@nurix/nustack 0.20.1 → 0.20.3

package/dist/commands/telemetry.js

@@ -4,9 +4,9 @@ import { printJsonSuccess } from "../lib/json_output.js";
 import { openLocalStore } from "../lib/local_store/database.js";
 import { getBindingByRepositoryRoot, listActiveBindings, setBindingTelemetry, } from "../lib/local_store/bindings.js";
 import { upsertFilebeatState } from "../lib/local_store/filebeat_state.js";
-import { ensureFilebeatBinary, unregisterService } from "../lib/filebeat_installer.js";
+import { ensureFilebeatBinary } from "../lib/filebeat_installer.js";
 import { collectTelemetryStatus } from "../lib/telemetry/health_report.js";
-import { ensureBindingTelemetry } from "../lib/session_telemetry.js";
+import { ensureBindingTelemetry, setLocalOutput, switchMachineOff } from "../lib/session_telemetry.js";
 import { resolveRepository } from "../lib/git-sync/core/repository.js";
 function resolveTargetBinding(store, options) {
     if (options.device)
@@ -50,6 +50,38 @@ export async function runTelemetry(action, options) {
             p.outro("Telemetry status.");
             return;
         }
+        if (action === "output") {
+            const elkUrl = options.elasticUrl ?? process.env.NUSTACK_ELASTIC_URL;
+            const apiKey = process.env.NUSTACK_ELASTIC_API_KEY;
+            if (!elkUrl || !apiKey) {
+                throw new Error("telemetry output needs --elastic-url (or NUSTACK_ELASTIC_URL) and NUSTACK_ELASTIC_API_KEY in the environment");
+            }
+            const result = await setLocalOutput({
+                baseUrl: resolveNuStackUrl(options),
+                store,
+                elkUrl,
+                apiKey,
+                index: options.index,
+            });
+            const status = await collectTelemetryStatus(store, undefined, verbose);
+            if (!result.ok) {
+                process.exitCode = 1;
+                if (json) {
+                    printJsonSuccess("telemetry output", { scope: "device", bindingId: null, applied: false, errorCode: result.errorCode, ...status });
+                    return;
+                }
+                p.log.error(`The shipper refused the output (${result.errorCode}); the previous config is still live.`);
+                return;
+            }
+            if (json) {
+                printJsonSuccess("telemetry output", { scope: "device", bindingId: null, applied: true, ...status });
+                return;
+            }
+            p.intro("nustack telemetry output");
+            p.log.success(`Shipping to ${new URL(elkUrl).host}; reconciled ${result.reconciled} folder${result.reconciled === 1 ? "" : "s"}; install state ${status.filebeatState}.`);
+            p.outro("A credential the server brokers later replaces this output.");
+            return;
+        }
         const target = action === "reinstall" ? null : resolveTargetBinding(store, options);
         if (target) {
             const enabled = action === "enable";
@@ -69,22 +101,24 @@ export async function runTelemetry(action, options) {
             p.intro(`nustack telemetry ${action}`);
             p.log.success(enabled
                 ? `${folderLabel(target)} is shipping. Other folders are unchanged.`
-                : `${folderLabel(target)} has stopped shipping and its input config is removed. Other folders are unchanged.`);
+                : `${folderLabel(target)} has stopped shipping; nothing it records while off will ever ship. Other folders are unchanged.`);
             p.outro(`Run \`nustack telemetry ${enabled ? "disable" : "enable"}\` here to reverse it.`);
             return;
         }
         if (action === "disable") {
-            unregisterService();
-            upsertFilebeatState(store, { telemetryEnabled: false, processState: "stopped" });
+            const result = await switchMachineOff({ store });
             if (json) {
                 printJsonSuccess("telemetry disable", {
                     scope: "device",
                     bindingId: null,
                     telemetryEnabled: false,
+                    shipper: result,
                 });
                 return;
             }
-            p.log.success("Stopped the telemetry shipper on this machine; every folder reports disabled (Document sync untouched).");
+            p.log.success(result === "skipping"
+                ? "Telemetry is off on this machine: the shipper keeps reading and discards everything, so nothing recorded while off will ever ship (Document sync untouched)."
+                : "Telemetry is off on this machine. The shipper refused the switch-off config, so it was stopped instead: sessions recorded while off will ship when you turn it back on.");
             p.outro("Run `nustack telemetry enable` to resume.");
             return;
         }

package/dist/index.js

@@ -179,18 +179,22 @@ device
     .action(async (deviceId, options) => runDeviceRevoke(deviceId, options, program.opts()));
 program
     .command("telemetry [action]")
-    .description("Inspect or control telemetry (status | enable | disable | reinstall). Inside a bound folder, enable/disable move that folder alone")
+    .description("Inspect or control telemetry (status | enable | disable | reinstall | output). Inside a bound folder, enable/disable move that folder alone; output points the shipper at your own Elastic, its key read from NUSTACK_ELASTIC_API_KEY")
     .option("--json", "emit the versioned machine envelope")
     .option("--device", "move this machine's switch instead of the current folder's")
     .option("--local-verbose", "include each folder's absolute path (local consumers only — never pipe into a log)")
+    .option("--elastic-url <url>", "output: the Elastic endpoint (default NUSTACK_ELASTIC_URL)")
+    .option("--index <name>", "output: the index events are written to (default claude-sessions)")
     .action(async (action, options) => {
-    const allowed = ["status", "enable", "disable", "reinstall"];
+    const allowed = ["status", "enable", "disable", "reinstall", "output"];
     const chosen = (allowed.includes(action ?? "") ? action : "status");
     return runTelemetry(chosen, {
         ...program.opts(),
         json: options.json,
         device: options.device,
         localVerbose: options.localVerbose,
+        elasticUrl: options.elasticUrl,
+        index: options.index,
     });
 });
 const toLimit = (value) => Number.parseInt(value, 10);

package/dist/lib/session_telemetry.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
-import { readdir } from "node:fs/promises";
+import { readFile, readdir } from "node:fs/promises";
 import path from "node:path";
 import { ensureAccessToken } from "./auth_grant.js";
 import { fetchBrokeredCredential } from "./nustack_client.js";
@@ -9,8 +9,8 @@ import { openLocalStore } from "./local_store/database.js";
 import { readDeviceState } from "./local_store/device_state.js";
 import { listActiveBindings } from "./local_store/bindings.js";
 import { listActivityBindings, readFilebeatState, upsertActivityBinding, upsertFilebeatState, } from "./local_store/filebeat_state.js";
-import { ensureFilebeatBinary, filebeatBinPath, filebeatDir, desiredFilebeatVersion, observedFilebeatVersion, probeServiceRegistered, registerAndStartService, restartService, testFilebeatConfig, } from "./filebeat_installer.js";
-import { renderBindingInput, renderCentralConfig, renderCodexSharedInput, } from "./telemetry/config_renderer.js";
+import { ensureFilebeatBinary, filebeatBinPath, filebeatDir, mainConfigPath, desiredFilebeatVersion, observedFilebeatVersion, probeServiceRegistered, registerAndStartService, restartService, testFilebeatConfig, unregisterService, } from "./filebeat_installer.js";
+import { INPUTS_FILE, LOCAL_OUTPUT_HEADER, renderCentralConfig, renderInputsFile, } from "./telemetry/config_renderer.js";
 import { applyConfigChange, removeInputFile } from "./telemetry/reload.js";
 import { discoverProviderBindings } from "./telemetry/provider_paths.js";
 import { reportTelemetryHealth } from "./telemetry/health_report.js";
@@ -28,6 +28,7 @@ function defaultSeams() {
         registerService: () => registerAndStartService(),
         serviceRegistered: () => probeServiceRegistered(),
         restartService: () => restartService(),
+        unregisterService: () => unregisterService(),
         fetchImpl: fetch,
         ensureAccessToken: (baseUrl) => ensureAccessToken(baseUrl),
     };
@@ -109,62 +110,64 @@ export async function ensureBindingTelemetry(opts) {
         const device = readDeviceState(store);
         const deviceRef = device?.deviceRef ?? "";
         const userId = device?.activeUserId ?? "";
+        const localOutput = await hasLocalOutput();
         const auth = await seams.ensureAccessToken(baseUrl);
-        if (!auth) {
+        if (!auth && !localOutput) {
             recordDegraded(store, "no_device_token");
             await reportBestEffort(baseUrl, store, seams, null);
             return;
         }
+        const accessToken = auth?.accessToken ?? null;
         if (!binding.telemetryEnabled) {
             await removeBindingTelemetry({ store, bindingId: binding.id, seams: opts.seams });
-            await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+            await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
         let brokerFailure = null;
-        const credential = await fetchBrokeredCredential(baseUrl, auth.accessToken, {
-            projectId: binding.projectId,
-            service: TELEMETRY_SERVICE,
-        }).catch((error) => {
-            brokerFailure = error instanceof Error ? error.message : String(error);
-            return null;
-        });
-        if (!credential?.url) {
+        const credential = accessToken
+            ? await fetchBrokeredCredential(baseUrl, accessToken, {
+                projectId: binding.projectId,
+                service: TELEMETRY_SERVICE,
+            }).catch((error) => {
+                brokerFailure = error instanceof Error ? error.message : String(error);
+                return null;
+            })
+            : null;
+        if (!credential?.url && !localOutput) {
             const unserved = brokerFailure !== null && brokerFailure.includes("does not serve");
             recordDegraded(store, unserved ? "credential_plane_unserved" : "no_output_credential");
-            await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+            await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
-        const index = credential.meta?.index || DEFAULT_INDEX;
-        const central = {
-            relativePath: "filebeat.yml",
-            contents: renderCentralConfig({ elkUrl: credential.url, apiKey: credential.key, index }),
-        };
-        const centralApply = await applyConfigChange({
-            files: [central],
-            scope: "central",
-            context: centralReloadContext(seams, filebeatDir()),
-        });
-        if (!centralApply.ok) {
-            recordDegraded(store, centralApply.errorCode);
-            await reportBestEffort(baseUrl, store, seams, auth.accessToken);
-            return;
+        if (credential?.url) {
+            const index = credential.meta?.index || DEFAULT_INDEX;
+            const central = {
+                relativePath: "filebeat.yml",
+                contents: renderCentralConfig({ elkUrl: credential.url, apiKey: credential.key, index }),
+            };
+            const centralApply = await applyConfigChange({
+                files: [central],
+                scope: "central",
+                context: centralReloadContext(seams, filebeatDir()),
+            });
+            if (!centralApply.ok) {
+                recordDegraded(store, centralApply.errorCode);
+                await reportBestEffort(baseUrl, store, seams, accessToken);
+                return;
+            }
         }
         if (!seams.serviceRegistered())
             await seams.registerService();
-        const bindings = activeBindingSet(store, binding, deviceRef, userId);
-        const inputs = [
-            { relativePath: `inputs.d/${binding.id}.yml`, contents: renderBindingInput(toTelemetryBinding(binding, deviceRef, userId)) },
-            { relativePath: "inputs.d/codex-shared.yml", contents: renderCodexSharedInput(bindings) },
-        ];
-        await removeOrphanInputs(bindings);
+        const inputs = renderInputs(store, { id: binding.id, binding, enabled: true }, deviceRef, userId) ?? "";
+        await removeOrphanInputs();
         const inputsApply = await applyConfigChange({
-            files: inputs,
+            files: [{ relativePath: INPUTS_FILE, contents: inputs }],
             scope: "inputs",
             context: seams.reloadContext(filebeatDir()),
         });
         if (!inputsApply.ok) {
             recordDegraded(store, inputsApply.errorCode);
-            await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+            await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
         for (const discovered of discoverProviderBindings(binding.repositoryRoot)) {
@@ -185,31 +188,83 @@ export async function ensureBindingTelemetry(opts) {
             processState: "running",
             lastErrorCode: null,
         });
-        await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+        await reportBestEffort(baseUrl, store, seams, accessToken);
     }
     catch (error) {
         recordDegraded(store, "binding_reconcile_failed");
         void message(error);
     }
 }
+export async function hasLocalOutput() {
+    try {
+        const contents = await readFile(mainConfigPath(), "utf8");
+        return contents.split("\n", 1)[0] === LOCAL_OUTPUT_HEADER;
+    }
+    catch {
+        return false;
+    }
+}
+export async function setLocalOutput(opts) {
+    const seams = { ...defaultSeams(), ...opts.seams };
+    const { store, baseUrl } = opts;
+    await seams.ensureBinary(NO_OP_LOG);
+    const central = {
+        relativePath: "filebeat.yml",
+        contents: renderCentralConfig({
+            elkUrl: opts.elkUrl,
+            apiKey: opts.apiKey,
+            index: opts.index || DEFAULT_INDEX,
+            origin: "local",
+        }),
+    };
+    const centralApply = await applyConfigChange({
+        files: [central],
+        scope: "central",
+        context: centralReloadContext(seams, filebeatDir()),
+    });
+    if (!centralApply.ok) {
+        recordDegraded(store, centralApply.errorCode);
+        return { ok: false, errorCode: centralApply.errorCode };
+    }
+    if (!seams.serviceRegistered())
+        await seams.registerService();
+    upsertFilebeatState(store, {
+        binaryPath: existsSync(filebeatBinPath()) ? filebeatBinPath() : null,
+        configDir: filebeatDir(),
+        desiredVersion: desiredFilebeatVersion(),
+        observedVersion: observedFilebeatVersion(),
+        processState: "running",
+        telemetryEnabled: true,
+        lastErrorCode: null,
+    });
+    const bindings = listActiveBindings(store);
+    for (const binding of bindings) {
+        await ensureBindingTelemetry({ baseUrl, store, binding, seams: opts.seams });
+    }
+    if (bindings.length === 0)
+        await reportBestEffort(baseUrl, store, seams);
+    return { ok: true, reconciled: bindings.length };
+}
 export async function removeBindingTelemetry(opts) {
     const seams = { ...defaultSeams(), ...opts.seams };
     const { store, bindingId } = opts;
     try {
-        await removeInputFile(filebeatDir(), `inputs.d/${bindingId}.yml`);
         const device = readDeviceState(store);
-        const remaining = listActiveBindings(store)
-            .filter((b) => b.id !== bindingId)
-            .map((b) => toTelemetryBinding(b, device?.deviceRef ?? "", device?.activeUserId ?? ""));
-        if (remaining.length === 0) {
-            await removeInputFile(filebeatDir(), "inputs.d/codex-shared.yml");
+        await removeOrphanInputs();
+        const inputs = renderInputs(store, { id: bindingId, enabled: false }, device?.deviceRef ?? "", device?.activeUserId ?? "");
+        if (inputs === null) {
+            await removeInputFile(filebeatDir(), INPUTS_FILE);
         }
         else {
-            await applyConfigChange({
-                files: [{ relativePath: "inputs.d/codex-shared.yml", contents: renderCodexSharedInput(remaining) }],
+            const applied = await applyConfigChange({
+                files: [{ relativePath: INPUTS_FILE, contents: inputs }],
                 scope: "inputs",
                 context: seams.reloadContext(filebeatDir()),
             });
+            if (!applied.ok) {
+                await removeInputFile(filebeatDir(), INPUTS_FILE);
+                recordDegraded(store, applied.errorCode);
+            }
         }
         for (const row of listActivityBindings(store, bindingId)) {
             upsertActivityBinding(store, {
@@ -225,22 +280,53 @@ export async function removeBindingTelemetry(opts) {
     catch {
     }
 }
-function activeBindingSet(store, binding, deviceRef, userId) {
+export async function switchMachineOff(opts) {
+    const seams = { ...defaultSeams(), ...opts.seams };
+    const { store } = opts;
+    upsertFilebeatState(store, { telemetryEnabled: false });
+    const device = readDeviceState(store);
+    const deviceRef = device?.deviceRef ?? "";
+    const userId = device?.activeUserId ?? "";
+    const entries = listActiveBindings(store).map((b) => ({ binding: toTelemetryBinding(b, deviceRef, userId), enabled: false }));
+    try {
+        await removeOrphanInputs();
+        if (entries.length === 0) {
+            await removeInputFile(filebeatDir(), INPUTS_FILE);
+            return "skipping";
+        }
+        const applied = await applyConfigChange({
+            files: [{ relativePath: INPUTS_FILE, contents: renderInputsFile(entries, { deviceRef, userId }) }],
+            scope: "inputs",
+            context: seams.reloadContext(filebeatDir()),
+        });
+        if (applied.ok)
+            return "skipping";
+        recordDegraded(store, applied.errorCode);
+    }
+    catch {
+        recordDegraded(store, "config_invalid");
+    }
+    seams.unregisterService();
+    upsertFilebeatState(store, { processState: "stopped" });
+    return "stopped";
+}
+function renderInputs(store, reconciled, deviceRef, userId) {
     const byId = new Map();
     for (const b of listActiveBindings(store)) {
-        if (b.telemetryEnabled)
-            byId.set(b.id, toTelemetryBinding(b, deviceRef, userId));
+        byId.set(b.id, { binding: toTelemetryBinding(b, deviceRef, userId), enabled: b.telemetryEnabled });
     }
-    byId.set(binding.id, toTelemetryBinding(binding, deviceRef, userId));
-    return [...byId.values()];
+    const known = reconciled.binding ? toTelemetryBinding(reconciled.binding, deviceRef, userId) : byId.get(reconciled.id)?.binding;
+    if (known)
+        byId.set(reconciled.id, { binding: known, enabled: reconciled.enabled });
+    return byId.size === 0 ? null : renderInputsFile([...byId.values()], { deviceRef, userId });
 }
-async function removeOrphanInputs(bindings) {
+async function removeOrphanInputs() {
     const inputsDirPath = path.join(filebeatDir(), "inputs.d");
     if (!existsSync(inputsDirPath))
         return;
-    const keep = new Set(["codex-shared.yml", ...bindings.map((b) => `${b.bindingId}.yml`)]);
+    const keep = path.basename(INPUTS_FILE);
     for (const name of await readdir(inputsDirPath)) {
-        if (name.endsWith(".yml") && !keep.has(name)) {
+        if (name.endsWith(".yml") && name !== keep) {
             await removeInputFile(filebeatDir(), `inputs.d/${name}`);
         }
     }

package/dist/lib/telemetry/config_renderer.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { assertSafeApiKey, assertSafeElkUrl, assertSafeIndexName } from "../guards.js";
 import { claudeProjectDir, codexSessionsDir } from "./provider_paths.js";
 import { REDACTION_POLICY_VERSION, SLASH_COMMAND_CLOSE, SLASH_COMMAND_OPEN, providerDropFields, } from "./redaction_policy.js";
-export const TELEMETRY_CONFIG_VERSION = 2;
+export const TELEMETRY_CONFIG_VERSION = 3;
 export const ENVELOPE_SCHEMA_VERSION = 2;
 export function renderTemplate(template, vars) {
     return template.replace(/\{\{\s*([a-zA-Z0-9_]+)\s*\}\}/g, (_match, name) => {
@@ -32,7 +32,9 @@ export function claudeFilestreamId(repoRoot) {
 export function desiredConfigHash(bytes) {
     return createHash("sha256").update(bytes).digest("hex");
 }
-const CENTRAL_TEMPLATE = `# Managed by the nustack CLI — do not edit by hand.
+export const BROKERED_OUTPUT_HEADER = "# Managed by the nustack CLI — do not edit by hand.";
+export const LOCAL_OUTPUT_HEADER = "# Managed by the nustack CLI — local output set by `nustack telemetry output`; do not edit by hand.";
+const CENTRAL_TEMPLATE = `{{header}}
 filebeat.config.inputs:
   enabled: true
   path: \${path.config}/inputs.d/*.yml
@@ -60,9 +62,9 @@ output.elasticsearch:
   index: {{index}}
   ssl.verification_mode: full
 
+# The index and its template already exist, so the shipping key needs no template privilege.
 setup.ilm.enabled: false
-setup.template.name: {{index}}
-setup.template.pattern: {{index_pattern}}
+setup.template.enabled: false
 
 logging.level: warning
 `;
@@ -71,13 +73,21 @@ export function renderCentralConfig(opts) {
     const apiKey = assertSafeApiKey(opts.apiKey);
     const index = assertSafeIndexName(opts.index);
     return renderTemplate(CENTRAL_TEMPLATE, {
+        header: opts.origin === "local" ? LOCAL_OUTPUT_HEADER : BROKERED_OUTPUT_HEADER,
         elk_url: yamlScalar(elkUrl),
         api_key: yamlScalar(apiKey),
         index: yamlScalar(index),
-        index_pattern: yamlScalar(`${index}-*`),
     });
 }
-const BINDING_TEMPLATE = `# Managed by the nustack CLI — binding: {{binding_id_raw}}
+export const INPUTS_FILE = "inputs.d/inputs.yml";
+export const CODEX_INPUT_KEY = "codex-shared";
+const INPUTS_HEADER = `# Managed by the nustack CLI — one input per bound folder, then the shared Codex input.
+# A switched-off folder's input still reads its sessions and drops every event, so nothing written
+# while it is off ever ships — \`nustack telemetry enable | disable\` inside the folder flips it;
+# do not edit by hand.
+`;
+const BLOCK_MARKER = /^# (?:binding: (\S+)|codex: shared)$/gm;
+const BINDING_TEMPLATE = `# binding: {{binding_id_raw}}
 - type: filestream
   id: {{filestream_id}}
   paths:
@@ -109,8 +119,9 @@ const BINDING_TEMPLATE = `# Managed by the nustack CLI — binding: {{binding_id
         fields: [{{drop_fields}}]
         ignore_missing: true
 `;
-export function renderBindingInput(binding) {
-    return renderTemplate(BINDING_TEMPLATE, {
+const SWITCHED_OFF = "    - drop_event: {} # switched off: read and discarded, never shipped\n";
+export function renderBindingInput(binding, enabled = true) {
+    const block = renderTemplate(BINDING_TEMPLATE, {
         binding_id_raw: binding.bindingId,
         filestream_id: claudeFilestreamId(binding.repoRoot),
         claude_glob: yamlScalar(`${claudeProjectDir(binding.repoRoot)}/**/*.jsonl`),
@@ -126,15 +137,15 @@ export function renderBindingInput(binding) {
         slash_close: SLASH_COMMAND_CLOSE,
         drop_fields: providerDropFields("claude_code").join(", "),
     });
+    return enabled ? block : block.replace("\n  processors:\n", `\n  processors:\n${SWITCHED_OFF}`);
 }
-export function renderCodexSharedInput(bindings) {
-    if (bindings.length === 0) {
-        throw new Error("renderCodexSharedInput requires at least one binding");
-    }
-    const sorted = [...bindings].sort((a, b) => (a.bindingId < b.bindingId ? -1 : a.bindingId > b.bindingId ? 1 : 0));
-    const device = sorted[0];
+export function renderCodexSharedInput(entries, device) {
+    const ordered = [...entries].sort((a, b) => a.binding.bindingId < b.binding.bindingId ? -1 : a.binding.bindingId > b.binding.bindingId ? 1 : 0);
+    const sorted = ordered.filter((entry) => entry.enabled).map((entry) => entry.binding);
+    const drops = sorted.length === 0 ? SWITCHED_OFF : "";
     const conditionals = sorted
-        .map((binding) => `    - if:
+        .map((binding) => `
+    - if:
         equals:
           cwd: ${yamlScalar(binding.repoRoot)}
       then:
@@ -144,9 +155,9 @@ export function renderCodexSharedInput(bindings) {
               organization_id: ${yamlScalar(binding.organizationId)}
               project_id: ${yamlScalar(binding.projectId)}
               binding_id: ${yamlScalar(binding.bindingId)}`)
-        .join("\n");
+        .join("");
     const dropList = ["cwd", ...providerDropFields("codex")].join(", ");
-    return `# Managed by the nustack CLI — codex shared input (all bindings)
+    return `# codex: shared
 - type: filestream
   id: codex-shared
   paths:
@@ -158,7 +169,7 @@ export function renderCodexSharedInput(bindings) {
         add_error_key: true
   fields_under_root: true
   processors:
-    - add_fields:
+${drops}    - add_fields:
         target: nustack
         fields:
           schema_version: ${ENVELOPE_SCHEMA_VERSION}
@@ -166,10 +177,25 @@ export function renderCodexSharedInput(bindings) {
           user_id: ${yamlScalar(device.userId)}
           provider: ${yamlScalar("codex")}
           redaction_policy_version: ${REDACTION_POLICY_VERSION}
-          redaction_applied: true
-${conditionals}
+          redaction_applied: true${conditionals}
     - drop_fields:
         fields: [${dropList}]
         ignore_missing: true
 `;
 }
+export function renderInputsFile(entries, device) {
+    const sorted = [...entries].sort((a, b) => a.binding.bindingId < b.binding.bindingId ? -1 : a.binding.bindingId > b.binding.bindingId ? 1 : 0);
+    const blocks = sorted.map((entry) => renderBindingInput(entry.binding, entry.enabled));
+    return INPUTS_HEADER + blocks.join("") + renderCodexSharedInput(sorted, device);
+}
+export function splitInputBlocks(contents) {
+    const starts = [...contents.matchAll(BLOCK_MARKER)].map((match) => ({
+        key: match[1] ?? CODEX_INPUT_KEY,
+        index: match.index ?? 0,
+    }));
+    const blocks = new Map();
+    starts.forEach((start, position) => {
+        blocks.set(start.key, contents.slice(start.index, starts[position + 1]?.index ?? contents.length));
+    });
+    return blocks;
+}

package/dist/lib/telemetry/health_report.js

@@ -4,9 +4,9 @@ import path from "node:path";
 import { listActiveBindings } from "../local_store/bindings.js";
 import { readDeviceState } from "../local_store/device_state.js";
 import { listActivityBindings, readFilebeatState, upsertFilebeatState, } from "../local_store/filebeat_state.js";
-import { desiredFilebeatVersion, filebeatBinPath, filebeatDir, inputsDir, observedFilebeatVersion, probeServiceRegistered, } from "../filebeat_installer.js";
+import { desiredFilebeatVersion, filebeatBinPath, filebeatDir, observedFilebeatVersion, probeServiceRegistered, } from "../filebeat_installer.js";
 import { REDACTION_POLICY_VERSION, } from "./redaction_policy.js";
-import { TELEMETRY_CONFIG_VERSION, desiredConfigHash, renderBindingInput, } from "./config_renderer.js";
+import { INPUTS_FILE, TELEMETRY_CONFIG_VERSION, desiredConfigHash, renderBindingInput, splitInputBlocks, } from "./config_renderer.js";
 import { discoverProviderBindings } from "./provider_paths.js";
 import { readObservedConfigBytes } from "./reload.js";
 export function defaultProbes() {
@@ -18,8 +18,11 @@ export function defaultProbes() {
         serviceRegistered: () => probeServiceRegistered(),
         observedConfigBytes: () => readObservedConfigBytes(filebeatDir()),
         bindingInputHash: async (bindingId) => {
-            const file = path.join(inputsDir(), `${bindingId}.yml`);
-            return existsSync(file) ? desiredConfigHash(await readFile(file, "utf8")) : null;
+            const file = path.join(filebeatDir(), INPUTS_FILE);
+            if (!existsSync(file))
+                return null;
+            const block = splitInputBlocks(await readFile(file, "utf8")).get(bindingId);
+            return block === undefined ? null : desiredConfigHash(block);
         },
     };
 }

package/dist/lib/telemetry/reload.js

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs";
 import { copyFile, readdir, readFile, rm } from "node:fs/promises";
 import path from "node:path";
 import { mkdirSecure, writeFileSecure } from "../secure_file.js";
+import { CODEX_INPUT_KEY, INPUTS_FILE, splitInputBlocks } from "./config_renderer.js";
 const MAIN_CONFIG = "filebeat.yml";
 const INPUTS_DIR = "inputs.d";
 async function liveConfigFiles(configDir) {
@@ -75,10 +76,8 @@ export async function removeInputFile(configDir, relativePath) {
     await rm(path.join(configDir, relativePath), { force: true });
 }
 export async function readObservedConfigBytes(configDir) {
-    const parts = [];
-    for (const relativePath of [MAIN_CONFIG, `${INPUTS_DIR}/codex-shared.yml`]) {
-        const file = path.join(configDir, relativePath);
-        parts.push(existsSync(file) ? await readFile(file, "utf8") : "");
-    }
-    return parts.join("\n");
+    const central = path.join(configDir, MAIN_CONFIG);
+    const inputs = path.join(configDir, INPUTS_FILE);
+    const codex = existsSync(inputs) ? (splitInputBlocks(await readFile(inputs, "utf8")).get(CODEX_INPUT_KEY) ?? "") : "";
+    return [existsSync(central) ? await readFile(central, "utf8") : "", codex].join("\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.20.1",
+  "version": "0.20.3",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,