Module: Ask::Ruby::Harness::AuditLog

Defined in:
lib/ask/ruby/harness/audit_log.rb

Overview

Append-only audit log for tool executions.

Every tool call made by an agent is recorded in the ask_audit_logs table (when one is available) with the intent (sanitized params) and outcome (status, timing), but not the data returned. A audit_log.ask_ruby_harness ActiveSupport notification fires either way, so hosts can subscribe without the table.

Sensitive param values (keys matching password, secret, token, api_key, key) are automatically redacted before logging.

Constant Summary collapse

SENSITIVE_KEYS = 
/\A(password|secret|token|api_key|key|auth_token|access_token)\z/i

Class Method Summary collapse

Class Method Details

.log(session_id:, tool_name:, params:, result: nil, error: nil, duration_ms:) ⇒ Object

Log a tool execution event.

Parameters:

  • session_id (String) —

    The agent session that triggered this call

  • tool_name (String) —

    Name of the tool that ran

  • params (Hash) —

    The parameters passed to the tool (sanitized automatically)

  • result (Ask::Result, Hash, nil) (defaults to: nil) —

    The result returned by the tool

  • error (StandardError, nil) (defaults to: nil) —

    The exception if the tool raised

  • duration_ms (Integer) —

    Wall-clock time for the tool execution

  • user_context (Hash, nil) —

    Who initiated the session (from config)



33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/ask/ruby/harness/audit_log.rb', line 33

def log(session_id:, tool_name:, params:, result: nil, error: nil, duration_ms:)
  now = Time.now.utc
  entry = {
    session_id: session_id,
    tool_name: tool_name,
    params: sanitize_params(params),
    result_summary: build_summary(tool_name, result, error),
    status: determine_status(result, error),
    error_message: determine_error(result, error),
    duration_ms: duration_ms,
    user_context: resolve_user_context,
    environment: environment_name,
    recorded_at: now,
    created_at: now,
    updated_at: now
  }

  if table_exists?
    write_entry(entry)
  end

  # Fire an ActiveSupport notification so host apps can subscribe
  ActiveSupport::Notifications.instrument("audit_log.ask_ruby_harness", entry)

  entry
end

.reset_table_check! ⇒ Object 



181
182
183
 
# File 'lib/ask/ruby/harness/audit_log.rb', line 181

def reset_table_check!
  @table_exists = nil
end