@wrongstack/core 0.287.0 → 0.291.0

package/dist/observability/index.d.ts

@@ -3,6 +3,9 @@ export { DefaultHealthRegistry } from './health.js';
 export { NoopTracer } from './tracer.js';
 export { OTelTracer } from './otel-tracer.js';
 export { wireMetricsToEvents } from './event-bridge.js';
+export { emitProcessCompleted, emitProcessOutput, emitProcessStarted, runWithProcessTelemetry, type ProcessTelemetryContext, } from './process-telemetry.js';
+export { redactCommand, redactCommandArgs } from './redact-command.js';
+export { runWithNetworkTelemetry, startNetworkTelemetryMonitor, type NetworkTelemetryContext } from './network-telemetry.js';
 export { renderPrometheus, startMetricsServer, PROMETHEUS_CONTENT_TYPE, type MetricsServerOptions, type MetricsServerHandle, type MetricsTlsOptions, } from './prometheus.js';
 export { buildOtlpMetricsRequest, startOtlpMetricsExporter, type OtlpMetricsExporterOptions, type OtlpMetricsExporterHandle, } from './otlp-metrics.js';
 export { buildOtlpTracesRequest, startOtlpTraceExporter, type OtlpTraceExporterOptions, type OtlpTraceExporterHandle, } from './otlp-traces.js';

package/dist/observability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC"}

package/dist/observability/index.js

@@ -287,6 +287,276 @@ function metricToolName(name) {
   return name.startsWith("mcp__") ? "mcp_proxy" : name;
 }
 
+// src/observability/process-telemetry.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
+
+// src/utils/expect-defined.ts
+function expectDefined(value, label) {
+  if (value === null || value === void 0) {
+    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
+    err.name = "ExpectDefinedError";
+    throw err;
+  }
+  return value;
+}
+
+// src/observability/redact-command.ts
+var SENSITIVE_FLAG_PATTERNS = [
+  // --flag=value  or  --flag "value"  (value captured up to next space or comma)
+  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
+  // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
+  // The separator group is optional so the attached form (the common one) matches.
+  // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  // -p|-password|-a (redis auth) short flags: attached + separated + =value.
+  // Same token-start anchor; over-redaction is an accepted tradeoff for a
+  // redaction function (false positive = cosmetic noise; false negative = leak).
+  /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
+  // env var–style secrets: TOKEN=x, API_KEY=y, etc.
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
+  // when preceded by a flag name (e.g. --github-token=EyJ...).
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+];
+function redactCommand(cmd) {
+  let result = cmd;
+  for (const pattern of SENSITIVE_FLAG_PATTERNS) {
+    result = result.replace(pattern, (match) => {
+      const eq = match.indexOf("=");
+      const sp = match.search(/\s/);
+      const delim = eq !== -1 ? "=" : sp !== -1 ? match[sp] : null;
+      if (delim !== null) {
+        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
+        return `${flag}[REDACTED]`;
+      }
+      if (match.startsWith("--")) {
+        return match;
+      }
+      return `${match.slice(0, 2)}[REDACTED]`;
+    });
+  }
+  return result;
+}
+var BARE_SENSITIVE_LONG_FLAG = /^--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)$/i;
+var BARE_SENSITIVE_SHORT_FLAG = /^-(?:p|t|a)$/i;
+function redactCommandArgs(command, args) {
+  const redactedCommand = redactCommand(command);
+  const redactedArgs = args.map((a) => redactCommand(a));
+  for (let i = 0; i < redactedArgs.length - 1; i++) {
+    const flag = redactedArgs[i];
+    const next = redactedArgs[i + 1];
+    if (flag === void 0 || next === void 0) continue;
+    const isBareSensitive = (BARE_SENSITIVE_LONG_FLAG.test(flag) || BARE_SENSITIVE_SHORT_FLAG.test(flag)) && !flag.includes("[REDACTED]");
+    if (isBareSensitive && !next.startsWith("-")) {
+      redactedArgs[i + 1] = "[REDACTED]";
+    }
+  }
+  return { command: redactedCommand, args: redactedArgs };
+}
+
+// src/observability/process-telemetry.ts
+var storage = new AsyncLocalStorage();
+function runWithProcessTelemetry(context, run) {
+  return storage.run(context, run);
+}
+function emitProcessStarted(event) {
+  const { command, args } = redactCommandArgs(event.command, event.args);
+  emit("process.started", { ...event, command, args });
+}
+function emitProcessOutput(input) {
+  const bytes = Buffer.byteLength(input.chunk);
+  emit("process.output", {
+    ...input.pid !== void 0 ? { pid: input.pid } : {},
+    stream: input.stream,
+    bytes,
+    chunkHash: createHash("sha256").update(input.chunk).digest("hex"),
+    at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function emitProcessCompleted(event) {
+  emit("process.completed", event);
+}
+function emit(name, event) {
+  const context = storage.getStore();
+  if (!context) return;
+  const { events, ...identity2 } = context;
+  events.emit(name, { ...identity2, ...event });
+}
+
+// src/observability/network-telemetry.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { channel } from "node:diagnostics_channel";
+var storage2 = new AsyncLocalStorage2();
+var requests = /* @__PURE__ */ new WeakMap();
+var users = 0;
+var unsubscribe;
+function runWithNetworkTelemetry(context, run) {
+  return storage2.run(context, run);
+}
+function startNetworkTelemetryMonitor() {
+  users++;
+  if (!unsubscribe) unsubscribe = subscribe();
+  let stopped = false;
+  return () => {
+    if (stopped) return;
+    stopped = true;
+    users--;
+    if (users <= 0) {
+      unsubscribe?.();
+      unsubscribe = void 0;
+      users = 0;
+    }
+  };
+}
+function subscribe() {
+  const create = channel("undici:request:create");
+  const headers = channel("undici:request:headers");
+  const error = channel("undici:request:error");
+  const onCreate = (message) => {
+    const context = storage2.getStore();
+    const request = objectField(message, "request");
+    if (!context || !request) return;
+    const target = safeTarget(request);
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const requestBytes = numberField(request, "contentLength");
+    const state = {
+      ...context,
+      requestId: randomUUID(),
+      ...target,
+      ...requestBytes !== void 0 ? { requestBytes } : {},
+      startedAt,
+      startedNs: process.hrtime.bigint()
+    };
+    requests.set(request, state);
+    context.events.emit("network.request.started", {
+      ...identity(state),
+      requestId: state.requestId,
+      method: state.method,
+      scheme: state.scheme,
+      serverAddress: state.serverAddress,
+      ...state.serverPort !== void 0 ? { serverPort: state.serverPort } : {},
+      pathHash: state.pathHash,
+      queryKeys: queryKeys(request),
+      ...state.requestBytes !== void 0 ? { requestBytes: state.requestBytes } : {},
+      startedAt
+    });
+  };
+  const onHeaders = (message) => {
+    const request = objectField(message, "request");
+    if (!request) return;
+    const state = requests.get(request);
+    if (!state) return;
+    requests.delete(request);
+    const response = objectField(message, "response");
+    const responseBytes = contentLength(response);
+    state.events.emit("network.request.completed", {
+      ...identity(state),
+      requestId: state.requestId,
+      method: state.method,
+      scheme: state.scheme,
+      serverAddress: state.serverAddress,
+      ...state.serverPort !== void 0 ? { serverPort: state.serverPort } : {},
+      pathHash: state.pathHash,
+      statusCode: numberField(response, "statusCode") ?? 0,
+      durationMs: elapsed(state.startedNs),
+      ...state.requestBytes !== void 0 ? { requestBytes: state.requestBytes } : {},
+      ...responseBytes !== void 0 ? { responseBytes } : {},
+      completedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  };
+  const onError = (message) => {
+    const request = objectField(message, "request");
+    if (!request) return;
+    const state = requests.get(request);
+    if (!state) return;
+    requests.delete(request);
+    const err = objectField(message, "error");
+    const errorCode = stringField(err, "code");
+    state.events.emit("network.request.failed", {
+      ...identity(state),
+      requestId: state.requestId,
+      method: state.method,
+      scheme: state.scheme,
+      serverAddress: state.serverAddress,
+      ...state.serverPort !== void 0 ? { serverPort: state.serverPort } : {},
+      pathHash: state.pathHash,
+      durationMs: elapsed(state.startedNs),
+      errorName: stringField(err, "name") ?? "Error",
+      ...errorCode ? { errorCode } : {},
+      failedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  };
+  create.subscribe(onCreate);
+  headers.subscribe(onHeaders);
+  error.subscribe(onError);
+  return () => {
+    create.unsubscribe(onCreate);
+    headers.unsubscribe(onHeaders);
+    error.unsubscribe(onError);
+  };
+}
+function identity(state) {
+  return {
+    sessionId: state.sessionId,
+    ...state.traceId ? { traceId: state.traceId } : {},
+    ...state.agentId ? { agentId: state.agentId } : {},
+    ...state.toolCallId ? { toolCallId: state.toolCallId } : {},
+    ...state.attemptId ? { attemptId: state.attemptId } : {},
+    initiator: state.initiator,
+    operationName: state.operationName
+  };
+}
+function safeTarget(request) {
+  const origin = String(request.origin ?? "");
+  const path = String(request.path ?? "");
+  let url;
+  try {
+    url = new URL(path, origin);
+  } catch {
+    url = new URL("http://invalid.local/");
+  }
+  return {
+    method: String(request.method ?? "GET").toUpperCase(),
+    scheme: url.protocol.replace(":", ""),
+    serverAddress: url.hostname,
+    ...url.port ? { serverPort: Number(url.port) } : {},
+    pathHash: hash(url.pathname)
+  };
+}
+function queryKeys(request) {
+  try {
+    return [...new URL(String(request.path ?? ""), String(request.origin ?? "")).searchParams.keys()].filter((v, i, a) => a.indexOf(v) === i).slice(0, 50);
+  } catch {
+    return [];
+  }
+}
+function contentLength(response) {
+  const raw = response?.headers;
+  if (!Array.isArray(raw)) return void 0;
+  for (let index = 0; index < raw.length - 1; index += 2) if (String(raw[index]).toLowerCase() === "content-length") {
+    const value = Number(String(raw[index + 1]));
+    return Number.isFinite(value) ? value : void 0;
+  }
+  return void 0;
+}
+function objectField(value, key) {
+  return value && typeof value === "object" && value[key] && typeof value[key] === "object" ? value[key] : void 0;
+}
+function stringField(value, key) {
+  return typeof value?.[key] === "string" ? value[key] : void 0;
+}
+function numberField(value, key) {
+  return typeof value?.[key] === "number" ? value[key] : void 0;
+}
+function elapsed(start) {
+  return Number(process.hrtime.bigint() - start) / 1e6;
+}
+function hash(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+
 // src/observability/prometheus.ts
 var NUMBER_FORMAT_INFINITY = "NaN";
 function escapeLabelValue(v) {
@@ -701,8 +971,16 @@ export {
   PROMETHEUS_CONTENT_TYPE,
   buildOtlpMetricsRequest,
   buildOtlpTracesRequest,
+  emitProcessCompleted,
+  emitProcessOutput,
+  emitProcessStarted,
+  redactCommand,
+  redactCommandArgs,
   renderPrometheus,
+  runWithNetworkTelemetry,
+  runWithProcessTelemetry,
   startMetricsServer,
+  startNetworkTelemetryMonitor,
   startOtlpMetricsExporter,
   startOtlpTraceExporter,
   wireMetricsToEvents