config-race-observer

1// The pinned SDK process hook returns { value: ProcessResult }; no output is retained.
2export function helperOutcome(answer, request, elapsedMs, rejected = false) {
3  const value = answer?.value;
4  const result = { outcome: 'PROCESS_SHAPE_INVALID', exitCode: null, elapsedBucket: elapsedMs < 250 ? 0 : elapsedMs < 1000 ? 1 : elapsedMs < 2000 ? 2 : elapsedMs < 5000 ? 3 : 4, stdoutTruncated: value?.isStdoutTruncated === true, stderrTruncated: value?.isStderrTruncated === true, stderrPresent: typeof value?.stderr === 'string' && value.stderr.length > 0, identityMatched: false };
5  if (rejected) { result.outcome = 'PROCESS_REJECTED'; return result; }
6  if (answer?.deny) { result.outcome = 'PROCESS_DENIED'; return result; }
7  if (!value || typeof value !== 'object' || Object.keys(value).sort().join(',') !== 'exitCode,isStderrTruncated,isStdoutTruncated,stderr,stdout' || !Number.isInteger(value.exitCode) || value.exitCode < -2147483648 || value.exitCode > 2147483647 || typeof value.stdout !== 'string' || typeof value.stderr !== 'string' || typeof value.isStdoutTruncated !== 'boolean' || typeof value.isStderrTruncated !== 'boolean') return result;
8  result.exitCode = value.exitCode;
9  if (value.exitCode !== 0) result.outcome = 'PROCESS_EXIT_NONZERO';
10  else if (result.stdoutTruncated) result.outcome = 'STDOUT_TRUNCATED';
11  else if (result.stderrTruncated) result.outcome = 'STDERR_TRUNCATED';
12  else if (result.stderrPresent) result.outcome = 'STDERR_PRESENT';
13  else {
14    if (value.stdout.length > 1048576) return result;
15    let reply;
16    try { reply = JSON.parse(value.stdout); } catch { result.outcome = 'INVALID_JSON'; return result; }
17    result.identityMatched = [1, 2].includes(request?.protocolVersion) && typeof request?.requestId === 'string' && typeof request?.policyId === 'string' && typeof request?.config?.revision === 'string' && reply?.protocolVersion === request.protocolVersion && reply?.requestId === request.requestId && reply?.policyId === request.policyId && reply?.engineVersion === '0.1.0-beta.14' && reply?.configRevision === request.config.revision;
18    result.outcome = reply?.status === 'failed' && reply?.errorCode === 'TIMEOUT' ? 'DECLARED_TIMEOUT' : reply?.status === 'failed' && reply?.errorCode === 'ENGINE_UNAVAILABLE' ? 'DECLARED_ENGINE_UNAVAILABLE' : !result.identityMatched ? 'IDENTITY_MISMATCH' : reply.status === 'ok' ? 'DECLARED_OK' : reply.status === 'blocked' ? 'DECLARED_BLOCKED' : reply.status === 'failed' ? 'DECLARED_FAILED' : 'STATUS_UNKNOWN';
19  }
20  return result;
21}
22
23export function register(on) {
24  const observations = [];
25  const helperOutcomes = [];
26  let reports = 0;
27  let stdoutSanitizes = 0;
28  on('session.start', async ($, e, next) => {
29    await $.command.register({ name: 'config-race-report', description: 'Fixed synthetic captured configuration metadata' });
30    return next(e);
31  });
32  on('process.run', async (_$, e, next) => {
33    let measuredRequest;
34    let measuredIndex = -1;
35    try {
36      const request = JSON.parse(e.init?.stdin ?? '{}');
37      if (request.operation === 'sanitize' && request.segments.some(segment => segment.id === 'stdout')) {
38        stdoutSanitizes = Math.min(3, stdoutSanitizes + 1);
39        if (helperOutcomes.length < 2) {
40          measuredIndex = helperOutcomes.length;
41          measuredRequest = request;
42          helperOutcomes.push(null);
43        }
44        const config = request.config;
45        if (observations.length < 2 && /^cfg-[0-9]{1,6}-[0-9]{1,6}$/.test(config.revision) && Array.isArray(config.rules) && config.rules.length <= 1) {
46          const rule = config.rules[0];
47          const exactRule = !rule || (rule.kind === 'token' && rule.id === 'config-race-token' && rule.prefix === 'syntheticcred_' && rule.alphabet === 'alnum' && rule.run.kind === 'exact' && rule.run.length === 16 && rule.action === 'redact');
48          observations.push({ revision: config.revision, rules: config.rules.length, exactRule });
49        }
50      }
51    } catch {}
52    const started = Date.now();
53    let answer;
54    try { answer = await next(e); }
55    catch (error) {
56      if (measuredIndex !== -1) helperOutcomes[measuredIndex] = helperOutcome(null, measuredRequest, Date.now() - started, true);
57      throw error;
58    }
59    if (measuredIndex !== -1) helperOutcomes[measuredIndex] = helperOutcome(answer, measuredRequest, Date.now() - started);
60    return answer;
61  });
62  on('command.run', { command: 'config-race-report' }, () => ({
63    text: `${helperOutcomes.map((value, index) => value ? `CONFIG_HELPER_${index + 1}_${value.outcome}_${value.exitCode ?? 'N'}_${value.elapsedBucket}_${Number(value.stdoutTruncated)}_${Number(value.stderrTruncated)}_${Number(value.stderrPresent)}_${Number(value.identityMatched)}` : '').join('\n')}\nCONFIG_RACE_REPORT_${++reports}_${stdoutSanitizes}_${observations.length}_${observations.map(value => `${value.revision}_${value.rules}_${value.exactRule ? 1 : 0}`).join('_')}`,
64  }));
65}
66