@harnessforce/claude-code-plugin 0.0.0-stage → 0.2.0

package/scripts/harnessforce-hook-main.cjs

@@ -0,0 +1,1895 @@
+let node_os = require("node:os");
+let node_path = require("node:path");
+let node_perf_hooks = require("node:perf_hooks");
+let node_crypto = require("node:crypto");
+let node_fs_promises = require("node:fs/promises");
+let node_child_process = require("node:child_process");
+let node_fs = require("node:fs");
+const NO_WHITE_SPACE = new RegExp(`^[^\\t-\\r \\u0085\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000]+$`);
+const isToken = (value, maxLength = 256) => {
+	const length = [...value].length;
+	return length >= 1 && length <= maxLength && NO_WHITE_SPACE.test(value);
+};
+const INSTANT_PATTERN = `^(?:1(?:6(?:7[7-9]|[89]\\d)|[7-9]\\d\\d)|2(?:[01]\\d\\d|2(?:[0-5]\\d|6[0-2])))-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-](?:[01]\\d|2[0-3]):[0-5]\\d)$`;
+const INSTANT_PARTS = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+const INSTANT = new RegExp(INSTANT_PATTERN);
+const MIN_INSTANT_MS = Date.UTC(1677, 8, 21, 0, 12, 44);
+const MAX_INSTANT_MS = Date.UTC(2262, 3, 11, 23, 47, 16);
+function isInstant(value) {
+	const parts = INSTANT.test(value) ? INSTANT_PARTS.exec(value) : null;
+	if (!parts) return false;
+	const [, ...fields] = parts;
+	const [year, month, day, hour, minute, second] = fields.slice(0, 6).map(Number);
+	const [fraction = "", sign, offsetHours = "0", offsetMinutes = "0"] = fields.slice(6);
+	const localMs = Date.UTC(year, month - 1, day, hour, minute, second);
+	const local = new Date(localMs);
+	if (!(local.getUTCFullYear() === year && local.getUTCMonth() === month - 1 && local.getUTCDate() === day && local.getUTCHours() === hour && local.getUTCMinutes() === minute && local.getUTCSeconds() === second)) return false;
+	const secondMs = localMs - (sign === "-" ? -1 : 1) * (Number(offsetHours) * 60 + Number(offsetMinutes)) * 6e4;
+	const nanos = Number(fraction.slice(0, 9) || "0");
+	return secondMs >= MIN_INSTANT_MS && !(secondMs > MAX_INSTANT_MS || secondMs === MAX_INSTANT_MS && nanos > 0);
+}
+//#endregion
+//#region ../../packages/semconv/dist/repository.js
+const SCHEME_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
+const SCP_LIKE = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(.+)$/;
+const HOST = /^[a-z0-9.-]+$/;
+const SEGMENT = /^[A-Za-z0-9_.-]+$/;
+function splitRemote(remote) {
+	if (SCHEME_URL.test(remote)) {
+		let url;
+		try {
+			url = new URL(remote);
+		} catch {
+			return;
+		}
+		return url.protocol === "file:" ? void 0 : {
+			host: url.hostname,
+			path: url.pathname
+		};
+	}
+	const scp = SCP_LIKE.exec(remote);
+	return scp?.[1] && scp[2] ? {
+		host: scp[1],
+		path: scp[2]
+	} : void 0;
+}
+function normalizeRepository(remoteUrl) {
+	const location = splitRemote(remoteUrl.trim());
+	if (!location) return void 0;
+	const lowerHost = location.host.toLowerCase();
+	const host = lowerHost === "ssh.github.com" ? "github.com" : lowerHost;
+	const segments = location.path.replace(/\/+$/, "").replace(/\.git$/, "").replace(/^\/+/, "").split("/");
+	if (segments.length !== 2 || !HOST.test(host) || !segments.every((segment) => SEGMENT.test(segment))) return void 0;
+	const [owner, name] = host === "github.com" ? segments.map((segment) => segment.toLowerCase()) : segments;
+	return `${host}/${owner}/${name}`;
+}
+//#endregion
+//#region ../../packages/agent-core/src/object.ts
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+//#endregion
+//#region ../../packages/agent-core/src/config/canonical.ts
+const byCodeUnit$1 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (typeof value === "object" && value !== null) return `{${Object.keys(value).sort(byCodeUnit$1).map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+const sha256 = (data) => (0, node_crypto.createHash)("sha256").update(data).digest("hex");
+const hashValue = (value) => sha256(Buffer.from(canonicalJson(value), "utf8"));
+function hashFileContent(content) {
+	const normalized = content.includes("\r\n") ? Buffer.from(content.toString("latin1").replace(/\r\n/g, "\n"), "latin1") : content;
+	return sha256(normalized);
+}
+function sortComponents(components) {
+	return [...components].sort((a, b) => byCodeUnit$1(a.kind, b.kind) || byCodeUnit$1(a.source, b.source) || byCodeUnit$1(a.id, b.id));
+}
+//#endregion
+//#region ../../packages/agent-core/src/config/files.ts
+const MAX_DEPTH = 8;
+const MAX_FILE_BYTES = 1048576;
+var CollectionExpired = class extends Error {};
+async function readFileIfExists(path, guard) {
+	guard();
+	const info = await (0, node_fs_promises.stat)(path).catch(() => void 0);
+	if (!info?.isFile() || info.size > MAX_FILE_BYTES) return void 0;
+	return (0, node_fs_promises.readFile)(path).catch(() => void 0);
+}
+async function exists(path, guard) {
+	guard();
+	return (0, node_fs_promises.stat)(path).then(() => true, () => false);
+}
+async function readJsonObjectFile(path, guard) {
+	const content = await readFileIfExists(path, guard);
+	if (!content) return void 0;
+	try {
+		const value = JSON.parse(content.toString("utf8"));
+		return isObject(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+async function entries(dir, guard) {
+	guard();
+	return (await (0, node_fs_promises.readdir)(dir, { withFileTypes: true }).catch(() => [])).filter((entry) => !entry.name.startsWith("."));
+}
+async function kindOf(dir, entry, guard) {
+	if (entry.isFile()) return "file";
+	if (entry.isDirectory()) return "directory";
+	if (!entry.isSymbolicLink()) return void 0;
+	guard();
+	const target = await (0, node_fs_promises.stat)((0, node_path.join)(dir, entry.name)).catch(() => void 0);
+	if (target?.isFile()) return "file";
+	return target?.isDirectory() ? "directory" : void 0;
+}
+async function listFiles(dir, ext, recursive, guard) {
+	const found = [];
+	const visited = /* @__PURE__ */ new Set();
+	const walk = async (relative, depth) => {
+		const current = relative ? (0, node_path.join)(dir, relative) : dir;
+		guard();
+		const real = await (0, node_fs_promises.realpath)(current).catch(() => void 0);
+		if (real === void 0 || visited.has(real)) return;
+		visited.add(real);
+		for (const entry of await entries(current, guard)) {
+			const path = relative ? `${relative}/${entry.name}` : entry.name;
+			const kind = await kindOf(current, entry, guard);
+			if (kind === "file" && entry.name.endsWith(ext)) found.push(path);
+			if (kind === "directory" && recursive && depth < MAX_DEPTH) await walk(path, depth + 1);
+		}
+	};
+	await walk("", 0);
+	return found;
+}
+async function listDirectories(dir, guard) {
+	const names = [];
+	for (const entry of await entries(dir, guard)) if (await kindOf(dir, entry, guard) === "directory") names.push(entry.name);
+	return names;
+}
+//#endregion
+//#region ../../packages/agent-core/src/config/hash-input.ts
+function withoutSecrets(entry) {
+	const { env, headers, url, args: _args, ...rest } = entry;
+	const result = rest;
+	if (isObject(env)) result.env = Object.keys(env).sort(byCodeUnit$1);
+	if (isObject(headers)) result.headers = Object.keys(headers).sort(byCodeUnit$1);
+	const strippedUrl = typeof url === "string" ? withoutCredentials(url) : void 0;
+	if (strippedUrl !== void 0) result.url = strippedUrl;
+	return result;
+}
+function withoutCredentials(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return;
+	}
+	parsed.username = "";
+	parsed.password = "";
+	parsed.search = "";
+	parsed.hash = "";
+	return parsed.href;
+}
+const reduceHookGroup = (group) => isObject(group) && Array.isArray(group.hooks) ? {
+	...group,
+	hooks: group.hooks.map((handler) => isObject(handler) ? withoutSecrets(handler) : handler)
+} : group;
+function hashInput(kind, value) {
+	if (kind === "mcp_server" && isObject(value)) return withoutSecrets(value);
+	if (kind === "hook" && Array.isArray(value)) return value.map(reduceHookGroup);
+	return value;
+}
+//#endregion
+//#region ../../packages/agent-core/src/config/scope.ts
+const MAX_COMPONENTS = 1e3;
+var TooManyComponents = class extends Error {};
+var Sink = class {
+	guard;
+	components = [];
+	constructor(guard) {
+		this.guard = guard;
+	}
+	add(component) {
+		if (!isToken(component.id)) return;
+		if (this.components.length >= MAX_COMPONENTS) throw new TooManyComponents();
+		this.components.push(component);
+	}
+	hasDuplicates() {
+		return new Set(this.components.map((c) => `${c.kind}\0${c.source}\0${c.id}`)).size !== this.components.length;
+	}
+	scope = (source, idPrefix = "", version) => {
+		const add = (kind, id, hash) => this.add({
+			kind,
+			source,
+			id: `${idPrefix}${id}`,
+			...version === void 0 ? {} : { version },
+			hash
+		});
+		return {
+			guard: this.guard,
+			addValue: (kind, id, value) => add(kind, id, hashValue(hashInput(kind, value))),
+			addFile: async (kind, id, path) => {
+				const content = await readFileIfExists(path, this.guard);
+				if (content) add(kind, id, hashFileContent(content));
+			}
+		};
+	};
+};
+const absoluteEnv = (value) => value && (0, node_path.isAbsolute)(value) ? value : void 0;
+const withoutExt = (path, ext) => path.slice(0, -ext.length);
+const colonName = (path) => withoutExt(path, ".md").replace(/\//g, ":");
+async function collectLayout(s, layout) {
+	if (layout.skills) for (const name of await listDirectories(layout.skills, s.guard)) await s.addFile("skill", name, (0, node_path.join)(layout.skills, name, "SKILL.md"));
+	if (layout.agents) for (const path of await listFiles(layout.agents, ".md", true, s.guard)) await s.addFile("agent", colonName(path), (0, node_path.join)(layout.agents, path));
+	if (layout.commands) for (const path of await listFiles(layout.commands, ".md", true, s.guard)) await s.addFile("command", colonName(path), (0, node_path.join)(layout.commands, path));
+	if (layout.workflows) for (const path of await listFiles(layout.workflows, ".js", false, s.guard)) await s.addFile("workflow", withoutExt(path, ".js"), (0, node_path.join)(layout.workflows, path));
+}
+async function collectRules(s, base, names, rulesDir) {
+	for (const name of names) await s.addFile("rule", name, (0, node_path.join)(base, name));
+	if (rulesDir) for (const path of await listFiles(rulesDir, ".md", true, s.guard)) await s.addFile("rule", `rules/${path}`, (0, node_path.join)(rulesDir, path));
+}
+function collectHooks(s, hooks) {
+	if (!isObject(hooks)) return;
+	for (const [event, value] of Object.entries(hooks)) s.addValue("hook", event, value);
+}
+function collectMcpServers(s, servers) {
+	if (!isObject(servers)) return;
+	for (const [name, value] of Object.entries(servers)) if (isObject(value)) s.addValue("mcp_server", name, value);
+}
+//#endregion
+//#region ../../packages/agent-core/src/hook-warning.ts
+const RESTART_FAILED_WARNING = "Could not restart the Harnessforce hook";
+const INVALID_ENDPOINT_WARNING = "The Harnessforce destination is invalid. Run `harnessforce init` again";
+const REGISTRATION_FAILED_WARNING = "Harnessforce session registration failed. Check your network connection";
+const notConfiguredWarning = (agent) => agent === "claude_code" ? "Harnessforce sending is not configured. Run `/harnessforce:setup`" : "Harnessforce sending is not configured. Run `harnessforce init`";
+const stopped = (agent) => agent === "claude_code" ? "telemetry is not being sent" : "sessions are not being registered";
+const keyMissingWarning = (agent) => `Harnessforce cannot find your ingest key, so ${stopped(agent)}. Run \`harnessforce init\``;
+const keyUnreadableWarning = (agent) => `Harnessforce could not read your ingest key from the OS keychain, so ${agent === "claude_code" ? "telemetry may not be sent" : "sessions may not be registered"}. Unlock the keychain or run \`harnessforce init\``;
+const DESTINATION_MISMATCH_WARNING = {
+	claude_code: "Telemetry is not being sent because the Harnessforce destination differs from the one saved by `harnessforce init`. Check this repository's settings or run `harnessforce init` again",
+	codex: "Sessions are not being registered because the Harnessforce destination differs from the one saved by `harnessforce init`. Run `harnessforce init` again"
+};
+const TELEMETRY_NOT_CONFIGURED_WARNING = "Claude Code telemetry for Harnessforce is not configured. Run `harnessforce init`";
+const warningOnlyOutput = (message) => `${JSON.stringify({ systemMessage: message })}\n`;
+//#endregion
+//#region ../../packages/agent-core/src/managed.ts
+const MANAGED_DIRS = {
+	darwin: "/Library/Application Support/ClaudeCode",
+	win32: "C:\\Program Files\\ClaudeCode"
+};
+const managedDirFor = (platform) => MANAGED_DIRS[platform] ?? "/etc/claude-code";
+const noGuard$2 = () => {};
+async function readManagedEnv(managedDir, names) {
+	const dropInDir = (0, node_path.join)(managedDir, "managed-settings.d");
+	const dropIns = (await listFiles(dropInDir, ".json", false, noGuard$2)).sort(byCodeUnit$1);
+	const files = [(0, node_path.join)(managedDir, "managed-settings.json"), ...dropIns.map((name) => (0, node_path.join)(dropInDir, name))];
+	const values = Object.fromEntries(names.map((name) => [name, void 0]));
+	for (const file of files) {
+		const env = (await readJsonObjectFile(file, noGuard$2))?.env;
+		if (!isObject(env)) continue;
+		for (const name of names) if (typeof env[name] === "string") values[name] = env[name];
+	}
+	return values;
+}
+//#endregion
+//#region ../../packages/agent-core/src/plugin-auto-update.ts
+const MARKETPLACE_NAME = "harnessforce-agent";
+const MARKETPLACE_KEYS = ["extraKnownMarketplaces", "additionalMarketplaces"];
+const DISABLING_VARIABLES = [
+	"DISABLE_UPDATES",
+	"DISABLE_AUTOUPDATER",
+	"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"
+];
+const noGuard$1 = () => {};
+function marketplacesOf(settings) {
+	const key = MARKETPLACE_KEYS.find((name) => settings?.[name] !== void 0);
+	const value = key === void 0 ? void 0 : settings?.[key];
+	return isObject(value) ? value : void 0;
+}
+const declaresEntry = (settings) => MARKETPLACE_KEYS.some((key) => {
+	const value = settings?.[key];
+	return isObject(value) && value["harnessforce-agent"] !== void 0;
+});
+async function managedFiles(managedDir) {
+	const dropInDir = (0, node_path.join)(managedDir, "managed-settings.d");
+	const dropIns = (await listFiles(dropInDir, ".json", false, noGuard$1)).sort(byCodeUnit$1);
+	return [(0, node_path.join)(managedDir, "managed-settings.json"), ...dropIns.map((name) => (0, node_path.join)(dropInDir, name))];
+}
+/**
+* Claude Codeがpluginを自動更新するとみなせるか（client-updates.md「表示」）。確かめられない場合は偽とし、outdatedを表示する。
+* user settingsのentryが真で、優先度の高いfileが同じ名前のentryを持たず、自動更新を止める変数が無い場合だけ真とする。
+*/
+async function isPluginAutoUpdateEffective(options) {
+	const { env } = options;
+	if (DISABLING_VARIABLES.some((name) => env[name] === "1") && env.FORCE_AUTOUPDATE_PLUGINS !== "1") return false;
+	const higher = [
+		...await managedFiles(options.managedDir),
+		(0, node_path.join)(options.projectDir, ".claude", "settings.json"),
+		(0, node_path.join)(options.projectDir, ".claude", "settings.local.json")
+	];
+	for (const file of higher) {
+		if (!await (0, node_fs_promises.access)(file).then(() => true, () => false)) continue;
+		const settings = await readJsonObjectFile(file, noGuard$1);
+		if (!settings || declaresEntry(settings)) return false;
+	}
+	const entry = marketplacesOf(await readJsonObjectFile(options.userSettingsPath, noGuard$1))?.[MARKETPLACE_NAME];
+	return isObject(entry) && entry.autoUpdate === true;
+}
+//#endregion
+//#region ../../packages/agent-core/src/process/lookup.ts
+const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+const NPM_SHIM_MAX_BYTES = 65536;
+const SHEBANG_MAX_BYTES = 256;
+const CMD_UNSAFE = /["%!\r\n]/;
+const NPM_SHIM_PROG_LINE = "SET \"_prog=%dp0%\\node.exe\"";
+const NPM_SHIM_LAUNCH_LINE = /"%_prog%"[ \t]+"%dp0%\\([^"]+)"[ \t]+%\*$/;
+const pathFor = (platform) => platform === "win32" ? node_path.win32 : node_path.posix;
+const isBatch = (file) => /\.(cmd|bat)$/i.test(file);
+function envValue(env, name, platform) {
+	if (platform !== "win32") return env[name];
+	const upper = name.toUpperCase();
+	const key = Object.keys(env).find((k) => k.toUpperCase() === upper);
+	return key === void 0 ? void 0 : env[key];
+}
+async function readBytes(path, length) {
+	try {
+		const handle = await (0, node_fs_promises.open)(path, "r");
+		try {
+			const buffer = Buffer.alloc(length);
+			const { bytesRead } = await handle.read(buffer, 0, length, 0);
+			return buffer.subarray(0, bytesRead);
+		} finally {
+			await handle.close();
+		}
+	} catch {
+		return;
+	}
+}
+const defaultFs = {
+	isFile: async (path) => {
+		try {
+			return (await (0, node_fs_promises.stat)(path)).isFile();
+		} catch {
+			return false;
+		}
+	},
+	isExecutable: async (path) => {
+		try {
+			await (0, node_fs_promises.access)(path, node_fs.constants.X_OK);
+			return true;
+		} catch {
+			return false;
+		}
+	},
+	exists: async (path) => {
+		try {
+			await (0, node_fs_promises.stat)(path);
+			return true;
+		} catch {
+			return false;
+		}
+	},
+	readSmallText: async (path, maxBytes) => {
+		const bytes = await readBytes(path, maxBytes + 1);
+		return bytes === void 0 || bytes.length > maxBytes ? void 0 : bytes.toString("utf8");
+	},
+	readHead: async (path, maxBytes) => (await readBytes(path, maxBytes))?.toString("utf8")
+};
+async function excludedDirectories(context) {
+	const path = pathFor(context.platform);
+	const fs = context.fs ?? defaultFs;
+	const key = (dir) => {
+		const resolved = path.resolve(dir);
+		return context.platform === "win32" ? resolved.toLowerCase() : resolved;
+	};
+	const exact = new Set(context.bases.map(key));
+	const roots = [];
+	for (const base of context.bases) {
+		let dir = path.resolve(base);
+		for (;;) {
+			if (await fs.exists(path.join(dir, ".git"))) {
+				roots.push(key(dir));
+				break;
+			}
+			const parent = path.dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+	}
+	return (dir) => {
+		const candidate = key(dir);
+		if (exact.has(candidate)) return true;
+		return roots.some((root) => {
+			const prefix = root.endsWith(path.sep) ? root : `${root}${path.sep}`;
+			return candidate === root || candidate.startsWith(prefix);
+		});
+	};
+}
+function candidateNames(name, context) {
+	if (context.platform !== "win32") return [name];
+	const extensions = (envValue(context.env, "PATHEXT", "win32") ?? DEFAULT_PATHEXT).split(";").filter(Boolean);
+	const extension = node_path.win32.extname(name).toLowerCase();
+	if (extension && extensions.some((e) => e.toLowerCase() === extension)) return [name];
+	return extensions.map((e) => `${name}${e}`);
+}
+async function isRunnable(file, context) {
+	const fs = context.fs ?? defaultFs;
+	if (!await fs.isFile(file)) return false;
+	return context.platform === "win32" || fs.isExecutable(file);
+}
+async function findIn(name, context, excluded) {
+	const path = pathFor(context.platform);
+	const dirs = (envValue(context.env, "PATH", context.platform) ?? "").split(path.delimiter).filter((dir) => dir !== "" && path.isAbsolute(dir) && !excluded(dir));
+	for (const dir of dirs) for (const candidate of candidateNames(name, context)) {
+		const file = path.join(dir, candidate);
+		if (await isRunnable(file, context)) return file;
+	}
+}
+async function findCommand(name, context) {
+	return findIn(name, context, await excludedDirectories(context));
+}
+async function findProgram(name, context) {
+	const file = await findCommand(name, context);
+	return file === void 0 || context.platform === "win32" && isBatch(file) ? void 0 : file;
+}
+async function npmShimScript(file, fs) {
+	if (!/\.cmd$/i.test(file)) return void 0;
+	const text = await fs.readSmallText(file, NPM_SHIM_MAX_BYTES);
+	if (text === void 0) return void 0;
+	const lines = text.split(/\r?\n/);
+	if (!lines.some((line) => line.trim() === NPM_SHIM_PROG_LINE)) return void 0;
+	const launches = lines.flatMap((line) => {
+		const match = NPM_SHIM_LAUNCH_LINE.exec(line);
+		return match?.[1] === void 0 ? [] : [match[1]];
+	});
+	const [script] = launches;
+	if (launches.length !== 1 || script === void 0 || CMD_UNSAFE.test(script)) return void 0;
+	return node_path.win32.join(node_path.win32.dirname(file), script);
+}
+async function isEnvNodeScript(file, fs) {
+	const head = await fs.readHead(file, SHEBANG_MAX_BYTES);
+	const end = head?.indexOf("\n") ?? -1;
+	if (head === void 0 || end < 0) return false;
+	const line = head.slice(0, end).replace(/\r$/, "");
+	if (!line.startsWith("#!")) return false;
+	const words = line.slice(2).split(/[ \t]+/).filter(Boolean);
+	const [interpreter, program] = words;
+	return words.length === 2 && interpreter !== void 0 && node_path.posix.isAbsolute(interpreter) && node_path.posix.basename(interpreter) === "env" && program === "node";
+}
+async function nodeScriptFor(file, context) {
+	const fs = context.fs ?? defaultFs;
+	if (context.platform === "win32") return npmShimScript(file, fs);
+	return await isEnvNodeScript(file, fs) ? file : void 0;
+}
+function cmdExe(context, excluded) {
+	const usable = (file) => node_path.win32.isAbsolute(file) && !excluded(node_path.win32.dirname(file));
+	const comSpec = envValue(context.env, "ComSpec", "win32");
+	if (comSpec !== void 0 && usable(comSpec)) return comSpec;
+	const systemRoot = envValue(context.env, "SystemRoot", "win32");
+	if (systemRoot === void 0 || !node_path.win32.isAbsolute(systemRoot)) return void 0;
+	if (excluded(systemRoot)) return void 0;
+	const file = node_path.win32.join(systemRoot, "System32", "cmd.exe");
+	return usable(file) ? file : void 0;
+}
+async function commandLineFor(file, args, context, { quoteArgs = true } = {}) {
+	const script = await nodeScriptFor(file, context);
+	if (script !== void 0) return {
+		file: context.execPath ?? process.execPath,
+		args: [script, ...args],
+		verbatim: false
+	};
+	if (context.platform !== "win32" || !isBatch(file)) return {
+		file,
+		args: [...args],
+		verbatim: false
+	};
+	if ([file, ...args].some((word) => CMD_UNSAFE.test(word))) return void 0;
+	const shell = cmdExe(context, await excludedDirectories(context));
+	if (shell === void 0) return void 0;
+	return {
+		file: shell,
+		args: [
+			"/d",
+			"/s",
+			"/c",
+			`"${quoteArgs ? [file, ...args].map((word) => `"${word}"`).join(" ") : [`"${file}"`, ...args].join(" ")}"`
+		],
+		verbatim: true
+	};
+}
+//#endregion
+//#region ../../packages/agent-core/src/process/git.ts
+const GIT_TIMEOUT_MS = 1e3;
+const execGit = (file, args, env, timeoutMs) => new Promise((resolve) => {
+	(0, node_child_process.execFile)(file, args, {
+		encoding: "utf8",
+		env,
+		timeout: timeoutMs,
+		windowsHide: true
+	}, (error, stdout) => resolve(error ? void 0 : stdout.trim() || void 0));
+});
+function createGitRunner({ platform, env, processCwd, excludeTarget, timeoutMs = GIT_TIMEOUT_MS, fs, exec = execGit }) {
+	const isGitVariable = (name) => (platform === "win32" ? name.toUpperCase() : name).startsWith("GIT_");
+	const gitEnv = Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== void 0 && !isGitVariable(entry[0])));
+	const resolved = /* @__PURE__ */ new Map();
+	const gitFor = (cwd) => {
+		const bases = excludeTarget ? [processCwd, cwd] : [processCwd];
+		const key = bases.join("\0");
+		let file = resolved.get(key);
+		if (!file) {
+			file = findProgram("git", {
+				platform,
+				env,
+				bases,
+				...fs ? { fs } : {}
+			});
+			resolved.set(key, file);
+		}
+		return file;
+	};
+	return async (cwd, args) => {
+		const file = await gitFor(cwd);
+		return file === void 0 ? void 0 : exec(file, [
+			"-C",
+			cwd,
+			...args
+		], gitEnv, timeoutMs);
+	};
+}
+//#endregion
+//#region ../../packages/agent-core/src/process/runtime-env.ts
+const RUNTIME_VARIABLES = [
+	"NODE_TLS_REJECT_UNAUTHORIZED",
+	"NODE_EXTRA_CA_CERTS",
+	"NODE_OPTIONS",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"NO_PROXY",
+	"http_proxy",
+	"https_proxy",
+	"no_proxy",
+	"OPENSSL_CONF",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR"
+];
+const STASH = "HARNESSFORCE_RUNTIME_ENV";
+const IGNORED_WHILE_WAITING = ["SIGINT", "SIGQUIT"];
+const FORWARDED = ["SIGTERM", "SIGHUP"];
+const isRuntimeVariable = (name, platform) => platform === "win32" ? RUNTIME_VARIABLES.some((v) => v.toUpperCase() === name.toUpperCase()) : RUNTIME_VARIABLES.includes(name);
+function splitRuntimeEnv(env, platform) {
+	const clean = {};
+	const removed = {};
+	for (const [name, value] of Object.entries(env)) {
+		if (value === void 0) continue;
+		if (isRuntimeVariable(name, platform)) removed[name] = value;
+		else clean[name] = value;
+	}
+	return {
+		clean,
+		removed
+	};
+}
+const spawnSelf = (env) => (0, node_child_process.spawn)(process.execPath, [...process.execArgv, ...process.argv.slice(1)], {
+	env,
+	stdio: "inherit"
+});
+function relaunchWithoutRuntimeVariables({ platform, env, stash, spawnSelf: start }) {
+	const { clean, removed } = splitRuntimeEnv(env, platform);
+	if (Object.keys(removed).length === 0) return Promise.resolve({ kind: "not-needed" });
+	const childEnv = Object.fromEntries(Object.entries(clean).filter(([name]) => name !== STASH));
+	if (stash) childEnv[STASH] = JSON.stringify(removed);
+	return new Promise((resolve) => {
+		let child;
+		try {
+			child = start(childEnv);
+		} catch {
+			return resolve({ kind: "failed" });
+		}
+		const ignore = () => {};
+		const forward = (signal) => child.kill(signal);
+		for (const signal of IGNORED_WHILE_WAITING) process.on(signal, ignore);
+		for (const signal of FORWARDED) process.on(signal, forward);
+		const finish = (outcome) => {
+			for (const signal of IGNORED_WHILE_WAITING) process.off(signal, ignore);
+			for (const signal of FORWARDED) process.off(signal, forward);
+			resolve(outcome);
+		};
+		child.once("error", () => finish({ kind: "failed" }));
+		child.once("exit", (code, signal) => finish({
+			kind: "exited",
+			code: code ?? 128 + (signal ? node_os.constants.signals[signal] : 0)
+		}));
+	});
+}
+//#endregion
+//#region ../../packages/agent-core/src/telemetry-settings.ts
+const EXPECTED = {
+	CLAUDE_CODE_ENABLE_TELEMETRY: (value) => value === "1",
+	OTEL_LOGS_EXPORTER: (value) => includesOtlp(value),
+	OTEL_METRICS_EXPORTER: (value) => includesOtlp(value),
+	OTEL_TRACES_EXPORTER: (value) => includesOtlp(value),
+	OTEL_EXPORTER_OTLP_PROTOCOL: (value) => value === "http/protobuf"
+};
+const NAMES = Object.keys(EXPECTED);
+const includesOtlp = (value) => value.split(",").some((exporter) => exporter.trim() === "otlp");
+const noGuard = () => {};
+async function isTelemetryConfigured(options) {
+	const managed = await readManagedEnv(options.managedDir, NAMES);
+	const settings = await readJsonObjectFile(options.userSettingsPath, noGuard).catch(() => void 0);
+	const userEnv = isObject(settings?.env) ? settings.env : {};
+	return NAMES.every((name) => {
+		const value = managed[name] ?? userEnv[name];
+		return typeof value === "string" && EXPECTED[name](value);
+	}) && typeof settings?.otelHeadersHelper === "string";
+}
+//#endregion
+//#region ../../packages/agent-core/src/url.ts
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+function parseAllowedUrl(value) {
+	if (!value) return void 0;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return;
+	}
+	return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname) ? url : void 0;
+}
+function underBase(base, path) {
+	const url = new URL(base.origin);
+	url.pathname = `${base.pathname.replace(/\/+$/, "")}/${path}`;
+	return url;
+}
+//#endregion
+//#region ../../packages/agent-core/src/client-update.ts
+const CLIENT_UPDATE_HEADER = "harnessforce-client-update";
+const UPDATE_COMMANDS = {
+	cli: "npm install -g @harnessforce/cli@latest",
+	"claude-code-plugin": "claude plugin update harnessforce@harnessforce-agent"
+};
+const DISPLAY_NAMES = {
+	cli: "CLI",
+	"claude-code-plugin": "plugin"
+};
+const DAY_MS = 864e5;
+const RECHECK_TIMEOUT_MS = 2e3;
+const userAgentOf = (client) => `harnessforce-${client.component}${client.dev ? "-dev" : ""}/${client.version}`;
+const STATUSES = /* @__PURE__ */ new Set([
+	"current",
+	"outdated",
+	"deprecated",
+	"unsupported"
+]);
+const REASONS = /* @__PURE__ */ new Set(["security", "compatibility"]);
+function parseClientUpdateHeader(value) {
+	if (!value) return void 0;
+	const members = /* @__PURE__ */ new Map();
+	for (const member of value.split(",")) {
+		const [key, raw] = member.trim().split("=", 2);
+		if (key && raw !== void 0) members.set(key, raw);
+	}
+	const status = members.get("status");
+	if (!status || !STATUSES.has(status)) return void 0;
+	const update = { status };
+	const latest = /^"([^"\\]*)"$/.exec(members.get("latest") ?? "")?.[1];
+	if (latest) update.latest = latest;
+	const reason = members.get("reason");
+	if (reason && REASONS.has(reason)) update.reason = reason;
+	const seconds = /^@(\d+)$/.exec(members.get("deadline") ?? "")?.[1];
+	if (seconds) update.deadline = (/* @__PURE__ */ new Date(Number(seconds) * 1e3)).toISOString();
+	return isComplete(update) ? update : void 0;
+}
+function isComplete(update) {
+	switch (update.status) {
+		case "outdated": return Boolean(update.latest);
+		case "deprecated": return Boolean(update.reason) && !Number.isNaN(Date.parse(update.deadline ?? ""));
+		case "unsupported": return Boolean(update.reason);
+		default: return true;
+	}
+}
+function stateFrom(value, version) {
+	if (!isObject(value) || value.version !== version) return void 0;
+	if (typeof value.receivedAt !== "string") return void 0;
+	if (typeof value.status !== "string" || !STATUSES.has(value.status)) return void 0;
+	const state = value;
+	return isComplete(state) ? state : void 0;
+}
+async function readUpdateState(path, version) {
+	const saved = await readSavedUpdateState(path);
+	return saved?.version === version ? saved : void 0;
+}
+async function readSavedUpdateState(path) {
+	try {
+		const value = JSON.parse(await (0, node_fs_promises.readFile)(path, "utf8"));
+		return isObject(value) && typeof value.version === "string" ? stateFrom(value, value.version) : void 0;
+	} catch {
+		return;
+	}
+}
+async function writeUpdateState(path, state) {
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = `${path}.${(0, node_crypto.randomUUID)()}.tmp`;
+	await (0, node_fs_promises.writeFile)(temporary, `${JSON.stringify(state)}\n`, { mode: 384 });
+	await (0, node_fs_promises.rename)(temporary, path);
+}
+/**
+* Harnessforceへの要求に`User-Agent`を付け、応答の`Harnessforce-Client-Update`を状態のfileへ保存するfetch。
+* 保存に失敗しても要求の結果は変えない。statePathが無い（pluginのdata directoryが無い）場合は版の申告だけを行う。
+*/
+function recordingFetch(fetchImpl, client, statePath, now) {
+	return async (url, init) => {
+		const headers = {
+			...Object.fromEntries(new Headers(init.headers)),
+			"user-agent": userAgentOf(client)
+		};
+		const response = await fetchImpl(url, {
+			...init,
+			headers
+		});
+		const update = parseClientUpdateHeader(response.headers.get(CLIENT_UPDATE_HEADER));
+		if (update && statePath) {
+			const previous = await readUpdateState(statePath, client.version);
+			await writeUpdateState(statePath, {
+				...update,
+				version: client.version,
+				receivedAt: now().toISOString(),
+				...previous?.outdatedShownAt ? { outdatedShownAt: previous.outdatedShownAt } : {}
+			}).catch(() => {});
+		}
+		return response;
+	};
+}
+const utcDate = (instant) => new Intl.DateTimeFormat("en-CA", {
+	timeZone: "UTC",
+	year: "numeric",
+	month: "2-digit",
+	day: "2-digit"
+}).format(new Date(instant));
+const unsupportedLine = (component) => `This Harnessforce ${DISPLAY_NAMES[component]} version is no longer supported, so nothing is being sent to Harnessforce. Update it: \`${UPDATE_COMMANDS[component]}\``;
+function updateLine(component, update) {
+	const name = DISPLAY_NAMES[component];
+	const command = UPDATE_COMMANDS[component];
+	switch (update.status) {
+		case "unsupported": return unsupportedLine(component);
+		case "deprecated": {
+			const stops = `stops sending on ${utcDate(update.deadline ?? "")} (00:00 UTC)`;
+			return update.reason === "security" ? `A security update for Harnessforce ${name} is available. This version ${stops}. Update it: \`${command}\`` : `This Harnessforce ${name} version ${stops}. Update it: \`${command}\``;
+		}
+		case "outdated": return `Harnessforce ${name} ${update.latest} is available. Update it: \`${command}\``;
+		default: return;
+	}
+}
+function shouldShowOutdated(state, now, env) {
+	if (state.status !== "outdated" || env.NO_UPDATE_NOTIFIER || env.CI) return false;
+	const shownAt = state.outdatedShownAt ? Date.parse(state.outdatedShownAt) : NaN;
+	return Number.isNaN(shownAt) || now.getTime() - shownAt >= DAY_MS;
+}
+const markOutdatedShown = (path, state, now) => writeUpdateState(path, {
+	...state,
+	outdatedShownAt: now.toISOString()
+});
+/**
+* 表示する1行。outdatedは24時間に1回までとし、表示する場合はその時刻を書く。isSuppressedは、pluginを
+* Claude Codeが自動更新する間など、呼び出し側がoutdatedを示さない条件。
+*/
+async function noticeLine(component, statePath, state, options) {
+	if (state.status === "outdated") {
+		if (!shouldShowOutdated(state, options.now, options.env) || await options.isSuppressed?.()) return void 0;
+		await markOutdatedShown(statePath, state, options.now).catch(() => {});
+	}
+	return updateLine(component, state);
+}
+/**
+* unsupportedを受けてから24時間以上経っていれば、資格情報を送らずに`GET /v1/client-status`で確かめ直す
+* （client-updates.md「送信の停止」）。失敗した場合は状態を変えない。
+*/
+async function recheckClientStatus(options) {
+	const { state } = options;
+	if (state?.status !== "unsupported" || options.now().getTime() - Date.parse(state.receivedAt) < DAY_MS) return state;
+	try {
+		await (await options.fetch(underBase(options.ingestBase, "v1/client-status"), {
+			method: "GET",
+			redirect: "error",
+			signal: AbortSignal.timeout(RECHECK_TIMEOUT_MS)
+		})).body?.cancel();
+	} catch {
+		return state;
+	}
+	return await readUpdateState(options.statePath, options.version) ?? state;
+}
+//#endregion
+//#region ../../packages/agent-core/src/config/plugins.ts
+const NON_MARKETPLACE_ORIGINS = /* @__PURE__ */ new Set([
+	"inline",
+	"skills-dir",
+	"synced"
+]);
+const PLUGIN_ID = /^([A-Za-z0-9._-]+)@([A-Za-z0-9._-]+)$/;
+const isPathSegment = (name) => name !== "." && name !== "..";
+const ORPHANED_MARK = ".orphaned_at";
+function enabledPluginIds(sources) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const settings of sources) {
+		const enabled = settings?.enabledPlugins;
+		if (isObject(enabled)) for (const [id, value] of Object.entries(enabled)) merged.set(id, value);
+	}
+	return [...merged].filter(([, value]) => value === true).map(([id]) => id);
+}
+async function liveVersion(pluginDir, guard) {
+	const live = [];
+	for (const version of await listDirectories(pluginDir, guard)) if (!await exists((0, node_path.join)(pluginDir, version, ORPHANED_MARK), guard)) live.push(version);
+	return live.length === 1 ? live[0] : void 0;
+}
+async function collectPlugins(pluginsRoot, settingsByPrecedence, scope, guard) {
+	for (const id of enabledPluginIds(settingsByPrecedence)) {
+		const [, name, marketplace] = PLUGIN_ID.exec(id) ?? [];
+		if (!name || !marketplace || !isPathSegment(name) || !isPathSegment(marketplace) || NON_MARKETPLACE_ORIGINS.has(marketplace)) continue;
+		const pluginDir = (0, node_path.join)(pluginsRoot, "cache", marketplace, name);
+		const version = await liveVersion(pluginDir, guard);
+		if (version === void 0) continue;
+		const root = (0, node_path.join)(pluginDir, version);
+		const s = scope("plugin", `${id}:`, isToken(version, 64) ? version : void 0);
+		await collectLayout(s, {
+			skills: (0, node_path.join)(root, "skills"),
+			agents: (0, node_path.join)(root, "agents"),
+			commands: (0, node_path.join)(root, "commands"),
+			workflows: (0, node_path.join)(root, "workflows")
+		});
+		collectHooks(s, (await readJsonObjectFile((0, node_path.join)(root, "hooks/hooks.json"), guard))?.hooks);
+		collectMcpServers(s, (await readJsonObjectFile((0, node_path.join)(root, ".mcp.json"), guard))?.mcpServers);
+	}
+}
+//#endregion
+//#region ../../packages/agent-core/src/config/collect.ts
+const COLLECT_BUDGET_MS = 1e3;
+async function readManagedSettings(managedDir, guard) {
+	let merged = await readJsonObjectFile((0, node_path.join)(managedDir, "managed-settings.json"), guard);
+	const dropInDir = (0, node_path.join)(managedDir, "managed-settings.d");
+	const dropIns = (await listFiles(dropInDir, ".json", false, guard)).sort(byCodeUnit$1);
+	for (const name of dropIns) {
+		const dropIn = await readJsonObjectFile((0, node_path.join)(dropInDir, name), guard);
+		if (dropIn) merged = {
+			...merged,
+			...dropIn
+		};
+	}
+	return merged;
+}
+function collectSettings(s, settings) {
+	if (!settings) return;
+	const { hooks, permissions, model } = settings;
+	collectHooks(s, hooks);
+	if (isObject(permissions)) s.addValue("permissions", "permissions", permissions);
+	if (typeof model === "string") s.addValue("model", model, model);
+}
+const objectAt = (value, key) => {
+	const found = value?.[key];
+	return isObject(found) ? found : {};
+};
+function locationsOf(options) {
+	const { projectRoot, managedDir, homeDir } = options;
+	const user = (0, node_path.join)(homeDir, ".claude");
+	const configDir = absoluteEnv(options.env.CLAUDE_CONFIG_DIR);
+	return {
+		projectRoot,
+		managedDir,
+		homeDir,
+		user,
+		configDir,
+		config: configDir ?? user,
+		project: (0, node_path.join)(projectRoot, ".claude")
+	};
+}
+async function collectFiles(at, s) {
+	const { projectRoot, managedDir, user, project } = at;
+	await collectRules(s.managed, managedDir, ["CLAUDE.md"]);
+	await collectLayout(s.managed, { skills: (0, node_path.join)(managedDir, ".claude/skills") });
+	if (!at.configDir) {
+		await collectRules(s.user, user, ["CLAUDE.md"], (0, node_path.join)(user, "rules"));
+		await collectLayout(s.user, {
+			skills: (0, node_path.join)(user, "skills"),
+			agents: (0, node_path.join)(user, "agents"),
+			commands: (0, node_path.join)(user, "commands")
+		});
+	}
+	await collectLayout(s.user, { workflows: (0, node_path.join)(at.config, "workflows") });
+	await collectRules(s.repository, projectRoot, ["CLAUDE.md", ".claude/CLAUDE.md"], (0, node_path.join)(project, "rules"));
+	await collectLayout(s.repository, {
+		skills: (0, node_path.join)(project, "skills"),
+		agents: (0, node_path.join)(project, "agents"),
+		commands: (0, node_path.join)(project, "commands"),
+		workflows: (0, node_path.join)(project, "workflows")
+	});
+	await collectRules(s.local, projectRoot, ["CLAUDE.local.md"]);
+}
+async function readAllSettings(at, guard) {
+	return {
+		managed: await readManagedSettings(at.managedDir, guard),
+		user: await readJsonObjectFile((0, node_path.join)(at.config, "settings.json"), guard),
+		repository: await readJsonObjectFile((0, node_path.join)(at.project, "settings.json"), guard),
+		local: await readJsonObjectFile((0, node_path.join)(at.project, "settings.local.json"), guard)
+	};
+}
+async function collectAllMcpServers(at, s, settings, guard) {
+	const managedMcp = await readJsonObjectFile((0, node_path.join)(at.managedDir, "managed-mcp.json"), guard);
+	collectMcpServers(s.managed, {
+		...objectAt(settings.managed, "managedMcpServers"),
+		...objectAt(managedMcp, "mcpServers")
+	});
+	const projectMcp = await readJsonObjectFile((0, node_path.join)(at.projectRoot, ".mcp.json"), guard);
+	collectMcpServers(s.repository, projectMcp?.mcpServers);
+	if (!at.configDir) {
+		const global = await readJsonObjectFile((0, node_path.join)(at.homeDir, ".claude.json"), guard);
+		collectMcpServers(s.user, global?.mcpServers);
+		collectMcpServers(s.local, objectAt(objectAt(global, "projects"), at.projectRoot).mcpServers);
+	}
+}
+async function collectAll(options, scope, guard) {
+	const at = locationsOf(options);
+	const scopes = {
+		managed: scope("managed"),
+		user: scope("user"),
+		repository: scope("repository"),
+		local: scope("local")
+	};
+	await collectFiles(at, scopes);
+	const settings = await readAllSettings(at, guard);
+	collectSettings(scopes.managed, settings.managed);
+	collectSettings(scopes.user, settings.user);
+	collectSettings(scopes.repository, settings.repository);
+	collectSettings(scopes.local, settings.local);
+	await collectAllMcpServers(at, scopes, settings, guard);
+	await collectPlugins(absoluteEnv(options.env.CLAUDE_CODE_PLUGIN_CACHE_DIR) ?? (0, node_path.join)(at.config, "plugins"), [
+		settings.user,
+		settings.repository,
+		settings.local,
+		settings.managed
+	], scope, guard);
+}
+async function collectConfig(options) {
+	const guard = () => {
+		if (options.isExpired()) throw new CollectionExpired();
+	};
+	const sink = new Sink(guard);
+	try {
+		await collectAll(options, sink.scope, guard);
+		guard();
+	} catch (error) {
+		if (error instanceof CollectionExpired) return {
+			kind: "skipped",
+			reason: "timeout"
+		};
+		if (error instanceof TooManyComponents) return {
+			kind: "skipped",
+			reason: "too many components"
+		};
+		throw error;
+	}
+	if (sink.hasDuplicates()) return {
+		kind: "skipped",
+		reason: "duplicate identifier"
+	};
+	return {
+		kind: "collected",
+		components: sortComponents(sink.components)
+	};
+}
+//#endregion
+//#region ../../packages/agent-core/src/ingest.ts
+const SEND_TIMEOUT_MS = 2e3;
+const INGEST_KEY_WORKSPACE = /^hf_ik_([A-Za-z0-9-]{1,128})_/;
+const workspaceIdOf = (key) => INGEST_KEY_WORKSPACE.exec(key)?.[1];
+function ingestBaseFrom(endpoint) {
+	const base = parseAllowedUrl(endpoint);
+	if (!base) return void 0;
+	const ingestBase = new URL(base.origin);
+	ingestBase.pathname = base.pathname.replace(/\/+$/, "");
+	return ingestBase;
+}
+async function postItems(destination, path, items, fetchImpl, timeoutMs = SEND_TIMEOUT_MS) {
+	try {
+		const response = await fetchImpl(underBase(destination.ingestBase, path), {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${destination.key}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify(items),
+			redirect: "error",
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		await response.body?.cancel();
+		if (response.status === 401) return { kind: "unauthorized" };
+		return response.ok ? { kind: "accepted" } : {
+			kind: "failed",
+			reason: `HTTP ${response.status}`
+		};
+	} catch (error) {
+		return {
+			kind: "failed",
+			reason: error instanceof Error ? error.name : "unknown"
+		};
+	}
+}
+//#endregion
+//#region ../../packages/agent-core/src/issue.ts
+const isIssueIdentifier = (value) => isToken(value, 300);
+//#endregion
+//#region ../../packages/agent-core/src/using-harnessforce.ts
+const usingHarnessforceBody = "---\nname: using-harnessforce\ndescription: Use when starting a session in an environment with the Harnessforce hook, when starting work on an Issue, or when asked what is recorded or collected. The hook injects this text into the context at session start.\n---\n\n# Using Harnessforce\n\nThis session has the Harnessforce hook installed. Harnessforce links the work of people and AI to Issues and records it. Follow these rules.\n\n## What is recorded\n\n- Session registration: agent, session ID, repository, branch, commit, start time, and the first prompt ID.\n- Config snapshot: the structure of the configuration in use (Claude Code only).\n- OTel telemetry: what the user chooses to send.\n- For work on an Issue, `record-run` registers the session as a Run and closes it. It records no Plan, Decision, or Definition of Done.\n\n## What is not collected\n\n- Prompts, responses, tool input and output, and the body of code diffs arrive only when the user opts in with `--send-content` and the Workspace has opted in. They are not collected by default.\n- Never put these contents, secrets, or environment variable values in MCP tool input or in a record.\n\n## Which hook sends what\n\n- SessionStart: session registration and the config snapshot (Codex sends session registration only).\n- UserPromptSubmit: resends on the first prompt (Claude Code only).\n- A failing hook never stops the session. When the hook cannot send, it shows a one-line warning. Tell the user when a warning appears.\n\n## Which skill and tool to use, and when\n\n- For work on a specified Issue ID, or when the environment variable `HARNESSFORCE_ISSUE` is set, follow `record-run` and use `start_run`, `get_issue`, and `complete_run`. An agent that cannot load the skill calls the tools in the same order.\n- Pass the value of the `harnessforce session_id:` line in the context to `start_run`. If there are several, use the last one. If the line is missing, do not guess the session ID, and do not call `start_run` or `complete_run`.\n- Use `propose-improvements` for the analysis of `/harnessforce:tune`.\n- When no Issue is specified, do not start recording a Run.\n\n## Red Flags\n\nStop when one of these thoughts comes up.\n\n| Thought | Reality |\n| --- | --- |\n| An Issue was specified, but the work is small, so recording is unnecessary | Work on a specified Issue is recorded regardless of its size |\n| The session ID line is missing, so I will guess it and call `start_run` | Do not guess. The Run would no longer be linked to the session |\n| Summarizing the content before recording would help | Do not pass content to the tool. It goes beyond what is collected |\n| A warning appeared, but I can ignore it | Sending is not working. Tell the user |\n\n## Priority\n\n1. The user's instructions (CLAUDE.md, AGENTS.md, direct requests). If the user tells you to stop recording, stop recording the Run.\n2. This introduction.\n3. Default behavior.\n\n## Subagents\n\nA subagent that was delegated only a specific task by its parent does not register a Run by following this introduction. The parent registers the Run.\n".replace(/\r\n/g, "\n").replace(/^---\n[\s\S]*?\n---\n+/, "").trimEnd();
+//#endregion
+//#region ../../packages/agent-core/src/session-context.ts
+const sessionContextLine = (sessionId) => `harnessforce session_id: ${sessionId}`;
+const sessionContext = (sessionId) => ({ hookSpecificOutput: {
+	hookEventName: "SessionStart",
+	additionalContext: `${sessionContextLine(sessionId)}\n\n${usingHarnessforceBody}`
+} });
+//#endregion
+//#region ../../packages/agent-core/src/vcs.ts
+async function selectRemote(cwd, git) {
+	if (await git(cwd, ["rev-parse", "--is-inside-work-tree"]) !== "true") return void 0;
+	const remotes = (await git(cwd, ["remote"]))?.split("\n") ?? [];
+	return remotes.includes("origin") ? "origin" : remotes[0];
+}
+async function resolveVcs(cwd, git) {
+	const remote = await selectRemote(cwd, git);
+	if (!remote) return void 0;
+	const [url, branch, commit] = await Promise.all([
+		git(cwd, [
+			"remote",
+			"get-url",
+			remote
+		]),
+		git(cwd, [
+			"symbolic-ref",
+			"--quiet",
+			"--short",
+			"HEAD"
+		]),
+		git(cwd, [
+			"rev-parse",
+			"--verify",
+			"--quiet",
+			"HEAD"
+		])
+	]);
+	const repository = url === void 0 ? void 0 : normalizeRepository(url);
+	return {
+		...repository === void 0 ? {} : { repository },
+		...branch === void 0 ? {} : { branch },
+		...commit === void 0 ? {} : { commit }
+	};
+}
+async function resolveProjectRoot(cwd, git) {
+	const topLevel = await git(cwd, ["rev-parse", "--show-toplevel"]);
+	return topLevel && (0, node_path.isAbsolute)(topLevel) ? topLevel : cwd;
+}
+//#endregion
+//#region src/input.ts
+const FILE_SAFE_SESSION_ID = /^[A-Za-z0-9_-]+$/;
+const isFileSafeSessionId = (sessionId) => FILE_SAFE_SESSION_ID.test(sessionId);
+const token = (value) => typeof value === "string" && isToken(value) ? value : void 0;
+const absolutePath = (value) => typeof value === "string" && (0, node_path.isAbsolute)(value) ? value : void 0;
+function parseJsonObject(raw) {
+	try {
+		const value = JSON.parse(raw);
+		return isObject(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+function parseHookInput(raw) {
+	const fields = parseJsonObject(raw);
+	const sessionId = token(fields?.session_id);
+	const cwd = absolutePath(fields?.cwd);
+	if (!fields || !sessionId || !cwd) return void 0;
+	const scratchpadDir = absolutePath(fields.scratchpad_dir);
+	return {
+		sessionId,
+		cwd,
+		promptId: token(fields.prompt_id),
+		scratchpad: scratchpadDir && isFileSafeSessionId(sessionId) ? {
+			dir: scratchpadDir,
+			sessionId
+		} : void 0,
+		source: typeof fields.source === "string" ? fields.source : void 0,
+		fields
+	};
+}
+//#endregion
+//#region src/scratchpad.ts
+const registrationFile = (pad) => (0, node_path.join)(pad.dir, `registration-${pad.sessionId}.json`);
+const unauthorizedMark = (pad) => (0, node_path.join)(pad.dir, `unauthorized-${pad.sessionId}`);
+const firstPromptSentMark = (pad) => (0, node_path.join)(pad.dir, `first-prompt-sent-${pad.sessionId}`);
+async function saveRegistration(pad, registration) {
+	await (0, node_fs_promises.writeFile)(registrationFile(pad), JSON.stringify(registration));
+}
+async function markUnauthorized(pad) {
+	await (0, node_fs_promises.writeFile)(unauthorizedMark(pad), "");
+}
+async function isMarkedUnauthorized(pad) {
+	return (0, node_fs_promises.access)(unauthorizedMark(pad)).then(() => true, () => false);
+}
+async function loadRegistration(pad) {
+	try {
+		const saved = JSON.parse(await (0, node_fs_promises.readFile)(registrationFile(pad), "utf8"));
+		return typeof saved === "object" && saved !== null && saved.session_id === pad.sessionId ? saved : void 0;
+	} catch {
+		return;
+	}
+}
+async function isFirstPromptSent(pad) {
+	return (0, node_fs_promises.access)(firstPromptSentMark(pad)).then(() => true, () => false);
+}
+async function claimFirstPrompt(pad) {
+	return (0, node_fs_promises.writeFile)(firstPromptSentMark(pad), "", { flag: "wx" }).then(() => true, () => false);
+}
+//#endregion
+//#region src/usage/names.ts
+const PLUGIN_COMPONENT = /^([A-Za-z0-9._-]+)@[A-Za-z0-9._-]+:(.+)$/;
+function pluginPartsOf(identifier) {
+	const parts = identifier.plugin ? PLUGIN_COMPONENT.exec(identifier.id) : null;
+	return parts ? {
+		plugin: parts[1],
+		name: parts[2]
+	} : void 0;
+}
+function onlyOne(candidates) {
+	const ids = new Set(candidates.map((c) => c.id));
+	return ids.size === 1 ? [...ids][0] : void 0;
+}
+function identifierOfName(name, candidates) {
+	const colon = name.indexOf(":");
+	if (colon >= 0) {
+		const plugin = name.slice(0, colon);
+		const rest = name.slice(colon + 1);
+		return onlyOne(candidates.filter((c) => {
+			const parts = pluginPartsOf(c);
+			return parts?.plugin === plugin && parts.name === rest;
+		}));
+	}
+	const direct = candidates.filter((c) => !c.plugin && c.id === name);
+	return onlyOne(direct.length > 0 ? direct : candidates.filter((c) => pluginPartsOf(c)?.name === name));
+}
+const toToolName = (name) => name.replace(/[^A-Za-z0-9_-]/g, "_");
+function toolPrefixOf(server) {
+	if (!server.plugin) return `mcp__${toToolName(server.id)}__`;
+	const parts = pluginPartsOf(server);
+	return parts && `mcp__plugin_${toToolName(parts.plugin)}_${toToolName(parts.name)}__`;
+}
+const mcpServerOfTool = (toolName, servers) => onlyOne(servers.filter((server) => {
+	const prefix = toolPrefixOf(server);
+	return prefix !== void 0 && toolName.startsWith(prefix);
+}));
+//#endregion
+//#region src/usage/count.ts
+const COUNTING_EVENTS = [
+	"post-tool-use",
+	"post-tool-use-failure",
+	"user-prompt-expansion",
+	"permission-request",
+	"post-compact"
+];
+const named = (kind, id) => id === void 0 ? { kind } : {
+	kind,
+	id
+};
+const stringOf = (value) => typeof value === "string" ? value : void 0;
+function toolCall(fields, identifiers) {
+	const tool = stringOf(fields.tool_name);
+	const input = isObject(fields.tool_input) ? fields.tool_input : {};
+	if (tool === "Skill") {
+		const skill = stringOf(input.skill)?.replace(/^\//, "");
+		return named("skill", skill === void 0 ? void 0 : identifierOfName(skill, identifiers.skill));
+	}
+	if (tool === "Agent" || tool === "Task") {
+		const type = stringOf(input.subagent_type);
+		return named("subagent", type === void 0 ? void 0 : identifierOfName(type, identifiers.agent));
+	}
+	if (tool?.startsWith("mcp__")) return named("mcp", mcpServerOfTool(tool, identifiers.mcp_server));
+}
+function commandCall(fields, identifiers) {
+	if (fields.expansion_type === "mcp_prompt") return named("command", void 0);
+	if (fields.expansion_type !== "slash_command") return void 0;
+	const name = stringOf(fields.command_name);
+	return named("command", name === void 0 ? void 0 : identifierOfName(name, [...identifiers.skill, ...identifiers.command]));
+}
+function countedOf(event, fields, identifiers) {
+	switch (event) {
+		case "post-tool-use": return toolCall(fields, identifiers);
+		case "post-tool-use-failure": {
+			const call = toolCall(fields, identifiers);
+			return call && {
+				...call,
+				failed: true
+			};
+		}
+		case "user-prompt-expansion": return commandCall(fields, identifiers);
+		case "permission-request": return { kind: "permission" };
+		case "post-compact": return fields.trigger === "auto" || fields.trigger === "manual" ? {
+			kind: "compaction",
+			trigger: fields.trigger
+		} : void 0;
+	}
+}
+//#endregion
+//#region src/usage/store.ts
+function usageStoreOf(sessionId, env) {
+	const data = env.CLAUDE_PLUGIN_DATA;
+	if (!data || !(0, node_path.isAbsolute)(data) || !isFileSafeSessionId(sessionId)) return void 0;
+	return {
+		dir: (0, node_path.join)(data, "usage"),
+		sessionId
+	};
+}
+const recordFile = (store, sessionId) => (0, node_path.join)(store.dir, `${sessionId}.jsonl`);
+const stateFile = (store, sessionId) => (0, node_path.join)(store.dir, `${sessionId}.json`);
+const IDENTIFIER_KINDS = [
+	"skill",
+	"command",
+	"agent",
+	"mcp_server"
+];
+function identifiersOf(components) {
+	const of = (kind) => {
+		const unique = /* @__PURE__ */ new Map();
+		for (const c of components) if (c.kind === kind) {
+			const plugin = c.source === "plugin";
+			unique.set(`${plugin}:${c.id}`, {
+				id: c.id,
+				plugin
+			});
+		}
+		return [...unique.values()];
+	};
+	return {
+		skill: of("skill"),
+		command: of("command"),
+		agent: of("agent"),
+		mcp_server: of("mcp_server")
+	};
+}
+async function createState(store, state) {
+	await (0, node_fs_promises.mkdir)(store.dir, { recursive: true });
+	await (0, node_fs_promises.writeFile)(stateFile(store, store.sessionId), JSON.stringify(state), { flag: "wx" }).catch((error) => {
+		if (error.code !== "EEXIST") throw error;
+	});
+}
+const isIdentifier = (value) => isObject(value) && typeof value.id === "string" && isToken(value.id) && typeof value.plugin === "boolean";
+function parseState(value) {
+	if (!isObject(value) || !isObject(value.identifiers)) return void 0;
+	const { workspaceId, identifiers, sentLength } = value;
+	return typeof workspaceId === "string" && typeof sentLength === "number" && Number.isSafeInteger(sentLength) && sentLength >= 0 && IDENTIFIER_KINDS.every((kind) => {
+		const list = identifiers[kind];
+		return Array.isArray(list) && list.every(isIdentifier);
+	}) ? value : void 0;
+}
+async function readState(store, sessionId = store.sessionId) {
+	try {
+		return parseState(JSON.parse(await (0, node_fs_promises.readFile)(stateFile(store, sessionId), "utf8")));
+	} catch {
+		return;
+	}
+}
+async function writeSentLength(store, sessionId, state, sentLength) {
+	const file = stateFile(store, sessionId);
+	const partial = `${file}.${process.pid}.tmp`;
+	await (0, node_fs_promises.writeFile)(partial, JSON.stringify({
+		...state,
+		sentLength
+	}));
+	await (0, node_fs_promises.rename)(partial, file);
+}
+const RECORD_KINDS = [
+	"start",
+	"prompt",
+	"skill",
+	"command",
+	"subagent",
+	"mcp",
+	"permission",
+	"compaction"
+];
+const appendRecord = (store, line) => (0, node_fs_promises.appendFile)(recordFile(store, store.sessionId), `${JSON.stringify(line)}\n`);
+const isOptional = (value, check) => value === void 0 || check(value);
+const isTokenValue = (value) => typeof value === "string" && isToken(value);
+function parseLine(text) {
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		return [];
+	}
+	if (!isObject(value)) return [];
+	const { at, kind, promptId, id, failed, trigger } = value;
+	return typeof at === "string" && isInstant(at) && RECORD_KINDS.some((k) => k === kind) && isOptional(promptId, isTokenValue) && isOptional(id, isTokenValue) && isOptional(failed, (v) => v === true) && isOptional(trigger, (v) => v === "auto" || v === "manual") ? [value] : [];
+}
+async function readRecord(store, sessionId = store.sessionId) {
+	const bytes = await (0, node_fs_promises.readFile)(recordFile(store, sessionId)).catch(() => void 0);
+	if (!bytes) return void 0;
+	const length = bytes.lastIndexOf(10) + 1;
+	return {
+		lines: bytes.subarray(0, length).toString("utf8").split("\n").flatMap(parseLine),
+		length
+	};
+}
+async function listSessions(store) {
+	return (await (0, node_fs_promises.readdir)(store.dir).catch(() => [])).filter((name) => name.endsWith(".json")).map((name) => name.slice(0, -5)).filter(isFileSafeSessionId);
+}
+const recordChangeOf = (store, sessionId) => (0, node_fs_promises.stat)(recordFile(store, sessionId)).then(({ size, mtimeMs }) => ({
+	size,
+	mtimeMs
+}), () => void 0);
+const RETENTION_MS = 2592e6;
+const REMOVALS_PER_START = 100;
+async function removeExpiredFiles(store, now) {
+	let removed = 0;
+	for (const name of await (0, node_fs_promises.readdir)(store.dir).catch(() => [])) {
+		if (removed === REMOVALS_PER_START) return;
+		const file = (0, node_path.join)(store.dir, name);
+		const info = await (0, node_fs_promises.lstat)(file).catch(() => void 0);
+		if (!info?.isFile() || now.getTime() - info.mtimeMs <= RETENTION_MS) continue;
+		if (await (0, node_fs_promises.unlink)(file).then(() => true, () => false)) removed += 1;
+	}
+}
+//#endregion
+//#region src/usage/summary.ts
+const COLLECTOR_VERSION = "0.1.0";
+const MAX_ITEMS = 200;
+const byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function callListOf(lines, kind) {
+	const byName = /* @__PURE__ */ new Map();
+	const other = {
+		calls: 0,
+		failures: 0
+	};
+	for (const line of lines) {
+		if (line.kind !== kind) continue;
+		let calls = other;
+		if (line.id !== void 0) {
+			calls = byName.get(line.id) ?? {
+				calls: 0,
+				failures: 0
+			};
+			byName.set(line.id, calls);
+		}
+		calls.calls += 1;
+		if (line.failed) calls.failures += 1;
+	}
+	const ranked = [...byName].map(([name, calls]) => ({
+		name,
+		...calls
+	})).sort((a, b) => b.calls - a.calls || byCodeUnit(a.name, b.name));
+	for (const rest of ranked.slice(MAX_ITEMS)) {
+		other.calls += rest.calls;
+		other.failures += rest.failures;
+	}
+	return {
+		items: ranked.slice(0, MAX_ITEMS),
+		other
+	};
+}
+function commandListOf(lines) {
+	const { items, other } = callListOf(lines, "command");
+	return {
+		items: items.map(({ name, calls }) => ({
+			name,
+			calls
+		})),
+		other: { calls: other.calls }
+	};
+}
+const countOf = (lines, kind) => lines.filter((line) => line.kind === kind).length;
+const compactionsOf = (lines, trigger) => lines.filter((line) => line.kind === "compaction" && line.trigger === trigger).length;
+const byTime = (lines) => lines.map((line, order) => ({
+	line,
+	ms: Date.parse(line.at),
+	order
+})).sort((a, b) => a.ms - b.ms || a.order - b.order).map(({ line }) => line);
+function buildSummary(sessionId, lines) {
+	const ordered = byTime(lines);
+	const first = ordered[0];
+	const last = ordered.at(-1);
+	if (!first || !last) return void 0;
+	const firstPromptId = ordered.find((line) => line.promptId)?.promptId;
+	return {
+		agent: "claude_code",
+		session_id: sessionId,
+		...firstPromptId === void 0 ? {} : { first_prompt_id: firstPromptId },
+		started_at: first.at,
+		last_event_at: last.at,
+		collector_version: COLLECTOR_VERSION,
+		skills: callListOf(lines, "skill"),
+		commands: commandListOf(lines),
+		subagents: callListOf(lines, "subagent"),
+		mcp_servers: callListOf(lines, "mcp"),
+		permission_requests: countOf(lines, "permission"),
+		compactions: {
+			auto: compactionsOf(lines, "auto"),
+			manual: compactionsOf(lines, "manual")
+		}
+	};
+}
+//#endregion
+//#region src/usage/send.ts
+async function sendSessionUsage(store, destination, deadlineMs, deps) {
+	const state = await readState(store);
+	if (!state || state.workspaceId !== workspaceIdOf(destination.key)) return void 0;
+	const record = await readRecord(store);
+	const summary = record ? buildSummary(store.sessionId, record.lines) : void 0;
+	if (!record || !summary) return void 0;
+	const remainingMs = deadlineMs - deps.now().getTime();
+	if (remainingMs <= 0) return {
+		kind: "failed",
+		reason: "TimeoutError"
+	};
+	const outcome = await postItems(destination, "v1/session-usage", [summary], deps.fetch, Math.ceil(remainingMs));
+	if (outcome.kind === "accepted") await writeSentLength(store, store.sessionId, state, record.length);
+	return outcome;
+}
+const PENDING_IDLE_MS = 6e5;
+const PENDING_PER_REQUEST = 20;
+async function pendingSessions(store, workspaceId, nowMs) {
+	const pending = [];
+	for (const sessionId of await listSessions(store)) {
+		if (sessionId === store.sessionId) continue;
+		const change = await recordChangeOf(store, sessionId);
+		if (!change || nowMs - change.mtimeMs < PENDING_IDLE_MS) continue;
+		const state = await readState(store, sessionId);
+		if (state?.workspaceId === workspaceId && change.size > state.sentLength) pending.push({
+			sessionId,
+			state,
+			mtimeMs: change.mtimeMs
+		});
+	}
+	return pending.sort((a, b) => a.mtimeMs - b.mtimeMs);
+}
+async function sendUnsentUsage(store, destination, deps) {
+	const workspaceId = workspaceIdOf(destination.key);
+	if (workspaceId === void 0) return void 0;
+	const batch = [];
+	for (const pending of await pendingSessions(store, workspaceId, deps.now().getTime())) {
+		if (batch.length === PENDING_PER_REQUEST) break;
+		const record = await readRecord(store, pending.sessionId);
+		if (!record || record.length <= pending.state.sentLength) continue;
+		const summary = buildSummary(pending.sessionId, record.lines);
+		if (summary) batch.push({
+			...pending,
+			record,
+			summary
+		});
+	}
+	if (batch.length === 0) return void 0;
+	const outcome = await postItems(destination, "v1/session-usage", batch.map((sent) => sent.summary), deps.fetch);
+	if (outcome.kind === "accepted") await Promise.all(batch.map((sent) => writeSentLength(store, sent.sessionId, sent.state, sent.record.length)));
+	return outcome;
+}
+//#endregion
+//#region src/hook.ts
+const pluginStatePath = (env) => env.CLAUDE_PLUGIN_DATA && (0, node_path.isAbsolute)(env.CLAUDE_PLUGIN_DATA) ? (0, node_path.join)(env.CLAUDE_PLUGIN_DATA, "update-status.json") : void 0;
+const cliStatePath = (homeDir) => (0, node_path.join)(homeDir, ".harnessforce", "update-status.json");
+const CLI_UNSUPPORTED_WARNING = unsupportedLine("cli");
+const REVOKED_KEY_MESSAGES = {
+	user: "Your ingest key has been revoked. Run `harnessforce init`",
+	workspace: "The organization's ingest key has been revoked. Contact a Workspace administrator"
+};
+const REGISTERING_SOURCES = /* @__PURE__ */ new Set([
+	"startup",
+	"clear",
+	"fork"
+]);
+const logError = (deps) => (error) => deps.stderr(`harnessforce: ${error instanceof Error ? error.message : String(error)}\n`);
+const report = (deps, subject, detail) => deps.stderr(`harnessforce: ${subject} ${detail}\n`);
+const KEY_WARNINGS = {
+	absent: keyMissingWarning("claude_code"),
+	withheld: DESTINATION_MISMATCH_WARNING.claude_code,
+	unreadable: keyUnreadableWarning("claude_code")
+};
+async function selectUserKey(deps, cwd) {
+	if (!deps.env.HARNESSFORCE_WORKSPACE_ID) return {};
+	const read = await deps.readUserKey(cwd);
+	if (read.kind === "found") return { key: read.key };
+	if (read.kind !== "missing") deps.stderr("harnessforce: no user key in keychain or read failed\n");
+	return {
+		warning: KEY_WARNINGS[read.kind],
+		isCliUnsupported: read.kind === "cliUnsupported"
+	};
+}
+const sendingNotice = (message) => message === void 0 ? void 0 : {
+	kind: "sending",
+	message
+};
+async function resolveDestination(deps, cwd, withUserKey = true) {
+	const managed = await readManagedEnv(deps.managedDir, ["HARNESSFORCE_INGEST_KEY", "HARNESSFORCE_ENDPOINT"]);
+	const workspaceKey = managed.HARNESSFORCE_INGEST_KEY;
+	if (!workspaceKey && !withUserKey) return {};
+	const endpoint = workspaceKey ? managed.HARNESSFORCE_ENDPOINT : deps.env.HARNESSFORCE_ENDPOINT;
+	const notConfigured = !endpoint || !(workspaceKey || deps.env.HARNESSFORCE_WORKSPACE_ID);
+	const ingestBase = ingestBaseFrom(endpoint);
+	if (!ingestBase) {
+		report(deps, "session registration", "skipped (invalid endpoint)");
+		return { warning: sendingNotice(notConfigured ? notConfiguredWarning("claude_code") : INVALID_ENDPOINT_WARNING) };
+	}
+	if (workspaceKey) return { destination: {
+		ingestBase,
+		key: workspaceKey,
+		keyKind: "workspace"
+	} };
+	const { key: userKey, warning, isCliUnsupported } = await selectUserKey(deps, cwd);
+	if (!userKey) {
+		report(deps, "session registration", "skipped (no ingest key)");
+		if (isCliUnsupported) {
+			await recheckCliStatus(deps, ingestBase);
+			return { warning: {
+				kind: "clientUnsupported",
+				message: CLI_UNSUPPORTED_WARNING
+			} };
+		}
+		return { warning: sendingNotice(notConfigured ? notConfiguredWarning("claude_code") : warning) };
+	}
+	return { destination: {
+		ingestBase,
+		key: userKey,
+		keyKind: "user"
+	} };
+}
+async function recheckCliStatus(deps, ingestBase) {
+	const statePath = cliStatePath(deps.homeDir);
+	const state = await readSavedUpdateState(statePath);
+	if (!state) return;
+	const cli = {
+		component: "cli",
+		version: state.version,
+		dev: false
+	};
+	await recheckClientStatus({
+		state,
+		ingestBase,
+		fetch: recordingFetch(deps.baseFetch, cli, statePath, deps.now),
+		statePath,
+		version: state.version,
+		now: deps.now
+	});
+}
+function registrationSource(destination, env) {
+	const issue = env.HARNESSFORCE_ISSUE;
+	return destination.keyKind === "user" && issue && isIssueIdentifier(issue) ? {
+		source: "cli",
+		issue_identifier: issue
+	} : { source: "hook" };
+}
+async function send(destination, path, item, subject, deps) {
+	const outcome = await postItems(destination, path, [item], deps.fetch);
+	if (outcome.kind === "failed") report(deps, subject, `failed (${outcome.reason})`);
+	return outcome;
+}
+async function reportRevokedKey(destination, pad, deps) {
+	const message = REVOKED_KEY_MESSAGES[destination.keyKind];
+	deps.stderr(`${message}\n`);
+	if (pad) await markUnauthorized(pad).catch(logError(deps));
+	return message;
+}
+const writeJson = (deps, output) => deps.stdout(`${JSON.stringify(output)}\n`);
+async function registerSession(input, destination, deps) {
+	const vcs = await resolveVcs(input.cwd, deps.git);
+	if (!vcs) return void 0;
+	const registration = {
+		agent: "claude_code",
+		session_id: input.sessionId,
+		...vcs,
+		...registrationSource(destination, deps.env),
+		started_at: deps.now().toISOString()
+	};
+	if (input.scratchpad) await saveRegistration(input.scratchpad, registration).catch(logError(deps));
+	return send(destination, "v1/sessions", registration, "session registration", deps);
+}
+async function collectComponents(input, deps) {
+	const startedMs = deps.now().getTime();
+	try {
+		const result = await collectConfig({
+			projectRoot: await resolveProjectRoot(input.cwd, deps.git),
+			homeDir: deps.homeDir,
+			managedDir: deps.managedDir,
+			env: deps.env,
+			isExpired: () => deps.now().getTime() - startedMs > COLLECT_BUDGET_MS
+		});
+		if (result.kind === "collected") return result.components;
+		report(deps, "config snapshot", `skipped (${result.reason})`);
+	} catch (error) {
+		logError(deps)(error);
+	}
+}
+async function sendConfigSnapshot(input, components, destination, deps) {
+	if (components.length === 0) return void 0;
+	return send(destination, "v1/config-snapshots", {
+		agent: "claude_code",
+		session_id: input.sessionId,
+		components
+	}, "config snapshot", deps);
+}
+async function createUsageState(usage, destination, components) {
+	const workspaceId = workspaceIdOf(destination.key);
+	if (workspaceId === void 0) return;
+	await createState(usage, {
+		workspaceId,
+		identifiers: identifiersOf(components),
+		sentLength: 0
+	});
+}
+async function appendIfRecording(usage, line) {
+	if (await readState(usage)) await appendRecord(usage, line);
+}
+const promptIdOf = (input) => input.promptId === void 0 ? {} : { promptId: input.promptId };
+async function startUsage(usage, destination, collected, deps) {
+	const [, unsent] = await Promise.all([collected.then((components) => createUsageState(usage, destination, components ?? [])).catch(logError(deps)), sendUnsentUsage(usage, destination, deps).catch(logError(deps))]);
+	if (unsent?.kind === "failed") report(deps, "session usage", `failed (${unsent.reason})`);
+	return unsent ?? void 0;
+}
+async function sendSessionStart(input, usage, deps) {
+	const registers = input.source === void 0 || REGISTERING_SOURCES.has(input.source);
+	if (!registers && !usage) return void 0;
+	if (input.scratchpad && await isMarkedUnauthorized(input.scratchpad)) return void 0;
+	const { destination, warning } = await resolveDestination(deps, input.cwd);
+	if (!destination) return registers ? warning : void 0;
+	const collected = registers || usage && !await readState(usage) ? collectComponents(input, deps) : Promise.resolve(void 0);
+	const isConfigured = registers && destination.keyKind === "user" ? deps.isTelemetryConfigured() : Promise.resolve(true);
+	const [registration, snapshot, unsent, configured] = await Promise.all([
+		registers ? registerSession(input, destination, deps).catch(logError(deps)) : void 0,
+		registers ? collected.then((components) => components ? sendConfigSnapshot(input, components, destination, deps) : void 0).catch(logError(deps)) : void 0,
+		usage ? startUsage(usage, destination, collected, deps) : void 0,
+		isConfigured
+	]);
+	if ([
+		registration,
+		snapshot,
+		unsent
+	].some((outcome) => outcome?.kind === "unauthorized")) return {
+		kind: "revoked",
+		message: await reportRevokedKey(destination, input.scratchpad, deps)
+	};
+	if (!configured) return sendingNotice(TELEMETRY_NOT_CONFIGURED_WARNING);
+	return sendingNotice(registration?.kind === "failed" ? REGISTRATION_FAILED_WARNING : void 0);
+}
+async function statusCheckBase(deps) {
+	const managed = await readManagedEnv(deps.managedDir, ["HARNESSFORCE_INGEST_KEY", "HARNESSFORCE_ENDPOINT"]);
+	return ingestBaseFrom(managed.HARNESSFORCE_INGEST_KEY ? managed.HARNESSFORCE_ENDPOINT : deps.env.HARNESSFORCE_ENDPOINT);
+}
+/**
+* pluginの状態のfileがunsupportedなら送信を止める（client-updates.md「送信の停止」）。recheckなら、受けてから24時間以上
+* 経った状態を資格情報を送らずに確かめ直す。SessionEndは1秒の予算に収めるため確かめ直さない。
+*/
+async function isPluginBlocked(deps, recheck) {
+	const statePath = pluginStatePath(deps.env);
+	if (!statePath) return false;
+	const state = await readUpdateState(statePath, deps.client.version);
+	if (state?.status !== "unsupported") return false;
+	const ingestBase = recheck ? await statusCheckBase(deps) : void 0;
+	return (ingestBase ? await recheckClientStatus({
+		state,
+		ingestBase,
+		fetch: deps.fetch,
+		statePath,
+		version: deps.client.version,
+		now: deps.now
+	}) : state)?.status === "unsupported";
+}
+async function withUpdateLine(notice, input, deps) {
+	if (notice && notice.kind !== "sending") return notice.message;
+	const statePath = pluginStatePath(deps.env);
+	const state = statePath ? await readUpdateState(statePath, deps.client.version) : void 0;
+	if (state?.status === "unsupported") return updateLine("claude-code-plugin", state);
+	if (notice || !state || !statePath) return notice?.message;
+	return noticeLine("claude-code-plugin", statePath, state, {
+		now: deps.now(),
+		env: deps.env,
+		isSuppressed: () => deps.isPluginAutoUpdateEffective(input.cwd)
+	});
+}
+async function onSessionStart(input, deps) {
+	const usage = usageStoreOf(input.sessionId, deps.env);
+	const startedAt = deps.now();
+	if (usage) await removeExpiredFiles(usage, startedAt).catch(logError(deps));
+	const registers = input.source === void 0 || REGISTERING_SOURCES.has(input.source);
+	const sent = await isPluginBlocked(deps, true).catch(() => false) ? void 0 : await sendSessionStart(input, usage, deps).catch((error) => {
+		logError(deps)(error);
+	});
+	const message = registers ? await withUpdateLine(sent, input, deps).catch(() => sent?.message) : sent?.message;
+	if (usage) await appendIfRecording(usage, {
+		at: startedAt.toISOString(),
+		kind: "start",
+		...promptIdOf(input)
+	}).catch(logError(deps));
+	writeJson(deps, {
+		...sessionContext(input.sessionId),
+		...message === void 0 ? {} : { systemMessage: message }
+	});
+}
+async function onUserPromptSubmit(input, deps) {
+	const usage = usageStoreOf(input.sessionId, deps.env);
+	if (usage) await appendIfRecording(usage, {
+		at: deps.now().toISOString(),
+		kind: "prompt",
+		...promptIdOf(input)
+	}).catch(logError(deps));
+	const pad = input.scratchpad;
+	if (!input.promptId || !pad || await isMarkedUnauthorized(pad)) return;
+	if (await isPluginBlocked(deps, false)) return;
+	const saved = await loadRegistration(pad);
+	if (!saved || await isFirstPromptSent(pad)) return;
+	const { destination } = await resolveDestination(deps, input.cwd);
+	if (!destination || !await claimFirstPrompt(pad)) return;
+	if ((await send(destination, "v1/sessions", {
+		...saved,
+		first_prompt_id: input.promptId
+	}, "session registration", deps)).kind === "unauthorized") writeJson(deps, { systemMessage: await reportRevokedKey(destination, pad, deps) });
+}
+const SESSION_END_BUDGET_MS = 1e3;
+async function onSessionEnd(input, deps) {
+	const usage = usageStoreOf(input.sessionId, deps.env);
+	if (!usage) return;
+	if (input.scratchpad && await isMarkedUnauthorized(input.scratchpad)) return;
+	if (await isPluginBlocked(deps, false)) return;
+	const { destination } = await resolveDestination(deps, input.cwd, false);
+	if (!destination) return;
+	const outcome = await sendSessionUsage(usage, destination, deps.processStartMs + SESSION_END_BUDGET_MS, deps);
+	if (outcome && outcome.kind !== "accepted") report(deps, "session usage", `failed (${outcome.kind === "failed" ? outcome.reason : "HTTP 401"})`);
+}
+const onCountingEvent = (event) => async (input, deps) => {
+	const usage = usageStoreOf(input.sessionId, deps.env);
+	const state = usage && await readState(usage);
+	const counted = state && countedOf(event, input.fields, state.identifiers);
+	if (usage && counted) await appendRecord(usage, {
+		at: deps.now().toISOString(),
+		...promptIdOf(input),
+		...counted
+	});
+};
+const HANDLERS = new Map([
+	["session-start", onSessionStart],
+	["user-prompt-submit", onUserPromptSubmit],
+	["session-end", onSessionEnd],
+	...COUNTING_EVENTS.map((event) => [event, onCountingEvent(event)])
+]);
+async function runHook(event, rawInput, hookDeps) {
+	const handler = HANDLERS.get(event);
+	const input = parseHookInput(rawInput);
+	if (!handler || !input) return;
+	const deps = {
+		...hookDeps,
+		baseFetch: hookDeps.fetch,
+		fetch: recordingFetch(hookDeps.fetch, hookDeps.client, pluginStatePath(hookDeps.env), hookDeps.now)
+	};
+	await handler(input, deps).catch(logError(deps));
+}
+//#endregion
+//#region src/user-key.ts
+const HF_TIMEOUT_MS = 1e3;
+const HF_OUTPUT_LIMIT_BYTES = 65536;
+const BEARER = /^Bearer (\S+)$/;
+const FAILURES = {
+	3: { kind: "absent" },
+	4: { kind: "withheld" },
+	5: { kind: "cliUnsupported" }
+};
+function parseKey(stdout) {
+	try {
+		const value = JSON.parse(stdout);
+		if (!isObject(value)) return void 0;
+		const authorization = value.Authorization;
+		return typeof authorization === "string" ? BEARER.exec(authorization)?.[1] : void 0;
+	} catch {
+		return;
+	}
+}
+function createUserKeyReader({ platform, env, exec, processCwd, fs }) {
+	return async (cwd) => {
+		const context = {
+			platform,
+			env,
+			bases: [processCwd, cwd],
+			...fs ? { fs } : {}
+		};
+		const file = await findCommand("harnessforce", context);
+		const command = file === void 0 ? void 0 : await commandLineFor(file, ["otel-headers"], context, { quoteArgs: false });
+		if (!command) return { kind: "missing" };
+		const result = await exec(command.file, command.args, {
+			timeoutMs: HF_TIMEOUT_MS,
+			windowsVerbatimArguments: command.verbatim,
+			env: {
+				...env,
+				HARNESSFORCE_NO_MIGRATE: "1"
+			}
+		});
+		const key = result.ok ? parseKey(result.stdout) : void 0;
+		if (key) return {
+			kind: "found",
+			key
+		};
+		return result.exitCode !== void 0 && FAILURES[result.exitCode] || { kind: "unreadable" };
+	};
+}
+const execHf = (file, args, options) => new Promise((resolve) => {
+	(0, node_child_process.execFile)(file, args, {
+		encoding: "utf8",
+		env: options.env,
+		timeout: options.timeoutMs,
+		killSignal: "SIGKILL",
+		maxBuffer: HF_OUTPUT_LIMIT_BYTES,
+		windowsHide: true,
+		windowsVerbatimArguments: options.windowsVerbatimArguments
+	}, (error, stdout) => resolve({
+		ok: !error,
+		stdout,
+		...error && !error.killed && typeof error.code === "number" ? { exitCode: error.code } : {}
+	}));
+});
+//#endregion
+//#region src/main.ts
+delete process.env.HARNESSFORCE_RUNTIME_ENV;
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8");
+}
+for (const stream of [process.stdout, process.stderr]) stream.on("error", () => {});
+async function main() {
+	const relaunch = await relaunchWithoutRuntimeVariables({
+		platform: process.platform,
+		env: process.env,
+		stash: false,
+		spawnSelf
+	});
+	if (relaunch.kind === "failed") {
+		process.stderr.write("harnessforce: session registration skipped (restart failed)\n");
+		process.stdout.write(warningOnlyOutput(RESTART_FAILED_WARNING));
+	}
+	if (relaunch.kind !== "not-needed") return;
+	const raw = await readStdin().catch(() => "");
+	const managedDir = managedDirFor(process.platform);
+	const userSettingsPath = (0, node_path.join)(absoluteEnv(process.env.CLAUDE_CONFIG_DIR) ?? (0, node_path.join)((0, node_os.homedir)(), ".claude"), "settings.json");
+	await runHook(process.argv[2] ?? "", raw, {
+		env: process.env,
+		now: () => /* @__PURE__ */ new Date(),
+		processStartMs: node_perf_hooks.performance.timeOrigin,
+		git: createGitRunner({
+			platform: process.platform,
+			env: process.env,
+			processCwd: process.cwd(),
+			excludeTarget: true
+		}),
+		fetch: (url, init) => fetch(url, init),
+		stdout: (text) => process.stdout.write(text),
+		stderr: (text) => process.stderr.write(text),
+		homeDir: (0, node_os.homedir)(),
+		managedDir,
+		readUserKey: createUserKeyReader({
+			platform: process.platform,
+			env: process.env,
+			exec: execHf,
+			processCwd: process.cwd()
+		}),
+		isTelemetryConfigured: () => isTelemetryConfigured({
+			userSettingsPath,
+			managedDir
+		}),
+		client: {
+			component: "claude-code-plugin",
+			version: "0.2.0",
+			dev: false
+		},
+		isPluginAutoUpdateEffective: (cwd) => isPluginAutoUpdateEffective({
+			userSettingsPath,
+			managedDir,
+			projectDir: absoluteEnv(process.env.CLAUDE_PROJECT_DIR) ?? cwd,
+			env: process.env
+		})
+	});
+}
+main();
+//#endregion