@pinta-ai/pinta-cc 1.7.1 → 1.9.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pinta-cc",
   "description": "Generic OTLP forwarder for Claude Code hook events. Converts hook events into OTLP/HTTP spans and sends them to any OpenTelemetry-compatible collector.",
-  "version": "1.7.1",
+  "version": "1.9.0",
   "license": "PolyForm-Noncommercial-1.0.0",
   "userConfig": {
     "endpoint": {

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to pinta-cc are documented here.
 
+## [1.9.0] - 2026-09-22
+
+### Added
+
+- Truthful scalar `cc.model` IDs from explicit hook metadata, with source
+  preservation and omission of placeholders or stringified objects/arrays.
+- Bounded, read-only assistant transcript lookup tied to the exact session,
+  tool-use ID, timestamp and subagent. Missing or uncorrelated evidence stays
+  absent; a SessionStart selection is never cached onto later tool hooks.
+- CJS/ESM model and SDK-version wire checks in the Node 18/20/22 CI matrix.
+
+### Compatibility
+
+- Still requires Pinta Manager 0.1.11 or later. Guard payloads, denial ordering,
+  event counts and redaction are unchanged; bundled `@pinta-ai/core` remains
+  `^0.8.0`. No new required envelope fields.
+- Host-selected models are not independently verified provider routing.
+
+## [1.8.0] - 2026-09-20
+
+### Changed
+
+- The guard is asked about the span, not about a summary of it. Until now the
+  `PreToolUse` gate assembled a five-field `GuardInput` (tool name, input, working
+  directory, hook, session) beside the span that carried the same facts under
+  `cc.*`, and the two were free to drift — `cwd` (PTA-176) and the hook name
+  (PTA-207) were on the span and missing from the summary. Now the span is built
+  first, `POST /guard/evaluate` receives that OTLP payload unwrapped, the manager
+  projects it through the same AgentEvent assembly the backend stores it with,
+  and the verdict is attached to the same object before it is relayed — the span
+  the manager judged is the span the backend stores, `spanId` included.
+  Requires Pinta Manager 0.1.11 or later; an older manager answers `400` and the
+  gate fails open (`pinta.guard.fail_open_reason: error`), a newer manager that
+  refuses a body answers `410`, recorded as `refused`.
+- `@pinta-ai/core` `^0.6.0` → `^0.8.0` (`evaluateGuard(payload)`, `attachGuard`).
+
 ## [1.7.1] - 2026-09-19
 
 ### Fixed

package/README.md

@@ -128,8 +128,55 @@ when telemetry is disabled.
 |-----------|-------|
 | `ingest.type` | `"cc"` (discriminator for aware-backend parser) |
 | `cc.hook` | Hook event name (e.g. `PreToolUse`) |
+| `cc.model` | Exact host-reported scalar model ID, when attributable |
+| `cc.model_source` | Host provenance or adapter evidence (see below) |
 | `cc.<key>` | All other top-level hook event fields (Bronze flattening) |
 
+### Model attribution and its limits
+
+An explicit hook `model` takes precedence: a string or a descriptor's `id`
+(or `name` when no `id` field exists), not stringified JSON. The source preserves
+the host's supplied `model_source` or defaults to `hook.model`.
+In particular, a SessionStart model is a host-selected model,
+**not proof of the routed response model**, and it is not cached for later
+tool calls.
+
+JSON-stringified objects/arrays (including `[object Object]`) are not IDs.
+Provider and requested/response fields remain unchanged. If a transcript
+replaces an unusable model, `model_source` describes that transcript evidence;
+a previous host source is retained as `cc.model_original_source`.
+
+For tool hooks without a usable model, the adapter reads the supplied
+`transcript_path` and uses `message.model` only from an `assistant` record whose
+`message.content` contains the exact `tool_use` ID from `tool_use_id`.
+`cc.model_source=transcript.assistant.message` identifies this evidence.
+The record's `sessionId` must match, its timestamp must not be in the future
+relative to the hook (or processing time if no hook timestamp is supplied),
+and its subagent identity must match. The agent is identified by `agent_id` or
+a session-bound `<session_id>/subagents/agent-<id>.jsonl` path, never by agent
+name. Sidechain/child records cannot supply a parent tool's model.
+
+PreToolUse, PostToolUse, PostToolUseFailure and permission hooks can use this
+lookup when they carry `tool_use_id`. Stop/lifecycle hooks without an explicit
+model, missing or not-yet-flushed assistant records, unsupported transcript
+formats, ambiguous/conflicting IDs, and records outside the read window remain
+model-less. There is no "latest assistant" fallback, no session-wide
+carry-forward, and no inference from global configuration, process/CLI
+versions, agent names or user prose.
+
+Blank, `unknown`, `undefined`, `null`, `n/a`, `none`, `auto` and `default` are
+omitted case-insensitively. Non-ID objects, control characters and IDs longer
+than 512 characters are also rejected. The input event is not mutated, and
+all model attributes still use the existing redaction pipeline.
+
+Model lookup is read-only and bounded to a 256 KiB prefix plus a 1 MiB tail
+and 4,096 complete JSONL records, with no subprocess, directory scan or model
+cache. Only absolute `.jsonl` regular files are opened; missing/unreadable
+files, leaf symlinks, malformed records and invalid identities fail quietly,
+and incomplete boundary lines are ignored. Transcript contents are never
+logged or exported. Explicit models and missing tool IDs require no
+model-lookup IO. Guard behavior and event counts are unchanged.
+
 ## Architecture
 
 ```
@@ -184,11 +231,19 @@ npm install
 npm run build         # tsc → dist/
 npm test              # vitest run
 npm run smoke:version # built CJS/ESM hooks -> local collector (after build)
+npm run smoke:model   # model attribution -> isolated loopback collector
 npm run mock-server   # Generic OTLP collector at http://localhost:3000
 ```
 
 ### Local integration test
 
+`smoke:model` exercises fresh built CJS/ESM hooks with isolated HOME/plugin
+data, no real Claude executable, and no manager/guard calls. Supplied, missing,
+placeholder, correlated, cross-session/subagent, future, partial and oversized
+transcript cases are verified. Results go to `.validation/model-smoke.json`.
+Optionally pass `-- --baseline=<previous-built-index.js>` for paired hook
+wall-time comparisons, including Node startup, local HTTP and scheduler noise.
+
 `smoke:version` uses isolated plugin data and a loopback collector, not your real
 configuration. On macOS/Linux it supplies an executable fixture by default.
 To check a real native installation (required on Windows), run after building:

package/dist/index.js

@@ -1,23 +1,23 @@
-"use strict";var Rt=Object.create;var ge=Object.defineProperty;var It=Object.getOwnPropertyDescriptor;var Ct=Object.getOwnPropertyNames;var Nt=Object.getPrototypeOf,Dt=Object.prototype.hasOwnProperty;var E=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Ut=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Ct(t))!Dt.call(e,o)&&o!==r&&ge(e,o,{get:()=>t[o],enumerable:!(n=It(t,o))||n.enumerable});return e};var y=(e,t,r)=>(r=e!=null?Rt(Nt(e)):{},Ut(t||!e||!e.__esModule?ge(r,"default",{value:e,enumerable:!0}):r,e));var z=E(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.PATTERNS=d.MAX_BYTES=void 0;d.truncateTo=_e;d.truncate=Bt;d.collectMatches=he;d.resolveOverlaps=ye;d.applyMatches=ve;d.redact=Lt;d.MAX_BYTES=102400;function _e(e,t){let r=Buffer.from(e,"utf-8");return r.length<=t?e:`${r.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function Bt(e){return _e(e,d.MAX_BYTES)}d.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function he(e,t){let r=[];for(let n of d.PATTERNS){if(n.requireContext&&n.requireContext!==t.context)continue;let o=new RegExp(n.regex.source,n.regex.flags),s;for(;(s=o.exec(e))!==null;){let a=n.captureGroup??0,c=s[a];if(c===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let u=s.index,P=s.index+s[0].length,R=u+s[0].indexOf(c),jt=R+c.length;r.push({start:u,end:P,replaceStart:R,replaceEnd:jt,type:n.type}),s.index===o.lastIndex&&o.lastIndex++}}return r}function ye(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),r=[],n=-1;for(let o of t)o.start<n||(r.push(o),n=o.end);return r}function ve(e,t){let r=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),n=e;for(let o of r)n=n.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+n.slice(o.replaceEnd);return n}function Lt(e,t={}){if(e.length===0)return e;let r=he(e,t);if(r.length===0)return e;let n=ye(r);return ve(e,n)}});var Z=E(f=>{"use strict";var $t=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=Te;f.newSpanId=be;f.snakeCase=Vt;f.toOtlpValue=Oe;f.attrsFromRecord=Yt;f.guardAttrs=ke;f.clientAttrs=Ae;f.enforceSpanBudget=we;f.buildPayload=Gt;f.mergeBatch=Xt;var qt=$t(require("crypto")),K=z(),Ft="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Te(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let n of e){let o=Ft.indexOf(n);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);t=t<<5n|BigInt(o)}let r=(1n<<128n)-1n;return t&=r,t.toString(16).padStart(32,"0")}function be(){return qt.default.randomBytes(8).toString("hex")}function Vt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Pe=new Set;function D(e,t,r){let n=(0,K.truncate)(t);if((r.skipRedactKeys??Pe).has(e))return n;let o=(r.bashContextKeys??Pe).has(e)?"bash":void 0;return(0,K.redact)(n,{context:o})}function Oe(e,t,r={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:D(e,t,r)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:D(e,JSON.stringify(t),r)}}catch{return{stringValue:D(e,String(t),r)}}default:return{stringValue:D(e,String(t),r)}}}function Yt(e,t,r={}){let n=[];for(let[o,s]of Object.entries(e)){let a=`${t}.${o}`,c=Oe(a,s,r);c!==null&&n.push({key:a,value:c})}return n}function ke(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ae(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function Ee(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Se=1024;function we(e,t=f.MAX_SPAN_BYTES){let r=Ee(e);for(let n=0;n<100&&r>t;n++){let o=null,s=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let P=Buffer.byteLength(u.value.stringValue,"utf-8");P>s&&(s=P,o=u.value)}if(o===null||s<=Se)break;let a=r-t,c=Math.max(Se,s-a-64);o.stringValue=(0,K.truncateTo)(o.stringValue,c),r=Ee(e)}return e}function Gt(e){let t=e.now??Date.now(),r=(BigInt(t)*1000000n).toString(),n=[...e.attributes];e.guard&&n.push(...ke(e.guard));let o=e.clientTiming??(e.guard?.clientRttMs!==void 0?{op:"guard",rttMs:e.guard.clientRttMs}:null);o&&n.push(...Ae(o));let s={traceId:Te(e.traceId),spanId:be(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};return we(s),{resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[s]}]}]}}function Xt(e){let t=[];for(let r of e)t.push(...r.resourceSpans);return{resourceSpans:t}}});var xe=E(J=>{"use strict";Object.defineProperty(J,"__esModule",{value:!0});J.evaluateGuard=Ht;var zt=1e4,Kt="pinta-core";function H(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Zt=new Set(["ALLOW","DENY","REVIEW"]);async function Ht(e,t,r={}){if(!t||r.disabled)return null;let n=r.timeoutMs??zt,o=Date.now(),s=new AbortController,a=setTimeout(()=>s.abort(),n);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??Kt,"x-pinta-relay-token":r.token??""},body:JSON.stringify({input:e}),signal:s.signal});if(c.status!==200)return H(Date.now()-o,"error");let u=await c.json(),P=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!Zt.has(u.decision)||!P)return H(Date.now()-o,"error");let R=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??R,clientRttMs:R}}catch(c){let u=c.name,P=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return H(Date.now()-o,P)}finally{clearTimeout(a)}}});var U=E(I=>{"use strict";var Jt=I&&I.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(I,"__esModule",{value:!0});I.atomicWriteFileSync=Wt;var Me=Jt(require("fs"));function Wt(e,t){let r=`${e}.${process.pid}.tmp`;Me.default.writeFileSync(r,t),Me.default.renameSync(r,e)}});var ee=E(T=>{"use strict";var je=T&&T.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(T,"__esModule",{value:!0});T.MemoryRetryQueue=T.DiskRetryQueue=void 0;var g=je(require("fs")),B=je(require("path")),Qt=U(),L=1e3,er=50,tr=5,W=class{filePath;lockPath;logPrefix;constructor(t,r){this.filePath=B.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(t){try{g.default.mkdirSync(B.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;g.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
-`)}}readAll(){try{let t=g.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of t.split(`
-`))if(n.trim())try{let o=JSON.parse(n);Array.isArray(o?.payload?.resourceSpans)&&r.push(o)}catch{}return r}catch{return[]}}rewrite(t){try{if(t.length===0){g.default.existsSync(this.filePath)&&g.default.unlinkSync(this.filePath);return}g.default.mkdirSync(B.default.dirname(this.filePath),{recursive:!0}),(0,Qt.atomicWriteFileSync)(this.filePath,t.map(r=>JSON.stringify(r)).join(`
+"use strict";var en=Object.create;var Re=Object.defineProperty;var tn=Object.getOwnPropertyDescriptor;var nn=Object.getOwnPropertyNames;var rn=Object.getPrototypeOf,on=Object.prototype.hasOwnProperty;var S=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var sn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of nn(t))!on.call(e,o)&&o!==n&&Re(e,o,{get:()=>t[o],enumerable:!(r=tn(t,o))||r.enumerable});return e};var g=(e,t,n)=>(n=e!=null?en(rn(e)):{},sn(t||!e||!e.__esModule?Re(n,"default",{value:e,enumerable:!0}):n,e));var oe=S(h=>{"use strict";Object.defineProperty(h,"__esModule",{value:!0});h.PATTERNS=h.MAX_BYTES=void 0;h.truncateTo=je;h.truncate=an;h.collectMatches=De;h.resolveOverlaps=Ne;h.applyMatches=Ce;h.redact=cn;h.MAX_BYTES=102400;function je(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function an(e){return je(e,h.MAX_BYTES)}h.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function De(e,t){let n=[];for(let r of h.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=r.captureGroup??0,c=i[a];if(c===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let u=i.index,l=i.index+i[0].length,m=u+i[0].indexOf(c),k=m+c.length;n.push({start:u,end:l,replaceStart:m,replaceEnd:k,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function Ne(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Ce(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function cn(e,t={}){if(e.length===0)return e;let n=De(e,t);if(n.length===0)return e;let r=Ne(n);return Ce(e,r)}});var se=S(f=>{"use strict";var un=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=Le;f.newSpanId=Fe;f.snakeCase=fn;f.toOtlpValue=$e;f.attrsFromRecord=pn;f.guardAttrs=qe;f.clientAttrs=Ve;f.enforceSpanBudget=Ge;f.buildPayload=mn;f.attachGuard=Ye;f.mergeBatch=gn;var ln=un(require("crypto")),ie=oe(),dn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Le(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=dn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Fe(){return ln.default.randomBytes(8).toString("hex")}function fn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Ie=new Set;function Y(e,t,n){let r=(0,ie.truncate)(t);if((n.skipRedactKeys??Ie).has(e))return r;let o=(n.bashContextKeys??Ie).has(e)?"bash":void 0;return(0,ie.redact)(r,{context:o})}function $e(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:Y(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:Y(e,JSON.stringify(t),n)}}catch{return{stringValue:Y(e,String(t),n)}}default:return{stringValue:Y(e,String(t),n)}}}function pn(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,c=$e(a,i,n);c!==null&&r.push({key:a,value:c})}return r}function qe(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ve(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function Ue(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Be=1024;function Ge(e,t=f.MAX_SPAN_BYTES){let n=Ue(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let l=Buffer.byteLength(u.value.stringValue,"utf-8");l>i&&(i=l,o=u.value)}if(o===null||i<=Be)break;let a=n-t,c=Math.max(Be,i-a-64);o.stringValue=(0,ie.truncateTo)(o.stringValue,c),n=Ue(e)}return e}function mn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Le(e.traceId),spanId:Fe(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ge(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Ye(i,e.guard,e.clientTiming)}function Ye(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...qe(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Ve(o)),e}function gn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var ze=S(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.GUARD_STATUS_REFUSED=void 0;C.evaluateGuard=vn;var hn=1e4,_n="pinta-core";function z(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var yn=new Set(["ALLOW","DENY","REVIEW"]);C.GUARD_STATUS_REFUSED=410;async function vn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??hn,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),r);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??_n,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{}},body:JSON.stringify(e),signal:i.signal});if(c.status===C.GUARD_STATUS_REFUSED)return z(Date.now()-o,"refused");if(c.status!==200)return z(Date.now()-o,"error");let u=await c.json(),l=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!yn.has(u.decision)||!l)return z(Date.now()-o,"error");let m=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??m,clientRttMs:m}}catch(c){let u=c.name,l=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return z(Date.now()-o,l)}finally{clearTimeout(a)}}});var X=S($=>{"use strict";var Pn=$&&$.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty($,"__esModule",{value:!0});$.atomicWriteFileSync=En;var Xe=Pn(require("fs"));function En(e,t){let n=`${e}.${process.pid}.tmp`;Xe.default.writeFileSync(n,t),Xe.default.renameSync(n,e)}});var ue=S(A=>{"use strict";var Ke=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.MemoryRetryQueue=A.DiskRetryQueue=void 0;var _=Ke(require("fs")),K=Ke(require("path")),Sn=X(),Z=1e3,Tn=50,bn=5,ae=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=K.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{_.default.mkdirSync(K.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;_.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=_.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){_.default.existsSync(this.filePath)&&_.default.unlinkSync(this.filePath);return}_.default.mkdirSync(K.default.dirname(this.filePath),{recursive:!0}),(0,Sn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
-`)}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${r}
-`)}}tryAcquireLock(){let t=Date.now();try{g.default.mkdirSync(B.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
-`),!1}for(;Date.now()-t<er;)try{let r=g.default.openSync(this.lockPath,"wx");return g.default.writeSync(r,String(process.pid)),g.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
-`),!1;try{let s=g.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){g.default.unlinkSync(this.lockPath);continue}}catch{}let n=tr,o=Date.now()+n;for(;Date.now()<o;);}return!1}release(){try{g.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=L)return;let r=t.length-L;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
-`),this.rewrite(t.slice(r))}};T.DiskRetryQueue=W;var Q=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>L&&this.entries.splice(0,this.entries.length-L)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};T.MemoryRetryQueue=Q});var Ue=E(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Ne;l.envOptionsResolver=De;l.postOtlp=C;var Re=ee(),Ie=Z(),rr=5e3;l.MAX_POST_BYTES=900*1024;function $(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Ce(e,t,r){let n=[],o=[],s=[],a=0;for(let c of e){let u=t(c);if(u>r){o.push(c);continue}s.length>0&&a+u>r&&(n.push(s),s=[],a=0),s.push(c),a+=u}return s.length>0&&n.push(s),{chunks:n,oversize:o}}function Ne(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let r of e.split(",")){let[n,...o]=r.split("=");n&&o.length>0&&(t[n.trim()]=o.join("=").trim())}return t}function De(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return e?r=e.replace(/\/+$/,""):t&&(r=t.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Ne(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function C(e,t,r){let n=new AbortController,o=setTimeout(()=>n.abort(),rr);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:n.signal});if(!s.ok){let a="";try{a=(await s.text()).slice(0,200)}catch{}let c=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${s.status} ${t.endpoint}${c}${a?` body=${a}`:""}
-`),!1}return!0}catch(s){return process.stderr.write(`[${r}] OTLP POST failed: ${s.message??String(s)}
-`),!1}finally{clearTimeout(o)}}var te=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Re.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??De}async send(t){let r=this.resolveOptions();if(!r||this.dropIfOversized(t))return;await C(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:o}=Ce(r,c=>$(c.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let s=[].concat(...n),a=0;for(let c of n){if(!await C((0,Ie.mergeBatch)(c.map(P=>P.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(s.slice(a))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let r=$(t);return r<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=te;var re=class{queue=new Re.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let r=this.resolveOptions();if(!r)return;if($(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await C(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:o}=Ce(r,$,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let s=[].concat(...n),a=0;for(let c of n){if(!await C((0,Ie.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of s.slice(a))this.queue.enqueue(c)}};l.MemoryTransport=re});var ie=E(k=>{"use strict";var se=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.TraceManager=void 0;k.generateUlid=Le;var Be=se(require("fs")),nr=se(require("path")),or=se(require("crypto")),sr=U(),ne="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Le(){let e=Date.now(),t="",r=e;for(let s=0;s<10;s++)t=ne[r&31]+t,r=Math.floor(r/32);let n=or.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=ne[n[s]&31];for(;o.length<16;)o+=ne[0];return t+o}var oe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=Le();return this.save(t),t}currentTrace(){try{let t=Be.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(t);if(r)return r}catch{}return this.newTrace()}save(t){try{Be.default.mkdirSync(nr.default.dirname(this.tracePath),{recursive:!0}),(0,sr.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
-`)}}};k.TraceManager=oe});var Ye=E(b=>{"use strict";var qe=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.MemorySessionTraceManager=b.DiskSessionTraceManager=void 0;var $e=qe(require("fs")),ir=qe(require("path")),Fe=ie(),ar=U(),Ve=200,ae=class{tracePath;maxSessions;constructor(t,r={}){this.tracePath=t,this.maxSessions=r.maxSessions??Ve}read(){try{let t=JSON.parse($e.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{$e.default.mkdirSync(ir.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(t),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):t;(0,ar.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(t){let r=t||"default",n=(0,Fe.generateUlid)(),o=this.read();return o[r]=n,this.write(o),n}currentTrace(t){let r=t||"default",n=this.read()[r];return n||this.newTrace(r)}};b.DiskSessionTraceManager=ae;var ce=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Ve}newTrace(t){let r=t||"default",n=(0,Fe.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return n}currentTrace(t){let r=t||"default";return this.map.get(r)??this.newTrace(r)}};b.MemorySessionTraceManager=ce});var ze=E(A=>{"use strict";var ue=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.envFilePath=lr;A.parseEnvFile=Xe;A.loadEnvFile=fr;var cr=ue(require("node:fs")),ur=ue(require("node:os")),Ge=ue(require("node:path"));function lr(e,t,r){let n=r?process.env[r]:void 0,o=n&&n.length>0?n:Ge.default.join(ur.default.homedir(),e);return Ge.default.join(o,t)}function Xe(e){let t={};for(let r of e.split(`
-`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let o=n.indexOf("=");if(o<0)continue;let s=n.slice(0,o).trim(),a=n.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),s&&(t[s]=a)}return t}function fr(e){let t;try{t=cr.default.readFileSync(e,"utf-8")}catch{return}let r=Xe(t);for(let[n,o]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=o)}});var w=E(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var O=z();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return O.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return O.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return O.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return O.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return O.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return O.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return O.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return O.MAX_BYTES}});var v=Z();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return v.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return v.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return v.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return v.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return v.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return v.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return v.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return v.buildPayload}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return v.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return v.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return v.MAX_SPAN_BYTES}});var pr=xe();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return pr.evaluateGuard}});var Ke=ee();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return Ke.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return Ke.MemoryRetryQueue}});var x=Ue();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return x.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return x.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return x.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return x.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return x.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return x.MAX_POST_BYTES}});var Ze=ie();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return Ze.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return Ze.generateUlid}});var He=Ye();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return He.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return He.MemorySessionTraceManager}});var le=ze();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return le.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return le.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return le.loadEnvFile}})});var N=y(w());function dr(){return(0,N.envFilePath)(".claude","pinta-cc.env")}function Je(e=dr()){(0,N.loadEnvFile)(e)}function We(){process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT&&!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT&&(process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT),process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&!process.env.OTEL_EXPORTER_OTLP_HEADERS&&(process.env.OTEL_EXPORTER_OTLP_HEADERS=`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`),!process.env.PINTA_RELAY_TOKEN&&process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.CLAUDE_PLUGIN_OPTION_API_KEY)}var fe=y(require("path")),Qe=y(w());function et(){let e=process.env.CLAUDE_PLUGIN_ROOT||process.cwd(),t=process.env.CLAUDE_PLUGIN_DATA||fe.default.join(e,".plugin-data");return{pluginRoot:e,pluginData:t,tracePath:fe.default.join(t,"trace.json")}}function tt(){return(0,Qe.envOptionsResolver)()!==null}function rt(e){return e.hook_event_name==="PreToolUse"}function nt(e){return e.hook_event_name==="PostToolUse"||e.hook_event_name==="PostToolUseFailure"}function ot(e){return e.hook_event_name==="UserPromptSubmit"}function st(e){return e.hook_event_name==="SessionStart"||e.hook_event_name==="SessionEnd"}function it(e){return e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop"}function at(e){return e.hook_event_name==="Stop"}function ct(e){return e.hook_event_name==="PermissionRequest"||e.hook_event_name==="PermissionDenied"}var mr=new Set(["Notification","TaskCreated","TaskCompleted"]);function ut(e){return mr.has(e.hook_event_name)}var lt=y(w()),gr=1e4,_r="pinta-cc/1.7.1";function ft(e,t){return(0,lt.evaluateGuard)(e,t,{timeoutMs:gr,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:_r})}var pt=y(w()),q=class extends pt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-cc"})}};var dt=y(w()),F=class extends dt.TraceManager{constructor(t){super(t.tracePath)}};var X=y(require("os"));var _t=require("node:child_process"),V=require("node:crypto"),_=y(require("node:fs")),ht=y(require("node:os")),p=y(require("node:path")),yt=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,hr=/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+\(Claude Code\)$/m,yr=2e3,vr=24*60*60*1e3,Pr=3e4,de=8,vt="claude-version.json",M=new Map;function S(e){return typeof e=="object"&&e!==null&&"code"in e&&typeof e.code=="string"?e.code:"UNKNOWN"}function h(e){process.stderr.write(`[pinta-cc] CLI version: ${e}
-`)}function Y(e){return S(e)==="ENOENT"||S(e)==="ENOTDIR"}function Er(){let e=process.env.CLAUDE_CODE_EXECPATH,t=process.platform==="win32"?["claude.exe","claude.cmd"]:["claude"],r;if(e)r=[e];else{let n=(process.env.PATH??"").split(p.default.delimiter).filter(o=>p.default.isAbsolute(o));try{n.push(p.default.join(ht.default.homedir(),".local","bin"))}catch(o){h(`native install directory lookup failed (${S(o)})`)}r=n.flatMap(o=>t.map(s=>p.default.join(o,s)))}for(let n of new Set(r))try{let o=_.default.realpathSync(n),s=_.default.statSync(o);if(!s.isFile())continue;return!e&&process.platform!=="win32"&&_.default.accessSync(o,_.default.constants.X_OK),{file:o,fingerprint:(0,V.createHash)("sha256").update(JSON.stringify([o,s.ino,s.size,s.mtimeMs,s.ctimeMs])).digest("hex")}}catch(o){Y(o)||h(`executable lookup failed (${S(o)})`)}return h(e?"configured executable is unavailable":"no Claude executable found in PATH or ~/.local/bin"),null}function pe(e){let t;try{t=JSON.parse(_.default.readFileSync(e,"utf8"))}catch(r){return Y(r)||h(`package metadata could not be read (${r instanceof SyntaxError?"INVALID_JSON":S(r)})`),null}return typeof t!="object"||t===null||!("name"in t)||!("version"in t)||typeof t.name!="string"||typeof t.version!="string"||!yt.test(t.version)?null:t.name==="@anthropic-ai/claude-code"||t.name.startsWith("@anthropic-ai/claude-code-")?t.version:null}function Sr(e){let t=p.default.dirname(e),r=p.default.basename(t)===".bin"&&/^claude(?:\.cmd)?$/i.test(p.default.basename(e));for(let n=0;n<6;n++){let o=pe(p.default.join(t,"package.json"));if(o)return o;if(p.default.basename(e).toLowerCase()==="claude.cmd"&&n===0){let a=pe(p.default.join(t,"node_modules","@anthropic-ai","claude-code","package.json"));if(a)return a}if(r&&p.default.basename(t)==="node_modules"){let a=pe(p.default.join(t,"@anthropic-ai","claude-code","package.json"));if(a)return a}let s=p.default.dirname(t);if(s===t)break;t=s}return null}function Tr(e){return typeof e=="object"&&e!==null&&"fingerprint"in e&&typeof e.fingerprint=="string"&&/^[0-9a-f]{64}$/.test(e.fingerprint)&&"version"in e&&(e.version===null||typeof e.version=="string"&&yt.test(e.version))&&"checkedAt"in e&&typeof e.checkedAt=="number"&&Number.isFinite(e.checkedAt)}function mt(e,t){let r=t-e.checkedAt;return r>=0&&r<(e.version===null?Pr:vr)}function br(e){if(!e)return[];let t=p.default.join(e,vt);try{if(_.default.statSync(t).size>16384)return h("oversized version cache ignored"),[];let r=JSON.parse(_.default.readFileSync(t,"utf8"));if(Array.isArray(r)&&r.length<=de&&r.every(Tr))return r;h("invalid version cache ignored")}catch(r){Y(r)||h(`version cache read failed (${r instanceof SyntaxError?"INVALID_JSON":S(r)})`)}return[]}function gt(e){for(M.delete(e.fingerprint),M.set(e.fingerprint,e);M.size>de;){let t=M.keys().next().value;t!==void 0&&M.delete(t)}}function Or(e,t){if(!e)return;let r=p.default.join(e,vt),n=`${r}.${process.pid}.${(0,V.randomUUID)()}.tmp`;try{_.default.mkdirSync(e,{recursive:!0,mode:448}),_.default.writeFileSync(n,JSON.stringify(t),{encoding:"utf8",mode:384,flag:"wx"}),_.default.renameSync(n,r)}catch(o){h(`version cache write failed (${S(o)})`)}finally{try{_.default.unlinkSync(n)}catch(o){Y(o)||h(`temporary version cache cleanup failed (${S(o)})`)}}}function kr(e){if(/\.(cmd|bat|ps1)$/i.test(e))return h("command shim has no readable Claude package metadata"),null;let t=(0,_t.spawnSync)(e,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],shell:!1,windowsHide:!0,timeout:yr,killSignal:"SIGKILL",maxBuffer:4096});if(t.error||t.status!==0)return h(`version probe failed (${t.error?S(t.error):`exit ${t.status??t.signal}`})`),null;let r=hr.exec(t.stdout.trim())?.[1];return r||(h("version probe did not identify Claude Code"),null)}function Pt(e){let t=Er();if(!t)return"unknown";let r=Sr(t.file);if(r)return r;let n=Date.now(),o=br(e),s=[M.get(t.fingerprint),...o].find(c=>c&&c.fingerprint===t.fingerprint&&mt(c,n));if(s)return gt(s),s.version??"unknown";let a={fingerprint:t.fingerprint,version:kr(t.file),checkedAt:Date.now()};return gt(a),Or(e,[...o.filter(c=>c.fingerprint!==a.fingerprint&&mt(c,a.checkedAt)),a].slice(-de)),a.version??"unknown"}var j=y(w()),G;function Ar(){if(G===void 0)try{G=X.default.userInfo().username}catch{G=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return G}var Et="1.7.1",wr=new Set(["cc.hook","cc.tool_name","cc.tool_use_id","cc.session_id","cc.transcript_path","cc.cwd","cc.permission_mode"]),xr=new Set(["cc.tool_input","cc.tool_response"]),Mr={skipRedactKeys:wr,bashContextKeys:xr};function jr(e){let t=[];t.push({key:"ingest.type",value:{stringValue:"cc"}}),t.push({key:"cc.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[n,o]of Object.entries(e))n!=="hook_event_name"&&(r[n]=o);return t.push(...(0,j.attrsFromRecord)(r,"cc",Mr)),t}function Rr(e){return[{key:"service.name",value:{stringValue:"claude-code"}},{key:"service.version",value:{stringValue:Pt(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-cc"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Et}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Ar()}},{key:"host.name",value:{stringValue:X.default.hostname()}},{key:"host.arch",value:{stringValue:X.default.arch()}}]}function St(e){return(0,j.buildPayload)({traceId:e.traceId,spanName:`cc.${(0,j.snakeCase)(e.event.hook_event_name)}`,attributes:jr(e.event),resource:Rr(e.versionCacheDir),scope:{name:"pinta-cc",version:Et},now:e.now,guard:e.guard})}async function m(e,t,r={}){if(!tt())return;let n=new q(t);await n.flush();let o=new F(t),s=r.traceMode==="new"?o.newTrace():o.currentTrace(),a=St({event:e,traceId:s,guard:r.guard,versionCacheDir:t.pluginData});await n.send(a)}async function Tt(e,t){let r=typeof e.tool_input=="string"?e.tool_input:JSON.stringify(e.tool_input),n=await ft({spanId:e.session_id??"unknown",toolName:e.tool_name,method:e.hook_event_name,cwd:e.cwd,toolInput:e.tool_input,rawTextFields:{toolInput:r}},process.env.PINTA_GUARD_ENDPOINT);if(n?.decision==="DENY"){let s={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:n.userMessage??n.reason??"guard_deny"}};process.stdout.write(JSON.stringify(s)+`
-`)}try{await m(e,t,{guard:n})}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
-`)}return 0}async function bt(e,t){return await m(e,t),0}async function Ot(e,t){return await m(e,t,{traceMode:"new"}),0}async function kt(e,t){return await m(e,t),0}async function At(e,t){return await m(e,t),0}async function wt(e,t){return await m(e,t),0}async function xt(e,t){return await m(e,t),0}async function me(e){return 0}async function Ir(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Mt(){We();let e=0;try{let t=et(),r=await Ir(),n=JSON.parse(r);ut(n)?e=await me(n):rt(n)?e=await Tt(n,t):nt(n)?e=await bt(n,t):ot(n)?e=await Ot(n,t):st(n)?e=await kt(n,t):it(n)?e=await At(n,t):at(n)?e=await wt(n,t):ct(n)?e=await xt(n,t):e=await me(n)}catch(t){process.stderr.write(`[pinta-cc] error: ${t}
-`),e=0}return e}Je();async function Cr(){let e=await Mt();process.exit(e)}Cr();
+`)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
+`)}}tryAcquireLock(){let t=Date.now();try{_.default.mkdirSync(K.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<Tn;)try{let n=_.default.openSync(this.lockPath,"wx");return _.default.writeSync(n,String(process.pid)),_.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let i=_.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){_.default.unlinkSync(this.lockPath);continue}}catch{}let r=bn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{_.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=Z)return;let n=t.length-Z;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};A.DiskRetryQueue=ae;var ce=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>Z&&this.entries.splice(0,this.entries.length-Z)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};A.MemoryRetryQueue=ce});var et=S(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.MemoryTransport=d.DiskTransport=d.MAX_POST_BYTES=void 0;d.parseHeadersEnv=We;d.envOptionsResolver=Qe;d.postOtlp=q;var Ze=ue(),He=se(),On=5e3;d.MAX_POST_BYTES=900*1024;function H(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Je(e,t,n){let r=[],o=[],i=[],a=0;for(let c of e){let u=t(c);if(u>n){o.push(c);continue}i.length>0&&a+u>n&&(r.push(i),i=[],a=0),i.push(c),a+=u}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function We(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function Qe(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:We(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function q(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),On);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let c=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${c}${a?` body=${a}`:""}
+`),!1}return!0}catch(i){return process.stderr.write(`[${n}] OTLP POST failed: ${i.message??String(i)}
+`),!1}finally{clearTimeout(o)}}var le=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ze.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Qe}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await q(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Je(n,c=>H(c.payload),d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${d.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...r),a=0;for(let c of r){if(!await q((0,He.mergeBatch)(c.map(l=>l.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(i.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=H(t);return n<=d.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};d.DiskTransport=le;var de=class{queue=new Ze.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(H(t)>d.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await q(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Je(n,H,d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${d.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...r),a=0;for(let c of r){if(!await q((0,He.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of i.slice(a))this.queue.enqueue(c)}};d.MemoryTransport=de});var ge=S(j=>{"use strict";var me=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=nt;var tt=me(require("fs")),kn=me(require("path")),An=me(require("crypto")),wn=X(),fe="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function nt(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=fe[n&31]+t,n=Math.floor(n/32);let r=An.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=fe[r[i]&31];for(;o.length<16;)o+=fe[0];return t+o}var pe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=nt();return this.save(t),t}currentTrace(){try{let t=tt.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{tt.default.mkdirSync(kn.default.dirname(this.tracePath),{recursive:!0}),(0,wn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};j.TraceManager=pe});var at=S(w=>{"use strict";var ot=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.MemorySessionTraceManager=w.DiskSessionTraceManager=void 0;var rt=ot(require("fs")),xn=ot(require("path")),it=ge(),Mn=X(),st=200,he=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??st}read(){try{let t=JSON.parse(rt.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{rt.default.mkdirSync(xn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Mn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,it.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};w.DiskSessionTraceManager=he;var _e=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??st}newTrace(t){let n=t||"default",r=(0,it.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};w.MemorySessionTraceManager=_e});var lt=S(D=>{"use strict";var ye=D&&D.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(D,"__esModule",{value:!0});D.envFilePath=Dn;D.parseEnvFile=ut;D.loadEnvFile=Nn;var Rn=ye(require("node:fs")),jn=ye(require("node:os")),ct=ye(require("node:path"));function Dn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:ct.default.join(jn.default.homedir(),e);return ct.default.join(o,t)}function ut(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),a=r.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function Nn(e){let t;try{t=Rn.default.readFileSync(e,"utf-8")}catch{return}let n=ut(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var M=S(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var x=oe();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return x.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return x.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return x.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return x.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return x.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return x.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return x.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return x.MAX_BYTES}});var y=se();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var dt=ze();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return dt.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return dt.GUARD_STATUS_REFUSED}});var ft=ue();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return ft.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return ft.MemoryRetryQueue}});var I=et();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return I.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return I.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return I.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return I.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return I.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return I.MAX_POST_BYTES}});var pt=ge();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return pt.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return pt.generateUlid}});var mt=at();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return mt.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return mt.MemorySessionTraceManager}});var ve=lt();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return ve.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return ve.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return ve.loadEnvFile}})});var V=g(M());function Cn(){return(0,V.envFilePath)(".claude","pinta-cc.env")}function gt(e=Cn()){(0,V.loadEnvFile)(e)}function ht(){process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT&&!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT&&(process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT),process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&!process.env.OTEL_EXPORTER_OTLP_HEADERS&&(process.env.OTEL_EXPORTER_OTLP_HEADERS=`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`),!process.env.PINTA_RELAY_TOKEN&&process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.CLAUDE_PLUGIN_OPTION_API_KEY)}var Pe=g(require("path")),_t=g(M());function yt(){let e=process.env.CLAUDE_PLUGIN_ROOT||process.cwd(),t=process.env.CLAUDE_PLUGIN_DATA||Pe.default.join(e,".plugin-data");return{pluginRoot:e,pluginData:t,tracePath:Pe.default.join(t,"trace.json")}}function Ee(){return(0,_t.envOptionsResolver)()!==null}function vt(e){return e.hook_event_name==="PreToolUse"}function Pt(e){return e.hook_event_name==="PostToolUse"||e.hook_event_name==="PostToolUseFailure"}function Et(e){return e.hook_event_name==="UserPromptSubmit"}function St(e){return e.hook_event_name==="SessionStart"||e.hook_event_name==="SessionEnd"}function Tt(e){return e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop"}function bt(e){return e.hook_event_name==="Stop"}function Ot(e){return e.hook_event_name==="PermissionRequest"||e.hook_event_name==="PermissionDenied"}var In=new Set(["Notification","TaskCreated","TaskCompleted"]);function kt(e){return In.has(e.hook_event_name)}var Yt=g(M());var At=g(M()),Un=1e4,Bn="pinta-cc/1.9.0";function wt(e,t){return(0,At.evaluateGuard)(e,t,{timeoutMs:Un,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Bn})}var xt=g(M()),J=class extends xt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-cc"})}};var Mt=g(M()),W=class extends Mt.TraceManager{constructor(t){super(t.tracePath)}};var re=g(require("os"));var Dt=require("node:child_process"),Q=require("node:crypto"),v=g(require("node:fs")),Nt=g(require("node:os")),p=g(require("node:path")),Ct=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,Ln=/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+\(Claude Code\)$/m,Fn=2e3,$n=24*60*60*1e3,qn=3e4,Te=8,It="claude-version.json",U=new Map;function O(e){return typeof e=="object"&&e!==null&&"code"in e&&typeof e.code=="string"?e.code:"UNKNOWN"}function P(e){process.stderr.write(`[pinta-cc] CLI version: ${e}
+`)}function ee(e){return O(e)==="ENOENT"||O(e)==="ENOTDIR"}function Vn(){let e=process.env.CLAUDE_CODE_EXECPATH,t=process.platform==="win32"?["claude.exe","claude.cmd"]:["claude"],n;if(e)n=[e];else{let r=(process.env.PATH??"").split(p.default.delimiter).filter(o=>p.default.isAbsolute(o));try{r.push(p.default.join(Nt.default.homedir(),".local","bin"))}catch(o){P(`native install directory lookup failed (${O(o)})`)}n=r.flatMap(o=>t.map(i=>p.default.join(o,i)))}for(let r of new Set(n))try{let o=v.default.realpathSync(r),i=v.default.statSync(o);if(!i.isFile())continue;return!e&&process.platform!=="win32"&&v.default.accessSync(o,v.default.constants.X_OK),{file:o,fingerprint:(0,Q.createHash)("sha256").update(JSON.stringify([o,i.ino,i.size,i.mtimeMs,i.ctimeMs])).digest("hex")}}catch(o){ee(o)||P(`executable lookup failed (${O(o)})`)}return P(e?"configured executable is unavailable":"no Claude executable found in PATH or ~/.local/bin"),null}function Se(e){let t;try{t=JSON.parse(v.default.readFileSync(e,"utf8"))}catch(n){return ee(n)||P(`package metadata could not be read (${n instanceof SyntaxError?"INVALID_JSON":O(n)})`),null}return typeof t!="object"||t===null||!("name"in t)||!("version"in t)||typeof t.name!="string"||typeof t.version!="string"||!Ct.test(t.version)?null:t.name==="@anthropic-ai/claude-code"||t.name.startsWith("@anthropic-ai/claude-code-")?t.version:null}function Gn(e){let t=p.default.dirname(e),n=p.default.basename(t)===".bin"&&/^claude(?:\.cmd)?$/i.test(p.default.basename(e));for(let r=0;r<6;r++){let o=Se(p.default.join(t,"package.json"));if(o)return o;if(p.default.basename(e).toLowerCase()==="claude.cmd"&&r===0){let a=Se(p.default.join(t,"node_modules","@anthropic-ai","claude-code","package.json"));if(a)return a}if(n&&p.default.basename(t)==="node_modules"){let a=Se(p.default.join(t,"@anthropic-ai","claude-code","package.json"));if(a)return a}let i=p.default.dirname(t);if(i===t)break;t=i}return null}function Yn(e){return typeof e=="object"&&e!==null&&"fingerprint"in e&&typeof e.fingerprint=="string"&&/^[0-9a-f]{64}$/.test(e.fingerprint)&&"version"in e&&(e.version===null||typeof e.version=="string"&&Ct.test(e.version))&&"checkedAt"in e&&typeof e.checkedAt=="number"&&Number.isFinite(e.checkedAt)}function Rt(e,t){let n=t-e.checkedAt;return n>=0&&n<(e.version===null?qn:$n)}function zn(e){if(!e)return[];let t=p.default.join(e,It);try{if(v.default.statSync(t).size>16384)return P("oversized version cache ignored"),[];let n=JSON.parse(v.default.readFileSync(t,"utf8"));if(Array.isArray(n)&&n.length<=Te&&n.every(Yn))return n;P("invalid version cache ignored")}catch(n){ee(n)||P(`version cache read failed (${n instanceof SyntaxError?"INVALID_JSON":O(n)})`)}return[]}function jt(e){for(U.delete(e.fingerprint),U.set(e.fingerprint,e);U.size>Te;){let t=U.keys().next().value;t!==void 0&&U.delete(t)}}function Xn(e,t){if(!e)return;let n=p.default.join(e,It),r=`${n}.${process.pid}.${(0,Q.randomUUID)()}.tmp`;try{v.default.mkdirSync(e,{recursive:!0,mode:448}),v.default.writeFileSync(r,JSON.stringify(t),{encoding:"utf8",mode:384,flag:"wx"}),v.default.renameSync(r,n)}catch(o){P(`version cache write failed (${O(o)})`)}finally{try{v.default.unlinkSync(r)}catch(o){ee(o)||P(`temporary version cache cleanup failed (${O(o)})`)}}}function Kn(e){if(/\.(cmd|bat|ps1)$/i.test(e))return P("command shim has no readable Claude package metadata"),null;let t=(0,Dt.spawnSync)(e,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],shell:!1,windowsHide:!0,timeout:Fn,killSignal:"SIGKILL",maxBuffer:4096});if(t.error||t.status!==0)return P(`version probe failed (${t.error?O(t.error):`exit ${t.status??t.signal}`})`),null;let n=Ln.exec(t.stdout.trim())?.[1];return n||(P("version probe did not identify Claude Code"),null)}function Ut(e){let t=Vn();if(!t)return"unknown";let n=Gn(t.file);if(n)return n;let r=Date.now(),o=zn(e),i=[U.get(t.fingerprint),...o].find(c=>c&&c.fingerprint===t.fingerprint&&Rt(c,r));if(i)return jt(i),i.version??"unknown";let a={fingerprint:t.fingerprint,version:Kn(t.file),checkedAt:Date.now()};return jt(a),Xn(e,[...o.filter(c=>c.fingerprint!==a.fingerprint&&Rt(c,a.checkedAt)),a].slice(-Te)),a.version??"unknown"}var R=g(require("node:path"));var T=g(require("node:fs")),be=g(require("node:path")),Zn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),Hn=256*1024,Jn=1024*1024,Wn=4096;function N(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function Oe(e){let t=N(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Zn.has(r.toLowerCase())?r:void 0}function Bt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function B(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function te(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Lt(e,t){let n=e.timestamp===void 0?te(t):te(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Ft(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!be.default.isAbsolute(e)||be.default.extname(e)!==".jsonl")return;let t;try{t=T.default.openSync(e,T.default.constants.O_RDONLY|T.default.constants.O_NONBLOCK|(T.default.constants.O_NOFOLLOW??0));let n=T.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,Hn));if(T.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=N(JSON.parse(r.toString("utf8",0,o)))}catch{}let a=Math.max(0,n.size-Jn),c=n.size<=r.length?r:Buffer.alloc(n.size-a);if(c!==r&&T.default.readSync(t,c,0,c.length,a)!==c.length)return;let u=T.default.fstatSync(t);if(u.size<n.size||u.size===n.size&&u.mtimeMs!==n.mtimeMs)return;let l=a>0?c.indexOf(10)+1:0,m=c.lastIndexOf(10);if(a>0&&l===0||m<l)return;let k=[],b=0;for(;m>l&&b<Wn;){let G=c.lastIndexOf(10,m-1),F=Math.max(l,G+1),xe=c.toString("utf8",F,m).trim();if(xe){let Me=N(JSON.parse(xe));Me&&k.push(Me)}m=F-1,b++}return k.reverse(),{first:i,rows:k,complete:a===0&&m<0&&c[c.length-1]===10}}catch{return}finally{if(t!==void 0)try{T.default.closeSync(t)}catch{}}}function $t(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var Qn=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest","PermissionDenied"]);function er(e,t){let n=R.default.dirname(e);if(R.default.basename(n)!=="subagents"||R.default.basename(R.default.dirname(n))!==t)return;let r=/^agent-(.+)\.jsonl$/.exec(R.default.basename(e));return B(r?.[1])}function qt(e,t){let n=Oe(e.model);if(n)return{name:n,source:"hook.model"};try{return tr(e,t)}catch{return}}function tr(e,t){if(!Qn.has(e.hook_event_name))return;let n=B(e.session_id),r=B(e.tool_use_id),o=Lt(e,t);if(!n||!r||o===void 0||typeof e.transcript_path!="string")return;let i=er(e.transcript_path,n),a=e.agent_id===void 0?i:B(e.agent_id);if(e.agent_id!==void 0&&!a||i!==void 0&&i!==a||!a&&e.agent_type!==void 0||R.default.basename(R.default.dirname(e.transcript_path))==="subagents"&&!i)return;let c=Ft(e.transcript_path);if(!c)return;let u=[];for(let l of c.rows){let m=te(l.timestamp);if(l.type!=="assistant"||l.sessionId!==n||m===void 0||m>o)continue;let k=l.agentId===void 0?void 0:B(l.agentId);if(k!==a||l.agentId!==void 0&&!k||l.isSidechain===!0&&!a)continue;let b=N(l.message);if(!b||b.role!==void 0&&b.role!=="assistant"||!Array.isArray(b.content)||!b.content.some(F=>N(F)?.type==="tool_use"&&N(F)?.id===r))continue;let G=Oe(b.model);u.push(G?{name:G,source:"transcript.assistant.message"}:void 0)}return $t(u)}var L=g(M()),ne;function nr(){if(ne===void 0)try{ne=re.default.userInfo().username}catch{ne=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ne}var Vt="1.9.0",rr=new Set(["cc.hook","cc.tool_name","cc.tool_use_id","cc.session_id","cc.transcript_path","cc.cwd","cc.permission_mode"]),or=new Set(["cc.tool_input","cc.tool_response"]),ir={skipRedactKeys:rr,bashContextKeys:or};function sr(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"cc"}}),n.push({key:"cc.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,i]of Object.entries(e))o!=="hook_event_name"&&(r[o]=i);return Bt(r,qt(e,t)),n.push(...(0,L.attrsFromRecord)(r,"cc",ir)),n}function ar(e){return[{key:"service.name",value:{stringValue:"claude-code"}},{key:"service.version",value:{stringValue:Ut(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-cc"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Vt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:nr()}},{key:"host.name",value:{stringValue:re.default.hostname()}},{key:"host.arch",value:{stringValue:re.default.arch()}}]}function Gt(e){let t=e.now??Date.now();return(0,L.buildPayload)({traceId:e.traceId,spanName:`cc.${(0,L.snakeCase)(e.event.hook_event_name)}`,attributes:sr(e.event,t),resource:ar(e.versionCacheDir),scope:{name:"pinta-cc",version:Vt},now:t})}function ke(e,t,n={}){let r=new W(t),o=n.traceMode==="new"?r.newTrace():r.currentTrace();return Gt({event:e,traceId:o,versionCacheDir:t.pluginData})}async function Ae(e,t){if(!Ee())return;let n=new J(t);await n.flush(),await n.send(e)}async function E(e,t,n={}){Ee()&&await Ae(ke(e,t,n),t)}async function zt(e,t){let n=ke(e,t),r=await wt(n,process.env.PINTA_GUARD_ENDPOINT);if(r?.decision==="DENY"){let i={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:r.userMessage??r.reason??"guard_deny"}};process.stdout.write(JSON.stringify(i)+`
+`)}try{(0,Yt.attachGuard)(n,r),await Ae(n,t)}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
+`)}return 0}async function Xt(e,t){return await E(e,t),0}async function Kt(e,t){return await E(e,t,{traceMode:"new"}),0}async function Zt(e,t){return await E(e,t),0}async function Ht(e,t){return await E(e,t),0}async function Jt(e,t){return await E(e,t),0}async function Wt(e,t){return await E(e,t),0}async function we(e){return 0}async function cr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Qt(){ht();let e=0;try{let t=yt(),n=await cr(),r=JSON.parse(n);kt(r)?e=await we(r):vt(r)?e=await zt(r,t):Pt(r)?e=await Xt(r,t):Et(r)?e=await Kt(r,t):St(r)?e=await Zt(r,t):Tt(r)?e=await Ht(r,t):bt(r)?e=await Jt(r,t):Ot(r)?e=await Wt(r,t):e=await we(r)}catch(t){process.stderr.write(`[pinta-cc] error: ${t}
+`),e=0}return e}gt();async function ur(){let e=await Qt();process.exit(e)}ur();

package/dist/index.mjs

@@ -1,24 +1,24 @@
 import{createRequire as __pintaCreateRequire}from 'node:module';const require=__pintaCreateRequire(import.meta.url);
-var Ct=Object.create;var ge=Object.defineProperty;var Dt=Object.getOwnPropertyDescriptor;var Nt=Object.getOwnPropertyNames;var Ut=Object.getPrototypeOf,Bt=Object.prototype.hasOwnProperty;var h=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var E=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Lt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Nt(t))!Bt.call(e,o)&&o!==n&&ge(e,o,{get:()=>t[o],enumerable:!(r=Dt(t,o))||r.enumerable});return e};var x=(e,t,n)=>(n=e!=null?Ct(Ut(e)):{},Lt(t||!e||!e.__esModule?ge(n,"default",{value:e,enumerable:!0}):n,e));var z=E(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.PATTERNS=d.MAX_BYTES=void 0;d.truncateTo=he;d.truncate=Ft;d.collectMatches=_e;d.resolveOverlaps=ye;d.applyMatches=ve;d.redact=$t;d.MAX_BYTES=102400;function he(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Ft(e){return he(e,d.MAX_BYTES)}d.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function _e(e,t){let n=[];for(let r of d.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=o.exec(e))!==null;){let a=r.captureGroup??0,c=s[a];if(c===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let u=s.index,P=s.index+s[0].length,R=u+s[0].indexOf(c),Rt=R+c.length;n.push({start:u,end:P,replaceStart:R,replaceEnd:Rt,type:r.type}),s.index===o.lastIndex&&o.lastIndex++}}return n}function ye(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function ve(e,t){let n=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function $t(e,t={}){if(e.length===0)return e;let n=_e(e,t);if(n.length===0)return e;let r=ye(n);return ve(e,r)}});var Z=E(f=>{"use strict";var qt=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=Te;f.newSpanId=be;f.snakeCase=Yt;f.toOtlpValue=Oe;f.attrsFromRecord=Xt;f.guardAttrs=ke;f.clientAttrs=we;f.enforceSpanBudget=Ae;f.buildPayload=zt;f.mergeBatch=Kt;var Vt=qt(h("crypto")),K=z(),Gt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Te(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=Gt.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function be(){return Vt.default.randomBytes(8).toString("hex")}function Yt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Pe=new Set;function B(e,t,n){let r=(0,K.truncate)(t);if((n.skipRedactKeys??Pe).has(e))return r;let o=(n.bashContextKeys??Pe).has(e)?"bash":void 0;return(0,K.redact)(r,{context:o})}function Oe(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:B(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:B(e,JSON.stringify(t),n)}}catch{return{stringValue:B(e,String(t),n)}}default:return{stringValue:B(e,String(t),n)}}}function Xt(e,t,n={}){let r=[];for(let[o,s]of Object.entries(e)){let a=`${t}.${o}`,c=Oe(a,s,n);c!==null&&r.push({key:a,value:c})}return r}function ke(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function we(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function Ee(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Se=1024;function Ae(e,t=f.MAX_SPAN_BYTES){let n=Ee(e);for(let r=0;r<100&&n>t;r++){let o=null,s=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let P=Buffer.byteLength(u.value.stringValue,"utf-8");P>s&&(s=P,o=u.value)}if(o===null||s<=Se)break;let a=n-t,c=Math.max(Se,s-a-64);o.stringValue=(0,K.truncateTo)(o.stringValue,c),n=Ee(e)}return e}function zt(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes];e.guard&&r.push(...ke(e.guard));let o=e.clientTiming??(e.guard?.clientRttMs!==void 0?{op:"guard",rttMs:e.guard.clientRttMs}:null);o&&r.push(...we(o));let s={traceId:Te(e.traceId),spanId:be(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};return Ae(s),{resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[s]}]}]}}function Kt(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var xe=E(J=>{"use strict";Object.defineProperty(J,"__esModule",{value:!0});J.evaluateGuard=Wt;var Zt=1e4,Ht="pinta-core";function H(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Jt=new Set(["ALLOW","DENY","REVIEW"]);async function Wt(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??Zt,o=Date.now(),s=new AbortController,a=setTimeout(()=>s.abort(),r);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??Ht,"x-pinta-relay-token":n.token??""},body:JSON.stringify({input:e}),signal:s.signal});if(c.status!==200)return H(Date.now()-o,"error");let u=await c.json(),P=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!Jt.has(u.decision)||!P)return H(Date.now()-o,"error");let R=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??R,clientRttMs:R}}catch(c){let u=c.name,P=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return H(Date.now()-o,P)}finally{clearTimeout(a)}}});var L=E(C=>{"use strict";var Qt=C&&C.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(C,"__esModule",{value:!0});C.atomicWriteFileSync=en;var je=Qt(h("fs"));function en(e,t){let n=`${e}.${process.pid}.tmp`;je.default.writeFileSync(n,t),je.default.renameSync(n,e)}});var ee=E(T=>{"use strict";var Me=T&&T.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(T,"__esModule",{value:!0});T.MemoryRetryQueue=T.DiskRetryQueue=void 0;var g=Me(h("fs")),F=Me(h("path")),tn=L(),$=1e3,nn=50,rn=5,W=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=F.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{g.default.mkdirSync(F.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;g.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
-`)}}readAll(){try{let t=g.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){g.default.existsSync(this.filePath)&&g.default.unlinkSync(this.filePath);return}g.default.mkdirSync(F.default.dirname(this.filePath),{recursive:!0}),(0,tn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+var nn=Object.create;var Me=Object.defineProperty;var rn=Object.getOwnPropertyDescriptor;var on=Object.getOwnPropertyNames;var sn=Object.getPrototypeOf,an=Object.prototype.hasOwnProperty;var _=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var S=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var cn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of on(t))!an.call(e,o)&&o!==n&&Me(e,o,{get:()=>t[o],enumerable:!(r=rn(t,o))||r.enumerable});return e};var R=(e,t,n)=>(n=e!=null?nn(sn(e)):{},cn(t||!e||!e.__esModule?Me(n,"default",{value:e,enumerable:!0}):n,e));var oe=S(g=>{"use strict";Object.defineProperty(g,"__esModule",{value:!0});g.PATTERNS=g.MAX_BYTES=void 0;g.truncateTo=Re;g.truncate=un;g.collectMatches=je;g.resolveOverlaps=De;g.applyMatches=Ie;g.redact=ln;g.MAX_BYTES=102400;function Re(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function un(e){return Re(e,g.MAX_BYTES)}g.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function je(e,t){let n=[];for(let r of g.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=r.captureGroup??0,c=i[a];if(c===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let u=i.index,l=i.index+i[0].length,p=u+i[0].indexOf(c),k=p+c.length;n.push({start:u,end:l,replaceStart:p,replaceEnd:k,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function De(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Ie(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function ln(e,t={}){if(e.length===0)return e;let n=je(e,t);if(n.length===0)return e;let r=De(n);return Ie(e,r)}});var se=S(d=>{"use strict";var fn=d&&d.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(d,"__esModule",{value:!0});d.MAX_SPAN_BYTES=void 0;d.ulidToTraceId=Be;d.newSpanId=Le;d.snakeCase=mn;d.toOtlpValue=Fe;d.attrsFromRecord=gn;d.guardAttrs=$e;d.clientAttrs=qe;d.enforceSpanBudget=Ve;d.buildPayload=hn;d.attachGuard=Ge;d.mergeBatch=_n;var dn=fn(_("crypto")),ie=oe(),pn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Be(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=pn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Le(){return dn.default.randomBytes(8).toString("hex")}function mn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Ne=new Set;function X(e,t,n){let r=(0,ie.truncate)(t);if((n.skipRedactKeys??Ne).has(e))return r;let o=(n.bashContextKeys??Ne).has(e)?"bash":void 0;return(0,ie.redact)(r,{context:o})}function Fe(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:X(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:X(e,JSON.stringify(t),n)}}catch{return{stringValue:X(e,String(t),n)}}default:return{stringValue:X(e,String(t),n)}}}function gn(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,c=Fe(a,i,n);c!==null&&r.push({key:a,value:c})}return r}function $e(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function qe(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}d.MAX_SPAN_BYTES=800*1024;function Ce(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Ue=1024;function Ve(e,t=d.MAX_SPAN_BYTES){let n=Ce(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let l=Buffer.byteLength(u.value.stringValue,"utf-8");l>i&&(i=l,o=u.value)}if(o===null||i<=Ue)break;let a=n-t,c=Math.max(Ue,i-a-64);o.stringValue=(0,ie.truncateTo)(o.stringValue,c),n=Ce(e)}return e}function hn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Be(e.traceId),spanId:Le(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ve(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Ge(i,e.guard,e.clientTiming)}function Ge(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...$e(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...qe(o)),e}function _n(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var ze=S(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.GUARD_STATUS_REFUSED=void 0;C.evaluateGuard=En;var yn=1e4,Pn="pinta-core";function K(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var vn=new Set(["ALLOW","DENY","REVIEW"]);C.GUARD_STATUS_REFUSED=410;async function En(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??yn,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),r);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??Pn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{}},body:JSON.stringify(e),signal:i.signal});if(c.status===C.GUARD_STATUS_REFUSED)return K(Date.now()-o,"refused");if(c.status!==200)return K(Date.now()-o,"error");let u=await c.json(),l=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!vn.has(u.decision)||!l)return K(Date.now()-o,"error");let p=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??p,clientRttMs:p}}catch(c){let u=c.name,l=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return K(Date.now()-o,l)}finally{clearTimeout(a)}}});var Z=S(q=>{"use strict";var Sn=q&&q.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(q,"__esModule",{value:!0});q.atomicWriteFileSync=Tn;var Ye=Sn(_("fs"));function Tn(e,t){let n=`${e}.${process.pid}.tmp`;Ye.default.writeFileSync(n,t),Ye.default.renameSync(n,e)}});var ue=S(A=>{"use strict";var Xe=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.MemoryRetryQueue=A.DiskRetryQueue=void 0;var h=Xe(_("fs")),W=Xe(_("path")),bn=Z(),H=1e3,On=50,kn=5,ae=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=W.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{h.default.mkdirSync(W.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;h.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=h.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){h.default.existsSync(this.filePath)&&h.default.unlinkSync(this.filePath);return}h.default.mkdirSync(W.default.dirname(this.filePath),{recursive:!0}),(0,bn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{g.default.mkdirSync(F.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<nn;)try{let n=g.default.openSync(this.lockPath,"wx");return g.default.writeSync(n,String(process.pid)),g.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let s=g.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){g.default.unlinkSync(this.lockPath);continue}}catch{}let r=rn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{g.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=$)return;let n=t.length-$;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};T.DiskRetryQueue=W;var Q=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>$&&this.entries.splice(0,this.entries.length-$)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};T.MemoryRetryQueue=Q});var Ue=E(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=De;l.envOptionsResolver=Ne;l.postOtlp=D;var Ie=ee(),Re=Z(),on=5e3;l.MAX_POST_BYTES=900*1024;function q(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Ce(e,t,n){let r=[],o=[],s=[],a=0;for(let c of e){let u=t(c);if(u>n){o.push(c);continue}s.length>0&&a+u>n&&(r.push(s),s=[],a=0),s.push(c),a+=u}return s.length>0&&r.push(s),{chunks:r,oversize:o}}function De(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function Ne(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:De(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function D(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),on);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let a="";try{a=(await s.text()).slice(0,200)}catch{}let c=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${c}${a?` body=${a}`:""}
-`),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
-`),!1}finally{clearTimeout(o)}}var te=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ie.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ne}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await D(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Ce(n,c=>q(c.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let s=[].concat(...r),a=0;for(let c of r){if(!await D((0,Re.mergeBatch)(c.map(P=>P.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(s.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=q(t);return n<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=te;var ne=class{queue=new Ie.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(q(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await D(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Ce(n,q,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let s=[].concat(...r),a=0;for(let c of r){if(!await D((0,Re.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of s.slice(a))this.queue.enqueue(c)}};l.MemoryTransport=ne});var ie=E(k=>{"use strict";var se=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.TraceManager=void 0;k.generateUlid=Le;var Be=se(h("fs")),sn=se(h("path")),an=se(h("crypto")),cn=L(),re="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Le(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=re[n&31]+t,n=Math.floor(n/32);let r=an.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=re[r[s]&31];for(;o.length<16;)o+=re[0];return t+o}var oe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=Le();return this.save(t),t}currentTrace(){try{let t=Be.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{Be.default.mkdirSync(sn.default.dirname(this.tracePath),{recursive:!0}),(0,cn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};k.TraceManager=oe});var Ge=E(b=>{"use strict";var $e=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.MemorySessionTraceManager=b.DiskSessionTraceManager=void 0;var Fe=$e(h("fs")),un=$e(h("path")),qe=ie(),ln=L(),Ve=200,ae=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??Ve}read(){try{let t=JSON.parse(Fe.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Fe.default.mkdirSync(un.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,ln.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,qe.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};b.DiskSessionTraceManager=ae;var ce=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Ve}newTrace(t){let n=t||"default",r=(0,qe.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};b.MemorySessionTraceManager=ce});var ze=E(w=>{"use strict";var ue=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.envFilePath=dn;w.parseEnvFile=Xe;w.loadEnvFile=mn;var fn=ue(h("node:fs")),pn=ue(h("node:os")),Ye=ue(h("node:path"));function dn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:Ye.default.join(pn.default.homedir(),e);return Ye.default.join(o,t)}function Xe(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),a=r.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),s&&(t[s]=a)}return t}function mn(e){let t;try{t=fn.default.readFileSync(e,"utf-8")}catch{return}let n=Xe(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var A=E(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var O=z();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return O.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return O.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return O.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return O.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return O.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return O.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return O.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return O.MAX_BYTES}});var y=Z();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var gn=xe();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return gn.evaluateGuard}});var Ke=ee();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return Ke.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return Ke.MemoryRetryQueue}});var j=Ue();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return j.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return j.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return j.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return j.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return j.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return j.MAX_POST_BYTES}});var Ze=ie();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return Ze.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return Ze.generateUlid}});var He=Ge();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return He.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return He.MemorySessionTraceManager}});var le=ze();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return le.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return le.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return le.loadEnvFile}})});import{realpathSync as Qn}from"node:fs";import{pathToFileURL as er}from"node:url";var N=x(A());function hn(){return(0,N.envFilePath)(".claude","pinta-cc.env")}function Je(e=hn()){(0,N.loadEnvFile)(e)}function We(){process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT&&!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT&&(process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT),process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&!process.env.OTEL_EXPORTER_OTLP_HEADERS&&(process.env.OTEL_EXPORTER_OTLP_HEADERS=`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`),!process.env.PINTA_RELAY_TOKEN&&process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.CLAUDE_PLUGIN_OPTION_API_KEY)}var et=x(A());import Qe from"path";function tt(){let e=process.env.CLAUDE_PLUGIN_ROOT||process.cwd(),t=process.env.CLAUDE_PLUGIN_DATA||Qe.join(e,".plugin-data");return{pluginRoot:e,pluginData:t,tracePath:Qe.join(t,"trace.json")}}function nt(){return(0,et.envOptionsResolver)()!==null}function rt(e){return e.hook_event_name==="PreToolUse"}function ot(e){return e.hook_event_name==="PostToolUse"||e.hook_event_name==="PostToolUseFailure"}function st(e){return e.hook_event_name==="UserPromptSubmit"}function it(e){return e.hook_event_name==="SessionStart"||e.hook_event_name==="SessionEnd"}function at(e){return e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop"}function ct(e){return e.hook_event_name==="Stop"}function ut(e){return e.hook_event_name==="PermissionRequest"||e.hook_event_name==="PermissionDenied"}var _n=new Set(["Notification","TaskCreated","TaskCompleted"]);function lt(e){return _n.has(e.hook_event_name)}var ft=x(A()),yn=1e4,vn="pinta-cc/1.7.1";function pt(e,t){return(0,ft.evaluateGuard)(e,t,{timeoutMs:yn,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:vn})}var dt=x(A()),V=class extends dt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-cc"})}};var mt=x(A()),G=class extends mt.TraceManager{constructor(t){super(t.tracePath)}};import de from"os";import{spawnSync as Pn}from"node:child_process";import{createHash as En,randomUUID as Sn}from"node:crypto";import v from"node:fs";import Tn from"node:os";import p from"node:path";var _t=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,bn=/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+\(Claude Code\)$/m,On=2e3,kn=24*60*60*1e3,wn=3e4,pe=8,yt="claude-version.json",M=new Map;function S(e){return typeof e=="object"&&e!==null&&"code"in e&&typeof e.code=="string"?e.code:"UNKNOWN"}function _(e){process.stderr.write(`[pinta-cc] CLI version: ${e}
-`)}function Y(e){return S(e)==="ENOENT"||S(e)==="ENOTDIR"}function An(){let e=process.env.CLAUDE_CODE_EXECPATH,t=process.platform==="win32"?["claude.exe","claude.cmd"]:["claude"],n;if(e)n=[e];else{let r=(process.env.PATH??"").split(p.delimiter).filter(o=>p.isAbsolute(o));try{r.push(p.join(Tn.homedir(),".local","bin"))}catch(o){_(`native install directory lookup failed (${S(o)})`)}n=r.flatMap(o=>t.map(s=>p.join(o,s)))}for(let r of new Set(n))try{let o=v.realpathSync(r),s=v.statSync(o);if(!s.isFile())continue;return!e&&process.platform!=="win32"&&v.accessSync(o,v.constants.X_OK),{file:o,fingerprint:En("sha256").update(JSON.stringify([o,s.ino,s.size,s.mtimeMs,s.ctimeMs])).digest("hex")}}catch(o){Y(o)||_(`executable lookup failed (${S(o)})`)}return _(e?"configured executable is unavailable":"no Claude executable found in PATH or ~/.local/bin"),null}function fe(e){let t;try{t=JSON.parse(v.readFileSync(e,"utf8"))}catch(n){return Y(n)||_(`package metadata could not be read (${n instanceof SyntaxError?"INVALID_JSON":S(n)})`),null}return typeof t!="object"||t===null||!("name"in t)||!("version"in t)||typeof t.name!="string"||typeof t.version!="string"||!_t.test(t.version)?null:t.name==="@anthropic-ai/claude-code"||t.name.startsWith("@anthropic-ai/claude-code-")?t.version:null}function xn(e){let t=p.dirname(e),n=p.basename(t)===".bin"&&/^claude(?:\.cmd)?$/i.test(p.basename(e));for(let r=0;r<6;r++){let o=fe(p.join(t,"package.json"));if(o)return o;if(p.basename(e).toLowerCase()==="claude.cmd"&&r===0){let a=fe(p.join(t,"node_modules","@anthropic-ai","claude-code","package.json"));if(a)return a}if(n&&p.basename(t)==="node_modules"){let a=fe(p.join(t,"@anthropic-ai","claude-code","package.json"));if(a)return a}let s=p.dirname(t);if(s===t)break;t=s}return null}function jn(e){return typeof e=="object"&&e!==null&&"fingerprint"in e&&typeof e.fingerprint=="string"&&/^[0-9a-f]{64}$/.test(e.fingerprint)&&"version"in e&&(e.version===null||typeof e.version=="string"&&_t.test(e.version))&&"checkedAt"in e&&typeof e.checkedAt=="number"&&Number.isFinite(e.checkedAt)}function gt(e,t){let n=t-e.checkedAt;return n>=0&&n<(e.version===null?wn:kn)}function Mn(e){if(!e)return[];let t=p.join(e,yt);try{if(v.statSync(t).size>16384)return _("oversized version cache ignored"),[];let n=JSON.parse(v.readFileSync(t,"utf8"));if(Array.isArray(n)&&n.length<=pe&&n.every(jn))return n;_("invalid version cache ignored")}catch(n){Y(n)||_(`version cache read failed (${n instanceof SyntaxError?"INVALID_JSON":S(n)})`)}return[]}function ht(e){for(M.delete(e.fingerprint),M.set(e.fingerprint,e);M.size>pe;){let t=M.keys().next().value;t!==void 0&&M.delete(t)}}function In(e,t){if(!e)return;let n=p.join(e,yt),r=`${n}.${process.pid}.${Sn()}.tmp`;try{v.mkdirSync(e,{recursive:!0,mode:448}),v.writeFileSync(r,JSON.stringify(t),{encoding:"utf8",mode:384,flag:"wx"}),v.renameSync(r,n)}catch(o){_(`version cache write failed (${S(o)})`)}finally{try{v.unlinkSync(r)}catch(o){Y(o)||_(`temporary version cache cleanup failed (${S(o)})`)}}}function Rn(e){if(/\.(cmd|bat|ps1)$/i.test(e))return _("command shim has no readable Claude package metadata"),null;let t=Pn(e,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],shell:!1,windowsHide:!0,timeout:On,killSignal:"SIGKILL",maxBuffer:4096});if(t.error||t.status!==0)return _(`version probe failed (${t.error?S(t.error):`exit ${t.status??t.signal}`})`),null;let n=bn.exec(t.stdout.trim())?.[1];return n||(_("version probe did not identify Claude Code"),null)}function vt(e){let t=An();if(!t)return"unknown";let n=xn(t.file);if(n)return n;let r=Date.now(),o=Mn(e),s=[M.get(t.fingerprint),...o].find(c=>c&&c.fingerprint===t.fingerprint&&gt(c,r));if(s)return ht(s),s.version??"unknown";let a={fingerprint:t.fingerprint,version:Rn(t.file),checkedAt:Date.now()};return ht(a),In(e,[...o.filter(c=>c.fingerprint!==a.fingerprint&&gt(c,a.checkedAt)),a].slice(-pe)),a.version??"unknown"}var I=x(A()),X;function Cn(){if(X===void 0)try{X=de.userInfo().username}catch{X=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return X}var Pt="1.7.1",Dn=new Set(["cc.hook","cc.tool_name","cc.tool_use_id","cc.session_id","cc.transcript_path","cc.cwd","cc.permission_mode"]),Nn=new Set(["cc.tool_input","cc.tool_response"]),Un={skipRedactKeys:Dn,bashContextKeys:Nn};function Bn(e){let t=[];t.push({key:"ingest.type",value:{stringValue:"cc"}}),t.push({key:"cc.hook",value:{stringValue:e.hook_event_name}});let n={};for(let[r,o]of Object.entries(e))r!=="hook_event_name"&&(n[r]=o);return t.push(...(0,I.attrsFromRecord)(n,"cc",Un)),t}function Ln(e){return[{key:"service.name",value:{stringValue:"claude-code"}},{key:"service.version",value:{stringValue:vt(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-cc"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Pt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Cn()}},{key:"host.name",value:{stringValue:de.hostname()}},{key:"host.arch",value:{stringValue:de.arch()}}]}function Et(e){return(0,I.buildPayload)({traceId:e.traceId,spanName:`cc.${(0,I.snakeCase)(e.event.hook_event_name)}`,attributes:Bn(e.event),resource:Ln(e.versionCacheDir),scope:{name:"pinta-cc",version:Pt},now:e.now,guard:e.guard})}async function m(e,t,n={}){if(!nt())return;let r=new V(t);await r.flush();let o=new G(t),s=n.traceMode==="new"?o.newTrace():o.currentTrace(),a=Et({event:e,traceId:s,guard:n.guard,versionCacheDir:t.pluginData});await r.send(a)}async function St(e,t){let n=typeof e.tool_input=="string"?e.tool_input:JSON.stringify(e.tool_input),r=await pt({spanId:e.session_id??"unknown",toolName:e.tool_name,method:e.hook_event_name,cwd:e.cwd,toolInput:e.tool_input,rawTextFields:{toolInput:n}},process.env.PINTA_GUARD_ENDPOINT);if(r?.decision==="DENY"){let s={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:r.userMessage??r.reason??"guard_deny"}};process.stdout.write(JSON.stringify(s)+`
-`)}try{await m(e,t,{guard:r})}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
-`)}return 0}async function Tt(e,t){return await m(e,t),0}async function bt(e,t){return await m(e,t,{traceMode:"new"}),0}async function Ot(e,t){return await m(e,t),0}async function kt(e,t){return await m(e,t),0}async function wt(e,t){return await m(e,t),0}async function At(e,t){return await m(e,t),0}async function me(e){return 0}async function Fn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function xt(){We();let e=0;try{let t=tt(),n=await Fn(),r=JSON.parse(n);lt(r)?e=await me(r):rt(r)?e=await St(r,t):ot(r)?e=await Tt(r,t):st(r)?e=await bt(r,t):it(r)?e=await Ot(r,t):at(r)?e=await kt(r,t):ct(r)?e=await wt(r,t):ut(r)?e=await At(r,t):e=await me(r)}catch(t){process.stderr.write(`[pinta-cc] error: ${t}
-`),e=0}return e}import{opendir as $n,stat as qn}from"node:fs/promises";import{homedir as Vn}from"node:os";import U from"node:path";var Gn="pinta-cc",jt="memory";function Yn(){let e=process.env.CLAUDE_CONFIG_DIR;return e&&e.length>0?e:U.join(Vn(),".claude")}function Xn(){return U.join(Yn(),"projects")}function zn(e,t){return U.relative(e,t).split(U.sep).join("/")}function Kn(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function Zn(e){let t=e.split("/");if(t.length<2)return{};let n=t[0],r=t[1];return t.length===2?r.endsWith(".jsonl")?{projectKey:n,sessionId:r.slice(0,-6)}:{projectKey:n}:r===jt?{projectKey:n}:{projectKey:n,sessionId:r}}function Hn(e){return e.endsWith(".jsonl")?"session-log":e.split("/")[1]===jt?"memory":e.endsWith(".json")?"meta":"other"}async function Mt(){return[Xn()]}async function*It(e,t){let n;try{n=await $n(t)}catch{return}try{for await(let r of n){let o=U.join(t,r.name);r.isDirectory()?yield*It(e,o):r.isFile()&&(yield{absPath:o,relPath:zn(e,o)})}}catch{return}}async function*Jn(e){let[t]=await Mt(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of It(t,t)){let s;try{s=await qn(r)}catch{continue}if(n!==void 0&&s.mtime.getTime()<=n)continue;let{projectKey:a,sessionId:c}=Zn(o);yield{relPath:o,absPath:r,size:s.size,mtime:s.mtime,sessionId:c,projectKey:a,semantics:Kn(o)}}}var Wn={id:Gn,roots:Mt,scan:Jn,classify:Hn};Je();function tr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===er(Qn(e)).href}catch{return!1}}async function nr(){let e=await xt();process.exit(e)}tr()&&nr();export{Wn as lifecycle};
+`)}}tryAcquireLock(){let t=Date.now();try{h.default.mkdirSync(W.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<On;)try{let n=h.default.openSync(this.lockPath,"wx");return h.default.writeSync(n,String(process.pid)),h.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let i=h.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){h.default.unlinkSync(this.lockPath);continue}}catch{}let r=kn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{h.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=H)return;let n=t.length-H;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};A.DiskRetryQueue=ae;var ce=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>H&&this.entries.splice(0,this.entries.length-H)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};A.MemoryRetryQueue=ce});var Qe=S(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.MemoryTransport=f.DiskTransport=f.MAX_POST_BYTES=void 0;f.parseHeadersEnv=He;f.envOptionsResolver=Je;f.postOtlp=V;var Ke=ue(),Ze=se(),An=5e3;f.MAX_POST_BYTES=900*1024;function J(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function We(e,t,n){let r=[],o=[],i=[],a=0;for(let c of e){let u=t(c);if(u>n){o.push(c);continue}i.length>0&&a+u>n&&(r.push(i),i=[],a=0),i.push(c),a+=u}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function He(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function Je(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:He(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function V(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),An);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let c=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${c}${a?` body=${a}`:""}
+`),!1}return!0}catch(i){return process.stderr.write(`[${n}] OTLP POST failed: ${i.message??String(i)}
+`),!1}finally{clearTimeout(o)}}var le=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ke.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Je}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await V(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=We(n,c=>J(c.payload),f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${f.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...r),a=0;for(let c of r){if(!await V((0,Ze.mergeBatch)(c.map(l=>l.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(i.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=J(t);return n<=f.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};f.DiskTransport=le;var fe=class{queue=new Ke.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(J(t)>f.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await V(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=We(n,J,f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${f.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...r),a=0;for(let c of r){if(!await V((0,Ze.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of i.slice(a))this.queue.enqueue(c)}};f.MemoryTransport=fe});var ge=S(j=>{"use strict";var me=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=tt;var et=me(_("fs")),wn=me(_("path")),xn=me(_("crypto")),Mn=Z(),de="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function tt(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=de[n&31]+t,n=Math.floor(n/32);let r=xn.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=de[r[i]&31];for(;o.length<16;)o+=de[0];return t+o}var pe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=tt();return this.save(t),t}currentTrace(){try{let t=et.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{et.default.mkdirSync(wn.default.dirname(this.tracePath),{recursive:!0}),(0,Mn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};j.TraceManager=pe});var st=S(w=>{"use strict";var rt=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.MemorySessionTraceManager=w.DiskSessionTraceManager=void 0;var nt=rt(_("fs")),Rn=rt(_("path")),ot=ge(),jn=Z(),it=200,he=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??it}read(){try{let t=JSON.parse(nt.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{nt.default.mkdirSync(Rn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,jn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,ot.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};w.DiskSessionTraceManager=he;var _e=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??it}newTrace(t){let n=t||"default",r=(0,ot.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};w.MemorySessionTraceManager=_e});var ut=S(D=>{"use strict";var ye=D&&D.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(D,"__esModule",{value:!0});D.envFilePath=Nn;D.parseEnvFile=ct;D.loadEnvFile=Cn;var Dn=ye(_("node:fs")),In=ye(_("node:os")),at=ye(_("node:path"));function Nn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:at.default.join(In.default.homedir(),e);return at.default.join(o,t)}function ct(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),a=r.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function Cn(e){let t;try{t=Dn.default.readFileSync(e,"utf-8")}catch{return}let n=ct(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var M=S(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var x=oe();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return x.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return x.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return x.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return x.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return x.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return x.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return x.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return x.MAX_BYTES}});var y=se();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var lt=ze();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return lt.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return lt.GUARD_STATUS_REFUSED}});var ft=ue();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return ft.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return ft.MemoryRetryQueue}});var U=Qe();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return U.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return U.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return U.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return U.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return U.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return U.MAX_POST_BYTES}});var dt=ge();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return dt.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return dt.generateUlid}});var pt=st();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return pt.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return pt.MemorySessionTraceManager}});var Pe=ut();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return Pe.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return Pe.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return Pe.loadEnvFile}})});import{realpathSync as Ar}from"node:fs";import{pathToFileURL as wr}from"node:url";var G=R(M());function Un(){return(0,G.envFilePath)(".claude","pinta-cc.env")}function mt(e=Un()){(0,G.loadEnvFile)(e)}function gt(){process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT&&!process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT&&(process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT),process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&!process.env.OTEL_EXPORTER_OTLP_HEADERS&&(process.env.OTEL_EXPORTER_OTLP_HEADERS=`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`),!process.env.PINTA_RELAY_TOKEN&&process.env.CLAUDE_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.CLAUDE_PLUGIN_OPTION_API_KEY)}var _t=R(M());import ht from"path";function yt(){let e=process.env.CLAUDE_PLUGIN_ROOT||process.cwd(),t=process.env.CLAUDE_PLUGIN_DATA||ht.join(e,".plugin-data");return{pluginRoot:e,pluginData:t,tracePath:ht.join(t,"trace.json")}}function ve(){return(0,_t.envOptionsResolver)()!==null}function Pt(e){return e.hook_event_name==="PreToolUse"}function vt(e){return e.hook_event_name==="PostToolUse"||e.hook_event_name==="PostToolUseFailure"}function Et(e){return e.hook_event_name==="UserPromptSubmit"}function St(e){return e.hook_event_name==="SessionStart"||e.hook_event_name==="SessionEnd"}function Tt(e){return e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop"}function bt(e){return e.hook_event_name==="Stop"}function Ot(e){return e.hook_event_name==="PermissionRequest"||e.hook_event_name==="PermissionDenied"}var Bn=new Set(["Notification","TaskCreated","TaskCompleted"]);function kt(e){return Bn.has(e.hook_event_name)}var Gt=R(M());var At=R(M()),Ln=1e4,Fn="pinta-cc/1.9.0";function wt(e,t){return(0,At.evaluateGuard)(e,t,{timeoutMs:Ln,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Fn})}var xt=R(M()),Q=class extends xt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-cc"})}};var Mt=R(M()),ee=class extends Mt.TraceManager{constructor(t){super(t.tracePath)}};import be from"os";import{spawnSync as $n}from"node:child_process";import{createHash as qn,randomUUID as Vn}from"node:crypto";import E from"node:fs";import Gn from"node:os";import m from"node:path";var Dt=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/,zn=/^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\s+\(Claude Code\)$/m,Yn=2e3,Xn=24*60*60*1e3,Kn=3e4,Se=8,It="claude-version.json",B=new Map;function b(e){return typeof e=="object"&&e!==null&&"code"in e&&typeof e.code=="string"?e.code:"UNKNOWN"}function P(e){process.stderr.write(`[pinta-cc] CLI version: ${e}
+`)}function te(e){return b(e)==="ENOENT"||b(e)==="ENOTDIR"}function Zn(){let e=process.env.CLAUDE_CODE_EXECPATH,t=process.platform==="win32"?["claude.exe","claude.cmd"]:["claude"],n;if(e)n=[e];else{let r=(process.env.PATH??"").split(m.delimiter).filter(o=>m.isAbsolute(o));try{r.push(m.join(Gn.homedir(),".local","bin"))}catch(o){P(`native install directory lookup failed (${b(o)})`)}n=r.flatMap(o=>t.map(i=>m.join(o,i)))}for(let r of new Set(n))try{let o=E.realpathSync(r),i=E.statSync(o);if(!i.isFile())continue;return!e&&process.platform!=="win32"&&E.accessSync(o,E.constants.X_OK),{file:o,fingerprint:qn("sha256").update(JSON.stringify([o,i.ino,i.size,i.mtimeMs,i.ctimeMs])).digest("hex")}}catch(o){te(o)||P(`executable lookup failed (${b(o)})`)}return P(e?"configured executable is unavailable":"no Claude executable found in PATH or ~/.local/bin"),null}function Ee(e){let t;try{t=JSON.parse(E.readFileSync(e,"utf8"))}catch(n){return te(n)||P(`package metadata could not be read (${n instanceof SyntaxError?"INVALID_JSON":b(n)})`),null}return typeof t!="object"||t===null||!("name"in t)||!("version"in t)||typeof t.name!="string"||typeof t.version!="string"||!Dt.test(t.version)?null:t.name==="@anthropic-ai/claude-code"||t.name.startsWith("@anthropic-ai/claude-code-")?t.version:null}function Wn(e){let t=m.dirname(e),n=m.basename(t)===".bin"&&/^claude(?:\.cmd)?$/i.test(m.basename(e));for(let r=0;r<6;r++){let o=Ee(m.join(t,"package.json"));if(o)return o;if(m.basename(e).toLowerCase()==="claude.cmd"&&r===0){let a=Ee(m.join(t,"node_modules","@anthropic-ai","claude-code","package.json"));if(a)return a}if(n&&m.basename(t)==="node_modules"){let a=Ee(m.join(t,"@anthropic-ai","claude-code","package.json"));if(a)return a}let i=m.dirname(t);if(i===t)break;t=i}return null}function Hn(e){return typeof e=="object"&&e!==null&&"fingerprint"in e&&typeof e.fingerprint=="string"&&/^[0-9a-f]{64}$/.test(e.fingerprint)&&"version"in e&&(e.version===null||typeof e.version=="string"&&Dt.test(e.version))&&"checkedAt"in e&&typeof e.checkedAt=="number"&&Number.isFinite(e.checkedAt)}function Rt(e,t){let n=t-e.checkedAt;return n>=0&&n<(e.version===null?Kn:Xn)}function Jn(e){if(!e)return[];let t=m.join(e,It);try{if(E.statSync(t).size>16384)return P("oversized version cache ignored"),[];let n=JSON.parse(E.readFileSync(t,"utf8"));if(Array.isArray(n)&&n.length<=Se&&n.every(Hn))return n;P("invalid version cache ignored")}catch(n){te(n)||P(`version cache read failed (${n instanceof SyntaxError?"INVALID_JSON":b(n)})`)}return[]}function jt(e){for(B.delete(e.fingerprint),B.set(e.fingerprint,e);B.size>Se;){let t=B.keys().next().value;t!==void 0&&B.delete(t)}}function Qn(e,t){if(!e)return;let n=m.join(e,It),r=`${n}.${process.pid}.${Vn()}.tmp`;try{E.mkdirSync(e,{recursive:!0,mode:448}),E.writeFileSync(r,JSON.stringify(t),{encoding:"utf8",mode:384,flag:"wx"}),E.renameSync(r,n)}catch(o){P(`version cache write failed (${b(o)})`)}finally{try{E.unlinkSync(r)}catch(o){te(o)||P(`temporary version cache cleanup failed (${b(o)})`)}}}function er(e){if(/\.(cmd|bat|ps1)$/i.test(e))return P("command shim has no readable Claude package metadata"),null;let t=$n(e,["--version"],{encoding:"utf8",stdio:["ignore","pipe","pipe"],shell:!1,windowsHide:!0,timeout:Yn,killSignal:"SIGKILL",maxBuffer:4096});if(t.error||t.status!==0)return P(`version probe failed (${t.error?b(t.error):`exit ${t.status??t.signal}`})`),null;let n=zn.exec(t.stdout.trim())?.[1];return n||(P("version probe did not identify Claude Code"),null)}function Nt(e){let t=Zn();if(!t)return"unknown";let n=Wn(t.file);if(n)return n;let r=Date.now(),o=Jn(e),i=[B.get(t.fingerprint),...o].find(c=>c&&c.fingerprint===t.fingerprint&&Rt(c,r));if(i)return jt(i),i.version??"unknown";let a={fingerprint:t.fingerprint,version:er(t.file),checkedAt:Date.now()};return jt(a),Qn(e,[...o.filter(c=>c.fingerprint!==a.fingerprint&&Rt(c,a.checkedAt)),a].slice(-Se)),a.version??"unknown"}import N from"node:path";import O from"node:fs";import Ct from"node:path";var tr=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),nr=256*1024,rr=1024*1024,or=4096;function I(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function Te(e){let t=I(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!tr.has(r.toLowerCase())?r:void 0}function Ut(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function L(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function ne(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Bt(e,t){let n=e.timestamp===void 0?ne(t):ne(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Lt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Ct.isAbsolute(e)||Ct.extname(e)!==".jsonl")return;let t;try{t=O.openSync(e,O.constants.O_RDONLY|O.constants.O_NONBLOCK|(O.constants.O_NOFOLLOW??0));let n=O.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,nr));if(O.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=I(JSON.parse(r.toString("utf8",0,o)))}catch{}let a=Math.max(0,n.size-rr),c=n.size<=r.length?r:Buffer.alloc(n.size-a);if(c!==r&&O.readSync(t,c,0,c.length,a)!==c.length)return;let u=O.fstatSync(t);if(u.size<n.size||u.size===n.size&&u.mtimeMs!==n.mtimeMs)return;let l=a>0?c.indexOf(10)+1:0,p=c.lastIndexOf(10);if(a>0&&l===0||p<l)return;let k=[],T=0;for(;p>l&&T<or;){let Y=c.lastIndexOf(10,p-1),$=Math.max(l,Y+1),we=c.toString("utf8",$,p).trim();if(we){let xe=I(JSON.parse(we));xe&&k.push(xe)}p=$-1,T++}return k.reverse(),{first:i,rows:k,complete:a===0&&p<0&&c[c.length-1]===10}}catch{return}finally{if(t!==void 0)try{O.closeSync(t)}catch{}}}function Ft(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var ir=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest","PermissionDenied"]);function sr(e,t){let n=N.dirname(e);if(N.basename(n)!=="subagents"||N.basename(N.dirname(n))!==t)return;let r=/^agent-(.+)\.jsonl$/.exec(N.basename(e));return L(r?.[1])}function $t(e,t){let n=Te(e.model);if(n)return{name:n,source:"hook.model"};try{return ar(e,t)}catch{return}}function ar(e,t){if(!ir.has(e.hook_event_name))return;let n=L(e.session_id),r=L(e.tool_use_id),o=Bt(e,t);if(!n||!r||o===void 0||typeof e.transcript_path!="string")return;let i=sr(e.transcript_path,n),a=e.agent_id===void 0?i:L(e.agent_id);if(e.agent_id!==void 0&&!a||i!==void 0&&i!==a||!a&&e.agent_type!==void 0||N.basename(N.dirname(e.transcript_path))==="subagents"&&!i)return;let c=Lt(e.transcript_path);if(!c)return;let u=[];for(let l of c.rows){let p=ne(l.timestamp);if(l.type!=="assistant"||l.sessionId!==n||p===void 0||p>o)continue;let k=l.agentId===void 0?void 0:L(l.agentId);if(k!==a||l.agentId!==void 0&&!k||l.isSidechain===!0&&!a)continue;let T=I(l.message);if(!T||T.role!==void 0&&T.role!=="assistant"||!Array.isArray(T.content)||!T.content.some($=>I($)?.type==="tool_use"&&I($)?.id===r))continue;let Y=Te(T.model);u.push(Y?{name:Y,source:"transcript.assistant.message"}:void 0)}return Ft(u)}var F=R(M()),re;function cr(){if(re===void 0)try{re=be.userInfo().username}catch{re=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return re}var qt="1.9.0",ur=new Set(["cc.hook","cc.tool_name","cc.tool_use_id","cc.session_id","cc.transcript_path","cc.cwd","cc.permission_mode"]),lr=new Set(["cc.tool_input","cc.tool_response"]),fr={skipRedactKeys:ur,bashContextKeys:lr};function dr(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"cc"}}),n.push({key:"cc.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,i]of Object.entries(e))o!=="hook_event_name"&&(r[o]=i);return Ut(r,$t(e,t)),n.push(...(0,F.attrsFromRecord)(r,"cc",fr)),n}function pr(e){return[{key:"service.name",value:{stringValue:"claude-code"}},{key:"service.version",value:{stringValue:Nt(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-cc"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:qt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:cr()}},{key:"host.name",value:{stringValue:be.hostname()}},{key:"host.arch",value:{stringValue:be.arch()}}]}function Vt(e){let t=e.now??Date.now();return(0,F.buildPayload)({traceId:e.traceId,spanName:`cc.${(0,F.snakeCase)(e.event.hook_event_name)}`,attributes:dr(e.event,t),resource:pr(e.versionCacheDir),scope:{name:"pinta-cc",version:qt},now:t})}function Oe(e,t,n={}){let r=new ee(t),o=n.traceMode==="new"?r.newTrace():r.currentTrace();return Vt({event:e,traceId:o,versionCacheDir:t.pluginData})}async function ke(e,t){if(!ve())return;let n=new Q(t);await n.flush(),await n.send(e)}async function v(e,t,n={}){ve()&&await ke(Oe(e,t,n),t)}async function zt(e,t){let n=Oe(e,t),r=await wt(n,process.env.PINTA_GUARD_ENDPOINT);if(r?.decision==="DENY"){let i={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:r.userMessage??r.reason??"guard_deny"}};process.stdout.write(JSON.stringify(i)+`
+`)}try{(0,Gt.attachGuard)(n,r),await ke(n,t)}catch(o){process.stderr.write(`[pinta-cc] telemetry emit failed: ${o}
+`)}return 0}async function Yt(e,t){return await v(e,t),0}async function Xt(e,t){return await v(e,t,{traceMode:"new"}),0}async function Kt(e,t){return await v(e,t),0}async function Zt(e,t){return await v(e,t),0}async function Wt(e,t){return await v(e,t),0}async function Ht(e,t){return await v(e,t),0}async function Ae(e){return 0}async function mr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Jt(){gt();let e=0;try{let t=yt(),n=await mr(),r=JSON.parse(n);kt(r)?e=await Ae(r):Pt(r)?e=await zt(r,t):vt(r)?e=await Yt(r,t):Et(r)?e=await Xt(r,t):St(r)?e=await Kt(r,t):Tt(r)?e=await Zt(r,t):bt(r)?e=await Wt(r,t):Ot(r)?e=await Ht(r,t):e=await Ae(r)}catch(t){process.stderr.write(`[pinta-cc] error: ${t}
+`),e=0}return e}import{opendir as gr,stat as hr}from"node:fs/promises";import{homedir as _r}from"node:os";import z from"node:path";var yr="pinta-cc",Qt="memory";function Pr(){let e=process.env.CLAUDE_CONFIG_DIR;return e&&e.length>0?e:z.join(_r(),".claude")}function vr(){return z.join(Pr(),"projects")}function Er(e,t){return z.relative(e,t).split(z.sep).join("/")}function Sr(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function Tr(e){let t=e.split("/");if(t.length<2)return{};let n=t[0],r=t[1];return t.length===2?r.endsWith(".jsonl")?{projectKey:n,sessionId:r.slice(0,-6)}:{projectKey:n}:r===Qt?{projectKey:n}:{projectKey:n,sessionId:r}}function br(e){return e.endsWith(".jsonl")?"session-log":e.split("/")[1]===Qt?"memory":e.endsWith(".json")?"meta":"other"}async function en(){return[vr()]}async function*tn(e,t){let n;try{n=await gr(t)}catch{return}try{for await(let r of n){let o=z.join(t,r.name);r.isDirectory()?yield*tn(e,o):r.isFile()&&(yield{absPath:o,relPath:Er(e,o)})}}catch{return}}async function*Or(e){let[t]=await en(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of tn(t,t)){let i;try{i=await hr(r)}catch{continue}if(n!==void 0&&i.mtime.getTime()<=n)continue;let{projectKey:a,sessionId:c}=Tr(o);yield{relPath:o,absPath:r,size:i.size,mtime:i.mtime,sessionId:c,projectKey:a,semantics:Sr(o)}}}var kr={id:yr,roots:en,scan:Or,classify:br};mt();function xr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===wr(Ar(e)).href}catch{return!1}}async function Mr(){let e=await Jt();process.exit(e)}xr()&&Mr();export{kr as lifecycle};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinta-ai/pinta-cc",
-  "version": "1.7.1",
+  "version": "1.9.0",
   "description": "Generic OTLP forwarder for Claude Code hook events",
   "main": "dist/index.js",
   "exports": {
@@ -37,11 +37,12 @@
     "test:watch": "vitest",
     "smoke:import": "node scripts/smoke-import.mjs",
     "smoke:version": "node scripts/smoke-version.mjs",
+    "smoke:model": "node scripts/smoke-model.mjs",
     "mock-server": "npx tsx tools/mock-server.ts",
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {
-    "@pinta-ai/core": "^0.6.0",
+    "@pinta-ai/core": "^0.8.0",
     "@types/node": "^22.0.0",
     "esbuild": "^0.24.0",
     "tsx": "^4.0.0",