@pinta-ai/pinta-cc 1.10.0 → 1.10.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pinta-cc",
   "description": "Generic OTLP forwarder for Claude Code hook events. Converts hook events into OTLP/HTTP spans and sends them to any OpenTelemetry-compatible collector.",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "license": "PolyForm-Noncommercial-1.0.0",
   "userConfig": {
     "endpoint": {

package/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 All notable changes to pinta-cc are documented here.
 
+## [1.10.1] - 2026-09-29
+
+### Fixed
+
+- Publish the output-enforcement fix above both 1.10.0 and 1.9.1 so semantic
+  version selection chooses the fixed adapter.
+
+### Compatibility
+
+- Version-only forward release of the merged behavior shipped in 1.9.1:
+  retains the 1.10.0 timeout declaration, native output denial and deferred
+  DENY telemetry. No policy, timeout, dependency or hook behavior changes.
+
+## [1.9.1] - 2026-09-29
+
+### Fixed
+
+- Evaluate successful `PostToolUse` output, including native `tool_response`,
+  using the original redaction-aware OTLP payload. Previously these events
+  emitted telemetry without asking the guard.
+- On an output `DENY`, emit Claude Code's supported `continue: false` stop JSON
+  before best-effort local persistence, using a fixed message that asks for a new
+  session and never reflects untrusted output or guard messages.
+- Finish both `PreToolUse` and `PostToolUse` DENYs without collector network IO,
+  deferring their original spans through the existing `DiskRetryQueue`. Merely
+  printing the response before awaiting telemetry was insufficient: a host
+  timeout could discard the decision while waiting for a slow collector.
+- Preserve original masked input/output evidence and span identity; attach
+  normal guard metadata plus `pinta.guard.target = "tool_output"` for every
+  non-null after-tool verdict.
+- Add native-output handler regressions and built CJS/ESM stdin/loopback checks
+  to PR validation, including a 1-second hook deadline with a 4-second collector
+  ACK, queue failure diagnostics, later-hook flush and non-gating boundaries.
+
+### Compatibility
+
+- This stops the current run on hosts honoring Claude Code's documented
+  synchronous `PostToolUse` stop contract. It does not undo an executed tool,
+  strip retained transcript content or make a resumed conversation safe.
+  Start a new session after an output denial; no persistent session lock or
+  automatic context clearing is introduced.
+- `PreToolUse` permission decisions, permission/lifecycle/internal hooks,
+  failed-tool telemetry, ALLOW/REVIEW and existing fail-open behavior remain
+  unchanged. No policy thresholds or required guard request fields change.
+- This out-of-order patch retains the already-released `@pinta-ai/core` 0.9.0
+  timeout-declaration behavior from 1.10.0.
+- With telemetry enabled, decided-DENY evidence persists in the existing local
+  retry queue; backend visibility waits for a later eligible hook to flush it.
+  Guard-only/telemetry-disabled mode does not retain new local evidence.
+  Existing size/retention limits and disk-failure diagnostics still apply.
+
 ## [1.10.0] - 2026-09-30
 
 ### Added

package/README.md

@@ -7,9 +7,10 @@ Converts Claude Code hook events into OTLP/HTTP spans and forwards them to any O
 - **OTLP transport**: converts 11 hook event types into OTLP/HTTP `resourceSpans` and sends them via `POST {endpoint}/traces`
 - **Bronze flattening**: every top-level field of a hook event is flattened into `cc.<key>` span attributes
 - **ULID per-turn traceId**: `UserPromptSubmit` starts a new ULID-based trace; all subsequent hooks in the same turn share it
-- **Retry queue**: on transport failure, payloads are appended to `.plugin-data/failed-spans.jsonl` (cap 1000) and flushed on the next hook invocation
+- **Retry queue**: DENY and transport-failure spans are persisted to `.plugin-data/failed-spans.jsonl` (cap 1000) and flushed by a later eligible telemetry hook
 - **Vendor-neutral**: any OTel-compatible collector works. Pinta Manager auto-configures the endpoint and token
 - **Identity at relay**: `member.identity.*` attributes are no longer attached at plugin time. Pinta Manager (or your own pipeline) attaches identity at the forwarding layer
+- **Optional guard enforcement**: denies tool input at `PreToolUse` and stops the current run when successful `PostToolUse` output is denied
 
 ## Channels
 
@@ -81,6 +82,73 @@ The plugin reads OTel env vars directly. `CLAUDE_PLUGIN_OPTION_*` env vars (set
 | `CLAUDE_PLUGIN_OPTION_ENDPOINT` | `OTEL_EXPORTER_OTLP_ENDPOINT` |
 | `CLAUDE_PLUGIN_OPTION_API_KEY` | `OTEL_EXPORTER_OTLP_HEADERS=x-pinta-relay-token=<key>` |
 
+## Tool-output guard and recovery
+
+When `PINTA_GUARD_ENDPOINT` is configured, successful `PostToolUse` events are
+evaluated through the same guard as `PreToolUse`. The adapter first builds the
+normal redaction-aware OTLP span, including native `tool_response`, and sends
+that original payload to the guard. It attaches the verdict to the same span
+before delivery or local deferral, preserving its `traceId`, `spanId`, input and output evidence.
+Every non-null after-tool verdict adds `pinta.guard.target = "tool_output"`:
+denial concerns the output, not whether the completed tool executed.
+
+Roll out telemetry-reader support for output-target verdicts before activating
+this adapter in managed installations. Older readers can interpret every guard
+denial as a prevented tool call rather than a completed tool with denied output.
+The target is retained as original extension metadata.
+
+On an output `DENY`, the hook exits successfully and emits exactly one JSON
+object before best-effort local persistence:
+
+```json
+{"continue":false,"stopReason":"Pinta blocked this tool output. Start a new session before continuing."}
+```
+
+This uses Claude Code's documented
+[`continue: false` / `stopReason` contract](https://code.claude.com/docs/en/hooks#json-output)
+to stop the current run, including when a tool completes during streaming.
+`PostToolUse` exit code 2 only provides stderr feedback, and `decision: "block"`
+alone is not this run-stop contract. The fixed message never copies tool output
+or guard-supplied reasons/messages into the conversation.
+
+**Decided DENYs never wait for collector network IO.** Both `PreToolUse` and
+`PostToolUse` write their existing native response, attach the guard metadata,
+persist the original redacted span using the existing `DiskRetryQueue`, and
+return without flushing or sending telemetry. Printing JSON first is not
+sufficient: a host timeout while waiting for a collector can invalidate that
+decision. The queued evidence retains the original input/output and span IDs,
+not replacement warning text.
+
+When telemetry is configured, evidence persists locally in
+`${CLAUDE_PLUGIN_DATA}/failed-spans.jsonl` (default:
+`${CLAUDE_PLUGIN_ROOT}/.plugin-data/failed-spans.jsonl`).
+**Backend visibility is delayed** until a later eligible telemetry hook
+successfully flushes the queue, including a hook in a new session. No queue is
+created or appended to in guard-only/telemetry-disabled mode. Local persistence
+uses the existing redaction, payload-size and 1000-entry retention limits.
+Queue write failures, oversized drops and oldest-entry eviction are diagnosed
+on stderr; they do not suppress the response or trigger a network fallback.
+
+**Start a new session after an output denial.** The tool already ran: this does
+not undo its effects, remove native results from the retained transcript, or
+make resuming/continuing that conversation safe. There is no automatic clearing
+or persistent session lock.
+
+`ALLOW`, `REVIEW`, inactive guarding and existing guard fail-open paths do not
+stop the run. `PostToolUseFailure` remains telemetry-only; this change covers
+successful tool output, not failed-tool errors. Permission, session, lifecycle
+and internal events keep their existing behavior, as does the `PreToolUse`
+permission-denial response.
+
+Enforcement requires synchronous hooks and a Claude Code host honoring the
+documented `PostToolUse` stop contract. The hook must finish within its host
+timeout: Claude Code [discards timed-out hook output](https://code.claude.com/docs/en/hooks#timeouts).
+Guard evaluation and local storage must still fit that deadline; removing
+collector IO from decided DENYs does not make those operations instantaneous.
+No minimum compatible host version is asserted here: adapter subprocess tests
+verify emitted JSON and transport, not an end-to-end compatibility matrix of
+Claude Code releases.
+
 ## Span attribute conventions
 
 ### Resource attributes
@@ -193,8 +261,8 @@ src/
 │   ├── identity.ts       # Empty stub (identity attribution moved to relay)
 │   └── redact.ts         # Tier-1 redaction + Tier-3 truncation
 └── handlers/
-    ├── pre-tool-use.ts   # flush → currentTrace → buildOtlpPayload → send → exit 0
-    ├── post-tool-use.ts
+    ├── pre-tool-use.ts   # build → guard → permission denial → defer DENY / send otherwise
+    ├── post-tool-use.ts  # successful output: build → guard → run stop → defer DENY / send otherwise
     ├── user-prompt.ts    # flush → newTrace → buildOtlpPayload → send → exit 0
     ├── session.ts
     ├── subagent.ts
@@ -232,11 +300,23 @@ npm run build         # tsc → dist/
 npm test              # vitest run
 npm run smoke:version # built CJS/ESM hooks -> local collector (after build)
 npm run smoke:model   # model attribution -> isolated loopback collector
+npm run smoke:guard   # output enforcement -> isolated loopback guard + collector
 npm run mock-server   # Generic OTLP collector at http://localhost:3000
 ```
 
 ### Local integration test
 
+`smoke:guard` exercises both built entrypoints with native `PostToolUse` `Read`
+stdin payloads and isolated HOME/plugin data. It verifies real guard requests,
+fixed/unchanged DENY JSON and zero collector calls with a 1-second hook deadline
+and a 4-second collector ACK delay. Both deny paths retain masked original
+spans in the existing retry queue; later hook processes flush the same IDs and
+evidence. Queue failures are diagnosed without losing the response, and
+guard-only mode never queues evidence. ALLOW/REVIEW/inactive/fail-open behavior,
+collector failure and failed-tool/permission/lifecycle routing remain covered.
+Only loopback fixture endpoints are contacted; no installed hooks or live
+Claude session are modified.
+
 `smoke:model` exercises fresh built CJS/ESM hooks with isolated HOME/plugin
 data, no real Claude executable, and no manager/guard calls. Supplied, missing,
 placeholder, correlated, cross-session/subagent, future, partial and oversized

package/dist/index.js

@@ -1,23 +1,26 @@
-"use strict";var en=Object.create;var De=Object.defineProperty;var tn=Object.getOwnPropertyDescriptor;var nn=Object.getOwnPropertyNames;var rn=Object.getPrototypeOf,on=Object.prototype.hasOwnProperty;var S=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var sn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of nn(t))!on.call(e,o)&&o!==n&&De(e,o,{get:()=>t[o],enumerable:!(r=tn(t,o))||r.enumerable});return e};var g=(e,t,n)=>(n=e!=null?en(rn(e)):{},sn(t||!e||!e.__esModule?De(n,"default",{value:e,enumerable:!0}):n,e));var oe=S(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.PATTERNS=_.MAX_BYTES=void 0;_.truncateTo=je;_.truncate=an;_.collectMatches=Ne;_.resolveOverlaps=Ue;_.applyMatches=Ce;_.redact=cn;_.MAX_BYTES=102400;function je(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function an(e){return je(e,_.MAX_BYTES)}_.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Ne(e,t){let n=[];for(let r of _.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=r.captureGroup??0,c=i[a];if(c===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let u=i.index,l=i.index+i[0].length,m=u+i[0].indexOf(c),k=m+c.length;n.push({start:u,end:l,replaceStart:m,replaceEnd:k,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function Ue(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Ce(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function cn(e,t={}){if(e.length===0)return e;let n=Ne(e,t);if(n.length===0)return e;let r=Ue(n);return Ce(e,r)}});var se=S(f=>{"use strict";var un=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=Fe;f.newSpanId=$e;f.snakeCase=fn;f.toOtlpValue=Ge;f.attrsFromRecord=pn;f.guardAttrs=qe;f.clientAttrs=Ve;f.enforceSpanBudget=Ye;f.buildPayload=mn;f.attachGuard=ze;f.mergeBatch=gn;var ln=un(require("crypto")),ie=oe(),dn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Fe(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=dn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function $e(){return ln.default.randomBytes(8).toString("hex")}function fn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Ie=new Set;function Y(e,t,n){let r=(0,ie.truncate)(t);if((n.skipRedactKeys??Ie).has(e))return r;let o=(n.bashContextKeys??Ie).has(e)?"bash":void 0;return(0,ie.redact)(r,{context:o})}function Ge(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:Y(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:Y(e,JSON.stringify(t),n)}}catch{return{stringValue:Y(e,String(t),n)}}default:return{stringValue:Y(e,String(t),n)}}}function pn(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,c=Ge(a,i,n);c!==null&&r.push({key:a,value:c})}return r}function qe(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ve(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function Be(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Le=1024;function Ye(e,t=f.MAX_SPAN_BYTES){let n=Be(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let l=Buffer.byteLength(u.value.stringValue,"utf-8");l>i&&(i=l,o=u.value)}if(o===null||i<=Le)break;let a=n-t,c=Math.max(Le,i-a-64);o.stringValue=(0,ie.truncateTo)(o.stringValue,c),n=Be(e)}return e}function mn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Fe(e.traceId),spanId:$e(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ye(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return ze(i,e.guard,e.clientTiming)}function ze(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...qe(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Ve(o)),e}function gn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Xe=S(O=>{"use strict";Object.defineProperty(O,"__esModule",{value:!0});O.GUARD_STATUS_REFUSED=O.GUARD_BUDGET_HEADER=void 0;O.evaluateGuard=En;var _n=1e4,hn="pinta-core";O.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function z(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var yn=new Set(["ALLOW","DENY","REVIEW"]);O.GUARD_STATUS_REFUSED=410;async function En(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??_n,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),r);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??hn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[O.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(c.status===O.GUARD_STATUS_REFUSED)return z(Date.now()-o,"refused");if(c.status!==200)return z(Date.now()-o,"error");let u=await c.json(),l=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!yn.has(u.decision)||!l)return z(Date.now()-o,"error");let m=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??m,clientRttMs:m}}catch(c){let u=c.name,l=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return z(Date.now()-o,l)}finally{clearTimeout(a)}}});var X=S($=>{"use strict";var vn=$&&$.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty($,"__esModule",{value:!0});$.atomicWriteFileSync=Pn;var Ke=vn(require("fs"));function Pn(e,t){let n=`${e}.${process.pid}.tmp`;Ke.default.writeFileSync(n,t),Ke.default.renameSync(n,e)}});var ue=S(w=>{"use strict";var He=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.MemoryRetryQueue=w.DiskRetryQueue=void 0;var h=He(require("fs")),K=He(require("path")),Sn=X(),H=1e3,Tn=50,bn=5,ae=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=K.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{h.default.mkdirSync(K.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+"use strict";var rn=Object.create;var Ue=Object.defineProperty;var on=Object.getOwnPropertyDescriptor;var sn=Object.getOwnPropertyNames;var an=Object.getPrototypeOf,un=Object.prototype.hasOwnProperty;var S=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var cn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of sn(t))!un.call(e,o)&&o!==n&&Ue(e,o,{get:()=>t[o],enumerable:!(r=on(t,o))||r.enumerable});return e};var p=(e,t,n)=>(n=e!=null?rn(an(e)):{},cn(t||!e||!e.__esModule?Ue(n,"default",{value:e,enumerable:!0}):n,e));var le=S(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.PATTERNS=_.MAX_BYTES=void 0;_.truncateTo=Ce;_.truncate=ln;_.collectMatches=Ie;_.resolveOverlaps=Be;_.applyMatches=Le;_.redact=dn;_.MAX_BYTES=102400;function Ce(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function ln(e){return Ce(e,_.MAX_BYTES)}_.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Ie(e,t){let n=[];for(let r of _.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=r.captureGroup??0,u=i[a];if(u===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,l=i.index+i[0].length,g=c+i[0].indexOf(u),w=g+u.length;n.push({start:c,end:l,replaceStart:g,replaceEnd:w,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function Be(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Le(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function dn(e,t={}){if(e.length===0)return e;let n=Ie(e,t);if(n.length===0)return e;let r=Be(n);return Le(e,r)}});var fe=S(f=>{"use strict";var fn=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=qe;f.newSpanId=Ve;f.snakeCase=gn;f.toOtlpValue=Ye;f.attrsFromRecord=_n;f.guardAttrs=ze;f.clientAttrs=Xe;f.enforceSpanBudget=Ke;f.buildPayload=hn;f.attachGuard=He;f.mergeBatch=yn;var pn=fn(require("crypto")),de=le(),mn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function qe(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=mn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ve(){return pn.default.randomBytes(8).toString("hex")}function gn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var $e=new Set;function K(e,t,n){let r=(0,de.truncate)(t);if((n.skipRedactKeys??$e).has(e))return r;let o=(n.bashContextKeys??$e).has(e)?"bash":void 0;return(0,de.redact)(r,{context:o})}function Ye(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:K(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:K(e,JSON.stringify(t),n)}}catch{return{stringValue:K(e,String(t),n)}}default:return{stringValue:K(e,String(t),n)}}}function _n(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,u=Ye(a,i,n);u!==null&&r.push({key:a,value:u})}return r}function ze(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Xe(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function Fe(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Ge=1024;function Ke(e,t=f.MAX_SPAN_BYTES){let n=Fe(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>i&&(i=l,o=c.value)}if(o===null||i<=Ge)break;let a=n-t,u=Math.max(Ge,i-a-64);o.stringValue=(0,de.truncateTo)(o.stringValue,u),n=Fe(e)}return e}function hn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:qe(e.traceId),spanId:Ve(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ke(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return He(i,e.guard,e.clientTiming)}function He(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...ze(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Xe(o)),e}function yn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Ze=S(A=>{"use strict";Object.defineProperty(A,"__esModule",{value:!0});A.GUARD_STATUS_REFUSED=A.GUARD_BUDGET_HEADER=void 0;A.evaluateGuard=Sn;var En=1e4,Pn="pinta-core";A.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function H(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var vn=new Set(["ALLOW","DENY","REVIEW"]);A.GUARD_STATUS_REFUSED=410;async function Sn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??En,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),r);try{let u=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??Pn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[A.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(u.status===A.GUARD_STATUS_REFUSED)return H(Date.now()-o,"refused");if(u.status!==200)return H(Date.now()-o,"error");let c=await u.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!vn.has(c.decision)||!l)return H(Date.now()-o,"error");let g=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??g,clientRttMs:g}}catch(u){let c=u.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return H(Date.now()-o,l)}finally{clearTimeout(a)}}});var Z=S(F=>{"use strict";var Tn=F&&F.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(F,"__esModule",{value:!0});F.atomicWriteFileSync=bn;var Je=Tn(require("fs"));function bn(e,t){let n=`${e}.${process.pid}.tmp`;Je.default.writeFileSync(n,t),Je.default.renameSync(n,e)}});var ge=S(x=>{"use strict";var We=x&&x.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(x,"__esModule",{value:!0});x.MemoryRetryQueue=x.DiskRetryQueue=void 0;var h=We(require("fs")),J=We(require("path")),On=Z(),W=1e3,An=50,kn=5,pe=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=J.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{h.default.mkdirSync(J.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
 `;h.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
 `)}}readAll(){try{let t=h.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){h.default.existsSync(this.filePath)&&h.default.unlinkSync(this.filePath);return}h.default.mkdirSync(K.default.dirname(this.filePath),{recursive:!0}),(0,Sn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){h.default.existsSync(this.filePath)&&h.default.unlinkSync(this.filePath);return}h.default.mkdirSync(J.default.dirname(this.filePath),{recursive:!0}),(0,On.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{h.default.mkdirSync(K.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<Tn;)try{let n=h.default.openSync(this.lockPath,"wx");return h.default.writeSync(n,String(process.pid)),h.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let i=h.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){h.default.unlinkSync(this.lockPath);continue}}catch{}let r=bn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{h.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=H)return;let n=t.length-H;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};w.DiskRetryQueue=ae;var ce=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>H&&this.entries.splice(0,this.entries.length-H)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};w.MemoryRetryQueue=ce});var tt=S(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.MemoryTransport=d.DiskTransport=d.MAX_POST_BYTES=void 0;d.parseHeadersEnv=Qe;d.envOptionsResolver=et;d.postOtlp=G;var Ze=ue(),Je=se(),On=5e3;d.MAX_POST_BYTES=900*1024;function Z(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function We(e,t,n){let r=[],o=[],i=[],a=0;for(let c of e){let u=t(c);if(u>n){o.push(c);continue}i.length>0&&a+u>n&&(r.push(i),i=[],a=0),i.push(c),a+=u}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function Qe(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function et(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Qe(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function G(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),On);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let c=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${c}${a?` body=${a}`:""}
+`)}}tryAcquireLock(){let t=Date.now();try{h.default.mkdirSync(J.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<An;)try{let n=h.default.openSync(this.lockPath,"wx");return h.default.writeSync(n,String(process.pid)),h.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let i=h.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){h.default.unlinkSync(this.lockPath);continue}}catch{}let r=kn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{h.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=W)return;let n=t.length-W;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};x.DiskRetryQueue=pe;var me=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>W&&this.entries.splice(0,this.entries.length-W)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};x.MemoryRetryQueue=me});var ot=S(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.MemoryTransport=d.DiskTransport=d.MAX_POST_BYTES=void 0;d.parseHeadersEnv=nt;d.envOptionsResolver=rt;d.postOtlp=G;var Qe=ge(),et=fe(),wn=5e3;d.MAX_POST_BYTES=900*1024;function Q(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function tt(e,t,n){let r=[],o=[],i=[],a=0;for(let u of e){let c=t(u);if(c>n){o.push(u);continue}i.length>0&&a+c>n&&(r.push(i),i=[],a=0),i.push(u),a+=c}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function nt(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function rt(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:nt(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function G(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),wn);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let u=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${u}${a?` body=${a}`:""}
 `),!1}return!0}catch(i){return process.stderr.write(`[${n}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var le=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ze.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??et}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await G(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=We(n,c=>Z(c.payload),d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${d.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...r),a=0;for(let c of r){if(!await G((0,Je.mergeBatch)(c.map(l=>l.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(i.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=Z(t);return n<=d.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};d.DiskTransport=le;var de=class{queue=new Ze.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(Z(t)>d.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await G(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=We(n,Z,d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${d.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...r),a=0;for(let c of r){if(!await G((0,Je.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of i.slice(a))this.queue.enqueue(c)}};d.MemoryTransport=de});var ge=S(j=>{"use strict";var me=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=rt;var nt=me(require("fs")),An=me(require("path")),kn=me(require("crypto")),wn=X(),fe="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function rt(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=fe[n&31]+t,n=Math.floor(n/32);let r=kn.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=fe[r[i]&31];for(;o.length<16;)o+=fe[0];return t+o}var pe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=rt();return this.save(t),t}currentTrace(){try{let t=nt.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{nt.default.mkdirSync(An.default.dirname(this.tracePath),{recursive:!0}),(0,wn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};j.TraceManager=pe});var ct=S(x=>{"use strict";var it=x&&x.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(x,"__esModule",{value:!0});x.MemorySessionTraceManager=x.DiskSessionTraceManager=void 0;var ot=it(require("fs")),xn=it(require("path")),st=ge(),Rn=X(),at=200,_e=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??at}read(){try{let t=JSON.parse(ot.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{ot.default.mkdirSync(xn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Rn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,st.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};x.DiskSessionTraceManager=_e;var he=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??at}newTrace(t){let n=t||"default",r=(0,st.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};x.MemorySessionTraceManager=he});var dt=S(N=>{"use strict";var ye=N&&N.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(N,"__esModule",{value:!0});N.envFilePath=jn;N.parseEnvFile=lt;N.loadEnvFile=Nn;var Mn=ye(require("node:fs")),Dn=ye(require("node:os")),ut=ye(require("node:path"));function jn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:ut.default.join(Dn.default.homedir(),e);return ut.default.join(o,t)}function lt(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),a=r.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function Nn(e){let t;try{t=Mn.default.readFileSync(e,"utf-8")}catch{return}let n=lt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var M=S(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_BUDGET_HEADER=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var R=oe();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return R.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return R.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return R.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return R.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return R.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return R.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return R.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return R.MAX_BYTES}});var y=se();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var Ee=Xe();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Ee.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Ee.GUARD_STATUS_REFUSED}});Object.defineProperty(s,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Ee.GUARD_BUDGET_HEADER}});var ft=ue();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return ft.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return ft.MemoryRetryQueue}});var C=tt();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return C.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return C.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return C.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return C.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return C.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return C.MAX_POST_BYTES}});var pt=ge();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return pt.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return pt.generateUlid}});var mt=ct();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return mt.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return mt.MemorySessionTraceManager}});var ve=dt();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return ve.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return ve.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return ve.loadEnvFile}})});var q=g(M());function Un(){return(0,q.envFilePath)(".claude","pinta-cc.env")}function gt(e=Un()){(0,q.loadEnvFile)(e)}function _t(){process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT&&!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT&&(process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT),process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&!process.env.OTEL_EXPORTER_OTLP_HEADERS&&(process.env.OTEL_EXPORTER_OTLP_HEADERS=`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`),!process.env.PINTA_RELAY_TOKEN&&process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.CLAUDE_PLUGIN_OPTION_API_KEY)}var Pe=g(require("path")),ht=g(M());function yt(){let e=process.env.CLAUDE_PLUGIN_ROOT||process.cwd(),t=process.env.CLAUDE_PLUGIN_DATA||Pe.default.join(e,".plugin-data");return{pluginRoot:e,pluginData:t,tracePath:Pe.default.join(t,"trace.json")}}function Se(){return(0,ht.envOptionsResolver)()!==null}function Et(e){return e.hook_event_name==="PreToolUse"}function vt(e){return e.hook_event_name==="PostToolUse"||e.hook_event_name==="PostToolUseFailure"}function Pt(e){return e.hook_event_name==="UserPromptSubmit"}function St(e){return e.hook_event_name==="SessionStart"||e.hook_event_name==="SessionEnd"}function Tt(e){return e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop"}function bt(e){return e.hook_event_name==="Stop"}function Ot(e){return e.hook_event_name==="PermissionRequest"||e.hook_event_name==="PermissionDenied"}var Cn=new Set(["Notification","TaskCreated","TaskCompleted"]);function At(e){return Cn.has(e.hook_event_name)}var Yt=g(M());var kt=g(M()),In=1e4,Bn="pinta-cc/1.10.0";function wt(e,t){return(0,kt.evaluateGuard)(e,t,{timeoutMs:In,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Bn})}var xt=g(M()),J=class extends xt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-cc"})}};var Rt=g(M()),W=class extends Rt.TraceManager{constructor(t){super(t.tracePath)}};var re=g(require("os"));var jt=require("node:child_process"),Q=require("node:crypto"),E=g(require("node:fs")),Nt=g(require("node:os")),p=g(require("node:path")),Ut=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,Ln=/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+\(Claude Code\)$/m,Fn=2e3,$n=24*60*60*1e3,Gn=3e4,be=8,Ct="claude-version.json",I=new Map;function A(e){return typeof e=="object"&&e!==null&&"code"in e&&typeof e.code=="string"?e.code:"UNKNOWN"}function v(e){process.stderr.write(`[pinta-cc] CLI version: ${e}
-`)}function ee(e){return A(e)==="ENOENT"||A(e)==="ENOTDIR"}function qn(){let e=process.env.CLAUDE_CODE_EXECPATH,t=process.platform==="win32"?["claude.exe","claude.cmd"]:["claude"],n;if(e)n=[e];else{let r=(process.env.PATH??"").split(p.default.delimiter).filter(o=>p.default.isAbsolute(o));try{r.push(p.default.join(Nt.default.homedir(),".local","bin"))}catch(o){v(`native install directory lookup failed (${A(o)})`)}n=r.flatMap(o=>t.map(i=>p.default.join(o,i)))}for(let r of new Set(n))try{let o=E.default.realpathSync(r),i=E.default.statSync(o);if(!i.isFile())continue;return!e&&process.platform!=="win32"&&E.default.accessSync(o,E.default.constants.X_OK),{file:o,fingerprint:(0,Q.createHash)("sha256").update(JSON.stringify([o,i.ino,i.size,i.mtimeMs,i.ctimeMs])).digest("hex")}}catch(o){ee(o)||v(`executable lookup failed (${A(o)})`)}return v(e?"configured executable is unavailable":"no Claude executable found in PATH or ~/.local/bin"),null}function Te(e){let t;try{t=JSON.parse(E.default.readFileSync(e,"utf8"))}catch(n){return ee(n)||v(`package metadata could not be read (${n instanceof SyntaxError?"INVALID_JSON":A(n)})`),null}return typeof t!="object"||t===null||!("name"in t)||!("version"in t)||typeof t.name!="string"||typeof t.version!="string"||!Ut.test(t.version)?null:t.name==="@anthropic-ai/claude-code"||t.name.startsWith("@anthropic-ai/claude-code-")?t.version:null}function Vn(e){let t=p.default.dirname(e),n=p.default.basename(t)===".bin"&&/^claude(?:\.cmd)?$/i.test(p.default.basename(e));for(let r=0;r<6;r++){let o=Te(p.default.join(t,"package.json"));if(o)return o;if(p.default.basename(e).toLowerCase()==="claude.cmd"&&r===0){let a=Te(p.default.join(t,"node_modules","@anthropic-ai","claude-code","package.json"));if(a)return a}if(n&&p.default.basename(t)==="node_modules"){let a=Te(p.default.join(t,"@anthropic-ai","claude-code","package.json"));if(a)return a}let i=p.default.dirname(t);if(i===t)break;t=i}return null}function Yn(e){return typeof e=="object"&&e!==null&&"fingerprint"in e&&typeof e.fingerprint=="string"&&/^[0-9a-f]{64}$/.test(e.fingerprint)&&"version"in e&&(e.version===null||typeof e.version=="string"&&Ut.test(e.version))&&"checkedAt"in e&&typeof e.checkedAt=="number"&&Number.isFinite(e.checkedAt)}function Mt(e,t){let n=t-e.checkedAt;return n>=0&&n<(e.version===null?Gn:$n)}function zn(e){if(!e)return[];let t=p.default.join(e,Ct);try{if(E.default.statSync(t).size>16384)return v("oversized version cache ignored"),[];let n=JSON.parse(E.default.readFileSync(t,"utf8"));if(Array.isArray(n)&&n.length<=be&&n.every(Yn))return n;v("invalid version cache ignored")}catch(n){ee(n)||v(`version cache read failed (${n instanceof SyntaxError?"INVALID_JSON":A(n)})`)}return[]}function Dt(e){for(I.delete(e.fingerprint),I.set(e.fingerprint,e);I.size>be;){let t=I.keys().next().value;t!==void 0&&I.delete(t)}}function Xn(e,t){if(!e)return;let n=p.default.join(e,Ct),r=`${n}.${process.pid}.${(0,Q.randomUUID)()}.tmp`;try{E.default.mkdirSync(e,{recursive:!0,mode:448}),E.default.writeFileSync(r,JSON.stringify(t),{encoding:"utf8",mode:384,flag:"wx"}),E.default.renameSync(r,n)}catch(o){v(`version cache write failed (${A(o)})`)}finally{try{E.default.unlinkSync(r)}catch(o){ee(o)||v(`temporary version cache cleanup failed (${A(o)})`)}}}function Kn(e){if(/\.(cmd|bat|ps1)$/i.test(e))return v("command shim has no readable Claude package metadata"),null;let t=(0,jt.spawnSync)(e,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],shell:!1,windowsHide:!0,timeout:Fn,killSignal:"SIGKILL",maxBuffer:4096});if(t.error||t.status!==0)return v(`version probe failed (${t.error?A(t.error):`exit ${t.status??t.signal}`})`),null;let n=Ln.exec(t.stdout.trim())?.[1];return n||(v("version probe did not identify Claude Code"),null)}function It(e){let t=qn();if(!t)return"unknown";let n=Vn(t.file);if(n)return n;let r=Date.now(),o=zn(e),i=[I.get(t.fingerprint),...o].find(c=>c&&c.fingerprint===t.fingerprint&&Mt(c,r));if(i)return Dt(i),i.version??"unknown";let a={fingerprint:t.fingerprint,version:Kn(t.file),checkedAt:Date.now()};return Dt(a),Xn(e,[...o.filter(c=>c.fingerprint!==a.fingerprint&&Mt(c,a.checkedAt)),a].slice(-be)),a.version??"unknown"}var D=g(require("node:path"));var T=g(require("node:fs")),Oe=g(require("node:path")),Hn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),Zn=256*1024,Jn=1024*1024,Wn=4096;function U(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function Ae(e){let t=U(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Hn.has(r.toLowerCase())?r:void 0}function Bt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function B(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function te(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Lt(e,t){let n=e.timestamp===void 0?te(t):te(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Ft(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Oe.default.isAbsolute(e)||Oe.default.extname(e)!==".jsonl")return;let t;try{t=T.default.openSync(e,T.default.constants.O_RDONLY|T.default.constants.O_NONBLOCK|(T.default.constants.O_NOFOLLOW??0));let n=T.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,Zn));if(T.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=U(JSON.parse(r.toString("utf8",0,o)))}catch{}let a=Math.max(0,n.size-Jn),c=n.size<=r.length?r:Buffer.alloc(n.size-a);if(c!==r&&T.default.readSync(t,c,0,c.length,a)!==c.length)return;let u=T.default.fstatSync(t);if(u.size<n.size||u.size===n.size&&u.mtimeMs!==n.mtimeMs)return;let l=a>0?c.indexOf(10)+1:0,m=c.lastIndexOf(10);if(a>0&&l===0||m<l)return;let k=[],b=0;for(;m>l&&b<Wn;){let V=c.lastIndexOf(10,m-1),F=Math.max(l,V+1),Re=c.toString("utf8",F,m).trim();if(Re){let Me=U(JSON.parse(Re));Me&&k.push(Me)}m=F-1,b++}return k.reverse(),{first:i,rows:k,complete:a===0&&m<0&&c[c.length-1]===10}}catch{return}finally{if(t!==void 0)try{T.default.closeSync(t)}catch{}}}function $t(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var Qn=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest","PermissionDenied"]);function er(e,t){let n=D.default.dirname(e);if(D.default.basename(n)!=="subagents"||D.default.basename(D.default.dirname(n))!==t)return;let r=/^agent-(.+)\.jsonl$/.exec(D.default.basename(e));return B(r?.[1])}function Gt(e,t){let n=Ae(e.model);if(n)return{name:n,source:"hook.model"};try{return tr(e,t)}catch{return}}function tr(e,t){if(!Qn.has(e.hook_event_name))return;let n=B(e.session_id),r=B(e.tool_use_id),o=Lt(e,t);if(!n||!r||o===void 0||typeof e.transcript_path!="string")return;let i=er(e.transcript_path,n),a=e.agent_id===void 0?i:B(e.agent_id);if(e.agent_id!==void 0&&!a||i!==void 0&&i!==a||!a&&e.agent_type!==void 0||D.default.basename(D.default.dirname(e.transcript_path))==="subagents"&&!i)return;let c=Ft(e.transcript_path);if(!c)return;let u=[];for(let l of c.rows){let m=te(l.timestamp);if(l.type!=="assistant"||l.sessionId!==n||m===void 0||m>o)continue;let k=l.agentId===void 0?void 0:B(l.agentId);if(k!==a||l.agentId!==void 0&&!k||l.isSidechain===!0&&!a)continue;let b=U(l.message);if(!b||b.role!==void 0&&b.role!=="assistant"||!Array.isArray(b.content)||!b.content.some(F=>U(F)?.type==="tool_use"&&U(F)?.id===r))continue;let V=Ae(b.model);u.push(V?{name:V,source:"transcript.assistant.message"}:void 0)}return $t(u)}var L=g(M()),ne;function nr(){if(ne===void 0)try{ne=re.default.userInfo().username}catch{ne=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ne}var qt="1.10.0",rr=new Set(["cc.hook","cc.tool_name","cc.tool_use_id","cc.session_id","cc.transcript_path","cc.cwd","cc.permission_mode"]),or=new Set(["cc.tool_input","cc.tool_response"]),ir={skipRedactKeys:rr,bashContextKeys:or};function sr(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"cc"}}),n.push({key:"cc.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,i]of Object.entries(e))o!=="hook_event_name"&&(r[o]=i);return Bt(r,Gt(e,t)),n.push(...(0,L.attrsFromRecord)(r,"cc",ir)),n}function ar(e){return[{key:"service.name",value:{stringValue:"claude-code"}},{key:"service.version",value:{stringValue:It(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-cc"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:qt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:nr()}},{key:"host.name",value:{stringValue:re.default.hostname()}},{key:"host.arch",value:{stringValue:re.default.arch()}}]}function Vt(e){let t=e.now??Date.now();return(0,L.buildPayload)({traceId:e.traceId,spanName:`cc.${(0,L.snakeCase)(e.event.hook_event_name)}`,attributes:sr(e.event,t),resource:ar(e.versionCacheDir),scope:{name:"pinta-cc",version:qt},now:t})}function ke(e,t,n={}){let r=new W(t),o=n.traceMode==="new"?r.newTrace():r.currentTrace();return Vt({event:e,traceId:o,versionCacheDir:t.pluginData})}async function we(e,t){if(!Se())return;let n=new J(t);await n.flush(),await n.send(e)}async function P(e,t,n={}){Se()&&await we(ke(e,t,n),t)}async function zt(e,t){let n=ke(e,t),r=await wt(n,process.env.PINTA_GUARD_ENDPOINT);if(r?.decision==="DENY"){let i={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:r.userMessage??r.reason??"guard_deny"}};process.stdout.write(JSON.stringify(i)+`
-`)}try{(0,Yt.attachGuard)(n,r),await we(n,t)}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
-`)}return 0}async function Xt(e,t){return await P(e,t),0}async function Kt(e,t){return await P(e,t,{traceMode:"new"}),0}async function Ht(e,t){return await P(e,t),0}async function Zt(e,t){return await P(e,t),0}async function Jt(e,t){return await P(e,t),0}async function Wt(e,t){return await P(e,t),0}async function xe(e){return 0}async function cr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Qt(){_t();let e=0;try{let t=yt(),n=await cr(),r=JSON.parse(n);At(r)?e=await xe(r):Et(r)?e=await zt(r,t):vt(r)?e=await Xt(r,t):Pt(r)?e=await Kt(r,t):St(r)?e=await Ht(r,t):Tt(r)?e=await Zt(r,t):bt(r)?e=await Jt(r,t):Ot(r)?e=await Wt(r,t):e=await xe(r)}catch(t){process.stderr.write(`[pinta-cc] error: ${t}
-`),e=0}return e}gt();async function ur(){let e=await Qt();process.exit(e)}ur();
+`),!1}finally{clearTimeout(o)}}var _e=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Qe.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??rt}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await G(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=tt(n,u=>Q(u.payload),d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${d.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...r),a=0;for(let u of r){if(!await G((0,et.mergeBatch)(u.map(l=>l.payload)),t,this.logPrefix))break;a+=u.length}this.queue.rewrite(i.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=Q(t);return n<=d.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};d.DiskTransport=_e;var he=class{queue=new Qe.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(Q(t)>d.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await G(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=tt(n,Q,d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${d.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...r),a=0;for(let u of r){if(!await G((0,et.mergeBatch)(u),t,this.logPrefix))break;a+=u.length}for(let u of i.slice(a))this.queue.enqueue(u)}};d.MemoryTransport=he});var ve=S(N=>{"use strict";var Pe=N&&N.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(N,"__esModule",{value:!0});N.TraceManager=void 0;N.generateUlid=st;var it=Pe(require("fs")),xn=Pe(require("path")),Rn=Pe(require("crypto")),Mn=Z(),ye="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function st(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=ye[n&31]+t,n=Math.floor(n/32);let r=Rn.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=ye[r[i]&31];for(;o.length<16;)o+=ye[0];return t+o}var Ee=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=st();return this.save(t),t}currentTrace(){try{let t=it.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{it.default.mkdirSync(xn.default.dirname(this.tracePath),{recursive:!0}),(0,Mn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};N.TraceManager=Ee});var dt=S(R=>{"use strict";var ut=R&&R.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(R,"__esModule",{value:!0});R.MemorySessionTraceManager=R.DiskSessionTraceManager=void 0;var at=ut(require("fs")),Dn=ut(require("path")),ct=ve(),Nn=Z(),lt=200,Se=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??lt}read(){try{let t=JSON.parse(at.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{at.default.mkdirSync(Dn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Nn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,ct.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};R.DiskSessionTraceManager=Se;var Te=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??lt}newTrace(t){let n=t||"default",r=(0,ct.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};R.MemorySessionTraceManager=Te});var mt=S(j=>{"use strict";var be=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.envFilePath=Cn;j.parseEnvFile=pt;j.loadEnvFile=In;var jn=be(require("node:fs")),Un=be(require("node:os")),ft=be(require("node:path"));function Cn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:ft.default.join(Un.default.homedir(),e);return ft.default.join(o,t)}function pt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),a=r.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function In(e){let t;try{t=jn.default.readFileSync(e,"utf-8")}catch{return}let n=pt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var T=S(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_BUDGET_HEADER=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var M=le();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return M.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return M.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return M.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return M.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return M.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return M.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return M.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return M.MAX_BYTES}});var y=fe();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var Oe=Ze();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Oe.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Oe.GUARD_STATUS_REFUSED}});Object.defineProperty(s,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Oe.GUARD_BUDGET_HEADER}});var gt=ge();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return gt.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return gt.MemoryRetryQueue}});var C=ot();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return C.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return C.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return C.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return C.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return C.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return C.MAX_POST_BYTES}});var _t=ve();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return _t.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return _t.generateUlid}});var ht=dt();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return ht.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return ht.MemorySessionTraceManager}});var Ae=mt();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return Ae.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return Ae.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return Ae.loadEnvFile}})});var q=p(T());function Bn(){return(0,q.envFilePath)(".claude","pinta-cc.env")}function yt(e=Bn()){(0,q.loadEnvFile)(e)}function Et(){process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT&&!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT&&(process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT),process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&!process.env.OTEL_EXPORTER_OTLP_HEADERS&&(process.env.OTEL_EXPORTER_OTLP_HEADERS=`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`),!process.env.PINTA_RELAY_TOKEN&&process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.CLAUDE_PLUGIN_OPTION_API_KEY)}var ke=p(require("path")),Pt=p(T());function vt(){let e=process.env.CLAUDE_PLUGIN_ROOT||process.cwd(),t=process.env.CLAUDE_PLUGIN_DATA||ke.default.join(e,".plugin-data");return{pluginRoot:e,pluginData:t,tracePath:ke.default.join(t,"trace.json")}}function ee(){return(0,Pt.envOptionsResolver)()!==null}function St(e){return e.hook_event_name==="PreToolUse"}function Tt(e){return e.hook_event_name==="PostToolUse"||e.hook_event_name==="PostToolUseFailure"}function bt(e){return e.hook_event_name==="UserPromptSubmit"}function Ot(e){return e.hook_event_name==="SessionStart"||e.hook_event_name==="SessionEnd"}function At(e){return e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop"}function kt(e){return e.hook_event_name==="Stop"}function wt(e){return e.hook_event_name==="PermissionRequest"||e.hook_event_name==="PermissionDenied"}var Ln=new Set(["Notification","TaskCreated","TaskCompleted"]);function xt(e){return Ln.has(e.hook_event_name)}var Xt=p(T());var Rt=p(T()),$n=1e4,Fn="pinta-cc/1.10.1";function te(e,t){return(0,Rt.evaluateGuard)(e,t,{timeoutMs:$n,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Fn})}var V=p(T());var Mt=p(T()),ne=class extends Mt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-cc"})}};var Dt=p(T()),re=class extends Dt.TraceManager{constructor(t){super(t.tracePath)}};var ue=p(require("os"));var Ut=require("node:child_process"),oe=require("node:crypto"),E=p(require("node:fs")),Ct=p(require("node:os")),m=p(require("node:path")),It=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,Gn=/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+\(Claude Code\)$/m,qn=2e3,Vn=24*60*60*1e3,Yn=3e4,xe=8,Bt="claude-version.json",I=new Map;function k(e){return typeof e=="object"&&e!==null&&"code"in e&&typeof e.code=="string"?e.code:"UNKNOWN"}function P(e){process.stderr.write(`[pinta-cc] CLI version: ${e}
+`)}function ie(e){return k(e)==="ENOENT"||k(e)==="ENOTDIR"}function zn(){let e=process.env.CLAUDE_CODE_EXECPATH,t=process.platform==="win32"?["claude.exe","claude.cmd"]:["claude"],n;if(e)n=[e];else{let r=(process.env.PATH??"").split(m.default.delimiter).filter(o=>m.default.isAbsolute(o));try{r.push(m.default.join(Ct.default.homedir(),".local","bin"))}catch(o){P(`native install directory lookup failed (${k(o)})`)}n=r.flatMap(o=>t.map(i=>m.default.join(o,i)))}for(let r of new Set(n))try{let o=E.default.realpathSync(r),i=E.default.statSync(o);if(!i.isFile())continue;return!e&&process.platform!=="win32"&&E.default.accessSync(o,E.default.constants.X_OK),{file:o,fingerprint:(0,oe.createHash)("sha256").update(JSON.stringify([o,i.ino,i.size,i.mtimeMs,i.ctimeMs])).digest("hex")}}catch(o){ie(o)||P(`executable lookup failed (${k(o)})`)}return P(e?"configured executable is unavailable":"no Claude executable found in PATH or ~/.local/bin"),null}function we(e){let t;try{t=JSON.parse(E.default.readFileSync(e,"utf8"))}catch(n){return ie(n)||P(`package metadata could not be read (${n instanceof SyntaxError?"INVALID_JSON":k(n)})`),null}return typeof t!="object"||t===null||!("name"in t)||!("version"in t)||typeof t.name!="string"||typeof t.version!="string"||!It.test(t.version)?null:t.name==="@anthropic-ai/claude-code"||t.name.startsWith("@anthropic-ai/claude-code-")?t.version:null}function Xn(e){let t=m.default.dirname(e),n=m.default.basename(t)===".bin"&&/^claude(?:\.cmd)?$/i.test(m.default.basename(e));for(let r=0;r<6;r++){let o=we(m.default.join(t,"package.json"));if(o)return o;if(m.default.basename(e).toLowerCase()==="claude.cmd"&&r===0){let a=we(m.default.join(t,"node_modules","@anthropic-ai","claude-code","package.json"));if(a)return a}if(n&&m.default.basename(t)==="node_modules"){let a=we(m.default.join(t,"@anthropic-ai","claude-code","package.json"));if(a)return a}let i=m.default.dirname(t);if(i===t)break;t=i}return null}function Kn(e){return typeof e=="object"&&e!==null&&"fingerprint"in e&&typeof e.fingerprint=="string"&&/^[0-9a-f]{64}$/.test(e.fingerprint)&&"version"in e&&(e.version===null||typeof e.version=="string"&&It.test(e.version))&&"checkedAt"in e&&typeof e.checkedAt=="number"&&Number.isFinite(e.checkedAt)}function Nt(e,t){let n=t-e.checkedAt;return n>=0&&n<(e.version===null?Yn:Vn)}function Hn(e){if(!e)return[];let t=m.default.join(e,Bt);try{if(E.default.statSync(t).size>16384)return P("oversized version cache ignored"),[];let n=JSON.parse(E.default.readFileSync(t,"utf8"));if(Array.isArray(n)&&n.length<=xe&&n.every(Kn))return n;P("invalid version cache ignored")}catch(n){ie(n)||P(`version cache read failed (${n instanceof SyntaxError?"INVALID_JSON":k(n)})`)}return[]}function jt(e){for(I.delete(e.fingerprint),I.set(e.fingerprint,e);I.size>xe;){let t=I.keys().next().value;t!==void 0&&I.delete(t)}}function Zn(e,t){if(!e)return;let n=m.default.join(e,Bt),r=`${n}.${process.pid}.${(0,oe.randomUUID)()}.tmp`;try{E.default.mkdirSync(e,{recursive:!0,mode:448}),E.default.writeFileSync(r,JSON.stringify(t),{encoding:"utf8",mode:384,flag:"wx"}),E.default.renameSync(r,n)}catch(o){P(`version cache write failed (${k(o)})`)}finally{try{E.default.unlinkSync(r)}catch(o){ie(o)||P(`temporary version cache cleanup failed (${k(o)})`)}}}function Jn(e){if(/\.(cmd|bat|ps1)$/i.test(e))return P("command shim has no readable Claude package metadata"),null;let t=(0,Ut.spawnSync)(e,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],shell:!1,windowsHide:!0,timeout:qn,killSignal:"SIGKILL",maxBuffer:4096});if(t.error||t.status!==0)return P(`version probe failed (${t.error?k(t.error):`exit ${t.status??t.signal}`})`),null;let n=Gn.exec(t.stdout.trim())?.[1];return n||(P("version probe did not identify Claude Code"),null)}function Lt(e){let t=zn();if(!t)return"unknown";let n=Xn(t.file);if(n)return n;let r=Date.now(),o=Hn(e),i=[I.get(t.fingerprint),...o].find(u=>u&&u.fingerprint===t.fingerprint&&Nt(u,r));if(i)return jt(i),i.version??"unknown";let a={fingerprint:t.fingerprint,version:Jn(t.file),checkedAt:Date.now()};return jt(a),Zn(e,[...o.filter(u=>u.fingerprint!==a.fingerprint&&Nt(u,a.checkedAt)),a].slice(-xe)),a.version??"unknown"}var D=p(require("node:path"));var b=p(require("node:fs")),Re=p(require("node:path")),Wn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),Qn=256*1024,er=1024*1024,tr=4096;function U(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function Me(e){let t=U(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Wn.has(r.toLowerCase())?r:void 0}function $t(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function B(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function se(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Ft(e,t){let n=e.timestamp===void 0?se(t):se(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Gt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Re.default.isAbsolute(e)||Re.default.extname(e)!==".jsonl")return;let t;try{t=b.default.openSync(e,b.default.constants.O_RDONLY|b.default.constants.O_NONBLOCK|(b.default.constants.O_NOFOLLOW??0));let n=b.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,Qn));if(b.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=U(JSON.parse(r.toString("utf8",0,o)))}catch{}let a=Math.max(0,n.size-er),u=n.size<=r.length?r:Buffer.alloc(n.size-a);if(u!==r&&b.default.readSync(t,u,0,u.length,a)!==u.length)return;let c=b.default.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=a>0?u.indexOf(10)+1:0,g=u.lastIndexOf(10);if(a>0&&l===0||g<l)return;let w=[],O=0;for(;g>l&&O<tr;){let X=u.lastIndexOf(10,g-1),$=Math.max(l,X+1),Ne=u.toString("utf8",$,g).trim();if(Ne){let je=U(JSON.parse(Ne));je&&w.push(je)}g=$-1,O++}return w.reverse(),{first:i,rows:w,complete:a===0&&g<0&&u[u.length-1]===10}}catch{return}finally{if(t!==void 0)try{b.default.closeSync(t)}catch{}}}function qt(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var nr=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest","PermissionDenied"]);function rr(e,t){let n=D.default.dirname(e);if(D.default.basename(n)!=="subagents"||D.default.basename(D.default.dirname(n))!==t)return;let r=/^agent-(.+)\.jsonl$/.exec(D.default.basename(e));return B(r?.[1])}function Vt(e,t){let n=Me(e.model);if(n)return{name:n,source:"hook.model"};try{return or(e,t)}catch{return}}function or(e,t){if(!nr.has(e.hook_event_name))return;let n=B(e.session_id),r=B(e.tool_use_id),o=Ft(e,t);if(!n||!r||o===void 0||typeof e.transcript_path!="string")return;let i=rr(e.transcript_path,n),a=e.agent_id===void 0?i:B(e.agent_id);if(e.agent_id!==void 0&&!a||i!==void 0&&i!==a||!a&&e.agent_type!==void 0||D.default.basename(D.default.dirname(e.transcript_path))==="subagents"&&!i)return;let u=Gt(e.transcript_path);if(!u)return;let c=[];for(let l of u.rows){let g=se(l.timestamp);if(l.type!=="assistant"||l.sessionId!==n||g===void 0||g>o)continue;let w=l.agentId===void 0?void 0:B(l.agentId);if(w!==a||l.agentId!==void 0&&!w||l.isSidechain===!0&&!a)continue;let O=U(l.message);if(!O||O.role!==void 0&&O.role!=="assistant"||!Array.isArray(O.content)||!O.content.some($=>U($)?.type==="tool_use"&&U($)?.id===r))continue;let X=Me(O.model);c.push(X?{name:X,source:"transcript.assistant.message"}:void 0)}return qt(c)}var L=p(T()),ae;function ir(){if(ae===void 0)try{ae=ue.default.userInfo().username}catch{ae=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ae}var Yt="1.10.1",sr=new Set(["cc.hook","cc.tool_name","cc.tool_use_id","cc.session_id","cc.transcript_path","cc.cwd","cc.permission_mode"]),ar=new Set(["cc.tool_input","cc.tool_response"]),ur={skipRedactKeys:sr,bashContextKeys:ar};function cr(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"cc"}}),n.push({key:"cc.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,i]of Object.entries(e))o!=="hook_event_name"&&(r[o]=i);return $t(r,Vt(e,t)),n.push(...(0,L.attrsFromRecord)(r,"cc",ur)),n}function lr(e){return[{key:"service.name",value:{stringValue:"claude-code"}},{key:"service.version",value:{stringValue:Lt(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-cc"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Yt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:ir()}},{key:"host.name",value:{stringValue:ue.default.hostname()}},{key:"host.arch",value:{stringValue:ue.default.arch()}}]}function zt(e){let t=e.now??Date.now();return(0,L.buildPayload)({traceId:e.traceId,spanName:`cc.${(0,L.snakeCase)(e.event.hook_event_name)}`,attributes:cr(e.event,t),resource:lr(e.versionCacheDir),scope:{name:"pinta-cc",version:Yt},now:t})}function Y(e,t,n={}){let r=new re(t),o=n.traceMode==="new"?r.newTrace():r.currentTrace();return zt({event:e,traceId:o,versionCacheDir:t.pluginData})}async function z(e,t){if(!ee())return;let n=new ne(t);await n.flush(),await n.send(e)}function ce(e,t){if(!ee())return;let n=Buffer.byteLength(JSON.stringify(e),"utf-8");if(n>V.MAX_POST_BYTES){process.stderr.write(`[pinta-cc] dropping oversized span payload (${n} > ${V.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`);return}new V.DiskRetryQueue(t.pluginData,"pinta-cc").enqueue(e)}async function v(e,t,n={}){ee()&&await z(Y(e,t,n),t)}async function Kt(e,t){let n=Y(e,t),r=await te(n,process.env.PINTA_GUARD_ENDPOINT);if(r?.decision==="DENY"){let i={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:r.userMessage??r.reason??"guard_deny"}};process.stdout.write(JSON.stringify(i)+`
+`)}try{if((0,Xt.attachGuard)(n,r),r?.decision==="DENY")return ce(n,t),0;await z(n,t)}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
+`)}return 0}var Ht=p(T());async function Zt(e,t){if(e.hook_event_name==="PostToolUseFailure")return await v(e,t),0;let n=Y(e,t),r=await te(n,process.env.PINTA_GUARD_ENDPOINT);r?.decision==="DENY"&&process.stdout.write(JSON.stringify({continue:!1,stopReason:"Pinta blocked this tool output. Start a new session before continuing."})+`
+`);try{if((0,Ht.attachGuard)(n,r),r&&n.resourceSpans[0].scopeSpans[0].spans[0].attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}}),r?.decision==="DENY")return ce(n,t),0;await z(n,t)}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
+`)}return 0}async function Jt(e,t){return await v(e,t,{traceMode:"new"}),0}async function Wt(e,t){return await v(e,t),0}async function Qt(e,t){return await v(e,t),0}async function en(e,t){return await v(e,t),0}async function tn(e,t){return await v(e,t),0}async function De(e){return 0}async function dr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function nn(){Et();let e=0;try{let t=vt(),n=await dr(),r=JSON.parse(n);xt(r)?e=await De(r):St(r)?e=await Kt(r,t):Tt(r)?e=await Zt(r,t):bt(r)?e=await Jt(r,t):Ot(r)?e=await Wt(r,t):At(r)?e=await Qt(r,t):kt(r)?e=await en(r,t):wt(r)?e=await tn(r,t):e=await De(r)}catch(t){process.stderr.write(`[pinta-cc] error: ${t}
+`),e=0}return e}yt();async function fr(){let e=await nn();process.exit(e)}fr();

package/dist/index.mjs

@@ -1,24 +1,27 @@
 import{createRequire as __pintaCreateRequire}from 'node:module';const require=__pintaCreateRequire(import.meta.url);
-var nn=Object.create;var Me=Object.defineProperty;var rn=Object.getOwnPropertyDescriptor;var on=Object.getOwnPropertyNames;var sn=Object.getPrototypeOf,an=Object.prototype.hasOwnProperty;var _=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var S=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var cn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of on(t))!an.call(e,o)&&o!==n&&Me(e,o,{get:()=>t[o],enumerable:!(r=rn(t,o))||r.enumerable});return e};var D=(e,t,n)=>(n=e!=null?nn(sn(e)):{},cn(t||!e||!e.__esModule?Me(n,"default",{value:e,enumerable:!0}):n,e));var oe=S(g=>{"use strict";Object.defineProperty(g,"__esModule",{value:!0});g.PATTERNS=g.MAX_BYTES=void 0;g.truncateTo=De;g.truncate=un;g.collectMatches=je;g.resolveOverlaps=Ie;g.applyMatches=Ne;g.redact=ln;g.MAX_BYTES=102400;function De(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function un(e){return De(e,g.MAX_BYTES)}g.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function je(e,t){let n=[];for(let r of g.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=r.captureGroup??0,c=i[a];if(c===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let u=i.index,l=i.index+i[0].length,p=u+i[0].indexOf(c),k=p+c.length;n.push({start:u,end:l,replaceStart:p,replaceEnd:k,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function Ie(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Ne(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function ln(e,t={}){if(e.length===0)return e;let n=je(e,t);if(n.length===0)return e;let r=Ie(n);return Ne(e,r)}});var se=S(d=>{"use strict";var fn=d&&d.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(d,"__esModule",{value:!0});d.MAX_SPAN_BYTES=void 0;d.ulidToTraceId=Le;d.newSpanId=Fe;d.snakeCase=mn;d.toOtlpValue=$e;d.attrsFromRecord=gn;d.guardAttrs=Ge;d.clientAttrs=qe;d.enforceSpanBudget=Ve;d.buildPayload=hn;d.attachGuard=ze;d.mergeBatch=_n;var dn=fn(_("crypto")),ie=oe(),pn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Le(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=pn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Fe(){return dn.default.randomBytes(8).toString("hex")}function mn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Ce=new Set;function X(e,t,n){let r=(0,ie.truncate)(t);if((n.skipRedactKeys??Ce).has(e))return r;let o=(n.bashContextKeys??Ce).has(e)?"bash":void 0;return(0,ie.redact)(r,{context:o})}function $e(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:X(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:X(e,JSON.stringify(t),n)}}catch{return{stringValue:X(e,String(t),n)}}default:return{stringValue:X(e,String(t),n)}}}function gn(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,c=$e(a,i,n);c!==null&&r.push({key:a,value:c})}return r}function Ge(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function qe(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}d.MAX_SPAN_BYTES=800*1024;function Ue(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Be=1024;function Ve(e,t=d.MAX_SPAN_BYTES){let n=Ue(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let l=Buffer.byteLength(u.value.stringValue,"utf-8");l>i&&(i=l,o=u.value)}if(o===null||i<=Be)break;let a=n-t,c=Math.max(Be,i-a-64);o.stringValue=(0,ie.truncateTo)(o.stringValue,c),n=Ue(e)}return e}function hn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Le(e.traceId),spanId:Fe(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ve(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return ze(i,e.guard,e.clientTiming)}function ze(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Ge(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...qe(o)),e}function _n(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Ye=S(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.GUARD_STATUS_REFUSED=b.GUARD_BUDGET_HEADER=void 0;b.evaluateGuard=vn;var yn=1e4,En="pinta-core";b.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function K(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Pn=new Set(["ALLOW","DENY","REVIEW"]);b.GUARD_STATUS_REFUSED=410;async function vn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??yn,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),r);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??En,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[b.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(c.status===b.GUARD_STATUS_REFUSED)return K(Date.now()-o,"refused");if(c.status!==200)return K(Date.now()-o,"error");let u=await c.json(),l=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!Pn.has(u.decision)||!l)return K(Date.now()-o,"error");let p=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??p,clientRttMs:p}}catch(c){let u=c.name,l=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return K(Date.now()-o,l)}finally{clearTimeout(a)}}});var H=S(G=>{"use strict";var Sn=G&&G.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(G,"__esModule",{value:!0});G.atomicWriteFileSync=Tn;var Xe=Sn(_("fs"));function Tn(e,t){let n=`${e}.${process.pid}.tmp`;Xe.default.writeFileSync(n,t),Xe.default.renameSync(n,e)}});var ue=S(w=>{"use strict";var Ke=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.MemoryRetryQueue=w.DiskRetryQueue=void 0;var h=Ke(_("fs")),Z=Ke(_("path")),bn=H(),W=1e3,On=50,An=5,ae=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=Z.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{h.default.mkdirSync(Z.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+var sn=Object.create;var Ne=Object.defineProperty;var an=Object.getOwnPropertyDescriptor;var cn=Object.getOwnPropertyNames;var un=Object.getPrototypeOf,ln=Object.prototype.hasOwnProperty;var _=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var S=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var fn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of cn(t))!ln.call(e,o)&&o!==n&&Ne(e,o,{get:()=>t[o],enumerable:!(r=an(t,o))||r.enumerable});return e};var O=(e,t,n)=>(n=e!=null?sn(un(e)):{},fn(t||!e||!e.__esModule?Ne(n,"default",{value:e,enumerable:!0}):n,e));var le=S(g=>{"use strict";Object.defineProperty(g,"__esModule",{value:!0});g.PATTERNS=g.MAX_BYTES=void 0;g.truncateTo=Ie;g.truncate=dn;g.collectMatches=Ce;g.resolveOverlaps=Ue;g.applyMatches=Be;g.redact=pn;g.MAX_BYTES=102400;function Ie(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function dn(e){return Ie(e,g.MAX_BYTES)}g.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Ce(e,t){let n=[];for(let r of g.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=r.captureGroup??0,c=i[a];if(c===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let u=i.index,l=i.index+i[0].length,p=u+i[0].indexOf(c),x=p+c.length;n.push({start:u,end:l,replaceStart:p,replaceEnd:x,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function Ue(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Be(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function pn(e,t={}){if(e.length===0)return e;let n=Ce(e,t);if(n.length===0)return e;let r=Ue(n);return Be(e,r)}});var de=S(d=>{"use strict";var mn=d&&d.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(d,"__esModule",{value:!0});d.MAX_SPAN_BYTES=void 0;d.ulidToTraceId=Ge;d.newSpanId=qe;d.snakeCase=_n;d.toOtlpValue=Ve;d.attrsFromRecord=yn;d.guardAttrs=Ye;d.clientAttrs=ze;d.enforceSpanBudget=Xe;d.buildPayload=En;d.attachGuard=Ke;d.mergeBatch=Pn;var gn=mn(_("crypto")),fe=le(),hn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ge(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=hn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function qe(){return gn.default.randomBytes(8).toString("hex")}function _n(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Le=new Set;function Z(e,t,n){let r=(0,fe.truncate)(t);if((n.skipRedactKeys??Le).has(e))return r;let o=(n.bashContextKeys??Le).has(e)?"bash":void 0;return(0,fe.redact)(r,{context:o})}function Ve(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:Z(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:Z(e,JSON.stringify(t),n)}}catch{return{stringValue:Z(e,String(t),n)}}default:return{stringValue:Z(e,String(t),n)}}}function yn(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,c=Ve(a,i,n);c!==null&&r.push({key:a,value:c})}return r}function Ye(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function ze(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}d.MAX_SPAN_BYTES=800*1024;function Fe(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var $e=1024;function Xe(e,t=d.MAX_SPAN_BYTES){let n=Fe(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let l=Buffer.byteLength(u.value.stringValue,"utf-8");l>i&&(i=l,o=u.value)}if(o===null||i<=$e)break;let a=n-t,c=Math.max($e,i-a-64);o.stringValue=(0,fe.truncateTo)(o.stringValue,c),n=Fe(e)}return e}function En(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Ge(e.traceId),spanId:qe(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Xe(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Ke(i,e.guard,e.clientTiming)}function Ke(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Ye(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...ze(o)),e}function Pn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var He=S(A=>{"use strict";Object.defineProperty(A,"__esModule",{value:!0});A.GUARD_STATUS_REFUSED=A.GUARD_BUDGET_HEADER=void 0;A.evaluateGuard=bn;var vn=1e4,Sn="pinta-core";A.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function J(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Tn=new Set(["ALLOW","DENY","REVIEW"]);A.GUARD_STATUS_REFUSED=410;async function bn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??vn,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),r);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??Sn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[A.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(c.status===A.GUARD_STATUS_REFUSED)return J(Date.now()-o,"refused");if(c.status!==200)return J(Date.now()-o,"error");let u=await c.json(),l=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!Tn.has(u.decision)||!l)return J(Date.now()-o,"error");let p=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??p,clientRttMs:p}}catch(c){let u=c.name,l=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return J(Date.now()-o,l)}finally{clearTimeout(a)}}});var W=S(G=>{"use strict";var On=G&&G.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(G,"__esModule",{value:!0});G.atomicWriteFileSync=An;var Ze=On(_("fs"));function An(e,t){let n=`${e}.${process.pid}.tmp`;Ze.default.writeFileSync(n,t),Ze.default.renameSync(n,e)}});var ge=S(R=>{"use strict";var Je=R&&R.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(R,"__esModule",{value:!0});R.MemoryRetryQueue=R.DiskRetryQueue=void 0;var h=Je(_("fs")),Q=Je(_("path")),kn=W(),ee=1e3,wn=50,xn=5,pe=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=Q.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{h.default.mkdirSync(Q.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
 `;h.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
 `)}}readAll(){try{let t=h.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){h.default.existsSync(this.filePath)&&h.default.unlinkSync(this.filePath);return}h.default.mkdirSync(Z.default.dirname(this.filePath),{recursive:!0}),(0,bn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){h.default.existsSync(this.filePath)&&h.default.unlinkSync(this.filePath);return}h.default.mkdirSync(Q.default.dirname(this.filePath),{recursive:!0}),(0,kn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{h.default.mkdirSync(Z.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<On;)try{let n=h.default.openSync(this.lockPath,"wx");return h.default.writeSync(n,String(process.pid)),h.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let i=h.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){h.default.unlinkSync(this.lockPath);continue}}catch{}let r=An,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{h.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=W)return;let n=t.length-W;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};w.DiskRetryQueue=ae;var ce=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>W&&this.entries.splice(0,this.entries.length-W)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};w.MemoryRetryQueue=ce});var et=S(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.MemoryTransport=f.DiskTransport=f.MAX_POST_BYTES=void 0;f.parseHeadersEnv=Je;f.envOptionsResolver=Qe;f.postOtlp=q;var He=ue(),Ze=se(),kn=5e3;f.MAX_POST_BYTES=900*1024;function J(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function We(e,t,n){let r=[],o=[],i=[],a=0;for(let c of e){let u=t(c);if(u>n){o.push(c);continue}i.length>0&&a+u>n&&(r.push(i),i=[],a=0),i.push(c),a+=u}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function Je(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function Qe(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Je(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function q(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),kn);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let c=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${c}${a?` body=${a}`:""}
+`)}}tryAcquireLock(){let t=Date.now();try{h.default.mkdirSync(Q.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<wn;)try{let n=h.default.openSync(this.lockPath,"wx");return h.default.writeSync(n,String(process.pid)),h.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let i=h.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){h.default.unlinkSync(this.lockPath);continue}}catch{}let r=xn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{h.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=ee)return;let n=t.length-ee;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};R.DiskRetryQueue=pe;var me=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>ee&&this.entries.splice(0,this.entries.length-ee)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};R.MemoryRetryQueue=me});var rt=S(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.MemoryTransport=f.DiskTransport=f.MAX_POST_BYTES=void 0;f.parseHeadersEnv=tt;f.envOptionsResolver=nt;f.postOtlp=q;var We=ge(),Qe=de(),Rn=5e3;f.MAX_POST_BYTES=900*1024;function te(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function et(e,t,n){let r=[],o=[],i=[],a=0;for(let c of e){let u=t(c);if(u>n){o.push(c);continue}i.length>0&&a+u>n&&(r.push(i),i=[],a=0),i.push(c),a+=u}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function tt(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function nt(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:tt(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function q(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),Rn);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let c=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${c}${a?` body=${a}`:""}
 `),!1}return!0}catch(i){return process.stderr.write(`[${n}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var le=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new He.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Qe}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await q(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=We(n,c=>J(c.payload),f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${f.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...r),a=0;for(let c of r){if(!await q((0,Ze.mergeBatch)(c.map(l=>l.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(i.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=J(t);return n<=f.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};f.DiskTransport=le;var fe=class{queue=new He.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(J(t)>f.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await q(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=We(n,J,f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${f.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...r),a=0;for(let c of r){if(!await q((0,Ze.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of i.slice(a))this.queue.enqueue(c)}};f.MemoryTransport=fe});var ge=S(j=>{"use strict";var me=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=nt;var tt=me(_("fs")),wn=me(_("path")),xn=me(_("crypto")),Rn=H(),de="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function nt(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=de[n&31]+t,n=Math.floor(n/32);let r=xn.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=de[r[i]&31];for(;o.length<16;)o+=de[0];return t+o}var pe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=nt();return this.save(t),t}currentTrace(){try{let t=tt.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{tt.default.mkdirSync(wn.default.dirname(this.tracePath),{recursive:!0}),(0,Rn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};j.TraceManager=pe});var at=S(x=>{"use strict";var ot=x&&x.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(x,"__esModule",{value:!0});x.MemorySessionTraceManager=x.DiskSessionTraceManager=void 0;var rt=ot(_("fs")),Mn=ot(_("path")),it=ge(),Dn=H(),st=200,he=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??st}read(){try{let t=JSON.parse(rt.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{rt.default.mkdirSync(Mn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Dn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,it.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};x.DiskSessionTraceManager=he;var _e=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??st}newTrace(t){let n=t||"default",r=(0,it.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};x.MemorySessionTraceManager=_e});var lt=S(I=>{"use strict";var ye=I&&I.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(I,"__esModule",{value:!0});I.envFilePath=Nn;I.parseEnvFile=ut;I.loadEnvFile=Cn;var jn=ye(_("node:fs")),In=ye(_("node:os")),ct=ye(_("node:path"));function Nn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:ct.default.join(In.default.homedir(),e);return ct.default.join(o,t)}function ut(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),a=r.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function Cn(e){let t;try{t=jn.default.readFileSync(e,"utf-8")}catch{return}let n=ut(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var M=S(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_BUDGET_HEADER=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var R=oe();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return R.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return R.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return R.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return R.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return R.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return R.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return R.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return R.MAX_BYTES}});var y=se();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var Ee=Ye();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Ee.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Ee.GUARD_STATUS_REFUSED}});Object.defineProperty(s,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Ee.GUARD_BUDGET_HEADER}});var ft=ue();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return ft.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return ft.MemoryRetryQueue}});var U=et();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return U.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return U.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return U.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return U.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return U.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return U.MAX_POST_BYTES}});var dt=ge();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return dt.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return dt.generateUlid}});var pt=at();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return pt.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return pt.MemorySessionTraceManager}});var Pe=lt();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return Pe.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return Pe.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return Pe.loadEnvFile}})});import{realpathSync as kr}from"node:fs";import{pathToFileURL as wr}from"node:url";var V=D(M());function Un(){return(0,V.envFilePath)(".claude","pinta-cc.env")}function mt(e=Un()){(0,V.loadEnvFile)(e)}function gt(){process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT&&!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT&&(process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT),process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&!process.env.OTEL_EXPORTER_OTLP_HEADERS&&(process.env.OTEL_EXPORTER_OTLP_HEADERS=`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`),!process.env.PINTA_RELAY_TOKEN&&process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.CLAUDE_PLUGIN_OPTION_API_KEY)}var _t=D(M());import ht from"path";function yt(){let e=process.env.CLAUDE_PLUGIN_ROOT||process.cwd(),t=process.env.CLAUDE_PLUGIN_DATA||ht.join(e,".plugin-data");return{pluginRoot:e,pluginData:t,tracePath:ht.join(t,"trace.json")}}function ve(){return(0,_t.envOptionsResolver)()!==null}function Et(e){return e.hook_event_name==="PreToolUse"}function Pt(e){return e.hook_event_name==="PostToolUse"||e.hook_event_name==="PostToolUseFailure"}function vt(e){return e.hook_event_name==="UserPromptSubmit"}function St(e){return e.hook_event_name==="SessionStart"||e.hook_event_name==="SessionEnd"}function Tt(e){return e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop"}function bt(e){return e.hook_event_name==="Stop"}function Ot(e){return e.hook_event_name==="PermissionRequest"||e.hook_event_name==="PermissionDenied"}var Bn=new Set(["Notification","TaskCreated","TaskCompleted"]);function At(e){return Bn.has(e.hook_event_name)}var Vt=D(M());var kt=D(M()),Ln=1e4,Fn="pinta-cc/1.10.0";function wt(e,t){return(0,kt.evaluateGuard)(e,t,{timeoutMs:Ln,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Fn})}var xt=D(M()),Q=class extends xt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-cc"})}};var Rt=D(M()),ee=class extends Rt.TraceManager{constructor(t){super(t.tracePath)}};import Oe from"os";import{spawnSync as $n}from"node:child_process";import{createHash as Gn,randomUUID as qn}from"node:crypto";import v from"node:fs";import Vn from"node:os";import m from"node:path";var jt=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,zn=/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+\(Claude Code\)$/m,Yn=2e3,Xn=24*60*60*1e3,Kn=3e4,Te=8,It="claude-version.json",B=new Map;function O(e){return typeof e=="object"&&e!==null&&"code"in e&&typeof e.code=="string"?e.code:"UNKNOWN"}function E(e){process.stderr.write(`[pinta-cc] CLI version: ${e}
-`)}function te(e){return O(e)==="ENOENT"||O(e)==="ENOTDIR"}function Hn(){let e=process.env.CLAUDE_CODE_EXECPATH,t=process.platform==="win32"?["claude.exe","claude.cmd"]:["claude"],n;if(e)n=[e];else{let r=(process.env.PATH??"").split(m.delimiter).filter(o=>m.isAbsolute(o));try{r.push(m.join(Vn.homedir(),".local","bin"))}catch(o){E(`native install directory lookup failed (${O(o)})`)}n=r.flatMap(o=>t.map(i=>m.join(o,i)))}for(let r of new Set(n))try{let o=v.realpathSync(r),i=v.statSync(o);if(!i.isFile())continue;return!e&&process.platform!=="win32"&&v.accessSync(o,v.constants.X_OK),{file:o,fingerprint:Gn("sha256").update(JSON.stringify([o,i.ino,i.size,i.mtimeMs,i.ctimeMs])).digest("hex")}}catch(o){te(o)||E(`executable lookup failed (${O(o)})`)}return E(e?"configured executable is unavailable":"no Claude executable found in PATH or ~/.local/bin"),null}function Se(e){let t;try{t=JSON.parse(v.readFileSync(e,"utf8"))}catch(n){return te(n)||E(`package metadata could not be read (${n instanceof SyntaxError?"INVALID_JSON":O(n)})`),null}return typeof t!="object"||t===null||!("name"in t)||!("version"in t)||typeof t.name!="string"||typeof t.version!="string"||!jt.test(t.version)?null:t.name==="@anthropic-ai/claude-code"||t.name.startsWith("@anthropic-ai/claude-code-")?t.version:null}function Zn(e){let t=m.dirname(e),n=m.basename(t)===".bin"&&/^claude(?:\.cmd)?$/i.test(m.basename(e));for(let r=0;r<6;r++){let o=Se(m.join(t,"package.json"));if(o)return o;if(m.basename(e).toLowerCase()==="claude.cmd"&&r===0){let a=Se(m.join(t,"node_modules","@anthropic-ai","claude-code","package.json"));if(a)return a}if(n&&m.basename(t)==="node_modules"){let a=Se(m.join(t,"@anthropic-ai","claude-code","package.json"));if(a)return a}let i=m.dirname(t);if(i===t)break;t=i}return null}function Wn(e){return typeof e=="object"&&e!==null&&"fingerprint"in e&&typeof e.fingerprint=="string"&&/^[0-9a-f]{64}$/.test(e.fingerprint)&&"version"in e&&(e.version===null||typeof e.version=="string"&&jt.test(e.version))&&"checkedAt"in e&&typeof e.checkedAt=="number"&&Number.isFinite(e.checkedAt)}function Mt(e,t){let n=t-e.checkedAt;return n>=0&&n<(e.version===null?Kn:Xn)}function Jn(e){if(!e)return[];let t=m.join(e,It);try{if(v.statSync(t).size>16384)return E("oversized version cache ignored"),[];let n=JSON.parse(v.readFileSync(t,"utf8"));if(Array.isArray(n)&&n.length<=Te&&n.every(Wn))return n;E("invalid version cache ignored")}catch(n){te(n)||E(`version cache read failed (${n instanceof SyntaxError?"INVALID_JSON":O(n)})`)}return[]}function Dt(e){for(B.delete(e.fingerprint),B.set(e.fingerprint,e);B.size>Te;){let t=B.keys().next().value;t!==void 0&&B.delete(t)}}function Qn(e,t){if(!e)return;let n=m.join(e,It),r=`${n}.${process.pid}.${qn()}.tmp`;try{v.mkdirSync(e,{recursive:!0,mode:448}),v.writeFileSync(r,JSON.stringify(t),{encoding:"utf8",mode:384,flag:"wx"}),v.renameSync(r,n)}catch(o){E(`version cache write failed (${O(o)})`)}finally{try{v.unlinkSync(r)}catch(o){te(o)||E(`temporary version cache cleanup failed (${O(o)})`)}}}function er(e){if(/\.(cmd|bat|ps1)$/i.test(e))return E("command shim has no readable Claude package metadata"),null;let t=$n(e,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],shell:!1,windowsHide:!0,timeout:Yn,killSignal:"SIGKILL",maxBuffer:4096});if(t.error||t.status!==0)return E(`version probe failed (${t.error?O(t.error):`exit ${t.status??t.signal}`})`),null;let n=zn.exec(t.stdout.trim())?.[1];return n||(E("version probe did not identify Claude Code"),null)}function Nt(e){let t=Hn();if(!t)return"unknown";let n=Zn(t.file);if(n)return n;let r=Date.now(),o=Jn(e),i=[B.get(t.fingerprint),...o].find(c=>c&&c.fingerprint===t.fingerprint&&Mt(c,r));if(i)return Dt(i),i.version??"unknown";let a={fingerprint:t.fingerprint,version:er(t.file),checkedAt:Date.now()};return Dt(a),Qn(e,[...o.filter(c=>c.fingerprint!==a.fingerprint&&Mt(c,a.checkedAt)),a].slice(-Te)),a.version??"unknown"}import C from"node:path";import A from"node:fs";import Ct from"node:path";var tr=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),nr=256*1024,rr=1024*1024,or=4096;function N(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function be(e){let t=N(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!tr.has(r.toLowerCase())?r:void 0}function Ut(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function L(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function ne(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Bt(e,t){let n=e.timestamp===void 0?ne(t):ne(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Lt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Ct.isAbsolute(e)||Ct.extname(e)!==".jsonl")return;let t;try{t=A.openSync(e,A.constants.O_RDONLY|A.constants.O_NONBLOCK|(A.constants.O_NOFOLLOW??0));let n=A.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,nr));if(A.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=N(JSON.parse(r.toString("utf8",0,o)))}catch{}let a=Math.max(0,n.size-rr),c=n.size<=r.length?r:Buffer.alloc(n.size-a);if(c!==r&&A.readSync(t,c,0,c.length,a)!==c.length)return;let u=A.fstatSync(t);if(u.size<n.size||u.size===n.size&&u.mtimeMs!==n.mtimeMs)return;let l=a>0?c.indexOf(10)+1:0,p=c.lastIndexOf(10);if(a>0&&l===0||p<l)return;let k=[],T=0;for(;p>l&&T<or;){let Y=c.lastIndexOf(10,p-1),$=Math.max(l,Y+1),xe=c.toString("utf8",$,p).trim();if(xe){let Re=N(JSON.parse(xe));Re&&k.push(Re)}p=$-1,T++}return k.reverse(),{first:i,rows:k,complete:a===0&&p<0&&c[c.length-1]===10}}catch{return}finally{if(t!==void 0)try{A.closeSync(t)}catch{}}}function Ft(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var ir=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest","PermissionDenied"]);function sr(e,t){let n=C.dirname(e);if(C.basename(n)!=="subagents"||C.basename(C.dirname(n))!==t)return;let r=/^agent-(.+)\.jsonl$/.exec(C.basename(e));return L(r?.[1])}function $t(e,t){let n=be(e.model);if(n)return{name:n,source:"hook.model"};try{return ar(e,t)}catch{return}}function ar(e,t){if(!ir.has(e.hook_event_name))return;let n=L(e.session_id),r=L(e.tool_use_id),o=Bt(e,t);if(!n||!r||o===void 0||typeof e.transcript_path!="string")return;let i=sr(e.transcript_path,n),a=e.agent_id===void 0?i:L(e.agent_id);if(e.agent_id!==void 0&&!a||i!==void 0&&i!==a||!a&&e.agent_type!==void 0||C.basename(C.dirname(e.transcript_path))==="subagents"&&!i)return;let c=Lt(e.transcript_path);if(!c)return;let u=[];for(let l of c.rows){let p=ne(l.timestamp);if(l.type!=="assistant"||l.sessionId!==n||p===void 0||p>o)continue;let k=l.agentId===void 0?void 0:L(l.agentId);if(k!==a||l.agentId!==void 0&&!k||l.isSidechain===!0&&!a)continue;let T=N(l.message);if(!T||T.role!==void 0&&T.role!=="assistant"||!Array.isArray(T.content)||!T.content.some($=>N($)?.type==="tool_use"&&N($)?.id===r))continue;let Y=be(T.model);u.push(Y?{name:Y,source:"transcript.assistant.message"}:void 0)}return Ft(u)}var F=D(M()),re;function cr(){if(re===void 0)try{re=Oe.userInfo().username}catch{re=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return re}var Gt="1.10.0",ur=new Set(["cc.hook","cc.tool_name","cc.tool_use_id","cc.session_id","cc.transcript_path","cc.cwd","cc.permission_mode"]),lr=new Set(["cc.tool_input","cc.tool_response"]),fr={skipRedactKeys:ur,bashContextKeys:lr};function dr(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"cc"}}),n.push({key:"cc.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,i]of Object.entries(e))o!=="hook_event_name"&&(r[o]=i);return Ut(r,$t(e,t)),n.push(...(0,F.attrsFromRecord)(r,"cc",fr)),n}function pr(e){return[{key:"service.name",value:{stringValue:"claude-code"}},{key:"service.version",value:{stringValue:Nt(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-cc"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Gt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:cr()}},{key:"host.name",value:{stringValue:Oe.hostname()}},{key:"host.arch",value:{stringValue:Oe.arch()}}]}function qt(e){let t=e.now??Date.now();return(0,F.buildPayload)({traceId:e.traceId,spanName:`cc.${(0,F.snakeCase)(e.event.hook_event_name)}`,attributes:dr(e.event,t),resource:pr(e.versionCacheDir),scope:{name:"pinta-cc",version:Gt},now:t})}function Ae(e,t,n={}){let r=new ee(t),o=n.traceMode==="new"?r.newTrace():r.currentTrace();return qt({event:e,traceId:o,versionCacheDir:t.pluginData})}async function ke(e,t){if(!ve())return;let n=new Q(t);await n.flush(),await n.send(e)}async function P(e,t,n={}){ve()&&await ke(Ae(e,t,n),t)}async function zt(e,t){let n=Ae(e,t),r=await wt(n,process.env.PINTA_GUARD_ENDPOINT);if(r?.decision==="DENY"){let i={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:r.userMessage??r.reason??"guard_deny"}};process.stdout.write(JSON.stringify(i)+`
-`)}try{(0,Vt.attachGuard)(n,r),await ke(n,t)}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
-`)}return 0}async function Yt(e,t){return await P(e,t),0}async function Xt(e,t){return await P(e,t,{traceMode:"new"}),0}async function Kt(e,t){return await P(e,t),0}async function Ht(e,t){return await P(e,t),0}async function Zt(e,t){return await P(e,t),0}async function Wt(e,t){return await P(e,t),0}async function we(e){return 0}async function mr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Jt(){gt();let e=0;try{let t=yt(),n=await mr(),r=JSON.parse(n);At(r)?e=await we(r):Et(r)?e=await zt(r,t):Pt(r)?e=await Yt(r,t):vt(r)?e=await Xt(r,t):St(r)?e=await Kt(r,t):Tt(r)?e=await Ht(r,t):bt(r)?e=await Zt(r,t):Ot(r)?e=await Wt(r,t):e=await we(r)}catch(t){process.stderr.write(`[pinta-cc] error: ${t}
-`),e=0}return e}import{opendir as gr,stat as hr}from"node:fs/promises";import{homedir as _r}from"node:os";import z from"node:path";var yr="pinta-cc",Qt="memory";function Er(){let e=process.env.CLAUDE_CONFIG_DIR;return e&&e.length>0?e:z.join(_r(),".claude")}function Pr(){return z.join(Er(),"projects")}function vr(e,t){return z.relative(e,t).split(z.sep).join("/")}function Sr(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function Tr(e){let t=e.split("/");if(t.length<2)return{};let n=t[0],r=t[1];return t.length===2?r.endsWith(".jsonl")?{projectKey:n,sessionId:r.slice(0,-6)}:{projectKey:n}:r===Qt?{projectKey:n}:{projectKey:n,sessionId:r}}function br(e){return e.endsWith(".jsonl")?"session-log":e.split("/")[1]===Qt?"memory":e.endsWith(".json")?"meta":"other"}async function en(){return[Pr()]}async function*tn(e,t){let n;try{n=await gr(t)}catch{return}try{for await(let r of n){let o=z.join(t,r.name);r.isDirectory()?yield*tn(e,o):r.isFile()&&(yield{absPath:o,relPath:vr(e,o)})}}catch{return}}async function*Or(e){let[t]=await en(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of tn(t,t)){let i;try{i=await hr(r)}catch{continue}if(n!==void 0&&i.mtime.getTime()<=n)continue;let{projectKey:a,sessionId:c}=Tr(o);yield{relPath:o,absPath:r,size:i.size,mtime:i.mtime,sessionId:c,projectKey:a,semantics:Sr(o)}}}var Ar={id:yr,roots:en,scan:Or,classify:br};mt();function xr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===wr(kr(e)).href}catch{return!1}}async function Rr(){let e=await Jt();process.exit(e)}xr()&&Rr();export{Ar as lifecycle};
+`),!1}finally{clearTimeout(o)}}var he=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new We.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??nt}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await q(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=et(n,c=>te(c.payload),f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${f.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...r),a=0;for(let c of r){if(!await q((0,Qe.mergeBatch)(c.map(l=>l.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(i.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=te(t);return n<=f.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};f.DiskTransport=he;var _e=class{queue=new We.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(te(t)>f.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await q(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=et(n,te,f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${f.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...r),a=0;for(let c of r){if(!await q((0,Qe.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of i.slice(a))this.queue.enqueue(c)}};f.MemoryTransport=_e});var ve=S(j=>{"use strict";var Pe=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=it;var ot=Pe(_("fs")),Dn=Pe(_("path")),Mn=Pe(_("crypto")),jn=W(),ye="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function it(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=ye[n&31]+t,n=Math.floor(n/32);let r=Mn.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=ye[r[i]&31];for(;o.length<16;)o+=ye[0];return t+o}var Ee=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=it();return this.save(t),t}currentTrace(){try{let t=ot.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{ot.default.mkdirSync(Dn.default.dirname(this.tracePath),{recursive:!0}),(0,jn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};j.TraceManager=Ee});var lt=S(D=>{"use strict";var at=D&&D.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(D,"__esModule",{value:!0});D.MemorySessionTraceManager=D.DiskSessionTraceManager=void 0;var st=at(_("fs")),Nn=at(_("path")),ct=ve(),In=W(),ut=200,Se=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??ut}read(){try{let t=JSON.parse(st.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{st.default.mkdirSync(Nn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,In.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,ct.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};D.DiskSessionTraceManager=Se;var Te=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??ut}newTrace(t){let n=t||"default",r=(0,ct.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};D.MemorySessionTraceManager=Te});var pt=S(N=>{"use strict";var be=N&&N.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(N,"__esModule",{value:!0});N.envFilePath=Bn;N.parseEnvFile=dt;N.loadEnvFile=Ln;var Cn=be(_("node:fs")),Un=be(_("node:os")),ft=be(_("node:path"));function Bn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:ft.default.join(Un.default.homedir(),e);return ft.default.join(o,t)}function dt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),a=r.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function Ln(e){let t;try{t=Cn.default.readFileSync(e,"utf-8")}catch{return}let n=dt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var T=S(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_BUDGET_HEADER=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var M=le();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return M.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return M.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return M.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return M.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return M.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return M.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return M.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return M.MAX_BYTES}});var y=de();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var Oe=He();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Oe.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Oe.GUARD_STATUS_REFUSED}});Object.defineProperty(s,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Oe.GUARD_BUDGET_HEADER}});var mt=ge();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return mt.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return mt.MemoryRetryQueue}});var U=rt();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return U.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return U.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return U.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return U.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return U.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return U.MAX_POST_BYTES}});var gt=ve();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return gt.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return gt.generateUlid}});var ht=lt();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return ht.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return ht.MemorySessionTraceManager}});var Ae=pt();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return Ae.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return Ae.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return Ae.loadEnvFile}})});import{realpathSync as Rr}from"node:fs";import{pathToFileURL as Dr}from"node:url";var V=O(T());function Fn(){return(0,V.envFilePath)(".claude","pinta-cc.env")}function _t(e=Fn()){(0,V.loadEnvFile)(e)}function yt(){process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT&&!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT&&(process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT),process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&!process.env.OTEL_EXPORTER_OTLP_HEADERS&&(process.env.OTEL_EXPORTER_OTLP_HEADERS=`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`),!process.env.PINTA_RELAY_TOKEN&&process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.CLAUDE_PLUGIN_OPTION_API_KEY)}var Pt=O(T());import Et from"path";function vt(){let e=process.env.CLAUDE_PLUGIN_ROOT||process.cwd(),t=process.env.CLAUDE_PLUGIN_DATA||Et.join(e,".plugin-data");return{pluginRoot:e,pluginData:t,tracePath:Et.join(t,"trace.json")}}function ne(){return(0,Pt.envOptionsResolver)()!==null}function St(e){return e.hook_event_name==="PreToolUse"}function Tt(e){return e.hook_event_name==="PostToolUse"||e.hook_event_name==="PostToolUseFailure"}function bt(e){return e.hook_event_name==="UserPromptSubmit"}function Ot(e){return e.hook_event_name==="SessionStart"||e.hook_event_name==="SessionEnd"}function At(e){return e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop"}function kt(e){return e.hook_event_name==="Stop"}function wt(e){return e.hook_event_name==="PermissionRequest"||e.hook_event_name==="PermissionDenied"}var $n=new Set(["Notification","TaskCreated","TaskCompleted"]);function xt(e){return $n.has(e.hook_event_name)}var zt=O(T());var Rt=O(T()),Gn=1e4,qn="pinta-cc/1.10.1";function re(e,t){return(0,Rt.evaluateGuard)(e,t,{timeoutMs:Gn,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:qn})}var Y=O(T());var Dt=O(T()),oe=class extends Dt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-cc"})}};var Mt=O(T()),ie=class extends Mt.TraceManager{constructor(t){super(t.tracePath)}};import Re from"os";import{spawnSync as Vn}from"node:child_process";import{createHash as Yn,randomUUID as zn}from"node:crypto";import v from"node:fs";import Xn from"node:os";import m from"node:path";var It=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,Kn=/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+\(Claude Code\)$/m,Hn=2e3,Zn=24*60*60*1e3,Jn=3e4,we=8,Ct="claude-version.json",B=new Map;function k(e){return typeof e=="object"&&e!==null&&"code"in e&&typeof e.code=="string"?e.code:"UNKNOWN"}function E(e){process.stderr.write(`[pinta-cc] CLI version: ${e}
+`)}function se(e){return k(e)==="ENOENT"||k(e)==="ENOTDIR"}function Wn(){let e=process.env.CLAUDE_CODE_EXECPATH,t=process.platform==="win32"?["claude.exe","claude.cmd"]:["claude"],n;if(e)n=[e];else{let r=(process.env.PATH??"").split(m.delimiter).filter(o=>m.isAbsolute(o));try{r.push(m.join(Xn.homedir(),".local","bin"))}catch(o){E(`native install directory lookup failed (${k(o)})`)}n=r.flatMap(o=>t.map(i=>m.join(o,i)))}for(let r of new Set(n))try{let o=v.realpathSync(r),i=v.statSync(o);if(!i.isFile())continue;return!e&&process.platform!=="win32"&&v.accessSync(o,v.constants.X_OK),{file:o,fingerprint:Yn("sha256").update(JSON.stringify([o,i.ino,i.size,i.mtimeMs,i.ctimeMs])).digest("hex")}}catch(o){se(o)||E(`executable lookup failed (${k(o)})`)}return E(e?"configured executable is unavailable":"no Claude executable found in PATH or ~/.local/bin"),null}function ke(e){let t;try{t=JSON.parse(v.readFileSync(e,"utf8"))}catch(n){return se(n)||E(`package metadata could not be read (${n instanceof SyntaxError?"INVALID_JSON":k(n)})`),null}return typeof t!="object"||t===null||!("name"in t)||!("version"in t)||typeof t.name!="string"||typeof t.version!="string"||!It.test(t.version)?null:t.name==="@anthropic-ai/claude-code"||t.name.startsWith("@anthropic-ai/claude-code-")?t.version:null}function Qn(e){let t=m.dirname(e),n=m.basename(t)===".bin"&&/^claude(?:\.cmd)?$/i.test(m.basename(e));for(let r=0;r<6;r++){let o=ke(m.join(t,"package.json"));if(o)return o;if(m.basename(e).toLowerCase()==="claude.cmd"&&r===0){let a=ke(m.join(t,"node_modules","@anthropic-ai","claude-code","package.json"));if(a)return a}if(n&&m.basename(t)==="node_modules"){let a=ke(m.join(t,"@anthropic-ai","claude-code","package.json"));if(a)return a}let i=m.dirname(t);if(i===t)break;t=i}return null}function er(e){return typeof e=="object"&&e!==null&&"fingerprint"in e&&typeof e.fingerprint=="string"&&/^[0-9a-f]{64}$/.test(e.fingerprint)&&"version"in e&&(e.version===null||typeof e.version=="string"&&It.test(e.version))&&"checkedAt"in e&&typeof e.checkedAt=="number"&&Number.isFinite(e.checkedAt)}function jt(e,t){let n=t-e.checkedAt;return n>=0&&n<(e.version===null?Jn:Zn)}function tr(e){if(!e)return[];let t=m.join(e,Ct);try{if(v.statSync(t).size>16384)return E("oversized version cache ignored"),[];let n=JSON.parse(v.readFileSync(t,"utf8"));if(Array.isArray(n)&&n.length<=we&&n.every(er))return n;E("invalid version cache ignored")}catch(n){se(n)||E(`version cache read failed (${n instanceof SyntaxError?"INVALID_JSON":k(n)})`)}return[]}function Nt(e){for(B.delete(e.fingerprint),B.set(e.fingerprint,e);B.size>we;){let t=B.keys().next().value;t!==void 0&&B.delete(t)}}function nr(e,t){if(!e)return;let n=m.join(e,Ct),r=`${n}.${process.pid}.${zn()}.tmp`;try{v.mkdirSync(e,{recursive:!0,mode:448}),v.writeFileSync(r,JSON.stringify(t),{encoding:"utf8",mode:384,flag:"wx"}),v.renameSync(r,n)}catch(o){E(`version cache write failed (${k(o)})`)}finally{try{v.unlinkSync(r)}catch(o){se(o)||E(`temporary version cache cleanup failed (${k(o)})`)}}}function rr(e){if(/\.(cmd|bat|ps1)$/i.test(e))return E("command shim has no readable Claude package metadata"),null;let t=Vn(e,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],shell:!1,windowsHide:!0,timeout:Hn,killSignal:"SIGKILL",maxBuffer:4096});if(t.error||t.status!==0)return E(`version probe failed (${t.error?k(t.error):`exit ${t.status??t.signal}`})`),null;let n=Kn.exec(t.stdout.trim())?.[1];return n||(E("version probe did not identify Claude Code"),null)}function Ut(e){let t=Wn();if(!t)return"unknown";let n=Qn(t.file);if(n)return n;let r=Date.now(),o=tr(e),i=[B.get(t.fingerprint),...o].find(c=>c&&c.fingerprint===t.fingerprint&&jt(c,r));if(i)return Nt(i),i.version??"unknown";let a={fingerprint:t.fingerprint,version:rr(t.file),checkedAt:Date.now()};return Nt(a),nr(e,[...o.filter(c=>c.fingerprint!==a.fingerprint&&jt(c,a.checkedAt)),a].slice(-we)),a.version??"unknown"}import C from"node:path";import w from"node:fs";import Bt from"node:path";var or=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),ir=256*1024,sr=1024*1024,ar=4096;function I(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function xe(e){let t=I(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!or.has(r.toLowerCase())?r:void 0}function Lt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function L(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function ae(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Ft(e,t){let n=e.timestamp===void 0?ae(t):ae(e.timestamp);return n!==void 0&&n<=t?n:void 0}function $t(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Bt.isAbsolute(e)||Bt.extname(e)!==".jsonl")return;let t;try{t=w.openSync(e,w.constants.O_RDONLY|w.constants.O_NONBLOCK|(w.constants.O_NOFOLLOW??0));let n=w.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,ir));if(w.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=I(JSON.parse(r.toString("utf8",0,o)))}catch{}let a=Math.max(0,n.size-sr),c=n.size<=r.length?r:Buffer.alloc(n.size-a);if(c!==r&&w.readSync(t,c,0,c.length,a)!==c.length)return;let u=w.fstatSync(t);if(u.size<n.size||u.size===n.size&&u.mtimeMs!==n.mtimeMs)return;let l=a>0?c.indexOf(10)+1:0,p=c.lastIndexOf(10);if(a>0&&l===0||p<l)return;let x=[],b=0;for(;p>l&&b<ar;){let H=c.lastIndexOf(10,p-1),$=Math.max(l,H+1),Me=c.toString("utf8",$,p).trim();if(Me){let je=I(JSON.parse(Me));je&&x.push(je)}p=$-1,b++}return x.reverse(),{first:i,rows:x,complete:a===0&&p<0&&c[c.length-1]===10}}catch{return}finally{if(t!==void 0)try{w.closeSync(t)}catch{}}}function Gt(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var cr=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest","PermissionDenied"]);function ur(e,t){let n=C.dirname(e);if(C.basename(n)!=="subagents"||C.basename(C.dirname(n))!==t)return;let r=/^agent-(.+)\.jsonl$/.exec(C.basename(e));return L(r?.[1])}function qt(e,t){let n=xe(e.model);if(n)return{name:n,source:"hook.model"};try{return lr(e,t)}catch{return}}function lr(e,t){if(!cr.has(e.hook_event_name))return;let n=L(e.session_id),r=L(e.tool_use_id),o=Ft(e,t);if(!n||!r||o===void 0||typeof e.transcript_path!="string")return;let i=ur(e.transcript_path,n),a=e.agent_id===void 0?i:L(e.agent_id);if(e.agent_id!==void 0&&!a||i!==void 0&&i!==a||!a&&e.agent_type!==void 0||C.basename(C.dirname(e.transcript_path))==="subagents"&&!i)return;let c=$t(e.transcript_path);if(!c)return;let u=[];for(let l of c.rows){let p=ae(l.timestamp);if(l.type!=="assistant"||l.sessionId!==n||p===void 0||p>o)continue;let x=l.agentId===void 0?void 0:L(l.agentId);if(x!==a||l.agentId!==void 0&&!x||l.isSidechain===!0&&!a)continue;let b=I(l.message);if(!b||b.role!==void 0&&b.role!=="assistant"||!Array.isArray(b.content)||!b.content.some($=>I($)?.type==="tool_use"&&I($)?.id===r))continue;let H=xe(b.model);u.push(H?{name:H,source:"transcript.assistant.message"}:void 0)}return Gt(u)}var F=O(T()),ce;function fr(){if(ce===void 0)try{ce=Re.userInfo().username}catch{ce=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ce}var Vt="1.10.1",dr=new Set(["cc.hook","cc.tool_name","cc.tool_use_id","cc.session_id","cc.transcript_path","cc.cwd","cc.permission_mode"]),pr=new Set(["cc.tool_input","cc.tool_response"]),mr={skipRedactKeys:dr,bashContextKeys:pr};function gr(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"cc"}}),n.push({key:"cc.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,i]of Object.entries(e))o!=="hook_event_name"&&(r[o]=i);return Lt(r,qt(e,t)),n.push(...(0,F.attrsFromRecord)(r,"cc",mr)),n}function hr(e){return[{key:"service.name",value:{stringValue:"claude-code"}},{key:"service.version",value:{stringValue:Ut(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-cc"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Vt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:fr()}},{key:"host.name",value:{stringValue:Re.hostname()}},{key:"host.arch",value:{stringValue:Re.arch()}}]}function Yt(e){let t=e.now??Date.now();return(0,F.buildPayload)({traceId:e.traceId,spanName:`cc.${(0,F.snakeCase)(e.event.hook_event_name)}`,attributes:gr(e.event,t),resource:hr(e.versionCacheDir),scope:{name:"pinta-cc",version:Vt},now:t})}function z(e,t,n={}){let r=new ie(t),o=n.traceMode==="new"?r.newTrace():r.currentTrace();return Yt({event:e,traceId:o,versionCacheDir:t.pluginData})}async function X(e,t){if(!ne())return;let n=new oe(t);await n.flush(),await n.send(e)}function ue(e,t){if(!ne())return;let n=Buffer.byteLength(JSON.stringify(e),"utf-8");if(n>Y.MAX_POST_BYTES){process.stderr.write(`[pinta-cc] dropping oversized span payload (${n} > ${Y.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`);return}new Y.DiskRetryQueue(t.pluginData,"pinta-cc").enqueue(e)}async function P(e,t,n={}){ne()&&await X(z(e,t,n),t)}async function Xt(e,t){let n=z(e,t),r=await re(n,process.env.PINTA_GUARD_ENDPOINT);if(r?.decision==="DENY"){let i={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:r.userMessage??r.reason??"guard_deny"}};process.stdout.write(JSON.stringify(i)+`
+`)}try{if((0,zt.attachGuard)(n,r),r?.decision==="DENY")return ue(n,t),0;await X(n,t)}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
+`)}return 0}var Kt=O(T());async function Ht(e,t){if(e.hook_event_name==="PostToolUseFailure")return await P(e,t),0;let n=z(e,t),r=await re(n,process.env.PINTA_GUARD_ENDPOINT);r?.decision==="DENY"&&process.stdout.write(JSON.stringify({continue:!1,stopReason:"Pinta blocked this tool output. Start a new session before continuing."})+`
+`);try{if((0,Kt.attachGuard)(n,r),r&&n.resourceSpans[0].scopeSpans[0].spans[0].attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}}),r?.decision==="DENY")return ue(n,t),0;await X(n,t)}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
+`)}return 0}async function Zt(e,t){return await P(e,t,{traceMode:"new"}),0}async function Jt(e,t){return await P(e,t),0}async function Wt(e,t){return await P(e,t),0}async function Qt(e,t){return await P(e,t),0}async function en(e,t){return await P(e,t),0}async function De(e){return 0}async function _r(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function tn(){yt();let e=0;try{let t=vt(),n=await _r(),r=JSON.parse(n);xt(r)?e=await De(r):St(r)?e=await Xt(r,t):Tt(r)?e=await Ht(r,t):bt(r)?e=await Zt(r,t):Ot(r)?e=await Jt(r,t):At(r)?e=await Wt(r,t):kt(r)?e=await Qt(r,t):wt(r)?e=await en(r,t):e=await De(r)}catch(t){process.stderr.write(`[pinta-cc] error: ${t}
+`),e=0}return e}import{opendir as yr,stat as Er}from"node:fs/promises";import{homedir as Pr}from"node:os";import K from"node:path";var vr="pinta-cc",nn="memory";function Sr(){let e=process.env.CLAUDE_CONFIG_DIR;return e&&e.length>0?e:K.join(Pr(),".claude")}function Tr(){return K.join(Sr(),"projects")}function br(e,t){return K.relative(e,t).split(K.sep).join("/")}function Or(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function Ar(e){let t=e.split("/");if(t.length<2)return{};let n=t[0],r=t[1];return t.length===2?r.endsWith(".jsonl")?{projectKey:n,sessionId:r.slice(0,-6)}:{projectKey:n}:r===nn?{projectKey:n}:{projectKey:n,sessionId:r}}function kr(e){return e.endsWith(".jsonl")?"session-log":e.split("/")[1]===nn?"memory":e.endsWith(".json")?"meta":"other"}async function rn(){return[Tr()]}async function*on(e,t){let n;try{n=await yr(t)}catch{return}try{for await(let r of n){let o=K.join(t,r.name);r.isDirectory()?yield*on(e,o):r.isFile()&&(yield{absPath:o,relPath:br(e,o)})}}catch{return}}async function*wr(e){let[t]=await rn(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of on(t,t)){let i;try{i=await Er(r)}catch{continue}if(n!==void 0&&i.mtime.getTime()<=n)continue;let{projectKey:a,sessionId:c}=Ar(o);yield{relPath:o,absPath:r,size:i.size,mtime:i.mtime,sessionId:c,projectKey:a,semantics:Or(o)}}}var xr={id:vr,roots:rn,scan:wr,classify:kr};_t();function Mr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===Dr(Rr(e)).href}catch{return!1}}async function jr(){let e=await tn();process.exit(e)}Mr()&&jr();export{xr as lifecycle};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinta-ai/pinta-cc",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "Generic OTLP forwarder for Claude Code hook events",
   "main": "dist/index.js",
   "exports": {
@@ -38,6 +38,7 @@
     "smoke:import": "node scripts/smoke-import.mjs",
     "smoke:version": "node scripts/smoke-version.mjs",
     "smoke:model": "node scripts/smoke-model.mjs",
+    "smoke:guard": "node scripts/smoke-guard.mjs",
     "mock-server": "npx tsx tools/mock-server.ts",
     "prepublishOnly": "npm run build"
   },