@nurix/nustack 0.23.8 → 0.23.10

package/dist/lib/session_telemetry.js

@@ -14,8 +14,9 @@ import { INPUTS_FILE, LOCAL_OUTPUT_HEADER, renderCentralConfig, renderInputsFile
 import { applyConfigChange, removeInputFile } from "./telemetry/reload.js";
 import { discoverProviderBindings } from "./telemetry/provider_paths.js";
 import { reportTelemetryHealth } from "./telemetry/health_report.js";
+import { DEFAULT_SESSION_INDEX, isSameOutput, machineVerdict, partAnswerOf, readPartState, recordPartState, } from "./telemetry/part_state.js";
 const TELEMETRY_SERVICE = "elastic-observability";
-const DEFAULT_INDEX = "claude-sessions";
+const DEFAULT_INDEX = DEFAULT_SESSION_INDEX;
 const NO_OP_LOG = () => { };
 function defaultSeams() {
     return {
@@ -123,53 +124,68 @@ export async function ensureBindingTelemetry(opts) {
             await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
-        let brokerFailure = null;
+        let brokerError = null;
         const credential = accessToken
             ? await fetchBrokeredCredential(baseUrl, accessToken, {
                 projectId: binding.projectId,
                 service: TELEMETRY_SERVICE,
             }).catch((error) => {
-                brokerFailure = error instanceof Error ? error.message : String(error);
+                brokerError = error;
                 return null;
             })
             : null;
-        if (!credential?.url && !localOutput) {
+        const brokerFailure = brokerError === null ? null : message(brokerError);
+        const answer = accessToken ? partAnswerOf(binding.organizationId, { credential, error: brokerError }) : null;
+        const parts = answer ? recordPartState({ projects: { [binding.projectId]: answer } }) : readPartState();
+        const candidate = credential?.url && answer ? { destination: answer.destination ?? "nurix", url: credential.url, index: answer.index ?? DEFAULT_INDEX } : null;
+        const verdict = machineVerdict(bindingsOf(store, binding.id, true), parts, candidate);
+        const output = verdict.selection.output;
+        if (verdict.selection.conflict) {
+            recordPartState({ conflict: true });
+            await applyInputs(store, binding.id, verdict, deviceRef, userId, seams);
+            disableActivity(store, binding.id);
+            recordDegraded(store, "destination_conflict");
+            await reportBestEffort(baseUrl, store, seams, accessToken);
+            return;
+        }
+        if (!output) {
+            recordPartState({ conflict: false });
+            if (answer?.state === "off") {
+                await applyInputs(store, binding.id, verdict, deviceRef, userId, seams);
+                disableActivity(store, binding.id);
+            }
             const unserved = brokerFailure !== null && brokerFailure.includes("does not serve");
             recordDegraded(store, unserved ? "credential_plane_unserved" : "no_output_credential");
             await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
-        if (credential?.url) {
-            const index = credential.meta?.index || DEFAULT_INDEX;
+        if (credential && candidate && isSameOutput(output, candidate)) {
             const central = {
                 relativePath: "filebeat.yml",
-                contents: renderCentralConfig({ elkUrl: credential.url, apiKey: credential.key, index }),
+                contents: renderCentralConfig({ elkUrl: candidate.url, apiKey: credential.key, index: candidate.index }),
             };
-            const centralApply = await applyConfigChange({
-                files: [central],
-                scope: "central",
-                context: centralReloadContext(seams, filebeatDir()),
-            });
-            if (!centralApply.ok) {
-                recordDegraded(store, centralApply.errorCode);
-                await reportBestEffort(baseUrl, store, seams, accessToken);
-                return;
+            const live = await readFile(mainConfigPath(), "utf8").catch(() => null);
+            if (live !== central.contents) {
+                const centralApply = await applyConfigChange({
+                    files: [central],
+                    scope: "central",
+                    context: centralReloadContext(seams, filebeatDir()),
+                });
+                if (!centralApply.ok) {
+                    recordDegraded(store, centralApply.errorCode);
+                    await reportBestEffort(baseUrl, store, seams, accessToken);
+                    return;
+                }
             }
         }
+        recordPartState({ output, conflict: false });
         if (!seams.serviceRegistered())
             await seams.registerService();
-        const inputs = renderInputs(store, { id: binding.id, binding, enabled: true }, deviceRef, userId) ?? "";
-        await removeOrphanInputs();
-        const inputsApply = await applyConfigChange({
-            files: [{ relativePath: INPUTS_FILE, contents: inputs }],
-            scope: "inputs",
-            context: seams.reloadContext(filebeatDir()),
-        });
-        if (!inputsApply.ok) {
-            recordDegraded(store, inputsApply.errorCode);
+        if (!(await applyInputs(store, binding.id, verdict, deviceRef, userId, seams, binding))) {
             await reportBestEffort(baseUrl, store, seams, accessToken);
             return;
         }
+        const isShipping = verdict.shipping.has(binding.id);
         for (const discovered of discoverProviderBindings(binding.repositoryRoot)) {
             upsertActivityBinding(store, {
                 id: activityRowId(binding.id, discovered.provider, discovered.pathFingerprint),
@@ -177,7 +193,7 @@ export async function ensureBindingTelemetry(opts) {
                 provider: discovered.provider,
                 providerProjectPath: discovered.absolutePath,
                 pathFingerprint: discovered.pathFingerprint,
-                state: discovered.state,
+                state: isShipping ? discovered.state : "disabled",
             });
         }
         upsertFilebeatState(store, {
@@ -226,6 +242,7 @@ export async function setLocalOutput(opts) {
         recordDegraded(store, centralApply.errorCode);
         return { ok: false, errorCode: centralApply.errorCode };
     }
+    recordPartState({ output: { destination: "local", url: opts.elkUrl, index: opts.index || DEFAULT_INDEX }, conflict: false });
     if (!seams.serviceRegistered())
         await seams.registerService();
     upsertFilebeatState(store, {
@@ -251,7 +268,8 @@ export async function removeBindingTelemetry(opts) {
     try {
         const device = readDeviceState(store);
         await removeOrphanInputs();
-        const inputs = renderInputs(store, { id: bindingId, enabled: false }, device?.deviceRef ?? "", device?.activeUserId ?? "");
+        const verdict = machineVerdict(bindingsOf(store, bindingId, false), readPartState());
+        const inputs = renderInputs(store, { id: bindingId, enabled: false }, device?.deviceRef ?? "", device?.activeUserId ?? "", verdict);
         if (inputs === null) {
             await removeInputFile(filebeatDir(), INPUTS_FILE);
         }
@@ -266,20 +284,70 @@ export async function removeBindingTelemetry(opts) {
                 recordDegraded(store, applied.errorCode);
             }
         }
-        for (const row of listActivityBindings(store, bindingId)) {
-            upsertActivityBinding(store, {
-                id: row.id,
-                bindingId: row.bindingId,
-                provider: row.provider,
-                providerProjectPath: row.providerProjectPath,
-                pathFingerprint: row.pathFingerprint,
-                state: "disabled",
-            });
+        disableActivity(store, bindingId);
+    }
+    catch {
+    }
+}
+function disableActivity(store, bindingId) {
+    for (const row of listActivityBindings(store, bindingId)) {
+        upsertActivityBinding(store, {
+            id: row.id,
+            bindingId: row.bindingId,
+            provider: row.provider,
+            providerProjectPath: row.providerProjectPath,
+            pathFingerprint: row.pathFingerprint,
+            state: "disabled",
+        });
+    }
+}
+function bindingsOf(store, bindingId, folderEnabled) {
+    return listActiveBindings(store).map((b) => ({ bindingId: b.id, projectId: b.projectId, folderEnabled: b.id === bindingId ? folderEnabled : b.telemetryEnabled }));
+}
+async function applyInputs(store, bindingId, verdict, deviceRef, userId, seams, binding) {
+    const inputs = renderInputs(store, { id: bindingId, binding, enabled: true }, deviceRef, userId, verdict) ?? "";
+    await removeOrphanInputs();
+    const inputsApply = await applyConfigChange({
+        files: [{ relativePath: INPUTS_FILE, contents: inputs }],
+        scope: "inputs",
+        context: seams.reloadContext(filebeatDir()),
+    });
+    if (!inputsApply.ok)
+        recordDegraded(store, inputsApply.errorCode);
+    return inputsApply.ok;
+}
+export async function reconcileAllBindings(opts) {
+    const { store, baseUrl } = opts;
+    const bindings = listActiveBindings(store);
+    let reconciled = 0;
+    try {
+        const machine = readFilebeatState(store);
+        if (!optedOutByEnv() && (!machine || machine.telemetryEnabled)) {
+            for (const binding of bindings) {
+                await ensureBindingTelemetry({ baseUrl, store, binding, seams: opts.seams });
+                reconciled += 1;
+            }
         }
     }
+    finally {
+        recordPartStateBestEffort();
+    }
+    const parts = readPartState();
+    return { reconciled, parts: countParts(bindings, parts), conflict: parts.conflict };
+}
+function recordPartStateBestEffort() {
+    try {
+        recordPartState();
+    }
     catch {
     }
 }
+function countParts(bindings, parts) {
+    const counts = { on: 0, off: 0, unknown: 0 };
+    for (const projectId of new Set(bindings.map((b) => b.projectId)))
+        counts[parts.projects[projectId]?.state ?? "unknown"] += 1;
+    return counts;
+}
 export async function switchMachineOff(opts) {
     const seams = { ...defaultSeams(), ...opts.seams };
     const { store } = opts;
@@ -310,15 +378,15 @@ export async function switchMachineOff(opts) {
     upsertFilebeatState(store, { processState: "stopped" });
     return "stopped";
 }
-function renderInputs(store, reconciled, deviceRef, userId) {
+function renderInputs(store, reconciled, deviceRef, userId, verdict) {
     const byId = new Map();
     for (const b of listActiveBindings(store)) {
-        byId.set(b.id, { binding: toTelemetryBinding(b, deviceRef, userId), enabled: b.telemetryEnabled });
+        byId.set(b.id, { binding: toTelemetryBinding(b, deviceRef, userId), enabled: b.telemetryEnabled && verdict.shipping.has(b.id) });
     }
     const known = reconciled.binding ? toTelemetryBinding(reconciled.binding, deviceRef, userId) : byId.get(reconciled.id)?.binding;
     if (known)
-        byId.set(reconciled.id, { binding: known, enabled: reconciled.enabled });
-    return byId.size === 0 ? null : renderInputsFile([...byId.values()], { deviceRef, userId });
+        byId.set(reconciled.id, { binding: known, enabled: reconciled.enabled && verdict.shipping.has(reconciled.id) });
+    return byId.size === 0 ? null : renderInputsFile([...byId.values()], { deviceRef, userId }, { dropAll: verdict.dropCodex });
 }
 async function removeOrphanInputs() {
     const inputsDirPath = path.join(filebeatDir(), "inputs.d");

package/dist/lib/telemetry/config_renderer.js

@@ -139,10 +139,10 @@ export function renderBindingInput(binding, enabled = true) {
     });
     return enabled ? block : block.replace("\n  processors:\n", `\n  processors:\n${SWITCHED_OFF}`);
 }
-export function renderCodexSharedInput(entries, device) {
+export function renderCodexSharedInput(entries, device, options = {}) {
     const ordered = [...entries].sort((a, b) => a.binding.bindingId < b.binding.bindingId ? -1 : a.binding.bindingId > b.binding.bindingId ? 1 : 0);
     const sorted = ordered.filter((entry) => entry.enabled).map((entry) => entry.binding);
-    const drops = sorted.length === 0 ? SWITCHED_OFF : "";
+    const drops = sorted.length === 0 || options.dropAll === true ? SWITCHED_OFF : "";
     const conditionals = sorted
         .map((binding) => `
     - if:
@@ -183,10 +183,10 @@ ${drops}    - add_fields:
         ignore_missing: true
 `;
 }
-export function renderInputsFile(entries, device) {
+export function renderInputsFile(entries, device, options = {}) {
     const sorted = [...entries].sort((a, b) => a.binding.bindingId < b.binding.bindingId ? -1 : a.binding.bindingId > b.binding.bindingId ? 1 : 0);
     const blocks = sorted.map((entry) => renderBindingInput(entry.binding, entry.enabled));
-    return INPUTS_HEADER + blocks.join("") + renderCodexSharedInput(sorted, device);
+    return INPUTS_HEADER + blocks.join("") + renderCodexSharedInput(sorted, device, options);
 }
 export function splitInputBlocks(contents) {
     const starts = [...contents.matchAll(BLOCK_MARKER)].map((match) => ({

package/dist/lib/telemetry/environment.js

@@ -0,0 +1,2 @@
+export const TELEMETRY_CHILD_VARIABLE = "NUSTACK_TELEMETRY_CHILD";
+export const FILEBEAT_SERVICE_LABEL_VARIABLE = "NUSTACK_FILEBEAT_SERVICE_LABEL";

package/dist/lib/telemetry/health_report.js

@@ -9,6 +9,7 @@ import { REDACTION_POLICY_VERSION, } from "./redaction_policy.js";
 import { INPUTS_FILE, TELEMETRY_CONFIG_VERSION, desiredConfigHash, renderBindingInput, splitInputBlocks, } from "./config_renderer.js";
 import { discoverProviderBindings } from "./provider_paths.js";
 import { readObservedConfigBytes } from "./reload.js";
+import { machineVerdict, readPartState } from "./part_state.js";
 export function defaultProbes() {
     return {
         binaryPresent: () => existsSync(filebeatBinPath()),
@@ -36,7 +37,11 @@ export async function collectTelemetryStatus(store, probes = defaultProbes(), op
     const userId = device?.activeUserId ?? "";
     const folders = [];
     const activity = [];
-    for (const binding of listActiveBindings(store)) {
+    const bindings = listActiveBindings(store);
+    const parts = readPartState();
+    const verdict = machineVerdict(bindings.map((b) => ({ bindingId: b.id, projectId: b.projectId, folderEnabled: b.telemetryEnabled })), parts);
+    for (const binding of bindings) {
+        const isRendered = verdict.shipping.has(binding.id);
         const rendered = renderBindingInput({
             bindingId: binding.id,
             repoRoot: binding.repositoryRoot,
@@ -57,9 +62,11 @@ export async function collectTelemetryStatus(store, probes = defaultProbes(), op
             desiredConfigHash: desired,
             observedConfigHash: observed,
             redactionPolicyVersion: REDACTION_POLICY_VERSION,
+            partState: parts.projects[binding.projectId]?.state ?? "unknown",
+            shipping: isRendered && verdict.selection.output !== null,
             state: folderState({
                 telemetryEnabled,
-                folderEnabled: binding.telemetryEnabled,
+                folderEnabled: binding.telemetryEnabled && isRendered,
                 binaryPresent,
                 desired,
                 observed,
@@ -75,7 +82,7 @@ export async function collectTelemetryStatus(store, probes = defaultProbes(), op
                 providerProjectKey: discovered.providerProjectKey,
                 pathFingerprint: discovered.pathFingerprint,
                 discoveryMethod: discovered.discoveryMethod,
-                state: !telemetryEnabled || !binding.telemetryEnabled ? "disabled" : baseState,
+                state: !telemetryEnabled || !binding.telemetryEnabled || !isRendered ? "disabled" : baseState,
                 lastObservedAtMs: row?.lastObservedAtMs ?? null,
             });
         }

package/dist/lib/telemetry/part_state.js

@@ -0,0 +1,168 @@
+import { spawn } from "node:child_process";
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { filebeatDir, mainConfigPath } from "../filebeat_installer.js";
+import { locksDir } from "../local_store/paths.js";
+import { DRAIN_CHILD_VARIABLE, isFlagSet } from "../records/environment.js";
+import { BROKERED_OUTPUT_HEADER, LOCAL_OUTPUT_HEADER } from "./config_renderer.js";
+import { TELEMETRY_CHILD_VARIABLE } from "./environment.js";
+export const TELEMETRY_PART_OFF_REASON = "telemetry_part_off";
+export const TELEMETRY_PART_DETAIL = "telemetryPart";
+export const TELEMETRY_DESTINATION_DETAIL = "telemetryDestination";
+export const DEFAULT_SESSION_INDEX = "claude-sessions";
+export const PART_CHECK_INTERVAL_MS = 60 * 60 * 1000;
+const PART_STATE_SCHEMA_VERSION = 1;
+export function partStatePath() {
+    return path.join(filebeatDir(), "part-state.json");
+}
+export function telemetryReconcileLockPath() {
+    return path.join(locksDir(), "telemetry-reconcile.lock");
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stringOrNull = (value) => (typeof value === "string" && value.length > 0 ? value : null);
+function readOutput(value) {
+    if (!isRecord(value))
+        return null;
+    const destination = value.destination;
+    if (destination !== "nurix" && destination !== "tenant" && destination !== "local")
+        return null;
+    return { destination, url: stringOrNull(value.url), index: stringOrNull(value.index) };
+}
+function readProject(value) {
+    if (!isRecord(value) || (value.state !== "on" && value.state !== "off") || typeof value.organizationId !== "string")
+        return null;
+    const destination = value.destination === "nurix" || value.destination === "tenant" ? value.destination : null;
+    return { organizationId: value.organizationId, state: value.state, destination, url: stringOrNull(value.url), index: stringOrNull(value.index), checkedAt: String(value.checkedAt ?? "") };
+}
+function seedOutput() {
+    try {
+        const header = readFileSync(mainConfigPath(), "utf8").split("\n", 1)[0];
+        if (header === LOCAL_OUTPUT_HEADER)
+            return { destination: "local", url: null, index: null };
+        if (header === BROKERED_OUTPUT_HEADER)
+            return { destination: "nurix", url: null, index: null };
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function readPartState() {
+    const empty = { schemaVersion: PART_STATE_SCHEMA_VERSION, checkedAt: null, output: null, conflict: false, projects: {} };
+    let state = empty;
+    try {
+        const parsed = JSON.parse(readFileSync(partStatePath(), "utf8"));
+        if (isRecord(parsed) && parsed.schemaVersion === PART_STATE_SCHEMA_VERSION) {
+            const projects = {};
+            for (const [projectId, entry] of Object.entries(isRecord(parsed.projects) ? parsed.projects : {})) {
+                const project = readProject(entry);
+                if (project)
+                    projects[projectId] = project;
+            }
+            state = { ...empty, checkedAt: stringOrNull(parsed.checkedAt), output: readOutput(parsed.output), conflict: parsed.conflict === true, projects };
+        }
+    }
+    catch {
+    }
+    return state.output ? state : { ...state, output: seedOutput() };
+}
+export function recordPartState(change = {}) {
+    const current = readPartState();
+    const projects = { ...current.projects };
+    for (const [projectId, entry] of Object.entries(change.projects ?? {})) {
+        if (entry)
+            projects[projectId] = entry;
+        else
+            delete projects[projectId];
+    }
+    const next = {
+        schemaVersion: PART_STATE_SCHEMA_VERSION,
+        checkedAt: new Date().toISOString(),
+        output: change.output === undefined ? current.output : change.output,
+        conflict: change.conflict ?? current.conflict,
+        projects,
+    };
+    const target = partStatePath();
+    mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    const staged = `${target}.${process.pid}.tmp`;
+    writeFileSync(staged, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    renameSync(staged, target);
+    return next;
+}
+export function partAnswerOf(organizationId, answer) {
+    const checkedAt = new Date().toISOString();
+    if (answer.credential) {
+        const index = typeof answer.credential.meta?.index === "string" && answer.credential.meta.index ? answer.credential.meta.index : DEFAULT_SESSION_INDEX;
+        const destination = answer.credential.meta?.destination === "tenant" ? "tenant" : "nurix";
+        return { organizationId, state: "on", destination, url: answer.credential.url, index, checkedAt };
+    }
+    const details = isRecord(answer.error) && isRecord(answer.error.details) ? answer.error.details : null;
+    if (!details)
+        return null;
+    if (details.reason === TELEMETRY_PART_OFF_REASON)
+        return { organizationId, state: "off", destination: null, url: null, index: null, checkedAt };
+    if (details[TELEMETRY_PART_DETAIL] !== "on")
+        return null;
+    const named = details[TELEMETRY_DESTINATION_DETAIL];
+    return { organizationId, state: "on", destination: named === "nurix" || named === "tenant" ? named : null, url: null, index: null, checkedAt };
+}
+export const isSameOutput = (a, b) => a !== null && b !== null && a.destination === b.destination && a.url === b.url && a.index === b.index;
+export function matchesOutput(entry, output) {
+    if (!output || entry?.state === "off")
+        return false;
+    if (output.destination !== "tenant")
+        return entry?.destination !== "tenant";
+    return entry?.state === "on" && entry.destination === "tenant" && entry.url === output.url && entry.index === output.index;
+}
+export function selectMachineOutput(input) {
+    const live = input.bindings.filter((binding) => binding.folderEnabled && input.projects[binding.projectId]?.state !== "off");
+    const tenantOutputs = new Map();
+    for (const binding of live) {
+        const entry = input.projects[binding.projectId];
+        if (entry?.destination === "tenant" && entry.url !== null)
+            tenantOutputs.set(`${entry.url}\n${entry.index}`, { destination: "tenant", url: entry.url, index: entry.index });
+    }
+    if (tenantOutputs.size > 1)
+        return { output: input.current, shippingBindingIds: [], conflict: true };
+    const tenant = [...tenantOutputs.values()][0] ?? null;
+    let output = input.current;
+    if (tenant && (isSameOutput(tenant, input.candidate) || isSameOutput(tenant, input.current)))
+        output = tenant;
+    else if (!tenant && input.candidate?.destination === "nurix")
+        output = input.candidate;
+    const shippingBindingIds = live.filter((binding) => matchesOutput(input.projects[binding.projectId], output)).map((binding) => binding.bindingId);
+    return { output, shippingBindingIds, conflict: false };
+}
+export function machineVerdict(bindings, parts, candidate = null) {
+    const selection = selectMachineOutput({ bindings, projects: parts.projects, current: parts.output, candidate });
+    const isOff = (projectId) => parts.projects[projectId]?.state === "off";
+    const live = bindings.filter((binding) => binding.folderEnabled && !isOff(binding.projectId)).map((binding) => binding.bindingId);
+    const shipping = new Set(selection.conflict ? [] : selection.output === null ? live : selection.shippingBindingIds);
+    const dropCodex = selection.conflict || selection.output?.destination === "tenant" || bindings.some((binding) => isOff(binding.projectId));
+    return { selection, shipping, dropCodex };
+}
+export function isPartCheckStale(env = process.env, now = Date.now()) {
+    try {
+        if (isFlagSet(DRAIN_CHILD_VARIABLE, env) || isFlagSet(TELEMETRY_CHILD_VARIABLE, env) || env.NUSTACK_TELEMETRY === "off")
+            return false;
+        if (!statSync(mainConfigPath(), { throwIfNoEntry: false }))
+            return false;
+        const file = statSync(partStatePath(), { throwIfNoEntry: false });
+        return !file || now - file.mtimeMs > PART_CHECK_INTERVAL_MS;
+    }
+    catch {
+        return false;
+    }
+}
+export function startTelemetryReconcile(options = {}) {
+    try {
+        const entry = fileURLToPath(new URL("../../index.js", import.meta.url));
+        const args = [entry, ...(options.nustackUrl ? ["--nustack-url", options.nustackUrl] : []), "telemetry", "reconcile", "--quiet"];
+        const child = spawn(process.execPath, args, { detached: true, stdio: "ignore", env: { ...process.env, [TELEMETRY_CHILD_VARIABLE]: "1" } });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+    }
+}