pi-langfuse 1.4.3 → 1.4.4

package/src/redaction.ts

@@ -0,0 +1,115 @@
+import { createHash } from "node:crypto";
+
+export const REDACTED = "[REDACTED_SECRET]";
+
+export interface RedactOptions {
+  maxDepth: number;
+  maxArrayItems: number;
+  maxObjectKeys: number;
+  maxStringLength: number;
+}
+
+const DEFAULT_OPTIONS: RedactOptions = {
+  maxDepth: 6,
+  maxArrayItems: 50,
+  maxObjectKeys: 80,
+  maxStringLength: 12_000,
+};
+
+const SECRET_ASSIGNMENT_RE =
+  /\b([A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASS|API[_-]?KEY|PRIVATE[_-]?KEY|AUTH|COOKIE)[A-Z0-9_]*)\s*=\s*([^\s"'`]+)/gi;
+const PRIVATE_KEY_RE = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+const BEARER_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/gi;
+const KNOWN_TOKEN_RE =
+  /\b(?:sk-(?:lf|ant|proj|live|test)[A-Za-z0-9_-]*|pk-lf-[A-Za-z0-9_-]+|gh[pousr]_[A-Za-z0-9_]{20,}|npm_[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16})\b/g;
+const ABSOLUTE_PATH_RE =
+  /(?:\/Users\/[^/\s]+|\/home\/[^/\s]+|\/private\/tmp|\/tmp|[A-Za-z]:\\Users\\[^\\\s]+)(?:[^\s"'`]*)/g;
+const SENSITIVE_FIELD_RE =
+  /^(authorization|cookie|setcookie|xapikey|apikey|token|accesstoken|refreshtoken|secret|secretkey|password|passwd|privatekey)$/;
+
+export function hashPath(path: string): string {
+  return `[PATH_HASH:${createHash("sha256").update(path).digest("hex").slice(0, 12)}]`;
+}
+
+function truncate(value: string, maxStringLength: number): string {
+  return value.length > maxStringLength ? `${value.slice(0, maxStringLength)}... [truncated]` : value;
+}
+
+export function redactString(value: string, options: Partial<RedactOptions> = {}): string {
+  const merged = { ...DEFAULT_OPTIONS, ...options };
+  const truncated = truncate(value, merged.maxStringLength);
+  return truncated
+    .replace(PRIVATE_KEY_RE, REDACTED)
+    .replace(BEARER_RE, REDACTED)
+    .replace(KNOWN_TOKEN_RE, REDACTED)
+    .replace(SECRET_ASSIGNMENT_RE, (_match, key: string) => `${key}=${REDACTED}`)
+    .replace(ABSOLUTE_PATH_RE, (path: string) => {
+      const envSuffix = path.match(/([/\\]\.env(?:\.[A-Za-z0-9_-]+)?)$/)?.[1];
+      return `${hashPath(envSuffix ? path.slice(0, -envSuffix.length) : path)}${envSuffix ?? ""}`;
+    });
+}
+
+function visit(value: unknown, options: RedactOptions, depth: number, seen: WeakSet<object>): unknown {
+  if (value === null || value === undefined || typeof value === "number" || typeof value === "boolean") {
+    return value;
+  }
+
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+
+  if (typeof value === "string") {
+    return redactString(value, options);
+  }
+
+  if (typeof value === "function" || typeof value === "symbol") {
+    return `[${typeof value}]`;
+  }
+
+  if (depth <= 0) {
+    return `[max depth ${options.maxDepth} reached]`;
+  }
+
+  if (value instanceof Error) {
+    return {
+      name: redactString(value.name, options),
+      message: redactString(value.message, options),
+      stack: value.stack ? redactString(value.stack, options) : undefined,
+    };
+  }
+
+  if (typeof value !== "object") {
+    return redactString(String(value), options);
+  }
+
+  if (seen.has(value)) {
+    return "[circular]";
+  }
+  seen.add(value);
+
+  if (Array.isArray(value)) {
+    const output = value
+      .slice(0, options.maxArrayItems)
+      .map((item) => visit(item, options, depth - 1, seen));
+    if (value.length > options.maxArrayItems) {
+      output.push(`[${value.length - options.maxArrayItems} truncated items]`);
+    }
+    return output;
+  }
+
+  const entries = Object.entries(value as Record<string, unknown>);
+  const output: Record<string, unknown> = {};
+  for (const [key, item] of entries.slice(0, options.maxObjectKeys)) {
+    const normalizedKey = key.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+    output[key] = SENSITIVE_FIELD_RE.test(normalizedKey) ? REDACTED : visit(item, options, depth - 1, seen);
+  }
+  if (entries.length > options.maxObjectKeys) {
+    output.__truncatedKeys = entries.length - options.maxObjectKeys;
+  }
+  return output;
+}
+
+export function redactValue(value: unknown, options: Partial<RedactOptions> = {}): unknown {
+  const merged: RedactOptions = { ...DEFAULT_OPTIONS, ...options };
+  return visit(value, merged, merged.maxDepth, new WeakSet<object>());
+}

package/src/state.ts

@@ -9,6 +9,7 @@ export interface SessionRunState {
   errorCount: number;
   turnCount: number;
   tracingDisabled: boolean;
+  setupAttemptedThisSession: boolean;
 }
 
 const DEFAULT_SESSION_ID = "__pi_langfuse_default_session__";
@@ -25,6 +26,7 @@ function createSessionRunState(): SessionRunState {
     errorCount: 0,
     turnCount: 0,
     tracingDisabled: false,
+    setupAttemptedThisSession: false,
   };
 }
 
@@ -59,7 +61,6 @@ export function runWithSession<T>(sessionId: string | undefined, fn: () => T): T
 
 export const state = {
   config: null as Config | null,
-  setupAttemptedThisSession: false,
   sessionStates: new Map<string, SessionRunState>(),
 
   get currentSessionId() {
@@ -118,10 +119,23 @@ export const state = {
   set isTracingDisabled(disabled: boolean) {
     getSessionRunState().tracingDisabled = disabled;
   },
+
+  get setupAttemptedThisSession() {
+    return getSessionRunState().setupAttemptedThisSession;
+  },
+  set setupAttemptedThisSession(attempted: boolean) {
+    getSessionRunState().setupAttemptedThisSession = attempted;
+  },
 };
 
 export function resetRunState(sessionId = getActiveSessionId()) {
-  state.sessionStates.set(normalizeSessionId(sessionId), createSessionRunState());
+  const normalizedSessionId = normalizeSessionId(sessionId);
+  const setupAttemptedThisSession =
+    state.sessionStates.get(normalizedSessionId)?.setupAttemptedThisSession ?? false;
+  state.sessionStates.set(normalizedSessionId, {
+    ...createSessionRunState(),
+    setupAttemptedThisSession,
+  });
 }
 
 export function clearAllSessionStates() {

package/src/types.ts

@@ -1,7 +1,10 @@
+import type { CapturePolicy } from "./capture-policy.js";
+
 export interface Config {
   publicKey: string;
   secretKey: string;
   host: string;
+  capturePolicy?: CapturePolicy;
 }
 
 export interface LangfuseObservation {

package/src/utils.ts

@@ -6,6 +6,13 @@ import {
   MAX_STRING_LENGTH,
   MAX_TOOL_PAYLOAD_LENGTH,
 } from "./constants.js";
+import { createCapturePolicy, type CapturePolicy } from "./capture-policy.js";
+import { redactValue } from "./redaction.js";
+import { state } from "./state.js";
+
+export function getCapturePolicy(): CapturePolicy {
+  return state.config?.capturePolicy ?? createCapturePolicy();
+}
 
 export function truncate(value: string, maxLength = MAX_STRING_LENGTH): string {
   return value.length > maxLength ? `${value.slice(0, maxLength)}... [truncated]` : value;
@@ -26,7 +33,10 @@ export function tryParseJson(value: string): unknown {
 
 const PAYLOAD_TOO_LARGE = "[payload too large]";
 
-export function shapePayload(value: unknown, options: { maxString?: number; depth?: number; maxNodes?: number } = {}): unknown {
+export function shapePayload(
+  value: unknown,
+  options: { maxString?: number; depth?: number; maxNodes?: number; redact?: boolean } = {},
+): unknown {
   const maxString = options.maxString ?? MAX_STRING_LENGTH;
   const depth = options.depth ?? MAX_DEPTH;
   const maxNodes = options.maxNodes ?? MAX_PAYLOAD_NODES;
@@ -117,7 +127,15 @@ export function shapePayload(value: unknown, options: { maxString?: number; dept
     return String(item);
   }
 
-  return visit(value, depth, new WeakSet<object>());
+  const shaped = visit(value, depth, new WeakSet<object>());
+  return options.redact === false
+    ? shaped
+    : redactValue(shaped, {
+        maxDepth: depth,
+        maxStringLength: maxString,
+        maxArrayItems: MAX_ARRAY_ITEMS,
+        maxObjectKeys: MAX_OBJECT_KEYS,
+      });
 }
 
 export function safeSerialize(value: unknown, maxLength = MAX_TOOL_PAYLOAD_LENGTH): string {