Sync with upstream langfuse v1.2.1, keeping our backlog fix and agent-type tags

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "langfuse-observability",
   "description": "The Langfuse x Claude Code Observability Plugin",
-  "version": "1.0.0",
+  "version": "1.2.1",
   "author": {
     "name": "Langfuse"
   },
@@ -13,20 +13,18 @@
       "type": "string",
       "title": "Langfuse Secret Key",
       "description": "Your Langfuse project secret key (sk-lf-...)",
-      "sensitive": true,
-      "required": true
+      "sensitive": true
     },
     "LANGFUSE_PUBLIC_KEY": {
       "type": "string",
       "title": "Langfuse Public Key",
-      "description": "Your Langfuse project public key (pk-lf-...)",
-      "required": true
+      "description": "Your Langfuse project public key (pk-lf-...)"
     },
     "LANGFUSE_BASE_URL": {
       "type": "string",
       "title": "Langfuse Base URL",
       "description": "Langfuse host. Use https://us.cloud.langfuse.com for US, https://cloud.langfuse.com for EU, or your self-hosted URL.",
-      "default": "https://us.cloud.langfuse.com"
+      "default": "https://cloud.langfuse.com"
     },
     "LANGFUSE_USER_ID": {
       "type": "string",
@@ -57,6 +55,17 @@
       "description": "Include the injected skill instruction text in the Skill tool span output",
       "default": false
     },
+    "CC_LANGFUSE_CAPTURE_IMAGES": {
+      "type": "boolean",
+      "title": "Capture images",
+      "description": "Upload images to Langfuse and show them in the trace. This includes pasted images and screenshots from tool results. Your Langfuse deployment must support media upload. Set to false to show short text markers instead.",
+      "default": true
+    },
+    "CC_LANGFUSE_STATE_DIR": {
+      "type": "string",
+      "title": "State directory",
+      "description": "Optional. Absolute directory for the hook's state, lock and log files (default ~/.claude/state). Set a distinct value per CLAUDE_CONFIG_DIR installation to keep their state separate. Leave empty for the default."
+    },
     "CC_LANGFUSE_TRACE_SEED": {
       "type": "string",
       "title": "Trace ID seed",

.github/workflows/ci.yml

@@ -0,0 +1,71 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test on Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.13"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          enable-cache: true
+      - name: Test
+        run: uv run --python ${{ matrix.python-version }} --group dev pytest
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          enable-cache: true
+      - name: Ruff
+        run: uvx ruff check --select F,E9 .
+
+  hook-smoke:
+    name: Hook starts from its own script header
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          enable-cache: true
+      - name: Run the hook with an empty payload
+        run: echo '{}' | uv run --script hooks/langfuse_hook.py

.github/workflows/release.yml

@@ -0,0 +1,44 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions: {}
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Verify the tag and draft a GitHub release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Validate release version
+        run: |
+          manifest_version="$(python3 -c 'import json; print(json.load(open(".claude-plugin/plugin.json"))["version"])')"
+          if [[ "$GITHUB_REF_NAME" != "v$manifest_version" ]]; then
+            echo "Tag $GITHUB_REF_NAME does not match plugin.json version $manifest_version" >&2
+            exit 1
+          fi
+      - name: Setup uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Test
+        run: uv run --group dev pytest
+      - name: Run the hook with an empty payload
+        run: echo '{}' | uv run --script hooks/langfuse_hook.py
+      # Draft, so the notes get a human pass before anyone sees them.
+      - name: Create draft GitHub release
+        run: gh release create "$GITHUB_REF_NAME" --draft --generate-notes --verify-tag
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/zizmor.yml

@@ -0,0 +1,36 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: Check GitHub Actions
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+  merge_group:
+  pull_request:
+    branches:
+      - "main"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Check GitHub Actions security
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        with:
+          # Findings upload to code scanning only on push; a pull request from a
+          # fork has no write token for it.
+          advanced-security: ${{ github.event_name == 'push' && 'true' || 'false' }}
+          min-severity: low

CONTRIBUTING.md

@@ -0,0 +1,64 @@
+# Development and Maintenance
+
+See the [main CONTRIBUTING.md](https://github.com/langfuse/langfuse/blob/main/CONTRIBUTING.md) to learn how to contribute to Langfuse and its integrations.
+
+## Local Development
+
+The hook is a single uv script with inline dependency metadata, and Claude Code
+runs `hooks/langfuse_hook.py` directly. There is no build step and no package to
+install.
+
+Run the tests:
+
+```bash
+uv run --group dev pytest
+```
+
+Lint with the same rules as CI:
+
+```bash
+uvx ruff check --select F,E9 .
+```
+
+CI also starts the hook once with an empty payload, which catches a broken
+script header before it reaches a user:
+
+```bash
+echo '{}' | uv run --script hooks/langfuse_hook.py
+```
+
+Tests run against Python 3.10 and 3.13 in CI. Add `--python 3.10` to `uv run` to
+reproduce the older matrix entry.
+
+To try your checkout as a real plugin, register the repository itself as a
+marketplace instead of the GitHub one:
+
+```bash
+claude plugin marketplace add /path/to/Claude-Observability-Plugin
+claude plugin install langfuse-observability@langfuse-observability
+```
+
+Restart Claude Code afterwards, so that it loads the hook. Run
+`claude plugin marketplace remove langfuse-observability` when you are done, and
+add the GitHub marketplace again to go back to the released plugin.
+
+## Releasing
+
+1. From a clean, up-to-date `main` branch, raise `version` in
+   `.claude-plugin/plugin.json` and commit that change.
+
+2. Tag the release commit and push both:
+
+   ```bash
+   git tag v1.2.3
+   git push origin main --follow-tags
+   ```
+
+   The release workflow refuses a tag that does not match the manifest version.
+   It then runs the tests and the hook smoke check, and creates a draft GitHub
+   release with generated notes.
+
+3. Review the draft release, give the notes a human pass, and publish it.
+
+Installed plugins do not update themselves, so users reach the new version only
+after `claude plugin marketplace update` and `claude plugin update`.