommendationEngine } from './metrics/recommendation-engine.js';
 import { RetryDetector } from './metrics/retry-detector.js';
 import { SessionTracker } from './metrics/session-tracker.js';
+import { SkillActivationTracker } from './metrics/skill-activation-tracker.js';
 import { TaskCompletionTracker } from './metrics/task-completion-tracker.js';
 import { buildTaskDetectorSeed } from './metrics/task-detector-seed.js';
 import { TaskDetector } from './metrics/task-detector.js';
@@ -70,7 +73,7 @@ import { TrendAnalyzer } from './metrics/trend-analyzer.js';
 import { TurnCostAttributor } from './metrics/turn-cost-attributor.js';
 import { TurnTracker } from './metrics/turn-tracker.js';
 import { WorkflowRunTracker } from './metrics/workflow-run-tracker.js';
-import { createDefaultRegistry, GenericMcpAdapter } from './platforms/index.js';
+import { ClaudeCodeAdapter, createDefaultRegistry, GenericMcpAdapter } from './platforms/index.js';
 import { ProxyManager } from './proxy/index.js';
 import { AuditTrailManager } from './security/audit-trail.js';
 import { createServer } from './server.js';
@@ -86,8 +89,9 @@ import { initMcpTracer } from './tracing/mcp-tracer.js';
 import { SessionSpan } from './tracing/session-span.js';
 import { TaskSpanTracker } from './tracing/task-span-tracker.js';
 import { emitToolCallSpan } from './tracing/tool-call-span.js';
+import { nrIngestOptionsFromConfig, sendAuditRecord } from './transport/audit-record-sender.js';
 import { NrIngestManager } from './transport/nr-ingest.js';
-import { UNFORWARDED_SESSIONS_HINT, UnforwardedSessionMonitor, detectCloudForwardingGap, } from './transport/unforwarded-session-monitor.js';
+import { unforwardedSessionsHint, UnforwardedSessionMonitor, detectCloudForwardingGap, } from './transport/unforwarded-session-monitor.js';
 import { HomelabAccumulator, HomelabForwarder } from './homelab/index.js';
 import { VERSION } from './version.js';
 export { loadMcpConfig, redactSensitive } from './config.js';
@@ -109,9 +113,9 @@ export function maskCredential(key) {
  * Helps users troubleshoot configuration issues without requiring
  * manual diagnosis steps.
  */
-function loadConfigOrDie(options) {
+function loadConfigOrDie(options, loadOptions) {
     try {
-        return loadMcpConfig(options);
+        return loadMcpConfig(options, loadOptions);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -221,8 +225,13 @@ export function runRetentionSweep(deps) {
         return;
     const deletedSessionFiles = purgeOldSessions(deps.storagePath, deps.retainSessionsDays);
     const deletedWeeklySummaryFiles = purgeOldWeeklySummaries(deps.storagePath, deps.retainSessionsDays);
-    if (deletedSessionFiles > 0 || deletedWeeklySummaryFiles > 0) {
-        logger.info('Retention purge complete', { deletedSessionFiles, deletedWeeklySummaryFiles });
+    const deletedBilledTurnDays = pruneBilledTurns(deps.storagePath, deps.retainSessionsDays, Date.now());
+    if (deletedSessionFiles > 0 || deletedWeeklySummaryFiles > 0 || deletedBilledTurnDays > 0) {
+        logger.info('Retention purge complete', {
+            deletedSessionFiles,
+            deletedWeeklySummaryFiles,
+            deletedBilledTurnDays,
+        });
     }
 }
 /**
@@ -566,13 +575,6 @@ export function parseArgs(argv) {
         validate,
     };
 }
-function initModelPricing(config) {
-    applyPricingOverlay(config.customPricingFile);
-    void startPricingRefresh({
-        enabled: config.pricingRefresh,
-        cachePath: resolve(config.storagePath, 'pricing-cache.json'),
-    });
-}
 async function main() {
     const nodeVersionError = checkNodeVersion();
     if (nodeVersionError) {
@@ -799,6 +801,21 @@ async function main() {
     process.on('SIGTERM', handleSignal);
     if (options.stdio || options.local) {
         let sessionTraceId;
+        // Sends the install's audit record at install time: a pending session that
+        // never resolves never builds a live ingest manager to send it later.
+        const buildHeadlessInstaller = () => createHeadlessInstaller({
+            allowHeadlessInstall: config.allowHeadlessInstall,
+            getAuditTrail: () => mcpServer?.auditTrailManager,
+            onAuditRecord: (record) => {
+                sendAuditRecord(record, {
+                    config: config,
+                    liveIngest: nrIngest,
+                    sessionTraceId,
+                }).catch((err) => {
+                    logger.warn('Failed to send the hook install audit event', { error: String(err) });
+                });
+            },
+        });
         // True when the synchronous resolution chain below succeeded ONLY via
         // the cwd fallback — the collision-prone source (shared by every
         // session that ever ran in this directory), unlike the ppid breadcrumb
@@ -887,9 +904,16 @@ async function main() {
                 if (!gap)
                     throw err;
                 process.env.NR_AI_MODE = 'local';
-                config = loadConfigOrDie(options);
+                config = loadConfigOrDie(options, { ignoreTiers: true });
                 unforwardedSessionMonitor = new UnforwardedSessionMonitor({ gap });
-                logger.warn(`Cloud export is configured (mode='${gap.requestedMode}') but this --local process has no ${gap.missingField}; sessions it drains will not reach New Relic`, { reason: gap.reason, requestedMode: gap.requestedMode, hint: UNFORWARDED_SESSIONS_HINT });
+                const problem = gap.reason === 'secret-helper-failed'
+                    ? `could not read ${gap.missingField} from its helper command`
+                    : `has no ${gap.missingField}`;
+                logger.warn(`Cloud export is configured (mode='${gap.requestedMode}') but this --local process ${problem}; sessions it drains will not reach New Relic`, {
+                    reason: gap.reason,
+                    requestedMode: gap.requestedMode,
+                    hint: unforwardedSessionsHint(gap.reason),
+                });
             }
             if (!config.enabled) {
                 logger.info('Server disabled via config — exiting');
@@ -921,8 +945,12 @@ async function main() {
         // dashboard owner's GC pass can tell which buffer files still have a live
         // owner. Removed in the shutdown handler below. Skipped during the
         // provisional window — the real heartbeat is written after resolution.
-        if (options.stdio && !isProvisional)
-            localStore.writeHeartbeat();
+        if (options.stdio && !isProvisional) {
+            localStore.writeHeartbeat(process.pid, process.argv.slice(1), process.cwd(), {
+                value: config.companionMode,
+                source: config.companionModeSource,
+            });
+        }
         localStoreForShutdown = localStore;
         // Migrate any pre-existing events from the legacy shared `buffer.jsonl` into
         // per-session files. Idempotent and a no-op on fresh installs.
@@ -1060,6 +1088,7 @@ async function main() {
         if (options.stdio)
             applyAuthoritativeSessionName(sessionTraceId);
         const turnCostAttributor = new TurnCostAttributor({ rateMultiplier });
+        const skillActivationTracker = new SkillActivationTracker();
         const turnTracker = new TurnTracker();
         const gitEfficiencyTracker = new GitEfficiencyTracker();
         const gitWorkspaceReporter = new GitWorkspaceReporter();
@@ -1703,30 +1732,11 @@ async function main() {
         // AiMcpToolCall/etc. event is silently dropped — see issue #320.
         let warnedMissingIngest = false;
         if (config.mode !== 'local' && !isProvisional) {
-            if (!config.licenseKey || !config.accountId) {
-                throw new Error('licenseKey and accountId must be defined. ' +
-                    'This should have been caught by config validation. ' +
-                    'Check that mode is not "local" or that cloud credentials are configured.');
-            }
             nrIngest = new NrIngestManager({
-                licenseKey: config.licenseKey,
-                transportOptions: {
-                    accountId: config.accountId,
-                    collectorHost: config.collectorHost,
-                },
-                developer: config.developer,
-                appName: config.appName,
-                teamId: config.teamId,
-                projectId: config.projectId,
-                orgId: config.orgId,
-                repoUrl: config.repoUrl,
-                companionMode: config.companionMode,
-                tiers: config.tiers,
+                ...nrIngestOptionsFromConfig(config),
                 sessionTracker,
                 localStore,
                 auditTrail,
-                eventHarvestIntervalMs: config.harvestIntervalMs.events,
-                metricHarvestIntervalMs: config.harvestIntervalMs.metrics,
                 costTracker,
                 efficiencyScorer,
                 feedbackCollector,
@@ -1806,7 +1816,9 @@ async function main() {
                 // record, so audit/security events carry agentId and agentType.
                 // The watcher's on-demand read is synchronous, which is what keeps it
                 // ahead of auditTrail.
-                const rawRecord = subagentAttribution.attributeAtIntake(incomingRecord, activeSubagentWatcher);
+                const attributed = subagentAttribution.attributeAtIntake(incomingRecord, activeSubagentWatcher);
+                const activeSkill = skillActivationTracker.recordToolCall(attributed);
+                const rawRecord = activeSkill ? { ...attributed, activeSkill } : attributed;
                 if (!config || !sessionTracker || !taskDetector) {
                     logger.warn('onRecord called before full initialization; skipping');
                     return;
@@ -2050,7 +2062,7 @@ async function main() {
                     ownSessionId: sessionTraceId,
                 });
                 const closedTurn = turnCostAttributor.recordTokenEvent(tokenEvent);
-                if (closedTurn && isOwnEvent)
+                if (isOwnEvent)
                     capturedNrIngest?.ingestTurnCost(closedTurn);
                 const usage = {
                     inputTokens: tokenEvent.inputTokens,
@@ -2300,7 +2312,9 @@ async function main() {
                 });
             },
             onUserPromptSubmit: (frame) => {
-                turnCostAttributor.recordSlashCommand(frame.sessionId, frame.slashCommand ?? null);
+                const slashRun = skillActivationTracker.recordPrompt(frame.sessionId, frame.slashCommand ?? null);
+                if (slashRun)
+                    turnCostAttributor.recordSkillRun(frame.sessionId, slashRun);
                 taskDetector.startTaskIfNone(frame.timestamp);
             },
             onStop: (frame) => {
@@ -2455,6 +2469,11 @@ async function main() {
         // signal for that platform, so it is gated only by its own opt-out, and
         // it no-ops cheaply (a single existsSync) when data.db is absent.
         const copilotAppUsageWatcherEnabled = process.env['NR_AI_ENABLE_COPILOT_APP_USAGE_WATCHER'] !== '0';
+        // One claimant per process, shared by every watcher that bills turns.
+        const billedTurnLedger = new BilledTurnLedger({
+            storagePath: config.storagePath,
+            retainDays: config.retainSessionsDays,
+        });
         // Construct + start the watchers for a given session id. In `--stdio` mode
         // the watchers filter discovered transcript dirs by `parentSessionId`; in
         // `--local` mode they run unfiltered (parentSessionId: undefined). Shared by
@@ -2479,6 +2498,7 @@ async function main() {
                     storagePath: config.storagePath,
                     parentSessionId: isStdioWatcher ? watcherSessionId : undefined,
                     localStore,
+                    ledger: billedTurnLedger,
                 });
                 activeParentTranscriptWatcher.start();
                 logger.info('ParentTranscriptWatcher started', {
@@ -2656,7 +2676,10 @@ async function main() {
             // Replace the current LocalStore with one scoped to the real id.
             const realLocalStore = new LocalStore(config.storagePath, realId);
             realLocalStore.initialize();
-            realLocalStore.writeHeartbeat();
+            realLocalStore.writeHeartbeat(process.pid, process.argv.slice(1), process.cwd(), {
+                value: config.companionMode,
+                source: config.companionModeSource,
+            });
             localStoreForShutdown = realLocalStore;
             try {
                 realLocalStore.migrateLegacyBuffer();
@@ -2688,29 +2711,11 @@ async function main() {
                 });
             }
             if (config.mode !== 'local') {
-                if (!config.licenseKey || !config.accountId) {
-                    throw new Error('licenseKey and accountId must be defined for non-local mode. ' +
-                        'This should have been caught by config validation.');
-                }
                 nrIngest = new NrIngestManager({
-                    licenseKey: config.licenseKey,
-                    transportOptions: {
-                        accountId: config.accountId,
-                        collectorHost: config.collectorHost,
-                    },
-                    developer: config.developer,
-                    appName: config.appName,
-                    teamId: config.teamId,
-                    projectId: config.projectId,
-                    orgId: config.orgId,
-                    repoUrl: config.repoUrl,
-                    companionMode: config.companionMode,
-                    tiers: config.tiers,
+                    ...nrIngestOptionsFromConfig(config),
                     sessionTracker: sessionTracker,
                     localStore: realLocalStore,
                     auditTrail,
-                    eventHarvestIntervalMs: config.harvestIntervalMs.events,
-                    metricHarvestIntervalMs: config.harvestIntervalMs.metrics,
                     costTracker,
                     efficiencyScorer,
                     feedbackCollector,
@@ -2737,13 +2742,17 @@ async function main() {
                 accountId: config.accountId ?? null,
                 licenseKeyMasked: config.licenseKey ? maskCredential(config.licenseKey) : null,
                 nrApiKeyMasked: config.nrApiKey ? maskCredential(config.nrApiKey) : null,
+                secretSources: config.secretSources,
                 region: config.collectorHost ?? 'us',
                 storagePath: config.storagePath,
                 dashboardUrl: `http://${config.dashboard.host}:${config.dashboard.port}`,
                 configFilePath,
                 companionMode: config.companionMode,
+                allowHeadlessInstall: config.allowHeadlessInstall,
+                companionModeSource: config.companionModeSource,
             };
             registerTools(mcpServer.server, {
+                headlessInstaller: buildHeadlessInstaller(),
                 sessionTracker: sessionTracker,
                 costTracker,
                 budgetTracker,
@@ -2788,6 +2797,7 @@ async function main() {
                 nrApiKey: config.nrApiKey,
                 collectorHost: config.collectorHost,
                 configFilePath,
+                digestWebhookUrlOverride: digestWebhookUrlOverride(config),
                 configSummary,
             });
             // The client cached tools/list during the pending window, when only the
@@ -2899,12 +2909,22 @@ async function main() {
                         accountId: config.accountId ?? null,
                         licenseKeyMasked: config.licenseKey ? maskCredential(config.licenseKey) : null,
                         nrApiKeyMasked: config.nrApiKey ? maskCredential(config.nrApiKey) : null,
+                        secretSources: config.secretSources,
                         region: config.collectorHost ?? 'us',
                         storagePath: config.storagePath,
                         dashboardUrl: `http://${config.dashboard.host}:${config.dashboard.port}`,
                         configFilePath: pendingConfigFilePath,
                         companionMode: config.companionMode,
+                        allowHeadlessInstall: config.allowHeadlessInstall,
+                        companionModeSource: config.companionModeSource,
                     },
+                    // A Claude Code session with no hooks never resolves, so this is
+                    // where the opt-in install has to work. Other stdio clients have no
+                    // Claude Code hooks to install or report missing.
+                    ...(createDefaultRegistry().getActive() instanceof ClaudeCodeAdapter && {
+                        hooksInstalledFn: () => areHooksInstalledAtAnyScope(),
+                        headlessInstaller: buildHeadlessInstaller(),
+                    }),
                 });
                 logger.info('Dashboard started early; awaiting session_id resolution (breadcrumb poll)');
                 sessionResolutionAbort = new AbortController();
@@ -2963,13 +2983,17 @@ async function main() {
                     accountId: config.accountId ?? null,
                     licenseKeyMasked: config.licenseKey ? maskCredential(config.licenseKey) : null,
                     nrApiKeyMasked: config.nrApiKey ? maskCredential(config.nrApiKey) : null,
+                    secretSources: config.secretSources,
                     region: config.collectorHost ?? 'us',
                     storagePath: config.storagePath,
                     dashboardUrl: `http://${config.dashboard.host}:${config.dashboard.port}`,
                     configFilePath,
                     companionMode: config.companionMode,
+                    allowHeadlessInstall: config.allowHeadlessInstall,
+                    companionModeSource: config.companionModeSource,
                 };
                 registerTools(mcpServer.server, {
+                    headlessInstaller: buildHeadlessInstaller(),
                     sessionTracker,
                     costTracker,
                     budgetTracker,
@@ -3014,6 +3038,7 @@ async function main() {
                     nrApiKey: config.nrApiKey,
                     collectorHost: config.collectorHost,
                     configFilePath,
+                    digestWebhookUrlOverride: digestWebhookUrlOverride(config),
                     configSummary,
                 });
                 // Harmless if the client hasn't listed yet, and necessary if it listed
@@ -3069,11 +3094,7 @@ async function main() {
         // load-time validation), so this mirrors that guard rather than
         // re-deriving it.
         if (config.mode !== 'local') {
-            if (!config.licenseKey || !config.accountId) {
-                throw new Error('licenseKey and accountId must be defined. ' +
-                    'This should have been caught by config validation. ' +
-                    'Check that mode is not "local" or that cloud credentials are configured.');
-            }
+            const configOptions = nrIngestOptionsFromConfig(config);
             // Unscoped LocalStore (mirrors --local mode) — proxy mode multiplexes
             // many concurrent clients, so there's no single session id to scope a
             // buffer file to. Passing it into NrIngestManager gives AuditTrailManager
@@ -3089,23 +3110,9 @@ async function main() {
             // to handle a missing tracker.
             const apiFailureTracker = new ApiFailureTracker();
             nrIngest = new NrIngestManager({
-                licenseKey: config.licenseKey,
-                transportOptions: {
-                    accountId: config.accountId,
-                    collectorHost: config.collectorHost,
-                },
-                developer: config.developer,
-                appName: config.appName,
-                teamId: config.teamId,
-                projectId: config.projectId,
-                orgId: config.orgId,
-                repoUrl: config.repoUrl,
-                companionMode: config.companionMode,
-                tiers: config.tiers,
+                ...configOptions,
                 sessionTracker: new SessionTracker(sessionTraceId),
                 localStore: proxyLocalStore,
-                eventHarvestIntervalMs: config.harvestIntervalMs.events,
-                metricHarvestIntervalMs: config.harvestIntervalMs.metrics,
                 apiFailureTracker,
                 sessionTraceId,
                 // Proxy mode has no single coherent session — sessionTracker above is