fix(sdks): stop excludeHttpRequests preset from dropping user spans (langwatch#7413)

The HTTP-verb span filter matched case-insensitively with a word
boundary, so any user span whose name starts with a verb word followed
by punctuation was silently discarded before export: post-process,
get-user-profile, delete-account, patch-config, ... while post_process
survived, because underscore is a word character.

The preset only exists to drop the SDK exporter's own feedback-loop
spans, and OpenTelemetry HTTP instrumentation names those with an
uppercase verb plus an optional route ('GET', 'POST /v1/traces'). Both
the TypeScript predicate and the Go regex now require exactly that
shape: case-sensitive verb followed by a space or end of string.

Rewrote the pinned case-insensitivity assertions into regressions that
keep lowercase user spans alive, added bare-verb coverage, and kept the
existing uppercase route-shape cases passing unchanged.

Fixes langwatch#7413

Author: feiiiiii5

docs/llms-full.txt

@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest";
+import {
+  featureEnv,
+  LANGY_ENV_KEY,
+  LEGACY_EVALUATORS_ENV_KEY,
+  LINGUA_ENV_KEY,
+  PRESIDIO_ENV_KEY,
+  resolveFeatures,
+} from "../src/shared/features.ts";
+
+describe("optional install pieces", () => {
+  describe("when nothing is set", () => {
+    it("installs the assistant and skips every heavyweight evaluator", () => {
+      const f = resolveFeatures({});
+      expect(f.isLangyEnabled).toBe(true);
+      expect(f.isPresidioEnabled).toBe(false);
+      expect(f.isLinguaEnabled).toBe(false);
+      expect(f.isLegacyEvaluatorsEnabled).toBe(false);
+    });
+  });
+
+  describe("when a toggle is set", () => {
+    it("honours an explicit opt-in to the PII model", () => {
+      expect(resolveFeatures({ [PRESIDIO_ENV_KEY]: "true" }).isPresidioEnabled).toBe(true);
+    });
+
+    it("honours an explicit opt-out of the assistant", () => {
+      expect(resolveFeatures({ [LANGY_ENV_KEY]: "false" }).isLangyEnabled).toBe(false);
+    });
+
+    it("honours opting into language detection and legacy evaluators", () => {
+      expect(resolveFeatures({ [LINGUA_ENV_KEY]: "true" }).isLinguaEnabled).toBe(true);
+      expect(
+        resolveFeatures({ [LEGACY_EVALUATORS_ENV_KEY]: "true" }).isLegacyEvaluatorsEnabled,
+      ).toBe(true);
+    });
+
+    it("accepts the spellings people actually type", () => {
+      for (const yes of ["1", "true", "TRUE", "yes", "on", " true "]) {
+        expect(resolveFeatures({ [PRESIDIO_ENV_KEY]: yes }).isPresidioEnabled).toBe(true);
+      }
+      for (const no of ["0", "false", "FALSE", "no", "off"]) {
+        expect(resolveFeatures({ [LANGY_ENV_KEY]: no }).isLangyEnabled).toBe(false);
+      }
+    });
+  });
+
+  describe("when a toggle is set to something unrecognised", () => {
+    it("keeps the default rather than reading it as off", () => {
+      // A typo silently stripping a feature someone asked for is the worse
+      // failure: they wait for an install that quietly did not happen.
+      expect(resolveFeatures({ [LANGY_ENV_KEY]: "maybe" }).isLangyEnabled).toBe(true);
+      expect(resolveFeatures({ [PRESIDIO_ENV_KEY]: "sure" }).isPresidioEnabled).toBe(false);
+    });
+
+    it("treats an empty value as unset", () => {
+      expect(resolveFeatures({ [LANGY_ENV_KEY]: "" }).isLangyEnabled).toBe(true);
+    });
+  });
+
+  describe("featureEnv", () => {
+    it("spells every toggle out so a child process never falls back to a default", () => {
+      const env = featureEnv(resolveFeatures({ [PRESIDIO_ENV_KEY]: "true" }));
+      expect(env).toEqual({
+        [LANGY_ENV_KEY]: "true",
+        [PRESIDIO_ENV_KEY]: "true",
+        [LINGUA_ENV_KEY]: "false",
+        [LEGACY_EVALUATORS_ENV_KEY]: "false",
+      });
+    });
+  });
+});

docs/skills/directory.mdx

@@ -0,0 +1,65 @@
+import { mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { restoreShellScriptBits } from "../../src/services/app-dir.ts";
+
+describe("shell script bits after relocation", () => {
+	const roots: string[] = [];
+	afterEach(() => {
+		for (const root of roots.splice(0))
+			rmSync(root, { recursive: true, force: true });
+	});
+
+	async function makeTree(): Promise<string> {
+		const root = await mkdtemp(join(tmpdir(), "langwatch-appdir-"));
+		roots.push(root);
+		mkdirSync(join(root, "langwatch", "scripts"), { recursive: true });
+		mkdirSync(join(root, "node_modules", "dep"), { recursive: true });
+		// pnpm pack normalizes modes: scripts arrive 0644.
+		writeFileSync(
+			join(root, "langwatch", "scripts", "build-mcp-server.sh"),
+			"#!/bin/sh\n",
+			{
+				mode: 0o644,
+			},
+		);
+		writeFileSync(
+			join(root, "langwatch", "scripts", "helper.ts"),
+			"export {};\n",
+			{
+				mode: 0o644,
+			},
+		);
+		writeFileSync(join(root, "node_modules", "dep", "hook.sh"), "#!/bin/sh\n", {
+			mode: 0o644,
+		});
+		return root;
+	}
+
+	describe("when the extracted artifact carries scripts without their bit", () => {
+		it("makes every *.sh executable so the app's build chain can invoke them", async () => {
+			// `pnpm run build` calls ./scripts/build-mcp-server.sh directly; a
+			// 0644 script dies with exit 126 and the boot never reaches healthy.
+			const root = await makeTree();
+			const restored = restoreShellScriptBits(root);
+			expect(restored).toBe(1);
+			const mode = statSync(
+				join(root, "langwatch", "scripts", "build-mcp-server.sh"),
+			).mode;
+			expect(mode & 0o111).not.toBe(0);
+		});
+
+		it("leaves non-scripts and node_modules alone", async () => {
+			const root = await makeTree();
+			restoreShellScriptBits(root);
+			expect(
+				statSync(join(root, "langwatch", "scripts", "helper.ts")).mode & 0o111,
+			).toBe(0);
+			expect(
+				statSync(join(root, "node_modules", "dep", "hook.sh")).mode & 0o111,
+			).toBe(0);
+		});
+	});
+});

docs/skills/pms-and-domain-experts.mdx

@@ -0,0 +1,146 @@
+#!/usr/bin/env bats
+# Unit tests for scripts/dogfood/langy-local.sh, the Langy local dogfood
+# doctor. The script under test runs for real against a sandboxed repo
+# layout: a temp langwatch/.env, fake opencode/go shims on PATH, and real
+# loopback listeners standing in for the app / gateway / langyagent.
+#
+# Spec: specs/setup/langy-local-dogfood.feature
+
+REPO_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/../.." && pwd)"
+
+setup() {
+  TEST_DIR="$(mktemp -d)"
+  mkdir -p "$TEST_DIR/scripts/dogfood" "$TEST_DIR/langwatch" "$TEST_DIR/bin"
+  cp "$REPO_DIR/scripts/dogfood/langy-local.sh" "$TEST_DIR/scripts/dogfood/"
+  DOCTOR="$TEST_DIR/scripts/dogfood/langy-local.sh"
+  ENV_FILE="$TEST_DIR/langwatch/.env"
+  : >"$ENV_FILE"
+
+  # Binaries the doctor requires: fake shims are enough — it only checks PATH.
+  printf '#!/bin/sh\nexit 0\n' >"$TEST_DIR/bin/opencode"
+  printf '#!/bin/sh\nexit 0\n' >"$TEST_DIR/bin/go"
+  chmod +x "$TEST_DIR/bin/opencode" "$TEST_DIR/bin/go"
+
+  # A base port slot unlikely to collide; the doctor derives gateway = base+3.
+  BASE_PORT=$((20000 + (RANDOM % 20000)))
+  AGENT_PORT=$((BASE_PORT + 7))
+  LISTENER_PIDS=()
+}
+
+teardown() {
+  for pid in "${LISTENER_PIDS[@]}"; do kill "$pid" 2>/dev/null || true; done
+  rm -rf "$TEST_DIR"
+}
+
+listen_on() {
+  python3 -m http.server "$1" --bind 127.0.0.1 >/dev/null 2>&1 &
+  LISTENER_PIDS+=("$!")
+  for _ in $(seq 1 50); do
+    if lsof -nP -iTCP:"$1" -sTCP:LISTEN >/dev/null 2>&1; then return 0; fi
+    sleep 0.1
+  done
+  return 1
+}
+
+write_full_env() {
+  mkdir -p "$TEST_DIR/sessions" "$TEST_DIR/workspace"
+  cat >"$ENV_FILE" <<EOF
+OPENCODE_AGENT_URL="http://localhost:${AGENT_PORT}"
+LANGY_INTERNAL_SECRET="test-secret"
+LANGY_UNSAFE_DEV_DISABLE_ISOLATION=true
+SESSIONS_ROOT="$TEST_DIR/sessions"
+LANGY_WORKSPACE_ROOT="$TEST_DIR/workspace"
+FEATURE_FLAG_FORCE_ENABLE=release_langy_enabled
+EOF
+}
+
+run_doctor() {
+  PATH="$TEST_DIR/bin:$PATH" PORT="$BASE_PORT" LANGY_AGENT_PORT="$AGENT_PORT" run "$DOCTOR" "$@"
+}
+
+# @scenario "A fully wired setup passes every check"
+@test "fully wired setup passes every check and exits zero" {
+  write_full_env
+  listen_on "$BASE_PORT"
+  listen_on $((BASE_PORT + 3))
+  listen_on "$AGENT_PORT"
+
+  run_doctor
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"all checks passed"* ]]
+  [[ "$output" == *"http://localhost:${BASE_PORT}"* ]]
+  [[ "$output" != *"✗"* ]]
+}
+
+# @scenario "A missing env entry prints the exact lines to add"
+@test "missing env entries are named with a ready-to-paste block and non-zero exit" {
+  run_doctor
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"LANGY_INTERNAL_SECRET missing"* ]]
+  [[ "$output" == *"OPENCODE_AGENT_URL missing"* ]]
+  [[ "$output" == *'LANGY_UNSAFE_DEV_DISABLE_ISOLATION=true'* ]]
+  [[ "$output" == *"LANGY_INTERNAL_SECRET=\""* ]]
+}
+
+# @scenario "A dead service prints the command that starts it"
+@test "a dead langyagent names the service and prints its start command" {
+  write_full_env
+  listen_on "$BASE_PORT"
+  listen_on $((BASE_PORT + 3))
+
+  run_doctor
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"langyagent not listening on :${AGENT_PORT}"* ]]
+  [[ "$output" == *"service svc=langyagent"* ]]
+}
+
+# @scenario "A provider key that the provider rejects is caught before a turn wastes time on it"
+@test "a rejected provider key is reported without failing an otherwise green doctor" {
+  write_full_env
+  echo 'OPENAI_API_KEY="sk-proj-dead"' >>"$ENV_FILE"
+  listen_on "$BASE_PORT"
+  listen_on $((BASE_PORT + 3))
+  listen_on "$AGENT_PORT"
+
+  # A local responder that rejects everything, standing in for the provider.
+  REJECT_PORT=$((BASE_PORT + 11))
+  python3 -c '
+import http.server, sys
+class H(http.server.BaseHTTPRequestHandler):
+    def do_GET(self):
+        self.send_response(401); self.end_headers()
+    def log_message(self, *a): pass
+http.server.HTTPServer(("127.0.0.1", int(sys.argv[1])), H).serve_forever()
+' "$REJECT_PORT" &
+  LISTENER_PIDS+=("$!")
+  for _ in $(seq 1 50); do
+    lsof -nP -iTCP:"$REJECT_PORT" -sTCP:LISTEN >/dev/null 2>&1 && break
+    sleep 0.1
+  done
+
+  PATH="$TEST_DIR/bin:$PATH" PORT="$BASE_PORT" LANGY_AGENT_PORT="$AGENT_PORT" \
+    LANGY_DOCTOR_OPENAI_URL="http://127.0.0.1:${REJECT_PORT}/v1/models" \
+    run "$DOCTOR"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"OPENAI_API_KEY REJECTED by the provider (HTTP 401)"* ]]
+  [[ "$output" == *"all checks passed"* ]]
+
+  # A userinfo-tricked override (http://localhost:...@attacker) must be
+  # rejected: the key would otherwise be sent off-machine. curl is stubbed to
+  # record its argv (no network), so the assertion is that the doctor handed
+  # curl the REAL fallback endpoint, never the attacker authority.
+  mkdir -p "$TEST_DIR/curlstub"
+  cat >"$TEST_DIR/curlstub/curl" <<STUB
+#!/bin/sh
+printf '%s\n' "\$@" >>"$TEST_DIR/curl-args"
+cat >/dev/null
+printf '000'
+STUB
+  chmod +x "$TEST_DIR/curlstub/curl"
+  PATH="$TEST_DIR/curlstub:$TEST_DIR/bin:$PATH" PORT="$BASE_PORT" LANGY_AGENT_PORT="$AGENT_PORT" \
+    LANGY_DOCTOR_OPENAI_URL="http://localhost:${REJECT_PORT}@attacker.example/v1/models" \
+    run "$DOCTOR"
+  [[ "$output" == *"ignoring non-loopback endpoint override"* ]]
+  grep -q "https://api.openai.com/v1/models" "$TEST_DIR/curl-args"
+  ! grep -q "attacker.example" "$TEST_DIR/curl-args"
+}