@posthog/ai 8.16.0 → 8.16.2

package/dist/openai/index.mjs

@@ -228,6 +228,10 @@ const sanitize = (data, client) => isFullAiCaptureEnabled(client) ? data : redac
 const sanitizeOpenAI = (data, client) => sanitize(data, client);
 const sanitizeOpenAIResponse = (data, client) => sanitize(data, client);
 //#endregion
+//#region src/privacyMode.ts
+/** Per-call settings can turn redaction on but never off. */
+const isPrivacyModeEnabled = (client, privacyMode = false) => privacyMode === true || client?.privacyMode === true || client?.privacy_mode === true || client?.options?.privacyMode === true;
+//#endregion
 //#region src/utils.ts
 const TOKEN_PROPERTY_KEYS = /* @__PURE__ */ new Set([
 	"$ai_input_tokens",
@@ -307,6 +311,10 @@ const formatResponseOpenAI = (response) => {
 				type: "text",
 				text: choice.message.content
 			});
+			if (choice.message.refusal) content.push({
+				type: "refusal",
+				refusal: choice.message.refusal
+			});
 			if (choice.message.tool_calls) for (const toolCall of choice.message.tool_calls) {
 				const call = toolCall.type === "custom" ? toolCall.custom : toolCall.function;
 				if (!call) continue;
@@ -370,7 +378,6 @@ const formatResponseOpenAI = (response) => {
 	}
 	return output;
 };
-const isPrivacyModeEnabled = (client, privacyMode) => Boolean(client.privacy_mode || privacyMode);
 const withPrivacyMode = (client, privacyMode, input) => {
 	return isPrivacyModeEnabled(client, privacyMode) ? null : input;
 };
@@ -541,11 +548,12 @@ function formatOpenAIResponsesInput(input, instructions) {
 }
 //#endregion
 //#region package.json
-var version = "8.16.0";
+var version = "8.16.2";
 //#endregion
 //#region src/serializeError.ts
 const DEFAULT_MAX_DEPTH = 3;
 const MAX_STACK_LINES = 20;
+const OMITTED_FIELD = "requestBodyValues";
 function serializeError(value, depth = DEFAULT_MAX_DEPTH) {
 	if (depth < 0 || value === null || typeof value !== "object") return value;
 	if (value instanceof Error) {
@@ -554,16 +562,17 @@ function serializeError(value, depth = DEFAULT_MAX_DEPTH) {
 			message: value.message,
 			stack: truncateStack(value.stack)
 		};
-		for (const key of Object.keys(value)) out[key] = serializeError(value[key], depth - 1);
+		for (const key of Object.keys(value)) if (key !== OMITTED_FIELD) out[key] = serializeError(Reflect.get(value, key), depth - 1);
 		if (value.cause !== void 0) out.cause = serializeError(value.cause, depth - 1);
 		return out;
 	}
 	if (Array.isArray(value)) return value.map((item) => serializeError(item, depth - 1));
 	return value;
 }
+const omitRequestBody = (key, value) => key === OMITTED_FIELD ? void 0 : value;
 function stringifyError(error) {
 	try {
-		return JSON.stringify(sanitizeValues(serializeError(error)));
+		return JSON.stringify(sanitizeValues(serializeError(error)), omitRequestBody);
 	} catch {
 		if (error instanceof Error) return JSON.stringify({
 			name: error.name,
@@ -572,6 +581,105 @@ function stringifyError(error) {
 		return JSON.stringify({ message: String(error) });
 	}
 }
+const CLASS_NAME = /^[A-Za-z_$][A-Za-z0-9_$.]{0,127}$/;
+const PROVIDER_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
+const PARAM = /^[A-Za-z0-9_.[\]-]{1,128}$/;
+const REQUEST_ID = /^[A-Za-z0-9_.:-]{1,128}$/;
+const MAX_CAUSES = 3;
+const readField = (value, key) => {
+	if (value === null || typeof value !== "object" && typeof value !== "function") return;
+	try {
+		return Reflect.get(value, key);
+	} catch {
+		return;
+	}
+};
+const matching = (value, grammar) => typeof value === "string" && grammar.test(value) ? value : void 0;
+const firstMatching = (values, grammar) => {
+	for (const value of values) {
+		const match = matching(value, grammar);
+		if (match !== void 0) return match;
+	}
+};
+const className = (value) => {
+	if (!(value instanceof Error)) return "NonErrorThrown";
+	const name = readField(value, "name");
+	return firstMatching([
+		name === "Error" ? void 0 : name,
+		readField(readField(value, "constructor"), "name"),
+		name
+	], CLASS_NAME) ?? "Error";
+};
+const httpStatus = (error) => {
+	for (const key of ["status", "statusCode"]) {
+		const value = readField(error, key);
+		if (typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599) return value;
+	}
+};
+const unwrapEnvelope = (body) => {
+	const inner = readField(body, "error");
+	return inner !== null && typeof inner === "object" ? inner : body;
+};
+const parsedResponseBody = (error) => {
+	const responseBody = readField(error, "responseBody");
+	if (typeof responseBody !== "string") return;
+	try {
+		return unwrapEnvelope(JSON.parse(responseBody));
+	} catch {
+		return;
+	}
+};
+const causeNames = (error) => {
+	const names = [];
+	let cause = readField(error, "cause");
+	while (cause !== void 0 && cause !== null && names.length < MAX_CAUSES) {
+		names.push(className(cause));
+		cause = readField(cause, "cause");
+	}
+	return names;
+};
+const describeError = (error) => {
+	const sources = [
+		error,
+		unwrapEnvelope(readField(error, "error")),
+		parsedResponseBody(error)
+	];
+	const codes = /* @__PURE__ */ new Set();
+	for (const source of sources) for (const key of [
+		"code",
+		"type",
+		"status"
+	]) {
+		const code = matching(readField(source, key), PROVIDER_CODE);
+		if (code !== void 0) codes.add(code);
+	}
+	const status = httpStatus(error);
+	const param = firstMatching(sources.map((source) => readField(source, "param")), PARAM);
+	const requestId = firstMatching([readField(error, "requestID"), readField(error, "request_id")], REQUEST_ID);
+	const causes = causeNames(error);
+	let summary = className(error);
+	if (status !== void 0) summary += `: ${status}`;
+	for (const code of codes) summary += ` ${code}`;
+	if (param !== void 0) summary += ` param=${param}`;
+	if (requestId !== void 0) summary += ` request_id=${requestId}`;
+	if (causes.length > 0) summary += ` (caused by ${causes.join(", ")})`;
+	return summary;
+};
+/**
+* Describes an error for `$ai_error` without its message, stack, or arbitrary fields, which
+* routinely echo the prompt. Only structured fields that pass a strict grammar are kept.
+* The format matches the Python SDK.
+*/
+function summarizeErrorForPrivacy(error) {
+	try {
+		return describeError(error);
+	} catch {
+		return error instanceof Error ? "Error" : "NonErrorThrown";
+	}
+}
+function formatAiError(error, privacyMode) {
+	return privacyMode ? summarizeErrorForPrivacy(error) : stringifyError(error);
+}
 function truncateStack(stack) {
 	if (!stack) return stack;
 	const lines = stack.split("\n");
@@ -579,6 +687,33 @@ function truncateStack(stack) {
 	return [...lines.slice(0, MAX_STACK_LINES), "... (truncated)"].join("\n");
 }
 //#endregion
+//#region src/mcpCredentials.ts
+const MCP_CREDENTIAL_FIELDS = ["headers", "authorization"];
+const MCP_PROVIDER_TOOL_IDS = /* @__PURE__ */ new Set([
+	"openai.mcp",
+	"xai.mcp",
+	"google.mcp_server"
+]);
+const isMcpProviderTool = (tool) => (tool.type === "provider" || tool.type === "provider-defined") && typeof tool.id === "string" && MCP_PROVIDER_TOOL_IDS.has(tool.id);
+const withoutMcpCredentials = (config) => {
+	const redacted = { ...config };
+	for (const field of MCP_CREDENTIAL_FIELDS) if (field in redacted) redacted[field] = "[REDACTED]";
+	return redacted;
+};
+/** Hides the credentials of a remote MCP tool definition; everything else is kept as sent. */
+function redactMcpToolDefinition(tool) {
+	if (!isObject(tool)) return tool;
+	if (tool.type === "mcp") return withoutMcpCredentials(tool);
+	if (isMcpProviderTool(tool) && isObject(tool.args)) return {
+		...tool,
+		args: withoutMcpCredentials(tool.args)
+	};
+	return tool;
+}
+function redactMcpToolCredentials(tools) {
+	return Array.isArray(tools) ? tools.map(redactMcpToolDefinition) : tools;
+}
+//#endregion
 //#region src/gatewayWarning.ts
 const POSTHOG_AI_GATEWAY_HOSTS = [
 	"gateway.posthog.com",
@@ -641,13 +776,15 @@ const captureAiGeneration$1 = async (client, options) => {
 			}
 			let exceptionId;
 			if (client.options?.enableExceptionAutocapture) {
-				exceptionId = uuidv7();
-				client.captureException(options.error, void 0, { $ai_trace_id: traceId }, exceptionId);
+				if (!shouldRedact) {
+					exceptionId = uuidv7();
+					client.captureException(options.error, void 0, { $ai_trace_id: traceId }, exceptionId);
+				}
 				if (typeof options.error === "object") options.error.__posthog_previously_captured_error = true;
 			}
 			errorData = {
 				$ai_is_error: true,
-				$ai_error: stringifyError(options.error),
+				$ai_error: formatAiError(options.error, shouldRedact),
 				$exception_event_id: exceptionId
 			};
 		}
@@ -688,7 +825,7 @@ const captureAiGeneration$1 = async (client, options) => {
 			$ai_tokens_source: getTokensSource(options.properties),
 			...options.distinctId ? {} : { $process_person_profile: false },
 			...options.stopReason ? { $ai_stop_reason: options.stopReason } : {},
-			...options.tools ? { $ai_tools: options.tools } : {},
+			...options.tools ? { $ai_tools: redactMcpToolCredentials(options.tools) } : {},
 			...options.completionId ? { $ai_completion_id: options.completionId } : {},
 			...options.providerMetadata && Object.keys(options.providerMetadata).length > 0 ? { $ai_provider_metadata: options.providerMetadata } : {},
 			...errorData,
@@ -1142,6 +1279,7 @@ function monitoredStreamTee(source, createStream) {
 var OpenAIChatStreamAccumulator = class {
 	constructor() {
 		this.accumulatedContent = "";
+		this.accumulatedRefusal = "";
 		this.usage = { webSearchCount: 0 };
 		this.toolCalls = /* @__PURE__ */ new Map();
 	}
@@ -1158,6 +1296,10 @@ var OpenAIChatStreamAccumulator = class {
 			this.firstTokenTime ??= receivedAt;
 			this.accumulatedContent += choice.delta.content;
 		}
+		if (choice?.delta?.refusal) {
+			this.firstTokenTime ??= receivedAt;
+			this.accumulatedRefusal += choice.delta.refusal;
+		}
 		if (Array.isArray(choice?.delta?.tool_calls)) {
 			this.firstTokenTime ??= receivedAt;
 			for (const toolCall of choice.delta.tool_calls) {
@@ -1189,6 +1331,10 @@ var OpenAIChatStreamAccumulator = class {
 			type: "text",
 			text: this.accumulatedContent
 		});
+		if (this.accumulatedRefusal) content.push({
+			type: "refusal",
+			refusal: this.accumulatedRefusal
+		});
 		for (const toolCall of this.toolCalls.values()) if (toolCall.name) content.push({
 			type: "function",
 			id: toolCall.id,