@teamscala/service-boot 0.23.331 → 0.23.333

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.331",
+  "version": "0.23.333",
   "sideEffects": false,
   "files": [
     "src"
@@ -38,6 +38,7 @@
     "@teamscala/proc-walker": "*",
     "@teamscala/realtime-utils": "*",
     "@teamscala/resolver-engine": "*",
+    "@teamscala/safe-fallback": "*",
     "@teamscala/timing": "*",
     "@teamscala/tool-executor": "*",
     "@teamscala/watchdog": "*",

package/src/fn-routers/task-sync-router.ts

@@ -40,6 +40,7 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { recordEvent } from "@teamscala/event-log/record-event";
 import { getPlatformOrgId } from "@teamscala/db/registry/platform";
+import { createSafeFallback } from "@teamscala/safe-fallback/create-safe-fallback";
 import { authed, type Context } from "./auth-router.ts";
 import { notifyLaneOfTaskChange } from "./task-sync-dispatch.ts";
 import { resolveLaneTask, resolveLaneWorkName } from "./task-sync-lane.ts";
@@ -173,6 +174,12 @@ export function resolveBindOrg(explicit?: string): string {
 	return explicit ?? getPlatformOrgId();
 }
 
+const laneTaskCreateFallback = createSafeFallback<WorkItem | null>({
+	name: "task-sync:lane-task-create-race",
+	onFailure: "fail-open-noisy",
+	degradedResult: null,
+});
+
 /**
  * Record a task-sync hook DISCARD to event_log so it is observable + queryable,
  * not silently swallowed by the hook command's `>/dev/null 2>&1 || true`. The
@@ -288,8 +295,8 @@ async function ensureLaneTask(
 	const name = pane ? await resolveLaneWorkName(prisma, pane) : null;
 	if (!name || name.trim().toLowerCase() === "lane") return null;
 	const lane: LaneIdentity = { pane: pane ?? "", session, cli_kind: "claude-code", role: "agent" };
-	try {
-		return await prisma.work_items.create({
+	const created = await laneTaskCreateFallback.call(() =>
+		prisma.work_items.create({
 			data: {
 				kind: "task",
 				parent_id: null,
@@ -301,10 +308,9 @@ async function ensureLaneTask(
 				assignee_id: session,
 				kind_data: { lane },
 			},
-		});
-	} catch {
-		return resolveLaneTask(prisma, session);
-	}
+		}),
+	);
+	return created ?? resolveLaneTask(prisma, session);
 }
 
 

package/src/serve/stamp-transport-identity.d.ts

@@ -25,6 +25,13 @@
  * WebSocket upgrades are returned untouched (Bun tracks upgrades by Request
  * identity — a clone can never upgrade).
  */
+/**
+ * Preserve useful process attribution without copying arbitrary argv into logs.
+ * Arguments routinely contain bearer headers, inline scripts, URLs and secret
+ * values. There is no complete flag-name redaction list, so the safe boundary
+ * is structural: retain argv[0] and state that arguments were removed.
+ */
+export declare function summariseLocalCommand(cmdline: readonly string[]): string | null;
 /**
  * Return a Request with transport-identity headers stamped, or the original
  * `req` when no stamping is needed/possible. Never throws.

package/src/serve/stamp-transport-identity.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from "bun:test";
+import { summariseLocalCommand } from "./stamp-transport-identity.ts";
+
+describe("local command attribution", () => {
+	test("never copies command arguments into telemetry", () => {
+		const token = "operator-token-must-not-appear";
+		const summary = summariseLocalCommand([
+			"curl",
+			"-H",
+			`x-operator-spawn-token: ${token}`,
+			"http://127.0.0.1:3021/rpc/spawn",
+		]);
+		expect(summary).toBe("curl [arguments redacted]");
+		expect(summary).not.toContain(token);
+	});
+
+	test("keeps a lone executable name", () => {
+		expect(summariseLocalCommand(["scala-picker"])).toBe("scala-picker");
+	});
+
+	test("omits an empty command line", () => {
+		expect(summariseLocalCommand([])).toBeNull();
+	});
+});

package/src/serve/stamp-transport-identity.ts

@@ -31,6 +31,18 @@ import { resolveSocketPeer } from "@teamscala/proc-walker/socket-peer";
 
 const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
 
+/**
+ * Preserve useful process attribution without copying arbitrary argv into logs.
+ * Arguments routinely contain bearer headers, inline scripts, URLs and secret
+ * values. There is no complete flag-name redaction list, so the safe boundary
+ * is structural: retain argv[0] and state that arguments were removed.
+ */
+export function summariseLocalCommand(cmdline: readonly string[]): string | null {
+	const executable = cmdline[0]?.trim();
+	if (!executable) return null;
+	return cmdline.length > 1 ? `${executable} [arguments redacted]` : executable;
+}
+
 /**
  * Return a Request with transport-identity headers stamped, or the original
  * `req` when no stamping is needed/possible. Never throws.
@@ -77,8 +89,8 @@ export function stampTransportIdentity(
 			const owner = resolveSocketPeer(port);
 			if (owner) {
 				headers.set(CALLER_HEADERS.LOCAL_COMM, owner.comm);
-				const cmd = owner.cmdline.join(" ").trim();
-				if (cmd) headers.set(CALLER_HEADERS.LOCAL_CMD, cmd.slice(0, 160));
+				const cmd = summariseLocalCommand(owner.cmdline);
+				if (cmd) headers.set(CALLER_HEADERS.LOCAL_CMD, cmd);
 			}
 		}
 		return new Request(req.url, {