@xopcai/xopc 0.0.362 → 0.0.363

package/dist/src/config/loader.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { ConfigSchema, init_schema } from "./schema.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { init_paths, resolveConfigPath } from "./paths.js";
 import { init_resolution, setActivePlatformDiscovery } from "../platform/resolution.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
+import { ConfigSchema, init_schema } from "./schema.js";
 import { assertChannelPluginConfigs } from "./validate-channel-configs.js";
 import { isGatewayConfigLockedByAnotherProcessSync } from "../gateway/lock.js";
 import { dirname } from "path";

package/dist/src/config/models-json.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
 import { init_paths, resolveModelsJsonPath } from "./paths.js";
 import { ComputerProfileSchema, init_src } from "../../packages/computer-control-contract/src/index.js";
-import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
 import { init_model_policy, isComputerModel } from "../computer/model-policy.js";
 import { existsSync, readFileSync } from "fs";
 import { z } from "zod";

package/dist/src/config/reload.d.ts

@@ -17,6 +17,7 @@ export interface ReloadResult {
  */
 export type ReloadCallback = (newConfig: Config) => void | Promise<void>;
 export interface ReloadCallbacks {
+    onTracingReload?: ReloadCallback;
     onModelsReload?: ReloadCallback;
     onChannelsReload?: ReloadCallback;
     onCronReload?: ReloadCallback;

package/dist/src/config/reload.js

@@ -161,6 +161,10 @@ var ConfigHotReloader = class {
 	* Apply a single hot-reloadable path
 	*/
 	async applyHotPath(path, newConfig) {
+		if (path === "observability" || path.startsWith("observability.")) {
+			await this.callbacks.onTracingReload?.(newConfig);
+			return;
+		}
 		if (path.startsWith("models.")) {
 			if (this.callbacks.onModelsReload) await Promise.resolve(this.callbacks.onModelsReload(newConfig));
 			return;

package/dist/src/config/rules.js

@@ -113,6 +113,11 @@ const BASE_RELOAD_RULES = [
 		kind: "hot",
 		description: "Hot reload toggle"
 	},
+	{
+		prefix: "observability",
+		kind: "hot",
+		description: "Tracing storage and export"
+	},
 	{
 		prefix: "channels",
 		kind: "hot",

package/dist/src/config/schema.d.ts

@@ -1216,6 +1216,29 @@ export declare const ExperimentalConfigSchema: z.ZodDefault<z.ZodObject<{
 }, z.core.$strict>>;
 export type ExperimentalConfig = z.infer<typeof ExperimentalConfigSchema>;
 export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
+    observability: z.ZodOptional<z.ZodObject<{
+        tracing: z.ZodPrefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            capture: z.ZodDefault<z.ZodEnum<{
+                metadata: "metadata";
+                redacted: "redacted";
+                detailed: "detailed";
+            }>>;
+            detailedUntil: z.ZodOptional<z.ZodNumber>;
+            local: z.ZodPrefault<z.ZodObject<{
+                retentionDays: z.ZodDefault<z.ZodNumber>;
+                maxStoreMiB: z.ZodDefault<z.ZodNumber>;
+                maxTraces: z.ZodDefault<z.ZodNumber>;
+                maxSpans: z.ZodDefault<z.ZodNumber>;
+                maxTraceKiB: z.ZodDefault<z.ZodNumber>;
+                maxWriteMiBPerMinute: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+            langfuse: z.ZodPrefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                baseUrl: z.ZodDefault<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strict>>;
+    }, z.core.$strip>>;
     userContext: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         preferences: z.ZodDefault<z.ZodObject<{

package/dist/src/config/schema.js

@@ -1,10 +1,11 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { ComputerConfigSchema, init_config } from "../computer/config.js";
 import { AgentModelsOverrideSchema, ImageGenerationRouteSchema, ModelRouteSchema } from "../agent-config/schema.js";
 import { resolveEffectiveAgentConfig } from "../agent-config/resolver.js";
 import { init_agent_config } from "../agent-config/index.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
-import { DEFAULT_CONTEXT_COMPACTION_POLICY, UserContextConfigSchema, init_config as init_config$1 } from "../user-context/config.js";
+import { TracingConfigSchema, init_config } from "../observability/config.js";
+import { ComputerConfigSchema, init_config as init_config$1 } from "../computer/config.js";
+import { DEFAULT_CONTEXT_COMPACTION_POLICY, UserContextConfigSchema, init_config as init_config$2 } from "../user-context/config.js";
 import { init_public_url, validatePublicUrl } from "./public-url.js";
 import { PlatformConfigSchema, init_contracts } from "../platform/contracts.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, init_config_schema } from "../../extensions/telegram/src/config-schema.js";
@@ -44,9 +45,10 @@ function parseModelRef(ref) {
 var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentModelsSchema, BrowserDriverSchema, BrowserHostnameSchema, BrowserConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, RuntimePreferenceSchema, RuntimeProvisionSchema, RuntimeVersionRequestSchema, LanguageRuntimeSchema, DEFAULT_RUNTIME_TOOLS_CONFIG, RuntimeToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayScenesConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, UpdateConfigSchema, CommandsConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpOAuthConfigSchema, McpServerSchema, McpConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
 	init_config();
+	init_config$1();
 	init_agent_config();
 	init_repository();
-	init_config$1();
+	init_config$2();
 	init_public_url();
 	init_contracts();
 	init_config_schema();
@@ -959,6 +961,7 @@ tts: TTSConfigSchema.optional() }).optional();
 	/** First-run activation that analyzes one explicitly selected local folder. */
 workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDiscoveryOnboarding: true });
 	ConfigSchema = z.object({
+		observability: z.object({ tracing: TracingConfigSchema.prefault({}) }).optional(),
 		userContext: UserContextConfigSchema,
 		session: SessionConfigSchema,
 		channels: ChannelsConfigSchema,

package/dist/src/extensions/activation-context.js

@@ -1,5 +1,5 @@
-import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { PROVIDER_ENV_MAP, init_env_keys } from "../providers/env-keys.js";
+import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_providers, isProviderConfiguredSync } from "../providers/index.js";
 import { collectSttProviderConfigEntries } from "../voice/stt/config-slice.js";
 import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";

package/dist/src/extensions/lockfile.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
+import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
 import { dirname, join } from "path";
 import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from "fs";
 import { mkdir, readFile } from "fs/promises";

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,10 +1,10 @@
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
-import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
+import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
+import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";

package/dist/src/gateway/hono/routes/agents.js

@@ -1,6 +1,6 @@
+import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentEntrySchema, AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
-import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { init_agent_scope } from "../../../agent/agent-scope.js";
 import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,8 +1,8 @@
-import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { BindingsSchema, init_binding_schema } from "../../../../routing/binding-schema.js";
+import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
+import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
 import { BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
-import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
 import { AgentCatalogService } from "../../../../agent-catalog/service.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";

package/dist/src/gateway/hono/routes/connectors.js

@@ -20,6 +20,7 @@ import { createConnectorSetupSecretRequest, submitConnectorSetupSecret } from ".
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
 import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorInstances } from "../../../connectors/instances.js";
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
+import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
@@ -28,7 +29,6 @@ import { inspectManagedComposioStatus } from "../../../connectors/composio-manag
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
 import { ingestLocalFolderSource } from "../../../connectors/connected-source-ingestion.js";
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
-import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -297,6 +297,14 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			return { register: registerLogsRoutes };
 		}
 	},
+	{
+		id: "observability",
+		match: (path) => startsWithAny(path, ["/api/observability"]),
+		load: async () => {
+			const { registerObservabilityRoutes } = await import("./observability.js");
+			return { register: registerObservabilityRoutes };
+		}
+	},
 	{
 		id: "usage",
 		match: (path) => startsWithAny(path, ["/api/usage"]),

package/dist/src/gateway/hono/routes/models.js

@@ -1,11 +1,11 @@
-import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
 import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { computerModelProfile, init_model_policy, isDedicatedComputerModel } from "../../../computer/model-policy.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";
-import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";

package/dist/src/gateway/hono/routes/observability.d.ts

@@ -0,0 +1,3 @@
+import { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerObservabilityRoutes(authenticated: Hono, { service, strictRateLimitMiddleware }: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/observability.js

@@ -0,0 +1,106 @@
+import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
+import { TracingConfigSchema, init_config } from "../../../observability/config.js";
+import { configureTracing, localStore, testLangfuse, tracingConfig, tracingStatus } from "../../../observability/runtime.js";
+import { z } from "zod";
+import { Hono } from "hono";
+//#region src/gateway/hono/routes/observability.ts
+init_credentials();
+init_config();
+const traceIdSchema = z.string().regex(/^[0-9a-f]{32}$/);
+const querySchema = z.object({
+	limit: z.coerce.number().int().min(1).max(100).optional(),
+	cursor: z.string().regex(/^\d{1,16}:[0-9a-f]{32}$/).optional(),
+	from: z.coerce.number().int().nonnegative().optional(),
+	to: z.coerce.number().int().positive().optional(),
+	status: z.enum([
+		"running",
+		"success",
+		"error",
+		"cancelled",
+		"suspended",
+		"interrupted"
+	]).optional(),
+	conversationId: z.string().max(200).optional(),
+	runId: z.string().max(200).optional(),
+	agentId: z.string().max(200).optional()
+});
+function registerObservabilityRoutes(authenticated, { service, strictRateLimitMiddleware }) {
+	const app = new Hono();
+	app.onError((error, c) => {
+		if (error instanceof z.ZodError || error instanceof SyntaxError) return c.json({ error: "Invalid tracing request" }, 400);
+		return c.json({ error: "Tracing service unavailable" }, 503);
+	});
+	app.get("/tracing/settings", async (c) => {
+		const resolver = new CredentialResolver();
+		const secret = process.env.LANGFUSE_SECRET_KEY || await resolver.revealGatewayStoredApiKey("langfuse");
+		const pub = process.env.LANGFUSE_PUBLIC_KEY || await resolver.revealGatewayStoredApiKey("langfuse-public");
+		return c.json({
+			config: tracingConfig(),
+			credentials: {
+				publicKeyConfigured: Boolean(pub),
+				secretKeyConfigured: Boolean(secret),
+				publicKeySource: process.env.LANGFUSE_PUBLIC_KEY ? "environment" : pub ? "stored" : "none",
+				secretKeySource: process.env.LANGFUSE_SECRET_KEY ? "environment" : secret ? "stored" : "none",
+				baseUrlSource: process.env.LANGFUSE_BASE_URL ? "environment" : "config"
+			}
+		});
+	});
+	app.patch("/tracing/settings", strictRateLimitMiddleware, async (c) => {
+		const parsed = TracingConfigSchema.parse(await c.req.json());
+		if (parsed.capture === "detailed") parsed.detailedUntil = Date.now() + 1800 * 1e3;
+		else delete parsed.detailedUntil;
+		const next = {
+			...service.currentConfig,
+			observability: { tracing: parsed }
+		};
+		if (!(await service.saveConfig(next)).saved) return c.json({ error: "Could not save tracing configuration" }, 500);
+		await configureTracing(parsed);
+		return c.json({
+			ok: true,
+			config: parsed
+		});
+	});
+	app.put("/tracing/langfuse/credentials", strictRateLimitMiddleware, async (c) => {
+		const body = z.object({
+			publicKey: z.string().trim().min(1).max(512).optional(),
+			secretKey: z.string().trim().min(1).max(512).optional()
+		}).strict().parse(await c.req.json());
+		const resolver = new CredentialResolver();
+		if (body.publicKey) await resolver.saveApiKey("langfuse-public", body.publicKey, { profileName: "default" });
+		if (body.secretKey) await resolver.saveApiKey("langfuse", body.secretKey, { profileName: "default" });
+		await configureTracing(service.currentConfig.observability?.tracing);
+		return c.json({ ok: true });
+	});
+	app.delete("/tracing/langfuse/credentials", strictRateLimitMiddleware, async (c) => {
+		const resolver = new CredentialResolver();
+		await resolver.deleteProviderCredential("langfuse");
+		await resolver.deleteProviderCredential("langfuse-public");
+		await configureTracing(service.currentConfig.observability?.tracing);
+		return c.json({ ok: true });
+	});
+	app.post("/tracing/langfuse/test", strictRateLimitMiddleware, async (c) => c.json({ ok: await testLangfuse() }));
+	app.get("/tracing/status", async (c) => c.json(await tracingStatus()));
+	app.get("/traces", async (c) => c.json(await localStore().request("list", querySchema.parse(c.req.query()))));
+	app.post("/traces/prune", strictRateLimitMiddleware, async (c) => {
+		await localStore().request("prune");
+		return c.json({ ok: true });
+	});
+	app.delete("/traces", strictRateLimitMiddleware, async (c) => {
+		await localStore().clear();
+		return c.json({ ok: true });
+	});
+	app.get("/traces/:traceId/export", async (c) => {
+		const id = traceIdSchema.parse(c.req.param("traceId"));
+		const data = await localStore().request("detail", id);
+		if (!data) return c.json({ error: "Trace not found" }, 404);
+		c.header("Content-Disposition", `attachment; filename="trace-${id}.json"`);
+		return c.json(data);
+	});
+	app.get("/traces/:traceId", async (c) => {
+		const data = await localStore().request("detail", traceIdSchema.parse(c.req.param("traceId")));
+		return data ? c.json(data) : c.json({ error: "Trace not found" }, 404);
+	});
+	authenticated.route("/api/observability", app);
+}
+//#endregion
+export { registerObservabilityRoutes };

package/dist/src/gateway/image-generation-setup.js

@@ -1,7 +1,7 @@
 import { normalizeAgentId } from "../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
-import { ConfigSchema, init_schema } from "../config/schema.js";
 import { init_agent_scope } from "../agent/agent-scope.js";
+import { ConfigSchema, init_schema } from "../config/schema.js";
 import { resolveEffectiveAgentConfigForAgent } from "../config/agent-profile.js";
 import { fetchWithTimeoutGuarded } from "../media-shared/http/provider-http.js";
 import "../media-shared/http/index.js";

package/dist/src/gateway/lock.js

@@ -1,8 +1,8 @@
 import path from "node:path";
 import fs from "node:fs";
 import { createHash } from "node:crypto";
-import net from "node:net";
 import fs$1 from "node:fs/promises";
+import net from "node:net";
 import { homedir } from "os";
 //#region src/gateway/lock.ts
 /**

package/dist/src/gateway/security/gateway-scopes.js

@@ -24,6 +24,7 @@ function requiredGatewayScope(method, path) {
 	if (method === "GET" && path === "/api/connectors/approvals") return "sessions.read";
 	if (method === "POST" && path === "/api/connectors/approvals/respond") return "sessions.write";
 	if (path === "/api/agent" || path.startsWith("/api/agent/")) return "agents.run";
+	if (path === "/api/observability" || path.startsWith("/api/observability/")) return "gateway.admin";
 	if (path.startsWith("/api/usage")) return "gateway.admin";
 	if (path.startsWith("/api/agents") || path.startsWith("/api/models")) return methodScope(method, "agents.read", "gateway.admin");
 	if (path.startsWith("/api/sessions") || path.startsWith("/api/side-chats")) return methodScope(method, "sessions.read", "sessions.write");

package/dist/src/gateway/service/config-coordinator.d.ts

@@ -1,28 +1,3 @@
-/**
- * GatewayConfigCoordinator — owns config persistence, hot-reload, and the
- * per-section reload handlers.
- *
- * Was 350 lines of `GatewayService` covering nine concerns:
- *   - manual `reloadConfig()` (CLI/UI trigger)
- *   - `saveConfig()` / `updateConfig()` (PATCH /api/config)
- *   - `setExtensionActivationTarget` (extension lifecycle)
- *   - `afterWeixinCredentialsPersisted` / `afterFeishuCredentialsPersisted`
- *     (QR-login follow-ups that bypass the watcher)
- *   - `ConfigHotReloader` (fs.watch → debounced per-section dispatch)
- *   - Section reload handlers (models / agents / channels /
- *     tools / mcp / extensions)
- *   - `scheduleChannelPluginsAfterPersist` (coalesces rapid saves so
- *     Telegram/Weixin do not stop/start repeatedly)
- *
- * Pulled out so the gateway composition root stays focused on lifecycle, and
- * each handler is reachable from one place when adding a new config section.
- *
- * **Config state ownership.** `GatewayService.config` is still the single
- * source of truth — this coordinator reads it via `getConfig()` and writes it
- * back via `setConfig()` after every reload / persist. We pass through rather
- * than holding our own copy so other coordinators (sessions, marketplace,
- * agent runner) see the latest config the moment a reload commits.
- */
 import type { Config } from '../../config/schema.js';
 import type { AgentService } from '../../agent/service.js';
 import type { ChannelManager } from '../../channels/manager.js';

package/dist/src/gateway/service/config-coordinator.js

@@ -1,5 +1,6 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { configureTracing } from "../../observability/runtime.js";
 import { getModelRegistry } from "../../providers/model-registry.js";
 import { init_providers } from "../../providers/index.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
@@ -11,6 +12,31 @@ import "../../config/index.js";
 import { computeExtensionActivationPatch } from "../../extensions/bundled-extension-activation.js";
 import { sanitizeTunnelConfig } from "../../tunnel/tunnel-config.js";
 //#region src/gateway/service/config-coordinator.ts
+/**
+* GatewayConfigCoordinator — owns config persistence, hot-reload, and the
+* per-section reload handlers.
+*
+* Was 350 lines of `GatewayService` covering nine concerns:
+*   - manual `reloadConfig()` (CLI/UI trigger)
+*   - `saveConfig()` / `updateConfig()` (PATCH /api/config)
+*   - `setExtensionActivationTarget` (extension lifecycle)
+*   - `afterWeixinCredentialsPersisted` / `afterFeishuCredentialsPersisted`
+*     (QR-login follow-ups that bypass the watcher)
+*   - `ConfigHotReloader` (fs.watch → debounced per-section dispatch)
+*   - Section reload handlers (models / agents / channels /
+*     tools / mcp / extensions)
+*   - `scheduleChannelPluginsAfterPersist` (coalesces rapid saves so
+*     Telegram/Weixin do not stop/start repeatedly)
+*
+* Pulled out so the gateway composition root stays focused on lifecycle, and
+* each handler is reachable from one place when adding a new config section.
+*
+* **Config state ownership.** `GatewayService.config` is still the single
+* source of truth — this coordinator reads it via `getConfig()` and writes it
+* back via `setConfig()` after every reload / persist. We pass through rather
+* than holding our own copy so other coordinators (sessions, marketplace,
+* agent runner) see the latest config the moment a reload commits.
+*/
 init_providers();
 init_logger();
 const log = createLogger("GatewayConfigCoordinator");
@@ -26,6 +52,10 @@ var GatewayConfigCoordinator = class {
 	startHotReloader() {
 		if (this.configReloader) return;
 		this.configReloader = new ConfigHotReloader(this.opts.configPath, this.opts.getConfig(), {
+			onTracingReload: async (next) => {
+				this.opts.setConfig(next);
+				await configureTracing(next.observability?.tracing);
+			},
 			onModelsReload: (newConfig) => this.handleModelsReload(newConfig),
 			onChannelsReload: (newConfig) => this.handleChannelsReload(newConfig),
 			onCronReload: (newConfig) => this.handleAutomationReload(newConfig),
@@ -316,6 +346,7 @@ var GatewayConfigCoordinator = class {
 		await saveConfig(configToWrite, this.opts.configPath);
 		const reloaded = loadConfig(this.opts.configPath);
 		this.opts.setConfig(reloaded);
+		await configureTracing(reloaded.observability?.tracing);
 		if (sanitizeTunnelConfig(reloaded)) await saveConfig(reloaded, this.opts.configPath);
 		this.opts.getAgentService().applyRuntimeConfiguration(reloaded);
 		await this.opts.reconcileMemoryMaintenanceAutomations().catch((err) => {

package/dist/src/gateway/service.js

@@ -17,14 +17,15 @@ import { init_session_repository, listSessionMetadata, patchSessionMetadata } fr
 import { getSessionConfig, init_config_repository } from "../storage/sqlite/config-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { normalizeAgentId } from "../agent-catalog/id.js";
+import { init_agent_scope, listAgentEntries, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
+import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
+import { flushTracing } from "../observability/runtime.js";
 import { init_config, resolveKnowledgeReadPolicy } from "../user-context/config.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { init_agent_scope, listAgentEntries, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
 import { init_agent_session_key, resolveAgentMainConversationId } from "../routing/agent-session-key.js";
 import { init_session_key, resolveConversationId, sanitizeSegment } from "../routing/session-key.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
-import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
 import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { init_providers, providers_exports } from "../providers/index.js";
 import { AI_USAGE_RETENTION_MS, markStaleAiUsageEventsUnknown, pruneAiUsageEvents } from "../storage/sqlite/ai-usage-repository.js";
@@ -1513,6 +1514,7 @@ var GatewayService = class {
 		}
 	}
 	async stop() {
+		await flushTracing();
 		if (!this.running) return;
 		this.stopping = true;
 		this.taskRunDispatcher?.stop();
@@ -1563,7 +1565,7 @@ var GatewayService = class {
 		await disposeAllSessionMcpRuntimes().catch((err) => {
 			log.warn({ err }, "MCP runtime shutdown failed");
 		});
-		this._agentService?.stop();
+		await this._agentService?.stop();
 		this.running = false;
 		this.bus.shutdown();
 		this.lastDeferredChannelConnectIds = [];

package/dist/src/infra/update-restart.js

@@ -2,8 +2,8 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveConfigPath } from "../config/paths.js";
 import { loadConfig } from "../config/loader.js";
-import { resolveGatewayService } from "../daemon/service.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
+import { resolveGatewayService } from "../daemon/service.js";
 import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "./restart.js";
 import { findVerifiedGatewayListenerPidsOnPortSync, signalVerifiedGatewayPidSync } from "./gateway-processes.js";
 import { refreshGatewayServiceAfterUpdate } from "./update-service-refresh.js";

package/dist/src/observability/config.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+export declare const TracingConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    capture: z.ZodDefault<z.ZodEnum<{
+        metadata: "metadata";
+        redacted: "redacted";
+        detailed: "detailed";
+    }>>;
+    detailedUntil: z.ZodOptional<z.ZodNumber>;
+    local: z.ZodPrefault<z.ZodObject<{
+        retentionDays: z.ZodDefault<z.ZodNumber>;
+        maxStoreMiB: z.ZodDefault<z.ZodNumber>;
+        maxTraces: z.ZodDefault<z.ZodNumber>;
+        maxSpans: z.ZodDefault<z.ZodNumber>;
+        maxTraceKiB: z.ZodDefault<z.ZodNumber>;
+        maxWriteMiBPerMinute: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    langfuse: z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        baseUrl: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export type TracingConfig = z.infer<typeof TracingConfigSchema>;
+export declare const defaultTracingConfig: () => {
+    enabled: boolean;
+    capture: "metadata" | "redacted" | "detailed";
+    local: {
+        retentionDays: number;
+        maxStoreMiB: number;
+        maxTraces: number;
+        maxSpans: number;
+        maxTraceKiB: number;
+        maxWriteMiBPerMinute: number;
+    };
+    langfuse: {
+        enabled: boolean;
+        baseUrl: string;
+    };
+    detailedUntil?: number;
+};

package/dist/src/observability/config.js

@@ -0,0 +1,31 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { z } from "zod";
+//#region src/observability/config.ts
+var TracingConfigSchema, defaultTracingConfig;
+var init_config = __esmMin((() => {
+	TracingConfigSchema = z.object({
+		enabled: z.boolean().default(true),
+		capture: z.enum([
+			"metadata",
+			"redacted",
+			"detailed"
+		]).default("redacted"),
+		detailedUntil: z.number().int().nonnegative().optional(),
+		local: z.object({
+			retentionDays: z.number().int().min(1).max(90).default(7),
+			maxStoreMiB: z.number().int().min(16).max(4096).default(256),
+			maxTraces: z.number().int().min(10).max(1e5).default(1e4),
+			maxSpans: z.number().int().min(100).max(1e6).default(1e5),
+			maxTraceKiB: z.number().int().min(16).max(4096).default(1024),
+			maxWriteMiBPerMinute: z.number().int().min(1).max(100).default(2)
+		}).prefault({}),
+		langfuse: z.object({
+			enabled: z.boolean().default(false),
+			baseUrl: z.string().url().max(2048).refine((value) => ["http:", "https:"].includes(new URL(value).protocol), "HTTP(S) URL required").default("https://cloud.langfuse.com")
+		}).prefault({})
+	}).strict();
+	defaultTracingConfig = () => TracingConfigSchema.parse({});
+}));
+//#endregion
+init_config();
+export { TracingConfigSchema, defaultTracingConfig, init_config };

package/dist/src/observability/langfuse.d.ts

@@ -0,0 +1,31 @@
+import type { TraceRecord } from './types.js';
+/** Bounded OTLP/HTTP JSON exporter. No hidden SDK queue or durable replay. */
+export declare class LangfuseTarget {
+    private baseUrl;
+    private publicKey;
+    private secretKey;
+    private queue;
+    private bytes;
+    private timer?;
+    private sending?;
+    private controller?;
+    private closed;
+    private lastWarning;
+    dropped: number;
+    lastSuccess?: number;
+    lastFailure?: number;
+    lastError?: string;
+    constructor(baseUrl: string, publicKey: string, secretKey: string);
+    status(): {
+        state: string;
+        pending: number;
+        dropped: number;
+        lastSuccess: number;
+        lastFailure: number;
+        lastError: string;
+    };
+    enqueue(record: TraceRecord): void;
+    flush(): Promise<void>;
+    private send;
+    close(): void;
+}