@contextos/core 0.4.2 → 0.4.4

package/dist/index.js

@@ -29,10 +29,27 @@ var ConstraintSchema = z.object({
   suggestion: z.string().optional(),
   related: z.array(z.string()).optional()
 });
+var isValidGlobPattern = (pattern) => {
+  const dangerousPatterns = [
+    /\.\./,
+    // Directory traversal
+    /^~/,
+    // Home directory access
+    /^\//
+    // Absolute path (may be too restrictive)
+  ];
+  return !dangerousPatterns.some((p) => p.test(pattern));
+};
 var BoundarySchema = z.object({
   name: z.string().min(1),
-  allow: z.array(z.string()),
-  deny: z.array(z.string())
+  allow: z.array(z.string()).refine(
+    (patterns) => patterns.every(isValidGlobPattern),
+    { message: "Boundary patterns must not contain directory traversal (..) or absolute paths" }
+  ),
+  deny: z.array(z.string()).refine(
+    (patterns) => patterns.every(isValidGlobPattern),
+    { message: "Boundary patterns must not contain directory traversal (..) or absolute paths" }
+  )
 });
 var MetaSchema = z.object({
   last_indexed: z.string().datetime().optional(),
@@ -48,6 +65,7 @@ var ContextYamlSchema = z.object({
   boundaries: z.array(BoundarySchema).optional().default([]),
   meta: MetaSchema.optional()
 });
+var fileSizePattern = /^\d+(\.\d+)?\s*(B|KB|MB|GB|TB)$/i;
 var IndexingConfigSchema = z.object({
   watch_mode: z.boolean().default(true),
   ignore_patterns: z.array(z.string()).default([
@@ -57,7 +75,9 @@ var IndexingConfigSchema = z.object({
     "dist/**",
     ".git/**"
   ]),
-  file_size_limit: z.string().default("1MB")
+  file_size_limit: z.string().default("1MB").refine((val) => fileSizePattern.test(val), {
+    message: 'File size limit must be in format like "1MB", "500KB", "2GB", etc.'
+  })
 });
 var GraphConfigSchema = z.object({
   max_depth: z.number().int().min(1).max(10).default(2),
@@ -167,7 +187,7 @@ function findContextosRoot(startDir = process.cwd()) {
 function loadContextYaml(rootDir) {
   const contextPath = join(rootDir, CONTEXTOS_DIR, CONTEXT_FILE);
   if (!existsSync(contextPath)) {
-    throw new Error(`context.yaml not found at ${contextPath}. Run 'ctx init' first.`);
+    throw new Error(`ContextOS not initialized: context.yaml not found at ${contextPath}. Run 'ctx init' first.`);
   }
   const rawContent = readFileSync(contextPath, "utf-8");
   const parsed = parseYaml(rawContent);
@@ -1183,6 +1203,17 @@ var DependencyGraph = class {
 import Database from "better-sqlite3";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname3 } from "path";
+
+// src/constants.ts
+var DEFAULT_TIMEOUT = 1e4;
+var SANDBOX_TIMEOUT_RATIO = 10;
+var MAX_VISITED_PATHS = 50;
+var PATH_CLEANUP_BATCH_SIZE = 10;
+var VECTOR_PAGE_SIZE = 1e3;
+var CHARS_PER_TOKEN_CODE = 4;
+var GIT_MAX_BUFFER = 1024 * 1024;
+
+// src/embedding/vector-store.ts
 var VectorStore = class {
   db = null;
   embedder = null;
@@ -1306,7 +1337,7 @@ var VectorStore = class {
    */
   vectorSearch(queryEmbedding, limit) {
     if (!this.db) throw new Error("VectorStore not initialized");
-    const pageSize = 1e3;
+    const pageSize = VECTOR_PAGE_SIZE;
     let offset = 0;
     const allResults = [];
     while (allResults.length < limit * 2) {
@@ -1341,7 +1372,7 @@ var VectorStore = class {
   textSearch(query, limit) {
     if (!this.db) throw new Error("VectorStore not initialized");
     const terms = query.toLowerCase().split(/\s+/);
-    const pageSize = 1e3;
+    const pageSize = VECTOR_PAGE_SIZE;
     let offset = 0;
     const allResults = [];
     while (allResults.length < limit * 2) {
@@ -1739,11 +1770,15 @@ var TokenBudget = class {
     this.maxTokens = maxTokens || MODEL_LIMITS[modelName] || 32e3;
   }
   /**
-   * Count tokens in text (approximate)
-   * In production, use tiktoken for accurate counts
+   * Count tokens in text (improved approximation)
+   * Uses CHARS_PER_TOKEN_CODE constant for code-dense content
+   *
+   * Note: For production use, consider integrating tiktoken for accurate counts.
+   * This approximation works well for most code scenarios.
    */
   count(text) {
-    return Math.ceil(text.length / 4);
+    if (!text) return 0;
+    return Math.ceil(text.length / CHARS_PER_TOKEN_CODE);
   }
   /**
    * Get allocation percentages based on budget size
@@ -1865,7 +1900,7 @@ var TokenBudget = class {
    * Truncate text to fit within token limit
    */
   truncateToTokens(text, maxTokens) {
-    const estimatedChars = maxTokens * 4;
+    const estimatedChars = maxTokens * CHARS_PER_TOKEN_CODE;
     if (text.length <= estimatedChars) return text;
     const truncated = text.slice(0, estimatedChars);
     const lastNewline = truncated.lastIndexOf("\n");
@@ -2331,24 +2366,24 @@ var ContextBuilder = class {
   }
   /**
    * Execute git diff with proper sanitization and error handling
+   * SECURITY: Uses safe command strings with shell:false to prevent injection
    */
   async getGitDiff(type) {
     try {
       const { execSync: execSync2 } = await import("child_process");
       const cwd = this.sanitizeGitPath(this.config?.rootDir);
-      const flag = type === "cached" ? "--cached" : "";
-      return execSync2(
-        `git diff ${flag} --name-only`,
-        {
-          cwd,
-          encoding: "utf-8",
-          maxBuffer: 1024 * 1024,
-          // 1MB
-          stdio: ["ignore", "pipe", "pipe"],
-          timeout: 5e3
-          // 5 second timeout
-        }
-      ).trim();
+      const command = type === "cached" ? "git diff --cached --name-only" : "git diff --name-only";
+      return execSync2(command, {
+        cwd,
+        encoding: "utf-8",
+        maxBuffer: 1024 * 1024,
+        // 1MB
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 5e3,
+        // 5 second timeout
+        shell: false
+        // Explicitly disable shell to prevent injection
+      }).trim();
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : String(error);
       console.warn(`Git command failed: ${errorMessage}`);
@@ -2491,14 +2526,18 @@ var ContextBuilder = class {
             encoding: "utf-8",
             maxBuffer: 1024 * 1024,
             // 1MB max
-            timeout: 5e3
+            timeout: 5e3,
+            shell: false
+            // Prevent command injection
           });
           if (!gitDiff) {
             gitDiff = execSync2("git diff", {
               cwd,
               encoding: "utf-8",
               maxBuffer: 1024 * 1024,
-              timeout: 5e3
+              timeout: 5e3,
+              shell: false
+              // Prevent command injection
             });
           }
         } catch {
@@ -3241,6 +3280,25 @@ var DEFAULT_RLM_CONFIG = {
 };
 
 // src/rlm/context-api.ts
+var patternCache = /* @__PURE__ */ new Map();
+function getCachedPattern(key, pattern, flags = "") {
+  const cacheKey = `${key}:${flags}`;
+  if (!patternCache.has(cacheKey)) {
+    patternCache.set(cacheKey, new RegExp(pattern, flags));
+  }
+  return patternCache.get(cacheKey);
+}
+var CACHED_IMPORT_PATTERNS = [
+  getCachedPattern("import-es6", "^import\\s+.+", ""),
+  getCachedPattern("import-python", "^from\\s+.+\\s+import\\s+.+", ""),
+  getCachedPattern("import-commonjs1", "^const\\s+.+=\\s*require\\(", ""),
+  getCachedPattern("import-commonjs2", "^require\\s*\\(", "")
+];
+var CACHED_EXPORT_PATTERNS = [
+  getCachedPattern("export-default", "^export\\s+(default\\s+)?(class|function|const|let|interface|type|enum)", ""),
+  getCachedPattern("export-named", "^export\\s*\\{", ""),
+  getCachedPattern("export-commonjs", "^module\\.exports\\s*=", "")
+];
 function createContextAPI(rawContext) {
   const lines = rawContext.split("\n");
   return {
@@ -3354,19 +3412,9 @@ function createContextAPI(rawContext) {
     },
     getImports: () => {
       const imports = [];
-      const importPatterns = [
-        /^import\s+.+/,
-        // ES6 import
-        /^from\s+.+\s+import\s+.+/,
-        // Python from import
-        /^const\s+.+=\s*require\(/,
-        // CommonJS require
-        /^require\s*\(/
-        // require()
-      ];
       for (const line of lines) {
         const trimmed = line.trim();
-        for (const pattern of importPatterns) {
+        for (const pattern of CACHED_IMPORT_PATTERNS) {
           if (pattern.test(trimmed)) {
             imports.push(trimmed);
             break;
@@ -3377,14 +3425,9 @@ function createContextAPI(rawContext) {
     },
     getExports: () => {
       const exports = [];
-      const exportPatterns = [
-        /^export\s+(default\s+)?(class|function|const|let|interface|type|enum)/,
-        /^export\s*\{/,
-        /^module\.exports\s*=/
-      ];
       for (const line of lines) {
         const trimmed = line.trim();
-        for (const pattern of exportPatterns) {
+        for (const pattern of CACHED_EXPORT_PATTERNS) {
           if (pattern.test(trimmed)) {
             exports.push(trimmed);
             break;
@@ -3397,17 +3440,17 @@ function createContextAPI(rawContext) {
       const outline = [];
       const patterns = {
         function: [
-          /^(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\(([^)]*)\)/,
-          /^(?:export\s+)?(?:const|let)\s+(\w+)\s*=\s*(?:async\s+)?\([^)]*\)\s*=>/
+          getCachedPattern("outline-fn1", "^(?:export\\s+)?(?:async\\s+)?function\\s+(\\w+)\\s*\\(([^)]*)\\)"),
+          getCachedPattern("outline-fn2", "^(?:export\\s+)?(?:const|let)\\s+(\\w+)\\s*=\\s*(?:async\\s+)?\\([^)]*\\)\\s*=>")
         ],
         class: [
-          /^(?:export\s+)?(?:abstract\s+)?class\s+(\w+)/
+          getCachedPattern("outline-class", "^(?:export\\s+)?(?:abstract\\s+)?class\\s+(\\w+)")
         ],
         interface: [
-          /^(?:export\s+)?interface\s+(\w+)/
+          getCachedPattern("outline-interface", "^(?:export\\s+)?interface\\s+(\\w+)")
         ],
         type: [
-          /^(?:export\s+)?type\s+(\w+)/
+          getCachedPattern("outline-type", "^(?:export\\s+)?type\\s+(\\w+)")
         ]
       };
       for (let i = 0; i < lines.length; i++) {
@@ -3665,19 +3708,57 @@ function prepareSandboxVariables(rawContext, additionalVariables = {}) {
 function validateCode(code) {
   const issues = [];
   const dangerousPatterns = [
+    // Module system bypasses
     { pattern: /\brequire\s*\(/, message: "require() is not allowed" },
     { pattern: /\bimport\s*\(/, message: "Dynamic import() is not allowed" },
-    { pattern: /\bprocess\./, message: "process access is not allowed" },
-    { pattern: /\bglobal\./, message: "global access is not allowed" },
-    { pattern: /\bglobalThis\./, message: "globalThis access is not allowed" },
+    { pattern: /\bimport\s+\.+/, message: "Relative import is not allowed" },
+    // Global object access
+    { pattern: /\bprocess\s*\./, message: "process property access is not allowed" },
+    { pattern: /\bprocess\s*$/, message: "process variable access is not allowed" },
+    { pattern: /\bglobal\s*\./, message: "global access is not allowed" },
+    { pattern: /\bglobal\s*$/, message: "global variable access is not allowed" },
+    { pattern: /\bglobalThis\s*\./, message: "globalThis access is not allowed" },
+    { pattern: /\bglobalThis\s*$/, message: "globalThis variable access is not allowed" },
+    // Code execution
     { pattern: /\beval\s*\(/, message: "eval() is not allowed" },
     { pattern: /\bFunction\s*\(/, message: "Function constructor is not allowed" },
-    { pattern: /\bchild_process/, message: "child_process is not allowed" },
-    { pattern: /\bfs\./, message: "fs module is not allowed" },
+    { pattern: /\bnew\s+Function\s*\(/, message: "new Function() is not allowed" },
+    { pattern: /\bsetTimeout\s*\(/, message: "setTimeout() is not allowed" },
+    { pattern: /\bsetInterval\s*\(/, message: "setInterval() is not allowed" },
+    { pattern: /\bsetImmediate\s*\(/, message: "setImmediate() is not allowed" },
+    // Child process and system access
+    { pattern: /\bchild_process/, message: "child_process module is not allowed" },
     { pattern: /\bexec\s*\(/, message: "exec() is not allowed" },
     { pattern: /\bspawn\s*\(/, message: "spawn() is not allowed" },
+    { pattern: /\bfork\s*\(/, message: "fork() is not allowed" },
+    { pattern: /\bexecSync\s*\(/, message: "execSync() is not allowed" },
+    // File system access
+    { pattern: /\bfs\s*\./, message: "fs module access is not allowed" },
+    { pattern: /\bfs\s*$/, message: "fs module variable is not allowed" },
+    { pattern: /\brequire\s*\(\s*['"]fs['"]/, message: "fs module require is not allowed" },
+    // Directory traversal
+    { pattern: /\bprocess\s*\.\s*chdir\s*\(/, message: "process.chdir() is not allowed" },
+    { pattern: /\bprocess\s*\.\s*cwd\s*\(/, message: "process.cwd() is not allowed" },
+    // Buffer exploits
+    { pattern: /\bBuffer\s*\./, message: "Buffer static methods are not allowed" },
+    { pattern: /\bnew\s+Buffer\s*\(/, message: "new Buffer() is not allowed" },
+    // Prototype pollution
     { pattern: /\b__proto__/, message: "__proto__ access is not allowed" },
-    { pattern: /\bconstructor\s*\[/, message: "constructor access is not allowed" }
+    { pattern: /\bconstructor\s*\[/, message: "constructor array access is not allowed" },
+    { pattern: /\bprototype\s*\./, message: "prototype modification is not allowed" },
+    { pattern: /\bObject\s*\.\s*prototype/, message: "Object.prototype modification is not allowed" },
+    // Reflect and Proxy exploits
+    { pattern: /\bReflect\s*\.\s*set\s*\(/, message: "Reflect.set() is not allowed" },
+    { pattern: /\bnew\s+Proxy\s*\(/, message: "Proxy constructor is not allowed" },
+    // Async function exploits
+    { pattern: /\basync\s+Function\s*\(/, message: "async Function constructor is not allowed" },
+    // Module and namespace access
+    { pattern: /\bmodule\s*\./, message: "module access is not allowed" },
+    { pattern: /\bmodule\s*$/, message: "module variable access is not allowed" },
+    { pattern: /\bexports\s*\./, message: "exports access is not allowed" },
+    { pattern: /\bexports\s*$/, message: "exports variable access is not allowed" },
+    { pattern: /\b__dirname/, message: "__dirname access is not allowed" },
+    { pattern: /\b__filename/, message: "__filename access is not allowed" }
   ];
   for (const { pattern, message } of dangerousPatterns) {
     if (pattern.test(code)) {
@@ -3902,7 +3983,7 @@ var RLMEngine = class {
   constructor(options = {}) {
     this.config = { ...DEFAULT_RLM_CONFIG, ...options };
     this.sandbox = createSandbox(this.config.environment, {
-      timeout: Math.min(1e4, this.config.timeoutMs / 10)
+      timeout: Math.min(DEFAULT_TIMEOUT, this.config.timeoutMs / SANDBOX_TIMEOUT_RATIO)
     });
     this.executionId = this.generateExecutionId();
   }
@@ -4045,10 +4126,10 @@ Depth: ${depth}/${this.config.maxDepth}`
           continue;
         }
         state.visitedPaths.set(pathKey, now);
-        if (state.visitedPaths.size > 50) {
+        if (state.visitedPaths.size > MAX_VISITED_PATHS) {
           const entries = Array.from(state.visitedPaths.entries());
           entries.sort((a, b) => a[1] - b[1]);
-          for (let i = 0; i < 10; i++) {
+          for (let i = 0; i < PATH_CLEANUP_BATCH_SIZE; i++) {
             state.visitedPaths.delete(entries[i][0]);
           }
         }
@@ -4872,15 +4953,17 @@ var ScopeManager = class {
     switch (condition.type) {
       case "always":
         return true;
-      case "goal_contains":
+      case "goal_contains": {
         const values = Array.isArray(condition.value) ? condition.value : [condition.value || ""];
         return values.some((v) => goalLower.includes(v.toLowerCase()));
-      case "file_in":
+      }
+      case "file_in": {
         if (!targetFiles) return false;
         const patterns = Array.isArray(condition.value) ? condition.value : [condition.value || ""];
         return targetFiles.some(
           (file) => patterns.some((pattern) => this.matchGlob(file, pattern))
         );
+      }
       case "tag_is":
         return false;
       default:
@@ -5056,7 +5139,7 @@ function createWatchdog(config) {
 
 // src/sync/team-sync.ts
 import { execSync } from "child_process";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
 import { join as join5 } from "path";
 import { parse, stringify as stringify2 } from "yaml";
 function validateGitBranchName(branch) {
@@ -5096,7 +5179,7 @@ var TeamSync = class {
   loadSyncConfig() {
     const configPath = join5(this.contextosDir, "sync.yaml");
     if (existsSync5(configPath)) {
-      const content = readFileSync5(configPath, "utf-8");
+      const content = readFileSync4(configPath, "utf-8");
       return { ...DEFAULT_SYNC_CONFIG, ...parse(content) };
     }
     return DEFAULT_SYNC_CONFIG;
@@ -5230,7 +5313,7 @@ var TemplateManager = class {
       const files = __require("fs").readdirSync(this.templatesDir);
       for (const file of files) {
         if (file.endsWith(".yaml")) {
-          const content = readFileSync5(join5(this.templatesDir, file), "utf-8");
+          const content = readFileSync4(join5(this.templatesDir, file), "utf-8");
           templates.push(parse(content));
         }
       }
@@ -5249,8 +5332,8 @@ var TemplateManager = class {
       description,
       author,
       version: "1.0.0",
-      context: existsSync5(contextPath) ? parse(readFileSync5(contextPath, "utf-8")) : {},
-      config: existsSync5(configPath) ? parse(readFileSync5(configPath, "utf-8")) : {}
+      context: existsSync5(contextPath) ? parse(readFileSync4(contextPath, "utf-8")) : {},
+      config: existsSync5(configPath) ? parse(readFileSync4(configPath, "utf-8")) : {}
     };
     const templatePath = join5(this.templatesDir, `${name}.yaml`);
     writeFileSync2(templatePath, stringify2(template, { indent: 2 }), "utf-8");
@@ -5263,7 +5346,7 @@ var TemplateManager = class {
     if (!existsSync5(templatePath)) {
       throw new Error(`Template '${name}' not found`);
     }
-    const template = parse(readFileSync5(templatePath, "utf-8"));
+    const template = parse(readFileSync4(templatePath, "utf-8"));
     const contextPath = join5(this.templatesDir, "..", "context.yaml");
     const configPath = join5(this.templatesDir, "..", "config.yaml");
     if (template.context && Object.keys(template.context).length > 0) {
@@ -5483,7 +5566,7 @@ var CloudSync = class {
 };
 
 // src/analytics/analytics.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
 import { join as join7 } from "path";
 var AnalyticsCollector = class {
   analyticsDir;
@@ -5534,7 +5617,7 @@ var AnalyticsCollector = class {
   loadEvents() {
     if (existsSync7(this.eventsFile)) {
       try {
-        return JSON.parse(readFileSync7(this.eventsFile, "utf-8"));
+        return JSON.parse(readFileSync6(this.eventsFile, "utf-8"));
       } catch {
         return [];
       }
@@ -5562,7 +5645,7 @@ var AnalyticsCollector = class {
   loadDailyStats() {
     if (existsSync7(this.statsFile)) {
       try {
-        return JSON.parse(readFileSync7(this.statsFile, "utf-8"));
+        return JSON.parse(readFileSync6(this.statsFile, "utf-8"));
       } catch {
         return [];
       }
@@ -5628,7 +5711,7 @@ var AnalyticsCollector = class {
 };
 
 // src/compliance/rbac.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, existsSync as existsSync8, mkdirSync as mkdirSync5 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync8, mkdirSync as mkdirSync5 } from "fs";
 import { join as join8 } from "path";
 import crypto2 from "crypto";
 var BUILT_IN_ROLES = [
@@ -5704,7 +5787,7 @@ var RBACManager = class {
     }
     if (existsSync8(this.rolesFile)) {
       try {
-        const customRoles = JSON.parse(readFileSync8(this.rolesFile, "utf-8"));
+        const customRoles = JSON.parse(readFileSync7(this.rolesFile, "utf-8"));
         for (const role of customRoles) {
           this.roles.set(role.id, role);
         }
@@ -5713,7 +5796,7 @@ var RBACManager = class {
     }
     if (existsSync8(this.usersFile)) {
       try {
-        const users = JSON.parse(readFileSync8(this.usersFile, "utf-8"));
+        const users = JSON.parse(readFileSync7(this.usersFile, "utf-8"));
         for (const user of users) {
           this.users.set(user.id, user);
         }
@@ -5722,7 +5805,7 @@ var RBACManager = class {
     }
     if (existsSync8(this.policiesFile)) {
       try {
-        this.policies = JSON.parse(readFileSync8(this.policiesFile, "utf-8"));
+        this.policies = JSON.parse(readFileSync7(this.policiesFile, "utf-8"));
       } catch {
       }
     }
@@ -5883,7 +5966,7 @@ var RBACManager = class {
 };
 
 // src/compliance/audit.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync6, appendFileSync, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync6, appendFileSync, mkdirSync as mkdirSync6 } from "fs";
 import { join as join9 } from "path";
 import crypto3 from "crypto";
 var AuditLogger = class {
@@ -5945,7 +6028,7 @@ var AuditLogger = class {
   loadIndex() {
     if (existsSync9(this.indexFile)) {
       try {
-        return JSON.parse(readFileSync9(this.indexFile, "utf-8"));
+        return JSON.parse(readFileSync8(this.indexFile, "utf-8"));
       } catch {
         return {};
       }
@@ -5962,7 +6045,7 @@ var AuditLogger = class {
     for (const logFile of logFiles) {
       if (entries.length >= limit) break;
       const filePath = join9(this.auditDir, logFile);
-      const content = readFileSync9(filePath, "utf-8");
+      const content = readFileSync8(filePath, "utf-8");
       const lines = content.trim().split("\n").filter(Boolean);
       for (const line of lines.reverse()) {
         if (entries.length >= limit) break;
@@ -5999,7 +6082,7 @@ var AuditLogger = class {
    */
   verifyLogFile(filename) {
     const filePath = join9(this.auditDir, filename);
-    const content = readFileSync9(filePath, "utf-8");
+    const content = readFileSync8(filePath, "utf-8");
     const lines = content.trim().split("\n").filter(Boolean);
     const result = { valid: 0, invalid: 0, entries: [] };
     for (const line of lines) {
@@ -6053,7 +6136,7 @@ var AuditLogger = class {
 };
 
 // src/plugins/manager.ts
-import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync10, mkdirSync as mkdirSync7, rmSync, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync9, mkdirSync as mkdirSync7, rmSync, writeFileSync as writeFileSync7 } from "fs";
 import { join as join10, resolve, normalize as normalize2 } from "path";
 var PluginManager = class {
   plugins = /* @__PURE__ */ new Map();
@@ -6107,7 +6190,7 @@ var PluginManager = class {
     if (!existsSync10(manifestPath)) {
       throw new Error(`Plugin manifest not found: ${manifestPath}`);
     }
-    const manifestContent = readFileSync10(manifestPath, "utf-8");
+    const manifestContent = readFileSync9(manifestPath, "utf-8");
     let manifest;
     try {
       manifest = JSON.parse(manifestContent);
@@ -6202,7 +6285,7 @@ The file may contain invalid JSON.`
       mkdirSync7(targetDir, { recursive: true });
       let manifest;
       try {
-        const manifestContent = readFileSync10(join10(sourcePath, "package.json"), "utf-8");
+        const manifestContent = readFileSync9(join10(sourcePath, "package.json"), "utf-8");
         manifest = JSON.parse(manifestContent);
       } catch (error) {
         throw new Error(
@@ -6210,7 +6293,7 @@ The file may contain invalid JSON.`
         );
       }
       writeFileSync7(join10(targetDir, "package.json"), JSON.stringify(manifest, null, 2));
-      const mainContent = readFileSync10(join10(sourcePath, manifest.main), "utf-8");
+      const mainContent = readFileSync9(join10(sourcePath, manifest.main), "utf-8");
       writeFileSync7(join10(targetDir, manifest.main), mainContent);
     } else {
       throw new Error("Remote plugin installation not yet implemented");
@@ -6370,7 +6453,7 @@ ${commandsCode}
         if (!normalized.startsWith(rootNormalized)) {
           throw new Error(`Path traversal detected: "${path}" escapes project boundaries`);
         }
-        return readFileSync10(normalized, "utf-8");
+        return readFileSync9(normalized, "utf-8");
       },
       getDependencies: async (_path, _depth = 2) => {
         return [];
@@ -6390,7 +6473,7 @@ function createPluginManager(projectRoot) {
 }
 
 // src/plugins/registry.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync10 } from "fs";
 import { join as join11 } from "path";
 var PluginRegistry = class {
   config;
@@ -6414,7 +6497,7 @@ var PluginRegistry = class {
       if (!existsSync11(manifestPath)) continue;
       try {
         const manifest = JSON.parse(
-          readFileSync11(manifestPath, "utf-8")
+          readFileSync10(manifestPath, "utf-8")
         );
         const disabledPath = join11(pluginPath, ".disabled");
         const enabled = !existsSync11(disabledPath);
@@ -6555,7 +6638,7 @@ function createPluginRegistry(projectRoot) {
 }
 
 // src/finetuning/collector.ts
-import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
 import { join as join12 } from "path";
 import { createHash as createHash4 } from "crypto";
 var TrainingDataCollector = class {
@@ -6576,7 +6659,7 @@ var TrainingDataCollector = class {
     const dataFile = join12(this.dataDir, "examples.json");
     if (existsSync12(dataFile)) {
       try {
-        const data = JSON.parse(readFileSync12(dataFile, "utf-8"));
+        const data = JSON.parse(readFileSync11(dataFile, "utf-8"));
         this.examples = data.examples || [];
       } catch {
         this.examples = [];
@@ -7591,12 +7674,711 @@ function setGlobalLogger(logger) {
   globalLogger = logger;
 }
 
+// src/telemetry/metrics.ts
+var MetricsCollector = class {
+  counters = /* @__PURE__ */ new Map();
+  gauges = /* @__PURE__ */ new Map();
+  histograms = /* @__PURE__ */ new Map();
+  enabled;
+  flushInterval = null;
+  onFlush;
+  constructor(options = {}) {
+    this.enabled = options.enabled ?? process.env.CONTEXTOS_TELEMETRY !== "false";
+    this.onFlush = options.onFlush;
+    if (options.flushIntervalMs && options.flushIntervalMs > 0) {
+      this.flushInterval = setInterval(() => {
+        this.flush();
+      }, options.flushIntervalMs);
+    }
+  }
+  /**
+   * Increment a counter
+   */
+  increment(name, value = 1, labels) {
+    if (!this.enabled) return;
+    const key = this.makeKey(name, labels);
+    const current = this.counters.get(key) || 0;
+    this.counters.set(key, current + value);
+  }
+  /**
+   * Set a gauge value
+   */
+  gauge(name, value, labels) {
+    if (!this.enabled) return;
+    const key = this.makeKey(name, labels);
+    this.gauges.set(key, value);
+  }
+  /**
+   * Record a histogram value (typically timing)
+   */
+  histogram(name, value, labels) {
+    if (!this.enabled) return;
+    const key = this.makeKey(name, labels);
+    const values = this.histograms.get(key) || [];
+    values.push(value);
+    this.histograms.set(key, values);
+  }
+  /**
+   * Time a function execution
+   */
+  async time(name, fn, labels) {
+    const start = performance.now();
+    try {
+      return await fn();
+    } finally {
+      const duration = performance.now() - start;
+      this.histogram(name, duration, labels);
+    }
+  }
+  /**
+   * Time a synchronous function execution
+   */
+  timeSync(name, fn, labels) {
+    const start = performance.now();
+    try {
+      return fn();
+    } finally {
+      const duration = performance.now() - start;
+      this.histogram(name, duration, labels);
+    }
+  }
+  /**
+   * Get current snapshot of all metrics
+   */
+  getSnapshot() {
+    const snapshot = {
+      timestamp: /* @__PURE__ */ new Date(),
+      counters: Object.fromEntries(this.counters),
+      gauges: Object.fromEntries(this.gauges),
+      histograms: {}
+    };
+    for (const [key, values] of this.histograms) {
+      if (values.length === 0) continue;
+      const sorted = [...values].sort((a, b) => a - b);
+      snapshot.histograms[key] = {
+        count: values.length,
+        sum: values.reduce((a, b) => a + b, 0),
+        min: sorted[0],
+        max: sorted[sorted.length - 1],
+        avg: values.reduce((a, b) => a + b, 0) / values.length,
+        p50: this.percentile(sorted, 50),
+        p90: this.percentile(sorted, 90),
+        p99: this.percentile(sorted, 99)
+      };
+    }
+    return snapshot;
+  }
+  /**
+   * Flush metrics and reset
+   */
+  flush() {
+    const snapshot = this.getSnapshot();
+    if (this.onFlush) {
+      this.onFlush(snapshot);
+    }
+    this.counters.clear();
+    this.histograms.clear();
+    return snapshot;
+  }
+  /**
+   * Stop the flush interval
+   */
+  stop() {
+    if (this.flushInterval) {
+      clearInterval(this.flushInterval);
+      this.flushInterval = null;
+    }
+  }
+  makeKey(name, labels) {
+    if (!labels || Object.keys(labels).length === 0) {
+      return name;
+    }
+    const labelStr = Object.entries(labels).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}=${v}`).join(",");
+    return `${name}{${labelStr}}`;
+  }
+  percentile(sorted, p) {
+    const index = Math.ceil(p / 100 * sorted.length) - 1;
+    return sorted[Math.max(0, index)];
+  }
+};
+var METRICS = {
+  // Indexing
+  INDEX_FILES_TOTAL: "contextos_index_files_total",
+  INDEX_DURATION_MS: "contextos_index_duration_ms",
+  INDEX_ERRORS: "contextos_index_errors_total",
+  // Context building
+  CONTEXT_BUILD_DURATION_MS: "contextos_context_build_duration_ms",
+  CONTEXT_FILES_INCLUDED: "contextos_context_files_included",
+  CONTEXT_TOKENS: "contextos_context_tokens",
+  // API calls
+  API_CALLS_TOTAL: "contextos_api_calls_total",
+  API_DURATION_MS: "contextos_api_duration_ms",
+  API_ERRORS: "contextos_api_errors_total",
+  API_TOKENS_USED: "contextos_api_tokens_used",
+  // RLM
+  RLM_EXECUTIONS: "contextos_rlm_executions_total",
+  RLM_DURATION_MS: "contextos_rlm_duration_ms",
+  RLM_DEPTH: "contextos_rlm_depth",
+  RLM_WATCHDOG_TERMINATIONS: "contextos_rlm_watchdog_terminations",
+  // Cache
+  CACHE_HITS: "contextos_cache_hits_total",
+  CACHE_MISSES: "contextos_cache_misses_total",
+  CACHE_SIZE_BYTES: "contextos_cache_size_bytes",
+  // Memory
+  MEMORY_HEAP_USED: "contextos_memory_heap_used_bytes",
+  MEMORY_HEAP_TOTAL: "contextos_memory_heap_total_bytes"
+};
+
+// src/telemetry/tracer.ts
+var Span = class _Span {
+  context;
+  name;
+  startTime;
+  endTime;
+  status = "unset";
+  statusMessage;
+  attributes = {};
+  events = [];
+  children = [];
+  constructor(name, parentContext, attributes) {
+    this.name = name;
+    this.startTime = /* @__PURE__ */ new Date();
+    this.context = {
+      traceId: parentContext?.traceId || this.generateId(32),
+      spanId: this.generateId(16),
+      parentSpanId: parentContext?.spanId
+    };
+    if (attributes) {
+      this.attributes = { ...attributes };
+    }
+  }
+  /**
+   * Set an attribute on the span
+   */
+  setAttribute(key, value) {
+    this.attributes[key] = value;
+    return this;
+  }
+  /**
+   * Set multiple attributes
+   */
+  setAttributes(attributes) {
+    Object.assign(this.attributes, attributes);
+    return this;
+  }
+  /**
+   * Add an event to the span
+   */
+  addEvent(name, attributes) {
+    this.events.push({
+      name,
+      timestamp: /* @__PURE__ */ new Date(),
+      attributes
+    });
+    return this;
+  }
+  /**
+   * Set the span status
+   */
+  setStatus(status, message) {
+    this.status = status;
+    this.statusMessage = message;
+    return this;
+  }
+  /**
+   * Record an exception
+   */
+  recordException(error) {
+    this.addEvent("exception", {
+      "exception.type": error.name,
+      "exception.message": error.message,
+      "exception.stacktrace": error.stack
+    });
+    this.setStatus("error", error.message);
+    return this;
+  }
+  /**
+   * End the span
+   */
+  end() {
+    if (!this.endTime) {
+      this.endTime = /* @__PURE__ */ new Date();
+      if (this.status === "unset") {
+        this.status = "ok";
+      }
+    }
+    return this;
+  }
+  /**
+   * Get span duration in milliseconds
+   */
+  getDuration() {
+    const end = this.endTime || /* @__PURE__ */ new Date();
+    return end.getTime() - this.startTime.getTime();
+  }
+  /**
+   * Check if span has ended
+   */
+  isEnded() {
+    return !!this.endTime;
+  }
+  /**
+   * Create a child span
+   */
+  startChild(name, attributes) {
+    const child = new _Span(name, this.context, attributes);
+    this.children.push(child);
+    return child;
+  }
+  /**
+   * Convert to JSON for logging/export
+   */
+  toJSON() {
+    return {
+      traceId: this.context.traceId,
+      spanId: this.context.spanId,
+      parentSpanId: this.context.parentSpanId,
+      name: this.name,
+      startTime: this.startTime.toISOString(),
+      endTime: this.endTime?.toISOString(),
+      duration: this.getDuration(),
+      status: this.status,
+      statusMessage: this.statusMessage,
+      attributes: this.attributes,
+      events: this.events.map((e) => ({
+        name: e.name,
+        timestamp: e.timestamp.toISOString(),
+        attributes: e.attributes
+      })),
+      children: this.children.map((c) => c.toJSON())
+    };
+  }
+  generateId(length) {
+    const chars = "0123456789abcdef";
+    let result = "";
+    for (let i = 0; i < length; i++) {
+      result += chars[Math.floor(Math.random() * chars.length)];
+    }
+    return result;
+  }
+};
+var Tracer = class {
+  name;
+  version;
+  activeSpan = null;
+  spans = [];
+  enabled;
+  onSpanEnd;
+  constructor(options) {
+    this.name = options.name;
+    this.version = options.version || "1.0.0";
+    this.enabled = options.enabled ?? process.env.CONTEXTOS_TRACING !== "false";
+    this.onSpanEnd = options.onSpanEnd;
+  }
+  /**
+   * Start a new span
+   */
+  startSpan(name, attributes) {
+    const parentContext = this.activeSpan?.context;
+    const span = new Span(name, parentContext, {
+      "service.name": this.name,
+      "service.version": this.version,
+      ...attributes
+    });
+    if (this.enabled) {
+      this.spans.push(span);
+      this.activeSpan = span;
+    }
+    return span;
+  }
+  /**
+   * End a span and optionally export it
+   */
+  endSpan(span) {
+    span.end();
+    if (this.enabled && this.onSpanEnd) {
+      this.onSpanEnd(span);
+    }
+    if (this.activeSpan === span && span.context.parentSpanId) {
+      this.activeSpan = this.spans.find(
+        (s) => s.context.spanId === span.context.parentSpanId
+      ) || null;
+    }
+  }
+  /**
+   * Execute a function within a span
+   */
+  async withSpan(name, fn, attributes) {
+    const span = this.startSpan(name, attributes);
+    try {
+      const result = await fn(span);
+      span.setStatus("ok");
+      return result;
+    } catch (error) {
+      if (error instanceof Error) {
+        span.recordException(error);
+      }
+      throw error;
+    } finally {
+      this.endSpan(span);
+    }
+  }
+  /**
+   * Execute a sync function within a span
+   */
+  withSpanSync(name, fn, attributes) {
+    const span = this.startSpan(name, attributes);
+    try {
+      const result = fn(span);
+      span.setStatus("ok");
+      return result;
+    } catch (error) {
+      if (error instanceof Error) {
+        span.recordException(error);
+      }
+      throw error;
+    } finally {
+      this.endSpan(span);
+    }
+  }
+  /**
+   * Get all recorded spans
+   */
+  getSpans() {
+    return [...this.spans];
+  }
+  /**
+   * Clear recorded spans
+   */
+  clear() {
+    this.spans = [];
+    this.activeSpan = null;
+  }
+  /**
+   * Get active span
+   */
+  getActiveSpan() {
+    return this.activeSpan;
+  }
+};
+var SPAN_NAMES = {
+  // CLI operations
+  CLI_INIT: "cli.init",
+  CLI_INDEX: "cli.index",
+  CLI_BUILD: "cli.build",
+  CLI_ANALYZE: "cli.analyze",
+  // Core operations
+  PARSE_FILE: "core.parse_file",
+  BUILD_GRAPH: "core.build_graph",
+  COMPUTE_EMBEDDINGS: "core.compute_embeddings",
+  RANK_FILES: "core.rank_files",
+  BUILD_CONTEXT: "core.build_context",
+  // RLM operations
+  RLM_EXECUTE: "rlm.execute",
+  RLM_SPAWN_AGENT: "rlm.spawn_agent",
+  RLM_SANDBOX_RUN: "rlm.sandbox_run",
+  // API operations
+  API_COMPLETION: "api.completion",
+  API_EMBEDDING: "api.embedding",
+  // MCP operations
+  MCP_TOOL_CALL: "mcp.tool_call",
+  MCP_RESOURCE_READ: "mcp.resource_read"
+};
+
+// src/telemetry/error-reporter.ts
+var ErrorReporter = class {
+  enabled;
+  handlers = [];
+  breadcrumbs = [];
+  maxBreadcrumbs = 50;
+  globalTags = {};
+  globalExtra = {};
+  version;
+  constructor(options = {}) {
+    this.enabled = options.enabled ?? process.env.CONTEXTOS_ERROR_REPORTING !== "false";
+    this.version = options.version || "2.0.0";
+    this.maxBreadcrumbs = options.maxBreadcrumbs || 50;
+    if (options.handlers) {
+      this.handlers = options.handlers;
+    }
+    if (process.env.NODE_ENV === "development") {
+      this.addHandler((report) => {
+        console.error("[ErrorReporter]", report.error.name, report.error.message);
+      });
+    }
+  }
+  /**
+   * Add an error report handler
+   */
+  addHandler(handler) {
+    this.handlers.push(handler);
+  }
+  /**
+   * Set global tags for all reports
+   */
+  setTags(tags) {
+    Object.assign(this.globalTags, tags);
+  }
+  /**
+   * Set global extra data for all reports
+   */
+  setExtra(extra) {
+    Object.assign(this.globalExtra, extra);
+  }
+  /**
+   * Add a breadcrumb
+   */
+  addBreadcrumb(breadcrumb) {
+    this.breadcrumbs.push({
+      ...breadcrumb,
+      timestamp: /* @__PURE__ */ new Date()
+    });
+    if (this.breadcrumbs.length > this.maxBreadcrumbs) {
+      this.breadcrumbs = this.breadcrumbs.slice(-this.maxBreadcrumbs);
+    }
+  }
+  /**
+   * Capture and report an error
+   */
+  async captureException(error, context) {
+    if (!this.enabled) return null;
+    const report = this.createReport(error, context);
+    for (const handler of this.handlers) {
+      try {
+        await handler(report);
+      } catch (handlerError) {
+        console.error("[ErrorReporter] Handler failed:", handlerError);
+      }
+    }
+    return report.id;
+  }
+  /**
+   * Capture a message as an error
+   */
+  async captureMessage(message, level = "error", context) {
+    const error = new Error(message);
+    error.name = `Message.${level}`;
+    return this.captureException(error, context);
+  }
+  /**
+   * Wrap a function to auto-capture errors
+   */
+  wrap(fn, context) {
+    const reporter = this;
+    return ((...args) => {
+      try {
+        const result = fn(...args);
+        if (result instanceof Promise) {
+          return result.catch((error) => {
+            reporter.captureException(error, context);
+            throw error;
+          });
+        }
+        return result;
+      } catch (error) {
+        if (error instanceof Error) {
+          reporter.captureException(error, context);
+        }
+        throw error;
+      }
+    });
+  }
+  /**
+   * Clear breadcrumbs
+   */
+  clearBreadcrumbs() {
+    this.breadcrumbs = [];
+  }
+  /**
+   * Get recent reports (for debugging)
+   */
+  getRecentBreadcrumbs() {
+    return [...this.breadcrumbs];
+  }
+  createReport(error, context) {
+    const isContextOSError = error instanceof ContextOSError;
+    return {
+      id: this.generateId(),
+      timestamp: /* @__PURE__ */ new Date(),
+      error: {
+        name: error.name,
+        message: error.message,
+        stack: error.stack,
+        code: isContextOSError ? error.code : void 0
+      },
+      context: {
+        tags: { ...this.globalTags, ...context?.tags },
+        extra: {
+          ...this.globalExtra,
+          ...context?.extra,
+          ...isContextOSError ? error.context : {}
+        },
+        user: context?.user,
+        operation: context?.operation,
+        breadcrumbs: [...this.breadcrumbs, ...context?.breadcrumbs || []]
+      },
+      environment: {
+        nodeVersion: process.version,
+        platform: process.platform,
+        arch: process.arch,
+        contextosVersion: this.version
+      }
+    };
+  }
+  generateId() {
+    return `err_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+  }
+};
+function createSentryHandler(dsn) {
+  return async (report) => {
+    if (process.env.NODE_ENV === "development") {
+      console.log("[Sentry Mock] Would send to:", dsn);
+      console.log("[Sentry Mock] Report:", JSON.stringify(report, null, 2));
+    }
+  };
+}
+function createConsoleHandler() {
+  return (report) => {
+    console.error(`
+\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
+\u2551  ERROR REPORT: ${report.id.padEnd(43)}\u2551
+\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563
+\u2551  ${report.error.name}: ${report.error.message.substring(0, 50).padEnd(50)}\u2551
+\u2551  Code: ${(report.error.code || "N/A").padEnd(53)}\u2551
+\u2551  Time: ${report.timestamp.toISOString().padEnd(53)}\u2551
+\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+`);
+  };
+}
+function createFileHandler(logPath) {
+  return async (report) => {
+    const fs = await import("fs/promises");
+    const line = JSON.stringify(report) + "\n";
+    await fs.appendFile(logPath, line);
+  };
+}
+
+// src/telemetry/index.ts
+var Telemetry = class {
+  metrics;
+  tracer;
+  errors;
+  config;
+  constructor(config = {}) {
+    this.config = {
+      enabled: true,
+      serviceName: "contextos",
+      serviceVersion: "2.0.0",
+      metricsFlushIntervalMs: 6e4,
+      // 1 minute
+      ...config
+    };
+    this.metrics = new MetricsCollector({
+      enabled: this.config.enabled,
+      flushIntervalMs: this.config.metricsFlushIntervalMs,
+      onFlush: this.config.onMetricsFlush
+    });
+    this.tracer = new Tracer({
+      name: this.config.serviceName,
+      version: this.config.serviceVersion,
+      enabled: this.config.enabled,
+      onSpanEnd: this.config.onSpanEnd
+    });
+    this.errors = new ErrorReporter({
+      enabled: this.config.enabled,
+      version: this.config.serviceVersion,
+      handlers: this.config.errorHandlers || [createConsoleHandler()]
+    });
+    if (this.config.enabled) {
+      this.setupGlobalHandlers();
+    }
+  }
+  /**
+   * Execute an operation with full telemetry
+   */
+  async traced(name, operation, options) {
+    const span = this.tracer.startSpan(name, options?.attributes);
+    const startTime = performance.now();
+    try {
+      const result = await operation(span);
+      span.setStatus("ok");
+      this.metrics.histogram(`${name}_duration_ms`, performance.now() - startTime);
+      this.metrics.increment(`${name}_success`);
+      return result;
+    } catch (error) {
+      if (error instanceof Error) {
+        span.recordException(error);
+        await this.errors.captureException(error, options?.errorContext);
+      }
+      this.metrics.increment(`${name}_error`);
+      throw error;
+    } finally {
+      this.tracer.endSpan(span);
+    }
+  }
+  /**
+   * Record memory usage
+   */
+  recordMemoryUsage() {
+    const usage = process.memoryUsage();
+    this.metrics.gauge(METRICS.MEMORY_HEAP_USED, usage.heapUsed);
+    this.metrics.gauge(METRICS.MEMORY_HEAP_TOTAL, usage.heapTotal);
+  }
+  /**
+   * Flush all metrics
+   */
+  flush() {
+    return this.metrics.flush();
+  }
+  /**
+   * Shutdown telemetry
+   */
+  shutdown() {
+    this.metrics.stop();
+    this.tracer.clear();
+  }
+  setupGlobalHandlers() {
+    process.on("unhandledRejection", (reason) => {
+      if (reason instanceof Error) {
+        this.errors.captureException(reason, {
+          tags: { type: "unhandledRejection" }
+        });
+      }
+    });
+    process.on("uncaughtException", (error) => {
+      this.errors.captureException(error, {
+        tags: { type: "uncaughtException" }
+      });
+    });
+  }
+};
+var globalTelemetry = null;
+function getTelemetry(config) {
+  if (!globalTelemetry) {
+    globalTelemetry = new Telemetry(config);
+  }
+  return globalTelemetry;
+}
+function initTelemetry(config) {
+  if (globalTelemetry) {
+    globalTelemetry.shutdown();
+  }
+  globalTelemetry = new Telemetry(config);
+  return globalTelemetry;
+}
+function shutdownTelemetry() {
+  if (globalTelemetry) {
+    globalTelemetry.shutdown();
+    globalTelemetry = null;
+  }
+}
+
 // src/generator/index.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync10, writeFileSync as writeFileSync11, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync10, writeFileSync as writeFileSync11, readFileSync as readFileSync14 } from "fs";
 import { dirname as dirname5, join as join15, resolve as resolve2, normalize as normalize3 } from "path";
 
 // src/generator/shadow-fs.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9, readFileSync as readFileSync13, rmSync as rmSync2, renameSync, copyFileSync } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9, readFileSync as readFileSync12, rmSync as rmSync2, renameSync, copyFileSync } from "fs";
 import { join as join13, dirname as dirname4 } from "path";
 import { randomUUID } from "crypto";
 var ShadowFileSystem = class {
@@ -7661,11 +8443,11 @@ var ShadowFileSystem = class {
     if (tx && tx.files.has(realPath)) {
       const shadowPath = tx.files.get(realPath);
       if (existsSync14(shadowPath)) {
-        return readFileSync13(shadowPath, "utf-8");
+        return readFileSync12(shadowPath, "utf-8");
       }
     }
     if (existsSync14(realPath)) {
-      return readFileSync13(realPath, "utf-8");
+      return readFileSync12(realPath, "utf-8");
     }
     return null;
   }
@@ -7765,7 +8547,7 @@ function createShadowFS(rootDir) {
 }
 
 // src/context/negative-context.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "fs";
 import { join as join14 } from "path";
 var NegativeContextManager = class {
   contextIgnorePath;
@@ -7783,7 +8565,7 @@ var NegativeContextManager = class {
       return;
     }
     try {
-      const content = readFileSync14(this.contextIgnorePath, "utf-8");
+      const content = readFileSync13(this.contextIgnorePath, "utf-8");
       const lines = content.split("\n").filter((line) => line.trim() && !line.startsWith("#"));
       this.rules = lines.map((line) => {
         const match = line.match(/^(\w+):(.+?)\|(.+)$/);
@@ -8073,7 +8855,7 @@ var AIGenerator = class {
     for (const prdPath of prdPaths) {
       const fullPath = join15(this.rootDir, prdPath);
       if (existsSync16(fullPath)) {
-        const content = readFileSync15(fullPath, "utf-8");
+        const content = readFileSync14(fullPath, "utf-8");
         parts.push(`## ${prdPath}
 
 ${content}`);
@@ -8188,7 +8970,7 @@ Generate the files now:`;
       }
       if (!file.isNew && options.backupBeforeOverwrite) {
         const backupPath = `${fullPath}.bak`;
-        const existingContent = readFileSync15(fullPath, "utf-8");
+        const existingContent = readFileSync14(fullPath, "utf-8");
         writeFileSync11(backupPath, existingContent);
       }
       writeFileSync11(fullPath, file.content, "utf-8");
@@ -8225,6 +9007,7 @@ export {
   E2EEncryption,
   EmbeddingConfigSchema,
   ErrorCode,
+  ErrorReporter,
   Errors,
   GeminiClient,
   GraphConfigSchema,
@@ -8233,8 +9016,10 @@ export {
   LocalSandbox,
   LogLevel,
   Logger,
+  METRICS,
   MODEL_SPECIFIC_ADDENDUM,
   MetaSchema,
+  MetricsCollector,
   NegativeContextManager,
   OpenAIAdapter,
   PluginManager,
@@ -8244,13 +9029,17 @@ export {
   RBACManager,
   RLMEngine,
   RLM_BASE_SYSTEM_PROMPT,
+  SPAN_NAMES,
   ScopeManager,
   ShadowFileSystem,
+  Span,
   StackConfigSchema,
   SupportedLanguageSchema,
   TeamSync,
+  Telemetry,
   TemplateManager,
   TokenBudget,
+  Tracer,
   TrainingDataCollector,
   VectorStore,
   Watchdog,
@@ -8260,8 +9049,10 @@ export {
   createAIGenerator,
   createAnthropicAdapter,
   createBlackboard,
+  createConsoleHandler,
   createContextAPI,
   createDatasetFormatter,
+  createFileHandler,
   createGeminiClient,
   createInitialUserMessage,
   createLogger,
@@ -8275,6 +9066,7 @@ export {
   createSandbox,
   createSandboxContext,
   createScopeManager,
+  createSentryHandler,
   createShadowFS,
   createSubAgentResultMessage,
   createTrainingDataCollector,
@@ -8300,7 +9092,9 @@ export {
   getModelPricing,
   getParser,
   getSupportedLanguages,
+  getTelemetry,
   getTreeSitterLanguage,
+  initTelemetry,
   isAnthropicAvailable,
   isGeminiAvailable,
   isInitialized,
@@ -8319,6 +9113,7 @@ export {
   saveConfigYaml,
   saveContextYaml,
   setGlobalLogger,
+  shutdownTelemetry,
   splitContextToFiles,
   validateCode,
   validateLicense