@optimuslabs/harness-map-staging 1.5.16

package/dist/log_config_files/collection/opencode_token_usage_collector.js

@@ -0,0 +1,177 @@
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+/**
+ * Token-usage / cost / session / version / identity aggregator for OpenCode.
+ *
+ * Unlike Claude/Copilot (JSONL transcripts), OpenCode stores everything in a SQLite DB at
+ * ~/.local/share/opencode/opencode.db. Each assistant row in the `message` table has a JSON
+ * `data` blob carrying `modelID`, `providerID`, `tokens` ({input,output,reasoning,cache:{read,write}})
+ * and `cost`; the `account` table carries the login `email`/`url`; the singleton `account_state`
+ * row carries `active_org_id` (an org identifier — no org *name* exists anywhere in the schema).
+ * We read those via the bundled `sqlite3` binary (same resolver the remediation path uses) and
+ * emit only the aggregated numbers (plus the login email / org id) — never message content. The
+ * DB is opened read-only.
+ *
+ * Bounded by DB-file mtime recency so a stale install isn't re-read every hook run.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'opencode_token_usage';
+// ASCII record / unit separators: never appear in JSON or emails, so they delimit SELECTed
+// rows/fields unambiguously. In SQL these are char(30) / char(31).
+const ROW_SEP = '\x1e';
+const FIELD_SEP = '\x1f';
+function emptyTotals() {
+    return {
+        input_tokens: 0,
+        output_tokens: 0,
+        cache_read_input_tokens: 0,
+        cache_creation_input_tokens: 0,
+    };
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+function asObject(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+/** Run a read-only query and return raw stdout, or null when sqlite3/DB is unavailable. */
+function querySqlite(sqlite3, dbPath, sql) {
+    try {
+        return execSqlite3(sqlite3, ['-readonly', '-noheader', dbPath], `.timeout 5000\n${sql}\n`);
+    }
+    catch {
+        return null;
+    }
+}
+/** OpenCode CLI version from ~/.config/opencode/package.json (@opencode-ai/plugin pin), best-effort. */
+function readOpencodeVersion(home) {
+    for (const rel of ['.config/opencode/package.json', '.cache/opencode/package.json']) {
+        try {
+            const pkg = JSON.parse(readFileSync(join(home, rel), 'utf8'));
+            const deps = asObject(pkg.dependencies);
+            const v = deps['@opencode-ai/plugin'] ?? deps['opencode'] ?? pkg.version;
+            if (typeof v === 'string' && v)
+                return v.replace(/^[\^~]/, '');
+        }
+        catch {
+            /* missing/unparseable — try next */
+        }
+    }
+    return '';
+}
+/**
+ * Aggregate OpenCode token usage / cost / sessions / models from the SQLite DB.
+ * Returns a single-element array (one per-machine aggregate) or [] when there is no usable DB.
+ */
+function collectOpencodeTokenUsage(home = homedir()) {
+    const dbPath = join(home, '.local', 'share', 'opencode', 'opencode.db');
+    if (!existsSync(dbPath))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    try {
+        if (statSync(dbPath).mtimeMs < cutoffMs)
+            return [];
+    }
+    catch {
+        return [];
+    }
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        return [];
+    // Window aggregation to the recency horizon (message.time_created is epoch ms) so a touched-but-
+    // -stale DB (VACUUM, backup, one new session) doesn't re-sum all-time history — matches the
+    // 30-day window the Claude/Copilot collectors apply per transcript file. cutoffMs is a numeric
+    // constant we control, so inlining it into the SQL is injection-safe.
+    const cutoffClause = `WHERE time_created >= ${cutoffMs}`;
+    // Assistant message JSON blobs, one per row (char(30)-delimited so embedded newlines in the
+    // JSON don't split rows).
+    const messagesRaw = querySqlite(sqlite3, dbPath, `SELECT data || char(30) FROM message ${cutoffClause};`);
+    if (messagesRaw === null)
+        return [];
+    const totals = emptyTotals();
+    const models = new Set();
+    const providers = new Set();
+    const modelTokenSplit = {};
+    let cost = 0;
+    let sawData = false;
+    for (const blob of messagesRaw.split(ROW_SEP)) {
+        const trimmed = blob.trim();
+        if (!trimmed)
+            continue;
+        let msg;
+        try {
+            msg = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        if (msg.role !== 'assistant')
+            continue;
+        sawData = true;
+        const model = typeof msg.modelID === 'string' ? msg.modelID : '';
+        if (model)
+            models.add(model);
+        if (typeof msg.providerID === 'string' && msg.providerID)
+            providers.add(msg.providerID);
+        cost += num(msg.cost);
+        const tokens = asObject(msg.tokens);
+        const cache = asObject(tokens.cache);
+        const input = num(tokens.input);
+        const output = num(tokens.output) + num(tokens.reasoning);
+        const cacheRead = num(cache.read);
+        const cacheWrite = num(cache.write);
+        totals.input_tokens += input;
+        totals.output_tokens += output;
+        totals.cache_read_input_tokens += cacheRead;
+        totals.cache_creation_input_tokens += cacheWrite;
+        if (model) {
+            const sum = input + output + cacheRead + cacheWrite;
+            if (sum > 0)
+                modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+        }
+    }
+    // Session count = distinct sessions with activity in the window (the `session` table has no
+    // timestamp, so count distinct session_id from recent messages — consistent with the windowed
+    // token totals above).
+    const sessionCountRaw = querySqlite(sqlite3, dbPath, `SELECT count(DISTINCT session_id) FROM message ${cutoffClause};`);
+    const sessionCount = sessionCountRaw ? num(parseInt(sessionCountRaw.trim(), 10)) : 0;
+    const accountRaw = querySqlite(sqlite3, dbPath, "SELECT COALESCE(email, '') || char(31) || COALESCE(url, '') FROM account ORDER BY time_updated DESC LIMIT 1;");
+    let email = '';
+    let host = '';
+    if (accountRaw && accountRaw.trim()) {
+        const [rawEmail, rawUrl] = accountRaw.trim().split(FIELD_SEP);
+        email = (rawEmail ?? '').trim();
+        host = (rawUrl ?? '')
+            .trim()
+            .replace(/^https?:\/\//, '')
+            .replace(/\/$/, '');
+    }
+    // Singleton row; absent on older installs/schemas without account_state — querySqlite
+    // returns null on "no such table" and orgIdRaw stays empty in that case.
+    const orgIdRaw = querySqlite(sqlite3, dbPath, "SELECT COALESCE(active_org_id, '') FROM account_state LIMIT 1;");
+    const orgId = orgIdRaw ? orgIdRaw.trim() : '';
+    if (!sawData && !email)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: dbPath, // stable synthetic path → one aggregate row per machine
+            raw_content: {
+                version: readOpencodeVersion(home),
+                session_count: sessionCount,
+                models: [...models].sort(),
+                providers: [...providers].sort(),
+                model_token_split: modelTokenSplit,
+                cost,
+                email,
+                host,
+                org_id: orgId,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+            },
+        },
+    ];
+}
+export { collectOpencodeTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };

package/dist/log_config_files/collection/pi_token_usage_collector.js

@@ -0,0 +1,239 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Session / token usage / model / provider aggregator for Pi (earendil-works, pi.dev).
+ *
+ * Pi writes one JSONL transcript per session under
+ * ~/.pi/agent/sessions/<sanitized-cwd>/<timestamp>_<uuid>.jsonl. The first line is a
+ * `type: "session"` header carrying the session `id`; assistant turns are `type: "message"`
+ * lines whose `message.usage` block carries `{input, output, cacheRead, cacheWrite,
+ * totalTokens, reasoning?, cost?}` alongside `message.model` / `message.provider`. `usage.cost`
+ * (confirmed on a real install) is `{input, output, cacheRead, cacheWrite, total}` in USD, computed
+ * by Pi itself per message — we sum only `cost.total`. We aggregate the *numbers* (and model/
+ * provider ids) on the endpoint and emit only those — never `message.content` (the actual
+ * prompt/response text) — so the backend gets token usage, cost, session count, and models/
+ * providers used without ingesting transcript content.
+ *
+ * Configured defaults come from a scoped read of settings.json's `defaultProvider` /
+ * `defaultModel` / `lastChangelogVersion` keys only — never any other key.
+ *
+ * auth.json holds literal per-provider `{type, key}` blobs (`{"anthropic": {"type": ...,
+ * "key": ...}}`), the same risk class as Hermes's/Codex's auth.json. We read only the `type`
+ * field per provider (e.g. `"api_key"`) — never `key`, the actual credential.
+ *
+ * `lastChangelogVersion` (confirmed against a real install: "0.80.3", matching `pi --version`
+ * exactly) is a best-effort CLI version signal, not a guaranteed-current one — it records the
+ * version Pi last showed its changelog for, which in practice tracks the installed version but
+ * could theoretically lag by one release in a narrow upgrade window. The session header's own
+ * `version` field is a JSONL schema version (small int, e.g. `3`), not the CLI version, and is
+ * not used here.
+ *
+ * `~/.pi/agent/models.json` handles custom providers (Ollama, LM Studio, vLLM, or any OpenAI/
+ * Anthropic-compatible API per Pi's own docs) — but no official doc example shows its actual key
+ * shape (unlike auth.json/settings.json above, which have confirmed real examples). We read only
+ * a best-effort guessed `{ "<id>": { "baseURL": "..." } }` shape (mirroring the `baseUrl`/
+ * `baseURL` convention every other agent's custom-provider config uses) and treat anything else
+ * in the file as unknown; this is explicitly unconfirmed and may need correcting against a real
+ * install with the file actually populated.
+ *
+ * Bounded by mtime recency so a large session history is not fully re-parsed on every run.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'pi_token_usage';
+function emptyTotals() {
+    return { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+function str(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+function asObject(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+/** Recursively collect *.jsonl files under a dir whose mtime is within the recency window. */
+function recentJsonlFiles(dir, cutoffMs) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...recentJsonlFiles(full, cutoffMs));
+        }
+        else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
+            try {
+                if (statSync(full).mtimeMs >= cutoffMs)
+                    out.push(full);
+            }
+            catch {
+                /* unreadable file — skip */
+            }
+        }
+    }
+    return out;
+}
+/** Scoped read of settings.json's `defaultProvider` / `defaultModel` / `lastChangelogVersion` keys only. */
+function readDefaults(home) {
+    try {
+        const raw = JSON.parse(readFileSync(join(home, '.pi', 'agent', 'settings.json'), 'utf8'));
+        return {
+            provider: str(raw.defaultProvider),
+            model: str(raw.defaultModel),
+            version: str(raw.lastChangelogVersion),
+        };
+    }
+    catch {
+        return { provider: '', model: '', version: '' };
+    }
+}
+/**
+ * Scoped read of auth.json's per-provider `type` field only — never the sibling `key`
+ * credential. Returns a provider -> type map (e.g. `{"anthropic": "api_key"}`).
+ */
+function readAuthTypesByProvider(home) {
+    try {
+        const raw = JSON.parse(readFileSync(join(home, '.pi', 'agent', 'auth.json'), 'utf8'));
+        const out = {};
+        for (const [provider, value] of Object.entries(raw)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const type = str(value.type);
+            if (type)
+                out[provider] = type;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Best-effort, UNCONFIRMED scoped read of models.json's custom-provider `baseURL` values —
+ * see the module docstring's caveat. Returns a provider id -> base URL map.
+ */
+function readCustomProviderBaseUrls(home) {
+    try {
+        const raw = JSON.parse(readFileSync(join(home, '.pi', 'agent', 'models.json'), 'utf8'));
+        const out = {};
+        for (const [providerId, value] of Object.entries(raw)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const entry = value;
+            const baseUrl = str(entry.baseURL) || str(entry.baseUrl);
+            if (baseUrl)
+                out[providerId] = baseUrl;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Aggregate Pi session count / token usage / models / providers across recent session
+ * transcripts. Returns a single-element array (one per-machine aggregate) or [] when there is
+ * no recent data.
+ */
+function collectPiTokenUsage(home = homedir()) {
+    const sessionsDir = join(home, '.pi', 'agent', 'sessions');
+    if (!existsSync(sessionsDir))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const files = recentJsonlFiles(sessionsDir, cutoffMs);
+    if (files.length === 0)
+        return [];
+    const totals = emptyTotals();
+    const sessions = new Set();
+    const models = new Set();
+    const providers = new Set();
+    const modelTokenSplit = {};
+    let cost = 0;
+    let sawData = false;
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                continue;
+            }
+            if (entry.type === 'session') {
+                const sessionId = str(entry.id);
+                if (sessionId)
+                    sessions.add(sessionId);
+                sawData = true;
+                continue;
+            }
+            if (entry.type !== 'message')
+                continue;
+            const message = asObject(entry.message);
+            const usage = asObject(message.usage);
+            if (Object.keys(usage).length === 0)
+                continue;
+            sawData = true;
+            const model = str(message.model);
+            const provider = str(message.provider);
+            if (model)
+                models.add(model);
+            if (provider)
+                providers.add(provider);
+            const input = num(usage.input);
+            // reasoning tokens fold into output_tokens — TokenTotals has no separate reasoning
+            // field (matches Codex's/Hermes's reasoning fold-in convention).
+            const output = num(usage.output) + num(usage.reasoning);
+            const cacheRead = num(usage.cacheRead);
+            totals.input_tokens += input;
+            totals.output_tokens += output;
+            totals.cache_read_input_tokens += cacheRead;
+            cost += num(asObject(usage.cost).total);
+            const sum = input + output + cacheRead;
+            if (model && sum > 0) {
+                modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+            }
+        }
+    }
+    if (!sawData)
+        return [];
+    const defaults = readDefaults(home);
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            // Stable synthetic path → one aggregate row per machine.
+            file_path: sessionsDir,
+            raw_content: {
+                version: defaults.version,
+                session_count: sessions.size,
+                models: [...models].sort(),
+                providers: [...providers].sort(),
+                model_token_split: modelTokenSplit,
+                configured_model: defaults.model,
+                configured_provider: defaults.provider,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+                cost,
+                auth_types_by_provider: readAuthTypesByProvider(home),
+                custom_provider_base_urls: readCustomProviderBaseUrls(home),
+            },
+        },
+    ];
+}
+export { collectPiTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };

package/dist/log_config_files/collection/plugin_collector.js

@@ -0,0 +1,223 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { extname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
+import { getInstalledPluginsPath, getPluginHooksPath, getPluginMcpPaths, getPluginSkillFilename, getPluginSkillsDir } from '../paths/path_constants_helpers.js';
+import { versionFromPluginCachePath, parseInstalledPluginKey } from './plugin_version_helpers.js';
+/** Directories never worth shipping: git history is huge and already-compressed, deps are not the skill. */
+const SKILL_SKIP_DIRS = new Set(['.git', 'node_modules']);
+/** Fonts are the single largest thing in skill folders (canvas-design ships 54) and carry no signal. */
+const SKILL_SKIP_EXTS = new Set(['.ttf', '.otf', '.woff', '.woff2']);
+/** Inlined as text; everything else is recorded as path + size + hash. */
+const SKILL_TEXT_EXTS = new Set([
+    '.md', '.txt', '.py', '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.json', '.jsonc',
+    '.sh', '.bash', '.zsh', '.yaml', '.yml', '.xml', '.xsd', '.html', '.css', '.toml',
+    '.lock', '.csv', '.sql', '.rb', '.go', '.java', '.php', '.rs',
+]);
+const SKILL_MAX_FILE_BYTES = 1024 * 1024;
+const SKILL_MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+const SKILL_MAX_FILES = 500;
+const SKILL_MAX_DEPTH = 8;
+/** Hidden files are collected, but credential-shaped ones are recorded without their contents. */
+function isSecretName(name) {
+    const lower = name.toLowerCase();
+    return lower === '.env' || lower.startsWith('.env.') || lower === '.npmrc' || lower === '.netrc'
+        || lower === '.pgpass' || lower.endsWith('.pem') || lower.endsWith('.key');
+}
+function skillMetaRecord(filePath, size, sha256, ver) {
+    return {
+        file_type: 'claude_skill',
+        file_path: filePath,
+        collect_style: 'metadata',
+        raw_content: { source: 'file', size, ...(sha256 ? { sha256 } : {}), ...(ver ? { version: ver } : {}) },
+    };
+}
+function collectSkillDirFiles(dir, results, constants, skillFilename, budget, depth) {
+    if (depth > SKILL_MAX_DEPTH)
+        return;
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch (err) {
+        console.warn(`Error reading skill dir ${dir}:`, err instanceof Error ? err.message : String(err));
+        return;
+    }
+    for (const ent of entries) {
+        if (budget.files >= SKILL_MAX_FILES || budget.bytes >= SKILL_MAX_TOTAL_BYTES)
+            return;
+        const full = join(dir, ent.name);
+        if (ent.isDirectory()) {
+            if (!SKILL_SKIP_DIRS.has(ent.name))
+                collectSkillDirFiles(full, results, constants, skillFilename, budget, depth + 1);
+            continue;
+        }
+        // Symlinks report isSymbolicLink(), not isFile(), so this also keeps the walk inside the skill dir.
+        if (!ent.isFile())
+            continue;
+        const ext = extname(ent.name).toLowerCase();
+        if (SKILL_SKIP_EXTS.has(ext))
+            continue;
+        let size;
+        try {
+            size = statSync(full).size;
+        }
+        catch {
+            continue;
+        }
+        const ver = versionFromPluginCachePath(full, constants);
+        if (size > SKILL_MAX_FILE_BYTES) {
+            results.push(skillMetaRecord(full, size, '', ver));
+            budget.files += 1;
+            continue;
+        }
+        if (!SKILL_TEXT_EXTS.has(ext) && ent.name !== skillFilename) {
+            let sha256 = '';
+            try {
+                sha256 = createHash('sha256').update(readFileSync(full)).digest('hex');
+            }
+            catch {
+                continue;
+            }
+            results.push(skillMetaRecord(full, size, sha256, ver));
+            budget.files += 1;
+            continue;
+        }
+        if (isSecretName(ent.name)) {
+            results.push(skillMetaRecord(full, size, '', ver));
+            budget.files += 1;
+            continue;
+        }
+        const content = readMarkdownFile(full);
+        if (content === null)
+            continue;
+        results.push({ file_type: 'claude_skill', file_path: full, raw_content: { content, source: 'file', ...(ver ? { version: ver } : {}) } });
+        budget.files += 1;
+        budget.bytes += Buffer.byteLength(content);
+    }
+}
+function collectSkillFiles(skillsDir, results, constants) {
+    const skillFilename = getPluginSkillFilename(constants);
+    try {
+        for (const d of readdirSync(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory())) {
+            const skillRoot = join(skillsDir, d.name);
+            if (!existsSync(join(skillRoot, skillFilename)))
+                continue;
+            const budget = { files: 0, bytes: 0 };
+            collectSkillDirFiles(skillRoot, results, constants, skillFilename, budget, 0);
+            if (budget.files >= SKILL_MAX_FILES || budget.bytes >= SKILL_MAX_TOTAL_BYTES) {
+                console.warn(`Skill ${skillRoot} hit collection cap (${budget.files} files, ${budget.bytes} bytes)`);
+            }
+        }
+    }
+    catch (err) {
+        console.warn(`Error reading skills dir ${skillsDir}:`, err instanceof Error ? err.message : String(err));
+    }
+}
+function collectMcpFile(installPath, results, constants) {
+    const mcpPaths = getPluginMcpPaths(constants);
+    for (const rel of mcpPaths) {
+        const mcpPath = join(installPath, rel);
+        if (!existsSync(mcpPath))
+            continue;
+        const content = readJSONFile(mcpPath);
+        if (content !== null) {
+            const ver = versionFromPluginCachePath(mcpPath, constants);
+            results.push({ file_type: 'claude_plugin_mcp', file_path: mcpPath, raw_content: typeof content === 'object' ? { ...content, ...(ver ? { version: ver } : {}) } : content });
+            break;
+        }
+    }
+}
+function collectPluginInstallEntries(pluginKey, entries, results, constants) {
+    const { name: pluginName, publisher } = parseInstalledPluginKey(pluginKey);
+    const skillsDirName = getPluginSkillsDir(constants);
+    const hooksRel = getPluginHooksPath(constants);
+    for (const entry of entries) {
+        const installPath = entry?.installPath;
+        if (!installPath || typeof installPath !== 'string' || !existsSync(installPath))
+            continue;
+        const version = (entry?.version != null && entry?.version !== '') ? String(entry.version).trim() : '';
+        results.push({ file_type: 'claude_plugin_manifest', file_path: installPath, raw_content: { name: pluginName || pluginKey, version, publisher: publisher || '' } });
+        const skillsPath = join(installPath, skillsDirName);
+        if (existsSync(skillsPath))
+            collectSkillFiles(skillsPath, results, constants);
+        const hooksPath = join(installPath, hooksRel);
+        if (existsSync(hooksPath)) {
+            const content = readJSONFile(hooksPath);
+            if (content !== null) {
+                const ver = versionFromPluginCachePath(hooksPath, constants);
+                results.push({ file_type: 'claude_hooks', file_path: hooksPath, raw_content: typeof content === 'object' ? { ...content, ...(ver ? { version: ver } : {}) } : content });
+            }
+        }
+        collectMcpFile(installPath, results, constants);
+    }
+}
+const PLUGIN_CACHE_MCP_FILENAME = '.mcp.json';
+function walkPluginCacheForMcp(dir, results, seenMcpPaths, constants, depth) {
+    if (depth > 12)
+        return;
+    try {
+        for (const ent of readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory() || d.isFile())) {
+            const full = join(dir, ent.name);
+            if (ent.isDirectory()) {
+                walkPluginCacheForMcp(full, results, seenMcpPaths, constants, depth + 1);
+                continue;
+            }
+            if (!ent.isFile() || ent.name !== PLUGIN_CACHE_MCP_FILENAME)
+                continue;
+            if (seenMcpPaths.has(full))
+                continue;
+            const content = readJSONFile(full);
+            if (content === null)
+                continue;
+            seenMcpPaths.add(full);
+            const ver = versionFromPluginCachePath(full, constants);
+            results.push({
+                file_type: 'claude_plugin_mcp',
+                file_path: full,
+                raw_content: typeof content === 'object' ? { ...content, ...(ver ? { version: ver } : {}) } : content,
+            });
+        }
+    }
+    catch {
+        return;
+    }
+}
+/** All plugin MCP manifests under ~/.claude/plugins/cache, whether or not the plugin is enabled. */
+function collectPluginCacheMcpFiles(constants, home = homedir()) {
+    const cacheRoot = join(home, '.claude', 'plugins', 'cache');
+    if (!existsSync(cacheRoot))
+        return [];
+    const results = [];
+    const seenMcpPaths = new Set();
+    walkPluginCacheForMcp(cacheRoot, results, seenMcpPaths, constants, 0);
+    return results;
+}
+function collectConfigFilesFromInstalledPlugins(constants) {
+    const home = homedir();
+    const installedPluginsPath = getInstalledPluginsPath(home, constants);
+    const results = [];
+    if (!existsSync(installedPluginsPath))
+        return results;
+    let manifest;
+    try {
+        const raw = readJSONFile(installedPluginsPath);
+        if (!raw)
+            return results;
+        manifest = raw;
+    }
+    catch {
+        return results;
+    }
+    const plugins = manifest?.plugins;
+    if (!plugins || typeof plugins !== 'object')
+        return results;
+    results.push({ file_type: 'claude_plugin_manifest', file_path: installedPluginsPath, raw_content: manifest });
+    for (const [pluginKey, entries] of Object.entries(plugins)) {
+        if (Array.isArray(entries))
+            collectPluginInstallEntries(pluginKey, entries, results, constants);
+    }
+    return results;
+}
+export { collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles };

package/dist/log_config_files/collection/plugin_version_helpers.js

@@ -0,0 +1,37 @@
+/** Needles used to identify the plugin segment within a cache path. Requires backend client_path_constants. */
+function getPluginPathNeedles(constants) {
+    const needles = [];
+    if (constants.plugin_skills_dir)
+        needles.push(`/${constants.plugin_skills_dir}/`);
+    if (constants.plugin_hooks_path)
+        needles.push(`/${constants.plugin_hooks_path}`);
+    for (const p of constants.plugin_mcp_paths ?? [])
+        needles.push(`/${p}`);
+    if (!needles.length)
+        throw new Error('client_path_constants missing plugin path keys (plugin_skills_dir, plugin_hooks_path, plugin_mcp_paths)');
+    return needles;
+}
+function versionFromPluginCachePath(filePath, constants) {
+    const norm = filePath.replace(/\\/g, '/');
+    if (!norm.includes('plugins/cache/'))
+        return '';
+    const needles = getPluginPathNeedles(constants);
+    let segmentEnd = -1;
+    for (const needle of needles) {
+        const idx = norm.indexOf(needle);
+        if (idx !== -1 && (segmentEnd === -1 || idx < segmentEnd))
+            segmentEnd = idx;
+    }
+    if (segmentEnd === -1)
+        return '';
+    const before = norm.slice(0, segmentEnd);
+    const lastSlash = before.lastIndexOf('/');
+    return lastSlash === -1 ? '' : before.slice(lastSlash + 1).trim();
+}
+function parseInstalledPluginKey(pluginKey) {
+    const at = pluginKey.indexOf('@');
+    if (at === -1)
+        return { name: pluginKey.trim(), publisher: '' };
+    return { name: pluginKey.slice(0, at).trim(), publisher: pluginKey.slice(at + 1).trim() };
+}
+export { versionFromPluginCachePath, parseInstalledPluginKey };