[adumont]

Summary

• Add OpenCode project ID, working directory, and worktree to every exported span as filterable Langfuse trace metadata.
• Use Langfuse langfuse.trace.metadata.* attributes so the values are available as top-level trace metadata.
• Document the added metadata and cover the attributes with a unit test.

Motivation

OpenCode provides project, directory, and worktree context to plugins, but the Langfuse plugin did not include these values in exported spans. Adding them makes traces easier to identify and filter by the OpenCode workspace they came from.

Validation

• bun run test
• bun run typecheck
• bun run lint
• bun run format:check
• bun run build

Summary by CodeRabbit

• New Features
  • Trace data now includes the OpenCode project ID, working directory, and worktree as filterable metadata in Langfuse.
• Documentation
  • Updated the “How It Works” section to describe the trace metadata.

[greptile-apps]

Your organization has run out of review credits. Add credits to resume code reviews.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7aa9841b-f636-4105-b1d1-b52f9b6c8330

Commits

Reviewing files that changed from the base of the PR and between c038f6e and 8eac987.

Files selected for processing: 3

• README.md
• src/index.test.ts
• src/index.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The plugin now adds the OpenCode project ID, working directory, and worktree to spans as Langfuse trace metadata. Tests check the metadata attributes, and the README documents the fields.

Changes: Trace metadata

Layer / File(s)	Summary
Add project context to spans src/index.ts, src/index.test.ts, README.md	The plugin registers a processor before the Langfuse processor. It adds project, directory, and worktree values under langfuse.trace.metadata.*. A test checks the values, and the README describes them.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: omercnet

Merge Risk: Minimal · up to 8eac9

The trace metadata change is ready to merge after normal checks; no blocking issue was found.

Security architecture risk: Low · up to 8eac9

The change intentionally exports additional workspace information to the existing tracing destination without adding permissions or another recipient. Filesystem paths can contain sensitive names. Cross-workspace attribution and downstream handling remain unverified, but no concrete boundary bypass was established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The added exposure is bounded to three context values on spans reaching this processor and the existing configured Langfuse destination. Directory components may reveal user, repository or customer names; the evidence does not establish actual sensitive contents or who can view the resulting remote traces.

Trust Boundaries and Controls

• observed — The changed entrypoint receives context through the OpenCode plugin invocation rather than introducing a new remote request handler. Missing Langfuse credentials prevent SDK initialization. This gate controls tracing as a whole, not the individual metadata fields.

Resilience and Maintainability Implications

• observed — The metadata closure is specific to one plugin invocation, but applies its values to every span delivered to it. The added test checks direct attribute assignment using a mocked SDK; it does not establish provider ownership or attribution across concurrent instances, disposal and reinitialization.

Hardening Proposals

• proposed — For deployments where workspace names are sensitive, consider configurable omission or pseudonymization of directory and worktree before export while retaining useful project-level filtering.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "Add OpenCode context metadata to Langfuse traces" matches the main change. The PR adds OpenCode project ID, working directory, and worktree as Langfuse trace metadata (langfuse.trace.metada…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "Add OpenCode context metadata to Langfuse traces" matches the main change. The PR adds OpenCode project ID, working directory, and worktree as Langfuse trace metadata (langfuse.trace.metadata.* attributes) through a new metadata SpanProcessor in LangfusePlugin, plus a README update and a unit test. The title is specific, concise, and not vague. The commit message uses a feat: prefix, which is consistent with the title.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

src/index.test.ts

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

src/index.ts

ESLint skipped: the matched ESLint configuration already failed (missing-dependency).

_{Comment @coderabbitai help to get the list of available commands.}