typedef-data-intelligence 0.35.0__tar.gz → 0.36.0__tar.gz

{typedef_data_intelligence-0.35.0 → typedef_data_intelligence-0.36.0}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.36.0](https://github.com/typedef-ai/typedef/compare/typedef-data-intelligence-v0.35.0...typedef-data-intelligence-v0.36.0) (2026-07-07)
+
+
+### Features
+
+* **observability:** enable local desktop span export (TD-3805) ([#1114](https://github.com/typedef-ai/typedef/issues/1114)) ([32cf196](https://github.com/typedef-ai/typedef/commit/32cf196272f658a639ef3d6ae9ce3599c79078eb))
+
+
+### Bug Fixes
+
+* **observability:** classify + clean customer data in retained/exported logs (TD-3825) ([#1107](https://github.com/typedef-ai/typedef/issues/1107)) ([cac553d](https://github.com/typedef-ai/typedef/commit/cac553d50a84275a734d198baca25a7290c6ab70))
+
 ## [0.35.0](https://github.com/typedef-ai/typedef/compare/typedef-data-intelligence-v0.34.0...typedef-data-intelligence-v0.35.0) (2026-07-06)
 
 

{typedef_data_intelligence-0.35.0 → typedef_data_intelligence-0.36.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: typedef-data-intelligence
-Version: 0.35.0
+Version: 0.36.0
 Summary: Unified lineage management and AI-powered analytics platform for dbt projects
 Project-URL: Homepage, https://typedef.ai
 Project-URL: Repository, https://github.com/typedef-ai/data-intelligence

{typedef_data_intelligence-0.35.0 → typedef_data_intelligence-0.36.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "typedef-data-intelligence"
-version = "0.35.0"
+version = "0.36.0"
 description = "Unified lineage management and AI-powered analytics platform for dbt projects"
 readme = "README.pypi.md"
 license = "LicenseRef-Proprietary"

{typedef_data_intelligence-0.35.0 → typedef_data_intelligence-0.36.0}/src/lineage/api/app.py

@@ -8,7 +8,6 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Optional
 
-import logfire
 import yaml
 from agent.api import shutdown_event
 from agent.api.profiles import (
@@ -37,6 +36,10 @@ from core.backends.unified_graph.surreal.reader import SurrealUnifiedGraphReader
 from fastapi import FastAPI, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
 from lineage.api.auth_context import resolve_user_context
+from lineage.observability.desktop_logfire import (
+    configure_desktop_logfire,
+    shutdown_desktop_logfire,
+)
 from lineage.utils.env import load_env_file
 from pydantic import ValidationError
 
@@ -396,9 +399,9 @@ async def lifespan(app: FastAPI):
     # If user opts out via the consent modal or Settings, takes effect on next launch.
     from lineage.api.desktop_setup import _read_telemetry_prefs
 
-    logfire_token = os.getenv("LOGFIRE_TOKEN")
-    if logfire_token and not _read_telemetry_prefs().get("telemetry_opted_out"):
-        logfire.configure(token=logfire_token, console=False)
+    configure_desktop_logfire(
+        telemetry_opted_out=bool(_read_telemetry_prefs().get("telemetry_opted_out"))
+    )
 
     # Startup: no maintained API route initializes the legacy state path.
     if _NEEDS_LEGACY_STATE:
@@ -759,6 +762,7 @@ async def lifespan(app: FastAPI):
         shutdown_shared_posthog_client()
     except Exception:
         logger.debug("Failed to shut down PostHog analytics client", exc_info=True)
+    shutdown_desktop_logfire()
 
     # Close standalone data backend (e.g. DuckDB file handle)
     standalone_db = getattr(app.state, "standalone_data_backend", None)

typedef_data_intelligence-0.36.0/src/lineage/observability/__init__.py

@@ -0,0 +1 @@
+"""Local observability helpers for the desktop backend."""

typedef_data_intelligence-0.36.0/src/lineage/observability/desktop_logfire.py

@@ -0,0 +1,97 @@
+"""Desktop Logfire setup with local trace export processors."""
+
+from __future__ import annotations
+
+import logging
+import os
+from typing import Final
+
+import logfire
+from opentelemetry.sdk.trace import SpanProcessor
+
+from lineage.observability.local_otlp_export import make_local_otlp_span_processor
+from lineage.observability.local_span_export import make_local_span_processor
+
+logger = logging.getLogger(__name__)
+
+_OTEL_EXPORTER_ENV_KEYS: Final = (
+    "OTEL_TRACES_EXPORTER",
+    "OTEL_METRICS_EXPORTER",
+    "OTEL_LOGS_EXPORTER",
+)
+_OTEL_REMOTE_EXPORT_ENV_KEYS: Final = (
+    *_OTEL_EXPORTER_ENV_KEYS,
+    "OTEL_EXPORTER_OTLP_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT",
+)
+_local_only_previous_otel_exporters: dict[str, str | None] | None = None
+
+
+def configure_desktop_logfire(*, telemetry_opted_out: bool) -> None:
+    """Configure cloud-gated Logfire and local desktop span processors."""
+    logfire_token = os.getenv("LOGFIRE_TOKEN") or None
+    span_processors = _desktop_span_processors()
+    send_to_logfire = logfire_token is not None and not telemetry_opted_out
+    if send_to_logfire:
+        logfire.configure(
+            token=logfire_token,
+            send_to_logfire=True,
+            console=False,
+            additional_span_processors=span_processors,
+        )
+        return
+
+    _disable_otel_exporters_for_local_only()
+    logfire.configure(
+        token=None,
+        send_to_logfire=False,
+        metrics=False,
+        console=False,
+        additional_span_processors=span_processors,
+    )
+
+
+def shutdown_desktop_logfire() -> None:
+    """Flush configured Logfire processors and restore local-only OTEL env changes."""
+    try:
+        logfire.shutdown()
+    except Exception:
+        logger.debug("Failed to shut down Logfire", exc_info=True)
+    finally:
+        _restore_local_only_otel_exporters()
+
+
+def _desktop_span_processors() -> list[SpanProcessor]:
+    processors: list[SpanProcessor] = [make_local_span_processor()]
+    local_otlp_processor = make_local_otlp_span_processor()
+    if local_otlp_processor is not None:
+        processors.append(local_otlp_processor)
+    return processors
+
+
+def _disable_otel_exporters_for_local_only() -> None:
+    global _local_only_previous_otel_exporters
+    if _local_only_previous_otel_exporters is not None:
+        _restore_local_only_otel_exporters()
+    if not any(os.getenv(key) for key in _OTEL_REMOTE_EXPORT_ENV_KEYS):
+        return
+    _local_only_previous_otel_exporters = {
+        key: os.environ.get(key) for key in _OTEL_EXPORTER_ENV_KEYS
+    }
+    for key in _OTEL_EXPORTER_ENV_KEYS:
+        os.environ[key] = "none"
+
+
+def _restore_local_only_otel_exporters() -> None:
+    global _local_only_previous_otel_exporters
+    previous_exporters = _local_only_previous_otel_exporters
+    if previous_exporters is None:
+        return
+    for key, value in previous_exporters.items():
+        if value is None:
+            os.environ.pop(key, None)
+        else:
+            os.environ[key] = value
+    _local_only_previous_otel_exporters = None

typedef_data_intelligence-0.36.0/src/lineage/observability/local_otlp_export.py

@@ -0,0 +1,109 @@
+"""Local OTLP/HTTP export for explicitly enabled desktop development traces."""
+
+from __future__ import annotations
+
+import ipaddress
+import os
+from typing import Final
+from urllib.parse import SplitResult, urlsplit, urlunsplit
+
+from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter
+from opentelemetry.sdk.trace.export import BatchSpanProcessor
+
+_LOCAL_OTLP_EXPORT_ENV: Final = "TYPEDEF_ENABLE_LOCAL_OTLP_EXPORT"
+_GENERIC_ENDPOINT_ENV: Final = "OTEL_EXPORTER_OTLP_ENDPOINT"
+_TRACES_ENDPOINT_ENV: Final = "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT"
+_GENERIC_PROTOCOL_ENV: Final = "OTEL_EXPORTER_OTLP_PROTOCOL"
+_TRACES_PROTOCOL_ENV: Final = "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL"
+_DEFAULT_TRACES_ENDPOINT: Final = "http://127.0.0.1:4318/v1/traces"
+_TRACES_PATH: Final = "/v1/traces"
+_HTTP_PROTOBUF_PROTOCOL: Final = "http/protobuf"
+_ENABLED_VALUES: Final = frozenset({"1", "true", "yes", "on"})
+_LOOPBACK_HOSTNAMES: Final = frozenset({"localhost"})
+_EXPORT_TIMEOUT_SECONDS: Final = 2.0
+
+
+def resolve_local_otlp_traces_endpoint() -> str | None:
+    """Resolve a loopback OTLP/HTTP traces endpoint from development env config."""
+    if not _local_otlp_export_enabled():
+        return None
+    if _resolved_protocol() != _HTTP_PROTOBUF_PROTOCOL:
+        return None
+    traces_endpoint = _clean_env(_TRACES_ENDPOINT_ENV)
+    if traces_endpoint is not None:
+        return _validated_loopback_endpoint(traces_endpoint)
+    generic_endpoint = _clean_env(_GENERIC_ENDPOINT_ENV)
+    if generic_endpoint is None:
+        return _DEFAULT_TRACES_ENDPOINT
+    return _validated_loopback_endpoint(_with_traces_path(generic_endpoint))
+
+
+def make_local_otlp_span_processor() -> BatchSpanProcessor | None:
+    """Create a local OTLP/HTTP span processor when development export is enabled."""
+    endpoint = resolve_local_otlp_traces_endpoint()
+    if endpoint is None:
+        return None
+    return BatchSpanProcessor(
+        OTLPSpanExporter(endpoint=endpoint, timeout=_EXPORT_TIMEOUT_SECONDS)
+    )
+
+
+def _local_otlp_export_enabled() -> bool:
+    value = _clean_env(_LOCAL_OTLP_EXPORT_ENV)
+    return value is not None and value.lower() in _ENABLED_VALUES
+
+
+def _resolved_protocol() -> str:
+    traces_protocol = _clean_env(_TRACES_PROTOCOL_ENV)
+    if traces_protocol is not None:
+        return traces_protocol.lower()
+    generic_protocol = _clean_env(_GENERIC_PROTOCOL_ENV)
+    if generic_protocol is not None:
+        return generic_protocol.lower()
+    return _HTTP_PROTOBUF_PROTOCOL
+
+
+def _clean_env(key: str) -> str | None:
+    value = os.getenv(key)
+    if value is None:
+        return None
+    clean_value = value.strip()
+    if clean_value:
+        return clean_value
+    return None
+
+
+def _with_traces_path(endpoint: str) -> str:
+    parsed = urlsplit(endpoint)
+    clean_path = parsed.path.rstrip("/")
+    if clean_path.endswith(_TRACES_PATH):
+        return endpoint
+    traces_path = f"{clean_path}{_TRACES_PATH}" if clean_path else _TRACES_PATH
+    return urlunsplit(
+        SplitResult(
+            scheme=parsed.scheme,
+            netloc=parsed.netloc,
+            path=traces_path,
+            query=parsed.query,
+            fragment=parsed.fragment,
+        )
+    )
+
+
+def _validated_loopback_endpoint(endpoint: str) -> str | None:
+    parsed = urlsplit(endpoint)
+    if parsed.scheme not in {"http", "https"}:
+        return None
+    if parsed.username is not None or parsed.password is not None:
+        return None
+    if parsed.query or parsed.fragment:
+        return None
+    hostname = parsed.hostname
+    if hostname is None:
+        return None
+    if hostname.lower() in _LOOPBACK_HOSTNAMES:
+        return endpoint
+    try:
+        return endpoint if ipaddress.ip_address(hostname).is_loopback else None
+    except ValueError:
+        return None

typedef_data_intelligence-0.36.0/src/lineage/observability/local_span_export.py

@@ -0,0 +1,62 @@
+"""OpenTelemetry span export for local desktop traces."""
+
+from __future__ import annotations
+
+import os
+import threading
+import time
+from collections.abc import Sequence
+from pathlib import Path
+from typing import Final
+
+from core.paths import logs_dir
+from opentelemetry.sdk.trace.export import (
+    BatchSpanProcessor,
+    ReadableSpan,
+    SpanExporter,
+    SpanExportResult,
+)
+
+_TRACE_FILE_PREFIX: Final = "spans"
+
+
+class NdjsonFileSpanExporter(SpanExporter):
+    """Write OpenTelemetry spans to a per-process NDJSON file."""
+
+    def __init__(self, traces_dir: Path) -> None:
+        """Create an exporter rooted at the configured traces directory."""
+        self._traces_dir = traces_dir
+        self._path = (
+            traces_dir / f"{_TRACE_FILE_PREFIX}-{os.getpid()}-{time.time_ns()}.ndjson"
+        )
+        self._lock = threading.Lock()
+        self._closed = False
+
+    def export(self, spans: Sequence[ReadableSpan]) -> SpanExportResult:
+        """Append spans as one JSON object per line."""
+        with self._lock:
+            if self._closed:
+                return SpanExportResult.FAILURE
+            try:
+                self._traces_dir.mkdir(parents=True, exist_ok=True)
+                with self._path.open("a", encoding="utf-8") as trace_file:
+                    for span in spans:
+                        trace_file.write(span.to_json(indent=None))
+                        trace_file.write("\n")
+            except (OSError, TypeError, ValueError):
+                return SpanExportResult.FAILURE
+        return SpanExportResult.SUCCESS
+
+    def shutdown(self) -> None:
+        """Stop accepting new spans."""
+        with self._lock:
+            self._closed = True
+
+    def force_flush(self, timeout_millis: int = 30000) -> bool:
+        """Report that file writes are already flushed."""
+        return True
+
+
+def make_local_span_processor() -> BatchSpanProcessor:
+    """Create the always-on local span processor for desktop startup."""
+    return BatchSpanProcessor(NdjsonFileSpanExporter(logs_dir() / "traces"))

{typedef_data_intelligence-0.35.0 → typedef_data_intelligence-0.36.0}/src/lineage/utils/git.py

@@ -10,6 +10,8 @@ from collections.abc import AsyncIterator
 from dataclasses import dataclass
 from pathlib import Path
 
+from core.models.observability import sanitize_diagnostic_text
+
 logger = logging.getLogger(__name__)
 
 
@@ -69,7 +71,6 @@ class CloneProgress:
 # Regex to parse git progress lines like:
 # "Receiving objects:  67% (835/1247)"
 _PROGRESS_RE = re.compile(r"(Counting|Compressing|Receiving|Resolving)[^:]*:\s*(\d+)%")
-_URL_CREDENTIALS_RE = re.compile(r"(?P<scheme>https?://)(?:[^/\s@]+(?::[^/\s@]*)?@)")
 
 
 def _handle_clone_stderr_line(
@@ -91,19 +92,36 @@ def _handle_clone_stderr_line(
 
 
 def _build_clone_failure_message(stderr_lines: list[str], exit_code: int) -> str:
-    """Return the cleaned clone failure text to surface to callers."""
+    """Return the clone failure text to surface to callers.
+
+    Credential shapes are stripped here (TD-3825) so every downstream consumer
+    inherits clean text: the raised ``RuntimeError``, the error ``CloneProgress``
+    event, the ``logger.debug`` full-stderr line, and anything that logs the
+    exception into ``sync.log`` / ``quickstart.log`` / ``backend-stdout.log``.
+    A token-bearing remote URL (``https://TOKEN@host/repo.git``) never reaches
+    disk from this path.
+    """
     stderr_detail = "\n".join(line.strip() for line in stderr_lines if line.strip())
-    return stderr_detail or f"git clone failed (exit {exit_code})"
+    if not stderr_detail:
+        return f"git clone failed (exit {exit_code})"
+    sanitized, _ = sanitize_diagnostic_text(stderr_detail)
+    return sanitized
 
 
 def _build_clone_failure_log_summary(stderr_message: str, exit_code: int) -> str:
-    """Return a redacted one-line summary safe for error logs."""
+    """Return a one-line summary safe for error logs.
+
+    ``stderr_message`` is already credential-stripped by
+    :func:`_build_clone_failure_message`; this re-runs the sanitizer defensively
+    in case a caller passes raw text.
+    """
     first_line = next(
         (line.strip() for line in stderr_message.splitlines() if line.strip()), ""
     )
     if not first_line:
         return f"git clone failed (exit {exit_code})"
-    return _URL_CREDENTIALS_RE.sub(r"\g<scheme>", first_line)
+    sanitized, _ = sanitize_diagnostic_text(first_line)
+    return sanitized
 
 
 async def clone_repo_with_progress(

typedef_data_intelligence-0.36.0/tests/api/test_app_logfire.py

@@ -0,0 +1,257 @@
+from __future__ import annotations
+
+import json
+import os
+from collections.abc import Iterator, Sequence
+from pathlib import Path
+from typing import NotRequired, TypedDict, Unpack
+
+import core.paths as core_paths
+import pytest
+from opentelemetry.context import Context
+from opentelemetry.sdk.trace import ReadableSpan, SpanProcessor, TracerProvider
+from opentelemetry.sdk.trace.export import SpanExportResult
+from opentelemetry.trace import Span
+
+_OTEL_TEST_ENV_KEYS = (
+    "TYPEDEF_ENABLE_LOCAL_OTLP_EXPORT",
+    "OTEL_EXPORTER_OTLP_PROTOCOL",
+    "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL",
+    "OTEL_EXPORTER_OTLP_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT",
+    "OTEL_TRACES_EXPORTER",
+    "OTEL_METRICS_EXPORTER",
+    "OTEL_LOGS_EXPORTER",
+)
+
+
+class LogfireConfigureCall(TypedDict):
+    additional_span_processors: Sequence[SpanProcessor]
+    console: bool
+    send_to_logfire: bool
+    token: NotRequired[str | None]
+
+
+@pytest.fixture(autouse=True)
+def restore_desktop_logfire_env(
+    monkeypatch: pytest.MonkeyPatch,
+) -> Iterator[None]:
+    from lineage.observability import desktop_logfire
+
+    desktop_logfire._restore_local_only_otel_exporters()
+    for key in _OTEL_TEST_ENV_KEYS:
+        monkeypatch.delenv(key, raising=False)
+    yield
+    desktop_logfire._restore_local_only_otel_exporters()
+
+
+def _set_typedef_home(monkeypatch, tmp_path: Path) -> Path:
+    home = tmp_path / "typedef-home"
+    monkeypatch.setenv("TYPEDEF_DEV_MODE", "1")
+    monkeypatch.setenv("TYPEDEF_HOME", str(home))
+    core_paths.typedef_home.cache_clear()
+    return home
+
+
+def _capture_logfire_configure(monkeypatch) -> list[LogfireConfigureCall]:
+    from lineage.observability import desktop_logfire
+
+    calls: list[LogfireConfigureCall] = []
+
+    def fake_configure(**kwargs: Unpack[LogfireConfigureCall]) -> None:
+        calls.append(kwargs)
+
+    monkeypatch.setattr(desktop_logfire.logfire, "configure", fake_configure)
+    return calls
+
+
+class RecordingSpanProcessor(SpanProcessor):
+    def on_start(self, span: Span, parent_context: Context | None = None) -> None:
+        return
+
+    def on_end(self, span: ReadableSpan) -> None:
+        return
+
+    def shutdown(self) -> None:
+        return
+
+    def force_flush(self, timeout_millis: int = 30000) -> bool:
+        return True
+
+
+class CapturingSpanProcessor(SpanProcessor):
+    def __init__(self) -> None:
+        self.spans: list[ReadableSpan] = []
+
+    def on_start(self, span: Span, parent_context: Context | None = None) -> None:
+        return
+
+    def on_end(self, span: ReadableSpan) -> None:
+        self.spans.append(span)
+
+    def shutdown(self) -> None:
+        return
+
+    def force_flush(self, timeout_millis: int = 30000) -> bool:
+        return True
+
+
+def test_ndjson_file_span_exporter_writes_sdk_span(tmp_path: Path) -> None:
+    from lineage.observability.local_span_export import NdjsonFileSpanExporter
+
+    processor = CapturingSpanProcessor()
+    provider = TracerProvider()
+    provider.add_span_processor(processor)
+    tracer = provider.get_tracer(__name__)
+
+    with tracer.start_as_current_span("typedef-test-span"):
+        pass
+
+    traces_dir = tmp_path / "traces"
+    exporter = NdjsonFileSpanExporter(traces_dir)
+
+    assert exporter.export(processor.spans) is SpanExportResult.SUCCESS
+    trace_files = list(traces_dir.glob("spans-*.ndjson"))
+    assert len(trace_files) == 1
+    lines = trace_files[0].read_text(encoding="utf-8").splitlines()
+    assert len(lines) == 1
+    assert json.loads(lines[0])["name"] == "typedef-test-span"
+
+
+def test_configures_local_span_export_when_logfire_token_is_absent(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from lineage.observability import desktop_logfire
+
+    _set_typedef_home(monkeypatch, tmp_path)
+    monkeypatch.delenv("LOGFIRE_TOKEN", raising=False)
+    calls = _capture_logfire_configure(monkeypatch)
+
+    desktop_logfire.configure_desktop_logfire(telemetry_opted_out=False)
+
+    assert len(calls) == 1
+    assert calls[0]["send_to_logfire"] is False
+    assert calls[0]["token"] is None
+    assert calls[0]["console"] is False
+    assert len(calls[0]["additional_span_processors"]) == 1
+
+
+def test_local_only_configuration_suppresses_env_otlp_exporters(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from lineage.observability import desktop_logfire
+
+    _set_typedef_home(monkeypatch, tmp_path)
+    monkeypatch.delenv("LOGFIRE_TOKEN", raising=False)
+    monkeypatch.setenv("OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", "https://otel.example")
+    monkeypatch.setenv("OTEL_TRACES_EXPORTER", "otlp")
+    monkeypatch.setenv("OTEL_METRICS_EXPORTER", "otlp")
+    monkeypatch.setenv("OTEL_LOGS_EXPORTER", "otlp")
+    observed_exporters: list[tuple[str | None, str | None, str | None]] = []
+
+    def fake_configure(**kwargs: Unpack[LogfireConfigureCall]) -> None:
+        observed_exporters.append(
+            (
+                os.getenv("OTEL_TRACES_EXPORTER"),
+                os.getenv("OTEL_METRICS_EXPORTER"),
+                os.getenv("OTEL_LOGS_EXPORTER"),
+            )
+        )
+
+    monkeypatch.setattr(desktop_logfire.logfire, "configure", fake_configure)
+    monkeypatch.setattr(desktop_logfire.logfire, "shutdown", lambda: None)
+
+    desktop_logfire.configure_desktop_logfire(telemetry_opted_out=False)
+
+    assert observed_exporters == [("none", "none", "none")]
+    assert os.getenv("OTEL_TRACES_EXPORTER") == "none"
+    assert os.getenv("OTEL_METRICS_EXPORTER") == "none"
+    assert os.getenv("OTEL_LOGS_EXPORTER") == "none"
+
+    desktop_logfire.shutdown_desktop_logfire()
+
+    assert os.getenv("OTEL_TRACES_EXPORTER") == "otlp"
+    assert os.getenv("OTEL_METRICS_EXPORTER") == "otlp"
+    assert os.getenv("OTEL_LOGS_EXPORTER") == "otlp"
+
+
+def test_local_only_configuration_adds_explicit_local_otlp_processor(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from lineage.observability import desktop_logfire
+
+    _set_typedef_home(monkeypatch, tmp_path)
+    local_otlp_processor = RecordingSpanProcessor()
+    monkeypatch.delenv("LOGFIRE_TOKEN", raising=False)
+    monkeypatch.setenv("TYPEDEF_ENABLE_LOCAL_OTLP_EXPORT", "1")
+    monkeypatch.setenv("OTEL_EXPORTER_OTLP_ENDPOINT", "http://127.0.0.1:4318")
+    monkeypatch.setenv("OTEL_TRACES_EXPORTER", "otlp")
+    monkeypatch.setattr(
+        desktop_logfire,
+        "make_local_otlp_span_processor",
+        lambda: local_otlp_processor,
+    )
+    calls = _capture_logfire_configure(monkeypatch)
+
+    desktop_logfire.configure_desktop_logfire(telemetry_opted_out=False)
+
+    assert len(calls) == 1
+    assert calls[0]["send_to_logfire"] is False
+    assert calls[0]["additional_span_processors"][1] is local_otlp_processor
+    assert os.getenv("OTEL_TRACES_EXPORTER") == "none"
+
+
+def test_configures_cloud_and_local_span_export_with_token_and_consent(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from lineage.observability import desktop_logfire
+
+    _set_typedef_home(monkeypatch, tmp_path)
+    monkeypatch.setenv("LOGFIRE_TOKEN", "test-token")
+    calls = _capture_logfire_configure(monkeypatch)
+
+    desktop_logfire.configure_desktop_logfire(telemetry_opted_out=False)
+
+    assert len(calls) == 1
+    assert calls[0]["send_to_logfire"] is True
+    assert calls[0]["token"] == "test-token"
+    assert calls[0]["console"] is False
+    assert len(calls[0]["additional_span_processors"]) == 1
+
+
+def test_configures_local_only_when_token_exists_but_user_opted_out(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from lineage.observability import desktop_logfire
+
+    _set_typedef_home(monkeypatch, tmp_path)
+    monkeypatch.setenv("LOGFIRE_TOKEN", "test-token")
+    calls = _capture_logfire_configure(monkeypatch)
+
+    desktop_logfire.configure_desktop_logfire(telemetry_opted_out=True)
+
+    assert len(calls) == 1
+    assert calls[0]["send_to_logfire"] is False
+    assert calls[0]["token"] is None
+    assert calls[0]["console"] is False
+    assert len(calls[0]["additional_span_processors"]) == 1
+
+
+def test_shutdown_flushes_desktop_logfire(monkeypatch) -> None:
+    from lineage.observability import desktop_logfire
+
+    shutdown_calls: list[bool] = []
+
+    def fake_shutdown() -> None:
+        shutdown_calls.append(True)
+
+    monkeypatch.setattr(desktop_logfire.logfire, "shutdown", fake_shutdown)
+
+    desktop_logfire.shutdown_desktop_logfire()
+
+    assert shutdown_calls == [True]