pi-langfuse 1.5.2 → 1.5.3

package/README.md

@@ -150,6 +150,53 @@ The package also includes a Langfuse CLI skill, so Langfuse data can be queried
 /pi-langfuse-langfuse <your-query>
 ```
 
+## Source Metadata
+
+Local prototype note: source metadata support in this installed package is a local prototype patch. A durable solution should be shipped through an upstream PR, a fork, or a maintained package version so reinstalling the extension does not lose the behavior.
+
+For Git-backed runs, the extension attaches safe source metadata to traces:
+
+```json
+{
+  "source_type": "git-repo",
+  "repo_identity": "owner/repo",
+  "repo_owner": "owner",
+  "repo_name": "repo",
+  "repo_root_name": "repo",
+  "git_branch": "main",
+  "git_commit": "abc123",
+  "git_remote_host": "github.com",
+  "git_remote_path": "owner/repo",
+  "metadata_source": "git-detection"
+}
+```
+
+`repo_identity` is `owner/repo`. `repo_name` is the repo name only and must not contain a slash.
+
+A Git repo may optionally provide `.pi-langfuse.metadata.json`. Overrides are whitelist-only; unknown keys are ignored. Allowed keys are:
+
+```text
+repo_identity
+repo_owner
+repo_name
+source_type
+service_name
+project_slug
+environment
+observability_owner
+```
+
+Repo-local overrides are used only after the working directory is confirmed to be inside a usable Git repo. If Git detection fails for any reason, including a missing Git command, corrupted repo, or non-Git folder, the extension ignores repo-local identity files and emits only:
+
+```json
+{
+  "source_type": "non-git",
+  "metadata_source": "non-git"
+}
+```
+
+The extension must not upload raw absolute local paths, credentialed remotes, tokens, unknown override keys, or folder names for non-Git folders.
+
 ## Troubleshooting
 
 ### No traces appearing?

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-langfuse",
-	"version": "1.5.2",
+	"version": "1.5.3",
 	"description": "Langfuse extension for Pi coding agent",
 	"repository": {
 		"type": "git",

package/src/handlers/agent.ts

@@ -4,6 +4,7 @@ import { ensureConfig } from "../config.js";
 import { shapePayload, truncate, extractFinalAssistant, extractAssistantOutput, getCapturePolicy } from "../utils.js";
 import { closeDanglingObservations } from "./tool.js";
 import { applyCapturePolicy } from "../capture-policy.js";
+import { collectSourceMetadata } from "../source-metadata.js";
 
 function stringMetadata(metadata: Record<string, unknown> | undefined): Record<string, string> | undefined {
   if (!metadata) {
@@ -67,11 +68,13 @@ export async function startAgentRun(event: Record<string, unknown>, ctx: any) {
       images: event.images,
       context: event.context ?? event.attachments,
     });
+    const sourceMetadata = collectSourceMetadata(cwd);
     const captured = applyCapturePolicy(
       {
         input: rawPromptInput,
         metadata: {
           cwd,
+          ...sourceMetadata,
           ...(state.currentModel ? { model: state.currentModel } : {}),
           ...(state.currentProvider ? { provider: state.currentProvider } : {}),
           sessionId: state.currentSessionId || undefined,
@@ -88,6 +91,7 @@ export async function startAgentRun(event: Record<string, unknown>, ctx: any) {
       activeGenerations: new Map(),
       generationOrder: [],
       activeTools: new Map(),
+      sourceMetadata,
       providerMetadataByRequest: new Map(),
     };
 
@@ -133,6 +137,7 @@ export async function finishAgentRun(event: Record<string, unknown> = {}) {
       output: rawOutput,
       metadata: {
         cwd: state.agentState.cwd,
+        ...(state.agentState.sourceMetadata ?? {}),
         completed: true,
         model: state.currentModel || undefined,
         provider: state.currentProvider || undefined,

package/src/langfuse.ts

@@ -335,7 +335,8 @@ async function fallbackToRestIngestion(rt: LangfuseRuntime) {
   }
 
   const responseBody = response as { errors?: unknown[] } | undefined;
-  const errors = Array.isArray(responseBody?.errors) ? responseBody.errors : [];
+  const responseErrors = responseBody?.errors;
+  const errors = Array.isArray(responseErrors) ? responseErrors : [];
   if (errors.length > 0) {
     console.warn("📊 Langfuse: REST fallback ingestion reported errors", errors);
   } else {

package/src/source-metadata.ts

@@ -0,0 +1,160 @@
+import { existsSync, readFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { execFileSync } from "node:child_process";
+
+export type SourceMetadata = Record<string, string>;
+
+const OVERRIDE_KEYS = new Set([
+  "repo_identity",
+  "repo_owner",
+  "repo_name",
+  "source_type",
+  "service_name",
+  "project_slug",
+  "environment",
+  "observability_owner",
+]);
+
+function nonGitMetadata(): SourceMetadata {
+  return {
+    source_type: "non-git",
+    metadata_source: "non-git",
+  };
+}
+
+function runGit(cwd: string, args: string[]): string {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 2000,
+  }).trim();
+}
+
+function firstLine(value: string): string {
+  return value.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? "";
+}
+
+export function sanitizeGitRemote(remoteUrl: string): Partial<Pick<SourceMetadata, "git_remote_host" | "git_remote_path">> {
+  const raw = firstLine(remoteUrl).replace(/\.git$/i, "");
+  if (!raw) {
+    return {};
+  }
+
+  try {
+    const parsed = new URL(raw);
+    const path = parsed.pathname.replace(/^\/+/, "").replace(/\.git$/i, "");
+    return parsed.hostname && path ? { git_remote_host: parsed.hostname, git_remote_path: path } : {};
+  } catch {
+    // Continue with scp-like SSH syntax, for example git@github.com:owner/repo.git.
+  }
+
+  const scpLike = raw.match(/^(?:[^@\s/:]+@)?([^:\s]+):(.+)$/);
+  if (scpLike) {
+    const host = scpLike[1];
+    const path = scpLike[2].replace(/^\/+/, "").replace(/\.git$/i, "");
+    return host && path && !path.includes("@") ? { git_remote_host: host, git_remote_path: path } : {};
+  }
+
+  return {};
+}
+
+function deriveIdentity(remotePath: string | undefined): Partial<Pick<SourceMetadata, "repo_identity" | "repo_owner" | "repo_name">> {
+  if (!remotePath) {
+    return {};
+  }
+  const parts = remotePath.split("/").filter(Boolean);
+  if (parts.length < 2) {
+    return {};
+  }
+  const repoName = parts[parts.length - 1];
+  const owner = parts[parts.length - 2];
+  if (!repoName || !owner || repoName.includes("/")) {
+    return {};
+  }
+  return {
+    repo_identity: `${owner}/${repoName}`,
+    repo_owner: owner,
+    repo_name: repoName,
+  };
+}
+
+function findRepoMetadataFile(cwd: string, gitRoot: string): string | undefined {
+  let current = cwd;
+  const root = gitRoot;
+  while (true) {
+    const candidate = join(current, ".pi-langfuse.metadata.json");
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+    if (current === root) {
+      break;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return undefined;
+}
+
+function readWhitelistedOverrides(cwd: string, gitRoot: string): SourceMetadata {
+  const path = findRepoMetadataFile(cwd, gitRoot);
+  if (!path) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
+    const output: SourceMetadata = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (OVERRIDE_KEYS.has(key) && typeof value === "string" && value.trim()) {
+        output[key] = value.trim();
+      }
+    }
+    if (output.repo_name?.includes("/")) {
+      delete output.repo_name;
+    }
+    return output;
+  } catch {
+    return {};
+  }
+}
+
+export function collectSourceMetadata(cwd: string): SourceMetadata {
+  try {
+    const inside = runGit(cwd, ["rev-parse", "--is-inside-work-tree"]);
+    if (inside !== "true") {
+      return nonGitMetadata();
+    }
+
+    const gitRoot = runGit(cwd, ["rev-parse", "--show-toplevel"]);
+    const commit = runGit(cwd, ["rev-parse", "HEAD"]);
+    const branch = runGit(cwd, ["branch", "--show-current"]);
+    const remote = runGit(cwd, ["config", "--get", "remote.origin.url"]);
+    const remoteMetadata = sanitizeGitRemote(remote);
+    const derivedIdentity = deriveIdentity(remoteMetadata.git_remote_path);
+    const overrides = readWhitelistedOverrides(cwd, gitRoot);
+
+    const metadata: SourceMetadata = {
+      source_type: "git-repo",
+      repo_root_name: basename(gitRoot),
+      ...(branch ? { git_branch: branch } : {}),
+      git_commit: commit,
+      ...remoteMetadata,
+      ...derivedIdentity,
+      ...overrides,
+      metadata_source: Object.keys(overrides).length > 0 ? "repo-file" : "git-detection",
+    };
+
+    if (metadata.repo_name?.includes("/")) {
+      delete metadata.repo_name;
+    }
+    if (!metadata.repo_identity && metadata.repo_owner && metadata.repo_name) {
+      metadata.repo_identity = `${metadata.repo_owner}/${metadata.repo_name}`;
+    }
+    return metadata;
+  } catch {
+    return nonGitMetadata();
+  }
+}

package/src/types.ts

@@ -107,5 +107,6 @@ export interface AgentState {
   generationOrder: string[];
   activeTools: Map<string, ToolState>;
   latestAssistantOutput?: unknown;
+  sourceMetadata?: Record<string, unknown>;
   providerMetadataByRequest: Map<string, Record<string, unknown>>;
 }