logify360 1.0.0__tar.gz

logify360-1.0.0/.gitignore

@@ -0,0 +1,16 @@
+# Build artifacts
+dist/
+build/
+*.egg-info/
+
+# Virtualenv
+.venv/
+venv/
+test-install/
+
+# pytest / mypy / ruff caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+__pycache__/
+*.pyc

logify360-1.0.0/CHANGELOG.md

@@ -0,0 +1,182 @@
+# Changelog
+
+## 1.0.0
+
+Public PyPI release. Same API as 0.11.0.
+
+## 0.11.0
+
+Trust layer helpers. Every trust feature stays off until an admin enables it per project.
+
+### Added
+
+- **`warrant=`** on `create_openai`, `create_async_openai`, `create_anthropic` and `create_async_anthropic`, and a per-request **`with_warrant(token)`** helper. Sends `x-logify360-warrant`.
+- **`sign_warrant_request(method, url, headers, private_key, public_jwk=None)`**: RFC 9421 sender binding (`sig1`, `ecdsa-p256-sha256`) plus the `x-logify360-warrant-key` header. Needs the new optional **`warrant`** extra (`cryptography>=42`, also in `all`).
+- **`attenuate_warrant(...)`**: issues a narrower child through `POST /api/v1/warrants/:id/attenuate`. Needs a dashboard session today.
+- **`is_decoy_tool_name(name)`** and **`handle_decoy_tool_calls(response)`** for OpenAI and Anthropic responses (dicts or SDK objects). Nothing is executed.
+- **`mark_untrusted(span, source)`**: sets `logify360.untrusted` / `logify360.source` span metadata that survives the end-of-span PATCH.
+
+## 0.10.1
+
+### Fixed
+
+- **Direct-provider fallback no longer forwards the proxy `Host` / `Content-Length`.** The fallback copied the request headers, so the key-bearing request could be addressed to Logify360's zone instead of the provider. Both are now stripped and recomputed for the provider URL (R10).
+- **`resilience=` works with the openai/anthropic SDKs' `httpx2` clients** (the transport is built from the httpx flavor the provider SDK uses), and is now available on `create_anthropic()` / `create_async_anthropic()`, which attach the fallback key as `x-api-key`.
+- `Fallback.api_key` is `repr=False`, so it cannot leak into a log line.
+
+## 0.10.0
+
+**Breaking: Python 3.10 is no longer supported** (`requires-python >=3.11`). Python 3.10 reached end-of-life in October 2026, and the security releases of `pillow` (13.0.0+, pulled in by the `llama-index` extra) no longer install on it. Projects that must stay on 3.10 can keep using 0.9.0. No API changes.
+
+## 0.9.0
+
+Opt-in proxy resilience (sync + async) and a dropped-span counter. Parity with the TypeScript SDK 0.18.0.
+
+### Added
+
+- **`resilience=` on `create_openai()` / `create_async_openai()`** plus the building blocks `Resilience`, `Fallback`, `resilient_transport()`, `async_resilient_transport()` (and `ResilienceError`). Opt-in and default-safe. The resilient `httpx` transport:
+  - bounds the time to response headers (default 60 s - longer than the proxy's own 35 s upstream-header deadline) by overriding httpx's per-request read timeout, so a hang before headers no longer blocks to the 600 s default; a stream whose chunks keep flowing is never cut;
+  - retries **only** on `x-logify360-forwarded: false` (the provider was never reached, so no double-bill), honouring `Retry-After`, bounded and jittered. Connection errors and timeouts are not retried;
+  - optionally falls back to the provider directly with the **customer's own provider key** - on connection errors and `forwarded:false` responses, and on an ambiguous timeout only when `fallback_on_timeout=True`. `on_fallback` / `on_error` receive safe metadata only.
+  - forces the OpenAI SDK's own `max_retries` to 0 (its retry layer would re-add the forwarded:true double-bill) and warns once if the caller set `max_retries>0`.
+  - The provider key is never logged, sent to Logify360, or stored (R10).
+- **`client.get_dropped_span_count()`** (IMP4-S1): a running count of ingest calls permanently dropped (an error status, a network/timeout failure, or an op submitted after `close()`). Trace spans are fire-and-forget, so a lost span is otherwise silent - poll this (e.g. before `close()`) to detect and alert on lost telemetry.
+
+## 0.8.2
+
+Delivery-error and environment-parsing fixes. Two behaviour changes (see Fixed): `silent=False` now surfaces failures, and a key with whitespace or a control character inside it now raises `ValueError` when the client or a provider factory is built.
+
+### Fixed
+
+- `silent=False` no longer swallows ingest failures. It used to make the background worker raise into a `Future` that `span.end()`, `trace.end()` and `start_trace()` discard, so a failed delivery was never seen by anyone. `close()` now re-raises the first failed delivery (and so does leaving a `with Logify360Client(...)` block), once and as the original exception. `close()` also shuts the client down: a trace or span used after it is dropped, not sent. It never replaces an exception the `with` block is already raising (that failure is logged at error level instead), and a process that never calls `close()` gets it logged at error level at exit. It cannot be raised at `span.end()`: ingest is fire-and-forget and returns before the request is sent. `silent=True`, the default, is unchanged: failures go to `on_error` and are never raised.
+- `on_error` ran twice for every HTTP failure under `silent=False`. It now runs once per failed delivery in either mode.
+- Padded API keys are stripped. A key read from a file or a secret mount carries a trailing newline; sent as is, httpx rejects the `Authorization` header (`Illegal header value b'Bearer sl_...\n'`, a message that quotes the key), so every provider call failed and, under `silent=True`, every trace was dropped without a word. `Logify360Client`, `Logify360Middleware` and `api_key=` / `LOGIFY360_API_KEY` in `create_openai()`, `create_async_openai()`, `create_anthropic()`, `create_async_anthropic()`, `create_gemini()` and `configure_gemini()` now strip surrounding whitespace. A blank key counts as unset: a blank `api_key=` falls through to `LOGIFY360_API_KEY`, and a blank environment variable is reported as missing.
+- A key that still contains whitespace or a control character after the strip (an embedded newline, space, NUL, or any non-ASCII character) is now rejected with a `ValueError` when the client or provider factory is built: `[logify360] api_key contains whitespace or control characters`, or `LOGIFY360_API_KEY` when the key came from the environment. The message never quotes the key. Stripping cannot repair such a key, and httpx's error for it does quote the key: `Illegal header value b'Bearer sl_...'` would have reached stderr at exit, `on_error` hooks, and the exception `close()` raises. Keys the server issues (`sl_live_<hex>`) are unaffected.
+- `logify360 init` and `logify360 test` no longer echo a malformed key. The same keys as above (whitespace or a control character inside, or any non-ASCII character) used to be sent to `/api/v1/me/key-info`, and the wizard printed httpx's error for them, which quotes the key, inside "Network error contacting ...". The key is now checked where the wizard first receives it, before any request and before `.env` is touched, and refused with `[logify360] --api-key contains whitespace or control characters. Copy the key again from the dashboard.` (naming `LOGIFY360_API_KEY`, or "The pasted key" at the prompt, when it came from there). `fetch_key_info` repeats the check, and its network error now shows the host and the exception class (`ConnectError`, `ReadTimeout`, ...) instead of the exception's own text. Padding around the key is stripped, and a blank `--api-key` falls through to `LOGIFY360_API_KEY`. Normal keys (`sl_live_<hex>`) are unaffected.
+- `logify360 init`: an empty `LOGIFY360_API_KEY=` line in `.env` is no longer read as the value of the next line, and a blank `LOGIFY360_API_BASE` falls back to the hosted API instead of becoming an empty base URL (the same two fixes as `@logify360/cli` 0.3.4).
+
+### Changed
+
+- ruff and mypy now target Python 3.10, the package's floor (they still said 3.9). No runtime change.
+
+## 0.8.1
+
+### Changed
+
+- Default API host is `https://api.logify360.com`. Affects `DEFAULT_BASE_URL` and the `observe_openai` / `observe_anthropic` / `observe_gemini` default proxy URLs. Set `LOGIFY360_BASE_URL` or pass `base_url=` to override either way.
+
+## 0.8.0
+
+FastAPI / ASGI auto-instrumentation - one line traces every HTTP request.
+
+### Added
+
+- `Logify360Middleware` (and `install_logify360_middleware(app, ...)`): add it with `app.add_middleware(Logify360Middleware, api_key=...)` (or `client=`) and every request opens a trace + a root span named `"<METHOD> <path>"`. Clean responses end `completed`; a 5xx or unhandled exception ends `error` and the exception is re-raised untouched. The trace is exposed to handlers as `request.state.logify360` (`{trace, span, headers, trace_id, span_id}`) so nested `observe_*` LLM calls link automatically.
+- Sampling and tail-based error capture come from the underlying client, so sampled-out successful requests do zero network I/O while errors are always recorded. Health / metrics / docs routes are skipped by default (`skip_paths=` to override).
+- The middleware is pure ASGI (it does not import FastAPI), so it also works with Starlette, Litestar, Quart, and any ASGI app. New `logify360[fastapi]` optional extra.
+
+### Security
+
+- Query strings are **not** captured into trace metadata by default (they routinely carry secrets/PII: OAuth `code`/`state`, reset tokens, signed-URL signatures). Opt in with `capture_query_string=True`.
+- The exception re-raise path uses a `_safe_str` helper so a handler exception whose `__str__` itself raises can never replace the original exception on its way back up.
+
+### Verified
+
+- 8 tests (success trace + `request.state` injection, default-path skipping, error capture + re-raise, build-from-`api_key`, missing-credentials guard, query-string off-by-default + opt-in, and broken-`__str__` re-raise). `ruff` clean; `mypy --strict` clean on the new module.
+
+## 0.7.0
+
+Onboarding CLI release. `pip install logify360` now also installs a `logify360` console command that connects a Python project to Logify360 in one step, the same wizard the Node `@logify360/cli` ships. No extra dependency: it uses only the standard library plus `httpx` (already a runtime dependency).
+
+### Added
+
+- `logify360 init` interactive wizard: detects the package manager (`poetry` / `uv` / `pipenv` / `pip`) and which provider libraries are declared, validates the pasted `sl_live_*` key against `/api/v1/me/key-info`, writes `LOGIFY360_API_KEY` into `.env` (idempotent, comment-preserving), installs the right `logify360[...]` extras, and rewrites client construction to route through the proxy.
+- AST-based code patcher (`logify360.cli.code_patcher`): rewrites `OpenAI(...)` / `AsyncOpenAI(...)` into `create_openai()` / `create_async_openai()`, `Anthropic(...)` / `AsyncAnthropic(...)` into `create_anthropic()` / `create_async_anthropic()`, and `genai.configure(...)` into `configure_gemini()`. It strips `api_key` / `base_url`, preserves every other argument, edits by byte offset so formatting and comments survive, and re-parses each file before writing so a patched file always imports.
+- `logify360 test` for a quick key + connectivity check, and `logify360 --version`.
+- Flags: `--dry-run`, `--yes` (non-interactive), `--api-key`, `--server-url` (self-hosting).
+- `[project.scripts]` entry point so the command is available immediately after install. Output forces UTF-8 so the wizard renders on legacy Windows code pages.
+
+### Fixed
+
+- `configure_gemini()` now passes `transport="rest"` to `genai.configure(...)`. The default gRPC transport ignores an `https://` `api_endpoint`, so Gemini calls silently bypassed the proxy and were never logged. REST transport honours the proxy URL and sends the key as `x-goog-api-key`, which the proxy authenticates. Found during the CLI end-to-end smoke; OpenAI and Anthropic were already routing correctly.
+
+### Verified
+
+- 48 unit tests across env writing, project detection, install-target construction, the AST patcher (including Unicode-offset safety and validity of every emitted file), the key-info client (mocked with `respx`), and the end-to-end wizard in `--dry-run` / `--yes` modes.
+- Production smoke: the full wizard ran against `www.logify360.com`, validated a live key, and previewed then applied a real OpenAI patch.
+
+### Docs
+
+- The `/docs/cli` page now documents the Python CLI alongside the Node wizard, with install, walkthrough, before / after diffs for all three providers, and a flag reference.
+
+## 0.6.0
+
+LlamaIndex integration release. Drop `Logify360CallbackHandler` onto any LlamaIndex query engine, agent, or workflow and every `CBEventType` (LLM, RETRIEVE, EMBEDDING, FUNCTION_CALL, QUERY) becomes a typed Logify360 span with parent / child linkage matching the framework's per-event UUIDs.
+
+### Added
+
+- `logify360.integrations.llama_index.Logify360CallbackHandler` - subclasses LlamaIndex's `BaseCallbackHandler` so `Settings.callback_manager.add_handler(handler)` is the entire integration. Maps each event type to a Logify360 `span_type`, extracts token usage from the `response.raw.usage` shape OpenAI / LiteLLM / Anthropic LLM backends share, summarises retrieved nodes (count + top scores) instead of dumping full text, and truncates large inputs / outputs at 16 KB by default.
+- Optional dependency: `pip install "logify360[llama-index]"` (pulls in `llama-index-core>=0.10.0`). Also rolled into the `[all]` extra.
+- `llamaindex` / `llama-index` / `langgraph` keywords on the PyPI listing for discoverability.
+
+### Verified
+
+- 7 unit tests with `respx` mock the ingest HTTP layer and exercise event dispatch, parent linkage, exception handling, external-trace lifecycle, and retrieved-node summarisation. Run with `pytest tests/test_integrations_llama_index.py`.
+- An integration smoke script (`scripts/test_llama_index_integration.py`) drives a synthetic query through the real `CallbackManager` + `CBEventType` + `EventPayload` from `llama-index-core 0.14.22` and asserts the on-wire shape (trace POST + span POSTs + PATCHes). Setting `LOGIFY360_LIVE_URL` switches it to live mode against a real server.
+
+### Docs
+
+- New LlamaIndex docs page at `/docs/integrations/llamaindex` covering install, minimal setup, CBEventType → span_type mapping, trace-tree shape, long-lived trace lifecycle, proxy pairing for cost, and prompt-version linking.
+
+## 0.5.1
+
+PyPI metadata fixes + docs polish. No runtime API changes (already-shipped 0.5 features remain identical: `Logify360CallbackHandler` for LangChain / LangGraph, `observe_ollama`, async helpers, sampling).
+
+### Fixed
+
+- `Repository` and `Issues` URLs in `pyproject.toml` pointed at a stale GitHub org. PyPI sidebar links were 404. Updated to the correct org.
+
+### Added
+
+- New `[langchain]` optional dependency (`pip install "logify360[langchain]"` now pulls in `langchain-core>=0.1.0`). Also rolled into the `[all]` extra. The `Logify360CallbackHandler` already shipped in 0.5.0 but users had to install LangChain manually.
+- `ollama` keyword for PyPI search discoverability.
+- `Changelog` URL so the PyPI sidebar links straight to `CHANGELOG.md`.
+
+### Docs
+
+- New Ollama section in the README documenting `observe_ollama()` against a local Ollama via the OpenAI-compatible client.
+- New LangChain / LangGraph section showing the `Logify360CallbackHandler` plug-in pattern.
+- Em dash removal across the README and the package description for a cleaner read on the PyPI page.
+
+## 0.2.0
+
+Async-first integration release. Verifies the SDK behaves correctly under
+FastAPI / Django async views / asyncio.gather pipelines.
+
+- **New:** `create_async_openai()` returning an `openai.AsyncOpenAI` client
+  pre-configured for the Logify360 proxy. Drop-in for FastAPI handlers and
+  any `await client.chat.completions.create(...)` flow.
+- **New:** `create_async_anthropic()` returning an `anthropic.AsyncAnthropic`
+  client pre-configured for the Logify360 proxy.
+- **New:** test suite verifying `asyncio.gather` of 50 concurrent spans
+  preserves trace POST → span POST → span PATCH ordering with no orphaned
+  PATCH requests (the failure mode flagged by CLAUDE.md gotcha #10).
+- **New:** end-to-end FastAPI integration test (ASGI transport + respx
+  mocking) confirming the ASGI lifecycle is compatible with the SDK's
+  background thread pool.
+- No breaking changes - existing sync callers and `observe*()` async support
+  are unchanged.
+
+## 0.1.0
+
+Initial release of the Logify360 Python SDK.
+
+- `Logify360Client`, `TraceHandle`, `SpanHandle` - core tracing primitives
+- Context-manager support so `end()` is called automatically
+- `observe()`, `observe_openai()`, `observe_anthropic()`, `observe_gemini()`
+  - boilerplate-free helpers with auto-parsed usage
+- `create_openai()`, `create_anthropic()`, `create_gemini()`,
+  `configure_gemini()` - proxy-mode integrations
+- Background ingest with timeout + ordering guarantees so observability
+  never blocks user code or loses spans to race conditions
+- Sync **and** async callables supported by every `observe*()` helper