chore(bots): regenerate registry for xAI-SearchBot and LinkupBot by cport1 · Pull Request #39 · WebDecoy/node

cport1 · 2026-08-25T17:32:10Z

Companion to app#809.

Both crawlers were hitting WebDecoy production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed:

	detections	last seen
`xAI-SearchBot/1.0`	31	today
`LinkupBot/1.0`	148	2026-08-24

Generated, not hand-edited. pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit.

The registry count guard moves 169 → 171. It exists to make a registry change deliberate rather than incidental, so bumping it is the intended workflow.

397 tests pass, parity vectors included.

A span around protect() and a child around rule evaluation, carrying the decision id (which joins a span to its dashboard row), the conclusion, the deciding rule, and whether the request cost a round trip to ingest. The tracer is INJECTED, not imported. An optional peer dependency was the obvious route and the wrong one: this package is dependency-free and passes an edge-compatibility gate, and Workers and Vercel Edge are exactly where a stray transitive import hurts. A conditional import('@opentelemetry/api') bundles badly too -- the bundler either resolves it, adding weight for the majority who do not use it, or fails on a module that is legitimately absent. The Tracer type is a structural subset of OpenTelemetry's, so trace.getTracer('webdecoy') satisfies it with no adapter. Omit it and there are no spans, no dependency and no behaviour change, which is the majority case and should cost them nothing. A tracer cannot break a request. startSpan returning nothing, throwing, or returning a span whose every method throws all degrade to a no-op -- observability that can take the request path down is worse than none. The no-op span also means call sites need no null checks, and an `if (span)` is a branch that gets forgotten on the path that mattered. Eight tests, four of them hostile tracers. Also asserts the span is ended on the ERROR path: a leaked span holds memory and never reaches the exporter, so the trace is silently incomplete rather than absent. ClosesWebDecoy/app#740

Companion to WebDecoy/app. Both crawlers were hitting production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed. Generated, not hand-edited: pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit. The registry count guard moves 169 -> 171. It exists to make a registry change deliberate rather than incidental, so bumping it here is the intended workflow rather than a nuisance. 397 tests pass, parity vectors included.

Companion to WebDecoy/app. DuckAssistBot, SofyaBot, Reflectionbot and IbouBot join xAI-SearchBot and LinkupBot; all six were crawling production and landing unclassified. IbouBot is registered as a SEARCH crawler, not AI: its own page states it is a Cloudflare Verified Bot classified as Search. It arrived in the same unclassified tail as the others and does not belong with them. Count guard 171 -> 175. 397 tests pass.

cport1 · 2026-08-25T17:32:10Z

Companion to app#809.

Both crawlers were hitting WebDecoy production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed:

	detections	last seen
`xAI-SearchBot/1.0`	31	today
`LinkupBot/1.0`	148	2026-08-24

Generated, not hand-edited. pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit.

The registry count guard moves 169 → 171. It exists to make a registry change deliberate rather than incidental, so bumping it is the intended workflow.

397 tests pass, parity vectors included.

A span around protect() and a child around rule evaluation, carrying the decision id (which joins a span to its dashboard row), the conclusion, the deciding rule, and whether the request cost a round trip to ingest. The tracer is INJECTED, not imported. An optional peer dependency was the obvious route and the wrong one: this package is dependency-free and passes an edge-compatibility gate, and Workers and Vercel Edge are exactly where a stray transitive import hurts. A conditional import('@opentelemetry/api') bundles badly too -- the bundler either resolves it, adding weight for the majority who do not use it, or fails on a module that is legitimately absent. The Tracer type is a structural subset of OpenTelemetry's, so trace.getTracer('webdecoy') satisfies it with no adapter. Omit it and there are no spans, no dependency and no behaviour change, which is the majority case and should cost them nothing. A tracer cannot break a request. startSpan returning nothing, throwing, or returning a span whose every method throws all degrade to a no-op -- observability that can take the request path down is worse than none. The no-op span also means call sites need no null checks, and an `if (span)` is a branch that gets forgotten on the path that mattered. Eight tests, four of them hostile tracers. Also asserts the span is ended on the ERROR path: a leaked span holds memory and never reaches the exporter, so the trace is silently incomplete rather than absent. ClosesWebDecoy/app#740

Companion to WebDecoy/app. Both crawlers were hitting production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed. Generated, not hand-edited: pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit. The registry count guard moves 169 -> 171. It exists to make a registry change deliberate rather than incidental, so bumping it here is the intended workflow rather than a nuisance. 397 tests pass, parity vectors included.

Companion to WebDecoy/app. DuckAssistBot, SofyaBot, Reflectionbot and IbouBot join xAI-SearchBot and LinkupBot; all six were crawling production and landing unclassified. IbouBot is registered as a SEARCH crawler, not AI: its own page states it is a Cloudflare Verified Bot classified as Search. It arrived in the same unclassified tail as the others and does not belong with them. Count guard 171 -> 175. 397 tests pass.

cport1 · 2026-08-25T17:32:10Z

Companion to app#809.

Both crawlers were hitting WebDecoy production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed:

	detections	last seen
`xAI-SearchBot/1.0`	31	today
`LinkupBot/1.0`	148	2026-08-24

Generated, not hand-edited. pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit.

The registry count guard moves 169 → 171. It exists to make a registry change deliberate rather than incidental, so bumping it is the intended workflow.

397 tests pass, parity vectors included.

A span around protect() and a child around rule evaluation, carrying the decision id (which joins a span to its dashboard row), the conclusion, the deciding rule, and whether the request cost a round trip to ingest. The tracer is INJECTED, not imported. An optional peer dependency was the obvious route and the wrong one: this package is dependency-free and passes an edge-compatibility gate, and Workers and Vercel Edge are exactly where a stray transitive import hurts. A conditional import('@opentelemetry/api') bundles badly too -- the bundler either resolves it, adding weight for the majority who do not use it, or fails on a module that is legitimately absent. The Tracer type is a structural subset of OpenTelemetry's, so trace.getTracer('webdecoy') satisfies it with no adapter. Omit it and there are no spans, no dependency and no behaviour change, which is the majority case and should cost them nothing. A tracer cannot break a request. startSpan returning nothing, throwing, or returning a span whose every method throws all degrade to a no-op -- observability that can take the request path down is worse than none. The no-op span also means call sites need no null checks, and an `if (span)` is a branch that gets forgotten on the path that mattered. Eight tests, four of them hostile tracers. Also asserts the span is ended on the ERROR path: a leaked span holds memory and never reaches the exporter, so the trace is silently incomplete rather than absent. ClosesWebDecoy/app#740

Companion to WebDecoy/app. Both crawlers were hitting production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed. Generated, not hand-edited: pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit. The registry count guard moves 169 -> 171. It exists to make a registry change deliberate rather than incidental, so bumping it here is the intended workflow rather than a nuisance. 397 tests pass, parity vectors included.

Companion to WebDecoy/app. DuckAssistBot, SofyaBot, Reflectionbot and IbouBot join xAI-SearchBot and LinkupBot; all six were crawling production and landing unclassified. IbouBot is registered as a SEARCH crawler, not AI: its own page states it is a Cloudflare Verified Bot classified as Search. It arrived in the same unclassified tail as the others and does not belong with them. Count guard 171 -> 175. 397 tests pass.

cport1 · 2026-08-25T17:32:10Z

Companion to app#809.

Both crawlers were hitting WebDecoy production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed:

	detections	last seen
`xAI-SearchBot/1.0`	31	today
`LinkupBot/1.0`	148	2026-08-24

Generated, not hand-edited. pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit.

The registry count guard moves 169 → 171. It exists to make a registry change deliberate rather than incidental, so bumping it is the intended workflow.

397 tests pass, parity vectors included.

A span around protect() and a child around rule evaluation, carrying the decision id (which joins a span to its dashboard row), the conclusion, the deciding rule, and whether the request cost a round trip to ingest. The tracer is INJECTED, not imported. An optional peer dependency was the obvious route and the wrong one: this package is dependency-free and passes an edge-compatibility gate, and Workers and Vercel Edge are exactly where a stray transitive import hurts. A conditional import('@opentelemetry/api') bundles badly too -- the bundler either resolves it, adding weight for the majority who do not use it, or fails on a module that is legitimately absent. The Tracer type is a structural subset of OpenTelemetry's, so trace.getTracer('webdecoy') satisfies it with no adapter. Omit it and there are no spans, no dependency and no behaviour change, which is the majority case and should cost them nothing. A tracer cannot break a request. startSpan returning nothing, throwing, or returning a span whose every method throws all degrade to a no-op -- observability that can take the request path down is worse than none. The no-op span also means call sites need no null checks, and an `if (span)` is a branch that gets forgotten on the path that mattered. Eight tests, four of them hostile tracers. Also asserts the span is ended on the ERROR path: a leaked span holds memory and never reaches the exporter, so the trace is silently incomplete rather than absent. ClosesWebDecoy/app#740

Companion to WebDecoy/app. Both crawlers were hitting production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed. Generated, not hand-edited: pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit. The registry count guard moves 169 -> 171. It exists to make a registry change deliberate rather than incidental, so bumping it here is the intended workflow rather than a nuisance. 397 tests pass, parity vectors included.

Companion to WebDecoy/app. DuckAssistBot, SofyaBot, Reflectionbot and IbouBot join xAI-SearchBot and LinkupBot; all six were crawling production and landing unclassified. IbouBot is registered as a SEARCH crawler, not AI: its own page states it is a Cloudflare Verified Bot classified as Search. It arrived in the same unclassified tail as the others and does not belong with them. Count guard 171 -> 175. 397 tests pass.

cport1 · 2026-08-25T17:32:10Z

Companion to app#809.

Both crawlers were hitting WebDecoy production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed:

	detections	last seen
`xAI-SearchBot/1.0`	31	today
`LinkupBot/1.0`	148	2026-08-24

Generated, not hand-edited. pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit.

The registry count guard moves 169 → 171. It exists to make a registry change deliberate rather than incidental, so bumping it is the intended workflow.

397 tests pass, parity vectors included.

A span around protect() and a child around rule evaluation, carrying the decision id (which joins a span to its dashboard row), the conclusion, the deciding rule, and whether the request cost a round trip to ingest. The tracer is INJECTED, not imported. An optional peer dependency was the obvious route and the wrong one: this package is dependency-free and passes an edge-compatibility gate, and Workers and Vercel Edge are exactly where a stray transitive import hurts. A conditional import('@opentelemetry/api') bundles badly too -- the bundler either resolves it, adding weight for the majority who do not use it, or fails on a module that is legitimately absent. The Tracer type is a structural subset of OpenTelemetry's, so trace.getTracer('webdecoy') satisfies it with no adapter. Omit it and there are no spans, no dependency and no behaviour change, which is the majority case and should cost them nothing. A tracer cannot break a request. startSpan returning nothing, throwing, or returning a span whose every method throws all degrade to a no-op -- observability that can take the request path down is worse than none. The no-op span also means call sites need no null checks, and an `if (span)` is a branch that gets forgotten on the path that mattered. Eight tests, four of them hostile tracers. Also asserts the span is ended on the ERROR path: a leaked span holds memory and never reaches the exporter, so the trace is silently incomplete rather than absent. ClosesWebDecoy/app#740

Companion to WebDecoy/app. Both crawlers were hitting production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed. Generated, not hand-edited: pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit. The registry count guard moves 169 -> 171. It exists to make a registry change deliberate rather than incidental, so bumping it here is the intended workflow rather than a nuisance. 397 tests pass, parity vectors included.

Companion to WebDecoy/app. DuckAssistBot, SofyaBot, Reflectionbot and IbouBot join xAI-SearchBot and LinkupBot; all six were crawling production and landing unclassified. IbouBot is registered as a SEARCH crawler, not AI: its own page states it is a Cloudflare Verified Bot classified as Search. It arrived in the same unclassified tail as the others and does not belong with them. Count guard 171 -> 175. 397 tests pass.

cport1 · 2026-08-25T17:32:10Z

Companion to app#809.

Both crawlers were hitting WebDecoy production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed:

	detections	last seen
`xAI-SearchBot/1.0`	31	today
`LinkupBot/1.0`	148	2026-08-24

Generated, not hand-edited. pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit.

The registry count guard moves 169 → 171. It exists to make a registry change deliberate rather than incidental, so bumping it is the intended workflow.

397 tests pass, parity vectors included.

A span around protect() and a child around rule evaluation, carrying the decision id (which joins a span to its dashboard row), the conclusion, the deciding rule, and whether the request cost a round trip to ingest. The tracer is INJECTED, not imported. An optional peer dependency was the obvious route and the wrong one: this package is dependency-free and passes an edge-compatibility gate, and Workers and Vercel Edge are exactly where a stray transitive import hurts. A conditional import('@opentelemetry/api') bundles badly too -- the bundler either resolves it, adding weight for the majority who do not use it, or fails on a module that is legitimately absent. The Tracer type is a structural subset of OpenTelemetry's, so trace.getTracer('webdecoy') satisfies it with no adapter. Omit it and there are no spans, no dependency and no behaviour change, which is the majority case and should cost them nothing. A tracer cannot break a request. startSpan returning nothing, throwing, or returning a span whose every method throws all degrade to a no-op -- observability that can take the request path down is worse than none. The no-op span also means call sites need no null checks, and an `if (span)` is a branch that gets forgotten on the path that mattered. Eight tests, four of them hostile tracers. Also asserts the span is ended on the ERROR path: a leaked span holds memory and never reaches the exporter, so the trace is silently incomplete rather than absent. ClosesWebDecoy/app#740

Companion to WebDecoy/app. Both crawlers were hitting production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed. Generated, not hand-edited: pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit. The registry count guard moves 169 -> 171. It exists to make a registry change deliberate rather than incidental, so bumping it here is the intended workflow rather than a nuisance. 397 tests pass, parity vectors included.

Companion to WebDecoy/app. DuckAssistBot, SofyaBot, Reflectionbot and IbouBot join xAI-SearchBot and LinkupBot; all six were crawling production and landing unclassified. IbouBot is registered as a SEARCH crawler, not AI: its own page states it is a Cloudflare Verified Bot classified as Search. It arrived in the same unclassified tail as the others and does not belong with them. Count guard 171 -> 175. 397 tests pass.

cport1 · 2026-08-25T17:32:10Z

Companion to app#809.

Both crawlers were hitting WebDecoy production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed:

	detections	last seen
`xAI-SearchBot/1.0`	31	today
`LinkupBot/1.0`	148	2026-08-24

Generated, not hand-edited. pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit.

The registry count guard moves 169 → 171. It exists to make a registry change deliberate rather than incidental, so bumping it is the intended workflow.

397 tests pass, parity vectors included.

A span around protect() and a child around rule evaluation, carrying the decision id (which joins a span to its dashboard row), the conclusion, the deciding rule, and whether the request cost a round trip to ingest. The tracer is INJECTED, not imported. An optional peer dependency was the obvious route and the wrong one: this package is dependency-free and passes an edge-compatibility gate, and Workers and Vercel Edge are exactly where a stray transitive import hurts. A conditional import('@opentelemetry/api') bundles badly too -- the bundler either resolves it, adding weight for the majority who do not use it, or fails on a module that is legitimately absent. The Tracer type is a structural subset of OpenTelemetry's, so trace.getTracer('webdecoy') satisfies it with no adapter. Omit it and there are no spans, no dependency and no behaviour change, which is the majority case and should cost them nothing. A tracer cannot break a request. startSpan returning nothing, throwing, or returning a span whose every method throws all degrade to a no-op -- observability that can take the request path down is worse than none. The no-op span also means call sites need no null checks, and an `if (span)` is a branch that gets forgotten on the path that mattered. Eight tests, four of them hostile tracers. Also asserts the span is ended on the ERROR path: a leaked span holds memory and never reaches the exporter, so the trace is silently incomplete rather than absent. ClosesWebDecoy/app#740

Companion to WebDecoy/app. Both crawlers were hitting production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed. Generated, not hand-edited: pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit. The registry count guard moves 169 -> 171. It exists to make a registry change deliberate rather than incidental, so bumping it here is the intended workflow rather than a nuisance. 397 tests pass, parity vectors included.

Companion to WebDecoy/app. DuckAssistBot, SofyaBot, Reflectionbot and IbouBot join xAI-SearchBot and LinkupBot; all six were crawling production and landing unclassified. IbouBot is registered as a SEARCH crawler, not AI: its own page states it is a Cloudflare Verified Bot classified as Search. It arrived in the same unclassified tail as the others and does not belong with them. Count guard 171 -> 175. 397 tests pass.

cport1 · 2026-08-25T17:32:10Z

Companion to app#809.

Both crawlers were hitting WebDecoy production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed:

	detections	last seen
`xAI-SearchBot/1.0`	31	today
`LinkupBot/1.0`	148	2026-08-24

Generated, not hand-edited. pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit.

The registry count guard moves 169 → 171. It exists to make a registry change deliberate rather than incidental, so bumping it is the intended workflow.

397 tests pass, parity vectors included.

A span around protect() and a child around rule evaluation, carrying the decision id (which joins a span to its dashboard row), the conclusion, the deciding rule, and whether the request cost a round trip to ingest. The tracer is INJECTED, not imported. An optional peer dependency was the obvious route and the wrong one: this package is dependency-free and passes an edge-compatibility gate, and Workers and Vercel Edge are exactly where a stray transitive import hurts. A conditional import('@opentelemetry/api') bundles badly too -- the bundler either resolves it, adding weight for the majority who do not use it, or fails on a module that is legitimately absent. The Tracer type is a structural subset of OpenTelemetry's, so trace.getTracer('webdecoy') satisfies it with no adapter. Omit it and there are no spans, no dependency and no behaviour change, which is the majority case and should cost them nothing. A tracer cannot break a request. startSpan returning nothing, throwing, or returning a span whose every method throws all degrade to a no-op -- observability that can take the request path down is worse than none. The no-op span also means call sites need no null checks, and an `if (span)` is a branch that gets forgotten on the path that mattered. Eight tests, four of them hostile tracers. Also asserts the span is ended on the ERROR path: a leaked span holds memory and never reaches the exporter, so the trace is silently incomplete rather than absent. ClosesWebDecoy/app#740

Companion to WebDecoy/app. Both crawlers were hitting production and landing unclassified, so requests from them were excluded from AI traffic figures rather than attributed. Generated, not hand-edited: pkg is the source of truth and the export runs in agents.MatchUserAgent order, which the TS matcher depends on because it takes the first hit. The registry count guard moves 169 -> 171. It exists to make a registry change deliberate rather than incidental, so bumping it here is the intended workflow rather than a nuisance. 397 tests pass, parity vectors included.

Companion to WebDecoy/app. DuckAssistBot, SofyaBot, Reflectionbot and IbouBot join xAI-SearchBot and LinkupBot; all six were crawling production and landing unclassified. IbouBot is registered as a SEARCH crawler, not AI: its own page states it is a Cloudflare Verified Bot classified as Search. It arrived in the same unclassified tail as the others and does not belong with them. Count guard 171 -> 175. 397 tests pass.

cport1 added 3 commits August 22, 2026 11:40

cport1 merged commit 3aab303 into mainAug 25, 2026
2 checks passed

cport1 deleted the feat/registry-xai-linkup branch August 25, 2026 17:50

cport1 added 3 commits August 22, 2026 11:40

cport1 merged commit 3aab303 into mainAug 25, 2026
2 checks passed

cport1 deleted the feat/registry-xai-linkup branch August 25, 2026 17:50

cport1 added 3 commits August 22, 2026 11:40

cport1 merged commit 3aab303 into mainAug 25, 2026
2 checks passed

cport1 deleted the feat/registry-xai-linkup branch August 25, 2026 17:50

cport1 added 3 commits August 22, 2026 11:40

cport1 merged commit 3aab303 into mainAug 25, 2026
2 checks passed

cport1 deleted the feat/registry-xai-linkup branch August 25, 2026 17:50

cport1 added 3 commits August 22, 2026 11:40

cport1 merged commit 3aab303 into mainAug 25, 2026
2 checks passed

cport1 deleted the feat/registry-xai-linkup branch August 25, 2026 17:50

cport1 added 3 commits August 22, 2026 11:40

cport1 merged commit 3aab303 into mainAug 25, 2026
2 checks passed

cport1 deleted the feat/registry-xai-linkup branch August 25, 2026 17:50

cport1 added 3 commits August 22, 2026 11:40

cport1 merged commit 3aab303 into mainAug 25, 2026
2 checks passed

cport1 deleted the feat/registry-xai-linkup branch August 25, 2026 17:50

cport1 added 3 commits August 22, 2026 11:40

cport1 merged commit 3aab303 into mainAug 25, 2026
2 checks passed

cport1 deleted the feat/registry-xai-linkup branch August 25, 2026 17:50

Uh oh!

Conversation

cport1 commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

cport1 commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

cport1 commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

cport1 commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

cport1 commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

cport1 commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation