ccdeck 3.38.6 → 3.39.0

package/src/server/traffic-radar-config.mjs

@@ -0,0 +1,87 @@
+import { open } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { claudeConfigDir } from "./claude-dir.mjs";
+
+const BOOLEAN_KEYS = [
+  "CLAUDE_CODE_ENABLE_TELEMETRY", "CLAUDE_CODE_ENHANCED_TELEMETRY_BETA",
+  "ENABLE_ENHANCED_TELEMETRY_BETA", "OTEL_LOG_USER_PROMPTS",
+  "OTEL_LOG_ASSISTANT_RESPONSES", "OTEL_LOG_TOOL_DETAILS",
+  "OTEL_LOG_TOOL_CONTENT", "OTEL_LOG_RAW_API_BODIES", "OTEL_LOG_MANAGED_SETTINGS",
+];
+const SIGNALS = ["METRICS", "LOGS", "TRACES"];
+const ENDPOINT_KEYS = ["OTEL_EXPORTER_OTLP_ENDPOINT", ...SIGNALS.map(s => `OTEL_EXPORTER_OTLP_${s}_ENDPOINT`)];
+const EXPORTER_KEYS = SIGNALS.map(s => `OTEL_${s}_EXPORTER`);
+const INTERVAL_KEYS = ["OTEL_METRIC_EXPORT_INTERVAL", "OTEL_LOGS_EXPORT_INTERVAL", "OTEL_TRACES_EXPORT_INTERVAL"];
+const HEADER_KEYS = ["OTEL_EXPORTER_OTLP_HEADERS", ...SIGNALS.map(s => `OTEL_EXPORTER_OTLP_${s}_HEADERS`)];
+const PROTOCOL_KEYS = ["OTEL_EXPORTER_OTLP_PROTOCOL", ...SIGNALS.map(s => `OTEL_EXPORTER_OTLP_${s}_PROTOCOL`)];
+export const RADAR_KEYS = [...BOOLEAN_KEYS, ...ENDPOINT_KEYS, ...EXPORTER_KEYS, ...INTERVAL_KEYS, ...HEADER_KEYS, ...PROTOCOL_KEYS];
+
+export function safeRadarValue(key, raw) {
+  if (HEADER_KEYS.includes(key)) return "Configured (hidden)";
+  if (typeof raw !== "string" && typeof raw !== "number" && typeof raw !== "boolean") return "Invalid (value hidden)";
+  const value = String(raw).trim();
+  if (PROTOCOL_KEYS.includes(key)) return ['grpc', 'http/protobuf', 'http/json'].includes(value) ? value : "Unknown (value hidden)";
+  if (BOOLEAN_KEYS.includes(key)) {
+    if (key === "OTEL_LOG_RAW_API_BODIES" && value.startsWith("file:")) return "Enabled (file destination hidden)";
+    if (["1", "true"].includes(value)) return "Enabled";
+    if (["0", "false"].includes(value)) return "Disabled";
+    return "Unknown (value hidden)";
+  }
+  if (ENDPOINT_KEYS.includes(key)) {
+    try {
+      const url = new URL(value);
+      if (!["http:", "https:"].includes(url.protocol) || !url.hostname) return "Invalid (value hidden)";
+      return `${url.protocol}//${url.hostname}${url.port ? `:${url.port}` : ""}`;
+    } catch { return "Invalid (value hidden)"; }
+  }
+  if (EXPORTER_KEYS.includes(key)) {
+    const exporters = value.split(",").map(s => s.trim());
+    return exporters.length && exporters.every(s => ["otlp", "console", "none", "prometheus"].includes(s))
+      ? exporters.join(", ") : "Unknown (value hidden)";
+  }
+  if (INTERVAL_KEYS.includes(key)) {
+    return /^\d+$/.test(value) && Number(value) > 0 && Number(value) <= 86_400_000
+      ? `${Number(value)} ms` : "Invalid (value hidden)";
+  }
+  return "Unknown (value hidden)";
+}
+
+export function radarVariables(settings, source) {
+  const env = settings?.env;
+  if (!env || typeof env !== "object" || Array.isArray(env)) return [];
+  return RADAR_KEYS.filter(key => Object.hasOwn(env, key)).map(key => ({
+    key, value: safeRadarValue(key, env[key]), source,
+    ...(BOOLEAN_KEYS.includes(key) && ["1", "0", "true", "false"].includes(String(env[key]).trim()) ? { rawValue: String(env[key]).trim() } : {}),
+  }));
+}
+
+async function readBoundedJson(path) {
+  const file = await open(path, "r");
+  try {
+    const stat = await file.stat();
+    if (!stat.isFile() || stat.size > 262_144) throw new Error("invalid_file");
+    const buffer = Buffer.alloc(262_145);
+    const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+    if (bytesRead > 262_144) throw new Error("oversize");
+    return JSON.parse(buffer.subarray(0, bytesRead).toString("utf8"));
+  } finally { await file.close(); }
+}
+
+export async function readRadarConfig({ home = homedir(), env = process.env, readJson = readBoundedJson } = {}) {
+  const dir = claudeConfigDir(env, home);
+  const files = [
+    ["User settings", join(dir, "settings.json")],
+    ["Cached organization settings", join(dir, "remote-settings.json")],
+    ["Managed settings", "/Library/Application Support/ClaudeCode/managed-settings.json"],
+  ];
+  const sources = await Promise.all(files.map(async ([name, path]) => {
+    try {
+      const settings = await readJson(path);
+      return { name, status: "read", variables: radarVariables(settings, name) };
+    } catch (error) {
+      return { name, status: error?.code === "ENOENT" ? "absent" : "unavailable", variables: [] };
+    }
+  }));
+  return { sources: sources.map(({ name, status }) => ({ name, status })), variables: sources.flatMap(s => s.variables) };
+}

package/src/server/traffic-radar-helper.mjs

@@ -0,0 +1,43 @@
+import { pathToFileURL } from "node:url";
+
+export async function streamCapture({ base, token, source = 0, input = process.stdin, send = fetch, report = message => process.stderr.write(message + '\n') }) {
+  const url = new URL(base);
+  if (url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || url.username || url.password || url.pathname !== '/' || url.search || url.hash || !/^[a-f0-9]{64}$/.test(token)) throw new Error('Invalid local capture destination.');
+  if (!Number.isInteger(source) || source < 0 || source > 7) throw new Error('Invalid capture source.');
+  let stopped = false, sequence = Promise.resolve();
+  const finish = () => { stopped = true; input.destroy(); };
+  const post = bytes => {
+    sequence = sequence.then(async () => {
+      if (stopped) return;
+      try {
+        const response = await send(new URL('/api/system/traffic-radar/ingest', url), {
+          method: 'POST', headers: { 'x-radar-capture': token, 'x-radar-source': String(source), 'content-type': 'application/octet-stream' },
+          body: bytes, signal: AbortSignal.timeout(3000), redirect: 'error',
+        });
+        if (!response.ok) finish();
+      } catch { finish(); }
+    });
+    return sequence;
+  };
+  const heartbeat = setInterval(() => { if (!stopped) void post(Buffer.alloc(0)); }, 1000);
+  const deadline = setTimeout(finish, 600_000);
+  report('Telemetry Radar: sending capture bytes only to local ccdeck; no file is written. Press Ctrl+C to stop tcpdump.');
+  try {
+    for await (const chunk of input) {
+      for (let offset = 0; offset < chunk.length && !stopped; offset += 65_536) await post(chunk.subarray(offset, offset + 65_536));
+      if (stopped) break;
+    }
+    await sequence;
+  } catch {
+    if (!stopped) report('Capture input interrupted.');
+  } finally {
+    stopped = true; clearInterval(heartbeat); clearTimeout(deadline);
+    report('Telemetry Radar: local receiver stopped. Press Ctrl+C if tcpdump is still running.');
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  streamCapture({ base: process.argv[2], token: process.argv[3], source: Number(process.argv[4] ?? 0) }).catch(() => {
+    process.stderr.write('Could not start the local capture helper.\n'); process.exitCode = 1;
+  });
+}

package/src/server/traffic-radar-otlp.json

@@ -0,0 +1 @@
+{"nested":{"opentelemetry":{"nested":{"proto":{"nested":{"collector":{"nested":{"logs":{"nested":{"v1":{"options":{"csharp_namespace":"OpenTelemetry.Proto.Collector.Logs.V1","java_multiple_files":true,"java_package":"io.opentelemetry.proto.collector.logs.v1","java_outer_classname":"LogsServiceProto","go_package":"go.opentelemetry.io/proto/otlp/collector/logs/v1"},"nested":{"LogsService":{"methods":{"Export":{"requestType":"ExportLogsServiceRequest","responseType":"ExportLogsServiceResponse"}}},"ExportLogsServiceRequest":{"fields":{"resourceLogs":{"rule":"repeated","type":"opentelemetry.proto.logs.v1.ResourceLogs","id":1,"protoName":"resource_logs"}}},"ExportLogsServiceResponse":{"fields":{"partialSuccess":{"type":"ExportLogsPartialSuccess","id":1,"protoName":"partial_success"}}},"ExportLogsPartialSuccess":{"fields":{"rejectedLogRecords":{"type":"int64","id":1,"protoName":"rejected_log_records"},"errorMessage":{"type":"string","id":2,"protoName":"error_message"}}}}}}},"trace":{"nested":{"v1":{"options":{"csharp_namespace":"OpenTelemetry.Proto.Collector.Trace.V1","java_multiple_files":true,"java_package":"io.opentelemetry.proto.collector.trace.v1","java_outer_classname":"TraceServiceProto","go_package":"go.opentelemetry.io/proto/otlp/collector/trace/v1"},"nested":{"TraceService":{"methods":{"Export":{"requestType":"ExportTraceServiceRequest","responseType":"ExportTraceServiceResponse"}}},"ExportTraceServiceRequest":{"fields":{"resourceSpans":{"rule":"repeated","type":"opentelemetry.proto.trace.v1.ResourceSpans","id":1,"protoName":"resource_spans"}}},"ExportTraceServiceResponse":{"fields":{"partialSuccess":{"type":"ExportTracePartialSuccess","id":1,"protoName":"partial_success"}}},"ExportTracePartialSuccess":{"fields":{"rejectedSpans":{"type":"int64","id":1,"protoName":"rejected_spans"},"errorMessage":{"type":"string","id":2,"protoName":"error_message"}}}}}}},"metrics":{"nested":{"v1":{"options":{"csharp_namespace":"OpenTelemetry.Proto.Collector.Metrics.V1","java_multiple_files":true,"java_package":"io.opentelemetry.proto.collector.metrics.v1","java_outer_classname":"MetricsServiceProto","go_package":"go.opentelemetry.io/proto/otlp/collector/metrics/v1"},"nested":{"MetricsService":{"methods":{"Export":{"requestType":"ExportMetricsServiceRequest","responseType":"ExportMetricsServiceResponse"}}},"ExportMetricsServiceRequest":{"fields":{"resourceMetrics":{"rule":"repeated","type":"opentelemetry.proto.metrics.v1.ResourceMetrics","id":1,"protoName":"resource_metrics"}}},"ExportMetricsServiceResponse":{"fields":{"partialSuccess":{"type":"ExportMetricsPartialSuccess","id":1,"protoName":"partial_success"}}},"ExportMetricsPartialSuccess":{"fields":{"rejectedDataPoints":{"type":"int64","id":1,"protoName":"rejected_data_points"},"errorMessage":{"type":"string","id":2,"protoName":"error_message"}}}}}}}}},"trace":{"nested":{"v1":{"options":{"csharp_namespace":"OpenTelemetry.Proto.Trace.V1","java_multiple_files":true,"java_package":"io.opentelemetry.proto.trace.v1","java_outer_classname":"TraceProto","go_package":"go.opentelemetry.io/proto/otlp/trace/v1"},"nested":{"TracesData":{"fields":{"resourceSpans":{"rule":"repeated","type":"ResourceSpans","id":1,"protoName":"resource_spans"}}},"ResourceSpans":{"fields":{"resource":{"type":"opentelemetry.proto.resource.v1.Resource","id":1},"scopeSpans":{"rule":"repeated","type":"ScopeSpans","id":2,"protoName":"scope_spans"},"schemaUrl":{"type":"string","id":3,"protoName":"schema_url"}},"reserved":[[1000,1000]]},"ScopeSpans":{"fields":{"scope":{"type":"opentelemetry.proto.common.v1.InstrumentationScope","id":1},"spans":{"rule":"repeated","type":"Span","id":2},"schemaUrl":{"type":"string","id":3,"protoName":"schema_url"}}},"Span":{"fields":{"traceId":{"type":"bytes","id":1,"protoName":"trace_id"},"spanId":{"type":"bytes","id":2,"protoName":"span_id"},"traceState":{"type":"string","id":3,"protoName":"trace_state"},"parentSpanId":{"type":"bytes","id":4,"protoName":"parent_span_id"},"flags":{"type":"fixed32","id":16},"name":{"type":"string","id":5},"kind":{"type":"SpanKind","id":6},"startTimeUnixNano":{"type":"fixed64","id":7,"protoName":"start_time_unix_nano"},"endTimeUnixNano":{"type":"fixed64","id":8,"protoName":"end_time_unix_nano"},"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":9},"droppedAttributesCount":{"type":"uint32","id":10,"protoName":"dropped_attributes_count"},"events":{"rule":"repeated","type":"Event","id":11},"droppedEventsCount":{"type":"uint32","id":12,"protoName":"dropped_events_count"},"links":{"rule":"repeated","type":"Link","id":13},"droppedLinksCount":{"type":"uint32","id":14,"protoName":"dropped_links_count"},"status":{"type":"Status","id":15}},"nested":{"SpanKind":{"values":{"SPAN_KIND_UNSPECIFIED":0,"SPAN_KIND_INTERNAL":1,"SPAN_KIND_SERVER":2,"SPAN_KIND_CLIENT":3,"SPAN_KIND_PRODUCER":4,"SPAN_KIND_CONSUMER":5}},"Event":{"fields":{"timeUnixNano":{"type":"fixed64","id":1,"protoName":"time_unix_nano"},"name":{"type":"string","id":2},"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":3},"droppedAttributesCount":{"type":"uint32","id":4,"protoName":"dropped_attributes_count"}}},"Link":{"fields":{"traceId":{"type":"bytes","id":1,"protoName":"trace_id"},"spanId":{"type":"bytes","id":2,"protoName":"span_id"},"traceState":{"type":"string","id":3,"protoName":"trace_state"},"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":4},"droppedAttributesCount":{"type":"uint32","id":5,"protoName":"dropped_attributes_count"},"flags":{"type":"fixed32","id":6}}}}},"Status":{"fields":{"message":{"type":"string","id":2},"code":{"type":"StatusCode","id":3}},"reserved":[[1,1]],"nested":{"StatusCode":{"values":{"STATUS_CODE_UNSET":0,"STATUS_CODE_OK":1,"STATUS_CODE_ERROR":2}}}},"SpanFlags":{"values":{"SPAN_FLAGS_DO_NOT_USE":0,"SPAN_FLAGS_TRACE_FLAGS_MASK":255,"SPAN_FLAGS_CONTEXT_HAS_IS_REMOTE_MASK":256,"SPAN_FLAGS_CONTEXT_IS_REMOTE_MASK":512}}}}}},"logs":{"nested":{"v1":{"options":{"csharp_namespace":"OpenTelemetry.Proto.Logs.V1","java_multiple_files":true,"java_package":"io.opentelemetry.proto.logs.v1","java_outer_classname":"LogsProto","go_package":"go.opentelemetry.io/proto/otlp/logs/v1"},"nested":{"LogsData":{"fields":{"resourceLogs":{"rule":"repeated","type":"ResourceLogs","id":1,"protoName":"resource_logs"}}},"ResourceLogs":{"fields":{"resource":{"type":"opentelemetry.proto.resource.v1.Resource","id":1},"scopeLogs":{"rule":"repeated","type":"ScopeLogs","id":2,"protoName":"scope_logs"},"schemaUrl":{"type":"string","id":3,"protoName":"schema_url"}},"reserved":[[1000,1000]]},"ScopeLogs":{"fields":{"scope":{"type":"opentelemetry.proto.common.v1.InstrumentationScope","id":1},"logRecords":{"rule":"repeated","type":"LogRecord","id":2,"protoName":"log_records"},"schemaUrl":{"type":"string","id":3,"protoName":"schema_url"}}},"SeverityNumber":{"values":{"SEVERITY_NUMBER_UNSPECIFIED":0,"SEVERITY_NUMBER_TRACE":1,"SEVERITY_NUMBER_TRACE2":2,"SEVERITY_NUMBER_TRACE3":3,"SEVERITY_NUMBER_TRACE4":4,"SEVERITY_NUMBER_DEBUG":5,"SEVERITY_NUMBER_DEBUG2":6,"SEVERITY_NUMBER_DEBUG3":7,"SEVERITY_NUMBER_DEBUG4":8,"SEVERITY_NUMBER_INFO":9,"SEVERITY_NUMBER_INFO2":10,"SEVERITY_NUMBER_INFO3":11,"SEVERITY_NUMBER_INFO4":12,"SEVERITY_NUMBER_WARN":13,"SEVERITY_NUMBER_WARN2":14,"SEVERITY_NUMBER_WARN3":15,"SEVERITY_NUMBER_WARN4":16,"SEVERITY_NUMBER_ERROR":17,"SEVERITY_NUMBER_ERROR2":18,"SEVERITY_NUMBER_ERROR3":19,"SEVERITY_NUMBER_ERROR4":20,"SEVERITY_NUMBER_FATAL":21,"SEVERITY_NUMBER_FATAL2":22,"SEVERITY_NUMBER_FATAL3":23,"SEVERITY_NUMBER_FATAL4":24}},"LogRecordFlags":{"values":{"LOG_RECORD_FLAGS_DO_NOT_USE":0,"LOG_RECORD_FLAGS_TRACE_FLAGS_MASK":255}},"LogRecord":{"fields":{"timeUnixNano":{"type":"fixed64","id":1,"protoName":"time_unix_nano"},"observedTimeUnixNano":{"type":"fixed64","id":11,"protoName":"observed_time_unix_nano"},"severityNumber":{"type":"SeverityNumber","id":2,"protoName":"severity_number"},"severityText":{"type":"string","id":3,"protoName":"severity_text"},"body":{"type":"opentelemetry.proto.common.v1.AnyValue","id":5},"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":6},"droppedAttributesCount":{"type":"uint32","id":7,"protoName":"dropped_attributes_count"},"flags":{"type":"fixed32","id":8},"traceId":{"type":"bytes","id":9,"protoName":"trace_id"},"spanId":{"type":"bytes","id":10,"protoName":"span_id"},"eventName":{"type":"string","id":12,"protoName":"event_name"}},"reserved":[[4,4]]}}}}},"metrics":{"nested":{"v1":{"options":{"csharp_namespace":"OpenTelemetry.Proto.Metrics.V1","java_multiple_files":true,"java_package":"io.opentelemetry.proto.metrics.v1","java_outer_classname":"MetricsProto","go_package":"go.opentelemetry.io/proto/otlp/metrics/v1"},"nested":{"MetricsData":{"fields":{"resourceMetrics":{"rule":"repeated","type":"ResourceMetrics","id":1,"protoName":"resource_metrics"}}},"ResourceMetrics":{"fields":{"resource":{"type":"opentelemetry.proto.resource.v1.Resource","id":1},"scopeMetrics":{"rule":"repeated","type":"ScopeMetrics","id":2,"protoName":"scope_metrics"},"schemaUrl":{"type":"string","id":3,"protoName":"schema_url"}},"reserved":[[1000,1000]]},"ScopeMetrics":{"fields":{"scope":{"type":"opentelemetry.proto.common.v1.InstrumentationScope","id":1},"metrics":{"rule":"repeated","type":"Metric","id":2},"schemaUrl":{"type":"string","id":3,"protoName":"schema_url"}}},"Metric":{"oneofs":{"data":{"oneof":["gauge","sum","histogram","exponentialHistogram","summary"]}},"fields":{"name":{"type":"string","id":1},"description":{"type":"string","id":2},"unit":{"type":"string","id":3},"gauge":{"type":"Gauge","id":5},"sum":{"type":"Sum","id":7},"histogram":{"type":"Histogram","id":9},"exponentialHistogram":{"type":"ExponentialHistogram","id":10,"protoName":"exponential_histogram"},"summary":{"type":"Summary","id":11},"metadata":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":12}},"reserved":[[4,4],[6,6],[8,8]]},"Gauge":{"fields":{"dataPoints":{"rule":"repeated","type":"NumberDataPoint","id":1,"protoName":"data_points"}}},"Sum":{"fields":{"dataPoints":{"rule":"repeated","type":"NumberDataPoint","id":1,"protoName":"data_points"},"aggregationTemporality":{"type":"AggregationTemporality","id":2,"protoName":"aggregation_temporality"},"isMonotonic":{"type":"bool","id":3,"protoName":"is_monotonic"}}},"Histogram":{"fields":{"dataPoints":{"rule":"repeated","type":"HistogramDataPoint","id":1,"protoName":"data_points"},"aggregationTemporality":{"type":"AggregationTemporality","id":2,"protoName":"aggregation_temporality"}}},"ExponentialHistogram":{"fields":{"dataPoints":{"rule":"repeated","type":"ExponentialHistogramDataPoint","id":1,"protoName":"data_points"},"aggregationTemporality":{"type":"AggregationTemporality","id":2,"protoName":"aggregation_temporality"}}},"Summary":{"fields":{"dataPoints":{"rule":"repeated","type":"SummaryDataPoint","id":1,"protoName":"data_points"}}},"AggregationTemporality":{"values":{"AGGREGATION_TEMPORALITY_UNSPECIFIED":0,"AGGREGATION_TEMPORALITY_DELTA":1,"AGGREGATION_TEMPORALITY_CUMULATIVE":2}},"DataPointFlags":{"values":{"DATA_POINT_FLAGS_DO_NOT_USE":0,"DATA_POINT_FLAGS_NO_RECORDED_VALUE_MASK":1}},"NumberDataPoint":{"oneofs":{"value":{"oneof":["asDouble","asInt"]}},"fields":{"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":7},"startTimeUnixNano":{"type":"fixed64","id":2,"protoName":"start_time_unix_nano"},"timeUnixNano":{"type":"fixed64","id":3,"protoName":"time_unix_nano"},"asDouble":{"type":"double","id":4,"protoName":"as_double"},"asInt":{"type":"sfixed64","id":6,"protoName":"as_int"},"exemplars":{"rule":"repeated","type":"Exemplar","id":5},"flags":{"type":"uint32","id":8}},"reserved":[[1,1]]},"HistogramDataPoint":{"oneofs":{"_sum":{"oneof":["sum"]},"_min":{"oneof":["min"]},"_max":{"oneof":["max"]}},"fields":{"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":9},"startTimeUnixNano":{"type":"fixed64","id":2,"protoName":"start_time_unix_nano"},"timeUnixNano":{"type":"fixed64","id":3,"protoName":"time_unix_nano"},"count":{"type":"fixed64","id":4},"sum":{"type":"double","id":5,"options":{"proto3_optional":true}},"bucketCounts":{"rule":"repeated","type":"fixed64","id":6,"protoName":"bucket_counts"},"explicitBounds":{"rule":"repeated","type":"double","id":7,"protoName":"explicit_bounds"},"exemplars":{"rule":"repeated","type":"Exemplar","id":8},"flags":{"type":"uint32","id":10},"min":{"type":"double","id":11,"options":{"proto3_optional":true}},"max":{"type":"double","id":12,"options":{"proto3_optional":true}}},"reserved":[[1,1]]},"ExponentialHistogramDataPoint":{"oneofs":{"_sum":{"oneof":["sum"]},"_min":{"oneof":["min"]},"_max":{"oneof":["max"]}},"fields":{"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":1},"startTimeUnixNano":{"type":"fixed64","id":2,"protoName":"start_time_unix_nano"},"timeUnixNano":{"type":"fixed64","id":3,"protoName":"time_unix_nano"},"count":{"type":"fixed64","id":4},"sum":{"type":"double","id":5,"options":{"proto3_optional":true}},"scale":{"type":"sint32","id":6},"zeroCount":{"type":"fixed64","id":7,"protoName":"zero_count"},"positive":{"type":"Buckets","id":8},"negative":{"type":"Buckets","id":9},"flags":{"type":"uint32","id":10},"exemplars":{"rule":"repeated","type":"Exemplar","id":11},"min":{"type":"double","id":12,"options":{"proto3_optional":true}},"max":{"type":"double","id":13,"options":{"proto3_optional":true}},"zeroThreshold":{"type":"double","id":14,"protoName":"zero_threshold"}},"nested":{"Buckets":{"fields":{"offset":{"type":"sint32","id":1},"bucketCounts":{"rule":"repeated","type":"uint64","id":2,"protoName":"bucket_counts"}}}}},"SummaryDataPoint":{"fields":{"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":7},"startTimeUnixNano":{"type":"fixed64","id":2,"protoName":"start_time_unix_nano"},"timeUnixNano":{"type":"fixed64","id":3,"protoName":"time_unix_nano"},"count":{"type":"fixed64","id":4},"sum":{"type":"double","id":5},"quantileValues":{"rule":"repeated","type":"ValueAtQuantile","id":6,"protoName":"quantile_values"},"flags":{"type":"uint32","id":8}},"reserved":[[1,1]],"nested":{"ValueAtQuantile":{"fields":{"quantile":{"type":"double","id":1},"value":{"type":"double","id":2}}}}},"Exemplar":{"oneofs":{"value":{"oneof":["asDouble","asInt"]}},"fields":{"filteredAttributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":7,"protoName":"filtered_attributes"},"timeUnixNano":{"type":"fixed64","id":2,"protoName":"time_unix_nano"},"asDouble":{"type":"double","id":3,"protoName":"as_double"},"asInt":{"type":"sfixed64","id":6,"protoName":"as_int"},"spanId":{"type":"bytes","id":4,"protoName":"span_id"},"traceId":{"type":"bytes","id":5,"protoName":"trace_id"}},"reserved":[[1,1]]}}}}},"common":{"nested":{"v1":{"options":{"csharp_namespace":"OpenTelemetry.Proto.Common.V1","java_multiple_files":true,"java_package":"io.opentelemetry.proto.common.v1","java_outer_classname":"CommonProto","go_package":"go.opentelemetry.io/proto/otlp/common/v1"},"nested":{"AnyValue":{"oneofs":{"value":{"oneof":["stringValue","boolValue","intValue","doubleValue","arrayValue","kvlistValue","bytesValue"]}},"fields":{"stringValue":{"type":"string","id":1,"protoName":"string_value"},"boolValue":{"type":"bool","id":2,"protoName":"bool_value"},"intValue":{"type":"int64","id":3,"protoName":"int_value"},"doubleValue":{"type":"double","id":4,"protoName":"double_value"},"arrayValue":{"type":"ArrayValue","id":5,"protoName":"array_value"},"kvlistValue":{"type":"KeyValueList","id":6,"protoName":"kvlist_value"},"bytesValue":{"type":"bytes","id":7,"protoName":"bytes_value"}}},"ArrayValue":{"fields":{"values":{"rule":"repeated","type":"AnyValue","id":1}}},"KeyValueList":{"fields":{"values":{"rule":"repeated","type":"KeyValue","id":1}}},"KeyValue":{"fields":{"key":{"type":"string","id":1},"value":{"type":"AnyValue","id":2}}},"InstrumentationScope":{"fields":{"name":{"type":"string","id":1},"version":{"type":"string","id":2},"attributes":{"rule":"repeated","type":"KeyValue","id":3},"droppedAttributesCount":{"type":"uint32","id":4,"protoName":"dropped_attributes_count"}}},"EntityRef":{"fields":{"schemaUrl":{"type":"string","id":1,"protoName":"schema_url"},"type":{"type":"string","id":2},"idKeys":{"rule":"repeated","type":"string","id":3,"protoName":"id_keys"},"descriptionKeys":{"rule":"repeated","type":"string","id":4,"protoName":"description_keys"}}}}}}},"resource":{"nested":{"v1":{"options":{"csharp_namespace":"OpenTelemetry.Proto.Resource.V1","java_multiple_files":true,"java_package":"io.opentelemetry.proto.resource.v1","java_outer_classname":"ResourceProto","go_package":"go.opentelemetry.io/proto/otlp/resource/v1"},"nested":{"Resource":{"fields":{"attributes":{"rule":"repeated","type":"opentelemetry.proto.common.v1.KeyValue","id":1},"droppedAttributesCount":{"type":"uint32","id":2,"protoName":"dropped_attributes_count"},"entityRefs":{"rule":"repeated","type":"opentelemetry.proto.common.v1.EntityRef","id":3,"protoName":"entity_refs"}}}}}}}}}}}}}

package/src/server/traffic-radar-routes.mjs

@@ -0,0 +1,40 @@
+import { trafficCapture } from "./traffic-radar-capture.mjs";
+const BASE = '/api/system/traffic-radar';
+const loopback = req => ['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(req.socket.remoteAddress);
+export function isAuthorizedTrafficIngest(req, url) {
+  return req.method === 'POST' && url.pathname === BASE + '/ingest' && loopback(req)
+    && trafficCapture.accepts(req.headers['x-radar-capture']);
+}
+function reply(res, status, body) {
+  res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+  res.end(JSON.stringify(body));
+}
+async function body(req, max) {
+  const chunks = []; let size = 0;
+  for await (const chunk of req) { size += chunk.length; if (size > max) throw new Error('Request too large.'); chunks.push(chunk); }
+  return Buffer.concat(chunks);
+}
+export async function handleTrafficCapture(req, res, url, capture = trafficCapture) {
+  if (!loopback(req)) return reply(res, 403, { error: 'Telemetry contents are available on this machine only.' });
+  const action = url.pathname.slice(BASE.length);
+  try {
+    if (req.method === 'GET' && action === '/capture') return reply(res, 200, capture.read());
+    if (req.method === 'GET' && action === '/capture/event') {
+      const detail = capture.detail(Number(url.searchParams.get('id')));
+      return reply(res, detail ? 200 : 404, detail ?? { error: 'This event is no longer retained.' });
+    }
+    if (req.method === 'POST' && action === '/ingest') {
+      const token = req.headers['x-radar-capture'];
+      if (!capture.accepts(token)) return reply(res, 401, { error: 'Capture session ended or unauthorized.' });
+      const data = await body(req, 262_144);
+      return reply(res, capture.ingest(token, data, Number(req.headers['x-radar-source'] ?? 0)) ? 200 : 409, { ok: capture.read().state === 'capturing' });
+    }
+    if (req.method === 'POST' && action === '/capture/prepare') {
+      const data = JSON.parse((await body(req, 4096)).toString());
+      return reply(res, 200, await capture.prepare(data.destination, req.socket.localPort));
+    }
+    if (req.method === 'POST' && action === '/capture/stop') { capture.stop(); return reply(res, 200, { ok: true }); }
+    if (req.method === 'POST' && action === '/capture/clear') { capture.clear(); return reply(res, 200, { ok: true }); }
+    return reply(res, 404, { error: 'Unknown capture action.' });
+  } catch { return reply(res, 400, { error: 'Could not complete capture setup. Use a valid IPv4 destination and check its network route.' }); }
+}

package/src/server/traffic-radar-wire.mjs

@@ -0,0 +1,228 @@
+import { gunzipSync } from "node:zlib";
+import { decodeOtlp, headerDecoder } from "./traffic-radar-codec.mjs";
+
+const LIMIT = 262_144;
+const PREFACE = Buffer.from("PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n");
+const PATHS = Object.fromEntries([['logs', 'Logs'], ['metrics', 'Metrics'], ['traces', 'Trace']].map(([signal, name]) => [
+  `/opentelemetry.proto.collector.${signal === 'traces' ? 'trace' : signal}.v1.${name}Service/Export`, signal,
+]));
+
+export function createWireCapture({ host, port, onExport, onResponse, onIssue, onObservation }) {
+  let pending = Buffer.alloc(0);
+  let read32, link, nanos;
+  const flows = new Map();
+  const issue = code => onIssue(code);
+  function direction() {
+    return { next: null, queue: new Map(), buffer: Buffer.alloc(0), headers: headerDecoder(), block: null };
+  }
+  function discard(key, code) { flows.delete(key); issue(code); }
+  function payload(stream, side, bytes, at, flow, id) {
+    const key = side === 'out' ? 'request' : 'response';
+    stream[key] = Buffer.concat([stream[key] ?? Buffer.alloc(0), bytes]);
+    if (stream[key].length > LIMIT) throw new Error('payload_limit');
+    while (stream[key].length >= 5) {
+      const size = stream[key].readUInt32BE(1);
+      if (size > LIMIT) throw new Error('payload_limit');
+      if (stream[key].length < size + 5) return;
+      const compressed = stream[key][0];
+      let body = stream[key].subarray(5, 5 + size);
+      stream[key] = stream[key].subarray(5 + size);
+      if (compressed > 1) throw new Error('unsupported_protocol');
+      if (compressed) {
+        if (stream[side + 'Encoding'] !== 'gzip') throw new Error('unsupported_compression');
+        body = gunzipSync(body, { maxOutputLength: LIMIT });
+      }
+      if (!stream.signal) throw new Error('unknown_export');
+      const data = decodeOtlp(stream.signal, key, body);
+      if (side === 'out') {
+        if (stream.eventId) throw new Error('unsupported_protocol');
+        stream.eventId = onExport({ at, signal: stream.signal, destination: `${host}:${port}`, bytes: size + 5, payload: data, protobufBase64: body.toString('base64'), flow: flow.key, stream: id });
+      } else {
+        stream.responseDecoded = true;
+        stream.partial = data.partialSuccess ?? null;
+      }
+    }
+  }
+  function finishResponse(stream, at) {
+    if (!stream.eventId) return;
+    const status = stream.grpcStatus;
+    const partial = stream.partial;
+    const rejected = partial && Object.entries(partial).find(([key]) => key.startsWith('rejected'))?.[1];
+    const outcome = status === '0' && stream.httpStatus === '200' && stream.responseDecoded ? (partial?.errorMessage || (rejected && rejected !== '0') ? 'partial' : 'accepted')
+      : status !== undefined && status !== '0' ? 'rejected' : 'unknown';
+    onResponse(stream.eventId, { outcome, at, grpcStatus: status ?? null, rejected: rejected ?? null, message: partial?.errorMessage ?? null });
+  }
+  function headers(flow, side, id, bytes, end, at) {
+    const values = flow[side].headers(bytes);
+    const stream = flow.streams.get(id) ?? {};
+    if (!flow.streams.has(id)) {
+      if (flow.streams.size >= 32) throw new Error('stream_limit');
+      flow.streams.set(id, stream);
+    }
+    if (side === 'out' && values[':path']) {
+      if (values[':method'] !== 'POST' || !values['content-type']?.startsWith('application/grpc')) throw new Error('unknown_export');
+      stream.signal = PATHS[values[':path']];
+    }
+    if (values['grpc-encoding']) stream[side + 'Encoding'] = values['grpc-encoding'];
+    if (side === 'in' && values['grpc-status'] !== undefined) stream.grpcStatus = values['grpc-status'];
+    if (side === 'in' && values[':status']) stream.httpStatus = values[':status'];
+    if (side === 'in' && end) { finishResponse(stream, at); flow.streams.delete(id); }
+  }
+  function frames(flow, side, bytes, at) {
+    const d = flow[side];
+    d.buffer = Buffer.concat([d.buffer, bytes]);
+    if (d.buffer.length > LIMIT * 2) throw new Error('stream_limit');
+    if (!flow.ready) {
+      if (side === 'in') return;
+      if (d.buffer[0] === 22) throw new Error('encrypted');
+      if (!PREFACE.subarray(0, Math.min(PREFACE.length, d.buffer.length)).equals(d.buffer.subarray(0, PREFACE.length))) throw new Error('joined_midstream');
+      if (d.buffer.length < PREFACE.length) return;
+      d.buffer = d.buffer.subarray(PREFACE.length);
+      flow.ready = true;
+      frames(flow, 'in', Buffer.alloc(0), at);
+    }
+    while (d.buffer.length >= 9) {
+      const length = d.buffer.readUIntBE(0, 3), type = d.buffer[3], flags = d.buffer[4], id = d.buffer.readUInt32BE(5) & 0x7fffffff;
+      if (length > LIMIT || type > 9) throw new Error('unsupported_protocol');
+      if (d.buffer.length < length + 9) return;
+      let body = d.buffer.subarray(9, 9 + length);
+      d.buffer = d.buffer.subarray(9 + length);
+      if (d.block && (type !== 9 || id !== d.block.id)) throw new Error('capture_gap');
+      if (type === 0 || type === 1) {
+        if (flags & 8) {
+          const pad = body[0];
+          if (pad === undefined || pad >= body.length) throw new Error('capture_gap');
+          body = body.subarray(1, body.length - pad);
+        }
+        if (type === 1 && (flags & 32)) {
+          if (body.length < 5) throw new Error('capture_gap');
+          body = body.subarray(5);
+        }
+      }
+      if (type === 1) {
+        if (flags & 4) headers(flow, side, id, body, flags & 1, at);
+        else d.block = { id, bytes: Buffer.from(body), end: flags & 1 };
+      } else if (type === 9) {
+        if (!d.block) throw new Error('capture_gap');
+        d.block.bytes = Buffer.concat([d.block.bytes, body]);
+        if (d.block.bytes.length > 65_536) throw new Error('stream_limit');
+        if (flags & 4) { const b = d.block; d.block = null; headers(flow, side, id, b.bytes, b.end, at); }
+      } else if (type === 0) {
+        const stream = flow.streams.get(id);
+        if (!stream) throw new Error('unknown_export');
+        payload(stream, side, body, at, flow, id);
+        if (side === 'in' && (flags & 1)) { finishResponse(stream, at); flow.streams.delete(id); }
+      } else if (type === 3) {
+        const stream = flow.streams.get(id);
+        if (stream?.eventId) onResponse(stream.eventId, { outcome: 'reset', at, grpcStatus: null, rejected: null, message: null });
+        flow.streams.delete(id);
+      } else if (type === 7) {
+        throw new Error('connection_closed');
+      }
+    }
+    let buffered = flow.out.buffer.length + flow.in.buffer.length;
+    for (const stream of flow.streams.values()) buffered += (stream.request?.length ?? 0) + (stream.response?.length ?? 0);
+    if (buffered > LIMIT * 4) throw new Error('stream_limit');
+  }
+  function tcp(packet, at) {
+    let offset = 0;
+    if (link === 1) {
+      if (packet.length < 14) return;
+      let protocol = packet.readUInt16BE(12); offset = 14;
+      for (let tag = 0; tag < 2 && [0x8100, 0x88a8].includes(protocol); tag++) {
+        if (packet.length < offset + 4) return;
+        protocol = packet.readUInt16BE(offset + 2); offset += 4;
+      }
+      if (protocol !== 0x800) { issue('unsupported_network'); return; }
+    } else if ([0, 108].includes(link)) offset = 4;
+    else if (link === 113) offset = 16;
+    else if (link === 276) offset = 20;
+    else if (link !== 101 && link !== 12) { issue('unsupported_link'); return; }
+    if (packet.length < offset + 20 || packet[offset] >> 4 !== 4) { issue('unsupported_network'); return; }
+    const ip = packet.subarray(offset);
+    const ihl = (ip[0] & 15) * 4, total = ip.readUInt16BE(2);
+    if (ihl < 20 || total < ihl || ip.length < total) { issue('capture_gap'); return; }
+    if (ip[9] !== 6) return;
+    if (ip.readUInt16BE(6) & 0x3fff) { issue('fragmented'); return; }
+    const src = [...ip.subarray(12, 16)].join('.'), dst = [...ip.subarray(16, 20)].join('.');
+    const t = ip.subarray(ihl, total);
+    if (t.length < 20) { issue('capture_gap'); return; }
+    const srcPort = t.readUInt16BE(0), dstPort = t.readUInt16BE(2);
+    const side = dst === host && dstPort === port ? 'out' : src === host && srcPort === port ? 'in' : null;
+    if (!side) return;
+    const key = side === 'out' ? `${src}:${srcPort}` : `${dst}:${dstPort}`;
+    for (const [k, f] of flows) if (at - f.at > 60_000) discard(k, 'idle_connection');
+    let flow = flows.get(key);
+    const syn = !!(t[13] & 2), ack = !!(t[13] & 16);
+    if (syn && !ack) flows.delete(key);
+    if (!flow || (syn && !ack)) {
+      if (flows.size >= 16) discard(flows.keys().next().value, 'connection_limit');
+      flow = { key, at, ready: false, out: direction(), in: direction(), streams: new Map(), ignored: false };
+      flows.set(key, flow);
+    }
+    flow.at = at;
+    const size = (t[12] >> 4) * 4;
+    if (size < 20 || size > t.length) { discard(key, 'capture_gap'); return; }
+    const body = t.subarray(size), d = flow[side];
+    let seq = (t.readUInt32BE(4) + (syn ? 1 : 0)) >>> 0;
+    if (syn && d.next === null) d.next = seq;
+    if (body.length && !flow.ignored) {
+      if (d.next === null) d.next = seq;
+      const delta = (seq - d.next) | 0;
+      if (delta > 0) {
+        d.queue.set(seq, Buffer.from(body));
+        let queued = 0; for (const b of d.queue.values()) queued += b.length;
+        if (d.queue.size > 32 || queued > LIMIT) discard(key, 'capture_gap');
+        return;
+      }
+      const part = delta < 0 ? body.subarray(-delta) : body;
+      if (part.length) {
+        d.next = (d.next + part.length) >>> 0;
+        try {
+          frames(flow, side, part, at);
+          while (d.queue.size) {
+            const next = [...d.queue.keys()].find(n => ((n - d.next) | 0) <= 0);
+            if (next === undefined) break;
+            const p = d.queue.get(next); d.queue.delete(next);
+            const remainder = p.subarray(Math.max(0, (d.next - next) | 0));
+            if (remainder.length) { d.next = (d.next + remainder.length) >>> 0; frames(flow, side, remainder, at); }
+          }
+        } catch (error) {
+          onObservation?.({ at, destination: `${host}:${port}`, reason: ["encrypted", "joined_midstream", "payload_limit", "stream_limit", "unsupported_compression", "unknown_export", "connection_closed"].includes(error.message) ? error.message : "decode_failed", source: flow.key });
+          issue(['encrypted', 'joined_midstream', 'payload_limit', 'stream_limit', 'unsupported_compression', 'unknown_export', 'connection_closed'].includes(error.message) ? error.message : 'decode_failed');
+          flow.ignored = true;
+          flow.out.buffer = flow.in.buffer = Buffer.alloc(0);
+          flow.out.queue.clear(); flow.in.queue.clear(); flow.streams.clear();
+        }
+      }
+    }
+    if (t[13] & 5) flows.delete(key);
+  }
+  return {
+    feed(chunk) {
+      if (chunk.length > LIMIT) throw new Error('capture_chunk_limit');
+      pending = Buffer.concat([pending, chunk]);
+      if (pending.length > LIMIT * 2) throw new Error('capture_buffer_limit');
+      if (!read32) {
+        if (pending.length < 24) return;
+        const magic = pending.subarray(0, 4).toString('hex');
+        if (!['d4c3b2a1', 'a1b2c3d4', '4d3cb2a1', 'a1b23c4d'].includes(magic)) throw new Error('pcap_required');
+        nanos = ['4d3cb2a1', 'a1b23c4d'].includes(magic);
+        read32 = magic.startsWith('a1') ? b => b.readUInt32BE() : b => b.readUInt32LE();
+        link = read32(pending.subarray(20));
+        if (![0, 1, 12, 101, 108, 113, 276].includes(link)) throw new Error('unsupported_link');
+        pending = pending.subarray(24);
+      }
+      while (pending.length >= 16) {
+        const size = read32(pending.subarray(8));
+        if (size > LIMIT) throw new Error('packet_limit');
+        if (pending.length < size + 16) return;
+        const at = read32(pending) * 1000 + read32(pending.subarray(4)) / (nanos ? 1e6 : 1000);
+        if (size !== read32(pending.subarray(12))) issue('capture_gap');
+        else tcp(pending.subarray(16, 16 + size), at);
+        pending = pending.subarray(size + 16);
+      }
+    },
+    close() { pending = Buffer.alloc(0); flows.clear(); },
+  };
+}

package/src/server/traffic-radar.mjs

@@ -0,0 +1,134 @@
+import { execFile } from "node:child_process";
+import { homedir } from "node:os";
+import { basename } from "node:path";
+import { readRadarConfig } from "./traffic-radar-config.mjs";
+
+function systemCommand(file, args) {
+  return new Promise(resolve => {
+    execFile(file, args, { timeout: 2_000, maxBuffer: 262_144, encoding: "utf8", windowsHide: true }, (error, stdout, stderr) => {
+      if (!error) return resolve(stdout);
+      if (file === "/usr/sbin/lsof" && error.code === 1 && !stdout && !stderr) return resolve("");
+      resolve(null);
+    });
+  });
+}
+
+export function claudePids(text) {
+  const pids = [];
+  for (const line of String(text ?? "").split("\n")) {
+    const match = /^\s*(\d+)\s+(.+?)\s*$/.exec(line);
+    if (match && ["claude", "claude-native"].includes(basename(match[2]))) {
+      const pid = Number(match[1]);
+      if (Number.isSafeInteger(pid) && pid > 0) pids.push(pid);
+    }
+  }
+  return [...new Set(pids)];
+}
+
+export function parseRadarSockets(text, pids) {
+  const allowed = new Set(pids);
+  const sockets = new Map();
+  let pid = null;
+  for (const line of String(text ?? "").split("\n")) {
+    if (/^p\d+$/.test(line)) pid = Number(line.slice(1));
+    if (!allowed.has(pid) || !line.startsWith("n")) continue;
+    const peer = line.slice(1).split("->")[1];
+    if (!peer) continue;
+    const match = /^(\[[0-9a-fA-F:.%]+\]|[0-9.]+):(\d+)$/.exec(peer);
+    if (!match) continue;
+    const port = Number(match[2]);
+    if (port < 1 || port > 65535) continue;
+    const destination = `${match[1]}:${port}`;
+    sockets.set(`${pid}|${destination}`, { pid, destination });
+  }
+  return [...sockets.values()];
+}
+
+export function parseRadarWorkspaces(text, pids, home = homedir()) {
+  const allowed = new Set(pids);
+  const workspaces = new Map();
+  let pid = null;
+  for (const line of String(text ?? "").split("\n")) {
+    if (/^p\d+$/.test(line)) pid = Number(line.slice(1));
+    if (allowed.has(pid) && line.startsWith("n/")) {
+      const path = line.slice(1);
+      workspaces.set(pid, path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path);
+    }
+  }
+  return workspaces;
+}
+
+export function createTrafficRadar({ platform = process.platform, now = Date.now, run = systemCommand, config = readRadarConfig } = {}) {
+  let pending = null;
+  let cached = null;
+  let previousAt = null;
+  let previousConfig = null;
+  const seen = new Map();
+  let alerts = [];
+  let serial = 0;
+  const addAlert = (message, at) => {
+    alerts.unshift({ id: ++serial, message, at });
+    alerts = alerts.slice(0, 8);
+  };
+
+  async function sample() {
+    const sampledAt = now();
+    if (previousAt !== null && sampledAt - previousAt > 30_000) {
+      seen.clear();
+      alerts = [];
+      previousConfig = null;
+    }
+    const base = { ok: true, sampledAt, platform, pollMs: 5_000, processCount: 0, connections: [], alerts: [] };
+    if (platform !== "darwin") return { ...base, status: "unsupported", config: null };
+    const [configuration, processes] = await Promise.all([config(), run("/bin/ps", ["-axo", "pid=,comm="])]);
+    const nextConfig = new Map(configuration.variables.filter(v => !v.key.endsWith("HEADERS")).map(v => [`${v.source}:${v.key}`, v.value]));
+    if (previousConfig) {
+      for (const [key, value] of nextConfig) {
+        if (previousConfig.get(key) === value) continue;
+        const variable = key.slice(key.indexOf(":") + 1);
+        if (variable.includes("ENDPOINT")) addAlert("Telemetry destination configuration changed. Review settings below.", sampledAt);
+        if (/^OTEL_LOG_/.test(variable) && value.startsWith("Enabled")) addAlert("Content capture configuration changed to enabled. Review settings below.", sampledAt);
+      }
+    }
+    const pids = claudePids(processes);
+    const selected = pids.slice(0, 64);
+    let sockets = "";
+    let cwd = "";
+    if (selected.length) [sockets, cwd] = await Promise.all([
+      run("/usr/sbin/lsof", ["-nP", "-a", "-p", selected.join(","), "-iTCP", "-sTCP:ESTABLISHED", "-Fpn"]),
+      run("/usr/sbin/lsof", ["-nP", "-a", "-p", selected.join(","), "-d", "cwd", "-Fpn"]),
+    ]);
+    const workspaces = parseRadarWorkspaces(cwd, selected);
+    const status = processes === null || sockets === null ? "unavailable" : "observing";
+    if (cached?.status === "observing" && status === "unavailable") addAlert("Connection visibility lost. A failed sample does not mean traffic stopped.", sampledAt);
+    const current = parseRadarSockets(sockets, selected);
+    const active = new Set(current.map(s => `${s.pid}|${s.destination}`));
+    const destinations = new Set([...seen.values()].map(s => s.destination));
+    for (const connection of current) {
+      const key = `${connection.pid}|${connection.destination}`;
+      if (!seen.has(key)) {
+        if (previousAt !== null && previousConfig && !destinations.has(connection.destination)) addAlert(`New Claude connection destination: ${connection.destination}`, sampledAt);
+        destinations.add(connection.destination);
+        seen.set(key, { ...connection, workspace: workspaces.get(connection.pid) ?? null, firstSeenAt: sampledAt, lastSeenAt: sampledAt });
+      } else seen.get(key).lastSeenAt = sampledAt;
+    }
+    for (const [key, connection] of seen) if (sampledAt - connection.lastSeenAt > 300_000) seen.delete(key);
+    while (seen.size > 100) seen.delete(seen.keys().next().value);
+    previousAt = sampledAt;
+    previousConfig = nextConfig;
+    return { ...base, status, config: configuration, processCount: pids.length, limited: pids.length > selected.length,
+      connections: [...seen.entries()].map(([key, value]) => ({ ...value, active: status === "observing" ? active.has(key) : null }))
+        .sort((a, b) => b.lastSeenAt - a.lastSeenAt), alerts };
+  }
+
+  return {
+    read() {
+      if (pending) return pending;
+      if (cached && now() - cached.sampledAt < 3_000) return Promise.resolve(cached);
+      pending = sample().then(result => { cached = result; return result; }).finally(() => { pending = null; });
+      return pending;
+    },
+  };
+}
+
+export const trafficRadar = createTrafficRadar();