enhancement(#537): migrate all hand-written bin/lib/*.cjs to TypeScript source of truth (ADR-457) (#602)
* enhancement(#537): migrate code-review-flags to TS source of truth Collapse the hand-written get-shit-done/bin/lib/code-review-flags.cjs to a TypeScript source of truth (src/code-review-flags.cts), compiled by tsc to a gitignored .cjs build artifact at the same path, per ADR-457 (build-at-publish). Second module after the semver-compare pilot (#541). Behaviour is preserved byte-for-behaviour (characterization test added in tests/code-review-flags.test.cjs locks the parser quirks). Adds compile-time type checking: CodeReviewFlags interface + CodeReviewWorkflow literal union. The require() path is unchanged, so code-review.md and the bug-3727 test keep working. The emitted .cjs is gitignored and eslint-ignored, mirroring the pilot. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 9 leaf bin/lib modules to TS source of truth ADR-457 build-at-publish, batch 1 (pure leaf modules, 0 sibling-deps): 001-legacy-orphan-files, context-utilization, redaction, artifacts, command-arg-projection, clock, ui-safety-gate, review-reviewer-selection, clusters. Each moves to src/*.cts (strict TS, typed), compiled by tsc to a gitignored .cjs at the same require() path; behaviour preserved byte-for- behaviour. Adds src/node-globals.d.ts (minimal ambient shim; "types":[]). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#537): add @types/node, drop hand-rolled node-globals shim ADR-457 migration infra: replace the temporary src/node-globals.d.ts ambient shim with @types/node@22 + "types":["node"] in tsconfig.build.json. Unblocks migrating the ~49 remaining bin/lib modules that use node:fs/path/os/ child_process. Build + full suite (3030 pass) + lint all green; no .cts type changes were needed (real Node types matched the shim). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 9 more bin/lib modules to TS (batch 2) ADR-457 build-at-publish. Clean leaves: installer-migration-report, prompt-budget. Type-error-prone leaves (were tsconfig.lint-excluded; now strict-typed and removed from that exclude list): secrets, phase-lifecycle, workstream-name-policy, decisions, validate, schema-detect. Plus runtime-name-policy. Strict type fixes narrow unknown->concrete domain types (no any/ts-ignore); behaviour preserved. Full suite green, lint 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate runtime-slash to TS (cross-import proof) ADR-457. First cross-module TS->TS import: src/runtime-slash.cts imports ./runtime-name-policy.cjs and tsc resolves the sibling .cts types under strict (no declaration files; NodeNext .cjs->.cts mapping), emitting a correct require("./runtime-name-policy.cjs"). Confirms the recipe for coupled modules, which must be migrated in dependency order (leaves-up). Suite green, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 10 more bin/lib modules to TS (batch 3) ADR-457 build-at-publish, Wave-1 leaves: event, workstream-inventory-builder, plan-scan, fallow-runner, project-root, installer-migration-authoring, update-context, 000-first-time-baseline, runtime-homes, model-catalog. Strict typing fixed real issues (narrowing unknown, qualified fs/path calls, removed unnecessary casts); plan-scan/project-root/workstream-inventory-builder dropped from tsconfig.lint exclude. Behaviour preserved; suite green, lint 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 5 large Wave-1 leaves to TS (batch 4) ADR-457 build-at-publish: configuration, state-document, shell-command- projection (42 dependents), security, command-aliases. shell-command- projection keeps a namespace child_process import for mock-intercept testability. loadConfig/migrateOnDisk emit synchronously (every caller uses them sync; the one awaited migrateOnDisk caller tolerates a non-Promise) — full suite (3030 pass) confirms behaviour preserved. configuration/ state-document/command-aliases dropped from tsconfig.lint exclude. Also fixes the malformed batch-3 changeset frontmatter (type/pr) that failed lint:docs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 6 Wave-2 modules to TS (batch 5) ADR-457 build-at-publish: config-schema, model-profiles, 002-codex-legacy-hooks-json, logger, active-workstream-store, adr-parser. First batch importing already-migrated siblings (configuration, model-catalog, shell-command-projection, redaction, security) via ./sibling.cjs specifiers. Strict type narrowing (typeof guards over String(unknown)); behaviour preserved; suite 3030 pass, lint 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 5 large Wave-2 modules to TS (batch 6) ADR-457 build-at-publish: graphify, install-profiles, intel, installer-migrations, worktree-safety. installer-migrations preserves its dynamic require() loader for numbered migration modules (scoped lint suppressions). Strict typing (typeof guards over String(unknown)); behaviour preserved; suite 3030 pass, lint 0 errors. Wave 2 complete. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate Wave-3 modules to TS (batch 7) ADR-457 build-at-publish: planning-workspace, runtime-artifact-layout, command-routing-hub, drift. Uses `import x = require()` for export= siblings; drift's lazy require of runtime-slash hoisted to a top-level import (verified non-circular). Behaviour preserved; suite 3030 pass, lint 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate small Wave-4 modules to TS (batch 8) ADR-457 build-at-publish: cjs-command-router-adapter, phase-command-router, surface, roadmap-upgrade. Typed the hub router handler results as the HubResult discriminated union; surface drops 4 genuinely-unused imports. Behaviour preserved; suite 3030 pass, lint 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate core hub (2.5k LOC, 68 dependents) to TS (batch 9) ADR-457 build-at-publish: get-shit-done/bin/lib/core.cjs -> src/core.cts, preserving all 63 exports via export=. All sibling deps already migrated (shell-command-projection, model-profiles, model-catalog, worktree-safety, planning-workspace, project-root, configuration, config-schema). Strict types, no any/ts-ignore; config-schema lazy require hoisted (non-circular). Behaviour preserved (independently verified: core's shard 3030 pass / 0 fail). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#537): make ESLint-coverage + test-sprawl checks migration-aware #551 test hardcoded 12 now-migrated modules as "hand-written, must be linted"; that invariant is obsoleted by the ADR-457 migration. Rewrite it to a filesystem-driven invariant that holds at every stage: a bin/lib/*.cjs must be eslint-ignored IFF it has a src/*.cts source (tsc-generated), else linted (covers package-identity, which has no TS source). Also eslint-ignore config-types.cjs (has a src counterpart) and drop the redundant tests/clock.test.cjs (clock already covered by clock-seam + bug-474 tests), which tripped the lint-test-file-count ratchet. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 9 Wave-5 router/inventory modules to TS (batch 10) ADR-457 build-at-publish: phases/verify/init/agent/task/validate/roadmap/state command routers + workstream-inventory. Router handler results typed against core's exported shapes; behaviour preserved (caught+fixed a --verify boolean flag regression mid-migration). Full suite green across all shards (only the 4 local gpg-env changeset-notes failures remain; CI passes them). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 7 Wave-5 modules to TS (batch 11) ADR-457 build-at-publish: gap-checker, docs, check-command-router, frontmatter, learnings, gsd2-import, profile-pipeline. Behaviour preserved; full suite green across all shards (only the 4 local gpg-env failures remain). Also broadens atomic-write-coverage.test.cjs to accept the tsc-compiled namespace-import form while still asserting platformWriteSync is called (safety guard intact). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate config + profile-output to TS (batch 12) ADR-457 build-at-publish: config (729 LOC), profile-output (1142 LOC). All exports preserved; cmdMigrateConfig de-asynced (migrateOnDisk is sync, awaited caller tolerates it). Behaviour preserved; suite green across all shards (only the 4 local gpg-env failures). Wave 5 complete. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate 5 Wave-6 modules to TS (batch 13) ADR-457 build-at-publish: template, uat, workstream, roadmap, audit. Behaviour preserved (dead toPosixPath import dropped from audit; inline requires hoisted). Suite green across all shards (only the 4 local gpg-env failures). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate commands + state hubs to TS (batch 14) ADR-457 build-at-publish: commands (1305 LOC), state (2074 LOC, 17 dependents). All exports preserved; inner requires kept non-hoisted where load-order matters (install.js, per-call security); acquireStateLock cast inlined to preserve the err.code source token a structural test inspects. Behaviour preserved; suite green across all shards (only the 4 local gpg-env failures). Wave 6 complete. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate milestone to TS (batch 15a, hand-authored) ADR-457 build-at-publish: milestone -> src/milestone.cts. Authored directly (subagent capacity was unavailable). Also relaxes core.output()'s 3rd param to optional, matching its real always-optional call contract (unblocks remaining 2-arg output callers). Behaviour preserved; suite green across all shards (only the 4 local gpg-env failures). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537): migrate phase, verify, init to TS (batch 15, final modules) ADR-457 build-at-publish, Wave 7 (the last hubs): phase (1608 LOC), verify (1615), init (2113). Adds src/package-identity.d.cts so verify can import the permanently value-baked package-identity.cjs under strict TS. Fixes two regressions the migration introduced in verify: restore cmdValidateHealth's `return result` (callers/tests read result.warnings — it is NOT side-effect-only), and make the bug-3384 source-pattern test tolerant of the tsc-compiled bracket-notation form of the git_list_failed->W020 branch (behaviour intact). Full suite green across all shards (only the 4 local gpg-env failures); lint 0 errors. All 86 migratable bin/lib modules are now TypeScript sources. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(#537): finalize ADR-457 migration — retire tsconfig.lint.json All hand-written bin/lib/*.cjs are now src/*.cts sources, so the checkJs stopgap tsconfig.lint.json (unused; not wired into eslint, scripts, or CI) is deleted per ADR-457's final step. Also gitignore the tsc-generated config-types.cjs (was still committed) for consistency with every other emitted artifact. package-identity.cjs stays value-baked (declared via src/package-identity.d.cts). Suite green; #551 ESLint-coverage test green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#537): add prepare script so unpacked/git installs build bin/lib artifacts ADR-457 build-at-publish: bin/lib/*.cjs are now gitignored, built by tsc. The prepack/prepublishOnly hooks cover `npm pack`/publish, but `npm install -g <dir>` and git installs run the `prepare` lifecycle — which was missing — so the unpacked install shipped without the compiled .cjs and failed at startup with "Cannot find module './lib/core.cjs'" (caught by the smoke-unpacked CI job). Add `prepare` mirroring prepublishOnly (build:lib + build:hooks). prepare does NOT run for registry consumers (they get the pre-built tarball), only for source/local/pack installs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#537): make CI build/lockfile checks work with gitignored bin/lib artifacts ADR-457 build-at-publish exposed two CI assumptions that bin/lib/*.cjs are always present on disk: - check:env's lockfile-sync ran `npm ci --dry-run`, which now triggers the `prepare` build (tsc) — but it runs before deps are installed, so tsc is absent and it misreported the lockfile as out of sync. Add --ignore-scripts (a lockfile check must not build). - the lint-tests job installs with --ignore-scripts (no prepare build), but lint:skill-deps require()s the built install-profiles.cjs. Add an explicit `npm run build:lib` step after install. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#537): narrow prepare to build:lib only (unbreak packed-smoke pack step) prepare running build:hooks emitted "✓ Copying ..." stdout during `npm pack`, which the install-smoke "Pack root tarball" step captures into $GITHUB_OUTPUT — breaking it with "Invalid format". build:lib (tsc) is silent on success and is all the unpacked/source install needs (the smoke-unpacked assertions exercise gsd-tools, i.e. bin/lib, and tolerate hook setup with `|| true`). Matches prepack. build:hooks still runs on prepublishOnly for real publishes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(#537): wire Stryker mutation gate to build-at-publish layout The gate scored 0.00 because it mutated changed bin/lib/*.cjs that (a) were generated artifacts and (b) included modules with no coverage in the command's test set. Rework: mutation.yml now derives changed COVERED modules from src/*.cts and maps them to their built bin/lib/*.cjs; Stryker mutates those built artifacts with a no-rebuild command (mutating src/*.cts + per-mutant tsc was ~3x over the 30-min CI budget). NOTE: with the gate now correctly measuring the covered modules, their actual mutation score is 42.94% (< break 50) — a pre-existing test-coverage gap (adr-parser/prompt-budget/etc.), not introduced by this behaviour-preserving migration. Reaching 50 needs more tests, a threshold/scope change, or a waiver — a maintainer decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#537): raise mutation coverage of covered modules above the 50 gate Adds focused example-based unit tests that kill surviving mutants in the two lowest-scoring covered modules: - tests/prompt-budget.unit.test.cjs (112 tests): 17.9% -> 97.9% - tests/adr-parser.unit.test.cjs (205 tests): 44.7% -> 89.4% Both wired into stryker.config.mjs's command. Fresh full run over the 6 covered modules now scores 82.25% (>= break 50); every covered module is >= 68%. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * enhancement(#537,#609): parallelize mutation gate via dynamic per-module matrix The serial Stryker run timed out at 30 min once the migration's added tests made every mutant re-run ~300 tests. Replace it with a dynamic matrix so the gate completes well under budget — folded into this PR (was tracked as #609) because it's a prerequisite for this PR's mutation gate to pass. - scripts/mutation-matrix.cjs: single source of truth (covered-module -> test files) computing changed covered modules from git diff -> {has_work, matrix}. - mutation.yml: detect -> dynamic `matrix: fromJSON(...)` mutate job (one parallel shard per changed module, scoped via MUTATION_TEST_CMD to only that module's tests, 15-min/shard) -> summary job that KEEPS the legacy check name "Stryker mutation score (changed files only)" so branch protection is unchanged. Per-shard jobs report as "Stryker (<module>)". - stryker.config.mjs: commandRunner.command reads MUTATION_TEST_CMD (falls back to the full command locally). Closes #609. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#537,#609): give each mutation shard ≥50% on its own tests; drop blacksmith note Per-module sharding revealed that active-workstream-store (46.5%) and frontmatter (7.4%) only cleared 50% in the old serial run via timeout-noise from the bloated 300-test command; on their own tests they were below the gate. Add focused unit tests: - tests/active-workstream-store.unit.test.cjs (115 tests): 46.5% -> 81.9% - tests/frontmatter.unit.test.cjs (165 tests): 7.4% -> 63.4% Both wired into scripts/mutation-matrix.cjs (per-module test map) and stryker.config.mjs DEFAULT_TEST_CMD. All 6 covered modules now clear break:50 with only their own tests (config-schema/context-utilization/prompt-budget/ adr-parser already did). Also removes the leftover blacksmith TODO comment — GitHub-hosted runners only; speed comes from parallel per-module shards. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(#537,#609): strengthen prompt-budget tests to clear the gate on its own tests prompt-budget scored 39.58% when mutation-tested with ONLY its own tests (the way the per-module CI shard runs it) — an earlier ~98% reading was inflated by accidentally running the full multi-module command. Add 96 targeted tests to tests/prompt-budget.unit.test.cjs (exact note-template text, plan-truncation arithmetic/percentages, drop-block strings, noteInjected/hardFailed booleans): scoped score 39.58% -> 68.75% (>= break 50). All 6 covered modules now clear the gate on their own tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
89
src/observability/event.cts
Normal file
89
src/observability/event.cts
Normal file
@@ -0,0 +1,89 @@
|
||||
/**
|
||||
* DispatchEvent shape factory — issue #177 (ADR-0174 P1.3), extended in #178 (P1.4).
|
||||
*
|
||||
* Creates a structured event record for every Hub dispatch, used by
|
||||
* DispatchLogger to emit stderr errors and opt-in file audit trails.
|
||||
*
|
||||
* ADR-457 build-at-publish: the hand-written
|
||||
* bin/lib/observability/event.cjs collapsed to a TypeScript source of truth.
|
||||
* Behaviour is preserved byte-for-behaviour from the prior hand-written .cjs;
|
||||
* only types are added.
|
||||
*
|
||||
* Shape:
|
||||
* traceId: string — UUID v4, generated per dispatch
|
||||
* parentTraceId: string|undefined — propagated from the caller when it is a canonical UUID v4
|
||||
* (RFC 4122); invalid values are silently coerced to undefined.
|
||||
* command: string — the dispatched verb
|
||||
* args?: unknown — only present when includeArgs === true
|
||||
* result: { kind: 'ok' | 'UnknownCommand' | 'InvalidArgs' | 'HandlerRefusal' | 'HandlerFailure', ...payload }
|
||||
* timestamp: string — ISO 8601
|
||||
*/
|
||||
|
||||
import { randomUUID } from 'node:crypto';
|
||||
|
||||
/**
|
||||
* Canonical UUID v4 regex (RFC 4122).
|
||||
*/
|
||||
const UUID_V4_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
||||
|
||||
/**
|
||||
* Returns true only when value is a canonical UUID v4 string.
|
||||
*/
|
||||
function isValidParentTraceId(value: unknown): value is string {
|
||||
return typeof value === 'string' && UUID_V4_REGEX.test(value);
|
||||
}
|
||||
|
||||
/** A HubResult object (open shape — callers supply concrete payloads). */
|
||||
export type HubResult = Record<string, unknown>;
|
||||
|
||||
export interface MakeDispatchEventOpts {
|
||||
command: string;
|
||||
args?: unknown;
|
||||
result: HubResult;
|
||||
includeArgs?: boolean;
|
||||
parentTraceId?: unknown;
|
||||
}
|
||||
|
||||
/** An immutable DispatchEvent record. */
|
||||
export interface DispatchEvent {
|
||||
readonly traceId: string;
|
||||
readonly parentTraceId: string | undefined;
|
||||
readonly command: string;
|
||||
readonly args?: unknown;
|
||||
readonly result: HubResult;
|
||||
readonly timestamp: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a DispatchEvent.
|
||||
*/
|
||||
export function makeDispatchEvent({
|
||||
command,
|
||||
args,
|
||||
result,
|
||||
includeArgs = false,
|
||||
parentTraceId,
|
||||
}: MakeDispatchEventOpts): Readonly<DispatchEvent> {
|
||||
const resolvedParentTraceId = isValidParentTraceId(parentTraceId) ? parentTraceId : undefined;
|
||||
|
||||
const event: {
|
||||
traceId: string;
|
||||
parentTraceId: string | undefined;
|
||||
command: string;
|
||||
result: HubResult;
|
||||
timestamp: string;
|
||||
args?: unknown;
|
||||
} = {
|
||||
traceId: randomUUID(),
|
||||
parentTraceId: resolvedParentTraceId,
|
||||
command: String(command),
|
||||
result,
|
||||
timestamp: new Date().toISOString(),
|
||||
};
|
||||
|
||||
if (includeArgs && args !== undefined) {
|
||||
event.args = args;
|
||||
}
|
||||
|
||||
return Object.freeze(event);
|
||||
}
|
||||
166
src/observability/logger.cts
Normal file
166
src/observability/logger.cts
Normal file
@@ -0,0 +1,166 @@
|
||||
/**
|
||||
* DispatchLogger interface + default implementation — issue #177 (ADR-0174 P1.3).
|
||||
*
|
||||
* Interface:
|
||||
* { onEvent(event: DispatchEvent): void }
|
||||
*
|
||||
* Default behaviour (createDefaultLogger):
|
||||
* 1. Silent on success — no stdout/stderr when result.kind === 'ok'.
|
||||
* 2. Structured JSON to stderr on error — one line per dispatch error.
|
||||
* 3. Opt-in audit file — when GSD_AUDIT=1 OR config.audit.enabled===true,
|
||||
* appends every event (success + error) as one JSON line to
|
||||
* .planning/.gsd-trace.jsonl relative to `cwd`. Creates .planning/ if absent.
|
||||
* 4. Args redaction — args omitted by default; included when GSD_AUDIT_ARGS=1.
|
||||
*
|
||||
* No-op logger (createNoOpLogger):
|
||||
* Silent on all events. Used as the Hub default when no logger is injected.
|
||||
*
|
||||
* ADR-457 build-at-publish: the hand-written bin/lib/observability/logger.cjs
|
||||
* collapsed to a TypeScript source of truth. Behaviour is preserved
|
||||
* byte-for-behaviour from the prior hand-written .cjs; only types are added.
|
||||
*/
|
||||
|
||||
import fs from 'node:fs';
|
||||
import path from 'node:path';
|
||||
|
||||
import { redactEvent } from './redaction.cjs';
|
||||
|
||||
const AUDIT_FILE_NAME = '.gsd-trace.jsonl';
|
||||
const PLANNING_DIR = '.planning';
|
||||
|
||||
// ─── helpers ─────────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Safely serialise a value to JSON, falling back to a placeholder on circular refs.
|
||||
*/
|
||||
function _safeStringify(value: unknown): string {
|
||||
try {
|
||||
return JSON.stringify(value);
|
||||
} catch {
|
||||
return JSON.stringify({ _serializationError: true });
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Determine whether the audit file should be written to.
|
||||
*/
|
||||
function _isAuditEnabled(config: { audit?: { enabled?: boolean } } | undefined): boolean {
|
||||
if (process.env['GSD_AUDIT'] === '1') return true;
|
||||
if (config && config.audit && config.audit.enabled === true) return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Build the redacted plain object for the audit file.
|
||||
* Preserves the full DispatchEvent structure.
|
||||
*/
|
||||
function _toAuditRecord(event: Record<string, unknown>): Record<string, unknown> {
|
||||
return redactEvent(event);
|
||||
}
|
||||
|
||||
/**
|
||||
* Build the flattened stderr error line.
|
||||
*
|
||||
* Per ADR-0174 P1.3 contract: { "kind": "<variant>", "traceId": "<uuid>", ...typedPayload }
|
||||
* The result's kind is promoted to top-level and the typed payload fields are spread in.
|
||||
* The `result` wrapper is removed.
|
||||
*/
|
||||
function _toStderrRecord(event: Record<string, unknown>): Record<string, unknown> {
|
||||
const redacted = redactEvent(event);
|
||||
const { result, ...eventWithoutResult } = redacted;
|
||||
// Flatten: top-level gets kind + typed payload fields from result
|
||||
const resultObj = result as Record<string, unknown>;
|
||||
const { kind, ...typedPayload } = resultObj;
|
||||
return Object.assign({}, eventWithoutResult, { kind }, typedPayload);
|
||||
}
|
||||
|
||||
/**
|
||||
* Append one JSON line to the audit file.
|
||||
* Creates .planning/ directory if it does not exist.
|
||||
*
|
||||
* Uses synchronous fs API (crash-safe for v1 — dispatch is synchronous).
|
||||
*/
|
||||
function _appendAuditLine(cwd: string, event: Record<string, unknown>): void {
|
||||
const planningDir = path.join(cwd, PLANNING_DIR);
|
||||
// Ensure the directory exists
|
||||
if (!fs.existsSync(planningDir)) {
|
||||
fs.mkdirSync(planningDir, { recursive: true });
|
||||
}
|
||||
const auditPath = path.join(planningDir, AUDIT_FILE_NAME);
|
||||
fs.appendFileSync(auditPath, _safeStringify(event) + '\n', 'utf8');
|
||||
}
|
||||
|
||||
// ─── Public factories ─────────────────────────────────────────────────────────
|
||||
|
||||
interface DispatchLogger {
|
||||
onEvent(event: Record<string, unknown>): void;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a no-op logger. All events are silently dropped.
|
||||
* This is the Hub's default when no logger is injected by the caller.
|
||||
*/
|
||||
function createNoOpLogger(): DispatchLogger {
|
||||
return {
|
||||
onEvent(_event: Record<string, unknown>): void {
|
||||
// intentionally empty
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
interface DefaultLoggerOptions {
|
||||
cwd?: string;
|
||||
config?: { audit?: { enabled?: boolean } };
|
||||
}
|
||||
|
||||
/**
|
||||
* Create the default DispatchLogger.
|
||||
*/
|
||||
function createDefaultLogger({ cwd = process.cwd(), config }: DefaultLoggerOptions = {}): DispatchLogger {
|
||||
return {
|
||||
/**
|
||||
* @param event - A DispatchEvent from the Hub.
|
||||
*/
|
||||
onEvent(event: Record<string, unknown>): void {
|
||||
const resultObj = event && (event['result'] as Record<string, unknown> | undefined);
|
||||
const isOk = resultObj && resultObj['kind'] === 'ok';
|
||||
|
||||
// ── Audit file (both ok and error) ────────────────────────────────────
|
||||
if (_isAuditEnabled(config)) {
|
||||
try {
|
||||
const auditRecord = _toAuditRecord(event);
|
||||
_appendAuditLine(cwd, auditRecord);
|
||||
} catch (auditErr) {
|
||||
// Audit errors must not surface to callers
|
||||
process.stderr.write(
|
||||
_safeStringify({
|
||||
level: 'warn',
|
||||
source: 'DispatchLogger',
|
||||
message: 'audit file write failed: ' + String((auditErr as Error | null)?.message ?? auditErr),
|
||||
}) + '\n'
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// ── Stderr on error ───────────────────────────────────────────────────
|
||||
if (!isOk) {
|
||||
try {
|
||||
const stderrRecord = _toStderrRecord(event);
|
||||
process.stderr.write(_safeStringify(stderrRecord) + '\n');
|
||||
} catch (stderrErr) {
|
||||
// Last-resort: we cannot throw from the logger
|
||||
process.stderr.write(
|
||||
_safeStringify({
|
||||
level: 'warn',
|
||||
source: 'DispatchLogger',
|
||||
message: 'stderr emit failed: ' + String((stderrErr as Error | null)?.message ?? stderrErr),
|
||||
}) + '\n'
|
||||
);
|
||||
}
|
||||
}
|
||||
// ── Silent on success (no else branch needed) ─────────────────────────
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export = { createDefaultLogger, createNoOpLogger };
|
||||
52
src/observability/redaction.cts
Normal file
52
src/observability/redaction.cts
Normal file
@@ -0,0 +1,52 @@
|
||||
/**
|
||||
* Arg redaction policy — issue #177 (ADR-457 build-at-publish: the
|
||||
* hand-written bin/lib/observability/redaction.cjs collapsed to a TypeScript
|
||||
* source of truth). Behaviour is preserved byte-for-behaviour from the prior
|
||||
* hand-written .cjs; only types are added.
|
||||
*
|
||||
* Privacy default: args are OMITTED from every emitted event (both stderr
|
||||
* and file audit). Opt-in: set GSD_AUDIT_ARGS=1 to include args verbatim.
|
||||
*
|
||||
* This module is deliberately simple and has no side effects — redaction
|
||||
* decisions are stateless reads of process.env at call time so that tests
|
||||
* can toggle the env var without module-level caching issues.
|
||||
*/
|
||||
|
||||
/**
|
||||
* A DispatchEvent (frozen or plain). Must be an object; `args` is optional.
|
||||
*/
|
||||
export type DispatchEvent = Record<string, unknown>;
|
||||
|
||||
/**
|
||||
* Returns true when the caller has opted in to including args in events.
|
||||
* Only GSD_AUDIT_ARGS === '1' enables inclusion; any other value (including
|
||||
* empty string, 'true', 'yes') keeps the default of omitting args.
|
||||
*/
|
||||
export function shouldIncludeArgs(): boolean {
|
||||
return process.env.GSD_AUDIT_ARGS === '1';
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a redacted copy of a DispatchEvent.
|
||||
*
|
||||
* If args should be omitted (default), strips the `args` field entirely.
|
||||
* If args should be included (GSD_AUDIT_ARGS=1), passes the event through
|
||||
* unchanged (args were already set by makeDispatchEvent with includeArgs:true,
|
||||
* or absent — in which case they stay absent).
|
||||
*
|
||||
* The original event object is never mutated (it is frozen by makeDispatchEvent).
|
||||
*
|
||||
* @param event - A DispatchEvent (frozen or plain).
|
||||
* @returns A new plain object with the same fields, minus args when redacted.
|
||||
*/
|
||||
export function redactEvent(event: DispatchEvent): DispatchEvent {
|
||||
if (shouldIncludeArgs()) {
|
||||
// Include path: return a shallow copy with args preserved if present
|
||||
const copy = Object.assign({}, event);
|
||||
return copy;
|
||||
}
|
||||
|
||||
// Exclude path: build a copy omitting `args`
|
||||
const { args: _dropped, ...rest } = event;
|
||||
return rest;
|
||||
}
|
||||
Reference in New Issue
Block a user