salmon-loop 0.2.3

package/dist/core/observability/audit-trail.js

@@ -0,0 +1,125 @@
+const auditTrail = [];
+const auditContext = {};
+const DEFAULT_BUFFER_LIMITS = {
+    maxEvents: 10000,
+    maxBytes: 20 * 1024 * 1024,
+};
+let bufferLimits = { ...DEFAULT_BUFFER_LIMITS };
+let bufferBytes = 0;
+let droppedCount = 0;
+let droppedSince;
+export function setAuditBufferLimits(limits) {
+    bufferLimits = {
+        maxEvents: limits?.maxEvents ?? DEFAULT_BUFFER_LIMITS.maxEvents,
+        maxBytes: limits?.maxBytes ?? DEFAULT_BUFFER_LIMITS.maxBytes,
+    };
+    bufferBytes = auditTrail.reduce((sum, event) => sum + estimateEventSize(event), 0);
+}
+function estimateEventSize(event) {
+    try {
+        return Buffer.byteLength(JSON.stringify(event), 'utf-8');
+    }
+    catch {
+        return 0;
+    }
+}
+function severityRank(severity) {
+    if (severity === 'high')
+        return 3;
+    if (severity === 'medium')
+        return 2;
+    return 1;
+}
+function dropForCapacity(newEvent, newSize) {
+    const maxEvents = bufferLimits.maxEvents;
+    const maxBytes = bufferLimits.maxBytes;
+    const newRank = severityRank(newEvent.severity);
+    while (auditTrail.length >= maxEvents || bufferBytes + newSize > maxBytes) {
+        if (auditTrail.length === 0)
+            return false;
+        let lowestIndex = 0;
+        let lowestRank = severityRank(auditTrail[0]?.severity);
+        for (let i = 1; i < auditTrail.length; i += 1) {
+            const rank = severityRank(auditTrail[i]?.severity);
+            if (rank < lowestRank) {
+                lowestRank = rank;
+                lowestIndex = i;
+            }
+        }
+        if (lowestRank > newRank) {
+            return false;
+        }
+        const [removed] = auditTrail.splice(lowestIndex, 1);
+        bufferBytes -= estimateEventSize(removed);
+        droppedCount += 1;
+        if (!droppedSince) {
+            droppedSince = new Date().toISOString();
+        }
+    }
+    return true;
+}
+export function drainAuditDropStats() {
+    const snapshot = { count: droppedCount, since: droppedSince };
+    droppedCount = 0;
+    droppedSince = undefined;
+    return snapshot;
+}
+export function setAuditContext(meta) {
+    Object.assign(auditContext, meta);
+}
+export function getAuditContext() {
+    return { ...auditContext };
+}
+export function clearAuditContext() {
+    for (const key of Object.keys(auditContext)) {
+        delete auditContext[key];
+    }
+}
+export function recordAuditEvent(action, details, meta) {
+    const effective = {
+        ...auditContext,
+        ...meta,
+    };
+    if (droppedCount > 0) {
+        const dropEvent = {
+            action: 'audit.dropped',
+            details: { count: droppedCount, since: droppedSince },
+            source: 'audit',
+            severity: 'medium',
+            scope: effective.scope,
+            phase: effective.phase,
+            correlationId: effective.correlationId,
+            timestamp: new Date().toISOString(),
+        };
+        const dropSize = estimateEventSize(dropEvent);
+        if (dropForCapacity(dropEvent, dropSize)) {
+            auditTrail.push(dropEvent);
+            bufferBytes += dropSize;
+            droppedCount = 0;
+            droppedSince = undefined;
+        }
+    }
+    const event = {
+        action,
+        details,
+        source: effective.source,
+        severity: effective.severity,
+        scope: effective.scope,
+        phase: effective.phase,
+        correlationId: effective.correlationId,
+        timestamp: new Date().toISOString(),
+    };
+    const size = estimateEventSize(event);
+    if (!dropForCapacity(event, size))
+        return;
+    auditTrail.push(event);
+    bufferBytes += size;
+}
+export function getAuditTrail() {
+    return [...auditTrail];
+}
+export function clearAuditTrail() {
+    auditTrail.length = 0;
+    bufferBytes = 0;
+}
+//# sourceMappingURL=audit-trail.js.map

package/dist/core/observability/authorization-decisions.js

@@ -0,0 +1,54 @@
+import { getAuditTrail } from './audit-trail.js';
+function safeString(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+function safeNumber(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        return undefined;
+    return value;
+}
+function safeStringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const out = value.map(safeString).filter((v) => typeof v === 'string');
+    return out.length > 0 ? out : undefined;
+}
+export function extractAuthorizationDecisionsFromAuditTrail(auditTrail) {
+    const decisions = [];
+    for (const event of auditTrail) {
+        if (!event || typeof event !== 'object')
+            continue;
+        if (event.action !== 'authorization.decision')
+            continue;
+        const details = event.details;
+        if (!details || typeof details !== 'object')
+            continue;
+        const callId = safeString(details.callId);
+        const toolName = safeString(details.toolName);
+        const phase = safeString(details.phase) ?? safeString(event.phase);
+        const outcome = safeString(details.outcome);
+        if (!callId || !toolName || !phase || !outcome)
+            continue;
+        decisions.push({
+            callId,
+            toolName,
+            phase: phase,
+            outcome: outcome,
+            source: (safeString(details.source) ?? 'unknown'),
+            reason: safeString(details.reason),
+            ttlMs: safeNumber(details.ttlMs),
+            persist: safeString(details.persist),
+            riskLevel: safeString(details.riskLevel),
+            sideEffects: safeStringArray(details.sideEffects),
+            timestamp: safeString(event.timestamp) ?? new Date().toISOString(),
+        });
+    }
+    return decisions;
+}
+export function getAuthorizationDecisionsFromAuditTrail() {
+    return extractAuthorizationDecisionsFromAuditTrail(getAuditTrail());
+}
+//# sourceMappingURL=authorization-decisions.js.map

package/dist/core/observability/debug-artifacts.js

@@ -0,0 +1,61 @@
+import { createHash, randomBytes } from 'crypto';
+import path from 'path';
+import { mkdir, writeFile } from '../adapters/fs/node-fs.js';
+import { getAuditDir } from '../runtime/paths.js';
+const MAX_DEBUG_CHARS = 16_384;
+// eslint-disable-next-line no-control-regex
+const ANSI_REGEX = new RegExp('\\u001b\\[[0-9;]*m', 'g');
+function stripControlChars(input) {
+    let out = '';
+    for (let i = 0; i < input.length; i += 1) {
+        const code = input.charCodeAt(i);
+        out += code < 32 || code === 127 ? ' ' : input[i];
+    }
+    return out;
+}
+function truncate(input, maxChars) {
+    if (input.length <= maxChars)
+        return { text: input, truncated: false };
+    return { text: input.slice(0, Math.max(0, maxChars - 3)) + '...', truncated: true };
+}
+function redactSecrets(input) {
+    let out = input;
+    out = out.replace(/\bsk-[A-Za-z0-9]{16,}\b/g, '[REDACTED]');
+    out = out.replace(/\bAKIA[0-9A-Z]{16}\b/g, '[REDACTED]');
+    out = out.replace(/\bASIA[0-9A-Z]{16}\b/g, '[REDACTED]');
+    out = out.replace(/\bBearer\s+[A-Za-z0-9._-]{16,}\b/g, 'Bearer [REDACTED]');
+    out = out.replace(/\bghp_[A-Za-z0-9]{20,}\b/g, '[REDACTED]');
+    out = out.replace(/\bgho_[A-Za-z0-9]{20,}\b/g, '[REDACTED]');
+    out = out.replace(/\bghu_[A-Za-z0-9]{20,}\b/g, '[REDACTED]');
+    out = out.replace(/\bghs_[A-Za-z0-9]{20,}\b/g, '[REDACTED]');
+    out = out.replace(/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, '[REDACTED]');
+    return out;
+}
+function formatTimestampForFilename(value) {
+    return value.toISOString().replace(/[:.]/g, '-');
+}
+export async function writeDebugArtifact(params) {
+    const { repoRoot, prefix, content, auditScope } = params;
+    const auditDir = getAuditDir(repoRoot, auditScope);
+    const blobsDir = path.join(auditDir, 'blobs');
+    await mkdir(blobsDir, { recursive: true });
+    const timestamp = formatTimestampForFilename(new Date());
+    const nonce = randomBytes(4).toString('hex');
+    const fileName = `${prefix}-${timestamp}-${nonce}.log`;
+    const absolutePath = path.join(blobsDir, fileName);
+    const relativePath = path.join('blobs', fileName);
+    let payload = String(content ?? '');
+    payload = payload.replace(ANSI_REGEX, '');
+    payload = stripControlChars(payload);
+    payload = redactSecrets(payload);
+    const truncated = truncate(payload, MAX_DEBUG_CHARS);
+    payload = truncated.text;
+    const sha256 = createHash('sha256').update(payload).digest('hex');
+    await writeFile(absolutePath, payload, 'utf8');
+    return {
+        path: relativePath,
+        sha256,
+        chars: payload.length,
+    };
+}
+//# sourceMappingURL=debug-artifacts.js.map

package/dist/core/observability/error-envelope.js

@@ -0,0 +1,63 @@
+import { mapErrorForDisplay } from './error-mapping.js';
+export const REDACTED_ERROR_TOKEN = 'ERR_TECHNICAL_DETAILS_HIDDEN';
+export function isRedactedErrorToken(value) {
+    return value === REDACTED_ERROR_TOKEN;
+}
+export function extractErrorCode(error) {
+    if (typeof error === 'object' && error !== null) {
+        return (error.llmCode ??
+            error.code ??
+            error.name);
+    }
+    return undefined;
+}
+export function toSafeErrorSummary(error) {
+    const code = extractErrorCode(error);
+    const name = error instanceof Error ? error.name : typeof error;
+    return {
+        name,
+        code,
+    };
+}
+export function buildErrorEnvelope(params) {
+    return {
+        domain: params.domain,
+        code: params.code,
+        phase: params.phase,
+        safeMessage: params.safeMessage,
+        safeHint: params.safeHint,
+        remediationSteps: params.remediationSteps,
+        redacted: params.redacted,
+        redactionSource: params.redactionSource,
+        safeMeta: params.safeMeta,
+        debugArtifact: params.debugArtifact,
+    };
+}
+function inferErrorDomain(code) {
+    if (!code)
+        return 'unknown';
+    if (code.startsWith('LLM_'))
+        return 'llm';
+    if (code.startsWith('GIT_'))
+        return 'git';
+    if (code.startsWith('PATCH_') || code.startsWith('DIFF_'))
+        return 'runtime';
+    if (code.startsWith('VERIFY_'))
+        return 'verification';
+    return 'unknown';
+}
+export function buildFailureEnvelope(params) {
+    const code = params.code ?? 'UNKNOWN_ERROR';
+    const messageSource = params.safeHint ?? params.fallbackMessage;
+    const mapped = mapErrorForDisplay({ message: messageSource, code });
+    return buildErrorEnvelope({
+        domain: inferErrorDomain(code),
+        code,
+        phase: params.phase,
+        safeMessage: mapped.message,
+        safeHint: params.safeHint ?? params.fallbackMessage,
+        remediationSteps: params.remediationSteps,
+        redacted: mapped.redacted,
+    });
+}
+//# sourceMappingURL=error-envelope.js.map

package/dist/core/observability/error-mapping.js

@@ -0,0 +1,271 @@
+import { text } from '../../locales/index.js';
+import { getAuditTrail } from './audit-trail.js';
+import { REDACTED_ERROR_TOKEN } from './error-envelope.js';
+function mapLlmCodeToMessage(code) {
+    if (!code.startsWith('LLM_'))
+        return undefined;
+    const camelCode = code
+        .toLowerCase()
+        .replace(/_([a-z])/g, (_, g) => g.toUpperCase())
+        .replace(/^llm/, '');
+    const finalCamel = camelCode.charAt(0).toLowerCase() + camelCode.slice(1);
+    const llmErrors = text.llmErrors;
+    const llmText = text.llm;
+    const candidate = llmErrors[finalCamel] ?? llmText[finalCamel];
+    if (typeof candidate === 'string')
+        return candidate;
+    if (typeof candidate === 'function')
+        return candidate();
+    return undefined;
+}
+function mapUsageErrorMessage(message, code) {
+    if (code !== 'USAGE_ERROR')
+        return undefined;
+    switch (message) {
+        case 'PRINT_INSTRUCTION_CONFLICT':
+            return text.errors.usagePrintInstructionConflict;
+        case 'CONTINUE_RESUME_CONFLICT':
+            return text.errors.usageContinueResumeConflict;
+        case 'OUTPUT_PROFILE_REQUIRES_STREAM_JSON':
+            return text.errors.usageOutputProfileRequiresStreamJson;
+        case 'INVALID_OUTPUT_PROFILE':
+            return text.errors.usageInvalidOutputProfile;
+        case 'JSON_SCHEMA_REQUIRES_JSON':
+            return text.errors.usageJsonSchemaRequiresJson;
+        default:
+            return undefined;
+    }
+}
+function mapMessageToken(message) {
+    switch (message) {
+        case 'UNKNOWN_SLASH':
+            return text.errors.unknownSlash;
+        case 'NO_HANDLER':
+            return text.errors.noSlashHandler;
+        case 'INTERNAL_ERROR':
+            return text.errors.internalError;
+        case 'ALLOWLIST_PARSE_FAILED':
+            return text.errors.allowlistParseFailed;
+        case 'ALLOWLIST_WRITE_FAILED':
+            return text.errors.allowlistWriteFailed;
+        case 'ALLOWLIST_CACHE_WRITE_FAILED':
+            return text.errors.allowlistCacheWriteFailed;
+        case 'ALLOWLIST_LOCK_TIMEOUT':
+            return text.errors.allowlistLockTimeout;
+        case 'ALLOWLIST_LOCK_VERIFICATION_FAILED':
+            return text.errors.allowlistLockVerificationFailed;
+        case 'ALLOWLIST_ATOMIC_WRITE_BACKUP_FAILED':
+            return text.errors.allowlistAtomicWriteBackupFailed;
+        case 'ALLOWLIST_ATOMIC_RESTORE_FAILED':
+            return text.errors.allowlistAtomicRestoreFailed;
+        case 'ALLOWLIST_PATH_BLOCKED':
+            return text.errors.allowlistPathBlocked;
+        default:
+            return undefined;
+    }
+}
+const CODE_MESSAGE_MAP = {
+    noFilesRead: () => text.errors.noFilesRead,
+    explorationHallucination: () => text.errors.explorationHallucination,
+    PREFLIGHT_NOT_GIT: () => text.errors.preflightNotGit,
+    PREFLIGHT_DIRTY: () => text.errors.preflightDirty,
+    APPLY_BACK_FAILED: () => text.errors.applyBackFailed,
+    PATCH_NOT_APPLICABLE: () => text.errors.patchNotApplicable,
+    DIFF_VALIDATION_FAILED: () => text.errors.diffValidationFailed,
+    GIT_ERROR: () => text.errors.gitError,
+    SCHEMA_INVALID: () => text.errors.schemaInvalid,
+    SCHEMA_VALIDATION_FAILED: () => text.errors.schemaValidationFailed,
+    SCHEMA_VIOLATION: () => text.errors.schemaViolation,
+    USAGE_ERROR: () => text.errors.usageError,
+    INTERRUPT_REQUIRED: () => text.errors.interruptRequired,
+    PERMISSION_RULE_DENY: () => text.errors.permissionRuleDeny,
+    PERMISSION_REQUIRED_CONTEXT_CACHE_OUTSIDE_ROOT: () => text.errors.permissionRequiredContextCacheOutsideRoot,
+    PERMISSION_DENIED_CONTEXT_CACHE_OUTSIDE_ROOT: () => text.errors.permissionDeniedContextCacheOutsideRoot,
+    compilation: () => text.errors.compilationFailed,
+    lint: () => text.errors.lintFailed,
+    test: () => text.errors.testFailed,
+    logic: () => text.errors.logicFailed,
+    dependency_error: () => text.errors.dependencyError,
+    DEPENDENCY_ERROR: () => text.errors.dependencyError,
+    resource_lock_error: () => text.errors.resourceLockError,
+    ast_validation_error: () => text.errors.astValidationError,
+    unknown: () => text.errors.unknownError,
+    TIMEOUT: () => text.errors.timeout,
+    RUNTIME_ERROR: () => text.errors.runtimeError,
+    TOOL_PARSE_ERROR: () => text.errors.toolParseError,
+    OUTPUT_PARSE_FAILED: () => text.errors.outputParseFailed,
+    AUTH_REQUIRED: () => text.errors.authRequired,
+    ASK_USER_CANCELLED: () => text.errors.askUserCancelled,
+    ASK_USER_SUBAGENT_BLOCKED: () => text.errors.askUserSubagentBlocked,
+    SERIALIZE_ERROR: () => text.errors.serializeError,
+    PARSE_ERROR: () => text.errors.parseError,
+    EXECUTION_ERROR: () => text.errors.executionError,
+    INVALID_OUTPUT: () => text.errors.invalidOutput,
+    OUTPUT_TRUNCATED: () => text.errors.outputTruncated,
+    PIPELINE_RECOVERY_FAILED: () => text.errors.pipelineRecoveryFailed,
+    UNKNOWN_SLASH: () => text.errors.unknownSlash,
+    NO_HANDLER: () => text.errors.noSlashHandler,
+    INTERNAL_ERROR: () => text.errors.internalError,
+    UNAVAILABLE: () => text.errors.toolUnavailable,
+    NONZERO_EXIT: () => text.errors.nonzeroExit,
+    TOOL_NOT_FOUND: () => text.errors.toolNotFound,
+    MALFORMED_TOOL_CALL: () => text.errors.malformedToolCall,
+    INVALID_TOOL_ARGUMENTS_JSON: () => text.errors.invalidToolArguments,
+    BUDGET_CONCURRENCY: () => text.errors.toolBudgetConcurrency,
+    TOOL_CALL_BUDGET_EXCEEDED: () => text.errors.toolCallBudgetExceeded,
+    PPD_TOOL_RESULT_MISSING: () => text.errors.ppdToolResultMissing,
+    TECHNICAL_ERROR: () => text.errors.technicalError,
+};
+function mapKnownErrorCode(code) {
+    if (code.startsWith('LLM_'))
+        return mapLlmCodeToMessage(code);
+    if (code.startsWith('CONFIG_'))
+        return text.config.error(code);
+    const lookup = CODE_MESSAGE_MAP[code];
+    return lookup ? lookup() : undefined;
+}
+export function mapErrorForDisplay(input) {
+    const rawMessage = input.message ?? '';
+    const mappedByMessage = mapUsageErrorMessage(rawMessage, input.code) ?? mapMessageToken(rawMessage);
+    const mappedByCode = input.code ? mapKnownErrorCode(input.code) : undefined;
+    const mapped = mappedByMessage ?? mappedByCode;
+    const isRedacted = rawMessage === REDACTED_ERROR_TOKEN;
+    if (isRedacted) {
+        const trailError = mapAuditTrailToError(getAuditTrail());
+        if (trailError?.summary) {
+            return {
+                message: trailError.summary,
+                code: input.code,
+                redacted: true,
+            };
+        }
+        if (mapped) {
+            return {
+                message: mapped,
+                code: input.code,
+                redacted: true,
+            };
+        }
+        return {
+            message: text.errors.technicalDetailsHidden,
+            code: input.code,
+            redacted: true,
+        };
+    }
+    if (mapped) {
+        return {
+            message: mapped,
+            code: input.code,
+            redacted: false,
+        };
+    }
+    return {
+        message: rawMessage,
+        code: input.code,
+        redacted: false,
+    };
+}
+function mapErrorCategory(code) {
+    if (!code)
+        return 'unknown';
+    if (code.startsWith('CONFIG_'))
+        return 'config';
+    if (code.startsWith('PREFLIGHT_'))
+        return 'preflight';
+    if (code === 'VERIFY_FAILED')
+        return 'verify';
+    if (code.startsWith('AUTH_'))
+        return 'auth';
+    if (code.startsWith('LLM_'))
+        return 'llm';
+    return 'unknown';
+}
+export function mapErrorForAudit(input) {
+    const rawMessage = input.message ?? '';
+    const isRedacted = rawMessage === REDACTED_ERROR_TOKEN;
+    const display = mapErrorForDisplay(input);
+    const summary = isRedacted ? text.errors.technicalDetailsHidden : display.message;
+    return {
+        summary,
+        category: mapErrorCategory(input.code),
+        code: input.code,
+        redacted: isRedacted || display.redacted,
+    };
+}
+function buildLangfuseHttpFailed(details) {
+    const status = typeof details?.status === 'number' ? details.status : undefined;
+    if (!status)
+        return undefined;
+    if (status === 401 || status === 403) {
+        return {
+            summary: `Langfuse ingestion unauthorized (HTTP ${status})`,
+            category: 'auth',
+            redacted: false,
+        };
+    }
+    if (status >= 500) {
+        return {
+            summary: `Langfuse ingestion failed (HTTP ${status})`,
+            category: 'network',
+            redacted: false,
+        };
+    }
+    if (status >= 400) {
+        return {
+            summary: `Langfuse ingestion failed (HTTP ${status})`,
+            category: 'config',
+            redacted: false,
+        };
+    }
+    return {
+        summary: `Langfuse ingestion failed (HTTP ${status})`,
+        category: 'unknown',
+        redacted: false,
+    };
+}
+export function mapAuditTrailToError(events) {
+    for (let i = events.length - 1; i >= 0; i -= 1) {
+        const event = events[i];
+        if (!event)
+            continue;
+        if (event.action === 'langfuse.outcome.http_failed') {
+            return buildLangfuseHttpFailed(event.details);
+        }
+        if (event.action === 'langfuse.outcome.request_failed') {
+            return {
+                summary: 'Langfuse ingestion request failed',
+                category: 'network',
+                redacted: false,
+            };
+        }
+    }
+    return undefined;
+}
+export function mapAuditTrailToSecondaryFailures(events) {
+    const failures = [];
+    for (let i = 0; i < events.length; i += 1) {
+        const event = events[i];
+        if (!event)
+            continue;
+        if (event.action === 'langfuse.outcome.http_failed') {
+            const mapped = buildLangfuseHttpFailed(event.details);
+            if (mapped) {
+                failures.push({
+                    ...mapped,
+                    source: event.action,
+                });
+            }
+            continue;
+        }
+        if (event.action === 'langfuse.outcome.request_failed') {
+            failures.push({
+                source: event.action,
+                summary: 'Langfuse ingestion request failed',
+                category: 'network',
+                redacted: false,
+            });
+        }
+    }
+    return failures;
+}
+//# sourceMappingURL=error-mapping.js.map

package/dist/core/observability/ignored-error.js

@@ -0,0 +1,6 @@
+import { getLogger } from './logger.js';
+export function logIgnoredError(context, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    getLogger().trace(`[IgnoredError] ${context}: ${message}`);
+}
+//# sourceMappingURL=ignored-error.js.map