@kontourai/flow-agents 0.1.1

package/scripts/promote-workflow-artifact.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import("../build/src/cli/promote-workflow-artifact.js").then(({ main }) => process.exit(main()));

package/scripts/publish-change-helper.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import("../build/src/cli/publish-change-helper.js").then(({ main }) => process.exit(main()));

package/scripts/pull-work-provider.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import("../build/src/cli/pull-work-provider.js").then(({ main }) => process.exit(main()));

package/scripts/setup-repo-hooks.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(git rev-parse --show-toplevel)"
+cd "$ROOT_DIR"
+
+git config --local core.hooksPath .githooks
+echo "Configured repo-local Git hooks: core.hooksPath=.githooks"

package/scripts/statusline/flow-agents-statusline.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+/**
+ * Compact Flow Agents workflow status for runtimes with status bar support.
+ *
+ * Reads optional runtime JSON from stdin, discovers `.flow-agents`, and
+ * prints one ASCII line suitable for Claude Code statusLine or Pi setStatus.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const MAX_SUMMARY = 72;
+
+function readStdin() {
+  return new Promise(resolve => {
+    let raw = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', chunk => {
+      raw += chunk;
+    });
+    process.stdin.on('end', () => resolve(raw));
+    process.stdin.on('error', () => resolve(raw));
+  });
+}
+
+function parseJson(raw) {
+  try {
+    return raw.trim() ? JSON.parse(raw) : {};
+  } catch {
+    return {};
+  }
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function runtimeCwd(input) {
+  return (
+    input.cwd ||
+    input.current_dir ||
+    input.workspace?.current_dir ||
+    input.workspace?.cwd ||
+    process.env.CLAUDE_PROJECT_DIR ||
+    process.env.PWD ||
+    process.cwd()
+  );
+}
+
+function findWorkflowRoot(startDir) {
+  let current = path.resolve(startDir || process.cwd());
+  for (;;) {
+    const candidate = path.join(current, '.flow-agents');
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function stateFiles(workflowRoot) {
+  try {
+    return fs.readdirSync(workflowRoot, { withFileTypes: true })
+      .filter(entry => entry.isDirectory())
+      .map(entry => path.join(workflowRoot, entry.name, 'state.json'))
+      .filter(file => fs.existsSync(file));
+  } catch {
+    return [];
+  }
+}
+
+function chooseWorkflow(workflowRoot) {
+  const current = readJson(path.join(workflowRoot, 'current.json'));
+  if (current?.active_slug || current?.artifact_dir) {
+    const slug = current.active_slug || current.artifact_dir;
+    const dir = path.join(workflowRoot, slug);
+    const state = readJson(path.join(dir, 'state.json'));
+    if (state) return { dir, state };
+  }
+
+  const unresolved = new Set([
+    'new',
+    'planning',
+    'planned',
+    'in_progress',
+    'blocked',
+    'verifying',
+    'needs_decision',
+    'not_verified',
+    'failed',
+  ]);
+
+  return stateFiles(workflowRoot)
+    .map(file => ({ file, state: readJson(file), mtime: fs.statSync(file).mtimeMs }))
+    .filter(item => item.state)
+    .sort((a, b) => {
+      const aOpen = unresolved.has(a.state.status) ? 1 : 0;
+      const bOpen = unresolved.has(b.state.status) ? 1 : 0;
+      return bOpen - aOpen || b.mtime - a.mtime;
+    })
+    .map(item => ({ dir: path.dirname(item.file), state: item.state }))[0] || null;
+}
+
+function acceptanceProgress(dir) {
+  const acceptance = readJson(path.join(dir, 'acceptance.json'));
+  const criteria = Array.isArray(acceptance?.criteria) ? acceptance.criteria : [];
+  if (criteria.length > 0) {
+    const done = criteria.filter(item => ['pass', 'accepted_gap'].includes(item.status)).length;
+    return `${done}/${criteria.length} AC`;
+  }
+
+  const evidence = readJson(path.join(dir, 'evidence.json'));
+  const checks = Array.isArray(evidence?.checks) ? evidence.checks : [];
+  if (checks.length > 0) {
+    const done = checks.filter(item => ['pass', 'skip'].includes(item.status)).length;
+    return `${done}/${checks.length} checks`;
+  }
+
+  return '';
+}
+
+function compact(text, maxLength = MAX_SUMMARY) {
+  const singleLine = String(text || '').replace(/\s+/g, ' ').trim();
+  if (singleLine.length <= maxLength) return singleLine;
+  return `${singleLine.slice(0, Math.max(0, maxLength - 3))}...`;
+}
+
+function render(workflow) {
+  if (!workflow) return 'Flow Agents: no active workflow';
+
+  const { dir, state } = workflow;
+  const slug = state.task_slug || path.basename(dir);
+  const phaseStatus = [state.phase, state.status].filter(Boolean).join('/');
+  const progress = acceptanceProgress(dir);
+  const next = compact(state.next_action?.summary || '');
+  const parts = [`Flow Agents: ${slug}`];
+  if (phaseStatus) parts.push(phaseStatus);
+  if (progress) parts.push(progress);
+  if (next) parts.push(`next: ${next}`);
+  return parts.join(' | ');
+}
+
+async function main() {
+  const input = parseJson(await readStdin());
+  const workflowRoot = findWorkflowRoot(runtimeCwd(input));
+  process.stdout.write(`${render(workflowRoot ? chooseWorkflow(workflowRoot) : null)}\n`);
+}
+
+main().catch(() => {
+  process.stdout.write('Flow Agents: status unavailable\n');
+});

package/scripts/telemetry/console-presets.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Named Console telemetry sink defaults used by install/setup helpers.
+
+flow_agents_local_kontour_console_url() {
+  printf '%s\n' "${FLOW_AGENTS_LOCAL_KONTOUR_CONSOLE_URL:-http://127.0.0.1:3737}"
+}
+
+flow_agents_kontour_cloud_console_url() {
+  printf '%s\n' "${FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL:-https://console.kontourai.com}"
+}
+
+flow_agents_kontour_hosted_console_url() {
+  flow_agents_kontour_cloud_console_url
+}

package/scripts/telemetry/install-console-config.sh

@@ -0,0 +1,214 @@
+#!/usr/bin/env bash
+# Persist optional Console telemetry settings into an installed telemetry.conf.
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'EOF'
+usage: install-console-config.sh /path/to/telemetry.conf [options]
+
+Options:
+  --telemetry-sink NAME   local-files, local-kontour-console,
+                          kontour-hosted-console, user-hosted-console,
+                          or legacy aliases. May be repeated.
+  --console-url URL       Console base URL. Derives /api/telemetry/records.
+  --console-endpoint URL  Full Console telemetry records endpoint URL.
+  --console-token-file PATH
+                          File containing the bearer token.
+  --console-tenant ID     Tenant identifier for hosted Console routing.
+EOF
+}
+
+die() {
+  echo "install-console-config.sh: $*" >&2
+  exit 2
+}
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+source "$SCRIPT_DIR/console-presets.sh"
+
+append_sinks() {
+  local raw="$1"
+  local sink
+  raw="${raw//,/ }"
+  for sink in $raw; do
+    [[ -n "$sink" ]] && telemetry_sinks+=("$sink")
+  done
+}
+
+has_control_chars() {
+  [[ "$1" == *$'\n'* || "$1" == *$'\r'* || "$1" == *$'\t'* ]]
+}
+
+validate_url() {
+  local label="$1"
+  local value="$2"
+  [[ -z "$value" ]] && return 0
+  has_control_chars "$value" && die "$label must not contain control characters"
+  if [[ "$value" == https://* ]]; then
+    return 0
+  fi
+  if [[ "$value" == http://127.0.0.1:* || "$value" == http://127.0.0.1/* || "$value" == "http://127.0.0.1" ]]; then
+    return 0
+  fi
+  if [[ "$value" == http://localhost:* || "$value" == http://localhost/* || "$value" == "http://localhost" ]]; then
+    return 0
+  fi
+  die "$label must use https://, except localhost or 127.0.0.1 may use http://"
+}
+
+validate_token() {
+  local value="$1"
+  [[ -z "$value" ]] && return 0
+  [[ "${#value}" -le 4096 ]] || die "Console token must be 4096 characters or fewer"
+  has_control_chars "$value" && die "Console token must not contain control characters"
+  [[ "$value" =~ ^[A-Za-z0-9._~+/=-]+$ ]] || die "Console token contains unsupported characters"
+}
+
+read_token_file() {
+  local file="$1"
+  [[ -f "$file" ]] || die "--console-token-file does not exist: $file"
+  local value
+  value="$(tr -d '\r\n' <"$file")"
+  [[ -n "$value" ]] || die "--console-token-file is empty"
+  [[ "${#value}" -le 4096 ]] || die "Console token must be 4096 characters or fewer"
+  printf '%s\n' "$value"
+}
+
+validate_tenant() {
+  local value="$1"
+  [[ -z "$value" ]] && return 0
+  [[ "$value" =~ ^[A-Za-z0-9._:-]+$ ]] || die "--console-tenant contains unsupported characters"
+}
+
+set_config_key() {
+  local conf="$1"
+  local key="$2"
+  local value="$3"
+  [[ -z "$value" ]] && return 0
+  local tmp
+  tmp="$(mktemp "${TMPDIR:-/tmp}/flow-agents-telemetry-conf.XXXXXX")"
+  if [[ -f "$conf" ]]; then
+    awk -v key="$key" 'BEGIN { prefix = key "=" } index($0, prefix) != 1 { print }' "$conf" >"$tmp"
+  fi
+  printf '%s=%s\n' "$key" "$value" >>"$tmp"
+  mv "$tmp" "$conf"
+}
+
+main() {
+  [[ $# -ge 1 ]] || { usage; exit 2; }
+  local conf="$1"
+  shift
+
+  local console_url="${FLOW_AGENTS_CONSOLE_URL:-${CONSOLE_TELEMETRY_URL:-${CONSOLE_URL:-}}}"
+  local console_endpoint="${FLOW_AGENTS_CONSOLE_ENDPOINT_URL:-${CONSOLE_TELEMETRY_ENDPOINT_URL:-}}"
+  local console_token=""
+  local console_token_file="${FLOW_AGENTS_CONSOLE_TOKEN_FILE:-${CONSOLE_TELEMETRY_TOKEN_FILE:-}}"
+  local console_tenant="${FLOW_AGENTS_CONSOLE_TENANT:-${CONSOLE_TENANT_ID:-}}"
+  telemetry_sinks=()
+  if [[ -n "${FLOW_AGENTS_TELEMETRY_SINKS:-}" ]]; then
+    append_sinks "$FLOW_AGENTS_TELEMETRY_SINKS"
+  elif [[ -n "${FLOW_AGENTS_TELEMETRY_SINK:-}" ]]; then
+    append_sinks "$FLOW_AGENTS_TELEMETRY_SINK"
+  fi
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --telemetry-sink|--telemetry-sinks)
+        [[ $# -ge 2 ]] || die "$1 requires a value"
+        append_sinks "$2"
+        shift 2
+        ;;
+      --console-url)
+        [[ $# -ge 2 ]] || die "--console-url requires a value"
+        console_url="$2"
+        shift 2
+        ;;
+      --console-endpoint|--console-endpoint-url)
+        [[ $# -ge 2 ]] || die "$1 requires a value"
+        console_endpoint="$2"
+        shift 2
+        ;;
+      --console-token-file)
+        [[ $# -ge 2 ]] || die "--console-token-file requires a value"
+        console_token_file="$2"
+        shift 2
+        ;;
+      --console-tenant|--console-tenant-id)
+        [[ $# -ge 2 ]] || die "$1 requires a value"
+        console_tenant="$2"
+        shift 2
+        ;;
+      --help|-h)
+        usage
+        exit 0
+        ;;
+      *)
+        die "unknown option: $1"
+        ;;
+    esac
+  done
+
+  if [[ -n "$console_token_file" ]]; then
+    console_token="$(read_token_file "$console_token_file")"
+  fi
+
+  if [[ "${#telemetry_sinks[@]}" -eq 0 ]]; then
+    telemetry_sinks=("local-files")
+  fi
+  local sink
+  local console_sink_count=0
+  for sink in "${telemetry_sinks[@]}"; do
+    case "$sink" in
+      local-files)
+        ;;
+      local-kontour-console)
+        console_sink_count=$((console_sink_count + 1))
+        console_url="${console_url:-$(flow_agents_local_kontour_console_url)}"
+        ;;
+      kontour-hosted-console|kontour-cloud)
+        console_sink_count=$((console_sink_count + 1))
+        console_url="${console_url:-$(flow_agents_kontour_hosted_console_url)}"
+        ;;
+      user-hosted-console|hosted-kontour-console)
+        console_sink_count=$((console_sink_count + 1))
+        [[ -n "$console_url" || -n "$console_endpoint" ]] || die "user-hosted-console requires --console-url or --console-endpoint"
+        ;;
+      *)
+        die "unknown telemetry sink: $sink"
+        ;;
+    esac
+  done
+  [[ "$console_sink_count" -le 1 ]] || die "select at most one Console telemetry sink"
+
+  if [[ -z "$console_url" && -z "$console_endpoint" && -z "$console_token" && -z "$console_tenant" ]]; then
+    return 0
+  fi
+  if [[ -z "$console_url" && -z "$console_endpoint" && ( -n "$console_token" || -n "$console_tenant" ) ]]; then
+    die "--console-token-file and --console-tenant require --console-url or --console-endpoint"
+  fi
+
+  validate_url "--console-url" "$console_url"
+  validate_url "--console-endpoint" "$console_endpoint"
+  validate_token "$console_token"
+  validate_tenant "$console_tenant"
+
+  mkdir -p "$(dirname "$conf")"
+  [[ -f "$conf" ]] || : >"$conf"
+  set_config_key "$conf" "console_telemetry_url" "$console_url"
+  set_config_key "$conf" "console_telemetry_endpoint_url" "$console_endpoint"
+  set_config_key "$conf" "console_telemetry_token" "$console_token"
+  set_config_key "$conf" "console_tenant_id" "$console_tenant"
+  if [[ -n "$console_token" ]]; then
+    chmod 600 "$conf" 2>/dev/null || true
+  fi
+
+  local target="${console_endpoint:-$console_url}"
+  if [[ -n "$console_tenant" ]]; then
+    echo "Configured Console telemetry in $conf for $target (tenant: $console_tenant)"
+  else
+    echo "Configured Console telemetry in $conf for $target"
+  fi
+}
+
+main "$@"

package/scripts/telemetry/lib/config.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# config.sh — Load telemetry configuration with defaults
+
+TELEMETRY_DIR="${TELEMETRY_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+TELEMETRY_CONFIG_FILE="${TELEMETRY_CONFIG_FILE:-${TELEMETRY_DIR}/telemetry.conf}"
+
+# Defaults
+TELEMETRY_ENABLED="${TELEMETRY_ENABLED:-true}"
+TELEMETRY_DATA_DIR="${TELEMETRY_DATA_DIR:-$(cd "${TELEMETRY_DIR}/../../.." && pwd)/.telemetry}"
+TELEMETRY_SESSION_DIR="${TELEMETRY_SESSION_DIR:-${TELEMETRY_DATA_DIR}/sessions}"
+TELEMETRY_ENRICH_SYSTEM="${TELEMETRY_ENRICH_SYSTEM:-true}"
+TELEMETRY_ENRICH_WORKSPACE="${TELEMETRY_ENRICH_WORKSPACE:-true}"
+TELEMETRY_ENRICH_AUTH="${TELEMETRY_ENRICH_AUTH:-true}"
+TELEMETRY_SYNC_INCLUDE="${TELEMETRY_SYNC_INCLUDE:-*}"
+TELEMETRY_SYNC_EXCLUDE="${TELEMETRY_SYNC_EXCLUDE:-neo-*,Neo,local-gamma-*}"
+TELEMETRY_MAX_LOG_SIZE_MB="${TELEMETRY_MAX_LOG_SIZE_MB:-50}"
+TELEMETRY_MAX_LOG_FILES="${TELEMETRY_MAX_LOG_FILES:-3}"
+TELEMETRY_CHANNELS="${TELEMETRY_CHANNELS:-full}"
+FLOW_AGENTS_TELEMETRY_CAPTURE_RAW_HOOK_INPUT="${FLOW_AGENTS_TELEMETRY_CAPTURE_RAW_HOOK_INPUT:-false}"
+TELEMETRY_USAGE_TRACKING="${TELEMETRY_USAGE_TRACKING:-true}"
+TELEMETRY_NOTIFICATIONS="${TELEMETRY_NOTIFICATIONS:-true}"
+TELEMETRY_NOTIFICATION_PROFILE="${TELEMETRY_NOTIFICATION_PROFILE:-standard}"
+TELEMETRY_GOVERNANCE="${TELEMETRY_GOVERNANCE:-true}"
+TELEMETRY_GOVERNANCE_AUDIT_MAX_SIZE_MB="${TELEMETRY_GOVERNANCE_AUDIT_MAX_SIZE_MB:-25}"
+TELEMETRY_GOVERNANCE_AUDIT_MAX_FILES="${TELEMETRY_GOVERNANCE_AUDIT_MAX_FILES:-5}"
+
+# Channel defaults
+TELEMETRY_CHANNEL_FULL_LOG_FILE="${TELEMETRY_CHANNEL_FULL_LOG_FILE:-${TELEMETRY_DATA_DIR}/full.jsonl}"
+TELEMETRY_CHANNEL_FULL_REDACT="${TELEMETRY_CHANNEL_FULL_REDACT:-hook.raw_input,turn.prompt_text,tool.input,tool.output}"
+TELEMETRY_CHANNEL_ANALYTICS_LOG_FILE="${TELEMETRY_CHANNEL_ANALYTICS_LOG_FILE:-${TELEMETRY_DATA_DIR}/analytics.jsonl}"
+TELEMETRY_CHANNEL_ANALYTICS_REDACT="${TELEMETRY_CHANNEL_ANALYTICS_REDACT:-tool.input,tool.output,turn.prompt_text,delegation.targets.query,context.cwd,hook.raw_input,hook.last_assistant_message,hook.transcript_path}"
+TELEMETRY_CHANNEL_ANALYTICS_ENDPOINT_URL="${TELEMETRY_CHANNEL_ANALYTICS_ENDPOINT_URL:-}"
+CONSOLE_TELEMETRY_URL="${CONSOLE_TELEMETRY_URL:-${CONSOLE_URL:-}}"
+CONSOLE_TELEMETRY_ENDPOINT_URL="${CONSOLE_TELEMETRY_ENDPOINT_URL:-}"
+CONSOLE_TELEMETRY_TOKEN="${CONSOLE_TELEMETRY_TOKEN:-${CONSOLE_AUTH_TOKEN:-}}"
+CONSOLE_TENANT_ID="${CONSOLE_TENANT_ID:-}"
+
+# Load config file if it exists
+if [[ -f "$TELEMETRY_CONFIG_FILE" ]]; then
+  while IFS='=' read -r key value; do
+    [[ -z "$key" || "$key" =~ ^[[:space:]]*# ]] && continue
+    key=$(echo "$key" | tr -d '[:space:]')
+    value=$(echo "$value" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+    
+    # Handle channel-specific config
+    if [[ "$key" =~ ^channel\.([^.]+)\.(.+)$ ]]; then
+      channel_name="${BASH_REMATCH[1]}"
+      channel_key="${BASH_REMATCH[2]}"
+      if [[ "$channel_name" =~ ^[A-Za-z0-9_]+$ && "$channel_key" =~ ^[A-Za-z0-9_]+$ ]]; then
+        var_name="TELEMETRY_CHANNEL_$(echo "$channel_name" | tr '[:lower:]' '[:upper:]')_$(echo "$channel_key" | tr '[:lower:]' '[:upper:]')"
+        printf -v "$var_name" '%s' "$value"
+      fi
+    else
+      # Standard config
+      case "$key" in
+        enabled) TELEMETRY_ENABLED="$value" ;;
+        channels) TELEMETRY_CHANNELS="$value" ;;
+        enrich_system) TELEMETRY_ENRICH_SYSTEM="$value" ;;
+        enrich_workspace) TELEMETRY_ENRICH_WORKSPACE="$value" ;;
+        enrich_auth) TELEMETRY_ENRICH_AUTH="$value" ;;
+        max_log_size_mb) TELEMETRY_MAX_LOG_SIZE_MB="$value" ;;
+        max_log_files) TELEMETRY_MAX_LOG_FILES="$value" ;;
+        sync_include) TELEMETRY_SYNC_INCLUDE="$value" ;;
+        sync_exclude) TELEMETRY_SYNC_EXCLUDE="$value" ;;
+        usage_tracking) TELEMETRY_USAGE_TRACKING="$value" ;;
+        notifications) TELEMETRY_NOTIFICATIONS="$value" ;;
+        notification_profile) TELEMETRY_NOTIFICATION_PROFILE="$value" ;;
+        governance) TELEMETRY_GOVERNANCE="$value" ;;
+        governance_audit_max_size_mb) TELEMETRY_GOVERNANCE_AUDIT_MAX_SIZE_MB="$value" ;;
+        governance_audit_max_files) TELEMETRY_GOVERNANCE_AUDIT_MAX_FILES="$value" ;;
+        console_url) CONSOLE_TELEMETRY_URL="$value" ;;
+        console_telemetry_url) CONSOLE_TELEMETRY_URL="$value" ;;
+        console_telemetry_endpoint_url) CONSOLE_TELEMETRY_ENDPOINT_URL="$value" ;;
+        console_telemetry_token) CONSOLE_TELEMETRY_TOKEN="$value" ;;
+        console_tenant_id) CONSOLE_TENANT_ID="$value" ;;
+        console_telemetry_redact) CONSOLE_TELEMETRY_REDACT="$value" ;;
+      esac
+    fi
+  done < "$TELEMETRY_CONFIG_FILE"
+fi
+
+CONSOLE_TELEMETRY_REDACT="${CONSOLE_TELEMETRY_REDACT:-${TELEMETRY_CHANNEL_ANALYTICS_REDACT}}"
+
+# Ensure directories exist
+mkdir -p "$TELEMETRY_DATA_DIR" "$TELEMETRY_SESSION_DIR" 2>/dev/null

package/scripts/telemetry/lib/enrich.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# enrich.sh — Metadata enrichment functions
+
+enrich_system() {
+  [[ "$TELEMETRY_ENRICH_SYSTEM" != "true" ]] && echo '{}' && return
+  
+  local os os_version shell runtime_version node_version
+  os=$(uname -s | tr '[:upper:]' '[:lower:]')
+  os_version=$(uname -r)
+  shell=$(basename "${SHELL:-unknown}")
+  runtime_version=$(
+    kiro-cli --version 2>/dev/null &
+    _pid=$!; ( sleep 2; kill $_pid 2>/dev/null ) &
+    _guard=$!; wait $_pid 2>/dev/null; kill $_guard 2>/dev/null
+    wait $_pid 2>/dev/null
+  ) 2>/dev/null
+  runtime_version=$(echo "$runtime_version" | head -n1)
+  runtime_version="${runtime_version:-unknown}"
+  node_version=$(node --version 2>/dev/null || echo "unknown")
+  
+  jq -nc \
+    --arg os "$os" \
+    --arg osv "$os_version" \
+    --arg shell "$shell" \
+    --arg rv "$runtime_version" \
+    --arg nv "$node_version" \
+    '{
+      os: $os,
+      os_version: $osv,
+      shell: $shell,
+      runtime_version: $rv,
+      node_version: $nv
+    }'
+}
+
+enrich_workspace() {
+  [[ "$TELEMETRY_ENRICH_WORKSPACE" != "true" ]] && echo '{}' && return
+  
+  local session_id cache_file
+  session_id=$(session_get)
+  cache_file="${TELEMETRY_SESSION_DIR}/${session_id}.workspace"
+  
+  # Return cached if exists
+  [[ -f "$cache_file" ]] && cat "$cache_file" && return
+  
+  local has_git="false" git_branch="" git_hash=""
+  local file_count=0 workspace_size_mb=0 primary_languages=""
+  
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    has_git="true"
+    git_branch=$(git branch --show-current 2>/dev/null || echo "unknown")
+    git_hash=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
+    
+    # Only scan files inside a git repo to avoid scanning ~ or /
+    file_count=$(find . -maxdepth 4 -type f 2>/dev/null | head -10000 | wc -l | tr -d ' ')
+    primary_languages=$(find . -maxdepth 4 \( -name "*.js" -o -name "*.ts" -o -name "*.py" -o -name "*.sh" -o -name "*.go" -o -name "*.rs" \) 2>/dev/null | \
+      head -5000 | sed 's/.*\.//' | sort | uniq -c | sort -nr | head -3 | awk '{print $2}' | tr '\n' ',' | sed 's/,$//')
+  fi
+  
+  local result
+  result=$(jq -nc \
+    --argjson hg "$has_git" \
+    --arg gb "$git_branch" \
+    --arg gh "$git_hash" \
+    --argjson fc "$file_count" \
+    --argjson ws "$workspace_size_mb" \
+    --arg pl "$primary_languages" \
+    '{
+      has_git: $hg,
+      git_branch_hash: ($gb + "@" + $gh),
+      file_count: $fc,
+      workspace_size_mb: $ws,
+      primary_languages: $pl
+    }')
+  
+  echo "$result" | tee "$cache_file"
+}
+
+enrich_auth() {
+  [[ "$TELEMETRY_ENRICH_AUTH" != "true" ]] && echo '{}' && return
+  
+  local mwinit_active="false" mwinit_age_minutes=0 cookie_exists="false"
+  
+  # Check mwinit status
+  if command -v mwinit >/dev/null 2>&1; then
+    if mwinit status >/dev/null 2>&1; then
+      mwinit_active="true"
+      local mwinit_file="$HOME/.mwinit"
+      if [[ -f "$mwinit_file" ]]; then
+        local mwinit_mtime current_time
+        # Try GNU stat first, then BSD
+        if stat -c %Y "$mwinit_file" >/dev/null 2>&1; then
+          mwinit_mtime=$(stat -c %Y "$mwinit_file")
+        else
+          mwinit_mtime=$(stat -f %m "$mwinit_file" 2>/dev/null || echo "0")
+        fi
+        current_time=$(date +%s)
+        mwinit_age_minutes=$(((current_time - mwinit_mtime) / 60))
+      fi
+    fi
+  fi
+  
+  # Check for auth cookies
+  [[ -f "$HOME/.aws/sso/cache" ]] && cookie_exists="true"
+  
+  jq -nc \
+    --argjson ma "$mwinit_active" \
+    --argjson mam "$mwinit_age_minutes" \
+    --argjson ce "$cookie_exists" \
+    '{
+      mwinit_active: $ma,
+      mwinit_age_minutes: $mam,
+      cookie_exists: $ce
+    }'
+}

package/scripts/telemetry/lib/redact.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# redact.sh — Field redaction for telemetry events
+
+redact_event() {
+  local event="$1"
+  local redact_fields="$2"
+  
+  [[ -z "$event" || "$redact_fields" == "none" ]] && echo "$event" && return
+  
+  local result="$event"
+  IFS=',' read -ra fields <<< "$redact_fields"
+  
+  for field in "${fields[@]}"; do
+    field=$(echo "$field" | tr -d ' ')
+    [[ -z "$field" ]] && continue
+    
+    # Use jq to null out the field
+    result=$(echo "$result" | jq -c ".$field = null" 2>/dev/null || echo "$result")
+  done
+  
+  echo "$result"
+}