tmux-ide 2.9.0-beta.19 → 2.9.0-beta.21

package/packages/daemon/dist/lib/log-sanitize.js

@@ -0,0 +1,199 @@
+/**
+ * PURE — credential redaction, byte budgets and reserved-metadata protection
+ * for the shared structured logger (`log.ts`).
+ *
+ * Every record the daemon emits passes through `sanitizeLogPayload` before it
+ * reaches the ring buffer, subscribers or the wire. The rules are deliberately
+ * conservative: a value that looks like a credential is replaced, oversized
+ * payloads are truncated with an explicit marker, and caller data can never
+ * overwrite the identity fields (`ts`, `level`, `component`, `msg`, `pid`,
+ * `instanceId`, `version`) that incident triage relies on.
+ */
+export const REDACTED = "[redacted]";
+/** Wire keys owned by the logger; caller payloads with these keys are renamed. */
+export const RESERVED_LOG_KEYS = Object.freeze([
+    "ts",
+    "level",
+    "component",
+    "msg",
+    "pid",
+    "instanceId",
+    "version",
+]);
+const RESERVED = new Set(RESERVED_LOG_KEYS);
+/** Prefix applied to caller keys that collide with reserved metadata. */
+export const RESERVED_COLLISION_PREFIX = "payload_";
+export const DEFAULT_LOG_BUDGET = Object.freeze({
+    maxDataBytes: 8 * 1024,
+    maxStringBytes: 2 * 1024,
+    maxMessageBytes: 4 * 1024,
+    maxDepth: 6,
+    maxContainerSize: 64,
+});
+/** Total serialized bytes the in-memory ring may retain across all entries. */
+export const DEFAULT_LOG_RING_BYTES = 512 * 1024;
+/**
+ * Keys whose values are credentials regardless of shape. Matched on the key
+ * with separators removed and case folded so `auth_token`, `AuthToken`,
+ * `X-API-Key` and `authorization` all hit.
+ */
+const SECRET_KEY = /(token|secret|password|passwd|authorization|cookie|apikey|credential|capability|privatekey|bearer|ticket|lease)/u;
+export function isSecretKey(key) {
+    return SECRET_KEY.test(key.toLowerCase().replace(/[^a-z0-9]/gu, ""));
+}
+const BEARER = /\bBearer\s+[^\s"',;]+/giu;
+const BASIC = /\bBasic\s+[A-Za-z0-9+/=]{8,}/gu;
+const URL_QUERY_SECRET = /([?&](?:[A-Za-z0-9_-]*(?:token|ticket|lease|capability|password|secret|auth|key|signature)[A-Za-z0-9_-]*)=)[^&#\s"']*/giu;
+const URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)([^/\s@"']+)@/giu;
+// Values already handled by the header/URL passes (Bearer/Basic schemes, an
+// earlier redaction marker) are skipped so a second pass cannot eat the
+// surrounding text.
+const KEY_VALUE_SECRET = /\b((?:auth[-_]?token|access[-_]?token|refresh[-_]?token|authorization|capability|password|passwd|secret|token|ticket|lease|api[-_]?key)\s*[:=]\s*["']?)(?!Bearer\b|Basic\b|\[redacted\])[^\s,;"'}]+/giu;
+/** Redact credential-shaped substrings inside free text (URLs, headers, k=v). */
+export function redactText(text, secrets = EMPTY) {
+    let out = text;
+    for (const secret of secrets)
+        if (secret && out.includes(secret))
+            out = out.split(secret).join(REDACTED);
+    return out
+        .replace(BEARER, `Bearer ${REDACTED}`)
+        .replace(BASIC, `Basic ${REDACTED}`)
+        .replace(URL_USERINFO, `$1${REDACTED}@`)
+        .replace(URL_QUERY_SECRET, `$1${REDACTED}`)
+        .replace(KEY_VALUE_SECRET, `$1${REDACTED}`);
+}
+const EMPTY = new Set();
+function byteLength(text) {
+    return Buffer.byteLength(text, "utf8");
+}
+function truncateString(text, maxBytes) {
+    if (byteLength(text) <= maxBytes)
+        return text;
+    // Trim on code points so a multi-byte character is never split.
+    let kept = "";
+    let used = 0;
+    for (const char of text) {
+        const size = byteLength(char);
+        if (used + size > maxBytes)
+            break;
+        kept += char;
+        used += size;
+    }
+    return `${kept}…[truncated ${byteLength(text) - used} bytes]`;
+}
+function describeError(error) {
+    const out = { name: error.name, message: error.message };
+    const code = error.code;
+    if (code !== undefined)
+        out.code = code;
+    if (error.stack)
+        out.stack = error.stack;
+    return out;
+}
+function redactValue(value, depth, options, seen) {
+    const { budget, secrets } = options;
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === "string")
+        return truncateString(redactText(value, secrets), budget.maxStringBytes);
+    if (typeof value === "number" || typeof value === "boolean")
+        return value;
+    if (typeof value === "bigint")
+        return value.toString();
+    if (typeof value === "symbol" || typeof value === "function")
+        return `[${typeof value}]`;
+    if (value instanceof Date)
+        return value.toISOString();
+    if (value instanceof Error)
+        return redactValue(describeError(value), depth, options, seen);
+    if (Buffer.isBuffer(value) || ArrayBuffer.isView(value))
+        return `[binary ${value.byteLength} bytes]`;
+    if (typeof value !== "object")
+        return String(value);
+    if (seen.has(value))
+        return "[circular]";
+    if (depth >= budget.maxDepth)
+        return "[depth exceeded]";
+    seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            const items = value
+                .slice(0, budget.maxContainerSize)
+                .map((item) => redactValue(item, depth + 1, options, seen));
+            if (value.length > budget.maxContainerSize)
+                items.push(`[+${value.length - budget.maxContainerSize} items]`);
+            return items;
+        }
+        if (value instanceof Map)
+            return redactValue(Object.fromEntries(value), depth, options, seen);
+        if (value instanceof Set)
+            return redactValue([...value], depth, options, seen);
+        const out = {};
+        const keys = Object.keys(value);
+        for (const key of keys.slice(0, budget.maxContainerSize)) {
+            const child = value[key];
+            out[key] =
+                isSecretKey(key) && child != null ? REDACTED : redactValue(child, depth + 1, options, seen);
+        }
+        if (keys.length > budget.maxContainerSize)
+            out["[+keys]"] = keys.length - budget.maxContainerSize;
+        return out;
+    }
+    finally {
+        seen.delete(value);
+    }
+}
+/** Redact one arbitrary value (strings, nested objects, errors) under the default budget. */
+export function redactLogValue(value, secrets = EMPTY, budget = DEFAULT_LOG_BUDGET) {
+    return redactValue(value, 0, { budget, secrets }, new WeakSet());
+}
+/**
+ * Redact, protect reserved keys and bound a caller payload. Deterministic:
+ * the same input always yields the same output, so tests can assert exact
+ * shapes.
+ */
+export function sanitizeLogPayload(data, options = {}) {
+    if (!data)
+        return { data: undefined, bytes: 0, truncated: false, renamedKeys: [] };
+    const budget = options.budget ?? DEFAULT_LOG_BUDGET;
+    const secrets = options.secrets ?? EMPTY;
+    const redacted = redactValue(data, 0, { budget, secrets }, new WeakSet());
+    const renamedKeys = [];
+    const protectedData = {};
+    for (const [key, value] of Object.entries(redacted)) {
+        if (RESERVED.has(key)) {
+            renamedKeys.push(key);
+            protectedData[`${RESERVED_COLLISION_PREFIX}${key}`] = value;
+        }
+        else {
+            protectedData[key] = value;
+        }
+    }
+    let serialized = safeStringify(protectedData);
+    let bytes = byteLength(serialized);
+    if (bytes <= budget.maxDataBytes) {
+        return { data: protectedData, bytes, truncated: false, renamedKeys };
+    }
+    // Over budget even after per-string limits: keep the key list so the record
+    // stays diagnosable, and say how much was dropped.
+    const summary = {
+        truncated: true,
+        droppedBytes: bytes,
+        keys: Object.keys(protectedData).slice(0, budget.maxContainerSize),
+    };
+    serialized = safeStringify(summary);
+    bytes = byteLength(serialized);
+    return { data: summary, bytes, truncated: true, renamedKeys };
+}
+/** Bound a log message: redact and truncate to the message budget. */
+export function sanitizeLogMessage(message, secrets = EMPTY, budget = DEFAULT_LOG_BUDGET) {
+    return truncateString(redactText(String(message), secrets), budget.maxMessageBytes);
+}
+function safeStringify(value) {
+    try {
+        return JSON.stringify(value) ?? "null";
+    }
+    catch {
+        return '"[unserializable]"';
+    }
+}

package/packages/daemon/dist/lib/log.js

@@ -1,16 +1,67 @@
-/** Minimal structured logger for tmux-ide daemon processes. */
+/**
+ * Minimal structured logger for tmux-ide daemon processes.
+ *
+ * Every record is sanitized centrally (`log-sanitize.ts`): credential-shaped
+ * keys and substrings are redacted, payloads are bounded per record and for
+ * the in-memory ring, and the identity metadata a triage relies on (`ts`,
+ * `level`, `component`, `msg`, `pid`, `instanceId`, `version`) can never be
+ * overwritten by caller data. Stream write failures (closed pipe, full disk)
+ * degrade to ring-only logging with one explicit warning; they never crash
+ * the process.
+ */
+import { DEFAULT_LOG_BUDGET, DEFAULT_LOG_RING_BYTES, sanitizeLogMessage, sanitizeLogPayload, } from "./log-sanitize.js";
 const LEVEL_RANK = { debug: 0, info: 1, warn: 2, error: 3 };
 let minLevel = process.env.LOG_LEVEL ?? "info";
 export function setLogLevel(level) {
     minLevel = level;
 }
+let identity = {};
+const secrets = new Set();
+/** Stamp reserved identity metadata onto every subsequent record. */
+export function setLogIdentity(next) {
+    identity = next ? { ...next } : {};
+}
+export function getLogIdentity() {
+    return { ...identity };
+}
+/** Register a credential literal to redact wherever it appears in a record. */
+export function registerLogSecret(secret) {
+    if (typeof secret === "string" && secret.length >= 8)
+        secrets.add(secret);
+}
+/** @internal test seam */
+export function _resetLogStateForTests() {
+    identity = {};
+    secrets.clear();
+    logBuffer.length = 0;
+    ringBytes = 0;
+    streamState.stdout = { failed: false, listening: false };
+    streamState.stderr = { failed: false, listening: false };
+    budget = DEFAULT_LOG_BUDGET;
+    ringBudgetBytes = DEFAULT_LOG_RING_BYTES;
+}
+/** @internal test seam — shrink budgets to make bounds observable. */
+export function _setLogBudgetForTests(next) {
+    const { ringBytes, ...rest } = next;
+    budget = { ...DEFAULT_LOG_BUDGET, ...rest };
+    if (ringBytes !== undefined)
+        ringBudgetBytes = ringBytes;
+}
 const LOG_BUFFER_SIZE = 1_000;
 const logBuffer = [];
+const entryBytes = new WeakMap();
+let ringBytes = 0;
+let budget = DEFAULT_LOG_BUDGET;
+let ringBudgetBytes = DEFAULT_LOG_RING_BYTES;
 const subscribers = new Set();
 /** Snapshot the current ring buffer; useful for SSE backfill. */
 export function getLogBuffer() {
     return logBuffer.slice();
 }
+/** Ring occupancy for diagnostics: entry count and retained serialized bytes. */
+export function getLogBufferStats() {
+    return { entries: logBuffer.length, bytes: ringBytes, budgetBytes: ringBudgetBytes };
+}
 /**
  * Subscribe to live log entries. Returns an unsubscribe function. The
  * handler runs synchronously inside the writer — keep it cheap; throw
@@ -23,20 +74,75 @@ export function subscribeLogs(handler) {
         subscribers.delete(handler);
     };
 }
+const streamState = {
+    stdout: { failed: false, listening: false },
+    stderr: { failed: false, listening: false },
+};
+/** Which process streams the logger has given up on (diagnostics only). */
+export function getLogStreamFailures() {
+    return Object.keys(streamState).filter((name) => streamState[name].failed);
+}
+function markStreamFailed(name, error) {
+    if (streamState[name].failed)
+        return;
+    streamState[name].failed = true;
+    const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+    const warning = `[log.ts] ${name} write failed (${detail}); further records are retained in memory only\n`;
+    const other = name === "stdout" ? "stderr" : "stdout";
+    if (!streamState[other].failed) {
+        try {
+            process[other].write(warning);
+        }
+        catch {
+            streamState[other].failed = true;
+        }
+    }
+}
+function writeToStream(name, line) {
+    const state = streamState[name];
+    if (state.failed)
+        return;
+    const stream = process[name];
+    if (!state.listening) {
+        state.listening = true;
+        // A closed pipe (EPIPE) or full disk (ENOSPC) surfaces asynchronously as
+        // an 'error' event; without a listener Node raises it as an uncaught
+        // exception and the daemon dies mid-triage.
+        stream.on("error", (error) => markStreamFailed(name, error));
+    }
+    try {
+        stream.write(line);
+    }
+    catch (error) {
+        markStreamFailed(name, error);
+    }
+}
 function writeStructuredLog(level, component, message, data) {
     if (LEVEL_RANK[level] < LEVEL_RANK[minLevel])
         return;
+    const payload = sanitizeLogPayload(data, { secrets, budget });
     const entry = {
         ts: new Date().toISOString(),
         level,
-        component,
-        msg: message,
-        ...(data ? { data } : {}),
+        component: sanitizeLogMessage(String(component), secrets, budget).slice(0, 128),
+        msg: sanitizeLogMessage(message, secrets, budget),
+        pid: process.pid,
+        ...(identity.instanceId ? { instanceId: identity.instanceId } : {}),
+        ...(identity.version ? { version: identity.version } : {}),
+        ...(payload.data ? { data: payload.data } : {}),
     };
-    // Push to ring + drop oldest when over budget.
+    const size = payload.bytes + Buffer.byteLength(entry.msg, "utf8") + 96;
+    entryBytes.set(entry, size);
+    // Push to ring + drop oldest while over either budget.
     logBuffer.push(entry);
-    if (logBuffer.length > LOG_BUFFER_SIZE)
-        logBuffer.shift();
+    ringBytes += size;
+    while (logBuffer.length > 0 &&
+        (logBuffer.length > LOG_BUFFER_SIZE || ringBytes > ringBudgetBytes)) {
+        const evicted = logBuffer.shift();
+        ringBytes -= entryBytes.get(evicted) ?? 0;
+        if (logBuffer.length === 0)
+            ringBytes = 0;
+    }
     // Fan out to subscribers; isolate failures.
     for (const sub of subscribers) {
         try {
@@ -44,21 +150,25 @@ function writeStructuredLog(level, component, message, data) {
         }
         catch (err) {
             // Avoid recursion via the logger; write directly to stderr.
-            process.stderr.write(`[log.ts] subscriber threw: ${err instanceof Error ? err.message : String(err)}\n`);
+            writeToStream("stderr", `[log.ts] subscriber threw: ${err instanceof Error ? err.message : String(err)}\n`);
         }
     }
     // Stream form for humans tailing the process. The data field is
-    // serialized inline (matches the previous wire shape).
+    // serialized inline (matches the previous wire shape); reserved metadata
+    // is written last so a caller payload can never shadow it.
     const wire = {
+        ...(entry.data ?? {}),
         ts: entry.ts,
         level: entry.level,
         component: entry.component,
         msg: entry.msg,
+        pid: entry.pid,
+        ...(entry.instanceId ? { instanceId: entry.instanceId } : {}),
+        ...(entry.version ? { version: entry.version } : {}),
     };
-    if (data)
-        Object.assign(wire, data);
-    const out = level === "error" ? process.stderr : process.stdout;
-    out.write(JSON.stringify(wire) + "\n");
+    if (payload.renamedKeys.length > 0)
+        wire.reservedKeysRenamed = payload.renamedKeys;
+    writeToStream(level === "error" ? "stderr" : "stdout", JSON.stringify(wire) + "\n");
 }
 export const logger = {
     debug: (component, msg, data) => writeStructuredLog("debug", component, msg, data),

package/packages/daemon/dist/lib/soak-diagnostics.js

@@ -0,0 +1,124 @@
+/** Pure, allowlisted evidence projection. Never retain response bodies or errors. */
+export const DIAGNOSTICS_MAX_BYTES = 16_384;
+export const RESOURCE_KEYS = [
+    "Timeout",
+    "Immediate",
+    "TCPServerWrap",
+    "TCPSocketWrap",
+    "PipeWrap",
+    "ProcessWrap",
+    "FSEventWrap",
+    "other",
+];
+export const MEMORY_KEYS = ["rss", "heapTotal", "heapUsed", "external", "arrayBuffers"];
+const object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+const number = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
+const text = (v) => typeof v === "string" && v.length > 0 && v.length <= 256;
+function numeric(v, keys, integer = false) {
+    if (!object(v) || !keys.every((k) => number(v[k]) && (!integer || Number.isSafeInteger(v[k]))))
+        return null;
+    return Object.fromEntries(keys.map((k) => [k, v[k]]));
+}
+export function parseSoakDiagnostics(body, status, expected) {
+    const fail = (status) => ({
+        status,
+        sample: null,
+    });
+    if (status === 404)
+        return fail("unsupported-endpoint");
+    if (status !== 200)
+        return fail("http-error");
+    if (body === null || body === "")
+        return fail("missing");
+    if (new TextEncoder().encode(body).length > DIAGNOSTICS_MAX_BYTES)
+        return fail("malformed");
+    let raw;
+    try {
+        raw = JSON.parse(body);
+    }
+    catch {
+        return fail("malformed");
+    }
+    if (!object(raw) || !object(raw.daemon))
+        return fail("malformed");
+    const d = raw.daemon;
+    if (!Number.isSafeInteger(d.protocolVersion) ||
+        !number(d.protocolVersion) ||
+        !text(d.productVersion) ||
+        !text(d.instanceId) ||
+        !text(d.startedAt) ||
+        !Number.isFinite(Date.parse(d.startedAt)) ||
+        (d.environmentId !== undefined && !text(d.environmentId)) ||
+        !Number.isSafeInteger(raw.pid) ||
+        !number(raw.pid) ||
+        raw.pid === 0)
+        return fail("malformed");
+    if (["protocolVersion", "productVersion", "instanceId", "startedAt", "environmentId"].some((k) => d[k] !== expected[k]) ||
+        raw.pid !== expected.pid)
+        return fail("identity-mismatch");
+    const memory = numeric(raw.memory, MEMORY_KEYS, true);
+    const cpu = numeric(raw.cpu, ["user", "system"], true);
+    const eventLoop = numeric(raw.eventLoop, ["idle", "active", "utilization"]);
+    const activeResources = raw.activeResources === null ? null : numeric(raw.activeResources, RESOURCE_KEYS, true);
+    if (!memory ||
+        !cpu ||
+        !eventLoop ||
+        eventLoop.utilization > 1 ||
+        !number(raw.uptimeMs) ||
+        !number(raw.sampledAtMs) ||
+        (raw.activeResources !== null && !activeResources))
+        return fail("malformed");
+    return {
+        status: "ok",
+        sample: {
+            daemon: {
+                protocolVersion: d.protocolVersion,
+                productVersion: d.productVersion,
+                instanceId: d.instanceId,
+                startedAt: d.startedAt,
+                ...(d.environmentId !== undefined ? { environmentId: d.environmentId } : {}),
+            },
+            pid: raw.pid,
+            uptimeMs: raw.uptimeMs,
+            sampledAtMs: raw.sampledAtMs,
+            memory,
+            cpu,
+            eventLoop,
+            activeResources,
+        },
+    };
+}
+/** Uptime is monotonic; wall-clock jumps do not change interval rates. */
+export function diagnosticsDelta(previous, current) {
+    if (!previous)
+        return { status: "missing-baseline" };
+    if (previous.pid !== current.pid ||
+        ["protocolVersion", "productVersion", "instanceId", "startedAt", "environmentId"].some((key) => previous.daemon[key] !==
+            current.daemon[key]))
+        return { status: "identity-mismatch" };
+    const intervalMs = current.uptimeMs - previous.uptimeMs;
+    if (!Number.isFinite(intervalMs) || intervalMs <= 0)
+        return { status: "invalid-interval" };
+    const cpuUserMicros = current.cpu.user - previous.cpu.user;
+    const cpuSystemMicros = current.cpu.system - previous.cpu.system;
+    const eventLoopIdleMs = current.eventLoop.idle - previous.eventLoop.idle;
+    const eventLoopActiveMs = current.eventLoop.active - previous.eventLoop.active;
+    if (![cpuUserMicros, cpuSystemMicros, eventLoopIdleMs, eventLoopActiveMs].every(number))
+        return { status: "counter-regression" };
+    const cpuPercent = (cpuUserMicros + cpuSystemMicros) / (intervalMs * 10);
+    if (!Number.isFinite(cpuPercent))
+        return { status: "invalid-interval" };
+    const eventTotal = eventLoopIdleMs + eventLoopActiveMs;
+    if (!Number.isFinite(eventTotal))
+        return { status: "invalid-interval" };
+    return {
+        status: "ok",
+        intervalMs,
+        cpuUserMicros,
+        cpuSystemMicros,
+        cpuPercent,
+        eventLoopIdleMs,
+        eventLoopActiveMs,
+        eventLoopUtilization: eventTotal === 0 ? null : eventLoopActiveMs / eventTotal,
+    };
+}