autotel-devtools 20.0.1 → 21.0.0

package/dist/{http-uVPjDDld.js → http-CNZMrnzv.js}

@@ -1,10 +1,11 @@
+import { i as asString, o as stringAttr, t as asObject } from "./json-fields-CPjKZ2WH.js";
 import { t as pickRoot } from "./trace-root-EHnvuA7f.js";
 import { t as getResourceName } from "./resource-utils-B4UVvfnH.js";
 import { createServer } from "node:http";
 import { WebSocket, WebSocketServer } from "ws";
 import { ingestAgentEvents, ingestAgentMetrics } from "autotel-agents";
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import path, { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import protobuf from "protobufjs";
 
@@ -75,9 +76,9 @@ var ErrorAggregator = class {
 	*/
 	extractErrorFromSpan(span, trace) {
 		const exceptionEvent = span.events?.find((e) => e.name === "exception");
-		const errorType = span.attributes["exception.type"] || span.attributes["error.type"] || exceptionEvent?.attributes?.["exception.type"] || "Error";
-		const errorMessage = span.status.message || span.attributes["exception.message"] || span.attributes["error.message"] || "Unknown error";
-		const stackTrace = span.attributes["exception.stacktrace"] || span.attributes["exception.stack"] || this.extractStackFromEvents(span);
+		const errorType = stringAttr(span.attributes, "exception.type", "error.type") ?? stringAttr(exceptionEvent?.attributes, "exception.type") ?? "Error";
+		const errorMessage = span.status.message || stringAttr(span.attributes, "exception.message", "error.message") || "Unknown error";
+		const stackTrace = stringAttr(span.attributes, "exception.stacktrace", "exception.stack", "error.stack") ?? this.extractStackFromEvents(span);
 		return {
 			traceId: trace.traceId,
 			spanId: span.spanId,
@@ -87,7 +88,8 @@ var ErrorAggregator = class {
 			error: {
 				type: errorType,
 				message: errorMessage,
-				stackTrace
+				stackTrace,
+				fingerprint: stringAttr(span.attributes, "exception.fingerprint") ?? stringAttr(exceptionEvent?.attributes, "exception.fingerprint")
 			},
 			attributes: this.extractRelevantAttributes(span.attributes)
 		};
@@ -98,7 +100,7 @@ var ErrorAggregator = class {
 	extractStackFromEvents(span) {
 		if (!span.events) return void 0;
 		const exceptionEvent = span.events.find((e) => e.name === "exception");
-		if (exceptionEvent?.attributes) return exceptionEvent.attributes["exception.stacktrace"] || exceptionEvent.attributes["exception.stack"];
+		if (exceptionEvent?.attributes) return stringAttr(exceptionEvent.attributes, "exception.stacktrace", "exception.stack");
 	}
 	/**
 	* Extract relevant attributes for error context
@@ -127,6 +129,7 @@ var ErrorAggregator = class {
 	* Uses error type + first N stack frames (normalized)
 	*/
 	generateFingerprint(occurrence) {
+		if (occurrence.error.fingerprint) return occurrence.error.fingerprint;
 		const parts = [occurrence.error.type];
 		if (occurrence.error.stackTrace) {
 			const frames = this.extractStackFrames(occurrence.error.stackTrace, this.options.stackFramesForFingerprint);
@@ -530,13 +533,28 @@ var DevtoolsServer = class {
 	}
 };
 
+//#endregion
+//#region src/server/otlp-types.ts
+/**
+* An exporter's payload, read as the envelope it claims to be.
+*
+* SAFETY: this is the one place the receiver trusts the wire. Every field of
+* every envelope above is optional, so a payload that is not what it claims
+* reads back as empty arrays and undefined fields rather than throwing - which
+* is what the callers below rely on when they find no spans to add.
+*/
+function otlpEnvelope(payload) {
+	if (typeof payload !== "object" || payload === null) return void 0;
+	return payload;
+}
+
 //#endregion
 //#region src/server/otlp.ts
 function resolveOtlpValue(v) {
 	if (!v) return void 0;
 	if (v.stringValue !== void 0) return v.stringValue;
 	if (v.boolValue !== void 0) return v.boolValue;
-	if (v.intValue !== void 0) return typeof v.intValue === "string" ? Number(v.intValue) : v.intValue;
+	if (v.intValue !== void 0) return Number(v.intValue);
 	if (v.doubleValue !== void 0) return v.doubleValue;
 	if (v.bytesValue !== void 0) return v.bytesValue;
 	if (v.arrayValue?.values) return v.arrayValue.values.map(resolveOtlpValue);
@@ -548,6 +566,29 @@ function flattenAttributes(attrs) {
 	for (const { key, value } of attrs) out[key] = resolveOtlpValue(value);
 	return out;
 }
+/**
+* A log record's body: the text it carried, or the structure it carried when
+* the sender used an OTLP kvlist or array rather than a string.
+*/
+function logBody(body) {
+	const text = asString(body);
+	if (text !== void 0) return text;
+	if (body === void 0 || body === null) return "";
+	const structured = asObject(body);
+	if (!structured) return String(body);
+	return structured;
+}
+/**
+* Attributes handed to the agent layer, whose `Attributes` is OTel's own -
+* scalars and arrays of scalars, nothing nested.
+*
+* SAFETY: a coding agent's metrics and events carry scalar attributes only,
+* so the two shapes agree in practice. A sender that nests one anyway is
+* rendered by the Agents tab as whatever it is rather than being dropped.
+*/
+function agentAttributes(attributes) {
+	return attributes;
+}
 function nanoToMs(nano) {
 	if (!nano) return 0;
 	const ns = BigInt(nano);
@@ -555,19 +596,19 @@ function nanoToMs(nano) {
 	const remNs = ns % 1000000n;
 	return Number(ms) + Number(remNs) / 1e6;
 }
-const SPAN_KIND_MAP = {
-	0: "INTERNAL",
-	1: "INTERNAL",
-	2: "SERVER",
-	3: "CLIENT",
-	4: "PRODUCER",
-	5: "CONSUMER",
-	SPAN_KIND_INTERNAL: "INTERNAL",
-	SPAN_KIND_SERVER: "SERVER",
-	SPAN_KIND_CLIENT: "CLIENT",
-	SPAN_KIND_PRODUCER: "PRODUCER",
-	SPAN_KIND_CONSUMER: "CONSUMER"
-};
+const SPAN_KIND_MAP = /* @__PURE__ */ new Map([
+	[0, "INTERNAL"],
+	[1, "INTERNAL"],
+	[2, "SERVER"],
+	[3, "CLIENT"],
+	[4, "PRODUCER"],
+	[5, "CONSUMER"],
+	["SPAN_KIND_INTERNAL", "INTERNAL"],
+	["SPAN_KIND_SERVER", "SERVER"],
+	["SPAN_KIND_CLIENT", "CLIENT"],
+	["SPAN_KIND_PRODUCER", "PRODUCER"],
+	["SPAN_KIND_CONSUMER", "CONSUMER"]
+]);
 function normalizeHexId(id) {
 	if (!id) return "";
 	if (/^[A-Za-z0-9+/=]+$/.test(id) && !/^[0-9a-f]+$/i.test(id) && (id.length === 12 || id.length === 24 || id.length === 28 || id.length === 44 || id.length === 48)) try {
@@ -576,15 +617,13 @@ function normalizeHexId(id) {
 	return id;
 }
 function parseOtlpTraces(payload) {
-	if (!payload || typeof payload !== "object") return [];
-	const { resourceSpans } = payload;
-	if (!Array.isArray(resourceSpans) || resourceSpans.length === 0) return [];
+	const resourceSpans = otlpEnvelope(payload)?.resourceSpans;
+	if (!resourceSpans || resourceSpans.length === 0) return [];
 	const traceMap = /* @__PURE__ */ new Map();
 	for (const rs of resourceSpans) {
 		const resourceAttrs = flattenAttributes(rs.resource?.attributes);
 		const service = String(resourceAttrs["service.name"] || "unknown");
-		const scopeSpans = rs.scopeSpans || [];
-		for (const ss of scopeSpans) {
+		for (const ss of rs.scopeSpans ?? []) {
 			const scope = ss.scope?.name ? {
 				name: ss.scope.name,
 				version: ss.scope.version || void 0
@@ -603,7 +642,7 @@ function parseOtlpTraces(payload) {
 					spanId: normalizeHexId(span.spanId),
 					parentSpanId: normalizeHexId(span.parentSpanId) || void 0,
 					name: span.name || "unknown",
-					kind: SPAN_KIND_MAP[span.kind ?? 0] || "INTERNAL",
+					kind: SPAN_KIND_MAP.get(span.kind ?? 0) ?? "INTERNAL",
 					startTime: startMs,
 					endTime: endMs,
 					duration: endMs - startMs,
@@ -615,12 +654,12 @@ function parseOtlpTraces(payload) {
 						code: status,
 						message: span.status?.message
 					},
-					events: (span.events || []).map((e) => ({
+					events: (span.events ?? []).map((e) => ({
 						name: e.name || "",
 						timestamp: nanoToMs(e.timeUnixNano),
 						attributes: flattenAttributes(e.attributes)
 					})),
-					links: (span.links || []).map((l) => ({
+					links: (span.links ?? []).map((l) => ({
 						traceId: normalizeHexId(l.traceId),
 						spanId: normalizeHexId(l.spanId),
 						attributes: flattenAttributes(l.attributes)
@@ -643,7 +682,7 @@ function parseOtlpTraces(payload) {
 		const startTime = Math.min(...sorted.map((s) => s.startTime));
 		const endTime = Math.max(...sorted.map((s) => s.endTime));
 		const hasError = sorted.some((s) => s.status.code === "ERROR");
-		traces.push({
+		const trace = {
 			traceId,
 			correlationId: traceId.slice(0, 16),
 			rootSpan,
@@ -652,20 +691,20 @@ function parseOtlpTraces(payload) {
 			endTime,
 			duration: endTime - startTime,
 			status: hasError ? "ERROR" : "OK",
-			service,
-			...partial ? { partial: true } : {}
-		});
+			service
+		};
+		if (partial) trace.partial = true;
+		traces.push(trace);
 	}
 	return traces;
 }
 function parseOtlpLogs(payload) {
-	if (!payload || typeof payload !== "object") return [];
-	const { resourceLogs } = payload;
-	if (!Array.isArray(resourceLogs)) return [];
+	const resourceLogs = otlpEnvelope(payload)?.resourceLogs;
+	if (!resourceLogs) return [];
 	const logs = [];
 	for (const rl of resourceLogs) {
 		const resourceAttrs = flattenAttributes(rl.resource?.attributes);
-		for (const sl of rl.scopeLogs || []) for (const rec of sl.logRecords || []) {
+		for (const sl of rl.scopeLogs ?? []) for (const rec of sl.logRecords ?? []) {
 			const timestamp = nanoToMs(rec.timeUnixNano || rec.observedTimeUnixNano);
 			const traceId = normalizeHexId(rec.traceId) || void 0;
 			const spanId = normalizeHexId(rec.spanId) || void 0;
@@ -677,7 +716,7 @@ function parseOtlpLogs(payload) {
 				resourceName: getResourceName(resourceAttrs),
 				severityText: rec.severityText,
 				severityNumber: rec.severityNumber,
-				body: typeof body === "string" ? body : body,
+				body: logBody(body),
 				timestamp,
 				attributes: flattenAttributes(rec.attributes),
 				resource: resourceAttrs
@@ -687,11 +726,10 @@ function parseOtlpLogs(payload) {
 	return logs;
 }
 function countOtlpMetrics(payload) {
-	if (!payload || typeof payload !== "object") return 0;
-	const { resourceMetrics } = payload;
-	if (!Array.isArray(resourceMetrics)) return 0;
+	const resourceMetrics = otlpEnvelope(payload)?.resourceMetrics;
+	if (!resourceMetrics) return 0;
 	let count = 0;
-	for (const rm of resourceMetrics) for (const sm of rm.scopeMetrics || []) count += (sm.metrics || []).length;
+	for (const rm of resourceMetrics) for (const sm of rm.scopeMetrics ?? []) count += (sm.metrics ?? []).length;
 	return count;
 }
 function extractDataPoints(metric) {
@@ -701,14 +739,14 @@ function extractDataPoints(metric) {
 		const value = dp.asDouble !== void 0 ? Number(dp.asDouble) : dp.asInt !== void 0 ? Number(dp.asInt) : 0;
 		points.push({
 			value,
-			attributes: flattenAttributes(dp.attributes),
+			attributes: agentAttributes(flattenAttributes(dp.attributes)),
 			timestamp: nanoToMs(dp.timeUnixNano || dp.startTimeUnixNano)
 		});
 	}
 	const histPoints = metric.histogram?.dataPoints;
 	if (Array.isArray(histPoints)) for (const dp of histPoints) points.push({
 		value: dp.count !== void 0 ? Number(dp.count) : 0,
-		attributes: flattenAttributes(dp.attributes),
+		attributes: agentAttributes(flattenAttributes(dp.attributes)),
 		timestamp: nanoToMs(dp.timeUnixNano || dp.startTimeUnixNano)
 	});
 	return points;
@@ -724,19 +762,18 @@ function readTemporality(metric) {
 	if (raw === 1 || raw === "AGGREGATION_TEMPORALITY_DELTA") return "delta";
 }
 function parseOtlpMetrics(payload) {
-	if (!payload || typeof payload !== "object") return [];
-	const { resourceMetrics } = payload;
-	if (!Array.isArray(resourceMetrics)) return [];
+	const resourceMetrics = otlpEnvelope(payload)?.resourceMetrics;
+	if (!resourceMetrics) return [];
 	const records = [];
 	for (const rm of resourceMetrics) {
-		const resource = flattenAttributes(rm.resource?.attributes);
-		for (const sm of rm.scopeMetrics || []) {
+		const resource = agentAttributes(flattenAttributes(rm.resource?.attributes));
+		for (const sm of rm.scopeMetrics ?? []) {
 			const scope = sm.scope?.name ? {
 				name: sm.scope.name,
 				version: sm.scope.version || void 0
 			} : void 0;
-			for (const metric of sm.metrics || []) records.push({
-				name: metric.name,
+			for (const metric of sm.metrics ?? []) records.push({
+				name: metric.name ?? "",
 				unit: metric.unit || void 0,
 				description: metric.description || void 0,
 				temporality: readTemporality(metric),
@@ -755,20 +792,19 @@ function parseOtlpMetrics(payload) {
 * `parseOtlpLogs`, which feeds the generic Logs tab.
 */
 function parseOtlpAgentEvents(payload) {
-	if (!payload || typeof payload !== "object") return [];
-	const { resourceLogs } = payload;
-	if (!Array.isArray(resourceLogs)) return [];
+	const resourceLogs = otlpEnvelope(payload)?.resourceLogs;
+	if (!resourceLogs) return [];
 	const events = [];
 	for (const rl of resourceLogs) {
-		const resource = flattenAttributes(rl.resource?.attributes);
-		for (const sl of rl.scopeLogs || []) {
+		const resource = agentAttributes(flattenAttributes(rl.resource?.attributes));
+		for (const sl of rl.scopeLogs ?? []) {
 			const scope = sl.scope?.name ? {
 				name: sl.scope.name,
 				version: sl.scope.version || void 0
 			} : void 0;
-			for (const rec of sl.logRecords || []) {
-				const attributes = flattenAttributes(rec.attributes);
-				const eventName = typeof rec.eventName === "string" && rec.eventName || String(attributes["event.name"] ?? "");
+			for (const rec of sl.logRecords ?? []) {
+				const attributes = agentAttributes(flattenAttributes(rec.attributes));
+				const eventName = rec.eventName || String(attributes["event.name"] ?? "");
 				events.push({
 					eventName,
 					timestamp: nanoToMs(rec.timeUnixNano || rec.observedTimeUnixNano),
@@ -1121,6 +1157,98 @@ async function probePortHolder(host, port, timeoutMs = 500) {
 	}
 }
 
+//#endregion
+//#region src/server/source-file.ts
+/** Refuse to slurp something huge just because a span named it. */
+const MAX_BYTES = 2e6;
+const DISABLED = /* @__PURE__ */ new Set([
+	"false",
+	"0",
+	"off",
+	"no",
+	""
+]);
+/**
+* Decide what `GET /source` may read, from `AUTOTEL_DEVTOOLS_SOURCE_ROOT`.
+*
+* Defaults **on**, at the working directory: devtools is a local tool whose
+* whole point is showing you your own code, and requiring a flag for that would
+* mean nobody ever sees the feature. The blast radius stays small because two
+* other things still hold — the receiver is bound to loopback, and nothing
+* outside this directory is reachable. Set the variable to `false` to turn it
+* off outright.
+*
+* A non-loopback bind (`--host 0.0.0.0`) removes the first of those, and the
+* Origin guard does not replace it: a request with no `Origin` at all — any
+* `curl` on the network — passes. The root holds whatever else lives in the
+* project, `.env` included, so the default flips to **off** there. An explicit
+* root is still honoured: exposing it on purpose is the caller's call.
+*/
+function resolveSourceRoot(configured, cwd, loopbackOnly = true) {
+	if (configured === void 0) return loopbackOnly ? cwd : void 0;
+	if (DISABLED.has(configured.trim().toLowerCase())) return void 0;
+	return configured;
+}
+/**
+* Resolve `requested` against `root`, or return `null` if it escapes.
+*
+* Containment is judged on **real** paths so a symlink inside the root that
+* points outside it is rejected — lexical `..` stripping alone cannot see that.
+* The value returned is the *lexical* resolution, because the real one differs
+* from the caller's path whenever an ancestor is a symlink (on macOS both
+* `/tmp` and `/var` are), and a caller comparing paths should not have to know.
+*/
+function resolveWithinRoot(root, requested) {
+	const lexicalRoot = path.resolve(root);
+	const realRoot = safeRealpath(lexicalRoot);
+	if (realRoot === null) return null;
+	const lexicalTarget = path.resolve(lexicalRoot, requested);
+	const realTarget = safeRealpath(lexicalTarget);
+	if (realTarget === null) return null;
+	if (!isInside(realRoot, realTarget)) return null;
+	return lexicalTarget;
+}
+/** True when `target` is `root` itself or sits beneath it. */
+function isInside(root, target) {
+	if (target === root) return true;
+	return target.startsWith(root.endsWith(path.sep) ? root : root + path.sep);
+}
+function safeRealpath(p) {
+	try {
+		return realpathSync(p);
+	} catch {
+		return null;
+	}
+}
+/**
+* Read `context` lines either side of `line` from a file inside `root`.
+* Returns `null` when the path escapes the root, is not a readable file, or is
+* too large — the caller cannot distinguish those, which is the point.
+*/
+function readSourceWindow(root, requested, line, context) {
+	const resolved = resolveWithinRoot(root, requested);
+	if (resolved === null) return null;
+	let text;
+	try {
+		const stat = statSync(resolved);
+		if (!stat.isFile() || stat.size > MAX_BYTES) return null;
+		text = readFileSync(resolved, "utf8");
+	} catch {
+		return null;
+	}
+	const all = text.split("\n");
+	if (all.at(-1) === "") all.pop();
+	const startLine = Math.max(1, line - context);
+	const endLine = Math.min(all.length, line + context);
+	if (startLine > all.length) return null;
+	return {
+		file: path.relative(path.resolve(root), resolved),
+		line,
+		startLine,
+		lines: all.slice(startLine - 1, endLine)
+	};
+}
+
 //#endregion
 //#region src/server/http.ts
 function sendOtlpError(res, req, e) {
@@ -1184,6 +1312,7 @@ function getWidgetJs() {
 }
 function attachDevtoolsRoutes(httpServer, devtools, options = {}) {
 	const loopbackOnly = options.loopbackOnly ?? true;
+	const sourceRoot = options.sourceRoot;
 	const fullpageHtml = renderFullpageHtml(options.title);
 	httpServer.on("request", async (req, res) => {
 		if (req.headers.upgrade?.toLowerCase() === "websocket") return;
@@ -1224,6 +1353,31 @@ function attachDevtoolsRoutes(httpServer, devtools, options = {}) {
 			res.end(DEVTOOLS_FAVICON_SVG);
 			return;
 		}
+		if (req.method === "GET" && url.split("?")[0] === "/source") {
+			if (!sourceRoot) {
+				sendJson(res, 404, { error: "Not found" });
+				return;
+			}
+			if (!allowSensitiveRequest(req.headers, loopbackOnly)) {
+				sendJson(res, 403, { error: "Forbidden" });
+				return;
+			}
+			const query = new URL(url, "http://localhost").searchParams;
+			const file = query.get("file");
+			const line = Number(query.get("line"));
+			const context = Math.min(Math.max(Number(query.get("context") ?? 5) || 0, 0), 50);
+			if (!file || !Number.isInteger(line) || line < 1) {
+				sendJson(res, 400, { error: "file and a positive integer line are required" });
+				return;
+			}
+			const window = readSourceWindow(sourceRoot, file, line, context);
+			if (window === null) {
+				sendJson(res, 404, { error: "Not found" });
+				return;
+			}
+			sendJson(res, 200, { ...window });
+			return;
+		}
 		if (req.method === "GET" && url === "/healthz") {
 			sendJson(res, 200, {
 				ok: true,
@@ -1296,4 +1450,4 @@ function createDevtoolsHttpServer(devtools, _options = {}) {
 }
 
 //#endregion
-export { appendWithLimit as _, decodeOtlpLogsRequest as a, ErrorAggregator as b, isProtobufContentType as c, DevtoolsServer as d, allowSensitiveRequest as f, appendManyWithLimit as g, originIsLoopback as h, probePortHolder as i, parseOtlpLogs as l, isLoopbackHostname as m, createDevtoolsHttpServer as n, decodeOtlpMetricsRequest as o, hostHeaderIsLoopback as p, DEVTOOLS_IDENTITY as r, decodeOtlpTraceRequest as s, attachDevtoolsRoutes as t, parseOtlpTraces as u, applyTelemetryLimits as v, resolveTelemetryLimits as y };
+export { appendManyWithLimit as _, probePortHolder as a, resolveTelemetryLimits as b, decodeOtlpTraceRequest as c, parseOtlpTraces as d, DevtoolsServer as f, originIsLoopback as g, isLoopbackHostname as h, DEVTOOLS_IDENTITY as i, isProtobufContentType as l, hostHeaderIsLoopback as m, createDevtoolsHttpServer as n, decodeOtlpLogsRequest as o, allowSensitiveRequest as p, resolveSourceRoot as r, decodeOtlpMetricsRequest as s, attachDevtoolsRoutes as t, parseOtlpLogs as u, appendWithLimit as v, ErrorAggregator as x, applyTelemetryLimits as y };