@optimuslabs/runtime 0.3.4 → 0.3.12

package/dist/lib/startup-sync.js

@@ -12,6 +12,7 @@
 import { buildStartupEndpointUrl, createSignature, loadEndpointBase, persistAuthKey, readStoredAuthKey, } from "./tofu.js";
 import { OPTIMUS_AUTH_KEY_RELATIVE_PATH, resetToolCallAuthCache } from "./machine-auth.js";
 import { persistCollectPromptsFromResponse } from "./prompt-collection-policy.js";
+import { SCRUBBER_VERSION, scrubText } from "./pii-scrub.js";
 import { resolveUserProfile } from "./user-profile.js";
 import fs from "node:fs";
 import os from "node:os";
@@ -65,52 +66,59 @@ function readOrganizationUuid() {
         return "";
     }
 }
-export async function ensureStartupMetadataSynced(hardwareUuid) {
-    if (process.env.OPTIMUS_SKIP_STARTUP_SYNC === "1")
-        return;
+function startupSyncIntervalMs() {
     const rawInterval = process.env.OPTIMUS_STARTUP_SYNC_INTERVAL_MS;
-    let intervalMs = DEFAULT_STARTUP_SYNC_INTERVAL_MS;
-    if (rawInterval !== undefined && rawInterval !== "") {
-        const parsed = parseInt(rawInterval, 10);
-        intervalMs =
-            Number.isNaN(parsed) || parsed < 0 ? DEFAULT_STARTUP_SYNC_INTERVAL_MS : parsed;
-    }
-    const now = Date.now();
-    if (shouldSkipStartupSyncDueToCooldown(now, intervalMs)) {
-        return;
-    }
-    const timestamp = new Date().toISOString();
-    const payloadSummary = {
-        timestamp,
-        directory: process.cwd(),
-        hardware_uuid: hardwareUuid,
-    };
-    let user_profile;
+    if (rawInterval === undefined || rawInterval === "")
+        return DEFAULT_STARTUP_SYNC_INTERVAL_MS;
+    const parsed = parseInt(rawInterval, 10);
+    return Number.isNaN(parsed) || parsed < 0 ? DEFAULT_STARTUP_SYNC_INTERVAL_MS : parsed;
+}
+function startupUserProfile() {
     try {
-        user_profile = { ...resolveUserProfile() };
+        return { ...resolveUserProfile() };
     }
     catch (err) {
         console.error(`[optimus-tool-call] resolveUserProfile failed; continuing startup sync with empty profile: ${err instanceof Error ? err.message : String(err)}`);
-        user_profile = emptyUserProfile();
+        return emptyUserProfile();
     }
-    const github_username = (typeof user_profile.github_username === "string" && user_profile.github_username.trim()) ||
+}
+function githubUsername(profile) {
+    return ((typeof profile.github_username === "string" && profile.github_username.trim()) ||
         process.env.GITHUB_USER ||
         process.env.GH_USER ||
-        "";
-    const metadata = {
-        github_username,
+        "");
+}
+/**
+ * The machine's metadata for the startup request. The git remote in `repo_identifier` can embed a
+ * token (`https://user:token@host/owner/repo`), so it is scrubbed, and the scrubber's version is
+ * sent; `metadata` is not part of the signed summary.
+ */
+function startupMetadata() {
+    const user_profile = startupUserProfile();
+    return {
+        github_username: githubUsername(user_profile),
         org_identifier: process.env.GITHUB_ORG || "",
         organization_uuid: readOrganizationUuid(),
-        repo_identifier: process.env.GITHUB_REPOSITORY || "",
+        repo_identifier: scrubText(process.env.GITHUB_REPOSITORY || ""),
         branch: process.env.GITHUB_REF_NAME || process.env.BRANCH_NAME || "",
         commit_sha: process.env.GITHUB_SHA || "",
         agent_name: process.env.OPTIMUS_AGENT || "",
         user_profile,
+        scrubber_version: SCRUBBER_VERSION,
+    };
+}
+/** The startup request: the summary, signed with this machine's key when it has one, and the metadata. */
+function buildStartupBody(hardwareUuid) {
+    const timestamp = new Date().toISOString();
+    const payloadSummary = {
+        timestamp,
+        directory: process.cwd(),
+        hardware_uuid: hardwareUuid,
     };
     const body = {
         hardware_uuid: hardwareUuid,
         payload: payloadSummary,
-        metadata,
+        metadata: startupMetadata(),
         scan_timestamp: timestamp,
     };
     const storedKey = readStoredAuthKey({
@@ -121,42 +129,56 @@ export async function ensureStartupMetadataSynced(hardwareUuid) {
         if (storedKey.key_id)
             body.key_id = storedKey.key_id;
     }
+    return body;
+}
+async function postStartupBody(url, body) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 5000);
+    try {
+        return await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
+/** Store what a successful startup response carries (a new key, the org's options); true when it parsed. */
+function applyStartupResponse(text, hardwareUuid) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.status === "key_issued" && typeof parsed.key === "string") {
+        persistAuthKey(parsed.key, typeof parsed.key_id === "string" ? parsed.key_id : null, hardwareUuid, { authRelativePath: OPTIMUS_AUTH_KEY_RELATIVE_PATH });
+        resetToolCallAuthCache();
+    }
+    persistCollectPromptsFromResponse(parsed);
+    return true;
+}
+export async function ensureStartupMetadataSynced(hardwareUuid) {
+    if (process.env.OPTIMUS_SKIP_STARTUP_SYNC === "1")
+        return;
+    if (shouldSkipStartupSyncDueToCooldown(Date.now(), startupSyncIntervalMs())) {
+        return;
+    }
+    const body = buildStartupBody(hardwareUuid);
     const url = buildStartupEndpointUrl(loadEndpointBase());
     try {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 5000);
-        let res;
-        try {
-            res = await fetch(url, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify(body),
-                signal: controller.signal,
-            });
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        const res = await postStartupBody(url, body);
         const text = await res.text();
         if (!res.ok) {
             console.error(`[optimus-tool-call] startup metadata sync failed ${res.status}: ${text ? text.slice(0, 240) : res.statusText}`);
             recordStartupSyncAttemptEnd(false);
             return;
         }
-        let parsed = {};
-        try {
-            parsed = JSON.parse(text);
-        }
-        catch {
-            recordStartupSyncAttemptEnd(false);
-            return;
-        }
-        if (parsed.status === "key_issued" && typeof parsed.key === "string") {
-            persistAuthKey(parsed.key, typeof parsed.key_id === "string" ? parsed.key_id : null, hardwareUuid, { authRelativePath: OPTIMUS_AUTH_KEY_RELATIVE_PATH });
-            resetToolCallAuthCache();
-        }
-        persistCollectPromptsFromResponse(parsed);
-        recordStartupSyncAttemptEnd(true);
+        recordStartupSyncAttemptEnd(applyStartupResponse(text, hardwareUuid));
     }
     catch (err) {
         console.error(`[optimus-tool-call] startup metadata sync error: ${err instanceof Error ? err.message : String(err)}`);

package/dist/lib/startup-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"startup-sync.js","sourceRoot":"","sources":["../../src/lib/startup-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAoB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,GAAgB,EAAE,CAAC,CAAC;IAC3C,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;IAChB,eAAe,EAAE,EAAE;IACnB,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,OAAS,CAAC;AACnD,MAAM,oCAAoC,GAAG,IAAK,CAAC;AACnD,MAAM,mCAAmC,GAAG,MAAO,CAAC;AAEpD,IAAI,yBAAyB,GAAG,CAAC,CAAC;AAClC,8EAA8E;AAC9E,IAAI,oBAAoB,GAAG,IAAI,CAAC;AAChC,IAAI,wBAAwB,GAAG,CAAC,CAAC;AAEjC,SAAS,2BAA2B,CAAC,EAAW;IAC9C,yBAAyB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,oBAAoB,GAAG,EAAE,CAAC;IAC1B,IAAI,EAAE,EAAE,CAAC;QACP,wBAAwB,GAAG,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,wBAAwB,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CAAC,GAAW,EAAE,UAAkB;IACzE,IAAI,yBAAyB,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,gBAAgB,GAAG,CAAC,oBAAoB;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CACN,mCAAmC,EACnC,oCAAoC;YAClC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAC9D;QACH,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,iBAAiB,GAAG,oBAAoB,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IACjE,OAAO,UAAU,GAAG,CAAC,IAAI,GAAG,GAAG,yBAAyB,GAAG,UAAU,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC1G,OAAO,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,YAAoB;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAAE,OAAO;IAE1D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACjE,IAAI,UAAU,GAAG,gCAAgC,CAAC;IAClD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzC,UAAU;YACR,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG;QACrB,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;QACxB,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,YAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,YAAY,GAAG,EAAE,GAAG,kBAAkB,EAAE,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,8FACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACF,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACpC,CAAC;IACD,MAAM,eAAe,GACnB,CAAC,OAAO,YAAY,CAAC,eAAe,KAAK,QAAQ,IAAI,YAAY,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG;QACf,eAAe;QACf,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QAC5C,iBAAiB,EAAE,oBAAoB,EAAE;QACzC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;QACpD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE;QACpE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;QAC3C,YAAY;KACb,CAAC;IACF,MAAM,IAAI,GAA4B;QACpC,aAAa,EAAE,YAAY;QAC3B,OAAO,EAAE,cAAc;QACvB,QAAQ;QACR,cAAc,EAAE,SAAS;KAC1B,CAAC;IAEF,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,gBAAgB,EAAE,8BAA8B;KACjD,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,oDAAoD,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAChH,CAAC;YACF,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,MAAM,GAA4B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrE,cAAc,CACZ,MAAM,CAAC,GAAG,EACV,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EACxD,YAAY,EACZ,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CACrD,CAAC;YACF,sBAAsB,EAAE,CAAC;QAC3B,CAAC;QACD,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAC1C,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,oDAAoD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvG,CAAC;QACF,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}
+{"version":3,"file":"startup-sync.js","sourceRoot":"","sources":["../../src/lib/startup-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAoB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,GAAgB,EAAE,CAAC,CAAC;IAC3C,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;IAChB,eAAe,EAAE,EAAE;IACnB,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,OAAS,CAAC;AACnD,MAAM,oCAAoC,GAAG,IAAK,CAAC;AACnD,MAAM,mCAAmC,GAAG,MAAO,CAAC;AAEpD,IAAI,yBAAyB,GAAG,CAAC,CAAC;AAClC,8EAA8E;AAC9E,IAAI,oBAAoB,GAAG,IAAI,CAAC;AAChC,IAAI,wBAAwB,GAAG,CAAC,CAAC;AAEjC,SAAS,2BAA2B,CAAC,EAAW;IAC9C,yBAAyB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,oBAAoB,GAAG,EAAE,CAAC;IAC1B,IAAI,EAAE,EAAE,CAAC;QACP,wBAAwB,GAAG,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,wBAAwB,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CAAC,GAAW,EAAE,UAAkB;IACzE,IAAI,yBAAyB,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,gBAAgB,GAAG,CAAC,oBAAoB;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CACN,mCAAmC,EACnC,oCAAoC;YAClC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAC9D;QACH,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,iBAAiB,GAAG,oBAAoB,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IACjE,OAAO,UAAU,GAAG,CAAC,IAAI,GAAG,GAAG,yBAAyB,GAAG,UAAU,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC1G,OAAO,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACjE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,gCAAgC,CAAC;IAC7F,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,MAAM,CAAC;AACxF,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,OAAO,EAAE,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,8FACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACF,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAoB;IAC1C,OAAO,CACL,CAAC,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe;IACtB,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,OAAO;QACL,eAAe,EAAE,cAAc,CAAC,YAAY,CAAC;QAC7C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QAC5C,iBAAiB,EAAE,oBAAoB,EAAE;QACzC,eAAe,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC/D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE;QACpE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;QAC3C,YAAY;QACZ,gBAAgB,EAAE,gBAAgB;KACnC,CAAC;AACJ,CAAC;AAED,0GAA0G;AAC1G,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG;QACrB,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;QACxB,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,MAAM,IAAI,GAA4B;QACpC,aAAa,EAAE,YAAY;QAC3B,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,eAAe,EAAE;QAC3B,cAAc,EAAE,SAAS;KAC1B,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,gBAAgB,EAAE,8BAA8B;KACjD,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,GAAG,IAAI,SAAS,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,IAA6B;IACvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,SAAS,oBAAoB,CAAC,IAAY,EAAE,YAAoB;IAC9D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrE,cAAc,CACZ,MAAM,CAAC,GAAG,EACV,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EACxD,YAAY,EACZ,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,CACrD,CAAC;QACF,sBAAsB,EAAE,CAAC;IAC3B,CAAC;IACD,iCAAiC,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,YAAoB;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAAE,OAAO;IAC1D,IAAI,kCAAkC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,oDAAoD,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAChH,CAAC;YACF,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,2BAA2B,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,oDAAoD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvG,CAAC;QACF,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/lib/telemetry/build-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-event.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/build-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjE;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACtC,aAAa,GAAE,MAAkB,EACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,cAAc,GAAG,IAAI,CAgCvB"}
+{"version":3,"file":"build-event.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/build-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA2EjE;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACtC,aAAa,GAAE,MAAkB,EACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,cAAc,GAAG,IAAI,CA6BvB"}

package/dist/lib/telemetry/build-event.js

@@ -1,5 +1,75 @@
-import { readCollectPrompts } from "../prompt-collection-policy.js";
+import { readCollectPrompts, readFingerprintKey } from "../prompt-collection-policy.js";
 import { applyPromptCollectionToMetadata } from "./prompt-privacy.js";
+import os from "node:os";
+import { readLogin } from "../login.js";
+import { readAgentProduct, readCopilotProduct } from "../transcript.js";
+/**
+ * Every Optimus hook's hash for this agent, from the tool-call hook (OPTIMUS_HOOK_MANIFEST,
+ * `{"<agent>/<hook>": "<sha256>"}`), or null when absent or malformed. It travels inside the signed
+ * events, so the server can record a tampered or restored hook at this tool call.
+ */
+function hookManifest() {
+    const raw = (process.env.OPTIMUS_HOOK_MANIFEST || "").trim();
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string" && entry[1] !== "");
+        return entries.length ? Object.fromEntries(entries) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The macOS account running the agent, read on every event: after a handover, or from a second
+ * account on the same Mac, the event carries who ran it rather than whoever last synced the
+ * machine's profile. Left out if the account cannot be looked up.
+ */
+function osUser() {
+    try {
+        const { uid, username } = os.userInfo();
+        return username ? { uid, username } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Which product of the agent's family ran the tool (OPT-1488). Codex's CLI, desktop app, ChatGPT
+ * Work and VS Code send identical hook fields, so it is read from the session file Codex names in
+ * `transcript_path`; Copilot's from its session folder or VS Code's transcript.
+ */
+function agentProduct(inv, agentIdentity) {
+    const transcriptPath = inv.raw_event?.transcript_path;
+    let product = null;
+    if (agentIdentity === "codex" && typeof transcriptPath === "string") {
+        product = readAgentProduct(transcriptPath);
+    }
+    else if (agentIdentity === "copilot") {
+        product = readCopilotProduct(inv.session_id, typeof transcriptPath === "string" ? transcriptPath : null);
+    }
+    return product ? { agent_product: product } : {};
+}
+/** The metadata fields an invocation only sometimes has, each left out when empty. */
+function optionalMetadata(inv, agentIdentity) {
+    const hookHash = (process.env.OPTIMUS_HOOK_HASH || "").trim() || null;
+    const manifest = hookManifest();
+    // Tenant and email the agent is signed in with, read on every call; absent when unreadable.
+    const login = readLogin(agentIdentity);
+    const account = osUser();
+    return {
+        ...(inv.user_prompt ? { user_prompt: inv.user_prompt } : {}),
+        ...(inv.raw_event ? { raw_event: inv.raw_event } : {}),
+        ...agentProduct(inv, agentIdentity),
+        ...(hookHash ? { hook_hash: hookHash } : {}),
+        ...(manifest ? { hook_manifest: manifest } : {}),
+        ...(login ? { login } : {}),
+        ...(account ? { os_user: account } : {}),
+    };
+}
 /**
  * Build a telemetry event from a tool invocation.
  *
@@ -14,14 +84,11 @@ export function buildTelemetryEvent(inv, agentIdentity = "unknown", sessionId) {
     const toolName = inv.tool_name;
     const toolNameNorm = typeof toolName === "string" ? toolName.trim() : "";
     const normalizedToolInput = inv.tool_input || {};
-    const hookHash = (process.env.OPTIMUS_HOOK_HASH || "").trim() || null;
     const meta = applyPromptCollectionToMetadata({
         tool_name: toolNameNorm || toolName,
         tool_input: normalizedToolInput,
-        ...(inv.user_prompt ? { user_prompt: inv.user_prompt } : {}),
-        ...(inv.raw_event ? { raw_event: inv.raw_event } : {}),
-        ...(hookHash ? { hook_hash: hookHash } : {}),
-    }, !readCollectPrompts());
+        ...optionalMetadata(inv, agentIdentity),
+    }, !readCollectPrompts(), readFingerprintKey());
     return {
         timestamp: new Date().toISOString(),
         agent_identity: agentIdentity,

package/dist/lib/telemetry/build-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-event.js","sourceRoot":"","sources":["../../../src/lib/telemetry/build-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsC,EACtC,gBAAwB,SAAS,EACjC,SAAyB;IAEzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAC/B,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,mBAAmB,GAA4B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAEtE,MAAM,IAAI,GAAG,+BAA+B,CAC1C;QACE,SAAS,EAAE,YAAY,IAAI,QAAQ;QACnC,UAAU,EAAE,mBAAmB;QAC/B,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,EACD,CAAC,kBAAkB,EAAE,CACtB,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,iBAAiB,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QAClC,kBAAkB,EAAE,IAA4C;KACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"build-event.js","sourceRoot":"","sources":["../../../src/lib/telemetry/build-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC,MAAM,CACtE,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CACtF,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM;IACb,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAmB,EAAE,aAAqB;IAC9D,MAAM,cAAc,GAAG,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC;IACtD,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,aAAa,KAAK,OAAO,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,GAAmB,EAAE,aAAqB;IAClE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACtE,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,4FAA4F;IAC5F,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;IACzB,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsC,EACtC,gBAAwB,SAAS,EACjC,SAAyB;IAEzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAC/B,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,mBAAmB,GAA4B,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAE1E,MAAM,IAAI,GAAG,+BAA+B,CAC1C;QACE,SAAS,EAAE,YAAY,IAAI,QAAQ;QACnC,UAAU,EAAE,mBAAmB;QAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC;KACxC,EACD,CAAC,kBAAkB,EAAE,EACrB,kBAAkB,EAAE,CACrB,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,iBAAiB,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QAClC,kBAAkB,EAAE,IAA4C;KACjE,CAAC;AACJ,CAAC"}

package/dist/lib/telemetry/canonical.d.ts

@@ -11,7 +11,7 @@
  *   - user_prompt extraction (requires reading local files the backend cannot access)
  */
 export interface CanonicalHookInput {
-    agent: "claude" | "cursor" | "unknown";
+    agent: "claude" | "cursor" | "codex" | "copilot" | "unknown";
     hook_event_name: string;
     tool_name: string;
     tool_input: Record<string, unknown>;

package/dist/lib/telemetry/canonical.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAuBrF"}
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAuBrF"}

package/dist/lib/telemetry/canonical.js

@@ -36,30 +36,39 @@ export function normalizeToCanonical(raw) {
         raw_event: rawEvent,
     };
 }
-function detectAgent(raw) {
+/** Claude hook names are PascalCase; Cursor uses camelCase. */
+const CLAUDE_HOOK_EVENTS = new Set([
+    "PreToolUse", "SessionStart", "SessionEnd", "PostToolUse", "PostToolUseFailure", "PermissionRequest",
+]);
+const CURSOR_HOOK_EVENTS = new Set(["preToolUse", "beforeShellExecution", "beforePromptSubmit"]);
+/** The agent the hook's environment names, or null when it names none. */
+function agentFromEnv() {
+    // Codex's and Copilot's hooks say so: their payloads are shaped like Claude's, so nothing else
+    // can tell them apart. Checked first because either started from a Claude Code terminal
+    // inherits CLAUDE_CODE_SESSION_ID.
+    const named = (process.env.OPTIMUS_AGENT || "").trim().toLowerCase();
+    if (named === "codex" || named === "copilot")
+        return named;
     // Environment variable is the most reliable signal
     if (process.env.CLAUDE_CODE_SESSION_ID)
         return "claude";
     if (process.env.CURSOR_SESSION_ID || process.env.CURSOR)
         return "cursor";
-    const hookEventName = extractValue(raw, ["hook_event_name", "hookEventName", "hook_event"]);
-    // Claude hook names are PascalCase; Cursor uses camelCase
-    if (hookEventName === "PreToolUse" || hookEventName === "SessionStart" ||
-        hookEventName === "SessionEnd" || hookEventName === "PostToolUse" ||
-        hookEventName === "PostToolUseFailure" || hookEventName === "PermissionRequest") {
+    return null;
+}
+function detectAgent(raw) {
+    const fromEnv = agentFromEnv();
+    if (fromEnv)
+        return fromEnv;
+    const hookEventName = extractValue(raw, ["hook_event_name", "hookEventName", "hook_event"]) ?? "";
+    if (CLAUDE_HOOK_EVENTS.has(hookEventName))
         return "claude";
-    }
-    if (hookEventName === "preToolUse" || hookEventName === "beforeShellExecution" ||
-        hookEventName === "beforePromptSubmit") {
+    if (CURSOR_HOOK_EVENTS.has(hookEventName))
         return "cursor";
-    }
-    // Field naming convention fallback
+    // Field naming convention fallback: camelCase is Cursor; anything else (snake_case or none) is Claude.
     if (raw.toolUse || raw.toolName || (raw.sessionId && typeof raw.sessionId === "string")) {
         return "cursor";
     }
-    if (raw.tool_use_id || raw.session_id || raw.hook_event_name) {
-        return "claude";
-    }
     return "claude";
 }
 function extractHookEventName(raw, agent) {

package/dist/lib/telemetry/canonical.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/lib/telemetry/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAexB,MAAM,UAAU,oBAAoB,CAAC,GAA4B;IAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC5B,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC5B,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC3B,OAAO,QAAQ,CAAC,MAAM,CAAC;IAEvB,OAAO;QACL,KAAK;QACL,eAAe,EAAE,aAAa;QAC9B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,YAAY,CAAS,GAAG,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,IAAI,IAAI;QAC5E,UAAU,EAAE,SAAS;QACrB,GAAG,EAAE,YAAY,CAAS,GAAG,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,IAAI,IAAI;QACnE,KAAK,EAAE,YAAY,CAAS,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI;QACnD,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,mDAAmD;IACnD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAAE,OAAO,QAAQ,CAAC;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,aAAa,GAAG,YAAY,CAAS,GAAG,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IAEpG,0DAA0D;IAC1D,IAAI,aAAa,KAAK,YAAY,IAAI,aAAa,KAAK,cAAc;QAClE,aAAa,KAAK,YAAY,IAAI,aAAa,KAAK,aAAa;QACjE,aAAa,KAAK,oBAAoB,IAAI,aAAa,KAAK,mBAAmB,EAAE,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,aAAa,KAAK,YAAY,IAAI,aAAa,KAAK,sBAAsB;QAC1E,aAAa,KAAK,oBAAoB,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,mCAAmC;IACnC,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA4B,EAAE,KAAuC;IACjG,MAAM,QAAQ,GAAG,YAAY,CAAS,GAAG,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/F,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,YAAY,CAAC;QACrD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,sBAAsB,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,GAA4B,EAC5B,aAAqB;IAErB,MAAM,MAAM,GAAG,CAAC,KAAc,EAAkC,EAAE,CAChE,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAC/C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/D,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GACb,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QACnB,EAAE,CAAC;IAEL,yEAAyE;IACzE,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,cAAc,GAClB,cAAc,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QACzC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE;QAC3C,CAAC,CAAC,SAAS,CAAC;IAEhB,mEAAmE;IACnE,MAAM,QAAQ,GACZ,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;QACrB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAClB,CAAC,aAAa,KAAK,sBAAsB,IAAI,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEpF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA4B;IACpD,OAAO,CACL,YAAY,CAAS,GAAG,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA4B;IACrD,0BAA0B;IAC1B,MAAM,MAAM,GAAG,YAAY,CAAS,GAAG,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,oCAAoC;IACpC,MAAM,cAAc,GAAG,YAAY,CAAS,GAAG,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACzF,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,OAAO,OAAO,IAAI,IAAI,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,SAAS,MAAM,CAAC,CAAC;QACxE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,OAAO,IAAI,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CACnB,GAA4B,EAC5B,IAAc;IAEd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAU,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/lib/telemetry/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAexB,MAAM,UAAU,oBAAoB,CAAC,GAA4B;IAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC5B,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC5B,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC3B,OAAO,QAAQ,CAAC,MAAM,CAAC;IAEvB,OAAO;QACL,KAAK;QACL,eAAe,EAAE,aAAa;QAC9B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,YAAY,CAAS,GAAG,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,IAAI,IAAI;QAC5E,UAAU,EAAE,SAAS;QACrB,GAAG,EAAE,YAAY,CAAS,GAAG,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,IAAI,IAAI;QACnE,KAAK,EAAE,YAAY,CAAS,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI;QACnD,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB;CACrG,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEjG,0EAA0E;AAC1E,SAAS,YAAY;IACnB,+FAA+F;IAC/F,wFAAwF;IACxF,mCAAmC;IACnC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,mDAAmD;IACnD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAAE,OAAO,QAAQ,CAAC;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,aAAa,GAAG,YAAY,CAAS,GAAG,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1G,IAAI,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE3D,uGAAuG;IACvG,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAA4B,EAC5B,KAA6D;IAE7D,MAAM,QAAQ,GAAG,YAAY,CAAS,GAAG,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/F,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,YAAY,CAAC;QACrD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,sBAAsB,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,GAA4B,EAC5B,aAAqB;IAErB,MAAM,MAAM,GAAG,CAAC,KAAc,EAAkC,EAAE,CAChE,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAC/C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/D,iEAAiE;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GACb,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QACnB,EAAE,CAAC;IAEL,yEAAyE;IACzE,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,cAAc,GAClB,cAAc,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QACzC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE;QAC3C,CAAC,CAAC,SAAS,CAAC;IAEhB,mEAAmE;IACnE,MAAM,QAAQ,GACZ,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;QACrB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAClB,CAAC,aAAa,KAAK,sBAAsB,IAAI,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEpF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA4B;IACpD,OAAO,CACL,YAAY,CAAS,GAAG,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA4B;IACrD,0BAA0B;IAC1B,MAAM,MAAM,GAAG,YAAY,CAAS,GAAG,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,oCAAoC;IACpC,MAAM,cAAc,GAAG,YAAY,CAAS,GAAG,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACzF,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,OAAO,OAAO,IAAI,IAAI,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,SAAS,MAAM,CAAC,CAAC;QACxE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,OAAO,IAAI,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CACnB,GAA4B,EAC5B,IAAc;IAEd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAU,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/telemetry/index.d.ts

@@ -5,5 +5,5 @@ export * from "./types.js";
 export * from "./canonical.js";
 export { eventToDict } from "./serialize.js";
 export { buildTelemetryEvent } from "./build-event.js";
-export { cloneToolCallMetadataForWire, SERVER_OWNED_TOOL_CALL_METADATA_KEYS, } from "./wire-metadata.js";
+export { cloneToolCallMetadataForWire, WIRE_RAW_EVENT_KEYS, WIRE_TOOL_CALL_METADATA_KEYS, } from "./wire-metadata.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/telemetry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC"}

package/dist/lib/telemetry/index.js

@@ -5,5 +5,5 @@ export * from "./types.js";
 export * from "./canonical.js";
 export { eventToDict } from "./serialize.js";
 export { buildTelemetryEvent } from "./build-event.js";
-export { cloneToolCallMetadataForWire, SERVER_OWNED_TOOL_CALL_METADATA_KEYS, } from "./wire-metadata.js";
+export { cloneToolCallMetadataForWire, WIRE_RAW_EVENT_KEYS, WIRE_TOOL_CALL_METADATA_KEYS, } from "./wire-metadata.js";
 //# sourceMappingURL=index.js.map

package/dist/lib/telemetry/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/telemetry/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/telemetry/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC"}

package/dist/lib/telemetry/prompt-privacy.d.ts

@@ -1,5 +1,11 @@
 export declare const RAW_EVENT_PROMPT_KEYS: readonly ["user_prompt", "userPrompt", "prompt"];
 export declare function sha256UserPrompt(text: string): string;
+/**
+ * The prompt's grouping hash: HMAC-SHA256 under the org key once it has arrived, so a short prompt
+ * cannot be recovered by hashing guesses; plain SHA-256 before then (the first run after the
+ * upgrade), as before. Either is 64 hex characters, which the backend stores as sent.
+ */
+export declare function hashUserPrompt(text: string, orgKey?: string): string;
 export declare function stripRawEventPromptFields(rawEvent: Record<string, unknown> | undefined | null): Record<string, unknown> | undefined;
-export declare function applyPromptCollectionToMetadata(meta: Record<string, unknown>, hashPrompts: boolean): Record<string, unknown>;
+export declare function applyPromptCollectionToMetadata(meta: Record<string, unknown>, hashPrompts: boolean, orgKey?: string): Record<string, unknown>;
 //# sourceMappingURL=prompt-privacy.d.ts.map

package/dist/lib/telemetry/prompt-privacy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-privacy.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/prompt-privacy.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,kDAAmD,CAAC;AAEtF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,GACnD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,OAAO,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBzB"}
+{"version":3,"file":"prompt-privacy.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/prompt-privacy.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,kDAAmD,CAAC;AAEtF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,GACnD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,OAAO,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBzB"}

package/dist/lib/telemetry/prompt-privacy.js

@@ -1,8 +1,18 @@
-import { createHash } from "node:crypto";
+import { createHash, createHmac } from "node:crypto";
 export const RAW_EVENT_PROMPT_KEYS = ["user_prompt", "userPrompt", "prompt"];
 export function sha256UserPrompt(text) {
     return createHash("sha256").update(text.trim(), "utf8").digest("hex");
 }
+/**
+ * The prompt's grouping hash: HMAC-SHA256 under the org key once it has arrived, so a short prompt
+ * cannot be recovered by hashing guesses; plain SHA-256 before then (the first run after the
+ * upgrade), as before. Either is 64 hex characters, which the backend stores as sent.
+ */
+export function hashUserPrompt(text, orgKey) {
+    if (!orgKey)
+        return sha256UserPrompt(text);
+    return createHmac("sha256", Buffer.from(orgKey, "hex")).update(text.trim(), "utf8").digest("hex");
+}
 export function stripRawEventPromptFields(rawEvent) {
     if (!rawEvent || typeof rawEvent !== "object" || Array.isArray(rawEvent)) {
         return rawEvent ?? undefined;
@@ -13,7 +23,7 @@ export function stripRawEventPromptFields(rawEvent) {
     }
     return out;
 }
-export function applyPromptCollectionToMetadata(meta, hashPrompts) {
+export function applyPromptCollectionToMetadata(meta, hashPrompts, orgKey) {
     const out = { ...meta };
     const raw = out.raw_event;
     if (raw && typeof raw === "object" && !Array.isArray(raw)) {
@@ -29,7 +39,7 @@ export function applyPromptCollectionToMetadata(meta, hashPrompts) {
         return out;
     }
     if (plaintext) {
-        out.user_prompt_hash = sha256UserPrompt(plaintext);
+        out.user_prompt_hash = hashUserPrompt(plaintext, orgKey);
     }
     delete out.user_prompt;
     return out;

package/dist/lib/telemetry/prompt-privacy.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-privacy.js","sourceRoot":"","sources":["../../../src/lib/telemetry/prompt-privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAU,CAAC;AAEtF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAoD;IAEpD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,QAAQ,IAAI,SAAS,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACxC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAA6B,EAC7B,WAAoB;IAEpB,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC;IAC1B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,SAAS,GAAG,yBAAyB,CAAC,GAA8B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,SAAS;YAAE,GAAG,CAAC,WAAW,GAAG,SAAS,CAAC;;YACtC,OAAO,GAAG,CAAC,WAAW,CAAC;QAC5B,OAAO,GAAG,CAAC,gBAAgB,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"prompt-privacy.js","sourceRoot":"","sources":["../../../src/lib/telemetry/prompt-privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAU,CAAC;AAEtF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAe;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAoD;IAEpD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,QAAQ,IAAI,SAAS,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACxC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAA6B,EAC7B,WAAoB,EACpB,MAAe;IAEf,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC;IAC1B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,SAAS,GAAG,yBAAyB,CAAC,GAA8B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,SAAS;YAAE,GAAG,CAAC,WAAW,GAAG,SAAS,CAAC;;YACtC,OAAO,GAAG,CAAC,WAAW,CAAC;QAC5B,OAAO,GAAG,CAAC,gBAAgB,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,gBAAgB,GAAG,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/telemetry/types.d.ts

@@ -31,6 +31,24 @@ export interface TelemetryEvent {
         user_prompt_hash?: string | null;
         raw_event?: Record<string, unknown>;
         hook_hash?: string | null;
+        /** Every Optimus hook's hash for this agent, `{"<agent>/<hook>": "<sha256>"}`. */
+        hook_manifest?: Record<string, string>;
+        /** The agent's signed-in account (tenant, email), read on every event. */
+        login?: {
+            tenant_id?: string;
+            tenant_name?: string;
+            email?: string;
+        };
+        /** The macOS account running the agent, read on every event. */
+        os_user?: {
+            uid: number;
+            username: string;
+        };
+        /** Which Codex product ran the tool, from its session file (OPT-1488). */
+        agent_product?: {
+            originator: string;
+            version?: string;
+        };
     };
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/lib/telemetry/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/types.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAC5C,eAAO,MAAM,aAAa,SAAS,CAAC;AACpC,eAAO,MAAM,eAAe,WAAW,CAAC;AACxC,eAAO,MAAM,YAAY,QAAQ,CAAC;AAClC,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,eAAO,MAAM,cAAc,UAM1B,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,kBAAkB,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/types.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAC5C,eAAO,MAAM,aAAa,SAAS,CAAC;AACpC,eAAO,MAAM,eAAe,WAAW,CAAC;AACxC,eAAO,MAAM,YAAY,QAAQ,CAAC;AAClC,eAAO,MAAM,aAAa,SAAS,CAAC;AAEpC,eAAO,MAAM,cAAc,UAM1B,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC,kBAAkB,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,kFAAkF;QAClF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,0EAA0E;QAC1E,KAAK,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACrE,gEAAgE;QAChE,OAAO,CAAC,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5C,0EAA0E;QAC1E,aAAa,CAAC,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1D,CAAC;CACH"}

package/dist/lib/telemetry/wire-metadata.d.ts

@@ -1,10 +1,25 @@
 /**
- * Tool-call metadata keys owned by the Django ingest layer (`enrich_tool_call_metadata`).
- * Keep in sync with the keys popped at the start of ``enrich_tool_call_metadata``.
- * The sensor sends raw hook fields only; strip these before HTTP so spoofed values
- * cannot influence the API.
+ * The tool-call metadata fields sent to the backend, and nothing else. An allowlist, so a field
+ * added to the event later stays on the Mac until someone decides it should be sent (and adds it
+ * here, and to docs/pii-scrubbing/TOOL_CALL_FIELDS.md). Fields the backend works out itself (the
+ * classification, the MCP split, the machine's user profile) are not on it, so a Mac cannot set
+ * them.
+ */
+export declare const WIRE_TOOL_CALL_METADATA_KEYS: readonly ["tool_name", "tool_input", "user_prompt", "user_prompt_hash", "raw_event", "hook_hash", "hook_manifest", "login", "os_user", "agent_product"];
+/**
+ * The fields of the agent's own hook payload (`raw_event`) the backend reads: the hook's name, in
+ * each agent's spelling (it tells a Cursor event from a Claude one), the tool name (MCP calls) and
+ * the shell command Cursor sends outside `tool_input`. The rest of the payload (the tool's output,
+ * the transcript path, the agent's own copy of the input) stays on the Mac.
+ */
+export declare const WIRE_RAW_EVENT_KEYS: readonly ["hook_event_name", "hookEventName", "hook_event", "tool_name", "command"];
+/**
+ * Return the metadata the backend receives: only the allowlisted fields, with the content
+ * scrubbed. Secrets in `tool_input`, `raw_event` and the prompt are redacted to typed
+ * placeholders before the event leaves the machine; emails and paths stay as they are, since the
+ * backend matches tool calls to people and to the folders the inventory holds. Each event carries
+ * the scrubber's version, so the backend can tell what the sensor already ran. Identity (`login`,
+ * `os_user`) is sent as it is.
  */
-export declare const SERVER_OWNED_TOOL_CALL_METADATA_KEYS: readonly ["user_profile", "hardware_uuid", "action_type", "command_components", "file_path", "pattern", "mcp_server", "mcp_tool"];
-/** Return a shallow copy of metadata with server-owned keys removed. */
 export declare function cloneToolCallMetadataForWire(meta: unknown): Record<string, unknown> | undefined;
 //# sourceMappingURL=wire-metadata.d.ts.map

package/dist/lib/telemetry/wire-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-metadata.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/wire-metadata.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,mIASvC,CAAC;AAEX,wEAAwE;AACxE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAS/F"}
+{"version":3,"file":"wire-metadata.d.ts","sourceRoot":"","sources":["../../../src/lib/telemetry/wire-metadata.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,yJAW/B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,qFAAsF,CAAC;AAUvH;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAY/F"}