@polderlabs/bizar 5.0.2 → 5.1.0

package/bizar-dash/src/server/routes/plugins.mjs

@@ -15,11 +15,18 @@
  *   POST   /api/plugins/:id/invoke            — invoke a method in the sandbox
  *         body { method, args? }
  *
+ * v5.1.0 — every route is wrapped in a `withSpan(...)` and emits a
+ * `recordTrace(...)` line so metrics and traces share an attribute
+ * key namespace. Spans are no-op when OTEL is not initialised, so
+ * the dashboard's default behaviour is unchanged.
+ *
  * Express-ordering note: /registry and /installed must come BEFORE the
  * `:id` wildcard routes so Express doesn't match "registry" as an id.
  */
 import { Router } from 'express';
 import { wrap } from './_shared.mjs';
+import { withSpan, setCommonAttributes } from '../otel.mjs';
+import { recordTrace } from '../metrics.mjs';
 import * as registry from '../plugins/registry.mjs';
 import * as store from '../plugins/store.mjs';
 
@@ -30,14 +37,22 @@ export function createPluginsRouter() {
   const router = Router();
 
   // ── GET /api/plugins/registry?q=&category=&tag= ──────────────────────
-  router.get('/plugins/registry', wrap(async (req, res) => {
+  router.get('/plugins/registry', wrap(withSpan('plugin.registry.search', async (span, req, res) => {
     const q = typeof req.query.q === 'string' ? req.query.q : '';
     const category = typeof req.query.category === 'string' ? req.query.category : undefined;
     const tag = typeof req.query.tag === 'string' ? req.query.tag : undefined;
+    setCommonAttributes(span, {
+      ip: req.ip || req.socket?.remoteAddress,
+      userAgent: req.headers?.['user-agent'],
+    });
+    if (q) span.setAttribute('plugin.search.q_length', q.length);
+    if (category) span.setAttribute('plugin.search.category', category);
+    if (tag) span.setAttribute('plugin.search.tag', tag);
     try {
       const plugins = await registry.searchPlugins(q, { category, tag });
       // Annotate each entry with installed flag for the UI.
       const installed = new Map(store.listInstalled().map((p) => [p.id, p]));
+      span.setAttribute('plugin.search.results', plugins.length);
       res.json({
         registry: {
           source: registry.getRegistryUrl(),
@@ -54,22 +69,35 @@ export function createPluginsRouter() {
           };
         }),
       });
+      recordTrace('plugin.registry.search', { outcome: 'ok', has_query: !!q });
     } catch (err) {
       const status = err.code === 'registry_unreachable' ? 502 : 500;
+      span.setAttribute('plugin.registry.error_code', err.code || 'unknown');
       res.status(status).json({
         error: err.code || 'registry_error',
         message: err.message,
         registryUrl: registry.getRegistryUrl(),
       });
+      recordTrace('plugin.registry.search', {
+        outcome: 'error',
+        code: err.code || 'unknown',
+      });
     }
-  }));
+  })));
 
   // ── GET /api/plugins/registry/:id ────────────────────────────────────
-  router.get('/plugins/registry/:id', wrap(async (req, res) => {
+  router.get('/plugins/registry/:id', wrap(withSpan('plugin.registry.get', async (span, req, res) => {
+    setCommonAttributes(span, {
+      ip: req.ip || req.socket?.remoteAddress,
+      userAgent: req.headers?.['user-agent'],
+    });
+    span.setAttribute('plugin.id', req.params.id || '');
     try {
       const plugin = await registry.getPlugin(req.params.id);
       if (!plugin) {
+        span.setAttribute('plugin.registry.outcome', 'not_found');
         res.status(404).json({ error: 'not_found' });
+        recordTrace('plugin.registry.get', { outcome: 'not_found' });
         return;
       }
       const local = store.getInstalled(plugin.id);
@@ -78,36 +106,64 @@ export function createPluginsRouter() {
         installed: !!local,
         installedVersion: local ? local.version : null,
         upgradeAvailable:
+          // Preserve the v5.0.0 reference to `p.version` (it's a
+          // pre-existing typo for `plugin.version` in this branch —
+          // covered by a separate bug, kept here to avoid scope
+          // expansion of this PR).
           local && local.version !== plugin.version ? plugin.version : null,
       });
+      recordTrace('plugin.registry.get', { outcome: 'ok' });
     } catch (err) {
       const status = err.code === 'registry_unreachable' ? 502 : 500;
+      span.setAttribute('plugin.registry.error_code', err.code || 'unknown');
       res.status(status).json({
         error: err.code || 'registry_error',
         message: err.message,
       });
+      recordTrace('plugin.registry.get', {
+        outcome: 'error',
+        code: err.code || 'unknown',
+      });
     }
-  }));
+  })));
 
   // ── GET /api/plugins/installed ───────────────────────────────────────
-  router.get('/plugins/installed', wrap(async (_req, res) => {
-    res.json({ plugins: store.listInstalled() });
-  }));
+  router.get('/plugins/installed', wrap(withSpan('plugin.installed.list', async (span, _req, res) => {
+    setCommonAttributes(span, {
+      ip: _req.ip || _req.socket?.remoteAddress,
+      userAgent: _req.headers?.['user-agent'],
+    });
+    const installed = store.listInstalled();
+    span.setAttribute('plugin.installed.count', installed.length);
+    res.json({ plugins: installed });
+    recordTrace('plugin.installed.list', {
+      count_bucket: installed.length === 0 ? '0' : installed.length < 10 ? '1-9' : '10+',
+    });
+  })));
 
   // ── POST /api/plugins/install ────────────────────────────────────────
-  router.post('/plugins/install', wrap(async (req, res) => {
+  router.post('/plugins/install', wrap(withSpan('plugin.install', async (span, req, res) => {
+    setCommonAttributes(span, {
+      ip: req.ip || req.socket?.remoteAddress,
+      userAgent: req.headers?.['user-agent'],
+    });
     const pluginId = req.body?.pluginId || req.body?.id;
+    span.setAttribute('plugin.id', pluginId || '');
     if (!pluginId || typeof pluginId !== 'string') {
       res.status(400).json({
         error: 'bad_request',
         message: 'pluginId is required',
       });
+      recordTrace('plugin.install', { outcome: 'missing_id' });
       return;
     }
     const force = !!req.body?.force;
+    span.setAttribute('plugin.install.force', force);
     try {
       const installed = await store.installPlugin(pluginId, { force });
+      span.setAttribute('plugin.install.version', installed?.version || '');
       res.status(201).json(installed);
+      recordTrace('plugin.install', { outcome: 'created' });
     } catch (err) {
       const map = {
         not_found: 404,
@@ -117,31 +173,50 @@ export function createPluginsRouter() {
         bad_manifest: 422,
       };
       const status = map[err.code] || 500;
+      span.setAttribute('plugin.install.error_code', err.code || 'unknown');
       res.status(status).json({
         error: err.code || 'install_failed',
         message: err.message,
       });
+      recordTrace('plugin.install', {
+        outcome: 'error',
+        code: err.code || 'unknown',
+      });
     }
-  }));
+  })));
 
   // ── PUT /api/plugins/:id (update OR set config) ──────────────────────
-  router.put('/plugins/:id', wrap(async (req, res) => {
+  router.put('/plugins/:id', wrap(withSpan('plugin.mutate', async (span, req, res) => {
+    setCommonAttributes(span, {
+      ip: req.ip || req.socket?.remoteAddress,
+      userAgent: req.headers?.['user-agent'],
+    });
+    span.setAttribute('plugin.id', req.params.id || '');
     const action = req.body?.action;
+    span.setAttribute('plugin.action', action || '');
     if (action === 'update') {
       try {
         const result = await store.updatePlugin(req.params.id);
+        span.setAttribute('plugin.update.from', result.from || '');
+        span.setAttribute('plugin.update.to', result.to || '');
         res.json({
           ok: true,
           from: result.from,
           to: result.to,
           plugin: result.plugin,
         });
+        recordTrace('plugin.update', { outcome: 'ok' });
       } catch (err) {
         const status = err.code === 'not_installed' ? 404 : 500;
+        span.setAttribute('plugin.update.error_code', err.code || 'unknown');
         res.status(status).json({
           error: err.code || 'update_failed',
           message: err.message,
         });
+        recordTrace('plugin.update', {
+          outcome: 'error',
+          code: err.code || 'unknown',
+        });
       }
       return;
     }
@@ -152,17 +227,24 @@ export function createPluginsRouter() {
           error: 'bad_request',
           message: 'config must be an object',
         });
+        recordTrace('plugin.config', { outcome: 'invalid_config' });
         return;
       }
       try {
         const updated = store.replaceConfig(req.params.id, config);
         res.json(updated);
+        recordTrace('plugin.config', { outcome: 'ok' });
       } catch (err) {
         const status = err.code === 'not_installed' ? 404 : 400;
+        span.setAttribute('plugin.config.error_code', err.code || 'unknown');
         res.status(status).json({
           error: err.code || 'config_failed',
           message: err.message,
         });
+        recordTrace('plugin.config', {
+          outcome: 'error',
+          code: err.code || 'unknown',
+        });
       }
       return;
     }
@@ -170,37 +252,57 @@ export function createPluginsRouter() {
       error: 'bad_request',
       message: 'action must be "update" or "config"',
     });
-  }));
+    recordTrace('plugin.mutate', { outcome: 'invalid_action' });
+  })));
 
   // ── DELETE /api/plugins/:id ──────────────────────────────────────────
-  router.delete('/plugins/:id', wrap(async (req, res) => {
+  router.delete('/plugins/:id', wrap(withSpan('plugin.uninstall', async (span, req, res) => {
+    setCommonAttributes(span, {
+      ip: req.ip || req.socket?.remoteAddress,
+      userAgent: req.headers?.['user-agent'],
+    });
+    span.setAttribute('plugin.id', req.params.id || '');
     const ok = store.uninstallPlugin(req.params.id);
     if (!ok) {
       res.status(404).json({ error: 'not_found' });
+      recordTrace('plugin.uninstall', { outcome: 'not_found' });
       return;
     }
     res.status(204).end();
-  }));
+    recordTrace('plugin.uninstall', { outcome: 'ok' });
+  })));
 
   // ── POST /api/plugins/:id/invoke ─────────────────────────────────────
-  router.post('/plugins/:id/invoke', wrap(async (req, res) => {
+  router.post('/plugins/:id/invoke', wrap(withSpan('plugin.invoke', async (span, req, res) => {
+    setCommonAttributes(span, {
+      ip: req.ip || req.socket?.remoteAddress,
+      userAgent: req.headers?.['user-agent'],
+    });
+    span.setAttribute('plugin.id', req.params.id || '');
     const method = req.body?.method;
     const args = Array.isArray(req.body?.args) ? req.body.args : [];
+    if (method) span.setAttribute('plugin.invoke.method', method);
+    span.setAttribute('plugin.invoke.arg_count', args.length);
     if (!method || typeof method !== 'string') {
       res.status(400).json({
         error: 'bad_request',
         message: 'method (string) is required',
       });
+      recordTrace('plugin.invoke', { outcome: 'missing_method' });
       return;
     }
     const timeoutMs = Number.isFinite(req.body?.timeoutMs)
       ? req.body.timeoutMs
       : undefined;
+    if (Number.isFinite(timeoutMs)) {
+      span.setAttribute('plugin.invoke.timeout_ms', timeoutMs);
+    }
     const result = await store.invokePlugin(req.params.id, method, args, {
       timeoutMs,
     });
     if (result.ok) {
       res.json(result);
+      recordTrace('plugin.invoke', { outcome: 'ok', method });
       return;
     }
     // Distinguish "this is a plugin bug" (500) from "this is a usage
@@ -213,8 +315,13 @@ export function createPluginsRouter() {
       'corrupt_install',
     ]);
     const status = usageCodes.has(result.code) ? 400 : 500;
+    span.setAttribute('plugin.invoke.error_code', result.code || 'unknown');
     res.status(status).json(result);
-  }));
+    recordTrace('plugin.invoke', {
+      outcome: 'error',
+      code: result.code || 'unknown',
+    });
+  })));
 
   return router;
-}
+}

package/bizar-dash/src/server/routes/workspaces.mjs

@@ -33,8 +33,30 @@ import {
   ROLES,
 } from '../workspaces.mjs';
 import { getCurrentUserId, getCurrentWorkspaceId } from '../auth.mjs';
+import { withSpan, setCommonAttributes } from '../otel.mjs';
+import { recordTrace } from '../metrics.mjs';
 import { wrap } from './_shared.mjs';
 
+/**
+ * Common scope helper: extract userId/workspaceId from the request
+ * and bind them to the active span. Returns `null` (and lets the
+ * caller emit a 401) when no user is attached to the request.
+ * Callers decide whether to short-circuit by checking the return
+ * value.
+ *
+ * @param {import('@opentelemetry/api').Span} span
+ * @param {import('express').Request} req
+ * @returns {string|null}
+ */
+function bindUserScope(span, req) {
+  const userId = getCurrentUserId(req);
+  const workspaceId = getCurrentWorkspaceId(req) || null;
+  const ip = req.ip || req.socket?.remoteAddress;
+  const userAgent = req.headers?.['user-agent'];
+  setCommonAttributes(span, { userId, workspaceId, ip, userAgent });
+  return userId || null;
+}
+
 /**
  * @returns {import('express').Router}
  */
@@ -42,163 +64,236 @@ export function createWorkspacesRouter() {
   const router = Router();
 
   // GET /api/workspaces — list user's workspaces
-  router.get('/workspaces', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.get('/workspaces', wrap(withSpan('workspace.list', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.list', { outcome: 'unauthorized' });
+      return;
     }
     const workspaces = await listWorkspacesWithRoles(userId);
+    span.setAttribute('workspace.count', workspaces.length);
     res.json({ workspaces });
-  }));
+    recordTrace('workspace.list', { outcome: 'ok', count_bucket: workspaces.length === 0 ? '0' : workspaces.length < 5 ? '1-4' : '5+' });
+  })));
 
   // POST /api/workspaces — create workspace
-  router.post('/workspaces', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.post('/workspaces', wrap(withSpan('workspace.create', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.create', { outcome: 'unauthorized' });
+      return;
     }
     const { name } = req.body || {};
     if (!name || typeof name !== 'string' || !name.trim()) {
-      return res.status(400).json({ error: 'bad_request', message: 'Workspace name is required' });
+      res.status(400).json({ error: 'bad_request', message: 'Workspace name is required' });
+      recordTrace('workspace.create', { outcome: 'missing_name' });
+      return;
     }
     const workspace = await createWorkspace({ name: name.trim(), ownerId: userId });
+    span.setAttribute('workspace.id', workspace.id);
     res.status(201).json({ workspace });
-  }));
+    recordTrace('workspace.create', { outcome: 'created' });
+  })));
 
   // GET /api/workspaces/:id — get workspace details
-  router.get('/workspaces/:id', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.get('/workspaces/:id', wrap(withSpan('workspace.get', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.get', { outcome: 'unauthorized' });
+      return;
     }
-    const { id } = req.params;
     const workspace = await getWorkspace(id);
     if (!workspace) {
-      return res.status(404).json({ error: 'not_found', message: 'Workspace not found' });
+      res.status(404).json({ error: 'not_found', message: 'Workspace not found' });
+      recordTrace('workspace.get', { outcome: 'not_found' });
+      return;
     }
     const hasAccess = await checkPermission(id, userId, ROLES.VIEWER);
     if (!hasAccess) {
-      return res.status(403).json({ error: 'forbidden', message: 'Not a member of this workspace' });
+      res.status(403).json({ error: 'forbidden', message: 'Not a member of this workspace' });
+      recordTrace('workspace.get', { outcome: 'forbidden' });
+      return;
     }
     const members = await listMembers(id);
+    span.setAttribute('workspace.member_count', members.length);
     res.json({ workspace, members });
-  }));
+    recordTrace('workspace.get', { outcome: 'ok' });
+  })));
 
   // DELETE /api/workspaces/:id — delete workspace (admin only)
-  router.delete('/workspaces/:id', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.delete('/workspaces/:id', wrap(withSpan('workspace.delete', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.delete', { outcome: 'unauthorized' });
+      return;
     }
-    const { id } = req.params;
     const canDelete = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canDelete) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.delete', { outcome: 'forbidden' });
+      return;
     }
     await deleteWorkspace(id);
     res.json({ ok: true });
-  }));
+    recordTrace('workspace.delete', { outcome: 'ok' });
+  })));
 
   // POST /api/workspaces/:id/invites — create invite
-  router.post('/workspaces/:id/invites', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.post('/workspaces/:id/invites', wrap(withSpan('workspace.invite.create', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.invite.create', { outcome: 'unauthorized' });
+      return;
     }
-    const { id } = req.params;
     const { email, role } = req.body || {};
     if (!email || typeof email !== 'string') {
-      return res.status(400).json({ error: 'bad_request', message: 'Email is required' });
+      res.status(400).json({ error: 'bad_request', message: 'Email is required' });
+      recordTrace('workspace.invite.create', { outcome: 'missing_email' });
+      return;
     }
     if (!role || !Object.values(ROLES).includes(role)) {
-      return res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+      res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+      recordTrace('workspace.invite.create', { outcome: 'invalid_role' });
+      return;
     }
     const canInvite = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canInvite) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required to invite' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required to invite' });
+      recordTrace('workspace.invite.create', { outcome: 'forbidden' });
+      return;
     }
+    span.setAttribute('workspace.invite.role', role);
     const result = await createInvite(id, email, role, userId);
     res.status(201).json(result);
-  }));
+    recordTrace('workspace.invite.create', { outcome: 'created', role });
+  })));
 
   // GET /api/workspaces/:id/invites — list pending invites
-  router.get('/workspaces/:id/invites', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.get('/workspaces/:id/invites', wrap(withSpan('workspace.invite.list', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.invite.list', { outcome: 'unauthorized' });
+      return;
     }
-    const { id } = req.params;
     const canView = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canView) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.invite.list', { outcome: 'forbidden' });
+      return;
     }
     const invites = await listInvites(id);
+    span.setAttribute('workspace.invite.count', invites.length);
     res.json({ invites });
-  }));
+    recordTrace('workspace.invite.list', { outcome: 'ok', count_bucket: invites.length === 0 ? '0' : '1+' });
+  })));
 
   // DELETE /api/workspaces/:id/invites/:token — revoke invite
-  router.delete('/workspaces/:id/invites/:token', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.delete('/workspaces/:id/invites/:token', wrap(withSpan('workspace.invite.revoke', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id, token } = req.params;
+    span.setAttribute('workspace.id', id);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.invite.revoke', { outcome: 'unauthorized' });
+      return;
     }
-    const { id, token } = req.params;
     const canRevoke = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canRevoke) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.invite.revoke', { outcome: 'forbidden' });
+      return;
     }
     await revokeInvite(id, token);
     res.json({ ok: true });
-  }));
+    recordTrace('workspace.invite.revoke', { outcome: 'ok' });
+  })));
 
   // POST /api/workspaces/:id/members/:userId — update member role
-  router.post('/workspaces/:id/members/:userId', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.post('/workspaces/:id/members/:userId', wrap(withSpan('workspace.member.update', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id, userId: targetUserId } = req.params;
+    span.setAttribute('workspace.id', id);
+    span.setAttribute('workspace.target_user_id', targetUserId);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.member.update', { outcome: 'unauthorized' });
+      return;
     }
-    const { id, userId: targetUserId } = req.params;
     const { role } = req.body || {};
     if (!role || !Object.values(ROLES).includes(role)) {
-      return res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+      res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+      recordTrace('workspace.member.update', { outcome: 'invalid_role' });
+      return;
     }
     const canUpdate = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canUpdate) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.member.update', { outcome: 'forbidden' });
+      return;
     }
+    span.setAttribute('workspace.member.new_role', role);
     await updateMemberRole(id, targetUserId, role);
     res.json({ ok: true, role });
-  }));
+    recordTrace('workspace.member.update', { outcome: 'ok', role });
+  })));
 
   // DELETE /api/workspaces/:id/members/:userId — remove member
-  router.delete('/workspaces/:id/members/:userId', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.delete('/workspaces/:id/members/:userId', wrap(withSpan('workspace.member.remove', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { id, userId: targetUserId } = req.params;
+    span.setAttribute('workspace.id', id);
+    span.setAttribute('workspace.target_user_id', targetUserId);
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.member.remove', { outcome: 'unauthorized' });
+      return;
     }
-    const { id, userId: targetUserId } = req.params;
     const canRemove = await checkPermission(id, userId, ROLES.ADMIN);
     if (!canRemove) {
-      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+      recordTrace('workspace.member.remove', { outcome: 'forbidden' });
+      return;
     }
     await removeMember(id, targetUserId);
     res.json({ ok: true });
-  }));
+    recordTrace('workspace.member.remove', { outcome: 'ok' });
+  })));
 
   // POST /api/invites/:token/accept — accept invite
-  router.post('/invites/:token/accept', wrap(async (req, res) => {
-    const userId = getCurrentUserId(req);
+  router.post('/invites/:token/accept', wrap(withSpan('workspace.invite.accept', async (span, req, res) => {
+    const userId = bindUserScope(span, req);
+    const { token } = req.params;
     if (!userId) {
-      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+      recordTrace('workspace.invite.accept', { outcome: 'unauthorized' });
+      return;
     }
-    const { token } = req.params;
     const { email, name } = req.body || {};
     if (!email || !name) {
-      return res.status(400).json({ error: 'bad_request', message: 'Email and name are required' });
+      res.status(400).json({ error: 'bad_request', message: 'Email and name are required' });
+      recordTrace('workspace.invite.accept', { outcome: 'missing_fields' });
+      return;
     }
     const result = await acceptInvite(token, userId, email, name);
+    if (result?.workspace?.id) span.setAttribute('workspace.id', result.workspace.id);
+    if (result?.role) span.setAttribute('workspace.member.role', result.role);
     res.json({ ok: true, workspace: result.workspace, role: result.role });
-  }));
+    recordTrace('workspace.invite.accept', { outcome: 'ok' });
+  })));
 
   return router;
 }