hobots 1.5.1 → 1.7.0

package/dist/index.cjs

@@ -32,9 +32,6 @@ var src_exports = {};
 __export(src_exports, {
   Client: () => Client,
   DEFAULT_BASE_URL: () => DEFAULT_BASE_URL,
-  ManagerAgent: () => ManagerAgent,
-  ManagerApi: () => ManagerApi,
-  ManagerApiError: () => ManagerApiError,
   Scope: () => Scope,
   Span: () => Span,
   Transaction: () => Transaction,
@@ -47,7 +44,7 @@ __export(src_exports, {
   getClient: () => getClient,
   init: () => init,
   register: () => register,
-  resolveConfig: () => resolveConfig,
+  scrubSecrets: () => scrubSecrets,
   setContext: () => setContext,
   setExtra: () => setExtra,
   setTag: () => setTag,
@@ -63,26 +60,52 @@ module.exports = __toCommonJS(src_exports);
 
 // src/config.ts
 var DEFAULT_BASE_URL = "https://api2.hobots.app";
+var SECRET_PATTERN = /^hb_[a-f0-9]{64}$/i;
 function envBaseUrl() {
   if (typeof process === "undefined" || !process.env) return void 0;
   return process.env.HOBOTS_API_URL?.trim() || void 0;
 }
+function isLoopbackHost(hostname2) {
+  return hostname2 === "localhost" || hostname2.endsWith(".localhost") || hostname2.startsWith("127.") || hostname2 === "[::1]" || hostname2 === "::1" || hostname2 === "0.0.0.0";
+}
+var warnedInsecureBaseUrl = false;
+function validateBaseUrl(raw, prefix) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`${prefix} HOBOTS_API_URL inv\xE1lida \u2014 esperado URL http(s), ex.: http://localhost:3001`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(`${prefix} HOBOTS_API_URL com esquema "${url.protocol}" n\xE3o suportado \u2014 use http(s)`);
+  }
+  if (url.username || url.password) {
+    throw new Error(`${prefix} HOBOTS_API_URL n\xE3o pode conter credenciais na URL \u2014 a autentica\xE7\xE3o \xE9 s\xF3 pelo Client Secret`);
+  }
+  if (url.protocol === "http:" && !isLoopbackHost(url.hostname) && !warnedInsecureBaseUrl) {
+    warnedInsecureBaseUrl = true;
+    console.warn(
+      `${prefix} HOBOTS_API_URL usa http para o host remoto "${url.hostname}" \u2014 o Client Secret trafega sem TLS`
+    );
+  }
+  return raw.replace(/\/+$/, "");
+}
 function resolveConfig(options, prefix = "[hobots]") {
   const key = options.clientSecret?.trim();
   if (!key) {
     throw new Error(`${prefix} clientSecret ausente \u2014 copie o Client Secret do projeto em Configura\xE7\xF5es \u2192 Projetos`);
   }
-  const baseUrl = (envBaseUrl() ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-  try {
-    new URL(baseUrl);
-  } catch {
-    throw new Error(`${prefix} HOBOTS_API_URL inv\xE1lida: "${baseUrl}" \u2014 esperado ex.: http://localhost:3001`);
+  if (!SECRET_PATTERN.test(key)) {
+    throw new Error(
+      `${prefix} clientSecret com formato inv\xE1lido (${key.length} caracteres) \u2014 esperado "hb_" + 64 hex; copie o Client Secret do projeto em Configura\xE7\xF5es \u2192 Projetos`
+    );
   }
+  const baseUrl = validateBaseUrl(envBaseUrl() ?? DEFAULT_BASE_URL, prefix);
   return {
     key,
     baseUrl,
     ingestEndpoint: `${baseUrl}/v1/ingest`,
-    managerBaseUrl: `${baseUrl}/v1/manager`
+    tasksBaseUrl: `${baseUrl}/v1/tasks`
   };
 }
 
@@ -119,9 +142,28 @@ function parseStacktrace(stack) {
   return frames;
 }
 
+// src/scrub.ts
+var SECRET_PATTERNS = [
+  // client secret da Hobots
+  [/hb_[a-f0-9]{16,}/gi, "[REDACTED]"],
+  // tokens bearer em headers/mensagens
+  [/\b(authorization:?\s*)?bearer\s+[a-z0-9._~+/=-]{8,}/gi, "Bearer [REDACTED]"],
+  // chaves no formato sk-… (OpenAI e afins)
+  [/\bsk-[a-z0-9_-]{16,}\b/gi, "[REDACTED]"],
+  // credenciais embutidas em URL (https://user:pass@host)
+  [/\/\/[^/\s:@]+:[^/\s@]+@/g, "//[REDACTED]@"]
+];
+function scrubSecrets(text) {
+  let out = text;
+  for (const [pattern, replacement] of SECRET_PATTERNS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+
 // src/utils.ts
 var SDK_NAME = "hobots";
-var SDK_VERSION = true ? "1.5.0" : "0.0.0-dev";
+var SDK_VERSION = true ? "2.0.0" : "0.0.0-dev";
 function isNode() {
   return typeof process !== "undefined" && typeof process.versions?.node === "string";
 }
@@ -130,6 +172,12 @@ function uuid4() {
   if (cryptoRef && typeof cryptoRef.randomUUID === "function") {
     return cryptoRef.randomUUID().replace(/-/g, "");
   }
+  if (cryptoRef && typeof cryptoRef.getRandomValues === "function") {
+    const bytes = cryptoRef.getRandomValues(new Uint8Array(16));
+    bytes[6] = bytes[6] & 15 | 64;
+    bytes[8] = bytes[8] & 63 | 128;
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  }
   let out = "";
   for (let i = 0; i < 32; i++) {
     out += Math.floor(Math.random() * 16).toString(16);
@@ -148,7 +196,69 @@ function sleep(ms) {
     unrefTimer(timer);
   });
 }
-var PREFIX = "[hobots-monitor]";
+function jitter(baseMs) {
+  return Math.floor(baseMs / 2 + Math.random() * (baseMs / 2));
+}
+function truncate(value, max) {
+  return value.length > max ? `${value.slice(0, max)}\u2026 [truncado]` : value;
+}
+var DEFAULT_RETRY_DELAYS_MS = [1e3, 4e3, 16e3];
+async function fetchWithRetry(send, options) {
+  const delays = options.delays ?? DEFAULT_RETRY_DELAYS_MS;
+  for (let attempt = 0; ; attempt++) {
+    let retriable;
+    let serverDelay;
+    try {
+      const response = await send();
+      if (response.ok) return response;
+      if (response.status >= 400 && response.status < 500 && response.status !== 429) return response;
+      if (response.status === 429) serverDelay = retryAfterMs(response);
+      retriable = new Error(`HTTP ${response.status}`);
+    } catch (error) {
+      retriable = error;
+    }
+    const base = delays[attempt];
+    if (base === void 0) {
+      throw retriable instanceof Error ? retriable : new Error(String(retriable));
+    }
+    const delay = serverDelay ?? jitter(base);
+    options.logger.warn(`${options.label}: falha (${String(retriable)}), retry em ${delay}ms`);
+    await sleep(delay);
+  }
+}
+var MAX_RETRY_AFTER_MS = 6e4;
+function retryAfterMs(response) {
+  const header = response.headers.get("retry-after");
+  if (!header) return void 0;
+  const seconds = Number(header);
+  if (Number.isFinite(seconds)) {
+    return Math.min(MAX_RETRY_AFTER_MS, Math.max(0, seconds * 1e3));
+  }
+  const date = Date.parse(header);
+  if (Number.isNaN(date)) return void 0;
+  return Math.min(MAX_RETRY_AFTER_MS, Math.max(0, date - Date.now()));
+}
+function withTimeoutSignal(timeoutMs, external) {
+  const controller = new AbortController();
+  const onAbort = () => controller.abort(external?.reason);
+  if (external?.aborted) {
+    onAbort();
+  } else {
+    external?.addEventListener("abort", onAbort, { once: true });
+  }
+  const timer = setTimeout(() => {
+    controller.abort(Object.assign(new Error(`timeout ap\xF3s ${timeoutMs}ms`), { name: "TimeoutError" }));
+  }, timeoutMs);
+  unrefTimer(timer);
+  return {
+    signal: controller.signal,
+    cleanup: () => {
+      clearTimeout(timer);
+      external?.removeEventListener("abort", onAbort);
+    }
+  };
+}
+var PREFIX = "[hobots]";
 function makeLogger(enabled, prefix = PREFIX) {
   return {
     debug: (...args) => enabled && console.debug(colorize(prefix, "gray"), ...args),
@@ -189,11 +299,11 @@ function eventFromException(error, level = "error") {
   let frames = [];
   if (error instanceof Error) {
     type = error.name || "Error";
-    value = error.message;
+    value = scrubSecrets(error.message);
     frames = parseStacktrace(error.stack);
   } else {
     type = "NonError";
-    value = safeString(error);
+    value = scrubSecrets(safeString(error));
   }
   return {
     event_id: uuid4(),
@@ -211,12 +321,12 @@ function eventFromMessage(message, level = "info") {
     event_id: uuid4(),
     timestamp: nowISO(),
     level,
-    message
+    message: scrubSecrets(message)
   };
 }
 
 // src/transport.ts
-var RETRY_DELAYS_MS = [1e3, 4e3, 16e3];
+var REQUEST_TIMEOUT_MS = 1e4;
 var DEFAULT_FLUSH_INTERVAL_MS = 2e3;
 var DEFAULT_MAX_BATCH_SIZE = 10;
 var DEFAULT_MAX_QUEUE_SIZE = 200;
@@ -282,32 +392,26 @@ var Transport = class {
     return request;
   }
   async sendWithRetry(envelope) {
-    for (let attempt = 0; ; attempt++) {
-      try {
-        const response = await fetch(this.endpoint, {
+    let response;
+    try {
+      response = await fetchWithRetry(
+        () => fetch(this.endpoint, {
           method: "POST",
           headers: { "content-type": "application/json", authorization: `Bearer ${this.key}` },
-          body: JSON.stringify(envelope)
-        });
-        if (response.ok) {
-          this.logger.debug(`envelope enviado (${envelope.items.length} itens)`);
-          return;
-        }
-        if (response.status >= 400 && response.status < 500 && response.status !== 429) {
-          this.logger.error(`envelope rejeitado (HTTP ${response.status}), descartado`);
-          return;
-        }
-        throw new Error(`HTTP ${response.status}`);
-      } catch (error) {
-        const delay = RETRY_DELAYS_MS[attempt];
-        if (delay === void 0) {
-          this.logger.error("envelope descartado ap\xF3s retries:", error);
-          return;
-        }
-        this.logger.warn(`falha no envio (${String(error)}), retry em ${delay}ms`);
-        await sleep(delay);
-      }
+          body: JSON.stringify(envelope),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+        }),
+        { logger: this.logger, label: "envio de envelope" }
+      );
+    } catch (error) {
+      this.logger.error("envelope descartado ap\xF3s retries:", error);
+      return;
     }
+    if (response.ok) {
+      this.logger.debug(`envelope enviado (${envelope.items.length} itens)`);
+      return;
+    }
+    this.logger.error(`envelope rejeitado (HTTP ${response.status}), descartado`);
   }
   /** Envia o que estiver na fila e aguarda envios em andamento (até timeoutMs). */
   async flush(timeoutMs = 5e3) {
@@ -333,22 +437,38 @@ function runtimeContexts() {
   return { runtime: { name: "browser" } };
 }
 var Client = class {
-  options;
-  config;
   logger;
+  // campos privados + getters de protótipo: o clientSecret não aparece em
+  // JSON.stringify/serialização enumerável do Client (ex.: um objeto capturado
+  // que referencie o client), mas client.options/config seguem funcionando
+  #options;
+  #config;
   transport;
-  constructor(options) {
-    this.options = options;
+  constructor(options, config = resolveConfig(options)) {
+    this.#options = options;
     this.logger = makeLogger(!!options.debug);
-    this.config = resolveConfig(options);
+    this.#config = config;
     this.transport = new Transport({
-      endpoint: this.config.ingestEndpoint,
-      key: this.config.key,
+      endpoint: this.#config.ingestEndpoint,
+      key: this.#config.key,
       logger: this.logger,
       flushIntervalMs: options.flushIntervalMs,
       maxBatchSize: options.maxBatchSize
     });
   }
+  get options() {
+    return this.#options;
+  }
+  get config() {
+    return this.#config;
+  }
+  /** Serialização explícita nunca inclui o secret. */
+  toJSON() {
+    return { sdk: SDK_NAME, version: SDK_VERSION, baseUrl: this.#config.baseUrl };
+  }
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return `Client { baseUrl: '${this.#config.baseUrl}' }`;
+  }
   captureException(error, hint, scope2) {
     return this.captureEvent(eventFromException(error, hint?.level ?? "error"), hint, scope2);
   }
@@ -733,48 +853,31 @@ function sendCheckIn(client2, options) {
   return checkInId;
 }
 async function withMonitorImpl(client2, captureError, monitorSlug, fn, options) {
-  const checkInId = sendCheckIn(client2, {
-    monitorSlug,
-    status: "in_progress",
-    schedule: options?.schedule,
-    timezone: options?.timezone
-  });
+  const base = { monitorSlug, schedule: options?.schedule, timezone: options?.timezone };
+  const checkInId = sendCheckIn(client2, { ...base, status: "in_progress" });
   const startedAt = Date.now();
   try {
     const result = await fn();
-    sendCheckIn(client2, {
-      monitorSlug,
-      status: "ok",
-      checkInId,
-      durationMs: Date.now() - startedAt,
-      schedule: options?.schedule,
-      timezone: options?.timezone
-    });
+    sendCheckIn(client2, { ...base, status: "ok", checkInId, durationMs: Date.now() - startedAt });
     return result;
   } catch (error) {
-    sendCheckIn(client2, {
-      monitorSlug,
-      status: "error",
-      checkInId,
-      durationMs: Date.now() - startedAt,
-      schedule: options?.schedule,
-      timezone: options?.timezone
-    });
+    sendCheckIn(client2, { ...base, status: "error", checkInId, durationMs: Date.now() - startedAt });
     captureError(error);
     throw error;
   }
 }
 
-// src/manager/api.ts
-var RETRY_DELAYS_MS2 = [1e3, 4e3, 16e3];
-var ManagerApiError = class extends Error {
+// src/tasks/api.ts
+var POLL_TIMEOUT_MS = 3e4;
+var UPDATE_TIMEOUT_MS = 1e4;
+var TasksApiError = class extends Error {
   constructor(message, status) {
     super(message);
     this.status = status;
-    this.name = "ManagerApiError";
+    this.name = "TasksApiError";
   }
 };
-var ManagerApi = class {
+var TasksApi = class {
   baseUrl;
   key;
   logger;
@@ -791,45 +894,61 @@ var ManagerApi = class {
   }
   /** Um request só — o loop de polling é quem decide o backoff entre tentativas. */
   async poll(request, signal) {
-    const response = await fetch(`${this.baseUrl}/poll`, {
-      method: "POST",
-      headers: this.headers(),
-      body: JSON.stringify(request),
-      signal
-    });
+    const { signal: timeoutSignal, cleanup } = withTimeoutSignal(POLL_TIMEOUT_MS, signal);
+    let response;
+    try {
+      response = await fetch(`${this.baseUrl}/poll`, {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify(request),
+        signal: timeoutSignal
+      });
+    } finally {
+      cleanup();
+    }
     if (!response.ok) {
-      throw new ManagerApiError(`poll falhou (HTTP ${response.status})`, response.status);
+      throw new TasksApiError(`poll falhou (HTTP ${response.status})`, response.status);
+    }
+    return this.parsePollResponse(await response.json(), request.max ?? 1);
+  }
+  /** Nunca confia no shape da resposta: runs malformadas são descartadas e o `max` é respeitado. */
+  parsePollResponse(body, max) {
+    const runs = body?.runs;
+    if (!Array.isArray(runs)) {
+      throw new TasksApiError("resposta inv\xE1lida do poll (campo runs ausente)", 0);
+    }
+    const valid = [];
+    for (const run of runs.slice(0, Math.max(0, max))) {
+      if (typeof run?.id !== "string" || typeof run.task !== "string") continue;
+      const params = run.params && typeof run.params === "object" && !Array.isArray(run.params) ? run.params : {};
+      valid.push({ ...run, id: run.id, task: run.task, params });
+    }
+    if (valid.length < runs.length) {
+      this.logger.warn(`poll retornou ${runs.length - valid.length} run(s) inv\xE1lida(s)/excedente(s) \u2014 descartadas`);
     }
-    return await response.json();
+    return { runs: valid };
   }
   /**
    * PATCH de status/logs com retry em falha de rede/5xx/429.
-   * 4xx é definitivo e vira ManagerApiError imediato (409 = run cancelada/transição inválida).
+   * 4xx é definitivo e vira TasksApiError imediato (409 = run cancelada/transição inválida).
    */
   async updateRun(runId, update) {
-    for (let attempt = 0; ; attempt++) {
-      let retriable;
-      try {
-        const response = await fetch(`${this.baseUrl}/runs/${encodeURIComponent(runId)}`, {
+    let response;
+    try {
+      response = await fetchWithRetry(
+        () => fetch(`${this.baseUrl}/runs/${encodeURIComponent(runId)}`, {
           method: "PATCH",
           headers: this.headers(),
-          body: JSON.stringify(update)
-        });
-        if (response.ok) return;
-        if (response.status >= 400 && response.status < 500 && response.status !== 429) {
-          throw new ManagerApiError(`update rejeitado (HTTP ${response.status})`, response.status);
-        }
-        retriable = new Error(`HTTP ${response.status}`);
-      } catch (error) {
-        if (error instanceof ManagerApiError) throw error;
-        retriable = error;
-      }
-      const delay = RETRY_DELAYS_MS2[attempt];
-      if (delay === void 0) {
-        throw new Error(`update da run ${runId} descartado ap\xF3s retries: ${String(retriable)}`);
-      }
-      this.logger.warn(`falha no update da run ${runId} (${String(retriable)}), retry em ${delay}ms`);
-      await sleep(delay);
+          body: JSON.stringify(update),
+          signal: AbortSignal.timeout(UPDATE_TIMEOUT_MS)
+        }),
+        { logger: this.logger, label: `update da run ${runId}` }
+      );
+    } catch (error) {
+      throw new Error(`update da run ${runId} descartado ap\xF3s retries: ${String(error)}`);
+    }
+    if (!response.ok) {
+      throw new TasksApiError(`update rejeitado (HTTP ${response.status})`, response.status);
     }
   }
   /**
@@ -847,7 +966,7 @@ var ManagerApi = class {
   }
 };
 
-// src/manager/context.ts
+// src/tasks/context.ts
 var LOG_LEVEL_COLOR = {
   debug: "gray",
   info: "cyan",
@@ -951,14 +1070,14 @@ var RunReporter = class {
   }
   log(level, message) {
     if (this.dead) return;
-    printRunLog(this.context.task, level, message);
+    const scrubbed = scrubSecrets(message);
+    printRunLog(this.context.task, level, scrubbed);
     if (this.loggedCount >= MAX_LOGS_PER_RUN) {
       this.droppedCount++;
       return;
     }
     this.loggedCount++;
-    const truncated = message.length > MAX_LOG_MESSAGE_CHARS ? `${message.slice(0, MAX_LOG_MESSAGE_CHARS)}\u2026 [truncado]` : message;
-    this.buffer.push({ ts: nowISO(), level, message: truncated });
+    this.buffer.push({ ts: nowISO(), level, message: truncate(scrubbed, MAX_LOG_MESSAGE_CHARS) });
     if (this.buffer.length >= FLUSH_AT_BUFFERED) {
       this.flushLogs();
     } else {
@@ -1049,7 +1168,7 @@ var RunReporter = class {
       try {
         await this.api.updateRun(this.runId, payload);
       } catch (error) {
-        if (error instanceof ManagerApiError && (error.status === 409 || error.status === 404)) {
+        if (error instanceof TasksApiError && (error.status === 409 || error.status === 404)) {
           this.dead = true;
           this.stopCancelWatch();
           this.abort();
@@ -1065,7 +1184,7 @@ var RunReporter = class {
   }
 };
 
-// src/manager/run-context-store.ts
+// src/tasks/run-context-store.ts
 var storage;
 var initPromise;
 async function ensureStorage() {
@@ -1075,15 +1194,15 @@ async function ensureStorage() {
   });
   await initPromise;
 }
-async function runWithRunId(runId, fn) {
+async function runWithRunContext(store, fn) {
   await ensureStorage();
-  return storage ? storage.run({ runId }, fn) : fn();
+  return storage ? storage.run(store, fn) : fn();
 }
-function currentRunId() {
-  return storage?.getStore()?.runId;
+function currentRunTransaction() {
+  return storage?.getStore()?.tx;
 }
 
-// src/manager/shutdown.ts
+// src/tasks/shutdown.ts
 var WATCHED_SIGNALS = ["SIGINT", "SIGTERM"];
 function installShutdownHandlers(agent2) {
   if (!isNode()) return () => {
@@ -1127,7 +1246,7 @@ function installShutdownHandlers(agent2) {
   };
 }
 
-// src/manager/agent.ts
+// src/tasks/agent.ts
 var DEFAULT_POLL_INTERVAL_MS = 5e3;
 var MIN_POLL_INTERVAL_MS = 1e3;
 var MAX_CONCURRENCY = 5;
@@ -1137,13 +1256,13 @@ function hostname() {
   if (!isNode()) return void 0;
   return process.env.HOSTNAME || process.env.COMPUTERNAME || void 0;
 }
-var ManagerAgent = class {
+var TaskAgent = class {
   constructor(options, registry2) {
     this.options = options;
     this.registry = registry2;
-    this.logger = makeLogger(options.debug ?? false, "[hobots-manager]");
-    const config = resolveConfig(options, "[hobots-manager]");
-    this.api = new ManagerApi({ baseUrl: config.managerBaseUrl, key: config.key, logger: this.logger });
+    this.logger = makeLogger(options.debug ?? false);
+    const config = options.config;
+    this.api = new TasksApi({ baseUrl: config.tasksBaseUrl, key: config.key, logger: this.logger });
     this.client = options.client;
     this.pollIntervalMs = Math.max(MIN_POLL_INTERVAL_MS, options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
     this.concurrency = Math.min(MAX_CONCURRENCY, Math.max(1, options.concurrency ?? 1));
@@ -1151,7 +1270,7 @@ var ManagerAgent = class {
     this.taskTimeoutMs = options.taskTimeoutMs;
     this.logFlushIntervalMs = options.logFlushIntervalMs;
     this.cancelCheckIntervalMs = options.cancelCheckIntervalMs;
-    this.logger.debug("agente configurado", { baseUrl: config.managerBaseUrl });
+    this.logger.debug("agente configurado", { baseUrl: config.tasksBaseUrl });
   }
   logger;
   api;
@@ -1176,10 +1295,10 @@ var ManagerAgent = class {
   start() {
     if (this.state === "started") return;
     if (this.state === "stopping") {
-      throw new Error("[hobots-manager] start() chamado durante stop() \u2014 aguarde o stop terminar");
+      throw new Error("[hobots] start() chamado durante stop() \u2014 aguarde o stop terminar");
     }
     if (this.registry.size === 0) {
-      throw new Error("[hobots-manager] nenhuma task registrada \u2014 chame register() antes de start()");
+      throw new Error("[hobots] nenhuma task registrada \u2014 chame register() antes de start()");
     }
     this.state = "started";
     if (this.options.installExitHandlers !== false && !this.uninstallShutdown) {
@@ -1261,6 +1380,7 @@ var ManagerAgent = class {
       this.consecutiveFailures = 0;
       this.consecutiveAuthFailures = 0;
       for (const run of response.runs) {
+        if (this.activeRuns.size >= this.concurrency) break;
         this.dispatch(run);
       }
       this.schedule(response.runs.length > 0 ? 0 : this.pollIntervalMs);
@@ -1272,7 +1392,7 @@ var ManagerAgent = class {
     }
   }
   delayAfterPollError(error) {
-    if (error instanceof ManagerApiError && error.status === 401) {
+    if (error instanceof TasksApiError && error.status === 401) {
       this.consecutiveAuthFailures++;
       if (this.consecutiveAuthFailures === 1 || this.consecutiveAuthFailures % 10 === 0) {
         this.logger.error("chave rejeitada (401) \u2014 verifique o Client Secret do projeto em Configura\xE7\xF5es \u2192 Projetos");
@@ -1281,7 +1401,7 @@ var ManagerAgent = class {
     }
     this.consecutiveFailures++;
     const ladder = POLL_RETRY_DELAYS_MS[Math.min(this.consecutiveFailures - 1, POLL_RETRY_DELAYS_MS.length - 1)];
-    const delay = Math.min(Math.max(ladder, 0), Math.max(this.pollIntervalMs, 16e3));
+    const delay = Math.min(Math.max(jitter(ladder), 0), Math.max(this.pollIntervalMs, 16e3));
     this.logger.warn(`poll falhou (${String(error)}), pr\xF3xima tentativa em ${delay}ms`);
     return delay;
   }
@@ -1293,7 +1413,7 @@ var ManagerAgent = class {
     this.activeRuns.add(promise);
   }
   async executeRun(run) {
-    const tx = new Transaction(this.client, `run:${run.task}`, "manager.run", true, run.id);
+    const tx = new Transaction(this.client, `run:${run.task}`, "hobots.task", true, run.id);
     const reporter = new RunReporter(this.api, run.id, run.task, this.logger, tx, this.logFlushIntervalMs, this.cancelCheckIntervalMs);
     this.reporters.add(reporter);
     try {
@@ -1317,7 +1437,7 @@ var ManagerAgent = class {
       }
       this.logger.debug(`executando run ${run.id} (${run.task})`);
       try {
-        await runWithRunId(run.id, () => this.invokeWithTimeout(handler, run, reporter));
+        await runWithRunContext({ runId: run.id, tx }, () => this.invokeWithTimeout(handler, run, reporter));
         reporter.reportSuccess();
         tx.setStatus("ok");
         this.logger.debug(`run ${run.id} conclu\xEDda`);
@@ -1352,18 +1472,15 @@ var ManagerAgent = class {
 var TIMEOUT_SENTINEL = /* @__PURE__ */ Symbol("task-timeout");
 var MAX_ERROR_MESSAGE_CHARS = 1e4;
 var MAX_ERROR_STACK_CHARS = 2e4;
-function truncate(value, max) {
-  return value.length > max ? `${value.slice(0, max)}\u2026 [truncado]` : value;
-}
 function toRunError(error) {
   if (error instanceof Error) {
     return {
       type: error.name,
-      message: truncate(error.message, MAX_ERROR_MESSAGE_CHARS),
-      stack: error.stack ? truncate(error.stack, MAX_ERROR_STACK_CHARS) : void 0
+      message: scrubSecrets(truncate(error.message, MAX_ERROR_MESSAGE_CHARS)),
+      stack: error.stack ? scrubSecrets(truncate(error.stack, MAX_ERROR_STACK_CHARS)) : void 0
     };
   }
-  return { message: truncate(String(error), MAX_ERROR_MESSAGE_CHARS) };
+  return { message: scrubSecrets(truncate(String(error), MAX_ERROR_MESSAGE_CHARS)) };
 }
 
 // src/core.ts
@@ -1373,7 +1490,7 @@ var scope = new Scope();
 var heartbeat;
 var agent;
 var registry = /* @__PURE__ */ new Map();
-var warnedManagerDisabled = false;
+var warnedTasksDisabled = false;
 function init(options) {
   if (client) {
     client.logger.warn("init() chamado mais de uma vez \u2014 substituindo o client anterior");
@@ -1384,8 +1501,9 @@ function init(options) {
     void agent.stop(0);
     agent = void 0;
   }
-  warnedManagerDisabled = false;
-  client = new Client(options);
+  warnedTasksDisabled = false;
+  const config = resolveConfig(options);
+  client = new Client(options, config);
   if (options.captureUnhandled !== false) {
     installGlobalHandlers(client, () => scope);
   }
@@ -1394,10 +1512,10 @@ function init(options) {
     heartbeat = new Heartbeat(client, heartbeatOptions, options.instanceId);
     heartbeat.start();
   }
-  if (options.manager) {
-    const managerOptions = options.manager === true ? {} : options.manager;
-    agent = new ManagerAgent(
-      { ...managerOptions, clientSecret: options.clientSecret, instanceId: options.instanceId, debug: options.debug, client },
+  if (options.tasks) {
+    const tasksOptions = options.tasks === true ? {} : options.tasks;
+    agent = new TaskAgent(
+      { ...tasksOptions, config, instanceId: options.instanceId, debug: options.debug, client },
       registry
     );
   }
@@ -1440,9 +1558,14 @@ function withScope(callback) {
   }
 }
 function startTransaction(name, op) {
+  const active = currentRunTransaction();
+  if (active) {
+    client?.logger.debug(`startTransaction('${name}') dentro de uma execu\xE7\xE3o \u2014 reutilizando a transaction da run`);
+    return active;
+  }
   const rate = client?.options.tracesSampleRate ?? 1;
   const sampled = rate >= 1 || Math.random() < rate;
-  return new Transaction(client, name, op, sampled, currentRunId());
+  return new Transaction(client, name, op, sampled);
 }
 function checkIn(options) {
   return client ? sendCheckIn(client, options) : void 0;
@@ -1464,17 +1587,17 @@ function register(task, handler) {
   if (registry.has(task)) {
     (agent?.logger ?? client?.logger)?.warn(`register('${task}') sobrescreveu um handler existente`);
   }
-  if (client && !agent && !warnedManagerDisabled) {
-    warnedManagerDisabled = true;
+  if (client && !agent && !warnedTasksDisabled) {
+    warnedTasksDisabled = true;
     client.logger.warn(
-      `register('${task}') com o Manager desabilitado \u2014 passe manager: true (ou op\xE7\xF5es) no init()`
+      `register('${task}') com tasks desabilitadas \u2014 passe tasks: true (ou op\xE7\xF5es) no init()`
     );
   }
   registry.set(task, handler);
 }
 function start() {
   if (!agent) {
-    throw new Error("[hobots] Manager n\xE3o configurado \u2014 passe manager: true (ou op\xE7\xF5es) no init() antes de start()");
+    throw new Error("[hobots] tasks n\xE3o configuradas \u2014 passe tasks: true (ou op\xE7\xF5es) no init() antes de start()");
   }
   agent.start();
 }