@harnessforce/claude-code-plugin 0.1.0 → 0.2.0

package/scripts/harnessforce-hook-main.cjs

@@ -1,16 +1,71 @@
 let node_os = require("node:os");
-let node_perf_hooks = require("node:perf_hooks");
 let node_path = require("node:path");
+let node_perf_hooks = require("node:perf_hooks");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
-//#region ../../packages/agent-core/src/hook-warning.ts
-const RESTART_FAILED_WARNING = "Harnessforceのhookを起動し直せませんでした";
-const INVALID_ENDPOINT_WARNING = "Harnessforceの送信先が不正です。`harnessforce init`を実行し直してください";
-const REGISTRATION_FAILED_WARNING = "Harnessforceへのsession登録に失敗しました。通信を確かめてください";
-const notConfiguredWarning = (agent) => agent === "claude_code" ? "Harnessforceの送信が設定されていません。`/harnessforce:setup`を実行してください" : "Harnessforceの送信が設定されていません。`harnessforce init`を実行してください";
-const warningOnlyOutput = (message) => `${JSON.stringify({ systemMessage: message })}\n`;
+const NO_WHITE_SPACE = new RegExp(`^[^\\t-\\r \\u0085\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000]+$`);
+const isToken = (value, maxLength = 256) => {
+	const length = [...value].length;
+	return length >= 1 && length <= maxLength && NO_WHITE_SPACE.test(value);
+};
+const INSTANT_PATTERN = `^(?:1(?:6(?:7[7-9]|[89]\\d)|[7-9]\\d\\d)|2(?:[01]\\d\\d|2(?:[0-5]\\d|6[0-2])))-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-](?:[01]\\d|2[0-3]):[0-5]\\d)$`;
+const INSTANT_PARTS = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+const INSTANT = new RegExp(INSTANT_PATTERN);
+const MIN_INSTANT_MS = Date.UTC(1677, 8, 21, 0, 12, 44);
+const MAX_INSTANT_MS = Date.UTC(2262, 3, 11, 23, 47, 16);
+function isInstant(value) {
+	const parts = INSTANT.test(value) ? INSTANT_PARTS.exec(value) : null;
+	if (!parts) return false;
+	const [, ...fields] = parts;
+	const [year, month, day, hour, minute, second] = fields.slice(0, 6).map(Number);
+	const [fraction = "", sign, offsetHours = "0", offsetMinutes = "0"] = fields.slice(6);
+	const localMs = Date.UTC(year, month - 1, day, hour, minute, second);
+	const local = new Date(localMs);
+	if (!(local.getUTCFullYear() === year && local.getUTCMonth() === month - 1 && local.getUTCDate() === day && local.getUTCHours() === hour && local.getUTCMinutes() === minute && local.getUTCSeconds() === second)) return false;
+	const secondMs = localMs - (sign === "-" ? -1 : 1) * (Number(offsetHours) * 60 + Number(offsetMinutes)) * 6e4;
+	const nanos = Number(fraction.slice(0, 9) || "0");
+	return secondMs >= MIN_INSTANT_MS && !(secondMs > MAX_INSTANT_MS || secondMs === MAX_INSTANT_MS && nanos > 0);
+}
+//#endregion
+//#region ../../packages/semconv/dist/repository.js
+const SCHEME_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
+const SCP_LIKE = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(.+)$/;
+const HOST = /^[a-z0-9.-]+$/;
+const SEGMENT = /^[A-Za-z0-9_.-]+$/;
+function splitRemote(remote) {
+	if (SCHEME_URL.test(remote)) {
+		let url;
+		try {
+			url = new URL(remote);
+		} catch {
+			return;
+		}
+		return url.protocol === "file:" ? void 0 : {
+			host: url.hostname,
+			path: url.pathname
+		};
+	}
+	const scp = SCP_LIKE.exec(remote);
+	return scp?.[1] && scp[2] ? {
+		host: scp[1],
+		path: scp[2]
+	} : void 0;
+}
+function normalizeRepository(remoteUrl) {
+	const location = splitRemote(remoteUrl.trim());
+	if (!location) return void 0;
+	const lowerHost = location.host.toLowerCase();
+	const host = lowerHost === "ssh.github.com" ? "github.com" : lowerHost;
+	const segments = location.path.replace(/\/+$/, "").replace(/\.git$/, "").replace(/^\/+/, "").split("/");
+	if (segments.length !== 2 || !HOST.test(host) || !segments.every((segment) => SEGMENT.test(segment))) return void 0;
+	const [owner, name] = host === "github.com" ? segments.map((segment) => segment.toLowerCase()) : segments;
+	return `${host}/${owner}/${name}`;
+}
+//#endregion
+//#region ../../packages/agent-core/src/object.ts
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 //#endregion
 //#region ../../packages/agent-core/src/config/canonical.ts
 const byCodeUnit$1 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -29,9 +84,6 @@ function sortComponents(components) {
 	return [...components].sort((a, b) => byCodeUnit$1(a.kind, b.kind) || byCodeUnit$1(a.source, b.source) || byCodeUnit$1(a.id, b.id));
 }
 //#endregion
-//#region ../../packages/agent-core/src/object.ts
-const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-//#endregion
 //#region ../../packages/agent-core/src/config/files.ts
 const MAX_DEPTH = 8;
 const MAX_FILE_BYTES = 1048576;
@@ -94,26 +146,175 @@ async function listDirectories(dir, guard) {
 	return names;
 }
 //#endregion
+//#region ../../packages/agent-core/src/config/hash-input.ts
+function withoutSecrets(entry) {
+	const { env, headers, url, args: _args, ...rest } = entry;
+	const result = rest;
+	if (isObject(env)) result.env = Object.keys(env).sort(byCodeUnit$1);
+	if (isObject(headers)) result.headers = Object.keys(headers).sort(byCodeUnit$1);
+	const strippedUrl = typeof url === "string" ? withoutCredentials(url) : void 0;
+	if (strippedUrl !== void 0) result.url = strippedUrl;
+	return result;
+}
+function withoutCredentials(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return;
+	}
+	parsed.username = "";
+	parsed.password = "";
+	parsed.search = "";
+	parsed.hash = "";
+	return parsed.href;
+}
+const reduceHookGroup = (group) => isObject(group) && Array.isArray(group.hooks) ? {
+	...group,
+	hooks: group.hooks.map((handler) => isObject(handler) ? withoutSecrets(handler) : handler)
+} : group;
+function hashInput(kind, value) {
+	if (kind === "mcp_server" && isObject(value)) return withoutSecrets(value);
+	if (kind === "hook" && Array.isArray(value)) return value.map(reduceHookGroup);
+	return value;
+}
+//#endregion
+//#region ../../packages/agent-core/src/config/scope.ts
+const MAX_COMPONENTS = 1e3;
+var TooManyComponents = class extends Error {};
+var Sink = class {
+	guard;
+	components = [];
+	constructor(guard) {
+		this.guard = guard;
+	}
+	add(component) {
+		if (!isToken(component.id)) return;
+		if (this.components.length >= MAX_COMPONENTS) throw new TooManyComponents();
+		this.components.push(component);
+	}
+	hasDuplicates() {
+		return new Set(this.components.map((c) => `${c.kind}\0${c.source}\0${c.id}`)).size !== this.components.length;
+	}
+	scope = (source, idPrefix = "", version) => {
+		const add = (kind, id, hash) => this.add({
+			kind,
+			source,
+			id: `${idPrefix}${id}`,
+			...version === void 0 ? {} : { version },
+			hash
+		});
+		return {
+			guard: this.guard,
+			addValue: (kind, id, value) => add(kind, id, hashValue(hashInput(kind, value))),
+			addFile: async (kind, id, path) => {
+				const content = await readFileIfExists(path, this.guard);
+				if (content) add(kind, id, hashFileContent(content));
+			}
+		};
+	};
+};
+const absoluteEnv = (value) => value && (0, node_path.isAbsolute)(value) ? value : void 0;
+const withoutExt = (path, ext) => path.slice(0, -ext.length);
+const colonName = (path) => withoutExt(path, ".md").replace(/\//g, ":");
+async function collectLayout(s, layout) {
+	if (layout.skills) for (const name of await listDirectories(layout.skills, s.guard)) await s.addFile("skill", name, (0, node_path.join)(layout.skills, name, "SKILL.md"));
+	if (layout.agents) for (const path of await listFiles(layout.agents, ".md", true, s.guard)) await s.addFile("agent", colonName(path), (0, node_path.join)(layout.agents, path));
+	if (layout.commands) for (const path of await listFiles(layout.commands, ".md", true, s.guard)) await s.addFile("command", colonName(path), (0, node_path.join)(layout.commands, path));
+	if (layout.workflows) for (const path of await listFiles(layout.workflows, ".js", false, s.guard)) await s.addFile("workflow", withoutExt(path, ".js"), (0, node_path.join)(layout.workflows, path));
+}
+async function collectRules(s, base, names, rulesDir) {
+	for (const name of names) await s.addFile("rule", name, (0, node_path.join)(base, name));
+	if (rulesDir) for (const path of await listFiles(rulesDir, ".md", true, s.guard)) await s.addFile("rule", `rules/${path}`, (0, node_path.join)(rulesDir, path));
+}
+function collectHooks(s, hooks) {
+	if (!isObject(hooks)) return;
+	for (const [event, value] of Object.entries(hooks)) s.addValue("hook", event, value);
+}
+function collectMcpServers(s, servers) {
+	if (!isObject(servers)) return;
+	for (const [name, value] of Object.entries(servers)) if (isObject(value)) s.addValue("mcp_server", name, value);
+}
+//#endregion
+//#region ../../packages/agent-core/src/hook-warning.ts
+const RESTART_FAILED_WARNING = "Could not restart the Harnessforce hook";
+const INVALID_ENDPOINT_WARNING = "The Harnessforce destination is invalid. Run `harnessforce init` again";
+const REGISTRATION_FAILED_WARNING = "Harnessforce session registration failed. Check your network connection";
+const notConfiguredWarning = (agent) => agent === "claude_code" ? "Harnessforce sending is not configured. Run `/harnessforce:setup`" : "Harnessforce sending is not configured. Run `harnessforce init`";
+const stopped = (agent) => agent === "claude_code" ? "telemetry is not being sent" : "sessions are not being registered";
+const keyMissingWarning = (agent) => `Harnessforce cannot find your ingest key, so ${stopped(agent)}. Run \`harnessforce init\``;
+const keyUnreadableWarning = (agent) => `Harnessforce could not read your ingest key from the OS keychain, so ${agent === "claude_code" ? "telemetry may not be sent" : "sessions may not be registered"}. Unlock the keychain or run \`harnessforce init\``;
+const DESTINATION_MISMATCH_WARNING = {
+	claude_code: "Telemetry is not being sent because the Harnessforce destination differs from the one saved by `harnessforce init`. Check this repository's settings or run `harnessforce init` again",
+	codex: "Sessions are not being registered because the Harnessforce destination differs from the one saved by `harnessforce init`. Run `harnessforce init` again"
+};
+const TELEMETRY_NOT_CONFIGURED_WARNING = "Claude Code telemetry for Harnessforce is not configured. Run `harnessforce init`";
+const warningOnlyOutput = (message) => `${JSON.stringify({ systemMessage: message })}\n`;
+//#endregion
 //#region ../../packages/agent-core/src/managed.ts
 const MANAGED_DIRS = {
 	darwin: "/Library/Application Support/ClaudeCode",
 	win32: "C:\\Program Files\\ClaudeCode"
 };
 const managedDirFor = (platform) => MANAGED_DIRS[platform] ?? "/etc/claude-code";
-const noGuard = () => {};
+const noGuard$2 = () => {};
 async function readManagedEnv(managedDir, names) {
 	const dropInDir = (0, node_path.join)(managedDir, "managed-settings.d");
-	const dropIns = (await listFiles(dropInDir, ".json", false, noGuard)).sort(byCodeUnit$1);
+	const dropIns = (await listFiles(dropInDir, ".json", false, noGuard$2)).sort(byCodeUnit$1);
 	const files = [(0, node_path.join)(managedDir, "managed-settings.json"), ...dropIns.map((name) => (0, node_path.join)(dropInDir, name))];
 	const values = Object.fromEntries(names.map((name) => [name, void 0]));
 	for (const file of files) {
-		const env = (await readJsonObjectFile(file, noGuard))?.env;
+		const env = (await readJsonObjectFile(file, noGuard$2))?.env;
 		if (!isObject(env)) continue;
 		for (const name of names) if (typeof env[name] === "string") values[name] = env[name];
 	}
 	return values;
 }
 //#endregion
+//#region ../../packages/agent-core/src/plugin-auto-update.ts
+const MARKETPLACE_NAME = "harnessforce-agent";
+const MARKETPLACE_KEYS = ["extraKnownMarketplaces", "additionalMarketplaces"];
+const DISABLING_VARIABLES = [
+	"DISABLE_UPDATES",
+	"DISABLE_AUTOUPDATER",
+	"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"
+];
+const noGuard$1 = () => {};
+function marketplacesOf(settings) {
+	const key = MARKETPLACE_KEYS.find((name) => settings?.[name] !== void 0);
+	const value = key === void 0 ? void 0 : settings?.[key];
+	return isObject(value) ? value : void 0;
+}
+const declaresEntry = (settings) => MARKETPLACE_KEYS.some((key) => {
+	const value = settings?.[key];
+	return isObject(value) && value["harnessforce-agent"] !== void 0;
+});
+async function managedFiles(managedDir) {
+	const dropInDir = (0, node_path.join)(managedDir, "managed-settings.d");
+	const dropIns = (await listFiles(dropInDir, ".json", false, noGuard$1)).sort(byCodeUnit$1);
+	return [(0, node_path.join)(managedDir, "managed-settings.json"), ...dropIns.map((name) => (0, node_path.join)(dropInDir, name))];
+}
+/**
+* Claude Codeがpluginを自動更新するとみなせるか（client-updates.md「表示」）。確かめられない場合は偽とし、outdatedを表示する。
+* user settingsのentryが真で、優先度の高いfileが同じ名前のentryを持たず、自動更新を止める変数が無い場合だけ真とする。
+*/
+async function isPluginAutoUpdateEffective(options) {
+	const { env } = options;
+	if (DISABLING_VARIABLES.some((name) => env[name] === "1") && env.FORCE_AUTOUPDATE_PLUGINS !== "1") return false;
+	const higher = [
+		...await managedFiles(options.managedDir),
+		(0, node_path.join)(options.projectDir, ".claude", "settings.json"),
+		(0, node_path.join)(options.projectDir, ".claude", "settings.local.json")
+	];
+	for (const file of higher) {
+		if (!await (0, node_fs_promises.access)(file).then(() => true, () => false)) continue;
+		const settings = await readJsonObjectFile(file, noGuard$1);
+		if (!settings || declaresEntry(settings)) return false;
+	}
+	const entry = marketplacesOf(await readJsonObjectFile(options.userSettingsPath, noGuard$1))?.[MARKETPLACE_NAME];
+	return isObject(entry) && entry.autoUpdate === true;
+}
+//#endregion
 //#region ../../packages/agent-core/src/process/lookup.ts
 const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
 const NPM_SHIM_MAX_BYTES = 65536;
@@ -399,120 +600,208 @@ function relaunchWithoutRuntimeVariables({ platform, env, stash, spawnSelf: star
 		}));
 	});
 }
-const NO_WHITE_SPACE = new RegExp(`^[^\\t-\\r \\u0085\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000]+$`);
-const isToken = (value, maxLength = 256) => {
-	const length = [...value].length;
-	return length >= 1 && length <= maxLength && NO_WHITE_SPACE.test(value);
+//#endregion
+//#region ../../packages/agent-core/src/telemetry-settings.ts
+const EXPECTED = {
+	CLAUDE_CODE_ENABLE_TELEMETRY: (value) => value === "1",
+	OTEL_LOGS_EXPORTER: (value) => includesOtlp(value),
+	OTEL_METRICS_EXPORTER: (value) => includesOtlp(value),
+	OTEL_TRACES_EXPORTER: (value) => includesOtlp(value),
+	OTEL_EXPORTER_OTLP_PROTOCOL: (value) => value === "http/protobuf"
 };
-const INSTANT_PATTERN = `^(?:1(?:6(?:7[7-9]|[89]\\d)|[7-9]\\d\\d)|2(?:[01]\\d\\d|2(?:[0-5]\\d|6[0-2])))-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-](?:[01]\\d|2[0-3]):[0-5]\\d)$`;
-const INSTANT_PARTS = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
-const INSTANT = new RegExp(INSTANT_PATTERN);
-const MIN_INSTANT_MS = Date.UTC(1677, 8, 21, 0, 12, 44);
-const MAX_INSTANT_MS = Date.UTC(2262, 3, 11, 23, 47, 16);
-function isInstant(value) {
-	const parts = INSTANT.test(value) ? INSTANT_PARTS.exec(value) : null;
-	if (!parts) return false;
-	const [, ...fields] = parts;
-	const [year, month, day, hour, minute, second] = fields.slice(0, 6).map(Number);
-	const [fraction = "", sign, offsetHours = "0", offsetMinutes = "0"] = fields.slice(6);
-	const localMs = Date.UTC(year, month - 1, day, hour, minute, second);
-	const local = new Date(localMs);
-	if (!(local.getUTCFullYear() === year && local.getUTCMonth() === month - 1 && local.getUTCDate() === day && local.getUTCHours() === hour && local.getUTCMinutes() === minute && local.getUTCSeconds() === second)) return false;
-	const secondMs = localMs - (sign === "-" ? -1 : 1) * (Number(offsetHours) * 60 + Number(offsetMinutes)) * 6e4;
-	const nanos = Number(fraction.slice(0, 9) || "0");
-	return secondMs >= MIN_INSTANT_MS && !(secondMs > MAX_INSTANT_MS || secondMs === MAX_INSTANT_MS && nanos > 0);
+const NAMES = Object.keys(EXPECTED);
+const includesOtlp = (value) => value.split(",").some((exporter) => exporter.trim() === "otlp");
+const noGuard = () => {};
+async function isTelemetryConfigured(options) {
+	const managed = await readManagedEnv(options.managedDir, NAMES);
+	const settings = await readJsonObjectFile(options.userSettingsPath, noGuard).catch(() => void 0);
+	const userEnv = isObject(settings?.env) ? settings.env : {};
+	return NAMES.every((name) => {
+		const value = managed[name] ?? userEnv[name];
+		return typeof value === "string" && EXPECTED[name](value);
+	}) && typeof settings?.otelHeadersHelper === "string";
 }
 //#endregion
-//#region ../../packages/semconv/dist/repository.js
-const SCHEME_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
-const SCP_LIKE = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(.+)$/;
-const HOST = /^[a-z0-9.-]+$/;
-const SEGMENT = /^[A-Za-z0-9_.-]+$/;
-function splitRemote(remote) {
-	if (SCHEME_URL.test(remote)) {
-		let url;
-		try {
-			url = new URL(remote);
-		} catch {
-			return;
-		}
-		return url.protocol === "file:" ? void 0 : {
-			host: url.hostname,
-			path: url.pathname
-		};
+//#region ../../packages/agent-core/src/url.ts
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+function parseAllowedUrl(value) {
+	if (!value) return void 0;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return;
 	}
-	const scp = SCP_LIKE.exec(remote);
-	return scp?.[1] && scp[2] ? {
-		host: scp[1],
-		path: scp[2]
-	} : void 0;
+	return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname) ? url : void 0;
 }
-function normalizeRepository(remoteUrl) {
-	const location = splitRemote(remoteUrl.trim());
-	if (!location) return void 0;
-	const lowerHost = location.host.toLowerCase();
-	const host = lowerHost === "ssh.github.com" ? "github.com" : lowerHost;
-	const segments = location.path.replace(/\/+$/, "").replace(/\.git$/, "").replace(/^\/+/, "").split("/");
-	if (segments.length !== 2 || !HOST.test(host) || !segments.every((segment) => SEGMENT.test(segment))) return void 0;
-	const [owner, name] = host === "github.com" ? segments.map((segment) => segment.toLowerCase()) : segments;
-	return `${host}/${owner}/${name}`;
+function underBase(base, path) {
+	const url = new URL(base.origin);
+	url.pathname = `${base.pathname.replace(/\/+$/, "")}/${path}`;
+	return url;
 }
 //#endregion
-//#region ../../packages/agent-core/src/config/scope.ts
-const MAX_COMPONENTS = 1e3;
-var TooManyComponents = class extends Error {};
-var Sink = class {
-	guard;
-	components = [];
-	constructor(guard) {
-		this.guard = guard;
+//#region ../../packages/agent-core/src/client-update.ts
+const CLIENT_UPDATE_HEADER = "harnessforce-client-update";
+const UPDATE_COMMANDS = {
+	cli: "npm install -g @harnessforce/cli@latest",
+	"claude-code-plugin": "claude plugin update harnessforce@harnessforce-agent"
+};
+const DISPLAY_NAMES = {
+	cli: "CLI",
+	"claude-code-plugin": "plugin"
+};
+const DAY_MS = 864e5;
+const RECHECK_TIMEOUT_MS = 2e3;
+const userAgentOf = (client) => `harnessforce-${client.component}${client.dev ? "-dev" : ""}/${client.version}`;
+const STATUSES = /* @__PURE__ */ new Set([
+	"current",
+	"outdated",
+	"deprecated",
+	"unsupported"
+]);
+const REASONS = /* @__PURE__ */ new Set(["security", "compatibility"]);
+function parseClientUpdateHeader(value) {
+	if (!value) return void 0;
+	const members = /* @__PURE__ */ new Map();
+	for (const member of value.split(",")) {
+		const [key, raw] = member.trim().split("=", 2);
+		if (key && raw !== void 0) members.set(key, raw);
 	}
-	add(component) {
-		if (!isToken(component.id)) return;
-		if (this.components.length >= MAX_COMPONENTS) throw new TooManyComponents();
-		this.components.push(component);
+	const status = members.get("status");
+	if (!status || !STATUSES.has(status)) return void 0;
+	const update = { status };
+	const latest = /^"([^"\\]*)"$/.exec(members.get("latest") ?? "")?.[1];
+	if (latest) update.latest = latest;
+	const reason = members.get("reason");
+	if (reason && REASONS.has(reason)) update.reason = reason;
+	const seconds = /^@(\d+)$/.exec(members.get("deadline") ?? "")?.[1];
+	if (seconds) update.deadline = (/* @__PURE__ */ new Date(Number(seconds) * 1e3)).toISOString();
+	return isComplete(update) ? update : void 0;
+}
+function isComplete(update) {
+	switch (update.status) {
+		case "outdated": return Boolean(update.latest);
+		case "deprecated": return Boolean(update.reason) && !Number.isNaN(Date.parse(update.deadline ?? ""));
+		case "unsupported": return Boolean(update.reason);
+		default: return true;
 	}
-	hasDuplicates() {
-		return new Set(this.components.map((c) => `${c.kind}\0${c.source}\0${c.id}`)).size !== this.components.length;
+}
+function stateFrom(value, version) {
+	if (!isObject(value) || value.version !== version) return void 0;
+	if (typeof value.receivedAt !== "string") return void 0;
+	if (typeof value.status !== "string" || !STATUSES.has(value.status)) return void 0;
+	const state = value;
+	return isComplete(state) ? state : void 0;
+}
+async function readUpdateState(path, version) {
+	const saved = await readSavedUpdateState(path);
+	return saved?.version === version ? saved : void 0;
+}
+async function readSavedUpdateState(path) {
+	try {
+		const value = JSON.parse(await (0, node_fs_promises.readFile)(path, "utf8"));
+		return isObject(value) && typeof value.version === "string" ? stateFrom(value, value.version) : void 0;
+	} catch {
+		return;
 	}
-	scope = (source, idPrefix = "", version) => {
-		const add = (kind, id, hash) => this.add({
-			kind,
-			source,
-			id: `${idPrefix}${id}`,
-			...version === void 0 ? {} : { version },
-			hash
-		});
-		return {
-			guard: this.guard,
-			addValue: (kind, id, value) => add(kind, id, hashValue(value)),
-			addFile: async (kind, id, path) => {
-				const content = await readFileIfExists(path, this.guard);
-				if (content) add(kind, id, hashFileContent(content));
-			}
+}
+async function writeUpdateState(path, state) {
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = `${path}.${(0, node_crypto.randomUUID)()}.tmp`;
+	await (0, node_fs_promises.writeFile)(temporary, `${JSON.stringify(state)}\n`, { mode: 384 });
+	await (0, node_fs_promises.rename)(temporary, path);
+}
+/**
+* Harnessforceへの要求に`User-Agent`を付け、応答の`Harnessforce-Client-Update`を状態のfileへ保存するfetch。
+* 保存に失敗しても要求の結果は変えない。statePathが無い（pluginのdata directoryが無い）場合は版の申告だけを行う。
+*/
+function recordingFetch(fetchImpl, client, statePath, now) {
+	return async (url, init) => {
+		const headers = {
+			...Object.fromEntries(new Headers(init.headers)),
+			"user-agent": userAgentOf(client)
 		};
+		const response = await fetchImpl(url, {
+			...init,
+			headers
+		});
+		const update = parseClientUpdateHeader(response.headers.get(CLIENT_UPDATE_HEADER));
+		if (update && statePath) {
+			const previous = await readUpdateState(statePath, client.version);
+			await writeUpdateState(statePath, {
+				...update,
+				version: client.version,
+				receivedAt: now().toISOString(),
+				...previous?.outdatedShownAt ? { outdatedShownAt: previous.outdatedShownAt } : {}
+			}).catch(() => {});
+		}
+		return response;
 	};
-};
-const absoluteEnv = (value) => value && (0, node_path.isAbsolute)(value) ? value : void 0;
-const withoutExt = (path, ext) => path.slice(0, -ext.length);
-const colonName = (path) => withoutExt(path, ".md").replace(/\//g, ":");
-async function collectLayout(s, layout) {
-	if (layout.skills) for (const name of await listDirectories(layout.skills, s.guard)) await s.addFile("skill", name, (0, node_path.join)(layout.skills, name, "SKILL.md"));
-	if (layout.agents) for (const path of await listFiles(layout.agents, ".md", true, s.guard)) await s.addFile("agent", colonName(path), (0, node_path.join)(layout.agents, path));
-	if (layout.commands) for (const path of await listFiles(layout.commands, ".md", true, s.guard)) await s.addFile("command", colonName(path), (0, node_path.join)(layout.commands, path));
-	if (layout.workflows) for (const path of await listFiles(layout.workflows, ".js", false, s.guard)) await s.addFile("workflow", withoutExt(path, ".js"), (0, node_path.join)(layout.workflows, path));
 }
-async function collectRules(s, base, names, rulesDir) {
-	for (const name of names) await s.addFile("rule", name, (0, node_path.join)(base, name));
-	if (rulesDir) for (const path of await listFiles(rulesDir, ".md", true, s.guard)) await s.addFile("rule", `rules/${path}`, (0, node_path.join)(rulesDir, path));
+const utcDate = (instant) => new Intl.DateTimeFormat("en-CA", {
+	timeZone: "UTC",
+	year: "numeric",
+	month: "2-digit",
+	day: "2-digit"
+}).format(new Date(instant));
+const unsupportedLine = (component) => `This Harnessforce ${DISPLAY_NAMES[component]} version is no longer supported, so nothing is being sent to Harnessforce. Update it: \`${UPDATE_COMMANDS[component]}\``;
+function updateLine(component, update) {
+	const name = DISPLAY_NAMES[component];
+	const command = UPDATE_COMMANDS[component];
+	switch (update.status) {
+		case "unsupported": return unsupportedLine(component);
+		case "deprecated": {
+			const stops = `stops sending on ${utcDate(update.deadline ?? "")} (00:00 UTC)`;
+			return update.reason === "security" ? `A security update for Harnessforce ${name} is available. This version ${stops}. Update it: \`${command}\`` : `This Harnessforce ${name} version ${stops}. Update it: \`${command}\``;
+		}
+		case "outdated": return `Harnessforce ${name} ${update.latest} is available. Update it: \`${command}\``;
+		default: return;
+	}
 }
-function collectHooks(s, hooks) {
-	if (!isObject(hooks)) return;
-	for (const [event, value] of Object.entries(hooks)) s.addValue("hook", event, value);
+function shouldShowOutdated(state, now, env) {
+	if (state.status !== "outdated" || env.NO_UPDATE_NOTIFIER || env.CI) return false;
+	const shownAt = state.outdatedShownAt ? Date.parse(state.outdatedShownAt) : NaN;
+	return Number.isNaN(shownAt) || now.getTime() - shownAt >= DAY_MS;
 }
-function collectMcpServers(s, servers) {
-	if (!isObject(servers)) return;
-	for (const [name, value] of Object.entries(servers)) if (isObject(value)) s.addValue("mcp_server", name, value);
+const markOutdatedShown = (path, state, now) => writeUpdateState(path, {
+	...state,
+	outdatedShownAt: now.toISOString()
+});
+/**
+* 表示する1行。outdatedは24時間に1回までとし、表示する場合はその時刻を書く。isSuppressedは、pluginを
+* Claude Codeが自動更新する間など、呼び出し側がoutdatedを示さない条件。
+*/
+async function noticeLine(component, statePath, state, options) {
+	if (state.status === "outdated") {
+		if (!shouldShowOutdated(state, options.now, options.env) || await options.isSuppressed?.()) return void 0;
+		await markOutdatedShown(statePath, state, options.now).catch(() => {});
+	}
+	return updateLine(component, state);
+}
+/**
+* unsupportedを受けてから24時間以上経っていれば、資格情報を送らずに`GET /v1/client-status`で確かめ直す
+* （client-updates.md「送信の停止」）。失敗した場合は状態を変えない。
+*/
+async function recheckClientStatus(options) {
+	const { state } = options;
+	if (state?.status !== "unsupported" || options.now().getTime() - Date.parse(state.receivedAt) < DAY_MS) return state;
+	try {
+		await (await options.fetch(underBase(options.ingestBase, "v1/client-status"), {
+			method: "GET",
+			redirect: "error",
+			signal: AbortSignal.timeout(RECHECK_TIMEOUT_MS)
+		})).body?.cancel();
+	} catch {
+		return state;
+	}
+	return await readUpdateState(options.statePath, options.version) ?? state;
 }
 //#endregion
 //#region ../../packages/agent-core/src/config/plugins.ts
@@ -692,28 +981,6 @@ async function collectConfig(options) {
 	};
 }
 //#endregion
-//#region ../../packages/agent-core/src/url.ts
-const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]"
-]);
-function parseAllowedUrl(value) {
-	if (!value) return void 0;
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		return;
-	}
-	return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname) ? url : void 0;
-}
-function underBase(base, path) {
-	const url = new URL(base.origin);
-	url.pathname = `${base.pathname.replace(/\/+$/, "")}/${path}`;
-	return url;
-}
-//#endregion
 //#region ../../packages/agent-core/src/ingest.ts
 const SEND_TIMEOUT_MS = 2e3;
 const INGEST_KEY_WORKSPACE = /^hf_ik_([A-Za-z0-9-]{1,128})_/;
@@ -755,7 +1022,7 @@ async function postItems(destination, path, items, fetchImpl, timeoutMs = SEND_T
 const isIssueIdentifier = (value) => isToken(value, 300);
 //#endregion
 //#region ../../packages/agent-core/src/using-harnessforce.ts
-const usingHarnessforceBody = "---\nname: using-harnessforce\ndescription: Harnessforceのhookが入った環境でsessionを始めたとき、HarnessforceのIssue（ENG-42のような識別子）に取り組む作業を始めるとき、Harnessforceが何を記録し何を収集しないかを尋ねられたときに使う。sessionの開始時にhookがこの本文をcontextへ注入する。\n---\n\n# Harnessforceを使う\n\nこのsessionにはHarnessforceのhookが入っている。Harnessforceは、人とAIの作業をIssueに結び付けて記録する。次の規則に従う。\n\n## 何を記録するか\n\n- session registration: agent、session ID、repository、branch、commit、開始時刻、最初のprompt ID。\n- config snapshot: 利用中の設定の構成（Claude Codeだけ）。\n- OTelのテレメトリ: 利用者の設定で送るもの。\n- Issueに取り組む作業で`record-run`が記録する、Plan、Decision、Definition of Doneの充足。人が承認するまで確定しない。\n\n## 何を収集しないか\n\n- prompt、応答、toolの入出力、code diffの本文は、利用者が`--send-content`で選び、Workspaceがopt-inした場合だけ届く。既定では収集しない。\n- MCPのtoolの入力にも記録にも、これらの本文、secret、環境変数の値を含めない。\n\n## どのhookが何を送るか\n\n- SessionStart: session registrationとconfig snapshot（Codexはsession registrationだけ）。\n- UserPromptSubmit: 最初のpromptでの再送（Claude Codeだけ）。\n- hookは失敗してもsessionを止めない。送れない状態のときは、hookが警告を1行表示する。警告が出たら利用者に伝える。\n\n## どのskillとtoolをいつ使うか\n\n- IssueのIDを指定された作業、または環境変数`HARNESSFORCE_ISSUE`がある作業は、`record-run`に従い、`start_run`、`get_issue`、`record_plan`、`record_decision`、`complete_run`を使う。skillを読み込めないagentは、同じ順にtoolを呼ぶ。\n- `start_run`には、contextの`harnessforce session_id:`の行の値を渡す。複数あれば最後の値を使う。行が無ければ、session IDを推測せず、`start_run`と`complete_run`を呼ばない。\n- `/harnessforce:tune`の分析は`propose-improvements`を使う。\n- Issueが指定されていない作業では、Runの記録を始めない。\n\n## Red Flags\n\n次の考えが浮かんだら、立ち止まる。\n\n| 考え | 現実 |\n| --- | --- |\n| 小さな作業なので記録は要らない | Issueが指定された作業は、大きさによらず記録する |\n| session IDの行が無いが、推測して`start_run`を呼ぶ | 推測しない。Runがsessionと結び付かなくなる |\n| 本文を要約して渡せば記録の役に立つ | 本文はtoolに渡さない。収集しない範囲を超える |\n| 警告が出たが、気にしなくてよい | 送れていない。利用者に伝える |\n\n## 優先順位\n\n1. 利用者の指示（CLAUDE.md、AGENTS.md、直接の依頼）。利用者が記録を止めるよう指示したら、Runの記録を止める。\n2. この導入文。\n3. 既定の動作。\n\n## subagent\n\n親から特定の作業だけを委譲されたsubagentは、この導入文に従ってRunを登録しない。Runの登録は親が行う。\n".replace(/\r\n/g, "\n").replace(/^---\n[\s\S]*?\n---\n+/, "").trimEnd();
+const usingHarnessforceBody = "---\nname: using-harnessforce\ndescription: Use when starting a session in an environment with the Harnessforce hook, when starting work on an Issue, or when asked what is recorded or collected. The hook injects this text into the context at session start.\n---\n\n# Using Harnessforce\n\nThis session has the Harnessforce hook installed. Harnessforce links the work of people and AI to Issues and records it. Follow these rules.\n\n## What is recorded\n\n- Session registration: agent, session ID, repository, branch, commit, start time, and the first prompt ID.\n- Config snapshot: the structure of the configuration in use (Claude Code only).\n- OTel telemetry: what the user chooses to send.\n- For work on an Issue, `record-run` registers the session as a Run and closes it. It records no Plan, Decision, or Definition of Done.\n\n## What is not collected\n\n- Prompts, responses, tool input and output, and the body of code diffs arrive only when the user opts in with `--send-content` and the Workspace has opted in. They are not collected by default.\n- Never put these contents, secrets, or environment variable values in MCP tool input or in a record.\n\n## Which hook sends what\n\n- SessionStart: session registration and the config snapshot (Codex sends session registration only).\n- UserPromptSubmit: resends on the first prompt (Claude Code only).\n- A failing hook never stops the session. When the hook cannot send, it shows a one-line warning. Tell the user when a warning appears.\n\n## Which skill and tool to use, and when\n\n- For work on a specified Issue ID, or when the environment variable `HARNESSFORCE_ISSUE` is set, follow `record-run` and use `start_run`, `get_issue`, and `complete_run`. An agent that cannot load the skill calls the tools in the same order.\n- Pass the value of the `harnessforce session_id:` line in the context to `start_run`. If there are several, use the last one. If the line is missing, do not guess the session ID, and do not call `start_run` or `complete_run`.\n- Use `propose-improvements` for the analysis of `/harnessforce:tune`.\n- When no Issue is specified, do not start recording a Run.\n\n## Red Flags\n\nStop when one of these thoughts comes up.\n\n| Thought | Reality |\n| --- | --- |\n| An Issue was specified, but the work is small, so recording is unnecessary | Work on a specified Issue is recorded regardless of its size |\n| The session ID line is missing, so I will guess it and call `start_run` | Do not guess. The Run would no longer be linked to the session |\n| Summarizing the content before recording would help | Do not pass content to the tool. It goes beyond what is collected |\n| A warning appeared, but I can ignore it | Sending is not working. Tell the user |\n\n## Priority\n\n1. The user's instructions (CLAUDE.md, AGENTS.md, direct requests). If the user tells you to stop recording, stop recording the Run.\n2. This introduction.\n3. Default behavior.\n\n## Subagents\n\nA subagent that was delegated only a specific task by its parent does not register a Run by following this introduction. The parent registers the Run.\n".replace(/\r\n/g, "\n").replace(/^---\n[\s\S]*?\n---\n+/, "").trimEnd();
 //#endregion
 //#region ../../packages/agent-core/src/session-context.ts
 const sessionContextLine = (sessionId) => `harnessforce session_id: ${sessionId}`;
@@ -1205,9 +1472,12 @@ async function sendUnsentUsage(store, destination, deps) {
 }
 //#endregion
 //#region src/hook.ts
+const pluginStatePath = (env) => env.CLAUDE_PLUGIN_DATA && (0, node_path.isAbsolute)(env.CLAUDE_PLUGIN_DATA) ? (0, node_path.join)(env.CLAUDE_PLUGIN_DATA, "update-status.json") : void 0;
+const cliStatePath = (homeDir) => (0, node_path.join)(homeDir, ".harnessforce", "update-status.json");
+const CLI_UNSUPPORTED_WARNING = unsupportedLine("cli");
 const REVOKED_KEY_MESSAGES = {
-	user: "送信キーが失効しています。`harnessforce init`を実行してください",
-	workspace: "組織の送信キーが失効しています。Workspaceの管理者に連絡してください"
+	user: "Your ingest key has been revoked. Run `harnessforce init`",
+	workspace: "The organization's ingest key has been revoked. Contact a Workspace administrator"
 };
 const REGISTERING_SOURCES = /* @__PURE__ */ new Set([
 	"startup",
@@ -1216,12 +1486,25 @@ const REGISTERING_SOURCES = /* @__PURE__ */ new Set([
 ]);
 const logError = (deps) => (error) => deps.stderr(`harnessforce: ${error instanceof Error ? error.message : String(error)}\n`);
 const report = (deps, subject, detail) => deps.stderr(`harnessforce: ${subject} ${detail}\n`);
+const KEY_WARNINGS = {
+	absent: keyMissingWarning("claude_code"),
+	withheld: DESTINATION_MISMATCH_WARNING.claude_code,
+	unreadable: keyUnreadableWarning("claude_code")
+};
 async function selectUserKey(deps, cwd) {
-	if (!deps.env.HARNESSFORCE_WORKSPACE_ID) return void 0;
+	if (!deps.env.HARNESSFORCE_WORKSPACE_ID) return {};
 	const read = await deps.readUserKey(cwd);
-	if (read.kind === "failed") deps.stderr("harnessforce: no user key in keychain or read failed\n");
-	return read.kind === "found" ? read.key : void 0;
+	if (read.kind === "found") return { key: read.key };
+	if (read.kind !== "missing") deps.stderr("harnessforce: no user key in keychain or read failed\n");
+	return {
+		warning: KEY_WARNINGS[read.kind],
+		isCliUnsupported: read.kind === "cliUnsupported"
+	};
 }
+const sendingNotice = (message) => message === void 0 ? void 0 : {
+	kind: "sending",
+	message
+};
 async function resolveDestination(deps, cwd, withUserKey = true) {
 	const managed = await readManagedEnv(deps.managedDir, ["HARNESSFORCE_INGEST_KEY", "HARNESSFORCE_ENDPOINT"]);
 	const workspaceKey = managed.HARNESSFORCE_INGEST_KEY;
@@ -1231,17 +1514,24 @@ async function resolveDestination(deps, cwd, withUserKey = true) {
 	const ingestBase = ingestBaseFrom(endpoint);
 	if (!ingestBase) {
 		report(deps, "session registration", "skipped (invalid endpoint)");
-		return { warning: notConfigured ? notConfiguredWarning("claude_code") : INVALID_ENDPOINT_WARNING };
+		return { warning: sendingNotice(notConfigured ? notConfiguredWarning("claude_code") : INVALID_ENDPOINT_WARNING) };
 	}
 	if (workspaceKey) return { destination: {
 		ingestBase,
 		key: workspaceKey,
 		keyKind: "workspace"
 	} };
-	const userKey = await selectUserKey(deps, cwd);
+	const { key: userKey, warning, isCliUnsupported } = await selectUserKey(deps, cwd);
 	if (!userKey) {
 		report(deps, "session registration", "skipped (no ingest key)");
-		return notConfigured ? { warning: notConfiguredWarning("claude_code") } : {};
+		if (isCliUnsupported) {
+			await recheckCliStatus(deps, ingestBase);
+			return { warning: {
+				kind: "clientUnsupported",
+				message: CLI_UNSUPPORTED_WARNING
+			} };
+		}
+		return { warning: sendingNotice(notConfigured ? notConfiguredWarning("claude_code") : warning) };
 	}
 	return { destination: {
 		ingestBase,
@@ -1249,6 +1539,24 @@ async function resolveDestination(deps, cwd, withUserKey = true) {
 		keyKind: "user"
 	} };
 }
+async function recheckCliStatus(deps, ingestBase) {
+	const statePath = cliStatePath(deps.homeDir);
+	const state = await readSavedUpdateState(statePath);
+	if (!state) return;
+	const cli = {
+		component: "cli",
+		version: state.version,
+		dev: false
+	};
+	await recheckClientStatus({
+		state,
+		ingestBase,
+		fetch: recordingFetch(deps.baseFetch, cli, statePath, deps.now),
+		statePath,
+		version: state.version,
+		now: deps.now
+	});
+}
 function registrationSource(destination, env) {
 	const issue = env.HARNESSFORCE_ISSUE;
 	return destination.keyKind === "user" && issue && isIssueIdentifier(issue) ? {
@@ -1330,25 +1638,68 @@ async function sendSessionStart(input, usage, deps) {
 	const { destination, warning } = await resolveDestination(deps, input.cwd);
 	if (!destination) return registers ? warning : void 0;
 	const collected = registers || usage && !await readState(usage) ? collectComponents(input, deps) : Promise.resolve(void 0);
-	const [registration, snapshot, unsent] = await Promise.all([
+	const isConfigured = registers && destination.keyKind === "user" ? deps.isTelemetryConfigured() : Promise.resolve(true);
+	const [registration, snapshot, unsent, configured] = await Promise.all([
 		registers ? registerSession(input, destination, deps).catch(logError(deps)) : void 0,
 		registers ? collected.then((components) => components ? sendConfigSnapshot(input, components, destination, deps) : void 0).catch(logError(deps)) : void 0,
-		usage ? startUsage(usage, destination, collected, deps) : void 0
+		usage ? startUsage(usage, destination, collected, deps) : void 0,
+		isConfigured
 	]);
 	if ([
 		registration,
 		snapshot,
 		unsent
-	].some((outcome) => outcome?.kind === "unauthorized")) return reportRevokedKey(destination, input.scratchpad, deps);
-	return registration?.kind === "failed" ? REGISTRATION_FAILED_WARNING : void 0;
+	].some((outcome) => outcome?.kind === "unauthorized")) return {
+		kind: "revoked",
+		message: await reportRevokedKey(destination, input.scratchpad, deps)
+	};
+	if (!configured) return sendingNotice(TELEMETRY_NOT_CONFIGURED_WARNING);
+	return sendingNotice(registration?.kind === "failed" ? REGISTRATION_FAILED_WARNING : void 0);
+}
+async function statusCheckBase(deps) {
+	const managed = await readManagedEnv(deps.managedDir, ["HARNESSFORCE_INGEST_KEY", "HARNESSFORCE_ENDPOINT"]);
+	return ingestBaseFrom(managed.HARNESSFORCE_INGEST_KEY ? managed.HARNESSFORCE_ENDPOINT : deps.env.HARNESSFORCE_ENDPOINT);
+}
+/**
+* pluginの状態のfileがunsupportedなら送信を止める（client-updates.md「送信の停止」）。recheckなら、受けてから24時間以上
+* 経った状態を資格情報を送らずに確かめ直す。SessionEndは1秒の予算に収めるため確かめ直さない。
+*/
+async function isPluginBlocked(deps, recheck) {
+	const statePath = pluginStatePath(deps.env);
+	if (!statePath) return false;
+	const state = await readUpdateState(statePath, deps.client.version);
+	if (state?.status !== "unsupported") return false;
+	const ingestBase = recheck ? await statusCheckBase(deps) : void 0;
+	return (ingestBase ? await recheckClientStatus({
+		state,
+		ingestBase,
+		fetch: deps.fetch,
+		statePath,
+		version: deps.client.version,
+		now: deps.now
+	}) : state)?.status === "unsupported";
+}
+async function withUpdateLine(notice, input, deps) {
+	if (notice && notice.kind !== "sending") return notice.message;
+	const statePath = pluginStatePath(deps.env);
+	const state = statePath ? await readUpdateState(statePath, deps.client.version) : void 0;
+	if (state?.status === "unsupported") return updateLine("claude-code-plugin", state);
+	if (notice || !state || !statePath) return notice?.message;
+	return noticeLine("claude-code-plugin", statePath, state, {
+		now: deps.now(),
+		env: deps.env,
+		isSuppressed: () => deps.isPluginAutoUpdateEffective(input.cwd)
+	});
 }
 async function onSessionStart(input, deps) {
 	const usage = usageStoreOf(input.sessionId, deps.env);
 	const startedAt = deps.now();
 	if (usage) await removeExpiredFiles(usage, startedAt).catch(logError(deps));
-	const message = await sendSessionStart(input, usage, deps).catch((error) => {
+	const registers = input.source === void 0 || REGISTERING_SOURCES.has(input.source);
+	const sent = await isPluginBlocked(deps, true).catch(() => false) ? void 0 : await sendSessionStart(input, usage, deps).catch((error) => {
 		logError(deps)(error);
 	});
+	const message = registers ? await withUpdateLine(sent, input, deps).catch(() => sent?.message) : sent?.message;
 	if (usage) await appendIfRecording(usage, {
 		at: startedAt.toISOString(),
 		kind: "start",
@@ -1368,6 +1719,7 @@ async function onUserPromptSubmit(input, deps) {
 	}).catch(logError(deps));
 	const pad = input.scratchpad;
 	if (!input.promptId || !pad || await isMarkedUnauthorized(pad)) return;
+	if (await isPluginBlocked(deps, false)) return;
 	const saved = await loadRegistration(pad);
 	if (!saved || await isFirstPromptSent(pad)) return;
 	const { destination } = await resolveDestination(deps, input.cwd);
@@ -1382,6 +1734,7 @@ async function onSessionEnd(input, deps) {
 	const usage = usageStoreOf(input.sessionId, deps.env);
 	if (!usage) return;
 	if (input.scratchpad && await isMarkedUnauthorized(input.scratchpad)) return;
+	if (await isPluginBlocked(deps, false)) return;
 	const { destination } = await resolveDestination(deps, input.cwd, false);
 	if (!destination) return;
 	const outcome = await sendSessionUsage(usage, destination, deps.processStartMs + SESSION_END_BUDGET_MS, deps);
@@ -1403,10 +1756,15 @@ const HANDLERS = new Map([
 	["session-end", onSessionEnd],
 	...COUNTING_EVENTS.map((event) => [event, onCountingEvent(event)])
 ]);
-async function runHook(event, rawInput, deps) {
+async function runHook(event, rawInput, hookDeps) {
 	const handler = HANDLERS.get(event);
 	const input = parseHookInput(rawInput);
 	if (!handler || !input) return;
+	const deps = {
+		...hookDeps,
+		baseFetch: hookDeps.fetch,
+		fetch: recordingFetch(hookDeps.fetch, hookDeps.client, pluginStatePath(hookDeps.env), hookDeps.now)
+	};
 	await handler(input, deps).catch(logError(deps));
 }
 //#endregion
@@ -1414,6 +1772,11 @@ async function runHook(event, rawInput, deps) {
 const HF_TIMEOUT_MS = 1e3;
 const HF_OUTPUT_LIMIT_BYTES = 65536;
 const BEARER = /^Bearer (\S+)$/;
+const FAILURES = {
+	3: { kind: "absent" },
+	4: { kind: "withheld" },
+	5: { kind: "cliUnsupported" }
+};
 function parseKey(stdout) {
 	try {
 		const value = JSON.parse(stdout);
@@ -1438,13 +1801,17 @@ function createUserKeyReader({ platform, env, exec, processCwd, fs }) {
 		const result = await exec(command.file, command.args, {
 			timeoutMs: HF_TIMEOUT_MS,
 			windowsVerbatimArguments: command.verbatim,
-			env
+			env: {
+				...env,
+				HARNESSFORCE_NO_MIGRATE: "1"
+			}
 		});
 		const key = result.ok ? parseKey(result.stdout) : void 0;
-		return key ? {
+		if (key) return {
 			kind: "found",
 			key
-		} : { kind: "failed" };
+		};
+		return result.exitCode !== void 0 && FAILURES[result.exitCode] || { kind: "unreadable" };
 	};
 }
 const execHf = (file, args, options) => new Promise((resolve) => {
@@ -1458,7 +1825,8 @@ const execHf = (file, args, options) => new Promise((resolve) => {
 		windowsVerbatimArguments: options.windowsVerbatimArguments
 	}, (error, stdout) => resolve({
 		ok: !error,
-		stdout
+		stdout,
+		...error && !error.killed && typeof error.code === "number" ? { exitCode: error.code } : {}
 	}));
 });
 //#endregion
@@ -1483,6 +1851,8 @@ async function main() {
 	}
 	if (relaunch.kind !== "not-needed") return;
 	const raw = await readStdin().catch(() => "");
+	const managedDir = managedDirFor(process.platform);
+	const userSettingsPath = (0, node_path.join)(absoluteEnv(process.env.CLAUDE_CONFIG_DIR) ?? (0, node_path.join)((0, node_os.homedir)(), ".claude"), "settings.json");
 	await runHook(process.argv[2] ?? "", raw, {
 		env: process.env,
 		now: () => /* @__PURE__ */ new Date(),
@@ -1497,12 +1867,27 @@ async function main() {
 		stdout: (text) => process.stdout.write(text),
 		stderr: (text) => process.stderr.write(text),
 		homeDir: (0, node_os.homedir)(),
-		managedDir: managedDirFor(process.platform),
+		managedDir,
 		readUserKey: createUserKeyReader({
 			platform: process.platform,
 			env: process.env,
 			exec: execHf,
 			processCwd: process.cwd()
+		}),
+		isTelemetryConfigured: () => isTelemetryConfigured({
+			userSettingsPath,
+			managedDir
+		}),
+		client: {
+			component: "claude-code-plugin",
+			version: "0.2.0",
+			dev: false
+		},
+		isPluginAutoUpdateEffective: (cwd) => isPluginAutoUpdateEffective({
+			userSettingsPath,
+			managedDir,
+			projectDir: absoluteEnv(process.env.CLAUDE_PROJECT_DIR) ?? cwd,
+			env: process.env
 		})
 	});
 }