watchmyagents 0.2.0 → 0.5.0

package/src/anonymizer.js

@@ -1,48 +1,206 @@
-import { createHash } from 'node:crypto';
-
-const PII_PATTERNS = [
-  [/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, '[EMAIL]'],
-  [/Bearer\s+[A-Za-z0-9\-_\.=]+/gi, '[TOKEN]'],
-  [/eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+/g, '[TOKEN]'],
-  [/\b(sk|pk|rk)-[A-Za-z0-9_\-]{16,}\b/g, '[API_KEY]'],
-  [/\bwma_[A-Za-z0-9_\-]{8,}\b/g, '[API_KEY]'],
-  [/\b(?:\d[ -]*?){13,19}\b/g, '[CARD]'],
-  [/\b\+?\d{1,3}[\s.-]?\(?\d{2,4}\)?[\s.-]?\d{3,4}[\s.-]?\d{3,4}\b/g, '[PHONE]'],
-  [/https?:\/\/[^\s"'<>]+/gi, '[URL]'],
-  [/\b(?:\d{1,3}\.){3}\d{1,3}\b/g, '[IP]'],
-  [/\b(?:[a-f0-9]{1,4}:){7}[a-f0-9]{1,4}\b/gi, '[IP]'],
-];
-
-const HASH_FIELDS = new Set(['user_id', 'session_id', 'agent_id']);
-
-export function scrubString(str) {
-  if (typeof str !== 'string') return str;
-  let out = str;
-  for (const [re, tag] of PII_PATTERNS) out = out.replace(re, tag);
-  return out;
+// ─────────────────────────────────────────────────────────────────────────
+// Anonymizer — strip raw payloads, produce signals safe for Fortress
+// ─────────────────────────────────────────────────────────────────────────
+// Reads a Watch NDJSON file (the full local log) and produces an
+// anonymized signals payload — the shape Fortress's `signals` table
+// expects. The output contains ONLY:
+//
+//   - counts (action_type, tool_name)
+//   - latencies (p50, p95, max) per tool
+//   - error rates per tool
+//   - salted SHA-256 hashes of IoCs (URLs, commands, queries)
+//   - top action_type sequences (Markov pairs)
+//   - stop_reason type counts (NOT the message text)
+//   - tokens_total
+//
+// What it NEVER outputs:
+//   - input.content (prompts)
+//   - output.content (agent text)
+//   - raw URLs / commands / queries
+//   - error messages
+//   - readable session_id (hashed)
+//   - readable agent_id (hashed)
+//   - PII of any kind
+//
+// This is the single bottleneck between Watch (local) and Fortress (cloud).
+// Every byte that crosses to the cloud passes through this module.
+
+import { createHash, randomBytes } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { createInterface } from 'node:readline';
+
+// ── Configuration ────────────────────────────────────────────────────────
+
+// Fields that may contain raw data — we extract a hash, never the raw value.
+const HASHABLE_INPUT_FIELDS = ['url', 'query', 'command', 'path', 'file_path'];
+
+// Tool types whose inputs we want to hash for IoC tracking
+const TOOL_ACTIONS = new Set(['tool_use', 'mcp_tool_use', 'custom_tool_use']);
+
+// ── Hash helpers ─────────────────────────────────────────────────────────
+
+/**
+ * Salted SHA-256 hash. The salt is per-customer (passed in) so the same URL
+ * at customer A produces a different hash than at customer B by default —
+ * but if a global salt is used, identical IoCs across customers produce
+ * identical hashes (the antivirus model for L4 cross-customer intel).
+ */
+export function hashWithSalt(value, salt) {
+  if (value == null) return null;
+  const s = typeof value === 'string' ? value : JSON.stringify(value);
+  return 'sha256:' + createHash('sha256').update(salt).update(s).digest('hex').slice(0, 32);
 }
 
-export function hashId(value) {
-  if (value == null) return value;
-  return 'h_' + createHash('sha256').update(String(value)).digest('hex').slice(0, 24);
+// Generate a customer salt (if none provided)
+export function generateSalt() {
+  return randomBytes(16).toString('hex');
 }
 
-export function anonymize(obj) {
-  if (obj == null) return obj;
-  if (typeof obj === 'string') return scrubString(obj);
-  if (typeof obj !== 'object') return obj;
-  if (Array.isArray(obj)) return obj.map(anonymize);
-  const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (HASH_FIELDS.has(k) && (typeof v === 'string' || typeof v === 'number')) {
-      out[k] = hashId(v);
-    } else if (typeof v === 'string') {
-      out[k] = scrubString(v);
-    } else if (typeof v === 'object') {
-      out[k] = anonymize(v);
-    } else {
-      out[k] = v;
+// ── Single-entry extractor: what hashable IoCs are in this entry? ────────
+
+function extractIocs(entry, salt) {
+  const out = [];
+  if (!entry.input || typeof entry.input !== 'object') return out;
+  for (const field of HASHABLE_INPUT_FIELDS) {
+    const v = entry.input[field];
+    if (typeof v === 'string' && v.length > 0) {
+      out.push(hashWithSalt(v, salt));
     }
   }
   return out;
 }
+
+// ── Aggregator: walks the NDJSON stream and builds the signals payload ──
+
+export class SignalsAggregator {
+  constructor({ salt } = {}) {
+    if (!salt) throw new Error('SignalsAggregator requires a salt');
+    this.salt = salt;
+    this.counts = Object.create(null);          // action_type → count
+    this.toolCounts = Object.create(null);      // tool_name → count
+    this.toolErrors = Object.create(null);      // tool_name → error count
+    this.toolLatencies = Object.create(null);   // tool_name → number[]
+    this.iocHashes = new Set();                 // unique IoC hashes
+    this.sequences = Object.create(null);       // "A → B" → count
+    this.stopReasons = Object.create(null);     // stop_reason.type → count
+    this.tokensTotal = 0;
+    this.windowStart = null;
+    this.windowEnd = null;
+    this.entryCount = 0;
+    this._prevActionType = null;
+    this._prevSessionId = null;
+  }
+
+  add(entry) {
+    if (!entry) return;
+    this.entryCount++;
+
+    // Track window bounds
+    const ts = entry.timestamp || '';
+    if (ts) {
+      if (!this.windowStart || ts < this.windowStart) this.windowStart = ts;
+      if (!this.windowEnd || ts > this.windowEnd) this.windowEnd = ts;
+    }
+
+    // Counts
+    const at = entry.action_type || 'unknown';
+    this.counts[at] = (this.counts[at] || 0) + 1;
+
+    // Sequence tracking (only within the same session)
+    if (this._prevActionType && entry.session_id === this._prevSessionId
+        && at !== 'session_end' && this._prevActionType !== 'session_end') {
+      const seqKey = `${this._prevActionType} → ${at}`;
+      this.sequences[seqKey] = (this.sequences[seqKey] || 0) + 1;
+    }
+    this._prevActionType = at;
+    this._prevSessionId = entry.session_id || null;
+
+    // Tools
+    if (entry.tool_name && TOOL_ACTIONS.has(at)) {
+      this.toolCounts[entry.tool_name] = (this.toolCounts[entry.tool_name] || 0) + 1;
+      if (entry.status === 'error') {
+        this.toolErrors[entry.tool_name] = (this.toolErrors[entry.tool_name] || 0) + 1;
+      }
+      if (typeof entry.duration_ms === 'number') {
+        if (!this.toolLatencies[entry.tool_name]) this.toolLatencies[entry.tool_name] = [];
+        this.toolLatencies[entry.tool_name].push(entry.duration_ms);
+      }
+      // Extract & hash IoCs from this tool's input
+      for (const h of extractIocs(entry, this.salt)) this.iocHashes.add(h);
+    }
+
+    // Tokens
+    if (typeof entry.tokens_used === 'number') this.tokensTotal += entry.tokens_used;
+
+    // Stop reasons (state_transition entries carry these)
+    const stopType = entry.output?.stop_reason?.type;
+    if (typeof stopType === 'string') {
+      this.stopReasons[stopType] = (this.stopReasons[stopType] || 0) + 1;
+    }
+  }
+
+  // Compute p50/p95/max for an array of durations
+  _percentiles(arr) {
+    if (arr.length === 0) return null;
+    const sorted = [...arr].sort((a, b) => a - b);
+    const at = (p) => sorted[Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length))];
+    return { p50: at(50), p95: at(95), max: sorted[sorted.length - 1], n: sorted.length };
+  }
+
+  finalize() {
+    // Latencies aggregated
+    const latencies_p50_ms = {};
+    const latencies_p95_ms = {};
+    const error_rate_by_tool = {};
+    for (const [tool, durations] of Object.entries(this.toolLatencies)) {
+      const p = this._percentiles(durations);
+      if (p) {
+        latencies_p50_ms[tool] = p.p50;
+        latencies_p95_ms[tool] = p.p95;
+      }
+    }
+    for (const tool of Object.keys(this.toolCounts)) {
+      const errs = this.toolErrors[tool] || 0;
+      error_rate_by_tool[tool] = +(errs / this.toolCounts[tool]).toFixed(4);
+    }
+    // Top-10 sequences
+    const sequencesTop = Object.entries(this.sequences)
+      .sort((a, b) => b[1] - a[1])
+      .slice(0, 10)
+      .map(([pattern, count]) => ({ pattern, count }));
+
+    return {
+      window_start: this.windowStart,
+      window_end: this.windowEnd,
+      payload: {
+        counts: this.counts,
+        tool_counts: this.toolCounts,
+        latencies_p50_ms,
+        latencies_p95_ms,
+        error_rate_by_tool,
+        ioc_hashes: [...this.iocHashes],
+        sequences_top10: sequencesTop,
+        stop_reasons: this.stopReasons,
+        tokens_total: this.tokensTotal,
+      },
+      _meta: {
+        entries_processed: this.entryCount,
+      },
+    };
+  }
+}
+
+// ── Streaming convenience: anonymize a whole NDJSON file/dir ────────────
+
+export async function anonymizeFile(filePath, { salt } = {}) {
+  if (!salt) throw new Error('anonymizeFile requires a salt');
+  const agg = new SignalsAggregator({ salt });
+  const stream = createReadStream(filePath, { encoding: 'utf8' });
+  const rl = createInterface({ input: stream, crlfDelay: Infinity });
+  for await (const line of rl) {
+    if (!line.trim()) continue;
+    let e; try { e = JSON.parse(line); } catch { continue; }
+    agg.add(e);
+  }
+  return agg.finalize();
+}

package/src/logger.js

@@ -12,11 +12,17 @@ const EXPORT_FIELDS = [
 ];
 
 export class Logger {
-  constructor({ logDir, agentId, sessionId, silent }) {
+  // `silent`     : don't print log errors to stderr (default: true — quiet operation)
+  // `bestEffort` : SWALLOW write failures (default: false — fail loud).
+  //                Audit-grade default: refuse to silently lose events. Disk
+  //                full / EACCES / EINVAL must propagate so callers know.
+  //                Opt into bestEffort=true only for non-critical paths.
+  constructor({ logDir, agentId, sessionId, silent, bestEffort } = {}) {
     this.logDir = logDir;
     this.agentId = agentId;
     this.sessionId = sessionId || randomUUID();
     this.silent = silent !== false;
+    this.bestEffort = bestEffort === true;
     this.sequence = 0;
     this.currentDay = null;
     this.currentPath = null;
@@ -63,7 +69,10 @@ export class Logger {
       await appendFile(path, JSON.stringify(full) + '\n', { encoding: 'utf8', mode: 0o600 });
       this.count++;
     } catch (err) {
-      if (!this.silent) process.stderr.write(`[wma] log error: ${err.message}\n`);
+      if (!this.silent) process.stderr.write(`[wma] log write error: ${err.message}\n`);
+      // Audit-grade default: fail loud so callers know events are being lost.
+      // Disk full, EACCES, EINVAL etc. should NOT be silently swallowed.
+      if (!this.bestEffort) throw err;
     }
     return full;
   }

package/src/shield/policy.js

@@ -42,12 +42,46 @@ export async function loadPolicies(path) {
   return data;
 }
 
+// ReDoS protection: regexes are loaded from a user-provided JSON policy file,
+// so a malicious or buggy pattern (e.g. `(a+)+$`) could pin the CPU on a long
+// input. We mitigate two ways:
+//   1) Cap the maximum input length passed to any regex test to MAX_REGEX_INPUT
+//      bytes. Above that we truncate before testing. Real agent values
+//      (URLs, commands, queries) are well under this in practice.
+//   2) Reject obviously dangerous patterns at compile time (heuristic).
+//
+// A future v0.5 may add a proper safe-regex-2 dependency for thorough analysis.
+const MAX_REGEX_INPUT = 8192;
+
+const SUSPICIOUS_REGEX_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,   // (x+)+ or (x*)* — classic catastrophic backtracking
+  /(\.\*){3,}/,                  // multiple .* in a row
+];
+
+function validateRegexString(src, where) {
+  if (typeof src !== 'string') {
+    throw new Error(`policy ${where}: regex must be a string`);
+  }
+  if (src.length > 2000) {
+    throw new Error(`policy ${where}: regex too long (>2000 chars)`);
+  }
+  for (const sus of SUSPICIOUS_REGEX_PATTERNS) {
+    if (sus.test(src)) {
+      throw new Error(`policy ${where}: regex looks vulnerable to catastrophic backtracking ("${src.slice(0, 60)}…"). Refusing to load.`);
+    }
+  }
+  return new RegExp(src);
+}
+
 function compileMatchRegexes(match) {
-  for (const condition of Object.values(match)) {
+  for (const [field, condition] of Object.entries(match)) {
     if (condition && typeof condition === 'object') {
-      if (condition.regex) condition._regex = new RegExp(condition.regex);
-      if (condition.not_regex) condition._not_regex = new RegExp(condition.not_regex);
-      if (condition.regex_any) condition._regex_any = condition.regex_any.map(r => new RegExp(r));
+      if (condition.regex) condition._regex = validateRegexString(condition.regex, `${field}.regex`);
+      if (condition.not_regex) condition._not_regex = validateRegexString(condition.not_regex, `${field}.not_regex`);
+      if (condition.regex_any) {
+        condition._regex_any = condition.regex_any.map((r, i) =>
+          validateRegexString(r, `${field}.regex_any[${i}]`));
+      }
     }
   }
 }
@@ -56,6 +90,15 @@ function getNested(obj, path) {
   return path.split('.').reduce((o, k) => (o == null ? undefined : o[k]), obj);
 }
 
+// Truncate input before passing to regex test — guards against ReDoS on
+// pathologically long values (e.g. an agent that pastes a 5MB string into
+// a tool argument).
+function safeRegexTest(re, value) {
+  if (typeof value !== 'string') return false;
+  const s = value.length > MAX_REGEX_INPUT ? value.slice(0, MAX_REGEX_INPUT) : value;
+  return re.test(s);
+}
+
 function matchValue(value, condition) {
   // Literal scalar match
   if (condition === null || typeof condition !== 'object') {
@@ -67,13 +110,13 @@ function matchValue(value, condition) {
   if (condition.in !== undefined) return condition.in.includes(value);
   if (condition.not_in !== undefined) return !condition.not_in.includes(value);
   if (condition._regex !== undefined) {
-    return typeof value === 'string' && condition._regex.test(value);
+    return safeRegexTest(condition._regex, value);
   }
   if (condition._not_regex !== undefined) {
-    return typeof value === 'string' && !condition._not_regex.test(value);
+    return typeof value === 'string' && !safeRegexTest(condition._not_regex, value);
   }
   if (condition._regex_any !== undefined) {
-    return typeof value === 'string' && condition._regex_any.some(r => r.test(value));
+    return condition._regex_any.some(r => safeRegexTest(r, value));
   }
   // Unknown condition shape — defensive: fail-closed (no match) so unknown
   // conditions never silently allow events.

package/src/adapters/claude.js

@@ -1,46 +0,0 @@
-import { WatchMyAgents } from '../collector.js';
-
-export function createClaudeMonitor(opts = {}) {
-  const wma = WatchMyAgents.current() || new WatchMyAgents({ ...opts, framework: 'claude' });
-
-  return {
-    wma,
-    wrap(client) {
-      const m = client?.messages;
-      if (!m?.create) return client;
-      const orig = m.create.bind(m);
-      m.create = async (params) => {
-        const start = Date.now();
-        let status = 'ok', error = null, res;
-        try { res = await orig(params); return res; }
-        catch (e) { status = 'error'; error = e?.message || String(e); throw e; }
-        finally {
-          const u = res?.usage || {};
-          const inT = u.input_tokens || 0;
-          const outT = u.output_tokens || 0;
-          const cr = u.cache_read_input_tokens || 0;
-          const cw = u.cache_creation_input_tokens || 0;
-          const toolUses = Array.isArray(res?.content)
-            ? res.content.filter(b => b?.type === 'tool_use').map(b => b.name) : [];
-          await wma.logAction({
-            framework: 'claude', action_type: 'llm_call',
-            tool_name: params?.model || 'messages.create',
-            model: params?.model || null,
-            duration_ms: Date.now() - start,
-            input_tokens: inT || null,
-            output_tokens: outT || null,
-            cache_read_tokens: cr || null,
-            cache_creation_tokens: cw || null,
-            tokens_used: (inT + outT + cr + cw) || null,
-            status, error,
-            input: { model: params?.model, message_count: params?.messages?.length, tool_count: params?.tools?.length || 0 },
-            output: { stop_reason: res?.stop_reason || null, tool_uses: toolUses },
-          });
-        }
-      };
-      return client;
-    },
-    logToolUse: (name, input, output, duration_ms) =>
-      wma.logAction({ framework: 'claude', action_type: 'tool_use', tool_name: name, duration_ms: duration_ms ?? null, status: 'ok', input, output }),
-  };
-}

package/src/adapters/generic.js

@@ -1,21 +0,0 @@
-import { WatchMyAgents } from '../collector.js';
-
-export async function watch(toolName, params, fn, meta = {}) {
-  const wma = WatchMyAgents.getOrCreate();
-  return wma.watch(toolName, params, fn, { framework: 'generic', ...meta });
-}
-
-export function createGenericMonitor(opts = {}) {
-  const wma = WatchMyAgents.current() || new WatchMyAgents(opts);
-  return {
-    watch: (toolName, params, fn, meta) => wma.watch(toolName, params, fn, { framework: 'generic', ...meta }),
-    wrap(obj, methodNames) {
-      const names = methodNames || Object.keys(obj).filter(k => typeof obj[k] === 'function');
-      const wrapped = {};
-      for (const name of names) {
-        wrapped[name] = (...args) => wma.watch(name, args, () => obj[name](...args), { framework: 'generic' });
-      }
-      return { ...obj, ...wrapped };
-    },
-  };
-}

package/src/adapters/langchain.js

@@ -1,42 +0,0 @@
-import { WatchMyAgents } from '../collector.js';
-
-export function createLangChainHandler(opts = {}) {
-  const wma = WatchMyAgents.current() || new WatchMyAgents({ ...opts, framework: 'langchain' });
-  const starts = new Map();
-  const begin = id => starts.set(id, Date.now());
-  const elapsed = id => { const t = starts.get(id); starts.delete(id); return t ? Date.now() - t : null; };
-
-  return {
-    name: 'WatchMyAgentsHandler',
-    handleLLMStart: async (_l, _p, runId) => begin(runId),
-    handleLLMEnd: async (out, runId) => {
-      const u = out?.llmOutput?.tokenUsage || {};
-      const inT = u.promptTokens || 0, outT = u.completionTokens || 0;
-      return wma.logAction({
-        framework: 'langchain', action_type: 'llm_call', tool_name: 'llm',
-        model: out?.llmOutput?.modelName || null,
-        duration_ms: elapsed(runId),
-        input_tokens: inT || null, output_tokens: outT || null,
-        tokens_used: (inT + outT) || null, status: 'ok',
-      });
-    },
-    handleLLMError: async (err, runId) => wma.logAction({
-      framework: 'langchain', action_type: 'llm_call', tool_name: 'llm',
-      duration_ms: elapsed(runId), status: 'error', error: err?.message || String(err),
-    }),
-    handleToolStart: async (_t, _i, runId) => begin(runId),
-    handleToolEnd: async (_o, runId) => wma.logAction({
-      framework: 'langchain', action_type: 'tool_call', tool_name: 'tool',
-      duration_ms: elapsed(runId), status: 'ok',
-    }),
-    handleToolError: async (err, runId) => wma.logAction({
-      framework: 'langchain', action_type: 'tool_call', tool_name: 'tool',
-      duration_ms: elapsed(runId), status: 'error', error: err?.message || String(err),
-    }),
-    handleChainStart: async (_c, _i, runId) => begin(runId),
-    handleChainEnd: async (_o, runId) => wma.logAction({
-      framework: 'langchain', action_type: 'chain', tool_name: 'chain',
-      duration_ms: elapsed(runId), status: 'ok',
-    }),
-  };
-}

package/src/adapters/openai.js

@@ -1,47 +0,0 @@
-import { WatchMyAgents } from '../collector.js';
-
-export function createOpenAIMonitor(opts = {}) {
-  const wma = WatchMyAgents.current() || new WatchMyAgents({ ...opts, framework: 'openai' });
-
-  function wrapMethod(obj, method, action_type) {
-    if (!obj || typeof obj[method] !== 'function') return;
-    const orig = obj[method].bind(obj);
-    obj[method] = async (params) => {
-      const start = Date.now();
-      let status = 'ok', error = null, res;
-      try { res = await orig(params); return res; }
-      catch (e) { status = 'error'; error = e?.message || String(e); throw e; }
-      finally {
-        const u = res?.usage || {};
-        const inT = u.prompt_tokens || u.input_tokens || 0;
-        const outT = u.completion_tokens || u.output_tokens || 0;
-        const cr = u.prompt_tokens_details?.cached_tokens || 0;
-        await wma.logAction({
-          framework: 'openai', action_type,
-          tool_name: params?.model || params?.assistant_id || method,
-          model: params?.model || null,
-          duration_ms: Date.now() - start,
-          input_tokens: inT || null,
-          output_tokens: outT || null,
-          cache_read_tokens: cr || null,
-          tokens_used: (inT + outT) || null,
-          status, error,
-          input: { model: params?.model, assistant_id: params?.assistant_id },
-          output: { id: res?.id, status: res?.status },
-        });
-      }
-    };
-  }
-
-  return {
-    wma,
-    wrap(client) {
-      wrapMethod(client?.chat?.completions, 'create', 'llm_call');
-      wrapMethod(client?.completions, 'create', 'llm_call');
-      wrapMethod(client?.beta?.threads?.runs, 'create', 'assistant_run');
-      wrapMethod(client?.beta?.threads?.runs, 'createAndPoll', 'assistant_run');
-      wrapMethod(client?.responses, 'create', 'llm_call');
-      return client;
-    },
-  };
-}

package/src/collector.js

@@ -1,113 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { Logger } from './logger.js';
-import { Exporter } from './exporter.js';
-import { TokenTracker, estimateCost } from './tokens.js';
-
-let _instance = null;
-
-export class WatchMyAgents {
-  constructor(opts = {}) {
-    this.apiKey = opts.apiKey || process.env.WMA_API_KEY || null;
-    this.agentId = opts.agentId || 'default-agent';
-    this.logDir = opts.logDir || process.env.WMA_LOG_DIR || './watchmyagents-logs';
-    this.exportUrl = opts.exportUrl || process.env.WMA_EXPORT_URL || null;
-    this.silent = opts.silent !== false;
-    this.sessionId = opts.sessionId || randomUUID();
-    this.framework = opts.framework || 'generic';
-    this.tokenPricing = opts.tokenPricing || null;
-    this.tracker = new TokenTracker();
-    this.logger = new Logger({ logDir: this.logDir, agentId: this.agentId, sessionId: this.sessionId, silent: this.silent });
-    this.exporter = new Exporter({
-      apiKey: this.apiKey, exportUrl: this.exportUrl, agentId: this.agentId,
-      batchInterval: opts.batchInterval ?? 30000, silent: this.silent,
-    });
-    this.exporter.start();
-    _instance = this;
-  }
-
-  static current() { return _instance; }
-  static getOrCreate(opts) { return _instance || new WatchMyAgents(opts); }
-
-  summarize(v) {
-    if (v == null) return null;
-    const t = typeof v;
-    if (t === 'string') return { type: 'string', length: v.length };
-    if (t === 'number' || t === 'boolean') return { type: t };
-    if (Array.isArray(v)) return { type: 'array', length: v.length };
-    if (t === 'object') return { type: 'object', keys: Object.keys(v).length };
-    return { type: t };
-  }
-
-  _enrichTokens(entry) {
-    const i = entry.input_tokens, o = entry.output_tokens;
-    const cr = entry.cache_read_tokens || 0, cw = entry.cache_creation_tokens || 0;
-    if (entry.tokens_used == null && (i != null || o != null)) {
-      entry.tokens_used = (i || 0) + (o || 0) + cr + cw;
-    }
-    if (entry.cost_usd == null && entry.model) {
-      entry.cost_usd = estimateCost(entry.model, {
-        input_tokens: i, output_tokens: o,
-        cache_read_tokens: cr, cache_creation_tokens: cw,
-      }, this.tokenPricing);
-    }
-    return entry;
-  }
-
-  async watch(toolName, params, fn, meta = {}) {
-    const start = Date.now();
-    const id = randomUUID();
-    let status = 'ok', error = null, result;
-    try { result = await fn(); return result; }
-    catch (e) { status = 'error'; error = e?.message || String(e); throw e; }
-    finally {
-      const entry = await this.logger.write(this._enrichTokens({
-        id, framework: meta.framework || this.framework,
-        action_type: meta.action_type || 'tool_call',
-        tool_name: toolName, duration_ms: Date.now() - start,
-        model: meta.model ?? null,
-        tokens_used: meta.tokens_used ?? null,
-        input_tokens: meta.input_tokens ?? null,
-        output_tokens: meta.output_tokens ?? null,
-        cache_read_tokens: meta.cache_read_tokens ?? null,
-        cache_creation_tokens: meta.cache_creation_tokens ?? null,
-        status, error, input: params, output: this.summarize(result),
-      }));
-      this.tracker.record(entry);
-      this.exporter.enqueue(this.logger.toExportRecord(entry));
-    }
-  }
-
-  async logAction(entry) {
-    const written = await this.logger.write(this._enrichTokens({ ...entry }));
-    this.tracker.record(written);
-    this.exporter.enqueue(this.logger.toExportRecord(written));
-    return written;
-  }
-
-  tokenStats() { return this.tracker.stats(); }
-
-  async flush() { await this.exporter.flush(); }
-
-  async shutdown() {
-    const stats = this.tracker.stats().total;
-    const entry = await this.logger.write({
-      action_type: 'session_end',
-      tool_name: null,
-      framework: this.framework,
-      status: 'ok',
-      session_tokens: {
-        input: stats.input,
-        output: stats.output,
-        cache_read: stats.cache_read,
-        cache_creation: stats.cache_creation,
-        total: stats.sum,
-      },
-      session_cost_usd: stats.cost_usd,
-    });
-    this.exporter.enqueue(this.logger.toExportRecord(entry));
-    this.exporter.stop();
-    await this.exporter.flush();
-  }
-  get logPath() { return this.logger._pathForToday(); }
-  get actionCount() { return this.logger.count; }
-}