Skip to content

Address Ariel's review of the trace exporter - #289

Merged
rocklambros merged 10 commits into
integrationfrom
refimpl/274-exporter-code-quality
Oct 16, 2026
Merged

rocklambros merged 10 commits into
integrationfrom
refimpl/274-exporter-code-quality

Conversation

@rocklambros

Copy link
Copy Markdown
Collaborator

What changed

This addresses all six of Ariel's code-quality comments on the trace exporter from his review of PR #286, so they ship in 0.1.4. Apart from two intended changes, behavior is the same.

  1. The exporter no longer reads or writes process.env. main.ts now reads the proxy environment, prints the loopback warning and applies the exemption before the Guardian starts, the way it already owns every other variable. keepLoopbackOffProxy and loopbackProxyWarning take the environment as an argument. The package exports them, so an embedder decides whether its own environment changes.

  2. The warning no longer bypasses onError, because it left the exporter.

  3. otel-trace-exporter.ts is split from 1,022 lines into four files, one job each:

    • otel-mapping.ts (366 lines): the mapping loader and attribute sources;
    • otlp-file-exporter.ts (69): the file writer;
    • loopback-proxy.ts (93): the proxy handling;
    • otel-trace-exporter.ts (568): the assembly.

    The code moved verbatim. The old file re-exports every name it had, so existing imports keep working.

  4. REPLAY_DETECTED_CODE and the object reader are defined once. The two copies were identical.

  5. The OTLP compression type is named once instead of being built inline.

  6. close() applies the same bounded drain whether trace export is on or off. Before, it special-cased the null exporter.

The 0.1.4 CHANGELOG gets one bullet for the two behavior changes.

Which issue does this implement

Refs #274

How it was checked

  • New tests, each seen failing first:
    • The exporter leaves NO_PROXY alone.
    • close() drains with export off. On Bun 1.3.11 it timed out before the fix.
    • main.ts prints the warning.
    • main.ts keeps a loopback collector off the proxy. That test fails with the call removed (2 proxy connections, no export) and passes with it restored. It's gated to Bun 1.3.14 and later, because 1.3.11 ignores runtime environment edits.
  • Suites:
    • bun test: 1234 pass on Bun 1.3.14, and 1231 pass with 4 version-gated skips on 1.3.11.
    • bun run typecheck is clean and bun run conformance exits 0.
    • uv run pytest gives 918 passed, and mkdocs build --strict passes.
  • End to end against integration from before the change (5ee326b):
    • The walkthrough's trace output, reduced to span names, decisions, labels, attribute keys and drop counts, is identical to the baseline, with a clean environment and with hostile OTEL_* and proxy variables.
    • Under a counting proxy, steps 1 to 7 and the rerun made 0 proxy connections, and the startup warning still fires.
    • Natively, the collector config validates, a restart keeps both batches at 0600, and disabled after failure still appears.
    • The committed sample trace still passes its freshness test without being regenerated.

Base branch

  • integration, because this touches the specification, schemas, a reference
    implementation, an adapter, tests, or CI

Type of change

  • Reference implementation or adapter

I tested this

  • I synced my branch with the base branch before opening this
  • uv run pytest -v passes on my machine
  • uv run mkdocs build --strict passes on my machine

Checklist

  • Commits are signed off with git commit -s (required by the DCO)
  • Prose follows STYLE.md
  • No secrets, tokens, or internal URLs in the diff

Security

  • This change has no security impact

keepLoopbackOffProxy and loopbackProxyWarning now take the environment
as a parameter, and createOtelTraceExporter calls neither. main.ts
prints the warning and applies the exemption where it reads
ACS_OTEL_ENDPOINT, before the Guardian starts, so the exporter no longer
reads or writes process.env and no longer prints outside onError.

The in-process routing test passed only when an earlier test had left
127.0.0.1 in NO_PROXY. It now runs in a child process, like the
existing routing test, and is gated to Bun 1.3.14 and later.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
close() no longer special-cases NULL_OTEL_TRACE_EXPORTER. Its shutdown
resolves at once, so a Guardian with export off now gets the same drain,
bounded by the negotiated timeout. On Bun 1.3.11 the old path waited on
stop(true) alone and hung while a bridge had not answered. The new test
timed out there before this change and passes on both versions after.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
otel-trace-exporter.ts held four jobs in 1,022 lines. The mapping loader,
the attribute source tables and the decision failure event move to
otel-mapping.ts, the OTLP/JSON file writer to otlp-file-exporter.ts, and
the proxy helpers to loopback-proxy.ts. otel-trace-exporter.ts keeps the
assembly and re-exports every name it exported before, so no importer
has to change. Code and comments move as they were. The only edits are
the export keywords the assembly needs, the module headers, and two
comments that pointed at code now in another file.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
audit-to-otlp.ts kept its own REPLAY_DETECTED_CODE and a readObject
identical to the exporter's asObject. Both now live in otel-mapping.ts,
with the JsonObject type they share, and the converter imports them.
The copied sessionUuid stays, since importing it would be a cycle.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
The endpoint construction assembled the SDK's compression type inline
on a line past 200 characters. OtlpCompression names it once, with a
comment saying why the enum is not imported.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
The existing main.ts test checked only the warning, so removing the
keepLoopbackOffProxy call left it green. The new test runs main.ts with
HTTP_PROXY and a user NO_PROXY, sends one step, stops the Guardian with
SIGTERM, and checks that spans reached a stub collector and nothing
reached the proxy. It fails with the call removed and is gated to Bun
1.3.14 and later. The envelope helpers move to test/helpers so both
test files can use them.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
The README told embedders to call keepLoopbackOffProxy and
loopbackProxyWarning from src/loopback-proxy.ts, a path the package does
not export. index.ts now re-exports both, and the README names the
package import.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
The exporter header said a Guardian with export off behaves exactly as
before. close() now applies the bounded drain in that case too, so the
header says that instead.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
Replaces each " -- " in the comments of otel-mapping.ts,
otlp-file-exporter.ts and otel-trace-exporter.ts with a period, comma,
colon or parentheses. Comments only. loopback-proxy.ts had none.

Refs #274

Signed-off-by: rocklambros <rock@rockcyber.com>
@rocklambros

Copy link
Copy Markdown
Collaborator Author

Admin-merged on the project lead's call, so Ariel's six review comments from PR #286 ship in 0.1.4. Every check is green, and the description has the test and end-to-end evidence, including trace output identical to the pre-change baseline. @afogel, these are your comments, so a look after the fact is welcome.

@rocklambros
rocklambros merged commit 8a45952 into integration Oct 16, 2026
10 checks passed
@github-project-automation github-project-automation Bot moved this from Needs triage to Done in ACS Project Tracker Oct 16, 2026
President added a commit to disciplinedware/agent-control-standard that referenced this pull request Oct 17, 2026
Re-record the TypeScript answers: GenAI-Security-Project#289 changed the Guardian sources. No
recorded answer changed.

Claude-Session: https://claude.ai/code/session_01NqVwNgkbimQeV7PRGx9Zpa
Signed-off-by: Konstantin Trunin <konstantin@trunin.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant