@senad-d/observme 0.1.4 → 0.1.6

package/docs/reference/12-configuration-reference.md

@@ -15,8 +15,9 @@ observme:
     headers:
       Authorization: "Bearer ${OBSERVME_OTLP_TOKEN}"
     tls:
-      enabled: true
       insecureSkipVerify: false
+    # The endpoint scheme selects HTTP or HTTPS. HTTPS certificate verification
+    # stays enabled unless insecureSkipVerify is explicitly acknowledged.
     # Derived SDK URLs for OTLP/HTTP exporters:
     # traces:  https://otel-collector.example.com:4318/v1/traces
     # metrics: https://otel-collector.example.com:4318/v1/metrics
@@ -135,6 +136,16 @@ observme:
     flushTimeoutMs: 3000
 ```
 
+`otlp.endpoint` and every `otlp.signalEndpoints` value must be an absolute HTTP(S) URL without userinfo, unresolved placeholders, a query, or a fragment; credentials belong in `otlp.headers`. The base endpoint may contain an intentional path, to which ObservMe appends exactly one `/v1/{signal}` suffix using URL pathname semantics. Explicit signal endpoints must already end in their matching `/v1/traces`, `/v1/metrics`, or `/v1/logs` path.
+
+`query.grafana.url` must be an absolute HTTP(S) base URL without a username or password component. Authentication belongs only in `query.grafana.token` or the complete `query.grafana.username` and `query.grafana.password` pair. Credential-bearing base URLs fail configuration validation and query/transport preflight before network I/O. Diagnostics identify the bounded `embedded_credentials` failure class without rendering the rejected URL or either credential component.
+
+`otlp.tls.enabled` is intentionally unsupported and rejected as an unknown setting: the `http://` or `https://` endpoint scheme is the single source of truth for whether TLS is used. The retained `otlp.tls.insecureSkipVerify` option is passed to every OTLP HTTP exporter as its certificate-verification behavior.
+
+`query.links.traceUrlTemplate` is shared by `/obs session`, `/obs trace`, and `/obs link`. Absolute HTTP(S) templates support `{traceId}`, `{{traceId}}` (with optional inner whitespace), `${traceId}`, and `%TRACE_ID%`; optional Tempo UID placeholders use the matching `{tempoDatasourceUid}`, `{{tempoDatasourceUid}}`, `${tempoDatasourceUid}`, and `%TEMPO_DATASOURCE_UID%` forms. An empty template or one containing `...` selects the structured Grafana Explore fallback built from `query.grafana.url` and `query.grafana.datasourceUids.tempo`. Unsupported placeholders and invalid URLs fail with a bounded diagnostic.
+
+`query.maxLogs`, `query.maxTraces`, `query.maxMetricSeries`, and `query.maxAgents` accept integers from 1 through 100. Query clients enforce the same upper bound at runtime before issuing backend requests.
+
 ## 2. Environment Variables
 
 ```text
@@ -211,7 +222,8 @@ Rules:
 - Continue a valid W3C parent context explicitly on the child `pi.session` span. If trusted lineage has no usable continuation, start a new trace and add a validated parent span link when metadata exists, otherwise emit the documented propagation-failure log/counter fallback.
 - When `propagateTraceContext` is true, propagate W3C `traceparent`/`tracestate` to child processes launched by ObservMe-aware subagent wrappers.
 - When `workflow.enabled` is true, propagate `OBSERVME_WORKFLOW_ID` to child processes and report depth/fan-out/orphan metrics.
-- `writeCorrelationEntry` may append a minimal `custom` session entry for recovery, but it must remain disabled by default and must never use `custom_message`.
+- `writeCorrelationEntry` defaults to `false`. When enabled, successful startup appends at most one versioned `observme.correlation` `custom` entry to the active branch. Reload/resume/fork recovery scans only `ctx.sessionManager.getBranch()`, accepts the latest valid bounded lineage entry, ignores corrupt or abandoned-branch data, and does not duplicate an unchanged entry. ObservMe never uses `custom_message`, so this state cannot enter LLM context.
+- Historical telemetry is never replayed automatically. Use the explicit, confirmed `/obs backfill` command. The removed `replayOnStart` YAML field is rejected as unknown, and `OBSERVME_REPLAY_ON_START` is no longer recognized; neither can emit a synthetic duplicate startup record.
 
 ## 4. Config Precedence
 
@@ -224,6 +236,17 @@ Rules:
 
 Copy `.env.example` to `.env` for project-local extension variables, or export the same `OBSERVME_*` names in the shell before starting Pi. System environment variables override `.env` values, and `.env` must never be committed. If redacted content capture is enabled, set `OBSERVME_HASH_SALT` in the shell or trusted project `.env`; missing salts make capture fail closed.
 
+### 4.1 Project-Local Path and Symlink Policy
+
+Project config, project `.env`, and starter-config creation use the same fail-closed filesystem policy:
+
+- Pi must mark the project trusted before ObservMe reads or creates a project-local file.
+- The lexical path and resolved canonical target must both remain inside one stable canonical project root.
+- Existing file or directory symlinks are supported when their targets remain inside that root. Out-of-root, dangling, or unverifiable symlinks are rejected.
+- Reads and creates use opened file handles whose file identity, root identity, and canonical containment are verified before bytes are consumed or written. Concurrent replacement of a file, ancestor, or project root therefore rejects the operation instead of following the substituted target.
+- Normal missing in-root paths remain supported. Starter creation is exclusive and idempotent, never overwrites an existing file, and removes an unverified empty target if post-open validation fails.
+- Rejected project sources use the bounded `config_source_rejected` classification. Warnings and status diagnostics do not include canonical targets, external paths, file contents, or environment values; the rejected layer is skipped and other accepted layers continue to apply.
+
 Automatic project starter file:
 
 - On `session_start`, the extension creates `<cwd>/<CONFIG_DIR_NAME>/observme.yaml` (`<cwd>/.pi/observme.yaml` in the standard distribution) when the project is trusted and the file is missing.
@@ -307,7 +330,7 @@ Rules:
 - When the token is blank or an unresolved placeholder, a resolved `query.grafana.username` and `query.grafana.password` are sent as Basic auth for local development.
 - Query-backed commands and `/obs health` must fail fast before Grafana calls when Grafana auth is unresolved/missing/incomplete, `query.grafana.url` is invalid, or a required datasource UID is blank.
 - `/obs health` must report Grafana `401`/`403` responses as authentication failures and must not print token or password values.
-- `tls.insecureSkipVerify=true` is only for local self-signed certificates; production should trust the CA instead.
+- `query.grafana.tls.insecureSkipVerify=true` is only for local self-signed certificates; production requires `privacy.allowInsecureTransport=true` as an explicit acknowledgement and should trust the CA instead.
 - `transport.preferIPv4=true` uses Node's local HTTP(S) transport with IPv4 DNS lookup for Grafana calls.
 - Provisioned datasource UIDs are `tempo`, `loki`, and `prometheus`; Loki selectors use normalized labels such as `service_name`, `pi_session_id`, `event_name`, and `event_category` for ObservMe data.
 
@@ -335,11 +358,14 @@ ObservMe must display a warning when unsafe capture is active. Redacted capture
 Reject config when:
 
 - `allowUnsafeCapture=false` and `redactionEnabled=false` while any content capture is true.
-- Production endpoint uses `http://` and `allowInsecureTransport` is not true.
+- A production OTLP or Grafana endpoint uses `http://` and `privacy.allowInsecureTransport` is not true.
+- `query.grafana.url` contains an embedded username or password instead of using the dedicated token or username/password settings.
+- Production sets `otlp.tls.insecureSkipVerify=true` or `query.grafana.tls.insecureSkipVerify=true` and `privacy.allowInsecureTransport` is not true.
 - `otlp.protocol=http/protobuf` but a signal-specific exporter URL omits the required `/v1/traces`, `/v1/metrics`, or `/v1/logs` path.
 - `metrics.activeAgentLeaseDurationMillis` is fractional, non-numeric, below `10000`, above `300000`, or less than `(2 * metrics.exportIntervalMillis) + 5000`.
 - Metric labels include high-cardinality fields such as workflow IDs, session IDs, agent IDs, parent/child agent IDs, trace IDs, span IDs, entry IDs, spawn IDs, or spawn tool-call IDs. The generated `observme.instance.id` / `service.instance.id` remains a resource identity used by the Collector for the `observme_instance_id` lease join; it must not be configured as an execution-derived label.
 - Project-local config is read while `ctx.isProjectTrusted()` is false.
+- A project config, project `.env`, or starter-config path escapes the canonical project root, changes identity during I/O, or cannot be verified safely.
 - Propagated workflow or agent lineage values are malformed, too long, or contain unsafe characters.
 - Queue sizes exceed configured memory guardrails.
 

package/docs/review-validation.md

@@ -93,6 +93,16 @@ This sanitized record covers the production active-agent lease release candidate
 
 Post-run cleanup check found no containers or networks labeled for the active-agent lease integration and no `observme-grafana-it-*` containers or networks. Release remains blocked on the unrelated broad Grafana-stack validation unless the release owner accepts the explicitly allowed pre-existing blocker; all lease-specific release criteria passed.
 
+## Pi 0.81.1 compatibility validation — 2026-07-22
+
+This sanitized record covers the compatibility-policy correction against exact `@earendil-works/pi-coding-agent` and `@earendil-works/pi-ai` 0.81.1 development dependencies on local Node.js v26.0.0 and npm 11.12.1. No project, model, Grafana, or registry credentials were required or printed.
+
+| Command | Result | Evidence and notes |
+| --- | --- | --- |
+| `npm run validate:pi-compatibility` | Pass | Source/test typechecks, compatibility and event-mapping tests, packaged-install smoke, handler and lifecycle smoke, and the real Pi RPC runtime passed against Pi 0.81.1. |
+| `npm run validate` | Pass | ESLint, formatting, script checks, 618 unit/contract tests, package-content validation, packaged-install smoke, handler smoke, Pi lifecycle smoke, and real Pi runtime smoke passed. |
+| `npm audit --omit=dev` | Pass | The production dependency tree reported no vulnerabilities. |
+
 ## Review-closure evidence categories
 
 - **Read-only/check-only** — commands that inspect, type-check, lint, audit, run tests, dry-run packaging, or smoke local deterministic fixtures without publishing or writing tracked files.

package/examples/integrations/subagent-runner.ts

@@ -1,13 +1,13 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import {
   requestObservMeIntegration,
-  type ObservMeChildStatus,
   type ObservMeIntegrationApi,
   type ObservMeJoinStatus,
   type ObservMeProcessEnvironment,
   type ObservMeSpawnReason,
   type ObservMeSpawnType,
   type ObservMeStartedSubagent,
+  type ObservMeTerminalChildStatus,
 } from "@senad-d/observme/integration";
 
 /**
@@ -70,7 +70,6 @@ export class ObservableSubagentRunner<Request, Handle, Value> {
 
     try {
       handle = await this.#transport.launch(options.request, context, options.signal);
-      completeObservMeLaunch(observme, started);
     } catch (error) {
       failObservMeLaunch(observme, started, error);
       throw error;
@@ -90,10 +89,12 @@ export class ObservableSubagentRunner<Request, Handle, Value> {
     try {
       const result = await this.#transport.wait(handle, signal);
       endObservMeWait(observme, started, wait, result);
+      completeObservMeChild(observme, started, childStatus(result.status));
       recordObservMeJoin(observme, started, result);
       return result;
     } catch (error) {
       endObservMeWaitFailure(observme, started, wait);
+      completeObservMeChild(observme, started, "failed");
       recordObservMeJoinFailure(observme, started);
       throw error;
     }
@@ -127,14 +128,16 @@ function createLaunchContext(
   };
 }
 
-function completeObservMeLaunch(
+function completeObservMeChild(
   observme: ObservMeIntegrationApi | undefined,
   started: ObservMeStartedSubagent | undefined,
+  status: ObservMeTerminalChildStatus,
 ): void {
   if (!observme || !started) return;
   observme.completeSubagent(started.spawnId, {
     childAgentId: started.childAgentId,
-    childStatus: "active",
+    childStatus: status,
+    outcome: status,
   });
 }
 
@@ -245,7 +248,7 @@ function recordObservMeJoinFailure(
   });
 }
 
-function childStatus(status: ChildRunResult<unknown>["status"]): ObservMeChildStatus {
+function childStatus(status: ChildRunResult<unknown>["status"]): ObservMeTerminalChildStatus {
   if (status === "completed") return "completed";
   if (status === "cancelled") return "cancelled";
   return "failed";

package/examples/observme.yaml

@@ -6,7 +6,6 @@ observme:
   enabled: true
   environment: development
   tenant: local-dev
-  replayOnStart: false
 
   otlp:
     endpoint: http://localhost:4318
@@ -14,7 +13,6 @@ observme:
     timeoutMs: 3000
     headers: {}
     tls:
-      enabled: false
       insecureSkipVerify: false
     signalEndpoints:
       traces: http://localhost:4318/v1/traces
@@ -46,6 +44,8 @@ observme:
     propagateTraceContext: true
     propagateToSubagents: true
     capabilityEnv: OBSERVME_AGENT_CAPABILITY
+    # Opt in to one validated, branch-local custom entry for reload/resume recovery.
+    # This entry never participates in LLM context.
     writeCorrelationEntry: false
 
   traces:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senad-d/observme",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "description": "ObservMe: a Pi extension that instruments Pi agent sessions and exports OpenTelemetry traces, metrics, and logs to an external observability stack (OTel Collector, Grafana Tempo/Loki/Prometheus).",
   "license": "MIT",
@@ -67,12 +67,20 @@
     "smoke:handlers": "node scripts/smoke-handler-execution.mjs",
     "smoke:pi-lifecycle": "node scripts/smoke-pi-lifecycle.mjs",
     "smoke:pi-runtime": "node scripts/smoke-pi-runtime.mjs",
+    "validate:pi-compatibility": "npm run typecheck && npm run typecheck:test && node --test test/pi-compatibility.test.ts test/event-mapping.test.ts test/template.test.mjs && npm run smoke:packaged && npm run smoke:handlers && npm run smoke:pi-lifecycle && npm run smoke:pi-runtime",
     "validate:grafana-obs": "node scripts/validate-grafana-obs-flow.mjs",
     "check": "node --check scripts/check-package-contents.mjs && node --check scripts/test-coverage.mjs && node --check scripts/smoke-observability.mjs && node --check scripts/smoke-packaged-install.mjs && node --check scripts/smoke-handler-execution.mjs && node --check scripts/smoke-pi-lifecycle.mjs && node --check scripts/smoke-pi-runtime.mjs && node --check scripts/validate-grafana-obs-flow.mjs",
     "pack:dry-run": "npm pack --dry-run --json",
     "check:pack": "node scripts/check-package-contents.mjs",
     "validate": "npm run lint && npm run test && npm run check:pack && npm run smoke:packaged && npm run smoke:handlers && npm run smoke:pi-lifecycle && npm run smoke:pi-runtime"
   },
+  "observmeCompatibility": {
+    "pi": {
+      "earliestTestedVersion": "0.80.5",
+      "releaseTestedVersion": "0.81.1",
+      "runtimePolicy": "required-api-capabilities"
+    }
+  },
   "pi": {
     "extensions": [
       "./src/extension.ts"
@@ -88,8 +96,8 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.80.2",
-    "@earendil-works/pi-coding-agent": "^0.80.2",
+    "@earendil-works/pi-ai": "0.81.1",
+    "@earendil-works/pi-coding-agent": "0.81.1",
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.1.1",
     "c8": "^11.0.0",
@@ -97,7 +105,7 @@
     "globals": "^17.7.0",
     "typebox": "^1.3.6",
     "typescript": "6.0.3",
-    "typescript-eslint": "^8.63.0"
+    "typescript-eslint": "8.63.0"
   },
   "dependencies": {
     "@opentelemetry/api": "1.9.1",

package/src/commands/obs-agents.ts

@@ -6,6 +6,11 @@ import type { PrometheusFetch, PrometheusMetricSeries, QueryResult } from "../qu
 import { createPrometheusQueryClient } from "../query/prometheus.ts";
 import type { TimeRange, TraceSummary } from "../query/tempo.ts";
 import { createTempoQueryClient } from "../query/tempo.ts";
+import {
+  boundObsCommandOutput,
+  normalizeObsBackendLabel,
+  normalizeObsBackendLabelRecord,
+} from "../safety/display-bounds.ts";
 import { COMMON_SPAN_ATTRIBUTES } from "../semconv/attributes.ts";
 import { completeObsSubcommand, isExactObsSubcommandRequest } from "./obs-args.ts";
 import { loadObsCommandConfig, notifyObsCommand } from "./obs-command-support.ts";
@@ -187,8 +192,8 @@ export function renderObsAgents(snapshot: ObsAgentsSnapshot): string {
   const latestChild = readLatestChild(snapshot.children);
   const lines = [
     `Workflow: ${formatUnknown(snapshot.workflowId)} root=${formatUnknown(snapshot.workflowRootAgentId ?? snapshot.rootAgentId)}`,
-    `Agent: ${formatUnknown(snapshot.agentId)} (${snapshot.role} depth=${snapshot.depth})`,
-    `Session: ${formatUnknown(normalizeOptionalString(snapshot.sessionId))}`,
+    `Agent: ${formatUnknown(snapshot.agentId)} (${formatUnknown(snapshot.role)} depth=${snapshot.depth})`,
+    `Session: ${formatUnknown(snapshot.sessionId)}`,
     `Subagents spawned in current trace: ${snapshot.fanoutCount}`,
     `Current tree: depth=${snapshot.treeDepth} width=${snapshot.treeWidth} active=${snapshot.activeChildren} orphaned=${snapshot.orphanCount}`,
     `Recent children: ${renderRecentChildren(snapshot.children, snapshot.recentChildrenLimit)}`,
@@ -200,7 +205,7 @@ export function renderObsAgents(snapshot: ObsAgentsSnapshot): string {
     `Aggregate agent metrics (last ${OBS_AGENTS_WINDOW}): ${renderAggregateRows(snapshot.aggregateRows)}`,
     `Lineage drill-down: ${renderLineageDrilldown(snapshot)}`,
   );
-  return lines.join("\n");
+  return boundObsCommandOutput(lines.join("\n"));
 }
 
 class ObsAgentsCommand {
@@ -322,9 +327,9 @@ function toObsAgentAggregateRow(series: PrometheusMetricSeries): ObsAgentAggrega
   if (value === undefined) return undefined;
 
   return {
-    labels: { ...series.metric },
+    labels: normalizeObsBackendLabelRecord(series.metric),
     value,
-    timestampUnixSeconds: series.value?.timestampUnixSeconds,
+    timestampUnixSeconds: normalizeObsBackendLabel(series.value?.timestampUnixSeconds),
   };
 }
 
@@ -379,12 +384,12 @@ function selectRecentChildrenForRender(
 
 function renderRecentChild(child: ObsAgentChildRow): string {
   const orphan = child.orphaned ? " orphaned" : "";
-  return `${child.agentId} status=${child.status} depth=${child.depth}${orphan}`;
+  return `${formatUnknown(child.agentId)} status=${formatUnknown(child.status)} depth=${child.depth}${orphan}`;
 }
 
 function renderLatestChild(child: ObsAgentChildRow, hints: readonly ObsAgentWaitJoinHint[]): string {
   const joinHint = readLatestHintForChild(child.agentId, hints, "join");
-  return `${child.agentId} status=${child.status} active=${child.activeChildren} join=${formatDuration(joinHint?.durationMs)}`;
+  return `${formatUnknown(child.agentId)} status=${formatUnknown(child.status)} active=${child.activeChildren} join=${formatDuration(joinHint?.durationMs)}`;
 }
 
 function readLatestHintForChild(
@@ -408,7 +413,8 @@ function renderWaitJoinHint(hint: ObsAgentWaitJoinHint | undefined): string {
   if (!hint) return "none";
 
   const status = hint.joinStatus ?? hint.childStatus ?? (hint.active ? "waiting" : "complete");
-  return `${hint.kind}:${hint.childAgentId ?? hint.spawnId ?? hint.id} status=${status} duration=${formatDuration(hint.durationMs)}`;
+  const target = hint.childAgentId ?? hint.spawnId ?? hint.id;
+  return `${formatUnknown(hint.kind)}:${formatUnknown(target)} status=${formatUnknown(status)} duration=${formatDuration(hint.durationMs)}`;
 }
 
 function renderAggregateRows(rows: ObsAgentsAggregateRows): string {
@@ -416,7 +422,7 @@ function renderAggregateRows(rows: ObsAgentsAggregateRows): string {
 }
 
 function renderLineageDrilldown(snapshot: ObsAgentsSnapshot): string {
-  const attrs = Object.keys(snapshot.tempoSearchAttributes).join(", ") || "none";
+  const attrs = Object.keys(snapshot.tempoSearchAttributes).map(formatUnknown).join(", ") || "none";
   const traceCount = snapshot.traces.length;
   const latestTrace = normalizeOptionalString(snapshot.traces[0]?.traceId) ?? normalizeOptionalString(snapshot.traceId);
   const traceSuffix = latestTrace ? ` latest_trace=${latestTrace}` : "";
@@ -454,8 +460,7 @@ function normalizeRecentChildrenLimit(value: number | undefined): number {
 }
 
 function normalizeOptionalString(value: string | undefined): string | undefined {
-  const trimmed = value?.trim();
-  return trimmed || undefined;
+  return normalizeObsBackendLabel(value);
 }
 
 function isObsAgentsRequest(args: string): boolean {
@@ -463,7 +468,7 @@ function isObsAgentsRequest(args: string): boolean {
 }
 
 function formatUnknown(value: string | undefined): string {
-  return value ?? "unknown";
+  return normalizeObsBackendLabel(value) ?? "unknown";
 }
 
 function formatDuration(value: number | undefined): string {

package/src/commands/obs-backfill.ts

@@ -2,7 +2,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import type { ExtensionAPI, SessionEntry, SessionHeader } from "@earendil-works/pi-coding-agent";
 import type { LoadSessionConfigOptions } from "../config/load-config.ts";
 import type { ObservMeConfig } from "../config/schema.ts";
-import { ObservMeLogSdk } from "../otel/logs.ts";
+import { type ObservMeLogSdk, createLogSessionScopedOtelSdk } from "../otel/logs.ts";
 import type { BoundedOtelOperationResult } from "../otel/shutdown.ts";
 import { flushOtelSdk, shutdownOtelSdk } from "../otel/shutdown.ts";
 import { applyContentCapturePolicy } from "../privacy/content-capture.ts";
@@ -308,7 +308,7 @@ export function createObsBackfillLogExporter(
   config: ObservMeConfig,
   options: ObsBackfillOperationOptions = {},
 ): ObsBackfillExporter {
-  const sdk = new ObservMeLogSdk({ config });
+  const sdk = createLogSessionScopedOtelSdk({ config });
   sdk.start();
   return new ObsBackfillLogExporter(sdk, resolveBackfillOperationTimeoutMs(options, OBS_BACKFILL_DEFAULT_OPERATION_TIMEOUT_MS));
 }

package/src/commands/obs-command-support.ts

@@ -1,6 +1,7 @@
 import type { LoadSessionConfigOptions } from "../config/load-config.ts";
 import { loadSessionConfig } from "../config/load-config.ts";
 import type { ObservMeConfig } from "../config/schema.ts";
+import { boundObsCommandOutput } from "../safety/display-bounds.ts";
 
 export type ObsCommandNotificationType = "info" | "warning" | "error";
 
@@ -33,7 +34,7 @@ export async function notifyObsCommand(
   message: string,
   type: ObsCommandNotificationType,
 ): Promise<void> {
-  await ctx.ui?.notify?.(message, type);
+  await ctx.ui?.notify?.(boundObsCommandOutput(message), type);
 }
 
 export function normalizeObsCommandTimeoutMs(value: number | undefined, fallback: number, invalidFallback = fallback): number {

package/src/commands/obs-cost.ts

@@ -3,6 +3,11 @@ import type { LoadSessionConfigOptions } from "../config/load-config.ts";
 import type { ObservMeConfig } from "../config/schema.ts";
 import type { PrometheusFetch, PrometheusMetricSeries, QueryResult } from "../query/prometheus.ts";
 import { createPrometheusQueryClient } from "../query/prometheus.ts";
+import {
+  boundObsCommandOutput,
+  normalizeObsBackendLabel,
+  selectObsCommandRows,
+} from "../safety/display-bounds.ts";
 import { completeObsSubcommand, parseObsSubcommandArgs } from "./obs-args.ts";
 import { loadObsCommandConfig, notifyObsCommand } from "./obs-command-support.ts";
 import { appendObsRecoveryHint, formatObsCommandFailure } from "./obs-diagnostics.ts";
@@ -114,15 +119,19 @@ export async function getObsCostSnapshot(
 
 export function renderObsCost(snapshot: ObsCostSnapshot): string {
   const rows = snapshot.rows.map(normalizeObsCostRow).filter(isObsCostRow);
-  const lines = [`Cost by model/provider (last ${snapshot.window})`];
+  const selection = selectObsCommandRows(rows);
+  const window = normalizeObsBackendLabel(snapshot.window) ?? OBS_COST_WINDOW;
+  const lines = [`Cost by model/provider (last ${window})`];
 
   if (rows.length === 0) {
     lines.push(appendObsRecoveryHint("No cost metrics found.", OBS_COST_NO_METRICS_NEXT_ACTION));
-    return lines.join("\n");
+    return boundObsCommandOutput(lines.join("\n"));
   }
 
-  lines.push(...rows.map(renderObsCostRow), `Total: ${formatUsd(sumObsCostRows(rows))}`);
-  return lines.join("\n");
+  lines.push(...selection.rows.map(renderObsCostRow));
+  if (selection.omittedCount > 0) lines.push(`… ${selection.omittedCount} cost row(s) omitted`);
+  lines.push(`Total: ${formatUsd(sumObsCostRows(rows))}`);
+  return boundObsCommandOutput(lines.join("\n"));
 }
 
 class ObsCostCommand {
@@ -187,12 +196,11 @@ function parseCostUsd(value: string | number | undefined): number | undefined {
 }
 
 function normalizeMetricLabel(value: string | undefined): string {
-  return normalizeOptionalString(value) ?? "unknown";
+  return normalizeObsBackendLabel(value) ?? "unknown";
 }
 
 function normalizeOptionalString(value: string | undefined): string | undefined {
-  const trimmed = value?.trim();
-  return trimmed || undefined;
+  return normalizeObsBackendLabel(value);
 }
 
 function renderObsCostRow(row: ObsCostRow): string {

package/src/commands/obs-health.ts

@@ -1,6 +1,10 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { LoadSessionConfigOptions } from "../config/load-config.ts";
 import type { ObservMeConfig } from "../config/schema.ts";
+import {
+  createObsTransportSecuritySnapshot,
+  type ObsTransportSecuritySnapshot,
+} from "../config/transport-security.ts";
 import { readDiagnosticMessage, sanitizeDiagnosticText } from "../diagnostics/sanitize.ts";
 import { getGrafanaHealth, type GrafanaFetch } from "../query/grafana.ts";
 import { completeObsSubcommand, isExactObsSubcommandRequest } from "./obs-args.ts";
@@ -31,6 +35,7 @@ export interface ObsHealthCheckResult {
 export interface ObsHealthSnapshot {
   readonly timeoutMs: number;
   readonly checks: readonly ObsHealthCheckResult[];
+  readonly transportSecurity?: ObsTransportSecuritySnapshot;
 }
 
 export interface ObsHealthSnapshotOptions {
@@ -112,11 +117,18 @@ export async function getObsHealthSnapshot(
     getGrafanaHealth(config, { fetch: options.fetch, timeoutMs }),
   ]);
 
-  return { timeoutMs, checks: [collectorCheck, ...grafanaHealth.checks] };
+  return {
+    timeoutMs,
+    checks: [collectorCheck, ...grafanaHealth.checks],
+    transportSecurity: createObsTransportSecuritySnapshot(config),
+  };
 }
 
 export function renderObsHealth(snapshot: ObsHealthSnapshot): string {
-  return snapshot.checks.map(renderObsHealthCheck).join("\n");
+  return [
+    ...formatObsHealthTransportSecurity(snapshot.transportSecurity),
+    ...snapshot.checks.map(renderObsHealthCheck),
+  ].join("\n");
 }
 
 class ObsHealthCommand {
@@ -229,6 +241,14 @@ function failedHealthResult(label: string, kind: ObsHealthCheckKind, error: unkn
   };
 }
 
+function formatObsHealthTransportSecurity(security: ObsTransportSecuritySnapshot | undefined): string[] {
+  if (!security) return [];
+  return [
+    `Collector transport security: ${security.collector}`,
+    `Grafana transport security: ${security.grafana}`,
+  ];
+}
+
 function renderObsHealthCheck(check: ObsHealthCheckResult): string {
   const status = formatObsHealthStatus(check);
   const detail = formatObsHealthDetail(check);

package/src/commands/obs-loki-summary.ts

@@ -1,4 +1,6 @@
+import { normalizeQueryResultCount } from "../config/query-limits.ts";
 import type { LogResult, TimeRange } from "../query/loki.ts";
+import { normalizeObsBackendLabel } from "../safety/display-bounds.ts";
 import { LOG_ATTRIBUTES } from "../semconv/attributes.ts";
 
 export interface ObsLokiLogSummaryRow {
@@ -25,10 +27,8 @@ export interface ObsLokiTimeRangeOptions {
 }
 
 const defaultRangeHours = 1;
-const minimumMaxLogs = 1;
 const millisecondsPerHour = 60 * 60 * 1000;
 const nanosecondsPerMillisecond = 1_000_000n;
-const maximumDisplayValueLength = 96;
 const safeEventBodyPattern = /^[A-Za-z0-9_.:-]{1,96}$/u;
 const integerNanosecondsPattern = /^-?\d+$/u;
 const unknownTimestamp = "unknown-time";
@@ -51,8 +51,7 @@ export function formatObsLokiWindow(options: ObsLokiTimeRangeOptions = {}): stri
 }
 
 export function normalizeObsLokiMaxLogs(value: number | undefined): number {
-  if (value === undefined || !Number.isFinite(value) || value < minimumMaxLogs) return minimumMaxLogs;
-  return Math.trunc(value);
+  return normalizeQueryResultCount(value);
 }
 
 export function toObsLokiLogSummaryRow(log: LogResult): ObsLokiLogSummaryRow {
@@ -140,10 +139,7 @@ function normalizeObsLokiLogSummaryRow(row: ObsLokiLogSummaryRow): ObsLokiLogSum
 }
 
 function normalizeDisplayValue(value: string | undefined): string | undefined {
-  const normalized = value?.replace(/\s+/gu, " ").trim();
-  if (!normalized) return undefined;
-  if (normalized.length <= maximumDisplayValueLength) return normalized;
-  return `${normalized.slice(0, maximumDisplayValueLength - 1)}…`;
+  return normalizeObsBackendLabel(value);
 }
 
 function renderObsLokiLogSummaryRow(row: ObsLokiLogSummaryRow): string {