@intentic/claude-plugin 1.317.0

package/dist/post-bash.mjs

@@ -0,0 +1,927 @@
+import { createRequire as __intenticRequire } from 'node:module'; const require = __intenticRequire(import.meta.url);
+
+// src/post-bash.ts
+import { join as join4 } from "node:path";
+
+// ../output-cleaners/src/cleaners.mjs
+import { createHash } from "node:crypto";
+import { closeSync, fstatSync, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+var ANSI = /\x1b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-Z\\-_])/g;
+var collapseCr = (line) => {
+  const frames = line.split("\r");
+  for (let i = frames.length - 1; i >= 0; i--) {
+    if (frames[i] !== "") {
+      return frames[i];
+    }
+  }
+  return "";
+};
+var strip = (id, match, patterns) => ({
+  id,
+  match,
+  apply: (lines) => lines.filter((line) => !patterns.some((re) => re.test(line)))
+});
+var invocation = (word) => new RegExp(String.raw`(?<![\w.\-/])(?:${word})(?![\w.-])`);
+var bodyBytes = (lines) => lines.length === 0 ? 0 : lines.reduce((sum, line) => sum + line.length, 0) + lines.length - 1;
+var humanSize = (bytes) => bytes >= 1048576 ? `${(bytes / 1048576).toFixed(1)}M` : bytes >= 1024 ? `${(bytes / 1024).toFixed(1)}K` : `${bytes}B`;
+var EXECUTABLE = /* @__PURE__ */ new Set(["x", "s", "t"]);
+var permsToOctal = (perms) => {
+  const triad = (read, write, exec) => (perms[read] === "r" ? 4 : 0) + (perms[write] === "w" ? 2 : 0) + (EXECUTABLE.has(perms[exec]) ? 1 : 0);
+  const special = ("sS".includes(perms[3]) ? 4 : 0) + ("sS".includes(perms[6]) ? 2 : 0) + ("tT".includes(perms[9]) ? 1 : 0);
+  const mode = `${triad(1, 2, 3)}${triad(4, 5, 6)}${triad(7, 8, 9)}`;
+  return special > 0 ? `${special}${mode}` : mode;
+};
+var LS_DATE = /\s(?:(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d{1,2}\s+(?:\d{4}|\d{1,2}:\d{2})|\d{4}-\d{2}-\d{2}\s+\d{1,2}:\d{2})\s/;
+var LS_MODE = /^[-dlbcps][rwxSsTt-]{9}[.+@]?$/;
+var parseListingLine = (line) => {
+  const date = LS_DATE.exec(line);
+  if (date === null) {
+    return void 0;
+  }
+  const head = line.slice(0, date.index).split(/\s+/).filter((token) => token !== "");
+  if (head.length < 4 || !LS_MODE.test(head[0])) {
+    return void 0;
+  }
+  const size = head.reduceRight((found, token) => found === void 0 && /^\d+$/.test(token) ? Number(token) : found, void 0);
+  return { mode: permsToOctal(head[0]), directory: head[0].startsWith("d"), size, name: line.slice(date.index + date[0].length) };
+};
+var compactListing = (lines) => {
+  let parsed = 0;
+  const out = lines.flatMap((line) => {
+    if (/^total \d+$/.test(line)) {
+      return [];
+    }
+    const entry = parseListingLine(line);
+    if (entry === void 0) {
+      return [line];
+    }
+    parsed++;
+    if (entry.name === "." || entry.name === "..") {
+      return [];
+    }
+    if (entry.directory) {
+      return [`${entry.mode} ${entry.name}/`];
+    }
+    return [`${entry.mode} ${entry.name}${entry.size === void 0 ? "" : `  ${humanSize(entry.size)}`}`];
+  });
+  return parsed === 0 ? lines : out;
+};
+var PATH_RUN_MIN = 10;
+var PATH_RUN_DIRS = 60;
+var PATH_RUN_NAMES = 40;
+var isPathLine = (line) => line !== "" && !/\s/.test(line) && !/:\d/.test(line) && line.length < 300;
+var sharedRoot = (directories) => {
+  if (directories.length < 2) {
+    return "";
+  }
+  let prefix = directories[0];
+  for (const directory of directories) {
+    while (prefix !== "" && !directory.startsWith(prefix)) {
+      const shorter = prefix.slice(0, prefix.lastIndexOf("/", prefix.length - 2) + 1);
+      prefix = shorter === prefix ? "" : shorter;
+    }
+  }
+  return prefix;
+};
+var foldPaths = (run) => {
+  if (run.filter((line) => line.includes("/")).length * 5 < run.length * 3) {
+    return run;
+  }
+  const byDirectory = /* @__PURE__ */ new Map();
+  for (const path of run) {
+    const cut = path.lastIndexOf("/");
+    const directory = cut === -1 ? "./" : path.slice(0, cut + 1);
+    const names = byDirectory.get(directory);
+    if (names === void 0) {
+      byDirectory.set(directory, [path.slice(cut + 1)]);
+    } else {
+      names.push(path.slice(cut + 1));
+    }
+  }
+  const root = sharedRoot([...byDirectory.keys()]);
+  const trim = root.length > 8 ? root.length : 0;
+  const folded = [`${run.length} paths in ${byDirectory.size} directories${trim === 0 ? "" : ` under ${root}`}:`];
+  let shown = 0;
+  for (const [directory, names] of [...byDirectory].slice(0, PATH_RUN_DIRS)) {
+    const kept = names.slice(0, PATH_RUN_NAMES);
+    shown += kept.length;
+    folded.push(`${directory.slice(trim) === "" ? "./" : directory.slice(trim)} ${kept.join(" ")}`);
+  }
+  if (shown < run.length) {
+    folded.push(`\u2026 ${run.length - shown} more paths elided`);
+  }
+  return bodyBytes(folded) < bodyBytes(run) ? folded : run;
+};
+var foldPathRuns = (lines) => {
+  const out = [];
+  for (let i = 0; i < lines.length; ) {
+    let j = i;
+    while (j < lines.length && isPathLine(lines[j])) {
+      j++;
+    }
+    if (j === i) {
+      out.push(lines[i]);
+      i++;
+      continue;
+    }
+    out.push(...j - i >= PATH_RUN_MIN ? foldPaths(lines.slice(i, j)) : lines.slice(i, j));
+    i = j;
+  }
+  return out;
+};
+var HIT_LINE = /^([^\s:][^:]{0,240}):(\d+):(?:(\d+):)?(.*)$/;
+var HIT_RUN_MIN = 6;
+var isHitKey = (key) => key.includes("/") || key.includes(".");
+var parseHit = (line) => {
+  const match = HIT_LINE.exec(line);
+  return match !== null && isHitKey(match[1]) ? match : void 0;
+};
+var foldHitRun = (run) => {
+  const folded = [];
+  for (let start = 0; start < run.length; ) {
+    const file = parseHit(run[start])[1];
+    folded.push(run[start]);
+    let next = start + 1;
+    while (next < run.length && parseHit(run[next])[1] === file) {
+      const hit = parseHit(run[next]);
+      folded.push(`  ${hit[2]}${hit[3] === void 0 ? "" : `:${hit[3]}`}:${hit[4]}`);
+      next++;
+    }
+    start = next;
+  }
+  return bodyBytes(folded) < bodyBytes(run) ? folded : run;
+};
+var foldHitRuns = (lines) => {
+  const out = [];
+  for (let i = 0; i < lines.length; ) {
+    let end = i;
+    while (end < lines.length && parseHit(lines[end]) !== void 0) {
+      end++;
+    }
+    const stop = Math.max(end, i + 1);
+    out.push(...end - i >= HIT_RUN_MIN ? foldHitRun(lines.slice(i, end)) : lines.slice(i, stop));
+    i = stop;
+  }
+  return out;
+};
+var GENERATED_PATH = /(?:^|\/)(?:[^/]*\.lock(?:\.json)?|[^/]*-lock\.json|pnpm-lock\.yaml|go\.sum|[^/]*\.min\.(?:js|css|mjs)|[^/]*\.map)$/;
+var DIFF_HEADER = /^diff --git a\/(\S+) b\/(\S+)$/;
+var isAdded = (line) => line.startsWith("+") && !line.startsWith("+++");
+var isRemoved = (line) => line.startsWith("-") && !line.startsWith("---");
+var foldGeneratedDiffs = (lines) => {
+  const out = [];
+  let folding = false;
+  let added = 0;
+  let removed = 0;
+  let dropped = 0;
+  const flush = () => {
+    if (folding && dropped > 0) {
+      out.push(`\u2026 ${dropped} lines of generated-file diff elided (+${added} \u2212${removed}) \u2026`);
+    }
+    folding = false;
+    added = 0;
+    removed = 0;
+    dropped = 0;
+  };
+  for (const line of lines) {
+    const header = DIFF_HEADER.exec(line);
+    if (header !== null) {
+      flush();
+      folding = GENERATED_PATH.test(header[2]);
+      out.push(line);
+      continue;
+    }
+    if (!folding) {
+      out.push(line);
+      continue;
+    }
+    dropped++;
+    added += isAdded(line) ? 1 : 0;
+    removed += isRemoved(line) ? 1 : 0;
+  }
+  flush();
+  return bodyBytes(out) < bodyBytes(lines) ? out : lines;
+};
+var COMMAND_CLEANERS = [
+  strip("pnpm", invocation(String.raw`pnpm`), [
+    /^\s*Progress: /,
+    /^Packages: [+-]/,
+    /^Downloading /,
+    /^\s*[.+]+\s*$/,
+    /^Virtual store is at/,
+    /^Lockfile is up to date/
+  ]),
+  // `apt-get` before `apt`: ordered alternation, or the guard rejects the longer spelling at its hyphen.
+  strip("apt", invocation(String.raw`apt-get|apt`), [
+    /^(?:Get:|Hit:|Ign:|Fetched |Selecting |Preparing to unpack|Unpacking |Setting up |Processing triggers)/
+  ]),
+  // Test runners: on a passing run (exit 0) per-test PASS lines are noise, dropped, keeping the summary. Failures skip
+  // all command cleaners, so failing tests survive verbatim.
+  strip("test", invocation(String.raw`bun\s+test|suites|vitest|jest|pytest|rspec|mocha|phpunit|go\s+test|cargo\s+test`), [
+    /^\s*[✓√]\s/,
+    // per-test pass (vitest/jest/mocha)
+    /^\(pass\)\s/,
+    // bun test per-test pass
+    /^--- PASS:/,
+    // go test per-test
+    /^\s*test .+\.\.\. ok$/,
+    // cargo test per-test
+    /^PASS\s+\S/,
+    // jest per-file PASS header
+    /^\s*[.·]+\s*$/
+    // pytest/mocha dot progress
+  ]),
+  // `diff` reads the whole output's structure, the three after it read runs of lines; folding the generated hunks away
+  // first keeps those three from ever looking inside one.
+  { id: "diff", apply: foldGeneratedDiffs },
+  { id: "ls", apply: compactListing },
+  { id: "files", apply: foldPathRuns },
+  { id: "hits", apply: foldHitRuns }
+];
+var CLEANERS = [...COMMAND_CLEANERS.map((cleaner) => cleaner.id), "dedup", "wide", "cap", "redact", "cache"];
+var dedupeRuns = (lines) => {
+  const out = [];
+  for (let i = 0; i < lines.length; ) {
+    let j = i + 1;
+    while (j < lines.length && lines[j] === lines[i]) {
+      j++;
+    }
+    const run = j - i;
+    out.push(lines[i]);
+    if (run >= 3) {
+      out.push(`  \u2026 (${run - 1} more identical lines)`);
+    } else {
+      for (let k = 1; k < run; k++) {
+        out.push(lines[i]);
+      }
+    }
+    i = j;
+  }
+  return out;
+};
+var WIDE_RUN = 400;
+var WIDE_HEAD = 240;
+var WIDE_TAIL = 80;
+var elideRun = (run) => `${run.slice(0, WIDE_HEAD)}\u2026 ${run.length - WIDE_HEAD - WIDE_TAIL} chars elided \u2026${run.slice(-WIDE_TAIL)}`;
+var WIDE_PATTERN = new RegExp(String.raw`\S{${WIDE_RUN + 1},}`, "g");
+var elideWideRuns = (lines) => lines.map((line) => line.length > WIDE_RUN ? line.replaceAll(WIDE_PATTERN, elideRun) : line);
+var SECRET_NAME = String.raw`[A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY)[A-Za-z0-9_]*`;
+var ASSIGN = String.raw`["']?\s*[:=](?![=>])\s*`;
+var QUOTED_VALUE = String.raw`(["'\x60])([^"'\x60\n]{6,})\2`;
+var BARE_VALUE = String.raw`[\w+/=~-]{6,}(?![\w+/=~(-])`;
+var ISSUER_PREFIX = /^(?:sk-|pk-|rk-|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|xox[abposr]-|AKIA|ASIA|eyJ|AIza|ya29\.|glpat-|dop_v1_|shpat_|SG\.|npm_)/;
+var NUMERIC_VALUE = /^[\d_,.]+$/;
+var STRUCTURAL_VALUE = /[\s/\\${}]/;
+var ENV_NAME_VALUE = /^[A-Z0-9_]+$/;
+var ENTROPIC_VALUE = /^(?=[^\n]*\d)(?=[^\n]*[A-Za-z])/;
+var HANDWRITTEN_MAX = 12;
+var looksLikeCredential = (value) => ISSUER_PREFIX.test(value) || value.length > HANDWRITTEN_MAX && ENTROPIC_VALUE.test(value) && !NUMERIC_VALUE.test(value) && !STRUCTURAL_VALUE.test(value) && !ENV_NAME_VALUE.test(value);
+var SECRET_PATTERNS = [
+  [
+    new RegExp(`\\b(${SECRET_NAME}${ASSIGN})(?:${QUOTED_VALUE}|(${BARE_VALUE}))`, "gi"),
+    // Quoted and bare arrive in different groups because only the quoted one has a quote to put back.
+    (match, assignment, quote, quoted, bare) => looksLikeCredential(quoted ?? bare) ? `${assignment}${quote ?? ""}***${quote ?? ""}` : match
+  ],
+  [/\bAKIA[0-9A-Z]{16}\b/g, "***"],
+  // Same rule for a bearer value: prose about tokens carries no digit, every real bearer token does.
+  [/\b(Bearer\s+)(?=[\w.-]*\d)[\w.-]{8,}/gi, "$1***"],
+  [/\b(https?:\/\/[^:@\s/]+:)[^@\s]+@/gi, "$1***@"]
+];
+var SECRET_VALUE_MIN = 12;
+var secretValueCache = /* @__PURE__ */ new Map();
+var readIfChanged = (path, name) => {
+  try {
+    const descriptor = openSync(path, "r");
+    try {
+      const { mtimeMs, size } = fstatSync(descriptor);
+      const stamp = `${mtimeMs}:${size}`;
+      const cached = secretValueCache.get(path);
+      if (cached?.stamp === stamp) {
+        return cached.values;
+      }
+      const values = harvest(readFileSync(descriptor, "utf8"), path, name);
+      secretValueCache.set(path, { stamp, values });
+      return values;
+    } finally {
+      closeSync(descriptor);
+    }
+  } catch {
+    return [];
+  }
+};
+var surfaceForms = (value) => {
+  const forms = [value];
+  const jsonEscaped = JSON.stringify(value).slice(1, -1);
+  if (jsonEscaped !== value) {
+    forms.push(jsonEscaped);
+  }
+  try {
+    const encoded = encodeURIComponent(value);
+    if (encoded !== value) {
+      forms.push(encoded);
+    }
+  } catch {
+  }
+  return forms;
+};
+var harvest = (text, path, name) => {
+  const named = [];
+  if (path.endsWith("capability-secrets.json")) {
+    for (const [id, entry] of Object.entries(JSON.parse(text))) {
+      if (entry === null || typeof entry !== "object") {
+        continue;
+      }
+      for (const [field, value] of Object.entries(entry)) {
+        if (typeof value === "string") {
+          named.push([name(id, field), value]);
+        }
+      }
+    }
+  } else if (path.endsWith(".json")) {
+    for (const [key, value] of Object.entries(JSON.parse(text))) {
+      if (typeof value === "string") {
+        named.push([name(key), value]);
+      }
+    }
+  } else {
+    for (const line of text.split("\n")) {
+      const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+      if (match !== null) {
+        named.push([name(match[1]), (match[2] ?? "").trim().replace(/^(["'])([\s\S]*)\1$/, "$2")]);
+      }
+    }
+  }
+  const byTarget = /* @__PURE__ */ new Map();
+  const add = (target, replacement) => {
+    const trimmed = target.trim();
+    if (trimmed.length >= SECRET_VALUE_MIN && !byTarget.has(trimmed)) {
+      byTarget.set(trimmed, { target: trimmed, replacement });
+    }
+  };
+  for (const [reference, value] of named) {
+    for (const form of surfaceForms(value.trim())) {
+      add(form, `{{secret:${reference}}}`);
+    }
+    if (value.includes("\n")) {
+      for (const line of value.split("\n")) {
+        add(line, "***");
+      }
+    }
+  }
+  return [...byTarget.values()].toSorted((a, b) => b.target.length - a.target.length);
+};
+var secretValues = (env = process.env) => {
+  const authRoot = env.AGENT_AUTH_DIR !== void 0 && env.AGENT_AUTH_DIR !== "" ? env.AGENT_AUTH_DIR : join(env.WORKSPACE_ROOT ?? "/work", ".intentic/secrets/auth");
+  const repo = join(env.WORKSPACE_ROOT ?? "/work", "desired-state");
+  return [
+    ...readIfChanged(join(authRoot, "capability-secrets.json"), (id, field) => `${id}/${field}`),
+    ...readIfChanged(join(repo, ".env"), (key) => key),
+    ...readIfChanged(join(repo, ".secrets.json"), (key) => key)
+  ].toSorted((a, b) => b.target.length - a.target.length);
+};
+var redactText = (text, values = []) => text.split("\n").map((line) => redactLine(line, values)).join("\n");
+var redactLine = (line, values = []) => {
+  let masked = line;
+  for (const { target, replacement } of values) {
+    if (masked.includes(target)) {
+      masked = masked.split(target).join(replacement);
+    }
+  }
+  return SECRET_PATTERNS.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), masked);
+};
+var parseCleaners = (spec) => {
+  if (spec === void 0 || spec.trim() === "") {
+    return new Set(CLEANERS);
+  }
+  const tokens = spec.split(",").map((token) => token.trim()).filter((token) => token !== "" && CLEANERS.includes(token.replace(/^-/, "")));
+  if (tokens.length === 0) {
+    return new Set(CLEANERS);
+  }
+  const allowList = tokens.some((token) => !token.startsWith("-"));
+  if (allowList) {
+    return new Set(tokens.filter((token) => !token.startsWith("-")));
+  }
+  const disabled = new Set(tokens.map((token) => token.slice(1)));
+  return new Set(CLEANERS.filter((cleaner) => !disabled.has(cleaner)));
+};
+var HEAD = 30;
+var TAIL = 50;
+var MAX = 100;
+var FAIL_TAIL = 500;
+var LOG_MAX_BYTES = 16e3;
+var READ_MAX_BYTES = 96e3;
+var BYTE_HEAD_SHARE = 0.375;
+var READ_MAX = 2e3;
+var GIT_OPTIONS = String.raw`(?:(?:-[Cc]|--(?:git-dir|work-tree|namespace|exec-path|super-prefix))\s+\S+\s+|-\S+\s+)*`;
+var READ_COMMAND = new RegExp(
+  String.raw`(?<![\w.-])(?:cat|bat|sed\s+-n|awk|git\s+${GIT_OPTIONS}(?:diff|show)\b|git\s+${GIT_OPTIONS}log\s+(?:[^;&|]*\s)?-p)\b`
+);
+var takeWithinBudget = (source, budget) => {
+  const kept = [];
+  let spent = 0;
+  for (const line of source) {
+    spent += line.length + 1;
+    if (spent > budget) {
+      break;
+    }
+    kept.push(line);
+  }
+  return kept;
+};
+var byteBudget = (command) => READ_COMMAND.test(command) ? READ_MAX_BYTES : LOG_MAX_BYTES;
+var capOutput = (lines, command) => {
+  const isRead = READ_COMMAND.test(command);
+  const maxLines = isRead ? READ_MAX : MAX;
+  const maxBytes = byteBudget(command);
+  if (lines.length > maxLines) {
+    return isRead ? [...lines.slice(0, maxLines), `\u2026 ${lines.length - maxLines} more lines elided: narrow the range or use the Read tool \u2026`] : [...lines.slice(0, HEAD), `\u2026 ${lines.length - HEAD - TAIL} lines elided \u2026`, ...lines.slice(-TAIL)];
+  }
+  if (bodyBytes(lines) <= maxBytes) {
+    return lines;
+  }
+  if (isRead) {
+    const head2 = takeWithinBudget(lines, maxBytes);
+    return [...head2, `\u2026 ${lines.length - head2.length} more lines elided (${bodyBytes(lines)} bytes): narrow the range or use the Read tool \u2026`];
+  }
+  const head = takeWithinBudget(lines, Math.round(maxBytes * BYTE_HEAD_SHARE));
+  const tail = takeWithinBudget(lines.toReversed(), maxBytes - bodyBytes(head)).toReversed();
+  if (head.length === 0 && tail.length === 0) {
+    return [`${lines[0].slice(0, maxBytes)}\u2026 line truncated at ${maxBytes} bytes \u2026`];
+  }
+  return [...head, `\u2026 ${lines.length - head.length - tail.length} lines elided (${bodyBytes(lines)} bytes) \u2026`, ...tail];
+};
+var cleanSucceeded = (lines, command, enabled, ran) => {
+  let out = lines;
+  for (const cleaner of COMMAND_CLEANERS) {
+    if (enabled.has(cleaner.id) && (cleaner.match === void 0 || cleaner.match.test(command))) {
+      out = ran(cleaner.id, cleaner.apply(out));
+    }
+  }
+  if (enabled.has("dedup")) {
+    out = ran("dedup", dedupeRuns(out));
+  }
+  if (enabled.has("wide") && bodyBytes(out) > byteBudget(command)) {
+    out = ran("wide", elideWideRuns(out));
+  }
+  if (enabled.has("cap")) {
+    const capped = capOutput(out, command);
+    if (capped !== out) {
+      out = ran("cap", capped);
+    }
+  }
+  return out;
+};
+var cleanFailed = (lines, enabled, ran) => {
+  const out = enabled.has("dedup") ? ran("dedup", dedupeRuns(lines)) : lines;
+  return out.length > FAIL_TAIL ? (
+    // Own id, never `cap`: this fires regardless of the spec, so `cap`'s toggle shouldn't get credit for it.
+    ran("failtail", [`\u2026 ${out.length - FAIL_TAIL} earlier lines elided \u2026`, ...out.slice(-FAIL_TAIL)])
+  ) : out;
+};
+var cleanLines = (lines, { command, exitCode, enabled, values = [] }) => {
+  const stages = [];
+  let bytes = bodyBytes(lines);
+  const ran = (id, next) => {
+    const after = bodyBytes(next);
+    stages.push({ id, saved: bytes - after });
+    bytes = after;
+    return next;
+  };
+  let out = exitCode === "0" ? cleanSucceeded(lines, command, enabled, ran) : cleanFailed(lines, enabled, ran);
+  if (enabled.has("redact")) {
+    out = ran(
+      "redact",
+      out.map((line) => redactLine(line, values))
+    );
+  }
+  return { lines: out, stages };
+};
+var matchedCleaners = (command, enabled) => COMMAND_CLEANERS.filter((cleaner) => cleaner.match !== void 0 && enabled.has(cleaner.id) && cleaner.match.test(command)).map(
+  (cleaner) => cleaner.id
+);
+var CACHE_MARKER = "(output identical to ";
+var CACHE_MIN_BYTES = 512;
+var CACHE_COMMAND_MAX = 120;
+var hashText = (text) => createHash("sha1").update(text).digest("hex");
+var sessionKeyFromLog = (logPath) => {
+  if (logPath === void 0 || logPath === "") {
+    return void 0;
+  }
+  const base = logPath.split("/").pop() ?? "";
+  const match = base.match(/^(.*)-[^-]+\.log$/);
+  return match !== null && match[1] !== "" ? match[1] : void 0;
+};
+var openCacheStore = (logsDir, sessionKey) => {
+  const file = join(logsDir, "output-cache", `${sessionKey}.json`);
+  let map;
+  try {
+    map = new Map(Object.entries(JSON.parse(readFileSync(file, "utf8"))));
+  } catch {
+    map = /* @__PURE__ */ new Map();
+  }
+  return {
+    lookup: (key) => map.get(key),
+    record: (key, value) => {
+      map.set(key, value);
+      try {
+        mkdirSync(dirname(file), { recursive: true });
+        writeFileSync(file, JSON.stringify(Object.fromEntries(map)));
+      } catch {
+      }
+    }
+  };
+};
+var collapseCached = (body, command, store, retain = () => void 0) => {
+  if (body.length < CACHE_MIN_BYTES) {
+    return { body, cached: false };
+  }
+  const commandHash = `c:${hashText(command)}`;
+  const bodyKey = `b:${hashText(body)}`;
+  const bodyHash = hashText(body);
+  const handle = () => {
+    const path = retain();
+    return path === void 0 ? "" : ` \xB7 retrieve-output ${path}`;
+  };
+  if (store.lookup(commandHash) === bodyHash) {
+    return { body: `${CACHE_MARKER}a previous run this session${handle()})`, cached: true };
+  }
+  const earlier = store.lookup(bodyKey);
+  if (earlier !== void 0 && earlier !== command) {
+    const named = earlier.length > CACHE_COMMAND_MAX ? `${earlier.slice(0, CACHE_COMMAND_MAX)}\u2026` : earlier;
+    return { body: `${CACHE_MARKER}the output of \`${named}\` earlier this session${handle()})`, cached: true };
+  }
+  store.record(commandHash, bodyHash);
+  if (earlier === void 0) {
+    store.record(bodyKey, command);
+  }
+  return { body, cached: false };
+};
+
+// ../output-cleaners/src/agent-output-filter.mjs
+import { appendFileSync, mkdirSync as mkdirSync2, readdirSync, rmSync, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename, join as join2 } from "node:path";
+var RETRIEVAL_MIN_DROPPED = 20;
+var SIGPIPE_STATUS = "141";
+var maskedFailure = (exitCode, pipeline) => {
+  const statuses = pipeline.trim() === "" ? [] : pipeline.trim().split(/\s+/);
+  if (exitCode !== "0" || statuses.length < 2 || !statuses.every((status) => /^\d+$/.test(status))) {
+    return void 0;
+  }
+  return statuses.slice(0, -1).some((status) => status !== "0" && status !== SIGPIPE_STATUS) ? statuses.join(" ") : void 0;
+};
+var RG_REPLACE_CLUSTER = /(?<![\w.\-/])rg\s(?:[^;&|\n]*?\s)?(-[a-zA-Z]*r[a-zA-Z]*)(?=[\s;&|]|$)/;
+var commandNotes = (command, raw) => {
+  const cluster = RG_REPLACE_CLUSTER.exec(command)?.[1];
+  return cluster !== void 0 && cluster.length > 2 && raw.trim() !== "" ? [`--- note: \`${cluster}\` is not recursive in rg: -r is --replace, so matched text above was rewritten (rg recurses by default)`] : [];
+};
+var filterOutput = (raw, { command = "", exitCode = "0", durationS = "0", retain, enabled = new Set(CLEANERS), cacheStore, values = [], pipeline = "" }) => {
+  const input = raw.replaceAll(ANSI, "").split("\n").map(collapseCr);
+  if (input.at(-1) === "") {
+    input.pop();
+  }
+  const keep = () => retain?.(input.join("\n"));
+  const rawCount = input.length;
+  const stages = [{ id: "ansi", saved: raw.length - bodyBytes(input) }];
+  const cleaned = cleanLines(input, { command, exitCode, enabled, values });
+  const lines = cleaned.lines;
+  stages.push(...cleaned.stages);
+  let body = lines.join("\n");
+  if (exitCode === "0" && body.trim() === "" && raw.trim() !== "") {
+    body = "(no notable output)";
+  }
+  const masked = maskedFailure(exitCode, pipeline);
+  const exit = masked === void 0 ? `exit ${exitCode}` : `exit ${exitCode} (pipeline: ${masked} \u2014 an earlier stage failed)`;
+  const emitted = (text, id, footed) => {
+    stages.push({ id, saved: bodyBytes(lines) - text.length });
+    let out = text;
+    if (text.length > raw.length) {
+      stages.push({ id: "guard", saved: text.length - raw.length });
+      out = raw;
+    }
+    const extra = [...masked === void 0 || footed && out === text ? [] : [`--- [${exit}, ${durationS}s]`], ...commandNotes(command, raw)];
+    if (extra.length === 0) {
+      return { out, stages };
+    }
+    const noted = `${out === "" || out.endsWith("\n") ? out : `${out}
+`}${extra.join("\n")}
+`;
+    stages.push({ id: "notes", saved: out.length - noted.length });
+    return { out: noted, stages };
+  };
+  if (exitCode === "0" && enabled.has("cache") && cacheStore !== void 0 && body !== "" && body !== "(no notable output)") {
+    const collapsed = collapseCached(body, command, cacheStore, keep);
+    if (collapsed.cached) {
+      return emitted(`${collapsed.body}
+`, "cache", false);
+    }
+  }
+  const kept = body === "(no notable output)" ? 0 : lines.length;
+  const dropped = Math.max(0, rawCount - kept);
+  const cut = stages.find((stage) => stage.id === "wide")?.saved ?? 0;
+  if (dropped === 0 && cut <= 0) {
+    return emitted(body === "" ? body : `${body}
+`, "footer", false);
+  }
+  const retained = dropped >= RETRIEVAL_MIN_DROPPED || cut > 0 ? keep() : void 0;
+  const handle = retained === void 0 ? "" : ` \xB7 full: retrieve-output ${retained} [pattern]`;
+  const summary = dropped > 0 ? `${rawCount} lines filtered to ${kept}` : "long runs cut inside lines";
+  const withFooter = `${body}
+--- [${exit}, ${durationS}s] ${summary}${handle}
+`;
+  return withFooter.length <= raw.length ? emitted(withFooter, "footer", true) : emitted(`${body}
+`, "footer", false);
+};
+var RETAIN_FILES = 30;
+var RETAIN_MAX_CHARS = 2e6;
+var retainIn = (dir, name, values) => (text) => {
+  try {
+    mkdirSync2(dir, { recursive: true });
+    const file = join2(dir, name);
+    writeFileSync2(file, redactText(text.length > RETAIN_MAX_CHARS ? text.slice(-RETAIN_MAX_CHARS) : text, values));
+    const aged = readdirSync(dir).flatMap((entry) => {
+      try {
+        return [{ entry, at: statSync(join2(dir, entry)).mtimeMs }];
+      } catch {
+        return [];
+      }
+    });
+    for (const { entry } of aged.toSorted((a, b) => b.at - a.at).slice(RETAIN_FILES)) {
+      rmSync(join2(dir, entry), { force: true });
+    }
+    return file;
+  } catch {
+    return void 0;
+  }
+};
+var filterRun = (raw, {
+  command = "",
+  exitCode = "0",
+  durationS = "0",
+  pipeline = "",
+  enabled = new Set(CLEANERS),
+  holdout = 0,
+  logsDir,
+  runName,
+  sessionKey,
+  values = [],
+  tags = {},
+  random = Math.random,
+  now = Date.now
+} = {}) => {
+  let out = raw;
+  let stages = [];
+  let heldOut = false;
+  try {
+    heldOut = holdout > 0 && random() < holdout;
+    const cacheStore = !heldOut && enabled.has("cache") && logsDir !== void 0 && sessionKey !== void 0 ? openCacheStore(logsDir, sessionKey) : void 0;
+    if (!heldOut) {
+      const retain = logsDir !== void 0 && runName !== void 0 && runName !== "" ? retainIn(join2(logsDir, "raw-output"), runName, values) : void 0;
+      const filtered = filterOutput(raw, { command, exitCode, durationS, retain, enabled, cacheStore, values, pipeline });
+      out = filtered.out;
+      stages = filtered.stages;
+    }
+  } catch {
+    out = raw;
+    stages = [];
+  }
+  if (logsDir !== void 0) {
+    try {
+      const matched = matchedCleaners(command, enabled);
+      const stat = {
+        ...tags,
+        ts: now(),
+        command: command.slice(0, 200),
+        exit: exitCode,
+        durationS: Number(durationS),
+        rawBytes: raw.length,
+        emittedBytes: out.length,
+        cleaners: [...enabled],
+        matched: out.startsWith(CACHE_MARKER) ? [...matched, "cache"] : matched,
+        heldOut,
+        stageBytes: Object.fromEntries(stages.map((stage) => [stage.id, stage.saved]))
+      };
+      mkdirSync2(logsDir, { recursive: true });
+      appendFileSync(join2(logsDir, "filter-stats.jsonl"), `${JSON.stringify(stat)}
+`);
+    } catch {
+    }
+  }
+  try {
+    out = redactText(out, values);
+  } catch {
+  }
+  return { out, heldOut, stages };
+};
+var main = async () => {
+  const [command = "", exitCode = "0", durationS = "0", logPath = "", pipeline = ""] = process.argv.slice(2);
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  const raw = Buffer.concat(chunks).toString("utf8");
+  let values = [];
+  try {
+    values = secretValues();
+  } catch {
+    values = [];
+  }
+  const terminalsDir = process.env["INTENTIC_TERMINAL_LOGS_DIR"];
+  const { out } = filterRun(raw, {
+    command,
+    exitCode,
+    durationS,
+    pipeline,
+    enabled: parseCleaners(process.env["INTENTIC_OUTPUT_CLEANERS"]),
+    holdout: Number(process.env["INTENTIC_OUTPUT_HOLDOUT"] ?? "0"),
+    logsDir: terminalsDir !== void 0 && terminalsDir !== "" ? join2(terminalsDir, "..") : void 0,
+    // Named after the pane log, which is unique per command: one window, one pane id.
+    runName: logPath === "" ? void 0 : basename(logPath),
+    // Every command of a session runs in a new pane, so the session is the pane log's name minus the pane.
+    sessionKey: sessionKeyFromLog(logPath),
+    values
+  });
+  process.stdout.write(out);
+};
+if (process.argv[1]?.endsWith("agent-output-filter") || process.argv[1]?.endsWith("agent-output-filter.mjs")) {
+  await main();
+}
+
+// src/features.ts
+var OPTIONS = {
+  output_cleaners: {
+    type: "boolean",
+    title: "Trim Bash output",
+    description: "Clean what a successful command printed before Claude reads it (progress bars, install chatter, repeated lines, the middle of huge logs), keep the full text retrievable with `retrieve-output`, and ledger what each cleaner saved.",
+    default: true
+  },
+  cleaners: {
+    type: "string",
+    title: "Cleaners",
+    description: "Which cleaners run, as the sandbox spells it: empty for all, `-cap,-wide` to switch some off, `git,pnpm` to allow only those. `/intentic:stats` lists them by what they saved.",
+    default: ""
+  },
+  output_holdout: {
+    type: "number",
+    title: "Untrimmed share",
+    description: "Share of commands left untrimmed, so the saving can be measured against a real comparison and not only computed. 0 turns the comparison off; the exact per-command saving is reported either way.",
+    default: 0,
+    min: 0,
+    max: 0.5
+  },
+  project_map: {
+    type: "boolean",
+    title: "Project map",
+    description: "Open each session with a map of the project it starts in: its areas, what each is for, and where Claude is standing. Worked out from the tree every time, never stored, so it cannot go stale.",
+    default: true
+  },
+  field_notes: {
+    type: "boolean",
+    title: "Field notes",
+    description: "Open each session with this project's field notes: the traps past sessions hit and the commands that really verify. Written by `/intentic:field-notes` from your own sessions here; nothing is sent until you run it once.",
+    default: true
+  },
+  iq: {
+    type: "boolean",
+    title: "iq search",
+    description: "Teach Claude the `iq` code search CLI and recall past sessions on a matching prompt. Needs `npm i -g @intentic/iq`; without it this switch does nothing and says so once.",
+    default: true
+  },
+  fileq: {
+    type: "boolean",
+    title: "fileq",
+    description: "Let Claude read documents, PDFs, spreadsheets, slides, notebooks, images, audio and archives as markdown with the bundled `fileq` CLI. Off makes the command refuse; its one-line skill description stays listed, since a plugin cannot hide its own skills.",
+    default: true
+  },
+  shadows: {
+    type: "boolean",
+    title: "Document shadows",
+    description: "Keep a markdown rendering of every document in the project up to date in the background (a sweep at session start and every ten minutes, and each binary file Claude writes), so a read finds one ready. Costs background CPU on a document-heavy project.",
+    default: false
+  },
+  holdout: {
+    type: "number",
+    title: "Measured share",
+    description: "Share of sessions opened without the map, the field notes and the iq teaching, so `/intentic:stats` can show what each changed. 0 sends them to every session and measures nothing.",
+    default: 0.1,
+    min: 0,
+    max: 0.5
+  }
+};
+var asBoolean = (raw, fallback) => {
+  const value = raw?.trim().toLowerCase();
+  if (value === "true" || value === "1" || value === "yes" || value === "on") {
+    return true;
+  }
+  if (value === "false" || value === "0" || value === "no" || value === "off") {
+    return false;
+  }
+  return fallback;
+};
+var asShare = (raw, option) => {
+  const value = raw === void 0 || raw.trim() === "" ? Number.NaN : Number(raw);
+  return Number.isFinite(value) ? Math.min(option.max, Math.max(option.min, value)) : option.default;
+};
+var optionEnvName = (key) => `CLAUDE_PLUGIN_OPTION_${key.toUpperCase()}`;
+var readOptions = (env = process.env) => {
+  const entries = Object.keys(OPTIONS).map((key) => {
+    const option = OPTIONS[key];
+    const raw = env[optionEnvName(key)];
+    if (option.type === "boolean") {
+      return [key, asBoolean(raw, option.default)];
+    }
+    if (option.type === "number") {
+      return [key, asShare(raw, option)];
+    }
+    return [key, raw ?? option.default];
+  });
+  return Object.fromEntries(entries);
+};
+
+// src/hook-io.ts
+import { homedir } from "node:os";
+import { join as join3 } from "node:path";
+var readStdin = async () => {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+};
+var parseHookInput = (text) => {
+  try {
+    const value = JSON.parse(text);
+    return typeof value === "object" && value !== null ? value : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var runHook = async (handle) => {
+  try {
+    const raw = await readStdin();
+    const input = parseHookInput(raw);
+    if (input === void 0) {
+      return;
+    }
+    const answer = await handle(input, raw);
+    if (typeof answer === "string") {
+      process.stdout.write(answer);
+    } else if (answer !== void 0) {
+      process.stdout.write(`${JSON.stringify(answer)}
+`);
+    }
+  } catch (error) {
+    process.stderr.write(`intentic: ${error instanceof Error ? error.message : String(error)}
+`);
+  }
+};
+var dataDir = (env = process.env) => env["CLAUDE_PLUGIN_DATA"] ?? join3(env["CLAUDE_CONFIG_DIR"] ?? join3(homedir(), ".claude"), "plugins", "data", "intentic-intentic");
+var projectDir = (input, env = process.env) => env["CLAUDE_PROJECT_DIR"] ?? input.cwd ?? process.cwd();
+
+// src/post-bash.ts
+var outputDir = (data) => join4(data, "output");
+var OWN_REPORTS = /(?:^|[\s/])intentic-(?:stats|notes-evidence)(?:\s|$)/;
+var rawOf = (response) => {
+  if (typeof response.stdout !== "string" || response.interrupted === true || response.isImage === true || response.backgroundTaskId !== void 0) {
+    return void 0;
+  }
+  const stderr = typeof response.stderr === "string" ? response.stderr : "";
+  return stderr === "" ? response.stdout : `${response.stdout}${response.stdout === "" || response.stdout.endsWith("\n") ? "" : "\n"}${stderr}`;
+};
+var postBash = (input, env = process.env) => {
+  const options = readOptions(env);
+  const command = input.tool_input?.["command"];
+  const response = input.tool_response;
+  if (!options.output_cleaners || typeof command !== "string" || OWN_REPORTS.test(command) || typeof response !== "object" || response === null) {
+    return void 0;
+  }
+  const raw = rawOf(response);
+  if (raw === void 0 || raw === "") {
+    return void 0;
+  }
+  const session = input.session_id ?? "session";
+  const { out } = filterRun(raw, {
+    command,
+    exitCode: "0",
+    durationS: String(Math.round((input.duration_ms ?? 0) / 1e3)),
+    enabled: parseCleaners(options.cleaners),
+    holdout: options.output_holdout,
+    logsDir: outputDir(dataDir(env)),
+    // One file per call, named so a person can tell which session it came from.
+    runName: `${session}-${input.tool_use_id ?? Date.now().toString(36)}.log`,
+    sessionKey: session,
+    values: [],
+    tags: { project: projectDir(input, env), session }
+  });
+  if (out === raw) {
+    return void 0;
+  }
+  return { hookSpecificOutput: { hookEventName: "PostToolUse", updatedToolOutput: { ...response, stdout: out, stderr: "" } } };
+};
+if (process.argv[1]?.endsWith("post-bash.mjs")) {
+  await runHook((input) => postBash(input));
+}
+export {
+  outputDir,
+  postBash
+};