@dev.fast/whiteboard 0.0.0-stage → 0.2.0

package/dist/request-origin-D_4QIdoN.js

@@ -0,0 +1,811 @@
+import { a as jsonNumber, c as jsonString, i as jsonBoolean, n as isJsonObject } from "./src-X9phtB2j.js";
+import { f as REVIEW_DIFF_LAYOUTS, p as REVIEW_THEME_CHOICES } from "./src-DnwdaQ2r.js";
+import { z } from "zod";
+//#region src/telemetry-clean-text.ts
+const USER_DATA_REGEXES = [
+	{
+		label: "URL",
+		regex: /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s]*/
+	},
+	{
+		label: "Google API Key",
+		regex: /AIza[A-Za-z0-9_\\\-]{35}/
+	},
+	{
+		label: "JWT",
+		regex: /eyJ[0eXAiOiJKV1Qi|hbGci|a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+/
+	},
+	{
+		label: "Slack Token",
+		regex: /xox[pbar]\-[A-Za-z0-9]/
+	},
+	{
+		label: "GitHub Token",
+		regex: /(gh[psuro]_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59})/
+	},
+	{
+		label: "Generic Secret",
+		regex: /(key|token|sig|secret|signature|password|passwd|pwd|android:value)[^a-zA-Z0-9]/i
+	},
+	{
+		label: "CLI Credentials",
+		regex: /((login|psexec|(certutil|psexec)\.exe).{1,50}(\s-u(ser(name)?)?\s+.{3,100})?\s-(admin|user|vm|root)?p(ass(word)?)?\s+["']?[^$\-\/\s]|(^|[\s\r\n\\])net(\.exe)?.{1,5}(user\s+|share\s+\/user:| user -? secrets ? set) \s + [^ $\s \/])/
+	},
+	{
+		label: "Microsoft Entra ID",
+		regex: /eyJ(?:0eXAiOiJKV1Qi|hbGci|[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.)/
+	},
+	{
+		label: "Email",
+		regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/
+	}
+];
+const REDACTED_PATH_MARKER = "<REDACTED: user-file-path>";
+/**
+* The path shape the cleaner replaces: one or more `segment/` runs, with an
+* optional drive letter, UNC, or `file://` root. Upstream keeps this inline in
+* `anonymizeFilePaths`; it is named here so the allowlist can assert that no
+* path shape survived cleaning.
+*/
+const FILE_PATH_PATTERN = /(file:\/\/)?([a-zA-Z]:(\\\\|\\|\/)|(\\\\|\\|\/))?([\w\-\._@]+(\\\\|\\|\/))+[\w\-\._@]*/;
+/**
+* True when the value still holds something path-shaped. Deliberately the same
+* definition the cleaner uses: the point of re-testing is not a second opinion
+* on what a path looks like, it is to catch the cleaner failing to apply its own
+* rule — wrong patterns, wrong order, or an exception swallowed on the way.
+*/
+function containsFilePath(value) {
+	return FILE_PATH_PATTERN.test(value);
+}
+/**
+* True when the value still holds something the cleaner should have replaced.
+* The event allowlist calls this as its own second check, so it must not depend
+* on the cleaner having run.
+*/
+function hasPossibleUserInfo(value) {
+	return USER_DATA_REGEXES.some((entry) => entry.regex.test(value));
+}
+/**
+* Cleans a given stack of possible paths
+* @param stack The stack to sanitize
+* @param cleanupPatterns Cleanup patterns to remove from the stack
+* @returns The cleaned stack
+*/
+function anonymizeFilePaths(stack, cleanupPatterns) {
+	if (!stack || !stack.includes("/") && !stack.includes("\\")) return stack;
+	let updatedStack = stack;
+	const cleanUpIndexes = [];
+	for (const regexp of cleanupPatterns) while (true) {
+		const result = regexp.exec(stack);
+		if (!result) break;
+		cleanUpIndexes.push([result.index, regexp.lastIndex]);
+	}
+	const nodeModulesRegex = /(?:^|[\\\/])((node_modules|node_modules\.asar)[\\\/].*)$/;
+	const fileRegex = /(file:\/\/)?([a-zA-Z]:(\\\\|\\|\/)|(\\\\|\\|\/))?([\w\-\._@]+(\\\\|\\|\/))+[\w\-\._@]*/g;
+	let lastIndex = 0;
+	updatedStack = "";
+	while (true) {
+		const result = fileRegex.exec(stack);
+		if (!result) break;
+		if (!cleanUpIndexes.some(([start, end]) => result.index < end && start < fileRegex.lastIndex)) {
+			const nodeModulesMatch = nodeModulesRegex.exec(result[0]);
+			if (nodeModulesMatch) updatedStack += stack.substring(lastIndex, result.index) + `${REDACTED_PATH_MARKER}/` + nodeModulesMatch[1];
+			else updatedStack += stack.substring(lastIndex, result.index) + REDACTED_PATH_MARKER;
+			lastIndex = fileRegex.lastIndex;
+		}
+	}
+	if (lastIndex < stack.length) updatedStack += stack.substring(lastIndex);
+	return updatedStack;
+}
+/**
+* Redacts a value if it contains commonly leaked PII.
+* @param value The value returned (as-is) when no PII is detected
+* @param probe The string actually matched against the PII heuristics. Defaults
+* to `value`; callers may pass a value that includes a trailing delimiter (e.g. a
+* newline) so that heuristics relying on a non-alphanumeric boundary match the
+* same way they would against the original whole string.
+* @returns A `<REDACTED: ...>` marker if the probe matched, otherwise `value`
+*/
+function redactIfPossibleUserInfo(value, probe = value) {
+	for (const secretRegex of USER_DATA_REGEXES) if (secretRegex.regex.test(probe)) return `<REDACTED: ${secretRegex.label}>`;
+	return value;
+}
+/**
+* Attempts to remove commonly leaked PII.
+*
+* When a match is found the check is applied per line so that a single suspicious
+* frame (e.g. a stack frame containing a function name such as `getStorageKey`
+* which matches the broad `Generic Secret` heuristic) only redacts that line —
+* replacing it with a `<REDACTED: ...>` marker — instead of wiping the entire
+* multi-line value such as a whole callstack.
+* @param property The property whose offending lines will be replaced with a redaction marker if they contain user data
+* @returns The new value for the property
+*/
+function removePropertiesWithPossibleUserInfo(property) {
+	if (!property) return property;
+	if (!hasPossibleUserInfo(property)) return property;
+	if (!property.includes("\n")) return redactIfPossibleUserInfo(property);
+	const lines = property.split("\n");
+	for (let i = 0; i < lines.length; i++) {
+		const probe = i < lines.length - 1 ? lines[i] + "\n" : lines[i];
+		lines[i] = redactIfPossibleUserInfo(lines[i], probe);
+	}
+	return lines.join("\n");
+}
+/**
+* The whole pipeline for one free-text value, in VS Code's order: replace
+* path-shaped runs, delete the known local directories outright, then replace
+* any line holding a secret or address shape.
+*/
+function cleanTelemetryText(value, cleanupPatterns) {
+	let updated = value.replaceAll("%20", " ");
+	updated = anonymizeFilePaths(updated, cleanupPatterns);
+	for (const regexp of cleanupPatterns) updated = updated.replace(regexp, "");
+	return removePropertiesWithPossibleUserInfo(updated);
+}
+//#endregion
+//#region src/ui-telemetry-events.ts
+const PEEK_VIA = [
+	"prose_link",
+	"diagram",
+	"map",
+	"db_lens",
+	"call_stack_frame"
+];
+const PEEK_ROOT_KIND = ["range"];
+const LSP_FEATURE = [
+	"hover",
+	"goto_definition",
+	"peek_definition",
+	"goto_type_definition",
+	"goto_implementation",
+	"references",
+	"rename",
+	"format",
+	"code_action",
+	"symbol_search"
+];
+const LSP_VIA = ["command", "mouse"];
+const LSP_EDITOR_KIND = [
+	"files_tab",
+	"inline_peek",
+	"diff"
+];
+const LSP_LANGUAGE = [
+	"typescript",
+	"javascript",
+	"python",
+	"go",
+	"rust",
+	"swift",
+	"csharp",
+	"json",
+	"css",
+	"html",
+	"markdown",
+	"yaml",
+	"toml",
+	"shell",
+	"sql",
+	"other"
+];
+const LS_GROUP = [
+	"python",
+	"go",
+	"rust",
+	"swift",
+	"csharp"
+];
+const EXTENSION_ID = [
+	"vscodevim.vim",
+	"tuttieee.emacs-mcx",
+	"ms-vscode.sublime-keybindings",
+	"ms-python.python",
+	"astral-sh.ty",
+	"charliermarsh.ruff",
+	"golang.go",
+	"rust-lang.rust-analyzer",
+	"swiftlang.swift-vscode",
+	"llvm-vs-code-extensions.lldb-dap",
+	"muhammad-sammy.csharp",
+	"ms-dotnettools.vscode-dotnet-runtime"
+];
+const EXTENSION_TRIGGER = [
+	"user",
+	"auto_upgrade",
+	"startup_seed",
+	"keymap",
+	"rollback"
+];
+const EXTENSION_INSTALL_PHASE = ["download", "install"];
+const SETTING_NAME = [
+	"telemetry_enabled",
+	"keymap",
+	"software_map_enabled",
+	"scratchpad_enabled",
+	"diffr_config",
+	"structural_diff",
+	"theme",
+	"ctrl_tab",
+	"ready_notification",
+	"document_width"
+];
+const REVIEW_OPENED_VIA = [
+	"home",
+	"cli",
+	"other"
+];
+/** Where a review's source comes from: its target's kind, or the one scratchpad. */
+const SESSION_SOURCE_KIND = [
+	"worktree",
+	"commits",
+	"scratchpad"
+];
+/**
+* The authoring agent a review session is attributed to. This is the one
+* definition: `review-telemetry.ts`'s `ReviewSessionAgent` type imports and
+* derives from it instead of redeclaring the list.
+*/
+const SESSION_AGENT_KIND = [
+	"codex",
+	"claude",
+	"cursor",
+	"opencode",
+	"pi",
+	"omp",
+	"other"
+];
+/**
+* How a review session ends. `abnormal` is reported on the next launch for a
+* session the previous process never closed. This is the one definition:
+* `review-telemetry.ts`'s `ReviewSessionOutcome` type imports and derives from
+* it instead of redeclaring the list.
+*/
+const SESSION_OUTCOME = [
+	"closed",
+	"dismissed",
+	"deleted",
+	"app_quit",
+	"abnormal"
+];
+const REVIEW_DISMISSED_VIA = ["review_topbar", "home"];
+const REVIEW_RESTORED_VIA = ["home", "open"];
+const MAP_LEVEL = [
+	"system",
+	"container",
+	"component",
+	"code"
+];
+const SOURCE_TREE_OPENED_VIA = ["topbar", "home"];
+/** Tab names the dwell beacon reports. Shared with its request parser. */
+const REVIEW_TELEMETRY_TABS = [
+	"review",
+	"commits",
+	"map",
+	"files",
+	"trace"
+];
+const COMMIT_DIFF_VIA = [
+	"row",
+	"file",
+	"footer"
+];
+const CLIENT_ERROR_SOURCE = [
+	"window",
+	"worker",
+	"fetch",
+	"render",
+	"document",
+	"renderer_unexpected",
+	"main_unexpected",
+	"bootstrap",
+	"settings",
+	"server_unexpected"
+];
+/** Which process died. "unknown" is a minidump the live listeners did not see. */
+const CRASH_PROCESS = [
+	"renderer",
+	"gpu",
+	"utility",
+	"server",
+	"unknown"
+];
+const CRASH_SOURCE = ["live", "minidump"];
+/** Where a packaged macOS build runs from; Squirrel cannot update `volume` or `translocated`. */
+const INSTALL_LOCATION = [
+	"applications",
+	"user_applications",
+	"volume",
+	"translocated",
+	"other"
+];
+const DIFF_OPENED_VIA = [
+	"topbar",
+	"lens",
+	"locate"
+];
+/** Which diff opened: a commit's, or a file diff drawn plain or structural. */
+const DIFF_OPENED_KIND = [
+	"commit",
+	"file",
+	"structural"
+];
+const DISCORD_VIA = [
+	"topbar",
+	"dialog",
+	"docs"
+];
+const REVIEW_DELETED_VIA = ["home"];
+const ERROR_PROCESS = [
+	"main",
+	"renderer",
+	"canvas",
+	"server"
+];
+const UPDATE_FAILURE_PHASE = [
+	"check",
+	"download",
+	"install"
+];
+const UPDATE_MESSAGE_SOURCE = [
+	"electron",
+	"request",
+	"shipit",
+	"fallback"
+];
+/**
+* Directories that exist only in the shipped Review bundle. A stack frame is
+* reportable when — and only when — it has already been rewritten to start at
+* one of these, which is what strips the user's home directory off the front.
+* See error-telemetry.ts; this table re-checks the result independently.
+*/
+const BUNDLE_FRAME_ROOTS = [
+	"vs/review/",
+	"vs/workbench/",
+	"vs/platform/",
+	"vs/base/",
+	"vs/code/",
+	"vs/editor/",
+	"assets/",
+	"review-runtime/"
+];
+/**
+* The Electron entry files, which sit beside those directories rather than
+* inside one. A crash before the app can start lands here and nowhere else, so
+* without this list the report that matters most carries no location at all.
+* The list is closed for the same reason the directories are.
+*/
+const BUNDLE_FRAME_ENTRY_FILES = [
+	"main.js",
+	"cli.js",
+	"bootstrap-cli.js",
+	"bootstrap-esm.js",
+	"bootstrap-fork.js",
+	"bootstrap-meta.js",
+	"bootstrap-node.js"
+];
+/**
+* One normalized stack frame: a bundle-relative path, then `:line:col`. The
+* character class is deliberately narrow — anything outside it could carry user
+* content — and there is no function name, because the file already identifies
+* the frame and a minified name adds surface for nothing.
+*/
+const escapeForPattern = (value) => value.replaceAll(".", "\\.").replaceAll("/", "\\/");
+const BUNDLE_FRAME_PATTERN = new RegExp("^(?:" + [`(?:${BUNDLE_FRAME_ROOTS.map(escapeForPattern).join("|")})[A-Za-z0-9_./-]*`, `(?:${BUNDLE_FRAME_ENTRY_FILES.map(escapeForPattern).join("|")})`].join("|") + "):\\d{1,9}:\\d{1,9}$");
+const MAX_BUNDLE_FRAMES = 10;
+const MAX_BUNDLE_FRAMES_LENGTH = 1024;
+const HASH_HEX_PATTERN = /^[0-9a-f]{16}$/;
+const MAX_CLEANED_MESSAGE_LENGTH = 300;
+/** A marker the cleaner writes, e.g. `<REDACTED: user-file-path>`. */
+const REDACTION_MARKER_PATTERN = /<REDACTED: [A-Za-z][A-Za-z0-9 -]*>/g;
+/**
+* Header the canvas app attaches to review API requests so server-side events
+* can share the UI session id. The CORS preflight allowlist in
+* server/hono-http.ts must permit every header named here — the canvas runs on
+* a vscode-file:// origin, so a header missing from that list fails the
+* preflight and takes the whole request down with it.
+*/
+const REVIEW_APP_SESSION_ID_HEADER = "x-review-app-session-id";
+const UI_TELEMETRY_EVENTS = {
+	app_opened: {
+		event: "review_app_opened",
+		properties: {}
+	},
+	peek_opened: {
+		event: "review_peek_opened",
+		properties: { via: PEEK_VIA }
+	},
+	tour_started: {
+		event: "review_tour_started",
+		properties: { steps: "number" }
+	},
+	tour_completed: {
+		event: "review_tour_completed",
+		properties: { steps: "number" }
+	},
+	map_expanded: {
+		event: "review_map_expanded",
+		properties: { level: MAP_LEVEL }
+	},
+	commit_expanded: {
+		event: "review_commit_expanded",
+		properties: { expanded: "boolean" }
+	},
+	commit_diff_opened: {
+		event: "review_commit_diff_opened",
+		properties: { via: COMMIT_DIFF_VIA }
+	},
+	source_tree_opened: {
+		event: "review_source_tree_opened",
+		properties: { via: SOURCE_TREE_OPENED_VIA }
+	},
+	diff_layout_changed: {
+		event: "review_diff_layout_changed",
+		properties: { layout: REVIEW_DIFF_LAYOUTS }
+	},
+	review_dismissed: {
+		event: "review_review_dismissed",
+		properties: { via: REVIEW_DISMISSED_VIA }
+	},
+	review_restored: {
+		event: "review_review_restored",
+		properties: { via: REVIEW_RESTORED_VIA }
+	},
+	client_error: {
+		event: "review_client_error",
+		properties: {
+			error_source: CLIENT_ERROR_SOURCE,
+			error_process: ERROR_PROCESS,
+			error_name: "enum_free_short",
+			component: "enum_free_short",
+			message: "cleaned_message",
+			message_hash: "hash_hex",
+			frames: "bundle_frames"
+		}
+	},
+	update_started: {
+		event: "review_update_started",
+		properties: {
+			update_attempt_id: "opaque_id",
+			target_version: "release_version"
+		}
+	},
+	update_completed: {
+		event: "review_update_completed",
+		properties: {
+			update_attempt_id: "opaque_id",
+			target_version: "release_version",
+			duration_ms: "number"
+		}
+	},
+	update_failed: {
+		event: "review_update_failed",
+		properties: {
+			phase: UPDATE_FAILURE_PHASE,
+			message_source: UPDATE_MESSAGE_SOURCE,
+			update_attempt_id: "opaque_id",
+			target_version: "release_version",
+			duration_ms: "number",
+			error_name: "enum_free_short",
+			message: "cleaned_message",
+			message_hash: "hash_hex"
+		}
+	},
+	lsp_used: {
+		event: "review_lsp_used",
+		properties: {
+			feature: LSP_FEATURE,
+			via: LSP_VIA,
+			language: LSP_LANGUAGE,
+			editor_kind: LSP_EDITOR_KIND
+		}
+	},
+	ls_activated: {
+		event: "review_ls_activated",
+		properties: {
+			group: LS_GROUP,
+			ok: "boolean"
+		}
+	},
+	extension_installed: {
+		event: "review_extension_installed",
+		properties: {
+			extension_id: EXTENSION_ID,
+			trigger: EXTENSION_TRIGGER,
+			cached: "boolean",
+			duration_ms: "number"
+		}
+	},
+	extension_install_failed: {
+		event: "review_extension_install_failed",
+		properties: {
+			extension_id: EXTENSION_ID,
+			trigger: EXTENSION_TRIGGER,
+			phase: EXTENSION_INSTALL_PHASE
+		}
+	},
+	extension_enabled: {
+		event: "review_extension_enabled",
+		properties: {
+			extension_id: EXTENSION_ID,
+			trigger: EXTENSION_TRIGGER
+		}
+	},
+	extension_disabled: {
+		event: "review_extension_disabled",
+		properties: {
+			extension_id: EXTENSION_ID,
+			trigger: EXTENSION_TRIGGER
+		}
+	},
+	extension_uninstalled: {
+		event: "review_extension_uninstalled",
+		properties: {
+			extension_id: EXTENSION_ID,
+			trigger: EXTENSION_TRIGGER
+		}
+	},
+	tour_step_advanced: {
+		event: "review_tour_step_advanced",
+		properties: {
+			step: "number",
+			steps: "number"
+		}
+	},
+	tour_abandoned: {
+		event: "review_tour_abandoned",
+		properties: {
+			step: "number",
+			steps: "number"
+		}
+	},
+	bug_report_dialog_opened: {
+		event: "review_bug_report_dialog_opened",
+		properties: {}
+	},
+	bug_report_cancelled: {
+		event: "review_bug_report_cancelled",
+		properties: {}
+	},
+	bug_report_send_failed: {
+		event: "review_bug_report_send_failed",
+		properties: { error_name: "enum_free_short" }
+	},
+	setting_changed: {
+		event: "review_setting_changed",
+		properties: {
+			setting: SETTING_NAME,
+			enabled: "boolean",
+			value: REVIEW_THEME_CHOICES
+		}
+	},
+	review_opened: {
+		event: "review_review_opened",
+		properties: { via: REVIEW_OPENED_VIA }
+	},
+	session_started: {
+		event: "review_session_started",
+		properties: {
+			source_kind: SESSION_SOURCE_KIND,
+			agent_kind: SESSION_AGENT_KIND
+		}
+	},
+	session_ended: {
+		event: "review_session_ended",
+		properties: {
+			outcome: SESSION_OUTCOME,
+			duration_ms: "number"
+		}
+	},
+	review_presented: {
+		event: "review_review_presented",
+		properties: { load_ms: "number" }
+	},
+	home_empty_state_viewed: {
+		event: "review_home_empty_state_viewed",
+		properties: {}
+	},
+	crash: {
+		event: "review_crash",
+		properties: {
+			process: CRASH_PROCESS,
+			reason: "enum_free_short",
+			exit_code: "number",
+			uptime_ms: "number",
+			source: CRASH_SOURCE
+		}
+	},
+	hang_started: {
+		event: "review_hang_started",
+		properties: {}
+	},
+	hang_ended: {
+		event: "review_hang_ended",
+		properties: { duration_ms: "number" }
+	},
+	app_ready: {
+		event: "review_app_ready",
+		properties: {
+			duration_ms: "number",
+			install_location: INSTALL_LOCATION
+		}
+	},
+	error_burst: {
+		event: "review_error_burst",
+		properties: {
+			message_hash: "hash_hex",
+			suppressed: "number"
+		}
+	},
+	diff_opened: {
+		event: "review_diff_opened",
+		properties: {
+			kind: DIFF_OPENED_KIND,
+			via: DIFF_OPENED_VIA
+		}
+	},
+	scratchpad_opened: {
+		event: "review_scratchpad_opened",
+		properties: {}
+	},
+	discord_clicked: {
+		event: "review_discord_clicked",
+		properties: { via: DISCORD_VIA }
+	},
+	discord_dialog_shown: {
+		event: "review_discord_dialog_shown",
+		properties: {}
+	},
+	discord_dialog_dismissed: {
+		event: "review_discord_dialog_dismissed",
+		properties: {}
+	},
+	peek_resolved: {
+		event: "review_peek_resolved",
+		properties: { root_kind: PEEK_ROOT_KIND }
+	},
+	peek_resolve_failed: {
+		event: "review_peek_resolve_failed",
+		properties: { root_kind: PEEK_ROOT_KIND }
+	},
+	review_deleted: {
+		event: "review_review_deleted",
+		properties: { via: REVIEW_DELETED_VIA }
+	},
+	review_shared: {
+		event: "review_review_shared",
+		properties: {}
+	}
+};
+const MAX_FREE_STRING_LENGTH = 40;
+const FREE_STRING_PATTERN = /^[A-Za-z0-9_$-]+$/;
+const OPAQUE_ID_PATTERN = /^[A-Za-z0-9_-]{8,64}$/;
+const RELEASE_VERSION_PATTERN = /^\d{1,10}\.\d{1,10}\.\d{1,10}(?:[-+][0-9A-Za-z.-]{1,40})?$/;
+const COMMON_PROPERTIES = { app_session_id: "opaque_id" };
+function isUiTelemetryEventName(name) {
+	return Object.hasOwn(UI_TELEMETRY_EVENTS, name);
+}
+/**
+* Validate a raw UI event payload against the allowlist. Returns the PostHog
+* event name plus only the sanctioned properties, or null when the event
+* itself is unknown. Unknown keys and invalid values are silently dropped —
+* never forwarded.
+*/
+function sanitizeUiTelemetryEvent(input) {
+	const name = z.string().safeParse(input.name);
+	if (!name.success || !isUiTelemetryEventName(name.data)) return null;
+	const spec = UI_TELEMETRY_EVENTS[name.data];
+	const raw = isJsonObject(input.properties) ? input.properties : {};
+	const properties = {};
+	const propertySpecs = {
+		...COMMON_PROPERTIES,
+		...spec.properties
+	};
+	for (const [key, propSpec] of Object.entries(propertySpecs)) {
+		const value = raw[key];
+		if (value === void 0 || value === null) continue;
+		const text = jsonString(value);
+		if (propSpec === "number") {
+			const number = jsonNumber(value);
+			if (number !== void 0) properties[key] = number;
+			continue;
+		}
+		if (propSpec === "boolean") {
+			const boolean = jsonBoolean(value);
+			if (boolean !== void 0) properties[key] = boolean;
+			continue;
+		}
+		if (propSpec === "opaque_id") {
+			if (isValidReviewAppSessionId(text)) properties[key] = text;
+			continue;
+		}
+		if (propSpec === "release_version") {
+			if (text !== void 0 && RELEASE_VERSION_PATTERN.test(text)) properties[key] = text;
+			continue;
+		}
+		if (propSpec === "enum_free_short") {
+			if (text !== void 0 && text.length <= MAX_FREE_STRING_LENGTH && FREE_STRING_PATTERN.test(text)) properties[key] = text;
+			continue;
+		}
+		if (propSpec === "hash_hex") {
+			if (text !== void 0 && HASH_HEX_PATTERN.test(text)) properties[key] = text;
+			continue;
+		}
+		if (propSpec === "bundle_frames") {
+			const frames = sanitizeBundleFrames(text);
+			if (frames) properties[key] = frames;
+			continue;
+		}
+		if (propSpec === "cleaned_message") {
+			if (text !== void 0 && isReportableCleanedMessage(text)) properties[key] = text;
+			continue;
+		}
+		if (text !== void 0 && propSpec.includes(text)) properties[key] = text;
+	}
+	return {
+		event: spec.event,
+		properties
+	};
+}
+/**
+* The independent second check on a cleaned error message.
+*
+* It never repairs the message. Either the cleaner finished the job or the
+* message is dropped and only the digest goes, so a bug in the cleaner cannot
+* by itself put a path on the wire.
+*
+* The path rule is the load-bearing one: the cleaner replaces every path-shaped
+* run with a marker, so a surviving path shape means something got past it.
+*/
+function isReportableCleanedMessage(value) {
+	if (value.length === 0 || value.length > MAX_CLEANED_MESSAGE_LENGTH) return false;
+	const remainder = value.replaceAll(REDACTION_MARKER_PATTERN, " ");
+	return !containsFilePath(remainder) && !hasPossibleUserInfo(remainder);
+}
+/**
+* Keep only the frames that match BUNDLE_FRAME_PATTERN. Frames arrive already
+* normalized; this is the independent second check, so it never repairs a frame
+* — it drops it. Returns undefined when nothing survives.
+*/
+function sanitizeBundleFrames(value) {
+	if (value === void 0) return void 0;
+	const kept = [];
+	let length = 0;
+	for (const frame of value.split("|")) {
+		if (!BUNDLE_FRAME_PATTERN.test(frame)) continue;
+		const next = length + frame.length + (kept.length > 0 ? 1 : 0);
+		if (next > MAX_BUNDLE_FRAMES_LENGTH) break;
+		kept.push(frame);
+		length = next;
+		if (kept.length >= MAX_BUNDLE_FRAMES) break;
+	}
+	return kept.length > 0 ? kept.join("|") : void 0;
+}
+function isValidReviewAppSessionId(value) {
+	return value !== void 0 && OPAQUE_ID_PATTERN.test(value);
+}
+//#endregion
+//#region src/review-api/request-origin.ts
+/**
+* Headers the agent CLI sets so the server can say where a review came from.
+* Both are telemetry only and parse to closed enums: anything else a caller
+* sends becomes "other".
+*/
+const REVIEW_VIA_HEADER = "x-review-via";
+const REVIEW_AGENT_HEADER = "x-review-agent";
+const viaSchema = z.enum([
+	"api",
+	"mcp",
+	"other"
+]).catch("other");
+const agentSchema = z.enum(SESSION_AGENT_KIND).optional().catch("other");
+function reviewRequestOrigin(headers) {
+	const via = viaSchema.parse(headers.get(REVIEW_VIA_HEADER));
+	const agentKind = agentSchema.parse(headers.get("x-review-agent") ?? void 0);
+	return agentKind ? {
+		via,
+		agentKind
+	} : { via };
+}
+//#endregion
+export { REVIEW_APP_SESSION_ID_HEADER as a, sanitizeUiTelemetryEvent as c, BUNDLE_FRAME_PATTERN as i, cleanTelemetryText as l, REVIEW_VIA_HEADER as n, REVIEW_TELEMETRY_TABS as o, reviewRequestOrigin as r, isReportableCleanedMessage as s, REVIEW_AGENT_HEADER as t };