Repository navigation
Otel wiring - #325
Open
davidabram wants to merge 12 commits into
Open
Otel wiring#325davidabram wants to merge 12 commits into
davidabram wants to merge 12 commits into
Conversation
The CLI needs a stable managed telemetry contract even when repository config omits the optional OTEL block. Add code-owned OTLP endpoints and protocol, resolve per-field config provenance without replacing omitted defaults, and expose the values through config rendering. Add credential-backed managed/no-op selection that projects only the stored bearer token; exporter startup remains unwired until the follow-up trace and log tasks. Plan: managed-otel-export Task: T01 Co-authored-by: SCE <sce@crocoder.dev>
Add credential-gated OpenTelemetry trace export for command lifecycle spans with a pinned bearer-only OTLP/HTTP client, an allowlisted span layer, bounded batching and shutdown, and hook exclusion. Preserve no-op behavior when no valid credential is available and keep exporter failures isolated from command results. Plan: managed-otel-export T02 Co-authored-by: SCE <sce@crocoder.dev>
Extend managed telemetry with OTLP/HTTP log export for SCE events at the canonical /v1/logs endpoint. Bridge target: "sce" events into bounded OpenTelemetry log batches while filtering paths, secrets, arguments, and non-allowlisted fields. Share pinned bearer transport and bounded shutdown with traces, update the observability contract and Flatpak cargo sources, and cover loopback and security behavior with tests. Plan: managed-otel-export (T03) Co-authored-by: SCE <sce@crocoder.dev>
Add deterministic loopback regressions showing ambient OTLP settings cannot redirect exports or inject headers, stalled collectors do not block commands, shutdown remains bounded, and concurrent commands preserve isolated results. Verify hook invocations bypass managed telemetry resolution, and record completion of the managed OTEL export security task. Plan: managed-otel-export (T04) Co-authored-by: SCE <sce@crocoder.dev>
Complete the managed OTLP trace and log export contract with encrypted-auth-DB bearer-token use, pinned fail-open lifecycle, and reserved metrics behavior. Extract the trace exporter client seam so loopback tests can use an empty TLS root store without changing production client behavior. Plan: managed-otel-export (T05) Co-authored-by: SCE <sce@crocoder.dev>
Enable Claude Code's native OTLP integration to refresh the bearer header from the encrypted telemetry credential store without exposing a public command. The hidden helper emits only the Authorization header, uses a fixed secret-free error, and bypasses managed telemetry initialization for helper and policy invocations. Plan: claude-native-otel-instrumentation; task: T01. Co-authored-by: SCE <sce@crocoder.dev>
Add an idempotent Claude settings merge that configures managed OTLP telemetry while preserving unrelated user settings. Detect user-owned helpers and conflicting endpoint, header, protocol, or exporter values in both user and managed settings, and return explicit install, no-op, or skip outcomes without emitting token material. Plan: claude-native-otel-instrumentation, task T02 Co-authored-by: SCE <sce@crocoder.dev>
Configure Claude's user-level settings when the Claude setup target is selected, preserving existing settings and file permissions while skipping malformed or conflicting configurations. Report authentication status without exposing the telemetry helper command, and reuse the shared merge logic. Plan: claude-native-otel-instrumentation (T03) Co-authored-by: SCE <sce@crocoder.dev>
Document Claude Code's user-level native OpenTelemetry settings merge, helper-based credential refresh, conflict handling, and override limits while distinguishing it from SCE-CLI telemetry. Record completion of the `claude-native-otel-instrumentation` plan task T04. Use an equivalent `let ... else` in the telemetry header helper to satisfy clippy without changing behavior. Co-authored-by: SCE <sce@crocoder.dev>
Expose the stored-credential header renderer to the Claude telemetry helper and install Claude settings only when Claude is an explicitly selected setup target. Add regression tests for target selection, credential replacement, and fixed secret-free failures, and record completion of the implementation plan. Ref: context/plans/claude-native-otel-instrumentation.md (T03) Co-authored-by: SCE <sce@crocoder.dev>
Keep managed telemetry bounded from credential lookup through exporter shutdown, and render final command outcomes inside the telemetry scope so failures are classified and exported correctly. Tie telemetry credentials to the active WorkOS session, require pinned endpoints and SCE-installed repository attribution for Claude's header helper, and preserve explicit Claude telemetry opt-outs and conflicting settings during setup. This keeps stalled async or blocking work from extending process lifetime while preventing stale credentials, unintended endpoint use, and cross-repository telemetry attribution. Co-authored-by: SCE <sce@crocoder.dev>
Prevent telemetry bearer credentials from being reused across WorkOS identities or repositories in different workspaces. Store the issuing identity, verify it against the current session claims, and add repository enrollment bindings with explicit rebinding and non-moving login behavior. Require Claude's header helper to resolve and authorize the current Git repository, integrate enrollment into setup and authentication, and fail closed for missing or mismatched bindings. Add the auth migration, focused storage/helper coverage, and update the telemetry security documentation. Co-authored-by: SCE <sce@crocoder.dev>
davidabram
added this pull request to stack #327
October 15, 2026 08:52
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.