hyperweave 0.3.7__tar.gz → 0.3.8__tar.gz

{hyperweave-0.3.7 → hyperweave-0.3.8}/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to HyperWeave are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.8] - 2026-05-19
+
+Every artifact request now emits one greppable `HW_REQUEST` access-log line to stdout, so Fly.io's log stream reveals which GitHub repos embed HyperWeave SVGs via Camo's referer header. Health and metrics probes stay silent so 30-second checks don't drown the signal.
+
+### Added
+
+- **Access log middleware** — one `HW_REQUEST` line per non-probe request carries method, path with query string, user-agent, referer, x-forwarded-for, and status. Whitespace inside header values collapses to `_` so each `key=value` token stays grep-addressable.
+- **Silent probe filter** — `/health` and `/metrics` skip the access log; Fly health-check traffic no longer pollutes the stream.
+
+### Notes
+
+- Logs flow through the `hyperweave.serve.access` named logger at INFO; uvicorn's stdout handler delivers them to Fly's log stream.
+- Request and response bodies are never logged. The referer header is the only embed-attribution signal captured.
+
 ## [0.3.7] - 2026-05-18
 
 Font payloads now embed only the characters each artifact actually renders, and fonts an artifact never displays are no longer embedded at all. Across every text-bearing artifact type — badges, strips, stats cards, star charts, marquees, receipts, and rhythm strips — and across all three genomes, gzip size drops by an average of 59% per artifact.

{hyperweave-0.3.7 → hyperweave-0.3.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hyperweave
-Version: 0.3.7
+Version: 0.3.8
 Summary: Headless visual output layer for AI agents. One API call → self-contained SVG.
 Project-URL: Repository, https://github.com/InnerAura/hyperweave
 Project-URL: Issues, https://github.com/InnerAura/hyperweave/issues

{hyperweave-0.3.7 → hyperweave-0.3.8}/src/hyperweave/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.3.7'
-__version_tuple__ = version_tuple = (0, 3, 7)
+__version__ = version = '0.3.8'
+__version_tuple__ = version_tuple = (0, 3, 8)
 
 __commit_id__ = commit_id = None

{hyperweave-0.3.7 → hyperweave-0.3.8}/src/hyperweave/serve/app.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 from contextlib import asynccontextmanager
 from typing import TYPE_CHECKING, Annotated, Any
 
@@ -115,6 +116,42 @@ async def svg_camo_headers(request: Request, call_next):  # type: ignore[no-unty
     return response
 
 
+# -- Request observability middleware ---------------------------------------
+# Emits one greppable `HW_REQUEST` line per non-probe request so we can
+# track which GitHub repos embed our SVGs via Camo (referer header) and how
+# often they're viewed. Probe endpoints stay silent to keep Fly health-check
+# noise out of the access log. Bodies are never logged.
+
+_ACCESS_LOG = logging.getLogger("hyperweave.serve.access")
+_SILENT_PATHS = frozenset({"/health", "/metrics"})
+
+
+def _scrub(value: str | None) -> str:
+    """Collapse whitespace in header values so each key=value stays a single grep token."""
+    if not value:
+        return "-"
+    return value.replace(" ", "_").replace("\t", "_")
+
+
+@app.middleware("http")
+async def access_log(request: Request, call_next):  # type: ignore[no-untyped-def]
+    response = await call_next(request)
+    if request.url.path in _SILENT_PATHS:
+        return response
+    path = request.url.path + (f"?{request.url.query}" if request.url.query else "")
+    ip = request.headers.get("x-forwarded-for") or (request.client.host if request.client else "-")
+    _ACCESS_LOG.info(
+        "HW_REQUEST method=%s path=%s ua=%s ref=%s ip=%s status=%d",
+        request.method,
+        _scrub(path),
+        _scrub(request.headers.get("user-agent")),
+        _scrub(request.headers.get("referer")),
+        _scrub(ip),
+        response.status_code,
+    )
+    return response
+
+
 # Request / Response models
 
 

{hyperweave-0.3.7 → hyperweave-0.3.8}/tests/test_serve.py

@@ -8,6 +8,7 @@ rendering, and Camo-hardening middleware.
 
 from __future__ import annotations
 
+import logging
 from typing import Any
 from unittest.mock import AsyncMock, patch
 
@@ -472,6 +473,53 @@ async def test_svg_camo_headers(client: AsyncClient, mock_compose: Any) -> None:
     assert resp.headers.get("x-content-type-options") == "nosniff"
 
 
+# ===========================================================================
+# Access log middleware (v0.3.8)
+# ===========================================================================
+
+
+async def test_access_log_emits_hw_request(
+    client: AsyncClient, mock_compose: Any, caplog: pytest.LogCaptureFixture
+) -> None:
+    with caplog.at_level(logging.INFO, logger="hyperweave.serve.access"):
+        resp = await client.get(
+            "/v1/badge/build/passing/brutalist",
+            headers={
+                "user-agent": "github-camo/abc123",
+                "referer": "https://github.com/Foo/bar",
+                "x-forwarded-for": "1.2.3.4",
+            },
+        )
+    assert resp.status_code == 200
+    lines = [r.message for r in caplog.records if "HW_REQUEST" in r.message]
+    assert lines, f"no HW_REQUEST line; got {[r.message for r in caplog.records]}"
+    line = lines[0]
+    assert "method=GET" in line
+    assert "path=/v1/badge/build/passing/brutalist" in line
+    assert "ua=github-camo/abc123" in line
+    assert "ref=https://github.com/Foo/bar" in line
+    assert "ip=1.2.3.4" in line
+    assert "status=200" in line
+
+
+async def test_access_log_skips_health(client: AsyncClient, caplog: pytest.LogCaptureFixture) -> None:
+    with caplog.at_level(logging.INFO, logger="hyperweave.serve.access"):
+        await client.get("/health")
+    assert not any("HW_REQUEST" in r.message for r in caplog.records)
+
+
+async def test_access_log_scrubs_whitespace_in_ua(
+    client: AsyncClient, mock_compose: Any, caplog: pytest.LogCaptureFixture
+) -> None:
+    with caplog.at_level(logging.INFO, logger="hyperweave.serve.access"):
+        await client.get(
+            "/v1/badge/build/passing/brutalist",
+            headers={"user-agent": "Mozilla/5.0 (X11; Linux x86_64)"},
+        )
+    line = next(r.message for r in caplog.records if "HW_REQUEST" in r.message)
+    assert "ua=Mozilla/5.0_(X11;_Linux_x86_64)" in line
+
+
 # ===========================================================================
 # Kit endpoint
 # ===========================================================================