lua-cli 3.39.2 → 3.39.3

package/dist/index.js

@@ -1586,6 +1586,7 @@ function utf8Bytes(value3) {
 }
 function isPlainFieldKey(key) {
   if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  if (key === LOG_FIELDS_CLAMPED_KEY) return false;
   return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
 }
 function describeAgentLogFieldsViolation(value3) {
@@ -50379,7 +50380,7 @@ function wantsContent(options, sources) {
   return (sources ?? []).some((source) => LOG_DRAIN_CONTENT_SOURCES.includes(source));
 }
 __name(wantsContent, "wantsContent");
-async function acknowledgeContent(options, becauseOfFlag = true) {
+async function acknowledgeContent(options, becauseOfFlag = true, nothingHint = "Nothing was created") {
   emitAside("", options.json);
   emitAside(CONTENT_WARNING_TEXT, options.json);
   emitAside("", options.json);
@@ -50387,7 +50388,7 @@ async function acknowledgeContent(options, becauseOfFlag = true) {
   emitAside("", options.json);
   if (options.yes) return true;
   if (isCiModeEnabled()) {
-    throw CliError.usage(becauseOfFlag ? "--include-content needs the acknowledgement above; pass --yes to give it non-interactively." : "Selecting user_message or agent_response needs the acknowledgement above; pass --yes to give it non-interactively. (Content bodies stay OFF unless you also pass --include-content.)", "Nothing was created");
+    throw CliError.usage(becauseOfFlag ? "--include-content needs the acknowledgement above; pass --yes to give it non-interactively." : "Selecting user_message or agent_response needs the acknowledgement above; pass --yes to give it non-interactively. (Content bodies stay OFF unless you also pass --include-content.)", nothingHint);
   }
   const answer = await safePrompt([
     {
@@ -50398,7 +50399,7 @@ async function acknowledgeContent(options, becauseOfFlag = true) {
     }
   ]);
   if (!answer?.acknowledged) {
-    throw CliError.usage("Content was not enabled: the acknowledgement was declined.", "Nothing was created");
+    throw CliError.usage("Content was not enabled: the acknowledgement was declined.", nothingHint);
   }
   return true;
 }
@@ -51710,6 +51711,8 @@ var LOG_EXPORT_DOWNLOAD = {
 };
 var ALREADY_RUNNING = "EXPORT_ALREADY_RUNNING";
 var MISSING_EXPORT_SCOPE_MESSAGE = "Missing scope: logs:read. Create a key with that scope (lua auth key) or ask an org admin.";
+var EXPORT_CONTENT_FORBIDDEN = "EXPORT_CONTENT_FORBIDDEN";
+var MISSING_EXPORT_CONTENT_SCOPE_MESSAGE = "Missing scope: logs:manage. Create a key with that scope (lua auth key) or ask an org admin.";
 var TERMINAL2 = /* @__PURE__ */ new Set([
   "succeeded",
   "failed",
@@ -51726,6 +51729,10 @@ async function logsExportCommand(cmdObj) {
       }
       const sources = parseTypeFlag(options.type);
       const outDir = options.out ? resolveOutDir(String(options.out)) : void 0;
+      const includeContent = options.includeContent === true;
+      if (includeContent) {
+        await acknowledgeContent(options, true, "Nothing was exported");
+      }
       const context = await resolveDrainsContext(options);
       const api = new LogExportApi(BASE_URLS.API, context.apiKey, context.orgId);
       const say = /* @__PURE__ */ __name((line) => {
@@ -51734,7 +51741,8 @@ async function logsExportCommand(cmdObj) {
       const jobId = await startOrAttach(api, {
         from: since,
         to: until ?? (/* @__PURE__ */ new Date()).toISOString(),
-        sources
+        sources,
+        includeContent
       }, say);
       if (options.noWait || options.wait === false) {
         emit2(options, {
@@ -51745,7 +51753,8 @@ async function logsExportCommand(cmdObj) {
         trackEvent("cli_logs_export", {
           waited: false,
           json_output: !!options.json,
-          downloaded: 0
+          downloaded: 0,
+          include_content: includeContent
         });
         return;
       }
@@ -51786,7 +51795,8 @@ async function logsExportCommand(cmdObj) {
         waited: true,
         json_output: !!options.json,
         downloaded: written.length,
-        truncated: !!job.truncated
+        truncated: !!job.truncated,
+        include_content: includeContent
       });
     },
     "logs export",
@@ -51820,6 +51830,11 @@ async function startOrAttach(api, input, say) {
     to: input.to,
     ...input.sources ? {
       sources: input.sources
+    } : {},
+    // Only ever sent as `true` — PRO-2182. `false`/absent both mean "no content", and the
+    // server's own default is `false`, so there is nothing an omitted key would lose.
+    ...input.includeContent ? {
+      includeContent: true
     } : {}
   };
   const started = await callExport(() => api.startExport(body));
@@ -51874,7 +51889,7 @@ async function callExport(call) {
     return await call();
   } catch (error) {
     if (CliError.isCliError(error) && error.statusCode === 403) {
-      throw CliError.forbidden(MISSING_EXPORT_SCOPE_MESSAGE);
+      throw CliError.forbidden(error.serverCode === EXPORT_CONTENT_FORBIDDEN ? MISSING_EXPORT_CONTENT_SCOPE_MESSAGE : MISSING_EXPORT_SCOPE_MESSAGE);
     }
     throw error;
   }
@@ -71704,7 +71719,7 @@ Notes:
   shift the window. --type calls reads voice calls and ignores --since/--until/--environment
   /--follow. --since is INCLUSIVE; the boundary row is de-duplicated by id while following.
 `).action(logsCommand);
-  logsGroup.command("export").description("\u{1F4E6} Export this organization's logs as gzip NDJSON (asynchronous job)").option("--since <when>", "Inclusive lower bound (REQUIRED): an ISO 8601 instant, or 24h | 7d").option("--until <when>", "Inclusive upper bound; same formats (default: now)").option("--type <type>", "Comma-separated log sources, or all (default: all)").option("--out <dir>", "Download the parts into this directory (created if missing)").option("--org <id>", "The organization to export (default: the project, or the key when it reaches one org)").option("--no-wait", "Start the export and print the job id without polling it").option("--json", "Output as JSON").addHelpText("after", `
+  logsGroup.command("export").description("\u{1F4E6} Export this organization's logs as gzip NDJSON (asynchronous job)").option("--since <when>", "Inclusive lower bound (REQUIRED): an ISO 8601 instant, or 24h | 7d").option("--until <when>", "Inclusive upper bound; same formats (default: now)").option("--type <type>", "Comma-separated log sources, or all (default: all)").option("--out <dir>", "Download the parts into this directory (created if missing)").option("--org <id>", "The organization to export (default: the project, or the key when it reaches one org)").option("--no-wait", "Start the export and print the job id without polling it").option("--include-content", "Include user_message / agent_response bodies (requires logs:manage; prints an acknowledgement)").option("-y, --yes", "Give the --include-content acknowledgement non-interactively").option("--json", "Output as JSON").addHelpText("after", `
 Options:
   --since <when>         REQUIRED. Inclusive lower bound: an ISO 8601 instant, or 24h | 7d
   --until <when>         Inclusive upper bound, same formats (default: now)
@@ -71712,19 +71727,26 @@ Options:
   --out <dir>            Download every part into this local directory
   --org <id>             The organization, when the key reaches more than one
   --no-wait              Start it and print the job id; poll later
+  --include-content      Include user_message / agent_response bodies. Requires logs:manage;
+                         prints the same content warning and acknowledgement as
+                         lua drains create --include-content
+  -y, --yes              Give that acknowledgement non-interactively
   --json                 Output as JSON for scripting
 
 Examples:
   $ lua logs export --since 7d --out ./export        A week, downloaded
   $ lua logs export --since 30d --type skill,job     A month, two sources
   $ lua logs export --since 24h --no-wait --json     Start it and return
+  $ lua logs export --since 24h --include-content --yes   Include message bodies (logs:manage)
 
 Notes:
   The window is at most 31 days and the job at most 10 000 000 records; narrow the window
   or the sources rather than raising either. One export runs per organization at a time \u2014
   a second invocation FOLLOWS the running one instead of refusing. Download links expire
-  24 h after the export finishes and the files are removed after 7 days. Message bodies
-  are excluded unless the export was started with the logs:manage scope.
+  24 h after the export finishes and the files are removed after 7 days. Message bodies are
+  EXCLUDED BY DEFAULT and only ever included when --include-content is passed AND the
+  acknowledgement is given AND the credential holds logs:manage \u2014 the scope alone is not
+  enough, the flag is required too.
 `).action((options, command) => logsExportCommand(withGroupOptions(options ?? {}, command)));
   program2.command("skills [actionOrEnv] [action]").description("\u2699\uFE0F  Manage and view skills").option("--skill-name <name>", "Skill name").option("--skill-version <version>", "Version for deploy action (or 'latest')").addHelpText("after", `
 Arguments: