debugbundle-python 1.4.2__py3-none-any.whl → 2.0.0__py3-none-any.whl

debugbundle/delivery_hooks.py

@@ -0,0 +1,62 @@
+"""Finalize one reserved event at a time without retaining uncharged hook output."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, cast
+
+from .request_capture_policy import should_capture_request_event
+
+if TYPE_CHECKING:
+    from .core import DebugBundleSdk
+
+
+def replacement_allowed(sdk: DebugBundleSdk, event: dict[str, object]) -> bool:
+    payload = cast(dict[str, object], event["payload"])
+    if event["event_type"] == "log_event":
+        return sdk._log_level_eligible(cast(str, payload["level"]))
+    if event["event_type"] == "request_event":
+        return should_capture_request_event(sdk._capture_policy, payload, payload)
+    if event["event_type"] == "probe_event":
+        return sdk._capture_policy.capture_probe_events == "standalone_when_activated"
+    return True
+
+
+def finalize_batch(
+    sdk: DebugBundleSdk,
+    batch: list[dict[str, object]],
+    generation: int,
+    max_bytes: int,
+) -> list[dict[str, object]] | None:
+    retained_index = 0
+    for snapshot_index, original in enumerate(batch):
+        try:
+            replacement = sdk._apply_before_send_event(original)
+            replacement_bytes = sdk._event_bytes(replacement) if replacement is not None else 0
+        except BaseException:
+            # Hook exceptions/invalid returns already use the protected original
+            # inside apply_before_send. Other failures must withhold telemetry.
+            replacement, replacement_bytes = None, 0
+        with sdk._lock:
+            if generation != sdk._generation:
+                return None
+            original_bytes = sdk._buffer_sizes[id(original)]
+            allowed = replacement is not None and replacement_allowed(sdk, replacement)
+            fits = sdk._buffer_bytes - original_bytes + replacement_bytes <= max_bytes
+            if allowed and fits:
+                assert replacement is not None
+                sdk._buffer[retained_index] = replacement
+                sdk._buffer_sizes.pop(id(original))
+                sdk._buffer_sizes[id(replacement)] = replacement_bytes
+                sdk._buffer_bytes += replacement_bytes - original_bytes
+                retained_index += 1
+                batch[snapshot_index] = replacement
+            else:
+                if allowed and not fits:
+                    sdk._pressure_drops += 1
+                sdk._buffer.pop(retained_index)
+                sdk._buffer_sizes.pop(id(original))
+                sdk._buffer_bytes -= original_bytes
+                sdk._inflight_count -= 1
+                # Release the snapshot reference before another callback can wait.
+                batch[snapshot_index] = {}
+    return [event for event in batch if event]

debugbundle/event_support.py

@@ -264,7 +264,7 @@ def sdk_version() -> str:
     try:
         return metadata.version("debugbundle-python")
     except metadata.PackageNotFoundError:
-        return "1.4.2"
+        return "2.0.0"
 
 
 def sdk_config_endpoint(events_endpoint: str) -> str:

debugbundle/exception_snapshot.py

@@ -0,0 +1,74 @@
+"""Bounded exception details without invoking application-defined string renderers or source reads."""
+
+from __future__ import annotations
+
+MAX_CAUSES = 8
+MAX_FRAMES = 64
+MAX_STACK_CHARS = 16 * 1024
+
+
+def exception_details(error: BaseException) -> tuple[str, str, str]:
+    name = _exception_name(error)
+    message = _safe_message(error)
+    lines: list[str] = []
+    visited: set[int] = set()
+    current: BaseException | None = error
+    frames_seen = 0
+
+    while current is not None and len(visited) < MAX_CAUSES and id(current) not in visited:
+        visited.add(id(current))
+        current_name = _exception_name(current)
+        lines.append(f"{current_name}: {_safe_message(current)}")
+        try:
+            tb = BaseException.__dict__["__traceback__"].__get__(current)
+        except BaseException:
+            tb = None
+        while tb is not None and frames_seen < MAX_FRAMES:
+            try:
+                code = tb.tb_frame.f_code
+                filename = code.co_filename[:256]
+                function = code.co_name[:128]
+                line = tb.tb_lineno
+                tb = tb.tb_next
+            except BaseException:
+                break
+            lines.append(f"  File {filename}, line {line}, in {function}")
+            frames_seen += 1
+        if frames_seen >= MAX_FRAMES:
+            lines.append("  ... additional frames omitted")
+            break
+        try:
+            next_error = BaseException.__dict__["__cause__"].__get__(current)
+            if next_error is None and not BaseException.__dict__["__suppress_context__"].__get__(current):
+                next_error = BaseException.__dict__["__context__"].__get__(current)
+        except BaseException:
+            next_error = None
+        current = next_error
+        if current is not None:
+            lines.append("Caused by:")
+
+    return name, message, "\n".join(lines)[:MAX_STACK_CHARS]
+
+
+def _exception_name(error: BaseException) -> str:
+    # Invoke built-in descriptors directly: subclass properties, __getattribute__,
+    # metaclass accessors, and truthiness must never execute on capture callers.
+    return str(type.__dict__["__name__"].__get__(type(error)))[:256]
+
+
+def _safe_message(error: BaseException) -> str:
+    try:
+        args = BaseException.__dict__["args"].__get__(error)
+        if not isinstance(args, tuple):
+            return "[message unavailable]"
+        parts: list[str] = []
+        for value in args[:4]:
+            if issubclass(type(value), str):
+                parts.append(str.__getitem__(value, slice(0, 1024)))
+            elif type(value) in (int, float, bool):
+                parts.append(str(value))
+            else:
+                parts.append("[unsupported argument]")
+        return ", ".join(parts)[:4096]
+    except BaseException:
+        return "[message unavailable]"

debugbundle/flush_aggregates.py

@@ -0,0 +1,37 @@
+"""Prepare bounded SDK summaries away from the capture admission lock."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, cast
+
+if TYPE_CHECKING:
+    from .core import DebugBundleSdk
+
+
+def prepare_flush_aggregates(
+    sdk: DebugBundleSdk,
+    suppression: list[dict[str, object]],
+    pressure_count: int,
+) -> tuple[list[tuple[dict[str, object], int]], tuple[dict[str, object], int] | None]:
+    prepared: list[tuple[dict[str, object], int]] = []
+    for aggregate in suppression:
+        event_type = aggregate.get("event_type")
+        payload = aggregate.get("payload")
+        if not isinstance(event_type, str) or not isinstance(payload, dict):
+            continue
+        aggregate.update(sdk._base_event(event_type, cast(dict[str, object], payload)))
+        protected = sdk._protect_event(aggregate)
+        if protected is not None:
+            prepared.append((protected, sdk._event_bytes(protected)))
+
+    pressure: tuple[dict[str, object], int] | None = None
+    if pressure_count:
+        event = sdk._base_event("log_event", {
+            "message": f"{pressure_count} SDK events suppressed due to queue pressure",
+            "level": "warning",
+            "attributes": {"suppressed_count": pressure_count, "reason": "queue_pressure"},
+        })
+        protected = sdk._protect_event(event)
+        if protected is not None:
+            pressure = (protected, sdk._event_bytes(protected))
+    return prepared, pressure

debugbundle/probe_capture.py

@@ -0,0 +1,101 @@
+"""Probe capture with short admission/commit locks and no application callback under them."""
+
+from __future__ import annotations
+
+from collections import deque
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, cast
+
+from .capture_hooks import try_capture_lock
+from .event_support import iso_now
+from .process_support import ensure_current_process
+from .redaction import sanitize_telemetry
+
+if TYPE_CHECKING:
+    from .core import DebugBundleSdk
+
+
+@dataclass
+class ProbeEntry:
+    label: str
+    data: dict[str, object]
+    timestamp: str
+
+
+def capture_probe(
+    sdk: DebugBundleSdk,
+    label: str,
+    data: object | Callable[[], object],
+    opts: Mapping[str, object] | None,
+) -> None:
+    try:
+        ensure_current_process(sdk)
+        options = dict(opts or {})
+        now_ms = int(sdk._time_provider() * 1000)
+        if not try_capture_lock(sdk):
+            sdk._pressure_drops += 1
+            return
+        try:
+            if not sdk._enabled:
+                return
+            heavy = options.get("heavy") is True
+            directives = sdk._find_matching_probe_directives(label, now_ms)
+            if heavy and not directives:
+                return
+            if label not in sdk._probe_buffers and len(sdk._probe_buffers) >= sdk._max_probe_labels:
+                return
+            redact_fields = set(sdk._redact_fields)
+            generation = sdk._generation
+        finally:
+            sdk._lock.release()
+
+        # A host supplier, mapping iterator, privacy walk, clock, or serializer may
+        # be slow or hostile. None may hold the capture lock or block exceptions.
+        protected_label = sanitize_telemetry(label, redact_fields)
+        value = data() if callable(data) else data
+        if not isinstance(value, Mapping):
+            value = {"value": value}
+        protected_value = sanitize_telemetry(dict(value), redact_fields)
+        if not isinstance(protected_label, str) or not isinstance(protected_value, dict):
+            return
+        label = protected_label
+        redacted_value = cast(dict[str, object], protected_value)
+        entry = None if heavy else ProbeEntry(label, redacted_value, iso_now(sdk._time_provider))
+
+        prepared: list[tuple[str, dict[str, object], int]] = []
+        for directive in directives:
+            payload: dict[str, object] = {
+                "label": label,
+                "activation_id": directive.id,
+                "probe_label_pattern": directive.label_pattern,
+                "data": dict(redacted_value),
+            }
+            event = sdk._protect_event(sdk._base_event("probe_event", payload))
+            if event is not None:
+                prepared.append((directive.id, event, sdk._event_bytes(event)))
+
+        refreshed_now_ms = int(sdk._time_provider() * 1000)
+        if not try_capture_lock(sdk):
+            sdk._pressure_drops += 1
+            return
+        try:
+            if not sdk._enabled or generation != sdk._generation:
+                return
+            if label not in sdk._probe_buffers and len(sdk._probe_buffers) >= sdk._max_probe_labels:
+                return
+            active_ids = {directive.id for directive in sdk._find_matching_probe_directives(label, refreshed_now_ms)}
+            if heavy and not active_ids:
+                return
+            if entry is not None:
+                bucket = sdk._probe_buffers.setdefault(label, deque(maxlen=sdk._max_probe_entries_per_label))
+                bucket.append(entry)
+            if sdk._capture_policy.capture_probe_events == "standalone_when_activated":
+                for directive_id, event, event_bytes in prepared:
+                    if directive_id in active_ids:
+                        sdk._offer_protected_event(event, event_bytes)
+        finally:
+            sdk._lock.release()
+    except BaseException:
+        # Probe callbacks and SDK failures must remain observational.
+        return

debugbundle/process_support.py

@@ -0,0 +1,59 @@
+"""Discard pre-fork SDK ownership without touching inherited thread locks."""
+
+from __future__ import annotations
+
+import os
+import threading
+from contextvars import ContextVar
+from typing import TYPE_CHECKING
+
+from .suppression import EventSuppressionTracker
+from .transport import HttpTransport
+
+if TYPE_CHECKING:
+    from .core import DebugBundleSdk
+
+
+def ensure_current_process(sdk: DebugBundleSdk) -> None:
+    pid = os.getpid()
+    if sdk._pid == pid:
+        return
+
+    # The parent may have forked while another thread owned its lock. Never
+    # acquire, cancel, close, or join any inherited thread-owned object here.
+    sdk._lock = threading.RLock()
+    sdk._timer = None
+    sdk._remote_config_timer = None
+    sdk._initial_config_ready = threading.Event()
+    sdk._initial_config_ready.set()
+    sdk._generation += 1
+    sdk._sending = False
+    sdk._inflight_count = 0
+    sdk._timer_due_at = 0.0
+    sdk._buffer = []
+    sdk._buffer_sizes = {}
+    sdk._buffer_bytes = 0
+    sdk._pending_low_priority = 0
+    sdk._context = {}
+    sdk._scoped_context = ContextVar("debugbundle_scoped_context", default=None)
+    sdk._request_trigger_directives = ContextVar("debugbundle_request_trigger_directives", default=None)
+    sdk._probe_buffers = {}
+    sdk._suppression = EventSuppressionTracker()
+    sdk._pressure_drops = 0
+    sdk._last_pressure_report_at = 0.0
+    sdk._retry_after = 0.0
+    sdk._last_event_at = None
+    sdk._consecutive_failures = 0
+    sdk._remote_config_etag = None
+    sdk._remote_config_snapshot = None
+
+    # Retain the parent's effective policy until the child explicitly reinitializes;
+    # resetting to a default here could widen capture after a restricted policy.
+    if sdk._http_transport is not None:
+        sdk._http_transport = None
+        try:
+            sdk._http_transport = HttpTransport(sdk._endpoint)
+        except Exception:
+            pass
+        sdk._transport = sdk._http_transport
+    sdk._pid = pid

debugbundle/queue_admission.py

@@ -0,0 +1,39 @@
+"""Constant-time overload admission and pending-event priority helpers."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from .core import DebugBundleSdk
+
+
+def high_priority_event(event: dict[str, object]) -> bool:
+    if event.get("event_type") == "backend_exception":
+        return True
+    payload = event.get("payload")
+    return isinstance(payload, dict) and (
+        payload.get("level") in ("error", "critical")
+        or (event.get("event_type") == "request_event" and type(payload.get("response_status")) is int
+            and payload["response_status"] >= 500)
+    )
+
+
+def may_prepare_event(sdk: DebugBundleSdk, high_priority: bool, max_events: int, max_bytes: int) -> bool:
+    if len(sdk._buffer) < max_events and sdk._buffer_bytes < max_bytes:
+        return True
+    if high_priority and sdk._pending_low_priority > 0:
+        return True
+    sdk._pressure_drops = min(2**63 - 1, sdk._pressure_drops + 1)
+    return False
+
+
+def evict_low_priority(sdk: DebugBundleSdk) -> bool:
+    for index in range(sdk._inflight_count, len(sdk._buffer)):
+        if not high_priority_event(sdk._buffer[index]):
+            evicted = sdk._buffer.pop(index)
+            sdk._buffer_bytes -= sdk._buffer_sizes.pop(id(evicted))
+            sdk._pending_low_priority -= 1
+            sdk._pressure_drops = min(2**63 - 1, sdk._pressure_drops + 1)
+            return True
+    return False

debugbundle/redaction.py

@@ -1,7 +1,10 @@
 from __future__ import annotations
 
+import json
+import re
 from collections.abc import Mapping, Sequence
 from typing import Any
+from urllib.parse import parse_qsl, unquote, urlencode, urlsplit, urlunsplit
 
 DEFAULT_REDACT_FIELDS = {
     "authorization",
@@ -14,6 +17,200 @@ DEFAULT_REDACT_FIELDS = {
 }
 
 REDACTED_VALUE = "[REDACTED]"
+MANDATORY_FIELDS = DEFAULT_REDACT_FIELDS | {
+    "api_key", "apikey", "access_token", "refresh_token", "private_key", "bearer", "session_id",
+    "passwd", "card_number", "cvv", "cvc", "pin", "expiry", "phone", "otp", "verification_code",
+}
+_HEADER = re.compile(r"\b(Authorization|Proxy-Authorization|Cookie|Set-Cookie)\s*:\s*[^\r\n]*", re.I)
+_BEARER = re.compile(r"\b(Bearer|Basic)\s+[A-Za-z0-9._~+/-]{6,}", re.I)
+_TOKEN = re.compile(r"\bdbundle_(?:proj|mem|probe|agent)_[A-Za-z0-9_-]+\b")
+_PEM = re.compile(
+    r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----",
+    re.I,
+)
+_PEM_START = re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----", re.I)
+_CARD = re.compile(r"(?<![A-Za-z0-9_-])(?:\d[ -]?){12,18}\d(?![A-Za-z0-9_-])")
+_URL = re.compile(r"\bhttps?://[^\s<>\"']+", re.I)
+_LABELS = MANDATORY_FIELDS | {"client_secret", "x_api_key", "accessToken", "refreshToken", "privateKey", "clientSecret"}
+_ASSIGNMENT = re.compile(
+    r"\b(" + "|".join(re.escape(key) for key in sorted(_LABELS, key=len, reverse=True)) +
+    r")\b([\"']?\s*[:=]\s*)(?:\"[^\"]*\"|'[^']*'|[^\s&,;]+)", re.I,
+)
+
+
+class UnsafeTelemetry(ValueError):
+    """A fixed safe failure marker; never includes caller content."""
+
+
+def _sensitive_key(key: str, fields: set[str]) -> bool:
+    normalized = re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", key.strip()).lower()
+    segments = [segment for segment in re.split(r"[^a-z0-9]+", normalized) if segment]
+    canonical = {re.sub(r"[^a-z0-9]", "", field.lower()) for field in fields}
+    for start in range(len(segments)):
+        combined = ""
+        for segment in segments[start:]:
+            combined += segment
+            if combined in canonical:
+                return True
+    return False
+
+
+def _luhn(candidate: str) -> bool:
+    digits = re.sub(r"[^0-9]", "", candidate)
+    if not 13 <= len(digits) <= 19 or len(set(digits)) == 1:
+        return False
+    total = 0
+    for index, char in enumerate(reversed(digits)):
+        digit = int(char)
+        if index % 2:
+            digit *= 2
+            if digit > 9:
+                digit -= 9
+        total += digit
+    return total % 10 == 0
+
+
+def _scrub_url(raw: str, fields: set[str]) -> str:
+    try:
+        parsed = urlsplit(raw)
+        if not parsed.scheme or not parsed.hostname:
+            raise ValueError("invalid_url")
+        _ = parsed.port  # Invalid ports make the entire URL unscannable.
+        host = parsed.netloc.rsplit("@", 1)[-1]
+        authority = f"REDACTED@{host}" if parsed.username or parsed.password else host
+        query = urlencode([
+            (key, REDACTED_VALUE if _sensitive_key(key, fields)
+             or _scrub_text(value, fields, False) != value else value)
+            for key, value in parse_qsl(parsed.query, keep_blank_values=True)
+            if len(key) <= 128 and _scrub_text(key, fields, False) == key
+        ])
+        return urlunsplit((parsed.scheme.lower(), authority, parsed.path or "/", query, ""))
+    except ValueError:
+        return REDACTED_VALUE
+
+
+def _scrub_text(value: str, extra: set[str], scan_urls: bool = True) -> str:
+    if _PEM_START.search(value) and not _PEM.search(value):
+        return REDACTED_VALUE
+    if re.search(r"(?:password|token|secret|authorization|cookie)%3[ad]", value, re.I):
+        try:
+            value = unquote(value, errors="strict")
+        except UnicodeError:
+            return REDACTED_VALUE
+    result = _PEM.sub(REDACTED_VALUE, value)
+    result = _HEADER.sub(lambda match: f"{match.group(1)}: {REDACTED_VALUE}", result)
+    result = _BEARER.sub(lambda match: f"{match.group(1)} {REDACTED_VALUE}", result)
+    result = _TOKEN.sub(REDACTED_VALUE, result)
+    result = _ASSIGNMENT.sub(lambda match: f"{match.group(1)}{match.group(2)}{REDACTED_VALUE}", result)
+    for field in extra:
+        named = re.compile(r"\b(" + re.escape(field) + r")\b([\"']?\s*[:=]\s*)(?:\"[^\"]*\"|'[^']*'|[^\s&,;]+)", re.I)
+        result = named.sub(lambda match: f"{match.group(1)}{match.group(2)}{REDACTED_VALUE}", result)
+    result = _CARD.sub(lambda match: REDACTED_VALUE if _luhn(match.group(0)) else match.group(0), result)
+
+    if not scan_urls:
+        return result
+
+    def replace_url(match: re.Match[str]) -> str:
+        raw = match.group(0)
+        suffix = re.search(r"[).,;]+$", raw)
+        trailing = suffix.group(0) if suffix else ""
+        return _scrub_url(raw[:len(raw) - len(trailing)] if trailing else raw, MANDATORY_FIELDS | extra) + trailing
+
+    return _URL.sub(replace_url, result)
+
+
+def sanitize_telemetry(value: Any, additional_fields: set[str] | None = None) -> Any:
+    """Mandatory bounded telemetry policy. Failure withholds the input, never returns its original."""
+    extra = additional_fields or set()
+    if len(extra) > 128 or any(not isinstance(field, str) or not 0 < len(field) <= 64 for field in extra):
+        raise UnsafeTelemetry("unsafe_input")
+    state = {"nodes": 0, "bytes": 0}
+    seen: set[int] = set()
+    fields = MANDATORY_FIELDS | extra
+
+    def visit(candidate: Any, depth: int, structured: bool) -> Any:
+        state["nodes"] += 1
+        if state["nodes"] > 4096:
+            raise UnsafeTelemetry("budget_exceeded")
+        if depth > 16:
+            return REDACTED_VALUE
+        if isinstance(candidate, str):
+            if len(candidate) > 16 * 1024:
+                return REDACTED_VALUE
+            try:
+                length = len(candidate.encode("utf-8"))
+            except UnicodeError as error:
+                raise UnsafeTelemetry("unsafe_input") from error
+            if length > 16 * 1024:
+                return REDACTED_VALUE
+            state["bytes"] += length
+            if state["bytes"] > 256 * 1024:
+                raise UnsafeTelemetry("budget_exceeded")
+            if structured and candidate.startswith(("{", "[")):
+                try:
+                    nested = json.loads(candidate)
+                except (ValueError, TypeError):
+                    nested = None
+                if isinstance(nested, (dict, list)):
+                    return json.dumps(visit(nested, 0, False), separators=(",", ":"), ensure_ascii=False)
+            result = _scrub_text(candidate, extra)
+            if candidate.startswith(("{", "[")) and result == candidate and re.search(
+                r"(?:password|token|secret|authorization|cookie)[\"']?\s*[:=]", candidate, re.I
+            ):
+                return REDACTED_VALUE
+            return result
+        if candidate is None or isinstance(candidate, (bool, int, float)):
+            return candidate
+        identity = id(candidate)
+        if identity in seen:
+            return "[Circular]"
+        seen.add(identity)
+        try:
+            if isinstance(candidate, (list, tuple)):
+                if len(candidate) > 256:
+                    return REDACTED_VALUE
+                return [visit(item, depth + 1, structured) for item in candidate]
+            if isinstance(candidate, Mapping):
+                if len(candidate) > 256:
+                    return REDACTED_VALUE
+                output: dict[str, Any] = {}
+                for key, nested in candidate.items():
+                    if not isinstance(key, str):
+                        raise UnsafeTelemetry("unsafe_input")
+                    if len(key) > 128:
+                        continue
+                    state["bytes"] += len(key.encode("utf-8"))
+                    if state["bytes"] > 256 * 1024:
+                        raise UnsafeTelemetry("budget_exceeded")
+                    if _scrub_text(key, extra) != key:
+                        continue
+                    output[key] = (
+                        REDACTED_VALUE if _sensitive_key(key, fields) else visit(nested, depth + 1, structured)
+                    )
+                return output
+            raise UnsafeTelemetry("unsafe_input")
+        finally:
+            seen.remove(identity)
+
+    try:
+        sanitized = visit(value, 0, True)
+        if len(json.dumps(sanitized, separators=(",", ":"), ensure_ascii=False).encode("utf-8")) > 256 * 1024:
+            raise UnsafeTelemetry("budget_exceeded")
+        return sanitized
+    except UnsafeTelemetry:
+        raise
+    except (TypeError, ValueError, UnicodeError, RuntimeError, OverflowError) as error:
+        raise UnsafeTelemetry("unsafe_input") from error
+
+
+def has_safe_event_identity(event: Mapping[str, Any], extra: set[str] | None = None) -> bool:
+    correlation = event.get("correlation") or {}
+    if not isinstance(correlation, dict) or len(correlation) > 8:
+        return False
+    values = [event.get(key) for key in ("schema_version", "sdk_name", "sdk_version")]
+    values.extend(correlation.values())
+    return all(value is None or isinstance(value, str)
+               and sanitize_telemetry(value, extra) == value for value in values)
 
 
 def redact_value(value: Any, redact_fields: set[str]) -> Any:

debugbundle/relay.py

@@ -6,6 +6,7 @@ from collections.abc import Callable, Mapping
 from dataclasses import dataclass, field
 from typing import Any
 
+from .redaction import UnsafeTelemetry, has_safe_event_identity, sanitize_telemetry
 from .relay_delivery import (
     AtomicRelayFileTransport,
     RelayForwardTransport,
@@ -392,4 +393,11 @@ def _sanitize_event(
         if normalized_correlation:
             sanitized["correlation"] = normalized_correlation
 
+    try:
+        if not has_safe_event_identity(sanitized):
+            return None
+        sanitized["payload"] = sanitize_telemetry(sanitized["payload"])
+        sanitized["service"] = sanitize_telemetry(sanitized["service"])
+    except UnsafeTelemetry:
+        return None
     return sanitized

debugbundle/request_capture_policy.py

@@ -0,0 +1,45 @@
+"""Metadata-only request admission before request payload construction."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+
+from .config import CapturePolicy
+from .event_support import is_immediate_request_incident_status
+
+
+def should_capture_request_event(
+    policy: CapturePolicy,
+    request: Mapping[str, object] | None,
+    response: Mapping[str, object] | None,
+) -> bool:
+    status_code = None
+    if response is not None:
+        candidate = response.get("status_code") or response.get("response_status")
+        if isinstance(candidate, int):
+            status_code = candidate
+    request_path = None
+    http_method = None
+    if request is not None:
+        path_candidate = request.get("path") or request.get("url")
+        method_candidate = request.get("method")
+        request_path = path_candidate if isinstance(path_candidate, str) else None
+        http_method = method_candidate if isinstance(method_candidate, str) else None
+    if is_immediate_request_incident_status(
+        status_code,
+        policy.preset,
+        policy.immediate_client_error_statuses,
+        request_path,
+        http_method,
+        policy.immediate_client_error_path_rules,
+    ):
+        return True
+    if policy.capture_request_events == "off":
+        return False
+    if policy.capture_request_events == "all":
+        return True
+    if response is None or status_code is None:
+        return policy.capture_request_events == "filtered"
+    if policy.capture_request_events == "failures_only":
+        return status_code >= 500
+    return False