autotel-devtools 19.1.0 → 20.1.0

package/README.md

@@ -214,6 +214,7 @@ AUTOTEL_MAX_METRIC_COUNT=50000   # Max metrics to keep (default: 100)
 AUTOTEL_DEVTOOLS_PORT=4318       # Server port (default: 4318)
 AUTOTEL_DEVTOOLS_HOST=127.0.0.1  # Bind host (default: 127.0.0.1)
 AUTOTEL_DEVTOOLS_TITLE="My App"  # Dashboard title (optional)
+AUTOTEL_DEVTOOLS_SOURCE_ROOT=.   # Root GET /source may read (default: cwd on a loopback bind, else off; `false` disables)
 ```
 
 ### CLI Options

package/dist/cli.cjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const require_http = require('./http-53ldVU8k.cjs');
+const require_http = require('./http-D44dITGS.cjs');
 const require_listen = require('./listen-DGzVi7DE.cjs');
 let node_http = require("node:http");
 let node_fs = require("node:fs");
@@ -79,9 +79,11 @@ async function startReceiver(options) {
 		host: options.host,
 		verbose: true
 	});
+	const sourceRoot = require_http.resolveSourceRoot(process.env.AUTOTEL_DEVTOOLS_SOURCE_ROOT, process.cwd(), loopbackOnly);
 	require_http.attachDevtoolsRoutes(httpServer, wsServer, {
 		loopbackOnly,
-		title: options.title
+		title: options.title,
+		sourceRoot
 	});
 	const listeners = require_listen.listenLoopbackDualStack({
 		primary: httpServer,
@@ -89,7 +91,8 @@ async function startReceiver(options) {
 		host: options.host,
 		attachSecondary: (s) => require_http.attachDevtoolsRoutes(s, wsServer, {
 			loopbackOnly,
-			title: options.title
+			title: options.title,
+			sourceRoot
 		})
 	});
 	const { addresses, warnings, port: boundPort } = await listeners.ready;

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { d as DevtoolsServer, i as probePortHolder, p as hostHeaderIsLoopback, t as attachDevtoolsRoutes } from "./http-B8rl56bF.js";
+import { a as probePortHolder, f as DevtoolsServer, m as hostHeaderIsLoopback, r as resolveSourceRoot, t as attachDevtoolsRoutes } from "./http-Ddn7gT0R.js";
 import { t as listenLoopbackDualStack } from "./listen-NVMbBWHw.js";
 import { createServer } from "node:http";
 import { readFileSync } from "node:fs";
@@ -79,9 +79,11 @@ async function startReceiver(options) {
 		host: options.host,
 		verbose: true
 	});
+	const sourceRoot = resolveSourceRoot(process.env.AUTOTEL_DEVTOOLS_SOURCE_ROOT, process.cwd(), loopbackOnly);
 	attachDevtoolsRoutes(httpServer, wsServer, {
 		loopbackOnly,
-		title: options.title
+		title: options.title,
+		sourceRoot
 	});
 	const listeners = listenLoopbackDualStack({
 		primary: httpServer,
@@ -89,7 +91,8 @@ async function startReceiver(options) {
 		host: options.host,
 		attachSecondary: (s) => attachDevtoolsRoutes(s, wsServer, {
 			loopbackOnly,
-			title: options.title
+			title: options.title,
+			sourceRoot
 		})
 	});
 	const { addresses, warnings, port: boundPort } = await listeners.ready;

package/dist/{http-53ldVU8k.cjs → http-D44dITGS.cjs}

@@ -32,6 +32,7 @@ let ws = require("ws");
 let autotel_agents = require("autotel-agents");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
+node_path = __toESM(node_path, 1);
 let node_url = require("node:url");
 let protobufjs = require("protobufjs");
 protobufjs = __toESM(protobufjs, 1);
@@ -105,7 +106,7 @@ var ErrorAggregator = class {
 		const exceptionEvent = span.events?.find((e) => e.name === "exception");
 		const errorType = span.attributes["exception.type"] || span.attributes["error.type"] || exceptionEvent?.attributes?.["exception.type"] || "Error";
 		const errorMessage = span.status.message || span.attributes["exception.message"] || span.attributes["error.message"] || "Unknown error";
-		const stackTrace = span.attributes["exception.stacktrace"] || span.attributes["exception.stack"] || this.extractStackFromEvents(span);
+		const stackTrace = span.attributes["exception.stacktrace"] || span.attributes["exception.stack"] || span.attributes["error.stack"] || this.extractStackFromEvents(span);
 		return {
 			traceId: trace.traceId,
 			spanId: span.spanId,
@@ -201,7 +202,7 @@ var ErrorAggregator = class {
 	* Normalize error message by removing dynamic parts
 	*/
 	normalizeMessage(message) {
-		return message.replaceAll(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "[UUID]").replaceAll(/\b[0-9a-f]{16,}\b/gi, "[ID]").replaceAll(/\b\d+\b/g, "[N]").replaceAll(/"[^"]*"/g, "\"[STR]\"").replaceAll(/'[^']*'/g, "'[STR]'").slice(0, 200);
+		return message.replaceAll(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "[UUID]").replaceAll(/\b[0-9a-f]{16,}\b/gi, "[ID]").replaceAll(/\d+/g, "[N]").replaceAll(/"[^"]*"/g, "\"[STR]\"").replaceAll(/'[^']*'/g, "'[STR]'").slice(0, 200);
 	}
 	/**
 	* Normalize stack trace for display
@@ -1149,6 +1150,98 @@ async function probePortHolder(host, port, timeoutMs = 500) {
 	}
 }
 
+//#endregion
+//#region src/server/source-file.ts
+/** Refuse to slurp something huge just because a span named it. */
+const MAX_BYTES = 2e6;
+const DISABLED = /* @__PURE__ */ new Set([
+	"false",
+	"0",
+	"off",
+	"no",
+	""
+]);
+/**
+* Decide what `GET /source` may read, from `AUTOTEL_DEVTOOLS_SOURCE_ROOT`.
+*
+* Defaults **on**, at the working directory: devtools is a local tool whose
+* whole point is showing you your own code, and requiring a flag for that would
+* mean nobody ever sees the feature. The blast radius stays small because two
+* other things still hold — the receiver is bound to loopback, and nothing
+* outside this directory is reachable. Set the variable to `false` to turn it
+* off outright.
+*
+* A non-loopback bind (`--host 0.0.0.0`) removes the first of those, and the
+* Origin guard does not replace it: a request with no `Origin` at all — any
+* `curl` on the network — passes. The root holds whatever else lives in the
+* project, `.env` included, so the default flips to **off** there. An explicit
+* root is still honoured: exposing it on purpose is the caller's call.
+*/
+function resolveSourceRoot(configured, cwd, loopbackOnly = true) {
+	if (configured === void 0) return loopbackOnly ? cwd : void 0;
+	if (DISABLED.has(configured.trim().toLowerCase())) return void 0;
+	return configured;
+}
+/**
+* Resolve `requested` against `root`, or return `null` if it escapes.
+*
+* Containment is judged on **real** paths so a symlink inside the root that
+* points outside it is rejected — lexical `..` stripping alone cannot see that.
+* The value returned is the *lexical* resolution, because the real one differs
+* from the caller's path whenever an ancestor is a symlink (on macOS both
+* `/tmp` and `/var` are), and a caller comparing paths should not have to know.
+*/
+function resolveWithinRoot(root, requested) {
+	const lexicalRoot = node_path.default.resolve(root);
+	const realRoot = safeRealpath(lexicalRoot);
+	if (realRoot === null) return null;
+	const lexicalTarget = node_path.default.resolve(lexicalRoot, requested);
+	const realTarget = safeRealpath(lexicalTarget);
+	if (realTarget === null) return null;
+	if (!isInside(realRoot, realTarget)) return null;
+	return lexicalTarget;
+}
+/** True when `target` is `root` itself or sits beneath it. */
+function isInside(root, target) {
+	if (target === root) return true;
+	return target.startsWith(root.endsWith(node_path.default.sep) ? root : root + node_path.default.sep);
+}
+function safeRealpath(p) {
+	try {
+		return (0, node_fs.realpathSync)(p);
+	} catch {
+		return null;
+	}
+}
+/**
+* Read `context` lines either side of `line` from a file inside `root`.
+* Returns `null` when the path escapes the root, is not a readable file, or is
+* too large — the caller cannot distinguish those, which is the point.
+*/
+function readSourceWindow(root, requested, line, context) {
+	const resolved = resolveWithinRoot(root, requested);
+	if (resolved === null) return null;
+	let text;
+	try {
+		const stat = (0, node_fs.statSync)(resolved);
+		if (!stat.isFile() || stat.size > MAX_BYTES) return null;
+		text = (0, node_fs.readFileSync)(resolved, "utf8");
+	} catch {
+		return null;
+	}
+	const all = text.split("\n");
+	if (all.at(-1) === "") all.pop();
+	const startLine = Math.max(1, line - context);
+	const endLine = Math.min(all.length, line + context);
+	if (startLine > all.length) return null;
+	return {
+		file: node_path.default.relative(node_path.default.resolve(root), resolved),
+		line,
+		startLine,
+		lines: all.slice(startLine - 1, endLine)
+	};
+}
+
 //#endregion
 //#region src/server/http.ts
 function sendOtlpError(res, req, e) {
@@ -1212,6 +1305,7 @@ function getWidgetJs() {
 }
 function attachDevtoolsRoutes(httpServer, devtools, options = {}) {
 	const loopbackOnly = options.loopbackOnly ?? true;
+	const sourceRoot = options.sourceRoot;
 	const fullpageHtml = renderFullpageHtml(options.title);
 	httpServer.on("request", async (req, res) => {
 		if (req.headers.upgrade?.toLowerCase() === "websocket") return;
@@ -1252,6 +1346,31 @@ function attachDevtoolsRoutes(httpServer, devtools, options = {}) {
 			res.end(DEVTOOLS_FAVICON_SVG);
 			return;
 		}
+		if (req.method === "GET" && url.split("?")[0] === "/source") {
+			if (!sourceRoot) {
+				sendJson(res, 404, { error: "Not found" });
+				return;
+			}
+			if (!allowSensitiveRequest(req.headers, loopbackOnly)) {
+				sendJson(res, 403, { error: "Forbidden" });
+				return;
+			}
+			const query = new URL(url, "http://localhost").searchParams;
+			const file = query.get("file");
+			const line = Number(query.get("line"));
+			const context = Math.min(Math.max(Number(query.get("context") ?? 5) || 0, 0), 50);
+			if (!file || !Number.isInteger(line) || line < 1) {
+				sendJson(res, 400, { error: "file and a positive integer line are required" });
+				return;
+			}
+			const window = readSourceWindow(sourceRoot, file, line, context);
+			if (window === null) {
+				sendJson(res, 404, { error: "Not found" });
+				return;
+			}
+			sendJson(res, 200, { ...window });
+			return;
+		}
 		if (req.method === "GET" && url === "/healthz") {
 			sendJson(res, 200, {
 				ok: true,
@@ -1438,6 +1557,12 @@ Object.defineProperty(exports, 'probePortHolder', {
     return probePortHolder;
   }
 });
+Object.defineProperty(exports, 'resolveSourceRoot', {
+  enumerable: true,
+  get: function () {
+    return resolveSourceRoot;
+  }
+});
 Object.defineProperty(exports, 'resolveTelemetryLimits', {
   enumerable: true,
   get: function () {

package/dist/{http-B8rl56bF.js → http-Ddn7gT0R.js}

@@ -3,8 +3,8 @@ import { t as getResourceName } from "./resource-utils-B4UVvfnH.js";
 import { createServer } from "node:http";
 import { WebSocket, WebSocketServer } from "ws";
 import { ingestAgentEvents, ingestAgentMetrics } from "autotel-agents";
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import path, { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import protobuf from "protobufjs";
 
@@ -77,7 +77,7 @@ var ErrorAggregator = class {
 		const exceptionEvent = span.events?.find((e) => e.name === "exception");
 		const errorType = span.attributes["exception.type"] || span.attributes["error.type"] || exceptionEvent?.attributes?.["exception.type"] || "Error";
 		const errorMessage = span.status.message || span.attributes["exception.message"] || span.attributes["error.message"] || "Unknown error";
-		const stackTrace = span.attributes["exception.stacktrace"] || span.attributes["exception.stack"] || this.extractStackFromEvents(span);
+		const stackTrace = span.attributes["exception.stacktrace"] || span.attributes["exception.stack"] || span.attributes["error.stack"] || this.extractStackFromEvents(span);
 		return {
 			traceId: trace.traceId,
 			spanId: span.spanId,
@@ -173,7 +173,7 @@ var ErrorAggregator = class {
 	* Normalize error message by removing dynamic parts
 	*/
 	normalizeMessage(message) {
-		return message.replaceAll(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "[UUID]").replaceAll(/\b[0-9a-f]{16,}\b/gi, "[ID]").replaceAll(/\b\d+\b/g, "[N]").replaceAll(/"[^"]*"/g, "\"[STR]\"").replaceAll(/'[^']*'/g, "'[STR]'").slice(0, 200);
+		return message.replaceAll(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "[UUID]").replaceAll(/\b[0-9a-f]{16,}\b/gi, "[ID]").replaceAll(/\d+/g, "[N]").replaceAll(/"[^"]*"/g, "\"[STR]\"").replaceAll(/'[^']*'/g, "'[STR]'").slice(0, 200);
 	}
 	/**
 	* Normalize stack trace for display
@@ -1121,6 +1121,98 @@ async function probePortHolder(host, port, timeoutMs = 500) {
 	}
 }
 
+//#endregion
+//#region src/server/source-file.ts
+/** Refuse to slurp something huge just because a span named it. */
+const MAX_BYTES = 2e6;
+const DISABLED = /* @__PURE__ */ new Set([
+	"false",
+	"0",
+	"off",
+	"no",
+	""
+]);
+/**
+* Decide what `GET /source` may read, from `AUTOTEL_DEVTOOLS_SOURCE_ROOT`.
+*
+* Defaults **on**, at the working directory: devtools is a local tool whose
+* whole point is showing you your own code, and requiring a flag for that would
+* mean nobody ever sees the feature. The blast radius stays small because two
+* other things still hold — the receiver is bound to loopback, and nothing
+* outside this directory is reachable. Set the variable to `false` to turn it
+* off outright.
+*
+* A non-loopback bind (`--host 0.0.0.0`) removes the first of those, and the
+* Origin guard does not replace it: a request with no `Origin` at all — any
+* `curl` on the network — passes. The root holds whatever else lives in the
+* project, `.env` included, so the default flips to **off** there. An explicit
+* root is still honoured: exposing it on purpose is the caller's call.
+*/
+function resolveSourceRoot(configured, cwd, loopbackOnly = true) {
+	if (configured === void 0) return loopbackOnly ? cwd : void 0;
+	if (DISABLED.has(configured.trim().toLowerCase())) return void 0;
+	return configured;
+}
+/**
+* Resolve `requested` against `root`, or return `null` if it escapes.
+*
+* Containment is judged on **real** paths so a symlink inside the root that
+* points outside it is rejected — lexical `..` stripping alone cannot see that.
+* The value returned is the *lexical* resolution, because the real one differs
+* from the caller's path whenever an ancestor is a symlink (on macOS both
+* `/tmp` and `/var` are), and a caller comparing paths should not have to know.
+*/
+function resolveWithinRoot(root, requested) {
+	const lexicalRoot = path.resolve(root);
+	const realRoot = safeRealpath(lexicalRoot);
+	if (realRoot === null) return null;
+	const lexicalTarget = path.resolve(lexicalRoot, requested);
+	const realTarget = safeRealpath(lexicalTarget);
+	if (realTarget === null) return null;
+	if (!isInside(realRoot, realTarget)) return null;
+	return lexicalTarget;
+}
+/** True when `target` is `root` itself or sits beneath it. */
+function isInside(root, target) {
+	if (target === root) return true;
+	return target.startsWith(root.endsWith(path.sep) ? root : root + path.sep);
+}
+function safeRealpath(p) {
+	try {
+		return realpathSync(p);
+	} catch {
+		return null;
+	}
+}
+/**
+* Read `context` lines either side of `line` from a file inside `root`.
+* Returns `null` when the path escapes the root, is not a readable file, or is
+* too large — the caller cannot distinguish those, which is the point.
+*/
+function readSourceWindow(root, requested, line, context) {
+	const resolved = resolveWithinRoot(root, requested);
+	if (resolved === null) return null;
+	let text;
+	try {
+		const stat = statSync(resolved);
+		if (!stat.isFile() || stat.size > MAX_BYTES) return null;
+		text = readFileSync(resolved, "utf8");
+	} catch {
+		return null;
+	}
+	const all = text.split("\n");
+	if (all.at(-1) === "") all.pop();
+	const startLine = Math.max(1, line - context);
+	const endLine = Math.min(all.length, line + context);
+	if (startLine > all.length) return null;
+	return {
+		file: path.relative(path.resolve(root), resolved),
+		line,
+		startLine,
+		lines: all.slice(startLine - 1, endLine)
+	};
+}
+
 //#endregion
 //#region src/server/http.ts
 function sendOtlpError(res, req, e) {
@@ -1184,6 +1276,7 @@ function getWidgetJs() {
 }
 function attachDevtoolsRoutes(httpServer, devtools, options = {}) {
 	const loopbackOnly = options.loopbackOnly ?? true;
+	const sourceRoot = options.sourceRoot;
 	const fullpageHtml = renderFullpageHtml(options.title);
 	httpServer.on("request", async (req, res) => {
 		if (req.headers.upgrade?.toLowerCase() === "websocket") return;
@@ -1224,6 +1317,31 @@ function attachDevtoolsRoutes(httpServer, devtools, options = {}) {
 			res.end(DEVTOOLS_FAVICON_SVG);
 			return;
 		}
+		if (req.method === "GET" && url.split("?")[0] === "/source") {
+			if (!sourceRoot) {
+				sendJson(res, 404, { error: "Not found" });
+				return;
+			}
+			if (!allowSensitiveRequest(req.headers, loopbackOnly)) {
+				sendJson(res, 403, { error: "Forbidden" });
+				return;
+			}
+			const query = new URL(url, "http://localhost").searchParams;
+			const file = query.get("file");
+			const line = Number(query.get("line"));
+			const context = Math.min(Math.max(Number(query.get("context") ?? 5) || 0, 0), 50);
+			if (!file || !Number.isInteger(line) || line < 1) {
+				sendJson(res, 400, { error: "file and a positive integer line are required" });
+				return;
+			}
+			const window = readSourceWindow(sourceRoot, file, line, context);
+			if (window === null) {
+				sendJson(res, 404, { error: "Not found" });
+				return;
+			}
+			sendJson(res, 200, { ...window });
+			return;
+		}
 		if (req.method === "GET" && url === "/healthz") {
 			sendJson(res, 200, {
 				ok: true,
@@ -1296,4 +1414,4 @@ function createDevtoolsHttpServer(devtools, _options = {}) {
 }
 
 //#endregion
-export { appendWithLimit as _, decodeOtlpLogsRequest as a, ErrorAggregator as b, isProtobufContentType as c, DevtoolsServer as d, allowSensitiveRequest as f, appendManyWithLimit as g, originIsLoopback as h, probePortHolder as i, parseOtlpLogs as l, isLoopbackHostname as m, createDevtoolsHttpServer as n, decodeOtlpMetricsRequest as o, hostHeaderIsLoopback as p, DEVTOOLS_IDENTITY as r, decodeOtlpTraceRequest as s, attachDevtoolsRoutes as t, parseOtlpTraces as u, applyTelemetryLimits as v, resolveTelemetryLimits as y };
+export { appendManyWithLimit as _, probePortHolder as a, resolveTelemetryLimits as b, decodeOtlpTraceRequest as c, parseOtlpTraces as d, DevtoolsServer as f, originIsLoopback as g, isLoopbackHostname as h, DEVTOOLS_IDENTITY as i, isProtobufContentType as l, hostHeaderIsLoopback as m, createDevtoolsHttpServer as n, decodeOtlpLogsRequest as o, allowSensitiveRequest as p, resolveSourceRoot as r, decodeOtlpMetricsRequest as s, attachDevtoolsRoutes as t, parseOtlpLogs as u, appendWithLimit as v, ErrorAggregator as x, applyTelemetryLimits as y };

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_http = require('./http-53ldVU8k.cjs');
+const require_http = require('./http-D44dITGS.cjs');
 const require_listen = require('./listen-DGzVi7DE.cjs');
 const require_server_exporter = require('./server/exporter.cjs');
 const require_server_log_exporter = require('./server/log-exporter.cjs');
@@ -21,12 +21,19 @@ function createDevtools(options = {}) {
 		maxLogCount: options.maxLogCount,
 		maxMetricCount: options.maxMetricCount
 	});
-	require_http.attachDevtoolsRoutes(httpServer, wsServer, { loopbackOnly });
+	const sourceRoot = require_http.resolveSourceRoot(options.sourceRoot === false ? "false" : options.sourceRoot ?? process.env.AUTOTEL_DEVTOOLS_SOURCE_ROOT, process.cwd(), loopbackOnly);
+	require_http.attachDevtoolsRoutes(httpServer, wsServer, {
+		loopbackOnly,
+		sourceRoot
+	});
 	const listeners = require_listen.listenLoopbackDualStack({
 		primary: httpServer,
 		port,
 		host,
-		attachSecondary: (s) => require_http.attachDevtoolsRoutes(s, wsServer, { loopbackOnly })
+		attachSecondary: (s) => require_http.attachDevtoolsRoutes(s, wsServer, {
+			loopbackOnly,
+			sourceRoot
+		})
 	});
 	if (options.verbose) listeners.ready.then(({ warnings }) => {
 		for (const w of warnings) console.warn(`[autotel-devtools] ${w}`);

package/dist/index.d.cts

@@ -12,6 +12,14 @@ interface CreateDevtoolsOptions {
   maxTraceCount?: number;
   maxLogCount?: number;
   maxMetricCount?: number;
+  /**
+   * Project root the Errors tab may read source from, so a stack frame can show
+   * the line that threw.
+   *
+   * Same default as the CLI: the working directory on a loopback bind, off
+   * otherwise. `false` disables it. See `resolveSourceRoot`.
+   */
+  sourceRoot?: string | false;
 }
 interface DevtoolsInstance {
   server: DevtoolsServer;

package/dist/index.d.ts

@@ -12,6 +12,14 @@ interface CreateDevtoolsOptions {
   maxTraceCount?: number;
   maxLogCount?: number;
   maxMetricCount?: number;
+  /**
+   * Project root the Errors tab may read source from, so a stack frame can show
+   * the line that threw.
+   *
+   * Same default as the CLI: the working directory on a loopback bind, off
+   * otherwise. `false` disables it. See `resolveSourceRoot`.
+   */
+  sourceRoot?: string | false;
 }
 interface DevtoolsInstance {
   server: DevtoolsServer;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { b as ErrorAggregator, d as DevtoolsServer, p as hostHeaderIsLoopback, t as attachDevtoolsRoutes } from "./http-B8rl56bF.js";
+import { f as DevtoolsServer, m as hostHeaderIsLoopback, r as resolveSourceRoot, t as attachDevtoolsRoutes, x as ErrorAggregator } from "./http-Ddn7gT0R.js";
 import { t as listenLoopbackDualStack } from "./listen-NVMbBWHw.js";
 import { DevtoolsSpanExporter } from "./server/exporter.js";
 import { DevtoolsLogExporter } from "./server/log-exporter.js";
@@ -20,12 +20,19 @@ function createDevtools(options = {}) {
 		maxLogCount: options.maxLogCount,
 		maxMetricCount: options.maxMetricCount
 	});
-	attachDevtoolsRoutes(httpServer, wsServer, { loopbackOnly });
+	const sourceRoot = resolveSourceRoot(options.sourceRoot === false ? "false" : options.sourceRoot ?? process.env.AUTOTEL_DEVTOOLS_SOURCE_ROOT, process.cwd(), loopbackOnly);
+	attachDevtoolsRoutes(httpServer, wsServer, {
+		loopbackOnly,
+		sourceRoot
+	});
 	const listeners = listenLoopbackDualStack({
 		primary: httpServer,
 		port,
 		host,
-		attachSecondary: (s) => attachDevtoolsRoutes(s, wsServer, { loopbackOnly })
+		attachSecondary: (s) => attachDevtoolsRoutes(s, wsServer, {
+			loopbackOnly,
+			sourceRoot
+		})
 	});
 	if (options.verbose) listeners.ready.then(({ warnings }) => {
 		for (const w of warnings) console.warn(`[autotel-devtools] ${w}`);

package/dist/server/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_http = require('../http-53ldVU8k.cjs');
+const require_http = require('../http-D44dITGS.cjs');
 const require_server_exporter = require('./exporter.cjs');
 const require_server_log_exporter = require('./log-exporter.cjs');
 const require_server_remote_exporter = require('./remote-exporter.cjs');

package/dist/server/index.d.cts

@@ -16,6 +16,15 @@ interface DevtoolsRoutesOptions {
   /** Browser tab title for the fullpage UI. Without it every dashboard reads
    *  `autotel-devtools`, which is unhelpful with several running at once. */
   title?: string;
+  /**
+   * Project root that `GET /source` may read from, so a stack frame can show
+   * the line that threw.
+   *
+   * Opt-in and absent by default: without it the route 404s and devtools never
+   * touches the filesystem. Reading is confined to this directory, symlinks
+   * included — see `resolveWithinRoot`.
+   */
+  sourceRoot?: string;
 }
 declare function attachDevtoolsRoutes(httpServer: Server, devtools: DevtoolsServer, options?: DevtoolsRoutesOptions): void;
 declare function createDevtoolsHttpServer(devtools: DevtoolsServer, _options?: HttpServerOptions): Server;

package/dist/server/index.d.ts

@@ -16,6 +16,15 @@ interface DevtoolsRoutesOptions {
   /** Browser tab title for the fullpage UI. Without it every dashboard reads
    *  `autotel-devtools`, which is unhelpful with several running at once. */
   title?: string;
+  /**
+   * Project root that `GET /source` may read from, so a stack frame can show
+   * the line that threw.
+   *
+   * Opt-in and absent by default: without it the route 404s and devtools never
+   * touches the filesystem. Reading is confined to this directory, symlinks
+   * included — see `resolveWithinRoot`.
+   */
+  sourceRoot?: string;
 }
 declare function attachDevtoolsRoutes(httpServer: Server, devtools: DevtoolsServer, options?: DevtoolsRoutesOptions): void;
 declare function createDevtoolsHttpServer(devtools: DevtoolsServer, _options?: HttpServerOptions): Server;

package/dist/server/index.js

@@ -1,4 +1,4 @@
-import { _ as appendWithLimit, a as decodeOtlpLogsRequest, b as ErrorAggregator, c as isProtobufContentType, d as DevtoolsServer, f as allowSensitiveRequest, g as appendManyWithLimit, h as originIsLoopback, i as probePortHolder, l as parseOtlpLogs, m as isLoopbackHostname, n as createDevtoolsHttpServer, o as decodeOtlpMetricsRequest, p as hostHeaderIsLoopback, r as DEVTOOLS_IDENTITY, s as decodeOtlpTraceRequest, t as attachDevtoolsRoutes, u as parseOtlpTraces, v as applyTelemetryLimits, y as resolveTelemetryLimits } from "../http-B8rl56bF.js";
+import { _ as appendManyWithLimit, a as probePortHolder, b as resolveTelemetryLimits, c as decodeOtlpTraceRequest, d as parseOtlpTraces, f as DevtoolsServer, g as originIsLoopback, h as isLoopbackHostname, i as DEVTOOLS_IDENTITY, l as isProtobufContentType, m as hostHeaderIsLoopback, n as createDevtoolsHttpServer, o as decodeOtlpLogsRequest, p as allowSensitiveRequest, s as decodeOtlpMetricsRequest, t as attachDevtoolsRoutes, u as parseOtlpLogs, v as appendWithLimit, x as ErrorAggregator, y as applyTelemetryLimits } from "../http-Ddn7gT0R.js";
 import { DevtoolsSpanExporter } from "./exporter.js";
 import { DevtoolsLogExporter } from "./log-exporter.js";
 import { DevtoolsRemoteExporter } from "./remote-exporter.js";