@optimuslabs/runtime-staging 0.3.10 → 0.3.11

package/dist/lib/client-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-event.d.ts","sourceRoot":"","sources":["../../src/lib/client-event.ts"],"names":[],"mappings":"AAgEA,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,SAAS,GAAG,IAAI,GAAG,QAAQ,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAuBF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChF"}
+{"version":3,"file":"client-event.d.ts","sourceRoot":"","sources":["../../src/lib/client-event.ts"],"names":[],"mappings":"AAiEA,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,SAAS,GAAG,IAAI,GAAG,QAAQ,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA2DF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhF"}

package/dist/lib/client-event.js

@@ -13,6 +13,7 @@ import { fileURLToPath } from "url";
 import { loadEndpointBase, createSignature, readStoredAuthKey } from "./tofu.js";
 import { resolveHardwareUuid } from "./hardware-uuid.js";
 import { OPTIMUS_AUTH_KEY_RELATIVE_PATH } from "./machine-auth.js";
+import { SCRUBBER_VERSION, scrubFields } from "./pii-scrub.js";
 const SEND_TIMEOUT_MS = 4000;
 /** This package's name + version as "<name>: <version>", read from its own package.json. */
 function readPackageVersion() {
@@ -69,6 +70,7 @@ function metadata(agent) {
         node: process.version,
         pid: String(process.pid),
         reporter_version: readPackageVersion(),
+        scrubber_version: SCRUBBER_VERSION,
         source: "tool_call",
     };
     if (process.env.OPTIMUS_HOOK_SCRIPT_VERSION)
@@ -85,37 +87,45 @@ function resolveHookRunId(storyId) {
         return fromEnv;
     return `${storyId}::tool_call`;
 }
+/**
+ * The run record. Its command, message and detail are free text (a failure's log, a command
+ * line), so they are scrubbed like tool-call content before they leave the machine.
+ */
+function toolCallRunEvent(fields, storyId, agent) {
+    return scrubFields({
+        kind: "functional_run",
+        unit: "tool_call",
+        command: fields.command ?? "optimus-tool-call",
+        hook_name: "tool_call",
+        story_id: storyId,
+        hook_run_id: resolveHookRunId(storyId),
+        outcome: fields.outcome,
+        exit_code: fields.exit_code ?? null,
+        message: fields.message ?? "",
+        detail: fields.detail ?? "",
+        ...(agent ? { agent } : {}),
+        metadata: metadata(agent),
+    }, ["command", "message", "detail"]);
+}
+/** The signature over `payload`, or "" when there is no machine key (the backend accepts unsigned). */
+function signatureFor(payload) {
+    try {
+        const authKey = readStoredAuthKey({ authRelativePath: OPTIMUS_AUTH_KEY_RELATIVE_PATH });
+        return authKey?.key ? createSignature(payload, authKey.key) : "";
+    }
+    catch {
+        // unsigned is accepted by the backend (signature_valid=false)
+        return "";
+    }
+}
 export async function reportToolCallRun(fields) {
     try {
         const hardwareUuid = resolveHardwareUuid();
         const storyId = resolveStoryId();
         const agent = resolveReportingAgent(fields.agent);
-        const events = [
-            {
-                kind: "functional_run",
-                unit: "tool_call",
-                command: fields.command ?? "optimus-tool-call",
-                hook_name: "tool_call",
-                story_id: storyId,
-                hook_run_id: resolveHookRunId(storyId),
-                outcome: fields.outcome,
-                exit_code: fields.exit_code ?? null,
-                message: fields.message ?? "",
-                detail: fields.detail ?? "",
-                ...(agent ? { agent } : {}),
-                metadata: metadata(agent),
-            },
-        ];
+        const events = [toolCallRunEvent(fields, storyId, agent)];
         const signingPayload = { hardware_uuid: hardwareUuid, events };
-        let signature = "";
-        try {
-            const authKey = readStoredAuthKey({ authRelativePath: OPTIMUS_AUTH_KEY_RELATIVE_PATH });
-            if (authKey?.key)
-                signature = createSignature(signingPayload, authKey.key);
-        }
-        catch {
-            // unsigned is accepted by the backend (signature_valid=false)
-        }
+        const signature = signatureFor(signingPayload);
         const endpoint = `${loadEndpointBase().replace(/\/+$/, "")}/endpoint_security/api/client-event/`;
         if (typeof fetch === "undefined")
             return;

package/dist/lib/client-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-event.js","sourceRoot":"","sources":["../../src/lib/client-event.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,4FAA4F;AAC5F,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA0C,CAAC;QACrG,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,IAAI,IAAI,OAAO;YAAE,OAAO,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC;QAClD,OAAO,OAAO,IAAI,IAAI,IAAI,SAAS,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG,MAAO,CAAC;AAEtC,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACzD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACzF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC;gBACrD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnD,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,YAAY,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnF,0FAA0F;AAC1F,SAAS,qBAAqB,CAAC,QAAiB;IAC9C,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxG,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,YAAY,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,SAAS,QAAQ,CAAC,KAAoB;IACpC,MAAM,GAAG,GAA2B;QAClC,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE;QACnB,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;QAC/C,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACxB,gBAAgB,EAAE,kBAAkB,EAAE;QACtC,MAAM,EAAE,WAAW;KACpB,CAAC;IACF,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B;QAAE,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC/G,IAAI,KAAK;QAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAAE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,GAAG,OAAO,aAAa,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAyB;IAC/D,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG;YACb;gBACE,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,mBAAmB;gBAC9C,SAAS,EAAE,WAAW;gBACtB,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;gBACnC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;gBAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;aAC1B;SACF,CAAC;QACF,MAAM,cAAc,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAC/D,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACxF,IAAI,OAAO,EAAE,GAAG;gBAAE,SAAS,GAAG,eAAe,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,sCAAsC,CAAC;QACjG,IAAI,OAAO,KAAK,KAAK,WAAW;YAAE,OAAO;QACzC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,CAAC;gBACtD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC"}
+{"version":3,"file":"client-event.js","sourceRoot":"","sources":["../../src/lib/client-event.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE/D,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,4FAA4F;AAC5F,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA0C,CAAC;QACrG,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,IAAI,IAAI,OAAO;YAAE,OAAO,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC;QAClD,OAAO,OAAO,IAAI,IAAI,IAAI,SAAS,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG,MAAO,CAAC;AAEtC,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACzD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACzF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC;gBACrD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnD,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,YAAY,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnF,0FAA0F;AAC1F,SAAS,qBAAqB,CAAC,QAAiB;IAC9C,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxG,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,YAAY,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,SAAS,QAAQ,CAAC,KAAoB;IACpC,MAAM,GAAG,GAA2B;QAClC,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE;QACnB,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;QAC/C,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACxB,gBAAgB,EAAE,kBAAkB,EAAE;QACtC,gBAAgB,EAAE,gBAAgB;QAClC,MAAM,EAAE,WAAW;KACpB,CAAC;IACF,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B;QAAE,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC/G,IAAI,KAAK;QAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAAE,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,GAAG,OAAO,aAAa,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAyB,EAAE,OAAe,EAAE,KAAoB;IACxF,OAAO,WAAW,CAChB;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,mBAAmB;QAC9C,SAAS,EAAE,WAAW;QACtB,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC;QACtC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;KAC1B,EACD,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,SAAS,YAAY,CAAC,OAAgC;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACxF,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAyB;IAC/D,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,sCAAsC,CAAC;QACjG,IAAI,OAAO,KAAK,KAAK,WAAW;YAAE,OAAO;QACzC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,CAAC;gBACtD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC"}

package/dist/lib/pii-scrub.d.ts

@@ -0,0 +1,9 @@
+/**
+ * pii-scrub shim: the one place that imports @optimuslabs/pii-scrub-staging.
+ *
+ * Loaded the way lib/tofu.ts loads tofu: the sibling local dist when environment=development,
+ * the published npm package otherwise.
+ */
+import type * as PiiScrubTypes from "@optimuslabs/pii-scrub-staging";
+export declare const SCRUBBER_VERSION: string, scrubFields: typeof PiiScrubTypes.scrubFields, scrubText: typeof PiiScrubTypes.scrubText, scrubValue: typeof PiiScrubTypes.scrubValue;
+//# sourceMappingURL=pii-scrub.d.ts.map

package/dist/lib/pii-scrub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-scrub.d.ts","sourceRoot":"","sources":["../../src/lib/pii-scrub.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,KAAK,aAAa,MAAM,gCAAgC,CAAC;AAarE,eAAO,MAAQ,gBAAgB,UAAE,WAAW,oCAAE,SAAS,kCAAE,UAAU,iCAAa,CAAC"}

package/dist/lib/pii-scrub.js

@@ -0,0 +1,17 @@
+/**
+ * pii-scrub shim: the one place that imports @optimuslabs/pii-scrub-staging.
+ *
+ * Loaded the way lib/tofu.ts loads tofu: the sibling local dist when environment=development,
+ * the published npm package otherwise.
+ */
+import path from "path";
+import { fileURLToPath } from "url";
+import { isDevelopment } from "./tofu.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// dist/lib/pii-scrub.js → ../../.. → optimuslabs/pii-scrub/dist/index.js
+const localPiiScrubPath = path.join(__dirname, "../../../pii-scrub/dist/index.js");
+const piiScrub = (isDevelopment
+    ? await import(localPiiScrubPath)
+    : await import("@optimuslabs/pii-scrub-staging"));
+export const { SCRUBBER_VERSION, scrubFields, scrubText, scrubValue } = piiScrub;
+//# sourceMappingURL=pii-scrub.js.map

package/dist/lib/pii-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-scrub.js","sourceRoot":"","sources":["../../src/lib/pii-scrub.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CACf,aAAa;IACX,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC;IACjC,CAAC,CAAC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAC3B,CAAC;AAE1B,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC"}

package/dist/lib/prompt-collection-policy.d.ts

@@ -1,5 +1,15 @@
 export declare function orgConfigPath(): string;
 export declare function readCollectPrompts(): boolean;
+/**
+ * The org key the backend sends in the startup and inventory responses (`fingerprint_key`),
+ * or undefined until it has arrived: the prompt hash stays plain SHA-256 and secrets get no
+ * fingerprint until then.
+ */
+export declare function readFingerprintKey(): string | undefined;
 export declare function persistCollectPrompts(value: unknown): void;
+/**
+ * Store the org options a startup or inventory response carries: prompt collection, the org key
+ * and whether to scrub.
+ */
 export declare function persistCollectPromptsFromResponse(body: Record<string, unknown> | null | undefined): void;
 //# sourceMappingURL=prompt-collection-policy.d.ts.map

package/dist/lib/prompt-collection-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-collection-policy.d.ts","sourceRoot":"","sources":["../../src/lib/prompt-collection-policy.ts"],"names":[],"mappings":"AAOA,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAsBD,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAW1D;AAED,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CASxG"}
+{"version":3,"file":"prompt-collection-policy.d.ts","sourceRoot":"","sources":["../../src/lib/prompt-collection-policy.ts"],"names":[],"mappings":"AAOA,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAsBD,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAKD;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAGvD;AAYD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAO1D;AAgBD;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAWxG"}

package/dist/lib/prompt-collection-policy.js

@@ -30,23 +30,59 @@ function collectPromptsFromConfig(cfg) {
 export function readCollectPrompts() {
     return collectPromptsFromConfig(readOrgConfig());
 }
-export function persistCollectPrompts(value) {
-    if (typeof value !== "boolean")
-        return;
+/** The org's fingerprint key: hex, at least 128 bits. Keys the prompt hash and secret fingerprints. */
+const FINGERPRINT_KEY = /^(?:[0-9a-f]{2}){16,}$/i;
+/**
+ * The org key the backend sends in the startup and inventory responses (`fingerprint_key`),
+ * or undefined until it has arrived: the prompt hash stays plain SHA-256 and secrets get no
+ * fingerprint until then.
+ */
+export function readFingerprintKey() {
+    const key = readOrgConfig().fingerprint_key;
+    return typeof key === "string" && FINGERPRINT_KEY.test(key) ? key : undefined;
+}
+function writeOrgConfig(update) {
     const filePath = orgConfigPath();
     try {
         fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        const next = { ...readOrgConfig(), collect_prompts: value };
-        delete next.hash_tool_call_prompts;
-        fs.writeFileSync(filePath, `${JSON.stringify(next)}\n`, { encoding: "utf8", mode: 0o600 });
+        fs.writeFileSync(filePath, `${JSON.stringify(update(readOrgConfig()))}\n`, { encoding: "utf8", mode: 0o600 });
     }
     catch {
         // Best-effort: next heartbeat can retry.
     }
 }
+export function persistCollectPrompts(value) {
+    if (typeof value !== "boolean")
+        return;
+    writeOrgConfig((current) => {
+        const next = { ...current, collect_prompts: value };
+        delete next.hash_tool_call_prompts;
+        return next;
+    });
+}
+function persistFingerprintKey(value) {
+    if (typeof value !== "string" || !FINGERPRINT_KEY.test(value) || value === readFingerprintKey())
+        return;
+    writeOrgConfig((current) => ({ ...current, fingerprint_key: value }));
+}
+/**
+ * Whether the organization scrubs what endpoints send (OPT-942), read by `@optimuslabs/pii-scrub`
+ * from this file: only an explicit `false` switches scrubbing off.
+ */
+function persistScrubPii(value) {
+    if (typeof value !== "boolean" || readOrgConfig().scrub_pii === value)
+        return;
+    writeOrgConfig((current) => ({ ...current, scrub_pii: value }));
+}
+/**
+ * Store the org options a startup or inventory response carries: prompt collection, the org key
+ * and whether to scrub.
+ */
 export function persistCollectPromptsFromResponse(body) {
     if (!body || typeof body !== "object")
         return;
+    persistFingerprintKey(body.fingerprint_key);
+    persistScrubPii(body.scrub_pii);
     if (typeof body.collect_prompts === "boolean") {
         persistCollectPrompts(body.collect_prompts);
         return;

package/dist/lib/prompt-collection-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-collection-policy.js","sourceRoot":"","sources":["../../src/lib/prompt-collection-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,2FAA2F;AAC3F,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AAE/F,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAY,CAAC;QAC/E,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,wBAAwB,CAAC,GAA4B;IAC5D,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,eAAe,CAAC;IACzE,mEAAmE;IACnE,IAAI,OAAO,GAAG,CAAC,sBAAsB,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,sBAAsB,KAAK,IAAI,CAAC;IAChG,4DAA4D;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,wBAAwB,CAAC,aAAa,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO;IACvC,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAA4B,EAAE,GAAG,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACrF,OAAO,IAAI,CAAC,sBAAsB,CAAC;QACnC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,IAAgD;IAChG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC9C,qBAAqB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACrD,qBAAqB,CAAC,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}
+{"version":3,"file":"prompt-collection-policy.js","sourceRoot":"","sources":["../../src/lib/prompt-collection-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,2FAA2F;AAC3F,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AAE/F,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAY,CAAC;QAC/E,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,wBAAwB,CAAC,GAA4B;IAC5D,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,eAAe,CAAC;IACzE,mEAAmE;IACnE,IAAI,OAAO,GAAG,CAAC,sBAAsB,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,sBAAsB,KAAK,IAAI,CAAC;IAChG,4DAA4D;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,wBAAwB,CAAC,aAAa,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,uGAAuG;AACvG,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC,eAAe,CAAC;IAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,SAAS,cAAc,CAAC,MAAqE;IAC3F,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO;IACvC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE;QACzB,MAAM,IAAI,GAA4B,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,sBAAsB,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,kBAAkB,EAAE;QAAE,OAAO;IACxG,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,aAAa,EAAE,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO;IAC9E,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAAC,IAAgD;IAChG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,qBAAqB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5C,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC9C,qBAAqB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACrD,qBAAqB,CAAC,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/lib/startup-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startup-sync.d.ts","sourceRoot":"","sources":["../../src/lib/startup-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuEH,wBAAsB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8GrF"}
+{"version":3,"file":"startup-sync.d.ts","sourceRoot":"","sources":["../../src/lib/startup-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqLH,wBAAsB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBrF"}

package/dist/lib/startup-sync.js

@@ -12,6 +12,7 @@
 import { buildStartupEndpointUrl, createSignature, loadEndpointBase, persistAuthKey, readStoredAuthKey, } from "./tofu.js";
 import { OPTIMUS_AUTH_KEY_RELATIVE_PATH, resetToolCallAuthCache } from "./machine-auth.js";
 import { persistCollectPromptsFromResponse } from "./prompt-collection-policy.js";
+import { SCRUBBER_VERSION, scrubText } from "./pii-scrub.js";
 import { resolveUserProfile } from "./user-profile.js";
 import fs from "node:fs";
 import os from "node:os";
@@ -65,52 +66,59 @@ function readOrganizationUuid() {
         return "";
     }
 }
-export async function ensureStartupMetadataSynced(hardwareUuid) {
-    if (process.env.OPTIMUS_SKIP_STARTUP_SYNC === "1")
-        return;
+function startupSyncIntervalMs() {
     const rawInterval = process.env.OPTIMUS_STARTUP_SYNC_INTERVAL_MS;
-    let intervalMs = DEFAULT_STARTUP_SYNC_INTERVAL_MS;
-    if (rawInterval !== undefined && rawInterval !== "") {
-        const parsed = parseInt(rawInterval, 10);
-        intervalMs =
-            Number.isNaN(parsed) || parsed < 0 ? DEFAULT_STARTUP_SYNC_INTERVAL_MS : parsed;
-    }
-    const now = Date.now();
-    if (shouldSkipStartupSyncDueToCooldown(now, intervalMs)) {
-        return;
-    }
-    const timestamp = new Date().toISOString();
-    const payloadSummary = {
-        timestamp,
-        directory: process.cwd(),
-        hardware_uuid: hardwareUuid,
-    };
-    let user_profile;
+    if (rawInterval === undefined || rawInterval === "")
+        return DEFAULT_STARTUP_SYNC_INTERVAL_MS;
+    const parsed = parseInt(rawInterval, 10);
+    return Number.isNaN(parsed) || parsed < 0 ? DEFAULT_STARTUP_SYNC_INTERVAL_MS : parsed;
+}
+function startupUserProfile() {
     try {
-        user_profile = { ...resolveUserProfile() };
+        return { ...resolveUserProfile() };
     }
     catch (err) {
         console.error(`[optimus-tool-call] resolveUserProfile failed; continuing startup sync with empty profile: ${err instanceof Error ? err.message : String(err)}`);
-        user_profile = emptyUserProfile();
+        return emptyUserProfile();
     }
-    const github_username = (typeof user_profile.github_username === "string" && user_profile.github_username.trim()) ||
+}
+function githubUsername(profile) {
+    return ((typeof profile.github_username === "string" && profile.github_username.trim()) ||
         process.env.GITHUB_USER ||
         process.env.GH_USER ||
-        "";
-    const metadata = {
-        github_username,
+        "");
+}
+/**
+ * The machine's metadata for the startup request. The git remote in `repo_identifier` can embed a
+ * token (`https://user:token@host/owner/repo`), so it is scrubbed, and the scrubber's version is
+ * sent; `metadata` is not part of the signed summary.
+ */
+function startupMetadata() {
+    const user_profile = startupUserProfile();
+    return {
+        github_username: githubUsername(user_profile),
         org_identifier: process.env.GITHUB_ORG || "",
         organization_uuid: readOrganizationUuid(),
-        repo_identifier: process.env.GITHUB_REPOSITORY || "",
+        repo_identifier: scrubText(process.env.GITHUB_REPOSITORY || ""),
         branch: process.env.GITHUB_REF_NAME || process.env.BRANCH_NAME || "",
         commit_sha: process.env.GITHUB_SHA || "",
         agent_name: process.env.OPTIMUS_AGENT || "",
         user_profile,
+        scrubber_version: SCRUBBER_VERSION,
+    };
+}
+/** The startup request: the summary, signed with this machine's key when it has one, and the metadata. */
+function buildStartupBody(hardwareUuid) {
+    const timestamp = new Date().toISOString();
+    const payloadSummary = {
+        timestamp,
+        directory: process.cwd(),
+        hardware_uuid: hardwareUuid,
     };
     const body = {
         hardware_uuid: hardwareUuid,
         payload: payloadSummary,
-        metadata,
+        metadata: startupMetadata(),
         scan_timestamp: timestamp,
     };
     const storedKey = readStoredAuthKey({
@@ -121,42 +129,56 @@ export async function ensureStartupMetadataSynced(hardwareUuid) {
         if (storedKey.key_id)
             body.key_id = storedKey.key_id;
     }
+    return body;
+}
+async function postStartupBody(url, body) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 5000);
+    try {
+        return await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
+/** Store what a successful startup response carries (a new key, the org's options); true when it parsed. */
+function applyStartupResponse(text, hardwareUuid) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.status === "key_issued" && typeof parsed.key === "string") {
+        persistAuthKey(parsed.key, typeof parsed.key_id === "string" ? parsed.key_id : null, hardwareUuid, { authRelativePath: OPTIMUS_AUTH_KEY_RELATIVE_PATH });
+        resetToolCallAuthCache();
+    }
+    persistCollectPromptsFromResponse(parsed);
+    return true;
+}
+export async function ensureStartupMetadataSynced(hardwareUuid) {
+    if (process.env.OPTIMUS_SKIP_STARTUP_SYNC === "1")
+        return;
+    if (shouldSkipStartupSyncDueToCooldown(Date.now(), startupSyncIntervalMs())) {
+        return;
+    }
+    const body = buildStartupBody(hardwareUuid);
     const url = buildStartupEndpointUrl(loadEndpointBase());
     try {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 5000);
-        let res;
-        try {
-            res = await fetch(url, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify(body),
-                signal: controller.signal,
-            });
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        const res = await postStartupBody(url, body);
         const text = await res.text();
         if (!res.ok) {
             console.error(`[optimus-tool-call] startup metadata sync failed ${res.status}: ${text ? text.slice(0, 240) : res.statusText}`);
             recordStartupSyncAttemptEnd(false);
             return;
         }
-        let parsed = {};
-        try {
-            parsed = JSON.parse(text);
-        }
-        catch {
-            recordStartupSyncAttemptEnd(false);
-            return;
-        }
-        if (parsed.status === "key_issued" && typeof parsed.key === "string") {
-            persistAuthKey(parsed.key, typeof parsed.key_id === "string" ? parsed.key_id : null, hardwareUuid, { authRelativePath: OPTIMUS_AUTH_KEY_RELATIVE_PATH });
-            resetToolCallAuthCache();
-        }
-        persistCollectPromptsFromResponse(parsed);
-        recordStartupSyncAttemptEnd(true);
+        recordStartupSyncAttemptEnd(applyStartupResponse(text, hardwareUuid));
     }
     catch (err) {
         console.error(`[optimus-tool-call] startup metadata sync error: ${err instanceof Error ? err.message : String(err)}`);

package/dist/lib/startup-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"startup-sync.js","sourceRoot":"","sources":["../../src/lib/startup-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAoB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,GAAgB,EAAE,CAAC,CAAC;IAC3C,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;IAChB,eAAe,EAAE,EAAE;IACnB,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,OAAS,CAAC;AACnD,MAAM,oCAAoC,GAAG,IAAK,CAAC;AACnD,MAAM,mCAAmC,GAAG,MAAO,CAAC;AAEpD,IAAI,yBAAyB,GAAG,CAAC,CAAC;AAClC,8EAA8E;AAC9E,IAAI,oBAAoB,GAAG,IAAI,CAAC;AAChC,IAAI,wBAAwB,GAAG,CAAC,CAAC;AAEjC,SAAS,2BAA2B,CAAC,EAAW;IAC9C,yBAAyB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,oBAAoB,GAAG,EAAE,CAAC;IAC1B,IAAI,EAAE,EAAE,CAAC;QACP,wBAAwB,GAAG,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,wBAAwB,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CAAC,GAAW,EAAE,UAAkB;IACzE,IAAI,yBAAyB,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,gBAAgB,GAAG,CAAC,oBAAoB;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CACN,mCAAmC,EACnC,oCAAoC;YAClC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAC9D;QACH,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,iBAAiB,GAAG,oBAAoB,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IACjE,OAAO,UAAU,GAAG,CAAC,IAAI,GAAG,GAAG,yBAAyB,GAAG,UAAU,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC1G,OAAO,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,YAAoB;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAAE,OAAO;IAE1D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACjE,IAAI,UAAU,GAAG,gCAAgC,CAAC;IAClD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzC,UAAU;YACR,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG;QACrB,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;QACxB,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,YAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,YAAY,GAAG,EAAE,GAAG,kBAAkB,EAAE,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,8FACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACF,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACpC,CAAC;IACD,MAAM,eAAe,GACnB,CAAC,OAAO,YAAY,CAAC,eAAe,KAAK,QAAQ,IAAI,YAAY,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG;QACf,eAAe;QACf,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QAC5C,iBAAiB,EAAE,oBAAoB,EAAE;QACzC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;QACpD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE;QACpE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;QAC3C,YAAY;KACb,CAAC;IACF,MAAM,IAAI,GAA4B;QACpC,aAAa,EAAE,YAAY;QAC3B,OAAO,EAAE,cAAc;QACvB,QAAQ;QACR,cAAc,EAAE,SAAS;KAC1B,CAAC;IAEF,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,gBAAgB,EAAE,8BAA8B;KACjD,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,oDAAoD,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAChH,CAAC;YACF,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,MAAM,GAA4B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrE,cAAc,CACZ,MAAM,CAAC,GAAG,EACV,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EACxD,YAAY,EACZ,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CACrD,CAAC;YACF,sBAAsB,EAAE,CAAC;QAC3B,CAAC;QACD,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAC1C,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,oDAAoD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvG,CAAC;QACF,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}
+{"version":3,"file":"startup-sync.js","sourceRoot":"","sources":["../../src/lib/startup-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAoB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,GAAgB,EAAE,CAAC,CAAC;IAC3C,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;IAChB,eAAe,EAAE,EAAE;IACnB,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,OAAS,CAAC;AACnD,MAAM,oCAAoC,GAAG,IAAK,CAAC;AACnD,MAAM,mCAAmC,GAAG,MAAO,CAAC;AAEpD,IAAI,yBAAyB,GAAG,CAAC,CAAC;AAClC,8EAA8E;AAC9E,IAAI,oBAAoB,GAAG,IAAI,CAAC;AAChC,IAAI,wBAAwB,GAAG,CAAC,CAAC;AAEjC,SAAS,2BAA2B,CAAC,EAAW;IAC9C,yBAAyB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,oBAAoB,GAAG,EAAE,CAAC;IAC1B,IAAI,EAAE,EAAE,CAAC;QACP,wBAAwB,GAAG,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,wBAAwB,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CAAC,GAAW,EAAE,UAAkB;IACzE,IAAI,yBAAyB,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,gBAAgB,GAAG,CAAC,oBAAoB;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CACN,mCAAmC,EACnC,oCAAoC;YAClC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAC9D;QACH,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,iBAAiB,GAAG,oBAAoB,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IACjE,OAAO,UAAU,GAAG,CAAC,IAAI,GAAG,GAAG,yBAAyB,GAAG,UAAU,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC1G,OAAO,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACjE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,gCAAgC,CAAC;IAC7F,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,MAAM,CAAC;AACxF,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,OAAO,EAAE,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,8FACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACF,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAoB;IAC1C,OAAO,CACL,CAAC,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe;IACtB,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,OAAO;QACL,eAAe,EAAE,cAAc,CAAC,YAAY,CAAC;QAC7C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QAC5C,iBAAiB,EAAE,oBAAoB,EAAE;QACzC,eAAe,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC/D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE;QACpE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;QAC3C,YAAY;QACZ,gBAAgB,EAAE,gBAAgB;KACnC,CAAC;AACJ,CAAC;AAED,0GAA0G;AAC1G,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG;QACrB,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;QACxB,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,MAAM,IAAI,GAA4B;QACpC,aAAa,EAAE,YAAY;QAC3B,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,eAAe,EAAE;QAC3B,cAAc,EAAE,SAAS;KAC1B,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,gBAAgB,EAAE,8BAA8B;KACjD,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,IAA6B;IACvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,SAAS,oBAAoB,CAAC,IAAY,EAAE,YAAoB;IAC9D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrE,cAAc,CACZ,MAAM,CAAC,GAAG,EACV,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EACxD,YAAY,EACZ,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CACrD,CAAC;QACF,sBAAsB,EAAE,CAAC;IAC3B,CAAC;IACD,iCAAiC,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,YAAoB;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAAE,OAAO;IAC1D,IAAI,kCAAkC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,oDAAoD,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAChH,CAAC;YACF,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,2BAA2B,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,oDAAoD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvG,CAAC;QACF,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/lib/telemetry/build-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-event.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/build-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA0DjE;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACtC,aAAa,GAAE,MAAkB,EACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,cAAc,GAAG,IAAI,CA4BvB"}
+{"version":3,"file":"build-event.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/build-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA2EjE;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACtC,aAAa,GAAE,MAAkB,EACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,cAAc,GAAG,IAAI,CA6BvB"}

package/dist/lib/telemetry/build-event.js

@@ -1,5 +1,6 @@
-import { readCollectPrompts } from "../prompt-collection-policy.js";
+import { readCollectPrompts, readFingerprintKey } from "../prompt-collection-policy.js";
 import { applyPromptCollectionToMetadata } from "./prompt-privacy.js";
+import os from "node:os";
 import { readLogin } from "../login.js";
 import { readAgentProduct, readCopilotProduct } from "../transcript.js";
 /**
@@ -22,6 +23,20 @@ function hookManifest() {
         return null;
     }
 }
+/**
+ * The macOS account running the agent, read on every event: after a handover, or from a second
+ * account on the same Mac, the event carries who ran it rather than whoever last synced the
+ * machine's profile. Left out if the account cannot be looked up.
+ */
+function osUser() {
+    try {
+        const { uid, username } = os.userInfo();
+        return username ? { uid, username } : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Which product of the agent's family ran the tool (OPT-1488). Codex's CLI, desktop app, ChatGPT
  * Work and VS Code send identical hook fields, so it is read from the session file Codex names in
@@ -44,6 +59,7 @@ function optionalMetadata(inv, agentIdentity) {
     const manifest = hookManifest();
     // Tenant and email the agent is signed in with, read on every call; absent when unreadable.
     const login = readLogin(agentIdentity);
+    const account = osUser();
     return {
         ...(inv.user_prompt ? { user_prompt: inv.user_prompt } : {}),
         ...(inv.raw_event ? { raw_event: inv.raw_event } : {}),
@@ -51,6 +67,7 @@ function optionalMetadata(inv, agentIdentity) {
         ...(hookHash ? { hook_hash: hookHash } : {}),
         ...(manifest ? { hook_manifest: manifest } : {}),
         ...(login ? { login } : {}),
+        ...(account ? { os_user: account } : {}),
     };
 }
 /**
@@ -71,7 +88,7 @@ export function buildTelemetryEvent(inv, agentIdentity = "unknown", sessionId) {
         tool_name: toolNameNorm || toolName,
         tool_input: normalizedToolInput,
         ...optionalMetadata(inv, agentIdentity),
-    }, !readCollectPrompts());
+    }, !readCollectPrompts(), readFingerprintKey());
     return {
         timestamp: new Date().toISOString(),
         agent_identity: agentIdentity,

package/dist/lib/telemetry/build-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-event.js","sourceRoot":"","sources":["../../../src/lib/telemetry/build-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC,MAAM,CACtE,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CACtF,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAmB,EAAE,aAAqB;IAC9D,MAAM,cAAc,GAAG,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC;IACtD,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,aAAa,KAAK,OAAO,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,GAAmB,EAAE,aAAqB;IAClE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACtE,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,4FAA4F;IAC5F,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsC,EACtC,gBAAwB,SAAS,EACjC,SAAyB;IAEzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAC/B,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,mBAAmB,GAA4B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAE1E,MAAM,IAAI,GAAG,+BAA+B,CAC1C;QACE,SAAS,EAAE,YAAY,IAAI,QAAQ;QACnC,UAAU,EAAE,mBAAmB;QAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC;KACxC,EACD,CAAC,kBAAkB,EAAE,CACtB,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,iBAAiB,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QAClC,kBAAkB,EAAE,IAA4C;KACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"build-event.js","sourceRoot":"","sources":["../../../src/lib/telemetry/build-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC,MAAM,CACtE,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CACtF,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM;IACb,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAmB,EAAE,aAAqB;IAC9D,MAAM,cAAc,GAAG,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC;IACtD,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,aAAa,KAAK,OAAO,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,GAAmB,EAAE,aAAqB;IAClE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACtE,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,4FAA4F;IAC5F,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;IACzB,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsC,EACtC,gBAAwB,SAAS,EACjC,SAAyB;IAEzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAC/B,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,mBAAmB,GAA4B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAE1E,MAAM,IAAI,GAAG,+BAA+B,CAC1C;QACE,SAAS,EAAE,YAAY,IAAI,QAAQ;QACnC,UAAU,EAAE,mBAAmB;QAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC;KACxC,EACD,CAAC,kBAAkB,EAAE,EACrB,kBAAkB,EAAE,CACrB,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,iBAAiB,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QAClC,kBAAkB,EAAE,IAA4C;KACjE,CAAC;AACJ,CAAC"}

package/dist/lib/telemetry/index.d.ts

@@ -5,5 +5,5 @@ export * from "./types.js";
 export * from "./canonical.js";
 export { eventToDict } from "./serialize.js";
 export { buildTelemetryEvent } from "./build-event.js";
-export { cloneToolCallMetadataForWire, SERVER_OWNED_TOOL_CALL_METADATA_KEYS, } from "./wire-metadata.js";
+export { cloneToolCallMetadataForWire, WIRE_RAW_EVENT_KEYS, WIRE_TOOL_CALL_METADATA_KEYS, } from "./wire-metadata.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/telemetry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC"}

package/dist/lib/telemetry/index.js

@@ -5,5 +5,5 @@ export * from "./types.js";
 export * from "./canonical.js";
 export { eventToDict } from "./serialize.js";
 export { buildTelemetryEvent } from "./build-event.js";
-export { cloneToolCallMetadataForWire, SERVER_OWNED_TOOL_CALL_METADATA_KEYS, } from "./wire-metadata.js";
+export { cloneToolCallMetadataForWire, WIRE_RAW_EVENT_KEYS, WIRE_TOOL_CALL_METADATA_KEYS, } from "./wire-metadata.js";
 //# sourceMappingURL=index.js.map

package/dist/lib/telemetry/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/telemetry/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/telemetry/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC"}

package/dist/lib/telemetry/prompt-privacy.d.ts

@@ -1,5 +1,11 @@
 export declare const RAW_EVENT_PROMPT_KEYS: readonly ["user_prompt", "userPrompt", "prompt"];
 export declare function sha256UserPrompt(text: string): string;
+/**
+ * The prompt's grouping hash: HMAC-SHA256 under the org key once it has arrived, so a short prompt
+ * cannot be recovered by hashing guesses; plain SHA-256 before then (the first run after the
+ * upgrade), as before. Either is 64 hex characters, which the backend stores as sent.
+ */
+export declare function hashUserPrompt(text: string, orgKey?: string): string;
 export declare function stripRawEventPromptFields(rawEvent: Record<string, unknown> | undefined | null): Record<string, unknown> | undefined;
-export declare function applyPromptCollectionToMetadata(meta: Record<string, unknown>, hashPrompts: boolean): Record<string, unknown>;
+export declare function applyPromptCollectionToMetadata(meta: Record<string, unknown>, hashPrompts: boolean, orgKey?: string): Record<string, unknown>;
 //# sourceMappingURL=prompt-privacy.d.ts.map

package/dist/lib/telemetry/prompt-privacy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-privacy.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/prompt-privacy.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,kDAAmD,CAAC;AAEtF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,GACnD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,OAAO,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBzB"}
+{"version":3,"file":"prompt-privacy.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/prompt-privacy.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,kDAAmD,CAAC;AAEtF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,GACnD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,OAAO,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBzB"}