Documentation
¶
Overview ¶
Package events provides the core event model and types for audit logging.
Index ¶
- Constants
- func DefaultRedactPatterns() []string
- func DefaultSensitivePatterns() []string
- type ActionType
- type CommandExecPayload
- type Event
- func (e *Event) GetCommandExecPayload() (*CommandExecPayload, error)
- func (e *Event) GetFileDeletePayload() (*FileDeletePayload, error)
- func (e *Event) GetFileReadPayload() (*FileReadPayload, error)
- func (e *Event) GetFileWritePayload() (*FileWritePayload, error)
- func (e *Event) GetNotificationPayload() (*NotificationPayload, error)
- func (e *Event) GetToolUsePayload() (*ToolUsePayload, error)
- func (e Event) MarshalJSON() ([]byte, error)
- func (e *Event) SetPayload(payload interface{}) error
- type EventFilter
- func (f *EventFilter) IsAscending() bool
- func (f *EventFilter) WithActions(actions ...ActionType) *EventFilter
- func (f *EventFilter) WithAgents(agents ...string) *EventFilter
- func (f *EventFilter) WithCommandPattern(pattern string) *EventFilter
- func (f *EventFilter) WithFilePattern(pattern string) *EventFilter
- func (f *EventFilter) WithLimit(limit int) *EventFilter
- func (f *EventFilter) WithOffset(offset int) *EventFilter
- func (f *EventFilter) WithSensitive(sensitive bool) *EventFilter
- func (f *EventFilter) WithSession(sessionID uuid.UUID) *EventFilter
- func (f *EventFilter) WithSince(t time.Time) *EventFilter
- func (f *EventFilter) WithSort(order SortOrder) *EventFilter
- func (f *EventFilter) WithStatuses(statuses ...ResultStatus) *EventFilter
- func (f *EventFilter) WithUntil(t time.Time) *EventFilter
- type FileDeletePayload
- type FileReadPayload
- type FileWritePayload
- type NotificationPayload
- type PrivacyChecker
- type ResultStatus
- type SessionEndPayload
- type SessionPayload
- type SortOrder
- type SubagentStartPayload
- type SubagentStopPayload
- type ToolUsePayload
Constants ¶
const EventSchemaURL = "https://raw.githubusercontent.com/safedep/gryph/main/schema/event.schema.json"
EventSchemaURL is the canonical URL for the Event JSON Schema hosted on GitHub.
Variables ¶
This section is empty.
Functions ¶
func DefaultRedactPatterns ¶
func DefaultRedactPatterns() []string
DefaultRedactPatterns returns the default list of redaction regex patterns.
func DefaultSensitivePatterns ¶
func DefaultSensitivePatterns() []string
DefaultSensitivePatterns returns the default list of sensitive path patterns.
Types ¶
type ActionType ¶
type ActionType string
ActionType represents the type of action performed by an agent.
const ( // ActionFileRead indicates an agent read a file. ActionFileRead ActionType = "file_read" // ActionFileWrite indicates an agent wrote/modified a file. ActionFileWrite ActionType = "file_write" // ActionFileDelete indicates an agent deleted a file. ActionFileDelete ActionType = "file_delete" // ActionCommandExec indicates an agent executed a shell command. ActionCommandExec ActionType = "command_exec" // ActionNetworkRequest indicates an agent made an HTTP request. ActionNetworkRequest ActionType = "network_request" // ActionToolUse indicates other tool invocation. ActionToolUse ActionType = "tool_use" // ActionSessionStart indicates a session started. ActionSessionStart ActionType = "session_start" // ActionSessionEnd indicates a session ended. ActionSessionEnd ActionType = "session_end" // ActionNotification indicates a notification was sent. ActionNotification ActionType = "notification" // ActionSubagentStart indicates a subagent was spawned. ActionSubagentStart ActionType = "subagent_start" // ActionSubagentStop indicates a subagent completed. ActionSubagentStop ActionType = "subagent_stop" // ActionUnknown indicates an unrecognized action type. ActionUnknown ActionType = "unknown" )
func ParseActionType ¶ added in v0.2.7
func ParseActionType(s string) (ActionType, error)
ParseActionType parses a string into an ActionType, accepting both full names (e.g. "file_write") and display names (e.g. "write").
func (ActionType) DisplayName ¶ added in v0.2.7
func (a ActionType) DisplayName() string
DisplayName returns a short human-readable name for the action type.
func (ActionType) IsValid ¶
func (a ActionType) IsValid() bool
IsValid returns true if the ActionType is a known type.
func (ActionType) String ¶
func (a ActionType) String() string
String returns the string representation of an ActionType.
type CommandExecPayload ¶
type CommandExecPayload struct {
Command string `json:"command"`
Description string `json:"description,omitempty"`
Args []string `json:"args,omitempty"`
ExitCode int `json:"exit_code"`
Output string `json:"output,omitempty"`
DurationMs int64 `json:"duration_ms,omitempty"`
StdoutPreview string `json:"stdout_preview,omitempty"`
StderrPreview string `json:"stderr_preview,omitempty"`
}
CommandExecPayload represents the payload for command_exec actions.
type Event ¶
type Event struct {
// ID is the unique identifier for this event.
ID uuid.UUID `json:"id"`
// SessionID links this event to its parent session (deterministic UUID derived from AgentSessionID).
SessionID uuid.UUID `json:"session_id"`
// AgentSessionID is the original session ID string from the agent (for correlation).
AgentSessionID string `json:"agent_session_id,omitempty"`
// Sequence is the order within the session (1, 2, 3...).
Sequence int `json:"sequence"`
// Timestamp is when the action occurred (UTC).
Timestamp time.Time `json:"timestamp"`
// DurationMs is how long the action took in milliseconds.
DurationMs int64 `json:"duration_ms,omitempty"`
// AgentName is the identifier of the agent (e.g., "claude-code").
AgentName string `json:"agent_name"`
// AgentVersion is the version of the agent if detectable.
AgentVersion string `json:"agent_version,omitempty"`
// WorkingDirectory may differ from session if agent changed dirs.
WorkingDirectory string `json:"working_directory,omitempty"`
// ActionType is the category of action performed.
ActionType ActionType `json:"action_type"`
// ToolName is the original tool name from the agent.
ToolName string `json:"tool_name,omitempty"`
// ResultStatus is the outcome of the action.
ResultStatus ResultStatus `json:"result_status"`
// ErrorMessage contains error details if status is error.
ErrorMessage string `json:"error_message,omitempty"`
// Payload contains action-specific data.
Payload json.RawMessage `json:"payload,omitempty"`
// DiffContent contains file diff (full logging only, never for sensitive paths).
DiffContent string `json:"diff_content,omitempty"`
// RawEvent is the original event from agent (full logging only).
RawEvent json.RawMessage `json:"raw_event,omitempty"`
// ConversationContext is the prompt/conversation (full logging only).
ConversationContext string `json:"conversation_context,omitempty"`
// TranscriptPath is the path to the agent's transcript file (if provided by the agent).
// Excluded from JSON export as it is internal to the local machine.
TranscriptPath string `json:"-"`
// IsSensitive is true if path matched sensitive_paths pattern.
IsSensitive bool `json:"is_sensitive"`
// SubagentID is set when this event was performed by a subagent (empty for main agent).
SubagentID string `json:"subagent_id,omitempty"`
// SubagentType is the type of subagent (e.g., "Explore", "Plan", "general-purpose").
SubagentType string `json:"subagent_type,omitempty"`
}
Event represents a single action performed by an agent.
func NewEvent ¶
func NewEvent(sessionID uuid.UUID, agentName string, actionType ActionType) *Event
NewEvent creates a new Event with a generated UUID and current timestamp.
func (*Event) GetCommandExecPayload ¶
func (e *Event) GetCommandExecPayload() (*CommandExecPayload, error)
GetCommandExecPayload unmarshals the payload as a CommandExecPayload.
func (*Event) GetFileDeletePayload ¶ added in v0.5.0
func (e *Event) GetFileDeletePayload() (*FileDeletePayload, error)
GetFileDeletePayload unmarshals the payload as a FileDeletePayload.
func (*Event) GetFileReadPayload ¶
func (e *Event) GetFileReadPayload() (*FileReadPayload, error)
GetFileReadPayload unmarshals the payload as a FileReadPayload.
func (*Event) GetFileWritePayload ¶
func (e *Event) GetFileWritePayload() (*FileWritePayload, error)
GetFileWritePayload unmarshals the payload as a FileWritePayload.
func (*Event) GetNotificationPayload ¶ added in v0.5.0
func (e *Event) GetNotificationPayload() (*NotificationPayload, error)
GetNotificationPayload unmarshals the payload as a NotificationPayload.
func (*Event) GetToolUsePayload ¶ added in v0.3.4
func (e *Event) GetToolUsePayload() (*ToolUsePayload, error)
GetToolUsePayload unmarshals the payload as a ToolUsePayload.
func (Event) MarshalJSON ¶ added in v0.3.2
MarshalJSON implements json.Marshaler to include $schema in the JSON output.
func (*Event) SetPayload ¶
SetPayload marshals the given payload and sets it on the event.
type EventFilter ¶
type EventFilter struct {
// Since filters events after this time.
Since *time.Time
// Until filters events before this time.
Until *time.Time
// AgentNames filters by agent name(s).
AgentNames []string
// SessionID filters by a specific session.
SessionID *uuid.UUID
// ActionTypes filters by action type(s).
ActionTypes []ActionType
// ResultStatuses filters by result status(es).
ResultStatuses []ResultStatus
// FilePattern is a glob pattern to filter by file path.
FilePattern string
// CommandPattern is a glob pattern to filter by command.
CommandPattern string
// Sensitive filters to events involving sensitive file access when non-nil.
Sensitive *bool
// Limit is the maximum number of results.
Limit int
// Offset is the number of results to skip.
Offset int
// Sort controls the sort direction (desc by default).
Sort SortOrder
}
EventFilter provides filtering criteria for querying events.
func Last24Hours ¶
func Last24Hours() *EventFilter
Last24Hours returns a filter for events in the last 24 hours.
func NewEventFilter ¶
func NewEventFilter() *EventFilter
NewEventFilter creates a new EventFilter with default values.
func Today ¶
func Today() *EventFilter
Today returns a filter for events from today (midnight to now).
func Yesterday ¶
func Yesterday() *EventFilter
Yesterday returns a filter for events from yesterday.
func (*EventFilter) IsAscending ¶ added in v0.5.1
func (f *EventFilter) IsAscending() bool
IsAscending returns true if the sort order is ascending.
func (*EventFilter) WithActions ¶
func (f *EventFilter) WithActions(actions ...ActionType) *EventFilter
WithActions sets the ActionTypes filter.
func (*EventFilter) WithAgents ¶
func (f *EventFilter) WithAgents(agents ...string) *EventFilter
WithAgents sets the AgentNames filter.
func (*EventFilter) WithCommandPattern ¶
func (f *EventFilter) WithCommandPattern(pattern string) *EventFilter
WithCommandPattern sets the CommandPattern filter.
func (*EventFilter) WithFilePattern ¶
func (f *EventFilter) WithFilePattern(pattern string) *EventFilter
WithFilePattern sets the FilePattern filter.
func (*EventFilter) WithLimit ¶
func (f *EventFilter) WithLimit(limit int) *EventFilter
WithLimit sets the Limit.
func (*EventFilter) WithOffset ¶
func (f *EventFilter) WithOffset(offset int) *EventFilter
WithOffset sets the Offset.
func (*EventFilter) WithSensitive ¶ added in v0.3.7
func (f *EventFilter) WithSensitive(sensitive bool) *EventFilter
WithSensitive sets the Sensitive filter.
func (*EventFilter) WithSession ¶
func (f *EventFilter) WithSession(sessionID uuid.UUID) *EventFilter
WithSession sets the SessionID filter.
func (*EventFilter) WithSince ¶
func (f *EventFilter) WithSince(t time.Time) *EventFilter
WithSince sets the Since filter.
func (*EventFilter) WithSort ¶ added in v0.5.1
func (f *EventFilter) WithSort(order SortOrder) *EventFilter
WithSort sets the sort order.
func (*EventFilter) WithStatuses ¶
func (f *EventFilter) WithStatuses(statuses ...ResultStatus) *EventFilter
WithStatuses sets the ResultStatuses filter.
func (*EventFilter) WithUntil ¶
func (f *EventFilter) WithUntil(t time.Time) *EventFilter
WithUntil sets the Until filter.
type FileDeletePayload ¶
type FileDeletePayload struct {
Path string `json:"path"`
}
FileDeletePayload represents the payload for file_delete actions.
type FileReadPayload ¶
type FileReadPayload struct {
Path string `json:"path"`
Pattern string `json:"pattern,omitempty"`
SizeBytes int64 `json:"size_bytes,omitempty"`
ContentHash string `json:"content_hash,omitempty"`
}
FileReadPayload represents the payload for file_read actions.
func (*FileReadPayload) DisplayTarget ¶ added in v0.2.1
func (p *FileReadPayload) DisplayTarget() string
DisplayTarget returns the best available identifier for display purposes. It prefers Path, falling back to Pattern for tools like Glob/Grep that may only have a search pattern and no explicit directory.
type FileWritePayload ¶
type FileWritePayload struct {
Path string `json:"path"`
SizeBytes int64 `json:"size_bytes,omitempty"`
ContentHash string `json:"content_hash,omitempty"`
ContentPreview string `json:"content_preview,omitempty"`
OldString string `json:"old_string,omitempty"`
NewString string `json:"new_string,omitempty"`
LinesAdded int `json:"lines_added,omitempty"`
LinesRemoved int `json:"lines_removed,omitempty"`
}
FileWritePayload represents the payload for file_write actions.
type NotificationPayload ¶
type NotificationPayload struct {
Message string `json:"message,omitempty"`
Type string `json:"type,omitempty"`
Details json.RawMessage `json:"details,omitempty"`
}
NotificationPayload represents the payload for notification actions.
type PrivacyChecker ¶
type PrivacyChecker struct {
// contains filtered or unexported fields
}
PrivacyChecker determines if paths are sensitive and handles content redaction.
func NewPrivacyChecker ¶
func NewPrivacyChecker(sensitivePatterns []string, redactPatterns []string) (*PrivacyChecker, error)
NewPrivacyChecker creates a new PrivacyChecker with the given patterns.
func (*PrivacyChecker) IsSensitivePath ¶
func (p *PrivacyChecker) IsSensitivePath(path string) bool
IsSensitivePath checks if the given path matches any sensitive pattern.
func (*PrivacyChecker) Redact ¶
func (p *PrivacyChecker) Redact(content string) string
Redact applies redaction patterns to the content, replacing matches with [REDACTED].
func (*PrivacyChecker) RedactJSON ¶ added in v0.7.0
func (p *PrivacyChecker) RedactJSON(content []byte) []byte
RedactJSON applies redaction to string values inside a JSON document while preserving its structure. Greedy patterns like \S+ would otherwise consume JSON delimiters and produce invalid JSON if Redact were applied to the raw bytes. If the input is not valid JSON, falls back to byte-level string redaction.
type ResultStatus ¶
type ResultStatus string
ResultStatus represents the outcome of an agent action.
const ( // ResultSuccess indicates the action completed successfully. ResultSuccess ResultStatus = "success" // ResultError indicates the action failed with an error. ResultError ResultStatus = "error" // ResultBlocked indicates the action was blocked by policy. ResultBlocked ResultStatus = "blocked" // ResultRejected indicates the user rejected the action. ResultRejected ResultStatus = "rejected" )
func (ResultStatus) IsValid ¶
func (r ResultStatus) IsValid() bool
IsValid returns true if the ResultStatus is a known status.
func (ResultStatus) String ¶
func (r ResultStatus) String() string
String returns the string representation of a ResultStatus.
type SessionEndPayload ¶
type SessionEndPayload struct {
Reason string `json:"reason,omitempty"`
}
SessionEndPayload represents the payload for session_end actions.
type SessionPayload ¶
type SessionPayload struct {
Source string `json:"source,omitempty"`
Model string `json:"model,omitempty"`
AgentType string `json:"agent_type,omitempty"`
}
SessionPayload represents the payload for session_start actions.
type SortOrder ¶ added in v0.5.1
type SortOrder string
SortOrder defines the sort direction for query results.
type SubagentStartPayload ¶ added in v0.7.0
type SubagentStartPayload struct {
AgentID string `json:"agent_id"`
AgentType string `json:"agent_type"`
}
SubagentStartPayload represents the payload for subagent_start actions.
type SubagentStopPayload ¶ added in v0.7.0
type SubagentStopPayload struct {
AgentID string `json:"agent_id"`
AgentType string `json:"agent_type"`
AgentTranscriptPath string `json:"agent_transcript_path,omitempty"`
LastAssistantMessage string `json:"last_assistant_message,omitempty"`
}
SubagentStopPayload represents the payload for subagent_stop actions.
type ToolUsePayload ¶
type ToolUsePayload struct {
ToolName string `json:"tool_name"`
Input json.RawMessage `json:"input,omitempty"`
Output json.RawMessage `json:"output,omitempty"`
OutputPreview string `json:"output_preview,omitempty"`
}
ToolUsePayload represents the payload for tool_use actions.
func (*ToolUsePayload) DisplayTarget ¶ added in v0.3.4
func (p *ToolUsePayload) DisplayTarget() string
DisplayTarget returns the most relevant identifier from Input for display. It checks a prioritised list of well-known fields (url, query, command, …) and returns the first non-empty string value found.