events

package
v0.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 7, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Documentation

Overview

Package events provides the core event model and types for audit logging.

Index

Constants

View Source
const EventSchemaURL = "https://raw.githubusercontent.com/safedep/gryph/main/schema/event.schema.json"

EventSchemaURL is the canonical URL for the Event JSON Schema hosted on GitHub.

Variables

This section is empty.

Functions

func DefaultRedactPatterns

func DefaultRedactPatterns() []string

DefaultRedactPatterns returns the default list of redaction regex patterns.

func DefaultSensitivePatterns

func DefaultSensitivePatterns() []string

DefaultSensitivePatterns returns the default list of sensitive path patterns.

Types

type ActionType

type ActionType string

ActionType represents the type of action performed by an agent.

const (
	// ActionFileRead indicates an agent read a file.
	ActionFileRead ActionType = "file_read"
	// ActionFileWrite indicates an agent wrote/modified a file.
	ActionFileWrite ActionType = "file_write"
	// ActionFileDelete indicates an agent deleted a file.
	ActionFileDelete ActionType = "file_delete"
	// ActionCommandExec indicates an agent executed a shell command.
	ActionCommandExec ActionType = "command_exec"
	// ActionNetworkRequest indicates an agent made an HTTP request.
	ActionNetworkRequest ActionType = "network_request"
	// ActionToolUse indicates other tool invocation.
	ActionToolUse ActionType = "tool_use"
	// ActionSessionStart indicates a session started.
	ActionSessionStart ActionType = "session_start"
	// ActionSessionEnd indicates a session ended.
	ActionSessionEnd ActionType = "session_end"
	// ActionNotification indicates a notification was sent.
	ActionNotification ActionType = "notification"
	// ActionSubagentStart indicates a subagent was spawned.
	ActionSubagentStart ActionType = "subagent_start"
	// ActionSubagentStop indicates a subagent completed.
	ActionSubagentStop ActionType = "subagent_stop"
	// ActionUnknown indicates an unrecognized action type.
	ActionUnknown ActionType = "unknown"
)

func ParseActionType added in v0.2.7

func ParseActionType(s string) (ActionType, error)

ParseActionType parses a string into an ActionType, accepting both full names (e.g. "file_write") and display names (e.g. "write").

func (ActionType) DisplayName added in v0.2.7

func (a ActionType) DisplayName() string

DisplayName returns a short human-readable name for the action type.

func (ActionType) IsValid

func (a ActionType) IsValid() bool

IsValid returns true if the ActionType is a known type.

func (ActionType) String

func (a ActionType) String() string

String returns the string representation of an ActionType.

type CommandExecPayload

type CommandExecPayload struct {
	Command       string   `json:"command"`
	Description   string   `json:"description,omitempty"`
	Args          []string `json:"args,omitempty"`
	ExitCode      int      `json:"exit_code"`
	Output        string   `json:"output,omitempty"`
	DurationMs    int64    `json:"duration_ms,omitempty"`
	StdoutPreview string   `json:"stdout_preview,omitempty"`
	StderrPreview string   `json:"stderr_preview,omitempty"`
}

CommandExecPayload represents the payload for command_exec actions.

type Event

type Event struct {
	// ID is the unique identifier for this event.
	ID uuid.UUID `json:"id"`
	// SessionID links this event to its parent session (deterministic UUID derived from AgentSessionID).
	SessionID uuid.UUID `json:"session_id"`
	// AgentSessionID is the original session ID string from the agent (for correlation).
	AgentSessionID string `json:"agent_session_id,omitempty"`
	// Sequence is the order within the session (1, 2, 3...).
	Sequence int `json:"sequence"`
	// Timestamp is when the action occurred (UTC).
	Timestamp time.Time `json:"timestamp"`
	// DurationMs is how long the action took in milliseconds.
	DurationMs int64 `json:"duration_ms,omitempty"`
	// AgentName is the identifier of the agent (e.g., "claude-code").
	AgentName string `json:"agent_name"`
	// AgentVersion is the version of the agent if detectable.
	AgentVersion string `json:"agent_version,omitempty"`
	// WorkingDirectory may differ from session if agent changed dirs.
	WorkingDirectory string `json:"working_directory,omitempty"`
	// ActionType is the category of action performed.
	ActionType ActionType `json:"action_type"`
	// ToolName is the original tool name from the agent.
	ToolName string `json:"tool_name,omitempty"`
	// ResultStatus is the outcome of the action.
	ResultStatus ResultStatus `json:"result_status"`
	// ErrorMessage contains error details if status is error.
	ErrorMessage string `json:"error_message,omitempty"`
	// Payload contains action-specific data.
	Payload json.RawMessage `json:"payload,omitempty"`
	// DiffContent contains file diff (full logging only, never for sensitive paths).
	DiffContent string `json:"diff_content,omitempty"`
	// RawEvent is the original event from agent (full logging only).
	RawEvent json.RawMessage `json:"raw_event,omitempty"`
	// ConversationContext is the prompt/conversation (full logging only).
	ConversationContext string `json:"conversation_context,omitempty"`
	// TranscriptPath is the path to the agent's transcript file (if provided by the agent).
	// Excluded from JSON export as it is internal to the local machine.
	TranscriptPath string `json:"-"`
	// IsSensitive is true if path matched sensitive_paths pattern.
	IsSensitive bool `json:"is_sensitive"`
	// SubagentID is set when this event was performed by a subagent (empty for main agent).
	SubagentID string `json:"subagent_id,omitempty"`
	// SubagentType is the type of subagent (e.g., "Explore", "Plan", "general-purpose").
	SubagentType string `json:"subagent_type,omitempty"`
}

Event represents a single action performed by an agent.

func NewEvent

func NewEvent(sessionID uuid.UUID, agentName string, actionType ActionType) *Event

NewEvent creates a new Event with a generated UUID and current timestamp.

func (*Event) GetCommandExecPayload

func (e *Event) GetCommandExecPayload() (*CommandExecPayload, error)

GetCommandExecPayload unmarshals the payload as a CommandExecPayload.

func (*Event) GetFileDeletePayload added in v0.5.0

func (e *Event) GetFileDeletePayload() (*FileDeletePayload, error)

GetFileDeletePayload unmarshals the payload as a FileDeletePayload.

func (*Event) GetFileReadPayload

func (e *Event) GetFileReadPayload() (*FileReadPayload, error)

GetFileReadPayload unmarshals the payload as a FileReadPayload.

func (*Event) GetFileWritePayload

func (e *Event) GetFileWritePayload() (*FileWritePayload, error)

GetFileWritePayload unmarshals the payload as a FileWritePayload.

func (*Event) GetNotificationPayload added in v0.5.0

func (e *Event) GetNotificationPayload() (*NotificationPayload, error)

GetNotificationPayload unmarshals the payload as a NotificationPayload.

func (*Event) GetToolUsePayload added in v0.3.4

func (e *Event) GetToolUsePayload() (*ToolUsePayload, error)

GetToolUsePayload unmarshals the payload as a ToolUsePayload.

func (Event) MarshalJSON added in v0.3.2

func (e Event) MarshalJSON() ([]byte, error)

MarshalJSON implements json.Marshaler to include $schema in the JSON output.

func (*Event) SetPayload

func (e *Event) SetPayload(payload interface{}) error

SetPayload marshals the given payload and sets it on the event.

type EventFilter

type EventFilter struct {
	// Since filters events after this time.
	Since *time.Time
	// Until filters events before this time.
	Until *time.Time
	// AgentNames filters by agent name(s).
	AgentNames []string
	// SessionID filters by a specific session.
	SessionID *uuid.UUID
	// ActionTypes filters by action type(s).
	ActionTypes []ActionType
	// ResultStatuses filters by result status(es).
	ResultStatuses []ResultStatus
	// FilePattern is a glob pattern to filter by file path.
	FilePattern string
	// CommandPattern is a glob pattern to filter by command.
	CommandPattern string
	// Sensitive filters to events involving sensitive file access when non-nil.
	Sensitive *bool
	// Limit is the maximum number of results.
	Limit int
	// Offset is the number of results to skip.
	Offset int
	// Sort controls the sort direction (desc by default).
	Sort SortOrder
}

EventFilter provides filtering criteria for querying events.

func Last24Hours

func Last24Hours() *EventFilter

Last24Hours returns a filter for events in the last 24 hours.

func NewEventFilter

func NewEventFilter() *EventFilter

NewEventFilter creates a new EventFilter with default values.

func Today

func Today() *EventFilter

Today returns a filter for events from today (midnight to now).

func Yesterday

func Yesterday() *EventFilter

Yesterday returns a filter for events from yesterday.

func (*EventFilter) IsAscending added in v0.5.1

func (f *EventFilter) IsAscending() bool

IsAscending returns true if the sort order is ascending.

func (*EventFilter) WithActions

func (f *EventFilter) WithActions(actions ...ActionType) *EventFilter

WithActions sets the ActionTypes filter.

func (*EventFilter) WithAgents

func (f *EventFilter) WithAgents(agents ...string) *EventFilter

WithAgents sets the AgentNames filter.

func (*EventFilter) WithCommandPattern

func (f *EventFilter) WithCommandPattern(pattern string) *EventFilter

WithCommandPattern sets the CommandPattern filter.

func (*EventFilter) WithFilePattern

func (f *EventFilter) WithFilePattern(pattern string) *EventFilter

WithFilePattern sets the FilePattern filter.

func (*EventFilter) WithLimit

func (f *EventFilter) WithLimit(limit int) *EventFilter

WithLimit sets the Limit.

func (*EventFilter) WithOffset

func (f *EventFilter) WithOffset(offset int) *EventFilter

WithOffset sets the Offset.

func (*EventFilter) WithSensitive added in v0.3.7

func (f *EventFilter) WithSensitive(sensitive bool) *EventFilter

WithSensitive sets the Sensitive filter.

func (*EventFilter) WithSession

func (f *EventFilter) WithSession(sessionID uuid.UUID) *EventFilter

WithSession sets the SessionID filter.

func (*EventFilter) WithSince

func (f *EventFilter) WithSince(t time.Time) *EventFilter

WithSince sets the Since filter.

func (*EventFilter) WithSort added in v0.5.1

func (f *EventFilter) WithSort(order SortOrder) *EventFilter

WithSort sets the sort order.

func (*EventFilter) WithStatuses

func (f *EventFilter) WithStatuses(statuses ...ResultStatus) *EventFilter

WithStatuses sets the ResultStatuses filter.

func (*EventFilter) WithUntil

func (f *EventFilter) WithUntil(t time.Time) *EventFilter

WithUntil sets the Until filter.

type FileDeletePayload

type FileDeletePayload struct {
	Path string `json:"path"`
}

FileDeletePayload represents the payload for file_delete actions.

type FileReadPayload

type FileReadPayload struct {
	Path        string `json:"path"`
	Pattern     string `json:"pattern,omitempty"`
	SizeBytes   int64  `json:"size_bytes,omitempty"`
	ContentHash string `json:"content_hash,omitempty"`
}

FileReadPayload represents the payload for file_read actions.

func (*FileReadPayload) DisplayTarget added in v0.2.1

func (p *FileReadPayload) DisplayTarget() string

DisplayTarget returns the best available identifier for display purposes. It prefers Path, falling back to Pattern for tools like Glob/Grep that may only have a search pattern and no explicit directory.

type FileWritePayload

type FileWritePayload struct {
	Path           string `json:"path"`
	SizeBytes      int64  `json:"size_bytes,omitempty"`
	ContentHash    string `json:"content_hash,omitempty"`
	ContentPreview string `json:"content_preview,omitempty"`
	OldString      string `json:"old_string,omitempty"`
	NewString      string `json:"new_string,omitempty"`
	LinesAdded     int    `json:"lines_added,omitempty"`
	LinesRemoved   int    `json:"lines_removed,omitempty"`
}

FileWritePayload represents the payload for file_write actions.

type NotificationPayload

type NotificationPayload struct {
	Message string          `json:"message,omitempty"`
	Type    string          `json:"type,omitempty"`
	Details json.RawMessage `json:"details,omitempty"`
}

NotificationPayload represents the payload for notification actions.

type PrivacyChecker

type PrivacyChecker struct {
	// contains filtered or unexported fields
}

PrivacyChecker determines if paths are sensitive and handles content redaction.

func NewPrivacyChecker

func NewPrivacyChecker(sensitivePatterns []string, redactPatterns []string) (*PrivacyChecker, error)

NewPrivacyChecker creates a new PrivacyChecker with the given patterns.

func (*PrivacyChecker) IsSensitivePath

func (p *PrivacyChecker) IsSensitivePath(path string) bool

IsSensitivePath checks if the given path matches any sensitive pattern.

func (*PrivacyChecker) Redact

func (p *PrivacyChecker) Redact(content string) string

Redact applies redaction patterns to the content, replacing matches with [REDACTED].

func (*PrivacyChecker) RedactJSON added in v0.7.0

func (p *PrivacyChecker) RedactJSON(content []byte) []byte

RedactJSON applies redaction to string values inside a JSON document while preserving its structure. Greedy patterns like \S+ would otherwise consume JSON delimiters and produce invalid JSON if Redact were applied to the raw bytes. If the input is not valid JSON, falls back to byte-level string redaction.

type ResultStatus

type ResultStatus string

ResultStatus represents the outcome of an agent action.

const (
	// ResultSuccess indicates the action completed successfully.
	ResultSuccess ResultStatus = "success"
	// ResultError indicates the action failed with an error.
	ResultError ResultStatus = "error"
	// ResultBlocked indicates the action was blocked by policy.
	ResultBlocked ResultStatus = "blocked"
	// ResultRejected indicates the user rejected the action.
	ResultRejected ResultStatus = "rejected"
)

func (ResultStatus) IsValid

func (r ResultStatus) IsValid() bool

IsValid returns true if the ResultStatus is a known status.

func (ResultStatus) String

func (r ResultStatus) String() string

String returns the string representation of a ResultStatus.

type SessionEndPayload

type SessionEndPayload struct {
	Reason string `json:"reason,omitempty"`
}

SessionEndPayload represents the payload for session_end actions.

type SessionPayload

type SessionPayload struct {
	Source    string `json:"source,omitempty"`
	Model     string `json:"model,omitempty"`
	AgentType string `json:"agent_type,omitempty"`
}

SessionPayload represents the payload for session_start actions.

type SortOrder added in v0.5.1

type SortOrder string

SortOrder defines the sort direction for query results.

const (
	SortDesc SortOrder = "desc"
	SortAsc  SortOrder = "asc"
)

type SubagentStartPayload added in v0.7.0

type SubagentStartPayload struct {
	AgentID   string `json:"agent_id"`
	AgentType string `json:"agent_type"`
}

SubagentStartPayload represents the payload for subagent_start actions.

type SubagentStopPayload added in v0.7.0

type SubagentStopPayload struct {
	AgentID              string `json:"agent_id"`
	AgentType            string `json:"agent_type"`
	AgentTranscriptPath  string `json:"agent_transcript_path,omitempty"`
	LastAssistantMessage string `json:"last_assistant_message,omitempty"`
}

SubagentStopPayload represents the payload for subagent_stop actions.

type ToolUsePayload

type ToolUsePayload struct {
	ToolName      string          `json:"tool_name"`
	Input         json.RawMessage `json:"input,omitempty"`
	Output        json.RawMessage `json:"output,omitempty"`
	OutputPreview string          `json:"output_preview,omitempty"`
}

ToolUsePayload represents the payload for tool_use actions.

func (*ToolUsePayload) DisplayTarget added in v0.3.4

func (p *ToolUsePayload) DisplayTarget() string

DisplayTarget returns the most relevant identifier from Input for display. It checks a prioritised list of well-known fields (url, query, command, …) and returns the first non-empty string value found.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL