@pinta-ai/pinta-codex 1.10.0 → 1.11.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pinta-codex",
-  "version": "1.10.0",
+  "version": "1.11.1",
   "description": "Generic OTLP forwarder for Codex hook events",
   "author": {
     "name": "Pinta AI",

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to pinta-codex are documented here.
 
+## [1.11.1] - 2026-09-30
+
+### Fixed
+
+- Guard successful `PostToolUse` output before telemetry and use fixed safe
+  feedback for denied model-facing content (PTA-587).
+- Complete decided denials without waiting for collector network IO; retain
+  the original redacted evidence in the bounded retry queue.
+- Bundle `@pinta-ai/core` `^0.9.2` so ordinary `find -path` and `find -print`
+  arguments are not mistaken for mysql-family password options (PTA-515).
+
+### Compatibility
+
+- Catalog distribution of this output-enforcing release is gated to Manager
+  0.1.14 or later; older Managers keep the preceding compatible adapter.
+- Output protection requires a dispatched native hook and an output-capable
+  Manager/guard. Codex 0.154.0 skips `PostToolUse` for MCP `isError` results;
+  this release does not fix that host boundary (PTA-596).
+- REVIEW, disabled/fail-open behavior, guard budgets and guard/export ordering
+  are unchanged. Output denial does not undo an executed tool.
+
+## [1.11.0] - 2026-09-30
+
+### Changed
+
+- The guard gate now waits 100ms for a verdict, up from 50ms (PTA-579). At 50ms
+  the prod p99 of answers that did come back (58ms) already sat past the cut,
+  so slow-but-real verdicts were thrown away as `timeout` fail-opens.
+- The gate declares that budget to the manager. `@pinta-ai/core` `^0.8.0` →
+  `^0.9.0`, which sends the timeout as `x-pinta-guard-budget-ms`. Manager
+  0.1.10+ reads it instead of the adaptor table it keeps, which still says 50
+  for pinta-codex. Without the header the manager gives up on the backend
+  package check at 40ms. With it the manager has 80ms.
+
+### Compatibility
+
+- Still requires Pinta Manager 0.1.11 or later. Guard payloads, output
+  envelopes, event counts and redaction are unchanged. A manager older than
+  0.1.10 ignores the header and keeps its own table.
+
 ## [1.10.0] - 2026-09-22
 
 ### Added

package/README.md

@@ -31,8 +31,8 @@ npm run doctor     # verify everything green
 
 ## What it captures
 
-Codex 0.154.0 dispatches **twelve** hook events. All twelve are handled: two are
-pre-execution gates that can block, and ten are observed and forwarded.
+Codex 0.154.0 dispatches **twelve** hook events. All twelve are handled: two
+pre-execution gates, one output gate, and nine observations.
 
 Hooks require the `hooks` feature in `~/.codex/config.toml`:
 
@@ -48,17 +48,19 @@ hooks = true
 
 | Event | Notes |
 |-------|-------|
-| `PreToolUse` | Every local tool, not just Bash — `apply_patch`, MCP calls and all function tools since 0.134.0 |
+| `PreToolUse` | Local calls which dispatch this hook, including Bash, `apply_patch` and MCP; not every host tool path |
 | `PermissionRequest` | Fires when Codex would prompt the user, including for network access |
 
 Both answer through stdout, and their output envelopes are **not the same
 shape** — see `src/core/types.ts`. A deny must carry a non-empty reason; Codex
 rejects one without it. `PreToolUse` accepts only `deny` (an allow is empty
 stdout).
+Hosted tools, `write_stdin` and specialized paths that omit these hooks remain
+outside adapter coverage.
 
 ### Observed — forwarded, never block
 
-`PostToolUse`, `PreCompact`, `PostCompact`, `SessionStart`, `SessionEnd`,
+`PreCompact`, `PostCompact`, `SessionStart`, `SessionEnd`,
 `UserPromptSubmit`, `SubagentStart`, `SubagentStop`, `Stop`, `Interrupt`.
 
 `SessionStart` also drains the retry queue; `UserPromptSubmit` starts a new ULID
@@ -67,13 +69,41 @@ send-only — Codex reads no reply from it.
 
 Each invocation spawns `node dist/index.js`, maps the event to a single OTLP span, and POSTs it to `{endpoint}/traces`.
 
+### Output gate — does not undo execution
+
+`PostToolUse` submits the original `tool_response`, input and event identity to
+the guard, including non-zero Bash exits when the host dispatches this event. On DENY it
+returns **`{"decision":"block","reason":"…"}`**, the native
+[Codex 0.154.0 contract](https://github.com/openai/codex/blob/rust-v0.154.0/codex-rs/hooks/src/events/post_tool_use.rs).
+Codex substitutes that feedback for the original result; it may continue the
+turn. This is not a pre-tool refusal or rollback of completed side effects.
+The feedback is fixed safe text, never a guard-supplied reason copied into
+model-facing output. The original verdict remains attached to audit evidence.
+Hosted tools and paths which do not dispatch local hooks remain outside coverage.
+In a native Codex 0.154.0 loopback-provider test, successful MCP results dispatched
+this hook, but MCP `isError: true` results reached the model **without a
+`PostToolUse` event**. Those error results remain outside this adapter's output
+gate (PTA-596); a handler-only fixture cannot prove native error coverage.
+
+Output decisions carry `pinta.guard.target=tool_output` on the original masked
+span. The manager/runtime must interpret the native post phase as output
+evaluation, not re-run execution policies against completed operations.
+
+For **all three gates**, a decided DENY queues its span on disk and finishes
+without an OTLP/retry network wait. A later non-denied/lifecycle hook drains the
+existing retry queue. Delivery remains best-effort: a denied invocation alone
+does not prove collector ingestion.
+Deferred payloads retain the transport's `MAX_POST_BYTES` UTF-8 JSON limit;
+oversized payloads are diagnosed and dropped without a network fallback.
+Guard-only configurations without a telemetry endpoint retain no queue entries.
+
 ## Behavior
 
 - OTLP/HTTP JSON transport. Headers are read from `OTEL_EXPORTER_OTLP_HEADERS` (`key=val,key=val` format)
 - Top-level event fields are flattened into `codex.*` span attributes (Bronze; sibling adaptors use `cc.*`, `mcp.*`)
-- **Telemetry never blocks.** Every hook exits 0, and transmission failures are absorbed by the retry queue. A guard decision travels in stdout, so a dropped span cannot deny and a failed POST cannot stall a turn
+- **Telemetry is best-effort.** Every hook exits 0. A decided DENY travels in stdout and queues its span without awaiting a network request; other hooks retain normal send/retry behavior
 - **Fail-open is deliberate.** If the guard endpoint is unreachable or slow, the gates allow. An outage in Pinta must not stop an engineer from working; the guard is a control, not a dependency
-- Disk-backed retry queue at `.plugin-data/failed-spans.jsonl` (cap 1000). Drained on the next hook invocation
+- Disk-backed retry queue at `.plugin-data/failed-spans.jsonl` (cap 1000). Drained on a later non-denied or lifecycle hook invocation
 - One trace per user turn — based on the `UserPromptSubmit` ULID
 
 ### Model attribution and its limits

package/dist/index.js

@@ -1,26 +1,33 @@
-"use strict";var Vt=Object.create;var Te=Object.defineProperty;var Xt=Object.getOwnPropertyDescriptor;var Ft=Object.getOwnPropertyNames;var Yt=Object.getPrototypeOf,zt=Object.prototype.hasOwnProperty;var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Kt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Ft(t))!zt.call(e,o)&&o!==n&&Te(e,o,{get:()=>t[o],enumerable:!(r=Xt(t,o))||r.enumerable});return e};var m=(e,t,n)=>(n=e!=null?Vt(Yt(e)):{},Kt(t||!e||!e.__esModule?Te(n,"default",{value:e,enumerable:!0}):n,e));var ee=h(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.PATTERNS=_.MAX_BYTES=void 0;_.truncateTo=be;_.truncate=Ht;_.collectMatches=xe;_.resolveOverlaps=ke;_.applyMatches=Ae;_.redact=Wt;_.MAX_BYTES=102400;function be(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Ht(e){return be(e,_.MAX_BYTES)}_.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function xe(e,t){let n=[];for(let r of _.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=o.exec(e))!==null;){let u=r.captureGroup??0,a=s[u];if(a===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let c=s.index,d=s.index+s[0].length,p=c+s[0].indexOf(a),v=p+a.length;n.push({start:c,end:d,replaceStart:p,replaceEnd:v,type:r.type}),s.index===o.lastIndex&&o.lastIndex++}}return n}function ke(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Ae(e,t){let n=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function Wt(e,t={}){if(e.length===0)return e;let n=xe(e,t);if(n.length===0)return e;let r=ke(n);return Ae(e,r)}});var ne=h(f=>{"use strict";var Zt=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=De;f.newSpanId=Ne;f.snakeCase=en;f.toOtlpValue=Ce;f.attrsFromRecord=tn;f.guardAttrs=je;f.clientAttrs=Ie;f.enforceSpanBudget=Be;f.buildPayload=nn;f.attachGuard=Ue;f.mergeBatch=rn;var Jt=Zt(require("crypto")),te=ee(),Qt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function De(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=Qt.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ne(){return Jt.default.randomBytes(8).toString("hex")}function en(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Re=new Set;function G(e,t,n){let r=(0,te.truncate)(t);if((n.skipRedactKeys??Re).has(e))return r;let o=(n.bashContextKeys??Re).has(e)?"bash":void 0;return(0,te.redact)(r,{context:o})}function Ce(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:G(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:G(e,JSON.stringify(t),n)}}catch{return{stringValue:G(e,String(t),n)}}default:return{stringValue:G(e,String(t),n)}}}function tn(e,t,n={}){let r=[];for(let[o,s]of Object.entries(e)){let u=`${t}.${o}`,a=Ce(u,s,n);a!==null&&r.push({key:u,value:a})}return r}function je(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ie(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function we(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Me=1024;function Be(e,t=f.MAX_SPAN_BYTES){let n=we(e);for(let r=0;r<100&&n>t;r++){let o=null,s=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let d=Buffer.byteLength(c.value.stringValue,"utf-8");d>s&&(s=d,o=c.value)}if(o===null||s<=Me)break;let u=n-t,a=Math.max(Me,s-u-64);o.stringValue=(0,te.truncateTo)(o.stringValue,a),n=we(e)}return e}function nn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:De(e.traceId),spanId:Ne(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Be(o);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Ue(s,e.guard,e.clientTiming)}function Ue(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...je(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Ie(o)),e}function rn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Le=h(w=>{"use strict";Object.defineProperty(w,"__esModule",{value:!0});w.GUARD_STATUS_REFUSED=void 0;w.evaluateGuard=un;var on=1e4,sn="pinta-core";function $(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var an=new Set(["ALLOW","DENY","REVIEW"]);w.GUARD_STATUS_REFUSED=410;async function un(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??on,o=Date.now(),s=new AbortController,u=setTimeout(()=>s.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??sn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{}},body:JSON.stringify(e),signal:s.signal});if(a.status===w.GUARD_STATUS_REFUSED)return $(Date.now()-o,"refused");if(a.status!==200)return $(Date.now()-o,"error");let c=await a.json(),d=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!an.has(c.decision)||!d)return $(Date.now()-o,"error");let p=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??p,clientRttMs:p}}catch(a){let c=a.name,d=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return $(Date.now()-o,d)}finally{clearTimeout(u)}}});var V=h(N=>{"use strict";var cn=N&&N.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(N,"__esModule",{value:!0});N.atomicWriteFileSync=dn;var qe=cn(require("fs"));function dn(e,t){let n=`${e}.${process.pid}.tmp`;qe.default.writeFileSync(n,t),qe.default.renameSync(n,e)}});var se=h(S=>{"use strict";var Ge=S&&S.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(S,"__esModule",{value:!0});S.MemoryRetryQueue=S.DiskRetryQueue=void 0;var g=Ge(require("fs")),X=Ge(require("path")),ln=V(),F=1e3,fn=50,pn=5,re=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=X.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{g.default.mkdirSync(X.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+"use strict";var en=Object.create;var De=Object.defineProperty;var tn=Object.getOwnPropertyDescriptor;var nn=Object.getOwnPropertyNames;var rn=Object.getPrototypeOf,on=Object.prototype.hasOwnProperty;var E=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var sn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of nn(t))!on.call(e,o)&&o!==n&&De(e,o,{get:()=>t[o],enumerable:!(r=tn(t,o))||r.enumerable});return e};var m=(e,t,n)=>(n=e!=null?en(rn(e)):{},sn(t||!e||!e.__esModule?De(n,"default",{value:e,enumerable:!0}):n,e));var Ie=E(se=>{"use strict";Object.defineProperty(se,"__esModule",{value:!0});se.mysqlPasswordRanges=mn;var an=new Set(["mysql","mysqldump","mysqladmin","mysqlcheck","mysqlimport","mysqlshow","mariadb","mariadb-dump","mariadb-admin","mariadb-check","mariadb-import","mariadb-show"]),un=new Set(["sh","bash","dash","zsh","ksh"]),cn=new Set(["-u","--user","-h","--host","-P","--port","-D","--database","-S","--socket","-e","--execute","--protocol","--default-character-set","--defaults-file","--defaults-extra-file","--login-path","--init-command","--ssl-ca","--ssl-capath","--ssl-cert","--ssl-key","--ssl-cipher"]),Y=16;function Me(e,t,n=e.value.length){return{value:e.value.slice(t,n),ranges:e.ranges.slice(t,n)}}function U(e,t,n,r){e.value+=t.value.slice(n,r);for(let o=n;o<r;o++)e.ranges.push(t.ranges[o])}function Ne(e){if(e?.literal)return e.value.slice(e.value.lastIndexOf("/")+1).replace(/\.exe$/,"")}function ln(e){let t=0;for(let n=0;n<=Y;n++){for(;/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.value??"");)t++;let r=Ne(e[t]);if(!r)return;if(["!","if","then","elif","else","while","until","do"].includes(r)){t++;continue}let o={env:["-u","--unset","-C","--chdir"],sudo:["-u","--user","-g","--group","-p","--prompt","-D","--chdir","-R","--chroot","-C","--close-from","-T","--command-timeout"],exec:["-a"],nice:["-n","--adjustment"],timeout:["-s","--signal","-k","--kill-after"]},i={env:["-i","--ignore-environment","-0","--null"],sudo:["-n","-E","-H","-S","-b","-k"],command:["-p"],exec:["-c","-l"],nohup:[],nice:[],time:["-p"],timeout:["--foreground","--preserve-status"]};if(!(r in i))return t;for(t++;e[t]?.value.startsWith("-");){let s=e[t++].value;if(s==="--")break;if(!i[r].includes(s)){if((o[r]??[]).includes(s)){if(!e[t++])return;continue}if(!(o[r]??[]).some(a=>a.startsWith("--")?s.startsWith(a+"="):s.startsWith(a)&&s.length>2)&&!(r==="nice"&&/^-\d+$/.test(s)))return}}if(r==="timeout"&&!/^\d+(?:\.\d+)?[smhd]?$/.test(e[t++]?.value??""))return}}function Ce(e,t){let n=1,r="";for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"&&r!=="'"){o++;continue}if(r){i===r&&(r="");continue}if(i==="'"||i==='"')r=i;else if(i==="(")n++;else if(i===")"&&--n===0)return o}return e.length}function dn(e,t,n,r){let o={value:"",ranges:[],start:t,end:t,literal:!0},i="",s=t;for(;s<e.value.length;){let a=e.value[s];if(!i&&/[\s;|&()<>{}]/.test(a))break;if(a===i){i="",s++;continue}if(!i&&(a==="'"||a==='"')){i=a,s++;continue}if(a==="\\"&&i!=="'"){let c=e.value[s+1];if(c===`
+`){s+=2;continue}if(c&&(!i||/[$`"\\]/.test(c))){U(o,e,s+1,s+2),s+=2;continue}}if(i!=="'"&&e.value.startsWith("$(",s)){let c=Ce(e.value,s+2);e.value[s+2]!=="("&&r<Y&&C(Me(e,s+2,c),n,r+1),U(o,e,s,Math.min(c+1,e.value.length)),o.literal=!1,s=Math.min(c+1,e.value.length);continue}if(a==="`"&&i!=="'"){let c=s+1;for(;c<e.value.length&&e.value[c]!=="`";)c+=e.value[c]==="\\"?2:1;r<Y&&C(Me(e,s+1,c),n,r+1),U(o,e,s,Math.min(c+1,e.value.length)),o.literal=!1,s=Math.min(c+1,e.value.length);continue}a==="$"&&i!=="'"&&(o.literal=!1),U(o,e,s,s+1),s++}return o.end=s,o}function fn(e,t,n,r){let o=ln(t);if(o===void 0)return;let i=Ne(t[o]);if(un.has(i)&&r<Y){for(let s=o+1;s<t.length;s++){let a=t[s].value;if(a==="--command"||/^-[a-zA-Z]*c[a-zA-Z]*$/.test(a)){let c=t[s+1];c&&C(c,n,r+1);return}if(!a.startsWith("-")||a==="--")return;(a==="-o"||a==="-O")&&s++}return}if(an.has(i))for(let s=o+1;s<t.length;s++){let a=t[s];if(a.value==="--")return;if(cn.has(a.value)){s++;continue}a.value.startsWith("-p")&&a.value.length>2&&n.push({start:e.ranges[a.start].start,end:e.ranges[a.end-1].end})}}function C(e,t,n=0){let r=[],o,i=[],s=0,a=()=>{fn(e,r,t,n),r=[],o=void 0};for(;s<e.value.length;){let c=e.value[s];if(c===`
+`){a(),s++;for(let l of i.splice(0))for(;s<e.value.length;){let d=e.value.indexOf(`
+`,s),_=d<0?e.value.length:d,O=e.value.slice(s,_);if(s=d<0?_:_+1,(l.stripTabs?O.replace(/^\t+/,""):O)===l.delimiter)break}}else if(/\s/.test(c))s++;else if(c==="#"){let l=e.value.indexOf(`
+`,s);s=l<0?e.value.length:l}else if(e.value.startsWith("((",s))a(),s=Math.min(Ce(e.value,s+1)+1,e.value.length);else if(/[;|&(){}]/.test(c))a(),s++;else if(c==="<"||c===">")r.at(-1)?.end===s&&/^\d+$/.test(r.at(-1).value)&&r.pop(),o=/^(?:<<<|<<-?|>>|<&|>&|[<>])/.exec(e.value.slice(s))?.[0]??c,s+=o.length;else{let l=dn(e,s,t,n);s=l.end,(o==="<<"||o==="<<-")&&i.push({delimiter:l.value,stripTabs:o==="<<-"}),o||r.push(l),o=void 0}}a()}function pn(e,t,n){let r={value:"",ranges:[]};for(let o=t+1;o<n-1;o++){if(e.value[o]!=="\\"){U(r,e,o,o+1);continue}let i=o+(e.value[o+1]==="u"?6:2),s=JSON.parse(`"${e.value.slice(o,i)}"`);r.value+=s;for(let a=0;a<s.length;a++)r.ranges.push({start:e.ranges[o].start,end:e.ranges[i-1].end});o=i-1}return r}function mn(e){let t={value:e,ranges:Array.from({length:e.length},(r,o)=>({start:o,end:o+1}))},n=[];if(/^\s*[{[]/.test(e)){let r;try{r=JSON.parse(e)}catch{return C(t,n),n}if(r!==null&&typeof r=="object"){let o=/"(?:[^"\\]|\\.)*"/g,i;for(;i=o.exec(e);){let s=JSON.parse(i[0]);if(s!=="command"&&s!=="cmd"&&s!=="CommandLine")continue;let a=/^\s*:\s*/.exec(e.slice(o.lastIndex));if(!a)continue;let c=o.lastIndex+a[0].length;if(e[c]!=='"')continue;o.lastIndex=c;let l=o.exec(e);l?.index===c&&C(pn(t,c,c+l[0].length),n)}}return n}return C(t,n),n}});var ie=E(h=>{"use strict";Object.defineProperty(h,"__esModule",{value:!0});h.PATTERNS=h.MAX_BYTES=void 0;h.truncateTo=je;h.truncate=_n;h.collectMatches=Be;h.resolveOverlaps=Ue;h.applyMatches=qe;h.redact=gn;var hn=Ie();h.MAX_BYTES=102400;function je(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function _n(e){return je(e,h.MAX_BYTES)}h.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Be(e,t){let n=[];for(let r of h.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;if(r.type==="cli_password_short"){for(let{start:s,end:a}of(0,hn.mysqlPasswordRanges)(e))n.push({start:s,end:a,replaceStart:s,replaceEnd:a,type:r.type,replacement:`-p[REDACTED:${r.type}]`});continue}let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let s=r.captureGroup??0,a=i[s];if(a===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,l=i.index+i[0].length,d=c+i[0].indexOf(a),_=d+a.length;n.push({start:c,end:l,replaceStart:d,replaceEnd:_,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function Ue(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function qe(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+(o.replacement??`[REDACTED:${o.type}]`)+r.slice(o.replaceEnd);return r}function gn(e,t={}){if(e.length===0)return e;let n=Be(e,t);if(n.length===0)return e;let r=Ue(n);return qe(e,r)}});var ue=E(p=>{"use strict";var yn=p&&p.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(p,"__esModule",{value:!0});p.MAX_SPAN_BYTES=void 0;p.ulidToTraceId=Xe;p.newSpanId=Ve;p.snakeCase=Pn;p.toOtlpValue=Ye;p.attrsFromRecord=Sn;p.guardAttrs=Fe;p.clientAttrs=ze;p.enforceSpanBudget=Ke;p.buildPayload=On;p.attachGuard=He;p.mergeBatch=Tn;var En=yn(require("crypto")),ae=ie(),vn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Xe(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=vn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ve(){return En.default.randomBytes(8).toString("hex")}function Pn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Le=new Set;function F(e,t,n){let r=(0,ae.truncate)(t);if((n.skipRedactKeys??Le).has(e))return r;let o=(n.bashContextKeys??Le).has(e)?"bash":void 0;return(0,ae.redact)(r,{context:o})}function Ye(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:F(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:F(e,JSON.stringify(t),n)}}catch{return{stringValue:F(e,String(t),n)}}default:return{stringValue:F(e,String(t),n)}}}function Sn(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let s=`${t}.${o}`,a=Ye(s,i,n);a!==null&&r.push({key:s,value:a})}return r}function Fe(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function ze(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}p.MAX_SPAN_BYTES=800*1024;function Ge(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var $e=1024;function Ke(e,t=p.MAX_SPAN_BYTES){let n=Ge(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>i&&(i=l,o=c.value)}if(o===null||i<=$e)break;let s=n-t,a=Math.max($e,i-s-64);o.stringValue=(0,ae.truncateTo)(o.stringValue,a),n=Ge(e)}return e}function On(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Xe(e.traceId),spanId:Ve(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ke(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return He(i,e.guard,e.clientTiming)}function He(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Fe(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...ze(o)),e}function Tn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var We=E(S=>{"use strict";Object.defineProperty(S,"__esModule",{value:!0});S.GUARD_STATUS_REFUSED=S.GUARD_BUDGET_HEADER=void 0;S.evaluateGuard=kn;var bn=1e4,An="pinta-core";S.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function z(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var xn=new Set(["ALLOW","DENY","REVIEW"]);S.GUARD_STATUS_REFUSED=410;async function kn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??bn,o=Date.now(),i=new AbortController,s=setTimeout(()=>i.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??An,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[S.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(a.status===S.GUARD_STATUS_REFUSED)return z(Date.now()-o,"refused");if(a.status!==200)return z(Date.now()-o,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!xn.has(c.decision)||!l)return z(Date.now()-o,"error");let d=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??d,clientRttMs:d}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return z(Date.now()-o,l)}finally{clearTimeout(s)}}});var K=E(q=>{"use strict";var Rn=q&&q.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(q,"__esModule",{value:!0});q.atomicWriteFileSync=wn;var Ze=Rn(require("fs"));function wn(e,t){let n=`${e}.${process.pid}.tmp`;Ze.default.writeFileSync(n,t),Ze.default.renameSync(n,e)}});var de=E(T=>{"use strict";var Je=T&&T.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(T,"__esModule",{value:!0});T.MemoryRetryQueue=T.DiskRetryQueue=void 0;var g=Je(require("fs")),H=Je(require("path")),Dn=K(),W=1e3,Mn=50,Nn=5,ce=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=H.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{g.default.mkdirSync(H.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
 `;g.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
 `)}}readAll(){try{let t=g.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){g.default.existsSync(this.filePath)&&g.default.unlinkSync(this.filePath);return}g.default.mkdirSync(X.default.dirname(this.filePath),{recursive:!0}),(0,ln.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){g.default.existsSync(this.filePath)&&g.default.unlinkSync(this.filePath);return}g.default.mkdirSync(H.default.dirname(this.filePath),{recursive:!0}),(0,Dn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{g.default.mkdirSync(X.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<fn;)try{let n=g.default.openSync(this.lockPath,"wx");return g.default.writeSync(n,String(process.pid)),g.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let s=g.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){g.default.unlinkSync(this.lockPath);continue}}catch{}let r=pn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{g.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=F)return;let n=t.length-F;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};S.DiskRetryQueue=re;var oe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>F&&this.entries.splice(0,this.entries.length-F)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};S.MemoryRetryQueue=oe});var ze=h(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Fe;l.envOptionsResolver=Ye;l.postOtlp=C;var $e=se(),Ve=ne(),mn=5e3;l.MAX_POST_BYTES=900*1024;function Y(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Xe(e,t,n){let r=[],o=[],s=[],u=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}s.length>0&&u+c>n&&(r.push(s),s=[],u=0),s.push(a),u+=c}return s.length>0&&r.push(s),{chunks:r,oversize:o}}function Fe(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function Ye(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Fe(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function C(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),mn);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let u="";try{u=(await s.text()).slice(0,200)}catch{}let a=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${a}${u?` body=${u}`:""}
-`),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
-`),!1}finally{clearTimeout(o)}}var ie=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new $e.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ye}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await C(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Xe(n,a=>Y(a.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let s=[].concat(...r),u=0;for(let a of r){if(!await C((0,Ve.mergeBatch)(a.map(d=>d.payload)),t,this.logPrefix))break;u+=a.length}this.queue.rewrite(s.slice(u))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=Y(t);return n<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=ie;var ae=class{queue=new $e.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(Y(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await C(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Xe(n,Y,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let s=[].concat(...r),u=0;for(let a of r){if(!await C((0,Ve.mergeBatch)(a),t,this.logPrefix))break;u+=a.length}for(let a of s.slice(u))this.queue.enqueue(a)}};l.MemoryTransport=ae});var le=h(x=>{"use strict";var de=x&&x.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(x,"__esModule",{value:!0});x.TraceManager=void 0;x.generateUlid=He;var Ke=de(require("fs")),_n=de(require("path")),gn=de(require("crypto")),yn=V(),ue="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function He(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=ue[n&31]+t,n=Math.floor(n/32);let r=gn.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=ue[r[s]&31];for(;o.length<16;)o+=ue[0];return t+o}var ce=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=He();return this.save(t),t}currentTrace(){try{let t=Ke.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{Ke.default.mkdirSync(_n.default.dirname(this.tracePath),{recursive:!0}),(0,yn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};x.TraceManager=ce});var et=h(O=>{"use strict";var Ze=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.MemorySessionTraceManager=O.DiskSessionTraceManager=void 0;var We=Ze(require("fs")),hn=Ze(require("path")),Je=le(),Pn=V(),Qe=200,fe=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??Qe}read(){try{let t=JSON.parse(We.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{We.default.mkdirSync(hn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Pn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,Je.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};O.DiskSessionTraceManager=fe;var pe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Qe}newTrace(t){let n=t||"default",r=(0,Je.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};O.MemorySessionTraceManager=pe});var rt=h(k=>{"use strict";var me=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.envFilePath=Sn;k.parseEnvFile=nt;k.loadEnvFile=On;var En=me(require("node:fs")),vn=me(require("node:os")),tt=me(require("node:path"));function Sn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:tt.default.join(vn.default.homedir(),e);return tt.default.join(o,t)}function nt(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),u=r.slice(o+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),s&&(t[s]=u)}return t}function On(e){let t;try{t=En.default.readFileSync(e,"utf-8")}catch{return}let n=nt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var b=h(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.GUARD_STATUS_REFUSED=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.attachGuard=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var T=ee();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return T.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return T.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return T.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return T.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return T.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return T.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return T.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return T.MAX_BYTES}});var y=ne();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(i,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var ot=Le();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return ot.evaluateGuard}});Object.defineProperty(i,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ot.GUARD_STATUS_REFUSED}});var st=se();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return st.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return st.MemoryRetryQueue}});var M=ze();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return M.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return M.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return M.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return M.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return M.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return M.MAX_POST_BYTES}});var it=le();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return it.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return it.generateUlid}});var at=et();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return at.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return at.MemorySessionTraceManager}});var _e=rt();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return _e.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return _e.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return _e.loadEnvFile}})});var ge=m(require("node:fs")),ut=m(require("node:os")),j=m(require("node:path")),ct=m(b());function Tn(e){let t={},n;try{n=ge.default.readFileSync(e,"utf-8")}catch{return t}for(let r of n.split(`
-`)){let o=r.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<0)continue;let u=o.slice(0,s).trim(),a=o.slice(s+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),u&&(t[u]=a)}return t}function bn(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let n=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return n?n.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function xn(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function dt(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??j.default.join(e,".plugin-data"),n=process.env.CODEX_HOME??j.default.join(ut.default.homedir(),".codex"),r=j.default.join(n,"pinta-codex.env"),o=ge.default.existsSync(r)?Tn(r):{},s=bn(o),u=xn(o);if(u&&!process.env.PINTA_RELAY_TOKEN){let c=u.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let a=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:j.default.join(t,"trace.json"),endpoint:s?.replace(/\/+$/,""),headers:(0,ct.parseHeadersEnv)(u??""),guardEndpoint:a}}function lt(e){return e.hook_event_name==="PreToolUse"}function ft(e){return e.hook_event_name==="PermissionRequest"}function pt(e){return e.hook_event_name==="PostToolUse"}function mt(e){return e.hook_event_name==="UserPromptSubmit"}function _t(e){return e.hook_event_name==="SessionStart"}function gt(e){return e.hook_event_name==="Stop"}var kn=["PreToolUse","PermissionRequest"],An=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],Rn=new Set([...kn,...An]);function yt(e){return!Rn.has(e.hook_event_name)}var Mt=m(b());var ht=m(b()),z=class extends ht.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Pt=m(b()),K=class extends Pt.TraceManager{constructor(t){super(t.tracePath)}};var B=m(require("fs")),Z=m(require("os")),xt=m(require("path"));var H="1.10.0";var P=m(require("node:fs")),ye=m(require("node:path")),wn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),Mn=256*1024,Dn=1024*1024,Nn=4096;function A(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function he(e){let t=A(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!wn.has(r.toLowerCase())?r:void 0}function Et(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Pe(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function I(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function vt(e,t){let n=e.timestamp===void 0?I(t):I(e.timestamp);return n!==void 0&&n<=t?n:void 0}function St(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!ye.default.isAbsolute(e)||ye.default.extname(e)!==".jsonl")return;let t;try{t=P.default.openSync(e,P.default.constants.O_RDONLY|P.default.constants.O_NONBLOCK|(P.default.constants.O_NOFOLLOW??0));let n=P.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,Mn));if(P.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),s;if(o>=0)try{s=A(JSON.parse(r.toString("utf8",0,o)))}catch{}let u=Math.max(0,n.size-Dn),a=n.size<=r.length?r:Buffer.alloc(n.size-u);if(a!==r&&P.default.readSync(t,a,0,a.length,u)!==a.length)return;let c=P.default.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let d=u>0?a.indexOf(10)+1:0,p=a.lastIndexOf(10);if(u>0&&d===0||p<d)return;let v=[],D=0;for(;p>d&&D<Nn;){let $t=a.lastIndexOf(10,p-1),ve=Math.max(d,$t+1),Se=a.toString("utf8",ve,p).trim();if(Se){let Oe=A(JSON.parse(Se));Oe&&v.push(Oe)}p=ve-1,D++}return v.reverse(),{first:s,rows:v,complete:u===0&&p<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{P.default.closeSync(t)}catch{}}}function Ot(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}function Tt(e,t){let n=he(e.model);if(n)return{name:n,source:"hook.model"};try{return Cn(e,t)}catch{return}}function Cn(e,t){if(e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop")return;let n=Pe(e.session_id),r=Pe(e.turn_id),o=vt(e,t);if(!n||!r||o===void 0||e.agent_id!==void 0&&e.agent_id!==n)return;let s=St(e.transcript_path),u=s?.first,a=I(u?.timestamp);if(!s||u?.type!=="session_meta"||A(u.payload)?.id!==n||a===void 0||a>o||s.rows.some(d=>d.type==="session_meta"&&A(d.payload)?.id!==n))return;let c=[];for(let d of s.rows){let p=A(d.payload),v=I(d.timestamp);if(d.type!=="turn_context"||p?.turn_id!==r||v===void 0||v>o||v<a)continue;let D=he(p.model);c.push(D?{name:D,source:"transcript.turn_context"}:void 0)}return Ot(c)}var R=m(b()),W;function jn(){if(W===void 0)try{W=Z.default.userInfo().username}catch{W=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return W}var kt=H,Ee;function U(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var bt=256*1024;function In(e){if(!e)return;let t;try{t=B.default.openSync(e,"r");let n=Buffer.allocUnsafe(bt),r=B.default.readSync(t,n,0,bt,0),o=n.toString("utf8",0,r),s=o.indexOf(`
-`);if(s<0)return;let u=JSON.parse(o.slice(0,s));return u?.type!=="session_meta"?void 0:U(u.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{B.default.closeSync(t)}catch{}}}function Bn(){let e=U(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(B.default.readFileSync(xt.default.join(e,"package.json"),"utf8"));return U(t.version)}catch{return}}function Un(e){return Ee===void 0&&(Ee=In(U(e?.transcript_path))??Bn()??U(process.env.CODEX_CLI_VERSION)??null),Ee??void 0}var Ln=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),qn=new Set(["codex.tool_input","codex.tool_response"]),Gn={skipRedactKeys:Ln,bashContextKeys:qn};function $n(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"codex"}}),n.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,s]of Object.entries(e))o!=="hook_event_name"&&(r[o]=s);return Et(r,Tt(e,t)),n.push(...(0,R.attrsFromRecord)(r,"codex",Gn)),n}function Vn(e){let t=Un(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:kt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:jn()}},{key:"host.name",value:{stringValue:Z.default.hostname()}},{key:"host.arch",value:{stringValue:Z.default.arch()}}]}function At(e){let t=e.now??Date.now();return(0,R.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,R.snakeCase)(e.event.hook_event_name)}`,attributes:$n(e.event,t),resource:Vn(e.event),scope:{name:"pinta-codex",version:kt},now:t})}function L(e,t,n){let r=new K(t),o=n.trace==="new"?r.newTrace():r.currentTrace();return At({event:e,traceId:o})}async function q(e,t){let n=new z(t);await n.flush(),await n.send(e)}async function E(e,t,n){await q(L(e,t,n),t)}var Rt=m(b());var Xn=50,Fn=`pinta-codex/${H}`;async function wt(e,t){let n=await(0,Rt.evaluateGuard)(e,t,{timeoutMs:Xn,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Fn});if(n===null)return null;let r={decision:n.decision,reason:n.reason,durationMs:n.durationMs,clientRttMs:n.clientRttMs};return n.failOpenReason!==void 0&&(r.failOpenReason=n.failOpenReason),r}async function J(e,t){return wt(e,t.guardEndpoint)}function Q(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function Dt(e,t){let n=L(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Q(r)}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,Mt.attachGuard)(n,r),await q(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}var Nt=m(b());async function Ct(e,t){let n=L(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:Q(r)}}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,Nt.attachGuard)(n,r),await q(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}async function jt(e,t){return await E(e,t,{trace:"current"}),0}async function It(e,t){return await E(e,t,{trace:"new"}),0}async function Bt(e,t){return await E(e,t,{trace:"current"}),0}async function Ut(e,t){return await E(e,t,{trace:"current"}),0}async function Lt(e,t){return await E(e,t,{trace:"current"}),0}async function qt(e){return 0}async function Yn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Gt(){let e=0;try{let t=dt(),n=await Yn(),r=JSON.parse(n);yt(r)?e=await qt(r):lt(r)?e=await Dt(r,t):ft(r)?e=await Ct(r,t):pt(r)?e=await jt(r,t):mt(r)?e=await It(r,t):_t(r)?e=await Bt(r,t):gt(r)?e=await Ut(r,t):e=await Lt(r,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
-`),e=0}return e}async function zn(){let e=await Gt();process.exit(e)}zn();
+`)}}tryAcquireLock(){let t=Date.now();try{g.default.mkdirSync(H.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<Mn;)try{let n=g.default.openSync(this.lockPath,"wx");return g.default.writeSync(n,String(process.pid)),g.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let i=g.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){g.default.unlinkSync(this.lockPath);continue}}catch{}let r=Nn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{g.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=W)return;let n=t.length-W;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};T.DiskRetryQueue=ce;var le=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>W&&this.entries.splice(0,this.entries.length-W)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};T.MemoryRetryQueue=le});var ot=E(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.MemoryTransport=f.DiskTransport=f.MAX_POST_BYTES=void 0;f.parseHeadersEnv=nt;f.envOptionsResolver=rt;f.postOtlp=L;var Qe=de(),et=ue(),Cn=5e3;f.MAX_POST_BYTES=900*1024;function Z(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function tt(e,t,n){let r=[],o=[],i=[],s=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}i.length>0&&s+c>n&&(r.push(i),i=[],s=0),i.push(a),s+=c}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function nt(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function rt(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:nt(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function L(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),Cn);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let s="";try{s=(await i.text()).slice(0,200)}catch{}let a=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${a}${s?` body=${s}`:""}
+`),!1}return!0}catch(i){return process.stderr.write(`[${n}] OTLP POST failed: ${i.message??String(i)}
+`),!1}finally{clearTimeout(o)}}var fe=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Qe.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??rt}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await L(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=tt(n,a=>Z(a.payload),f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${f.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...r),s=0;for(let a of r){if(!await L((0,et.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;s+=a.length}this.queue.rewrite(i.slice(s))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=Z(t);return n<=f.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};f.DiskTransport=fe;var pe=class{queue=new Qe.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(Z(t)>f.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await L(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=tt(n,Z,f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${f.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...r),s=0;for(let a of r){if(!await L((0,et.mergeBatch)(a),t,this.logPrefix))break;s+=a.length}for(let a of i.slice(s))this.queue.enqueue(a)}};f.MemoryTransport=pe});var ge=E(k=>{"use strict";var _e=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.TraceManager=void 0;k.generateUlid=it;var st=_e(require("fs")),In=_e(require("path")),jn=_e(require("crypto")),Bn=K(),me="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function it(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=me[n&31]+t,n=Math.floor(n/32);let r=jn.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=me[r[i]&31];for(;o.length<16;)o+=me[0];return t+o}var he=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=it();return this.save(t),t}currentTrace(){try{let t=st.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{st.default.mkdirSync(In.default.dirname(this.tracePath),{recursive:!0}),(0,Bn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};k.TraceManager=he});var dt=E(b=>{"use strict";var ut=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.MemorySessionTraceManager=b.DiskSessionTraceManager=void 0;var at=ut(require("fs")),Un=ut(require("path")),ct=ge(),qn=K(),lt=200,ye=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??lt}read(){try{let t=JSON.parse(at.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{at.default.mkdirSync(Un.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,qn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,ct.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};b.DiskSessionTraceManager=ye;var Ee=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??lt}newTrace(t){let n=t||"default",r=(0,ct.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};b.MemorySessionTraceManager=Ee});var mt=E(R=>{"use strict";var ve=R&&R.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(R,"__esModule",{value:!0});R.envFilePath=$n;R.parseEnvFile=pt;R.loadEnvFile=Xn;var Ln=ve(require("node:fs")),Gn=ve(require("node:os")),ft=ve(require("node:path"));function $n(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:ft.default.join(Gn.default.homedir(),e);return ft.default.join(o,t)}function pt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),s=r.slice(o+1).trim();(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),i&&(t[i]=s)}return t}function Xn(e){let t;try{t=Ln.default.readFileSync(e,"utf-8")}catch{return}let n=pt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var v=E(u=>{"use strict";Object.defineProperty(u,"__esModule",{value:!0});u.loadEnvFile=u.parseEnvFile=u.envFilePath=u.MemorySessionTraceManager=u.DiskSessionTraceManager=u.generateUlid=u.TraceManager=u.MAX_POST_BYTES=u.parseHeadersEnv=u.envOptionsResolver=u.postOtlp=u.MemoryTransport=u.DiskTransport=u.MemoryRetryQueue=u.DiskRetryQueue=u.GUARD_BUDGET_HEADER=u.GUARD_STATUS_REFUSED=u.evaluateGuard=u.MAX_SPAN_BYTES=u.enforceSpanBudget=u.mergeBatch=u.attachGuard=u.buildPayload=u.clientAttrs=u.guardAttrs=u.attrsFromRecord=u.toOtlpValue=u.snakeCase=u.newSpanId=u.ulidToTraceId=u.MAX_BYTES=u.PATTERNS=u.applyMatches=u.resolveOverlaps=u.collectMatches=u.truncateTo=u.truncate=u.redact=void 0;var A=ie();Object.defineProperty(u,"redact",{enumerable:!0,get:function(){return A.redact}});Object.defineProperty(u,"truncate",{enumerable:!0,get:function(){return A.truncate}});Object.defineProperty(u,"truncateTo",{enumerable:!0,get:function(){return A.truncateTo}});Object.defineProperty(u,"collectMatches",{enumerable:!0,get:function(){return A.collectMatches}});Object.defineProperty(u,"resolveOverlaps",{enumerable:!0,get:function(){return A.resolveOverlaps}});Object.defineProperty(u,"applyMatches",{enumerable:!0,get:function(){return A.applyMatches}});Object.defineProperty(u,"PATTERNS",{enumerable:!0,get:function(){return A.PATTERNS}});Object.defineProperty(u,"MAX_BYTES",{enumerable:!0,get:function(){return A.MAX_BYTES}});var y=ue();Object.defineProperty(u,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(u,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(u,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(u,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(u,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(u,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(u,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(u,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(u,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(u,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(u,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(u,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var Pe=We();Object.defineProperty(u,"evaluateGuard",{enumerable:!0,get:function(){return Pe.evaluateGuard}});Object.defineProperty(u,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Pe.GUARD_STATUS_REFUSED}});Object.defineProperty(u,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Pe.GUARD_BUDGET_HEADER}});var ht=de();Object.defineProperty(u,"DiskRetryQueue",{enumerable:!0,get:function(){return ht.DiskRetryQueue}});Object.defineProperty(u,"MemoryRetryQueue",{enumerable:!0,get:function(){return ht.MemoryRetryQueue}});var I=ot();Object.defineProperty(u,"DiskTransport",{enumerable:!0,get:function(){return I.DiskTransport}});Object.defineProperty(u,"MemoryTransport",{enumerable:!0,get:function(){return I.MemoryTransport}});Object.defineProperty(u,"postOtlp",{enumerable:!0,get:function(){return I.postOtlp}});Object.defineProperty(u,"envOptionsResolver",{enumerable:!0,get:function(){return I.envOptionsResolver}});Object.defineProperty(u,"parseHeadersEnv",{enumerable:!0,get:function(){return I.parseHeadersEnv}});Object.defineProperty(u,"MAX_POST_BYTES",{enumerable:!0,get:function(){return I.MAX_POST_BYTES}});var _t=ge();Object.defineProperty(u,"TraceManager",{enumerable:!0,get:function(){return _t.TraceManager}});Object.defineProperty(u,"generateUlid",{enumerable:!0,get:function(){return _t.generateUlid}});var gt=dt();Object.defineProperty(u,"DiskSessionTraceManager",{enumerable:!0,get:function(){return gt.DiskSessionTraceManager}});Object.defineProperty(u,"MemorySessionTraceManager",{enumerable:!0,get:function(){return gt.MemorySessionTraceManager}});var Se=mt();Object.defineProperty(u,"envFilePath",{enumerable:!0,get:function(){return Se.envFilePath}});Object.defineProperty(u,"parseEnvFile",{enumerable:!0,get:function(){return Se.parseEnvFile}});Object.defineProperty(u,"loadEnvFile",{enumerable:!0,get:function(){return Se.loadEnvFile}})});var Oe=m(require("node:fs")),yt=m(require("node:os")),G=m(require("node:path")),Et=m(v());function Vn(e){let t={},n;try{n=Oe.default.readFileSync(e,"utf-8")}catch{return t}for(let r of n.split(`
+`)){let o=r.trim();if(!o||o.startsWith("#"))continue;let i=o.indexOf("=");if(i<0)continue;let s=o.slice(0,i).trim(),a=o.slice(i+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),s&&(t[s]=a)}return t}function Yn(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let n=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return n?n.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function Fn(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function vt(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??G.default.join(e,".plugin-data"),n=process.env.CODEX_HOME??G.default.join(yt.default.homedir(),".codex"),r=G.default.join(n,"pinta-codex.env"),o=Oe.default.existsSync(r)?Vn(r):{},i=Yn(o),s=Fn(o);if(s&&!process.env.PINTA_RELAY_TOKEN){let c=s.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let a=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:G.default.join(t,"trace.json"),endpoint:i?.replace(/\/+$/,""),headers:(0,Et.parseHeadersEnv)(s??""),guardEndpoint:a}}function Pt(e){return e.hook_event_name==="PreToolUse"}function St(e){return e.hook_event_name==="PermissionRequest"}function Ot(e){return e.hook_event_name==="PostToolUse"}function Tt(e){return e.hook_event_name==="UserPromptSubmit"}function bt(e){return e.hook_event_name==="SessionStart"}function At(e){return e.hook_event_name==="Stop"}var zn=["PreToolUse","PermissionRequest"],Kn=["PostToolUse"],Hn=["PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],Wn=new Set([...zn,...Kn,...Hn]);function xt(e){return!Wn.has(e.hook_event_name)}var Gt=m(v());var re=m(v());var kt=m(v()),J=class extends kt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Rt=m(v()),Q=class extends Rt.TraceManager{constructor(t){super(t.tracePath)}};var X=m(require("fs")),ne=m(require("os")),jt=m(require("path"));var ee="1.11.1";var P=m(require("node:fs")),Te=m(require("node:path")),Zn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),Jn=256*1024,Qn=1024*1024,er=4096;function w(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function be(e){let t=w(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Zn.has(r.toLowerCase())?r:void 0}function wt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Ae(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function $(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Dt(e,t){let n=e.timestamp===void 0?$(t):$(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Mt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Te.default.isAbsolute(e)||Te.default.extname(e)!==".jsonl")return;let t;try{t=P.default.openSync(e,P.default.constants.O_RDONLY|P.default.constants.O_NONBLOCK|(P.default.constants.O_NOFOLLOW??0));let n=P.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,Jn));if(P.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=w(JSON.parse(r.toString("utf8",0,o)))}catch{}let s=Math.max(0,n.size-Qn),a=n.size<=r.length?r:Buffer.alloc(n.size-s);if(a!==r&&P.default.readSync(t,a,0,a.length,s)!==a.length)return;let c=P.default.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=s>0?a.indexOf(10)+1:0,d=a.lastIndexOf(10);if(s>0&&l===0||d<l)return;let _=[],O=0;for(;d>l&&O<er;){let Qt=a.lastIndexOf(10,d-1),ke=Math.max(l,Qt+1),Re=a.toString("utf8",ke,d).trim();if(Re){let we=w(JSON.parse(Re));we&&_.push(we)}d=ke-1,O++}return _.reverse(),{first:i,rows:_,complete:s===0&&d<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{P.default.closeSync(t)}catch{}}}function Nt(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}function Ct(e,t){let n=be(e.model);if(n)return{name:n,source:"hook.model"};try{return tr(e,t)}catch{return}}function tr(e,t){if(e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop")return;let n=Ae(e.session_id),r=Ae(e.turn_id),o=Dt(e,t);if(!n||!r||o===void 0||e.agent_id!==void 0&&e.agent_id!==n)return;let i=Mt(e.transcript_path),s=i?.first,a=$(s?.timestamp);if(!i||s?.type!=="session_meta"||w(s.payload)?.id!==n||a===void 0||a>o||i.rows.some(l=>l.type==="session_meta"&&w(l.payload)?.id!==n))return;let c=[];for(let l of i.rows){let d=w(l.payload),_=$(l.timestamp);if(l.type!=="turn_context"||d?.turn_id!==r||_===void 0||_>o||_<a)continue;let O=be(d.model);c.push(O?{name:O,source:"transcript.turn_context"}:void 0)}return Nt(c)}var D=m(v()),te;function nr(){if(te===void 0)try{te=ne.default.userInfo().username}catch{te=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return te}var Bt=ee,xe;function V(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var It=256*1024;function rr(e){if(!e)return;let t;try{t=X.default.openSync(e,"r");let n=Buffer.allocUnsafe(It),r=X.default.readSync(t,n,0,It,0),o=n.toString("utf8",0,r),i=o.indexOf(`
+`);if(i<0)return;let s=JSON.parse(o.slice(0,i));return s?.type!=="session_meta"?void 0:V(s.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{X.default.closeSync(t)}catch{}}}function or(){let e=V(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(X.default.readFileSync(jt.default.join(e,"package.json"),"utf8"));return V(t.version)}catch{return}}function sr(e){return xe===void 0&&(xe=rr(V(e?.transcript_path))??or()??V(process.env.CODEX_CLI_VERSION)??null),xe??void 0}var ir=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),ar=new Set(["codex.tool_input","codex.tool_response"]),ur={skipRedactKeys:ir,bashContextKeys:ar};function cr(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"codex"}}),n.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,i]of Object.entries(e))o!=="hook_event_name"&&(r[o]=i);return wt(r,Ct(e,t)),n.push(...(0,D.attrsFromRecord)(r,"codex",ur)),n}function lr(e){let t=sr(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Bt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:nr()}},{key:"host.name",value:{stringValue:ne.default.hostname()}},{key:"host.arch",value:{stringValue:ne.default.arch()}}]}function Ut(e){let t=e.now??Date.now();return(0,D.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,D.snakeCase)(e.event.hook_event_name)}`,attributes:cr(e.event,t),resource:lr(e.event),scope:{name:"pinta-codex",version:Bt},now:t})}function M(e,t,n){let r=new Q(t),o=n.trace==="new"?r.newTrace():r.currentTrace();return Ut({event:e,traceId:o})}async function N(e,t){let n=new J(t);await n.flush(),await n.send(e)}function j(e,t){if(t.endpoint){if(Buffer.byteLength(JSON.stringify(e),"utf8")>re.MAX_POST_BYTES){process.stderr.write(`[pinta-codex] deferred telemetry exceeds MAX_POST_BYTES; dropped
+`);return}new re.DiskRetryQueue(t.pluginData,"pinta-codex").enqueue(e)}}async function x(e,t,n){await N(M(e,t,n),t)}var qt=m(v());var dr=100,fr=`pinta-codex/${ee}`;async function Lt(e,t){let n=await(0,qt.evaluateGuard)(e,t,{timeoutMs:dr,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:fr});if(n===null)return null;let r={decision:n.decision,reason:n.reason,durationMs:n.durationMs,clientRttMs:n.clientRttMs};return n.failOpenReason!==void 0&&(r.failOpenReason=n.failOpenReason),r}async function B(e,t){return Lt(e,t.guardEndpoint)}function oe(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function $t(e,t){let n=M(e,t,{trace:"current"}),r=await B(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:oe(r)}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Gt.attachGuard)(n,r),r?.decision==="DENY"?j(n,t):await N(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}var Xt=m(v());async function Vt(e,t){let n=M(e,t,{trace:"current"}),r=await B(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:oe(r)}}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Xt.attachGuard)(n,r),r?.decision==="DENY"?j(n,t):await N(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}var Yt=m(v());var pr="Pinta withheld this tool output because it violated an active policy.";async function Ft(e,t){let n=M(e,t,{trace:"current"}),r=await B(n,t);if(r?.decision==="DENY"){let o={decision:"block",reason:pr};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Yt.attachGuard)(n,r),r&&n.resourceSpans[0].scopeSpans[0].spans[0].attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}}),r?.decision==="DENY"?j(n,t):await N(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}async function zt(e,t){return await x(e,t,{trace:"new"}),0}async function Kt(e,t){return await x(e,t,{trace:"current"}),0}async function Ht(e,t){return await x(e,t,{trace:"current"}),0}async function Wt(e,t){return await x(e,t,{trace:"current"}),0}async function Zt(e){return 0}async function mr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Jt(){let e=0;try{let t=vt(),n=await mr(),r=JSON.parse(n);xt(r)?e=await Zt(r):Pt(r)?e=await $t(r,t):St(r)?e=await Vt(r,t):Ot(r)?e=await Ft(r,t):Tt(r)?e=await zt(r,t):bt(r)?e=await Kt(r,t):At(r)?e=await Ht(r,t):e=await Wt(r,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
+`),e=0}return e}async function hr(){let e=await Jt();process.exit(e)}hr();

package/dist/index.mjs

@@ -1,27 +1,34 @@
 import{createRequire as __pintaCreateRequire}from 'node:module';const require=__pintaCreateRequire(import.meta.url);
-var Yt=Object.create;var Oe=Object.defineProperty;var zt=Object.getOwnPropertyDescriptor;var Kt=Object.getOwnPropertyNames;var Wt=Object.getPrototypeOf,Ht=Object.prototype.hasOwnProperty;var g=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Zt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Kt(t))!Ht.call(e,o)&&o!==n&&Oe(e,o,{get:()=>t[o],enumerable:!(r=zt(t,o))||r.enumerable});return e};var T=(e,t,n)=>(n=e!=null?Yt(Wt(e)):{},Zt(t||!e||!e.__esModule?Oe(n,"default",{value:e,enumerable:!0}):n,e));var ee=h(m=>{"use strict";Object.defineProperty(m,"__esModule",{value:!0});m.PATTERNS=m.MAX_BYTES=void 0;m.truncateTo=be;m.truncate=Jt;m.collectMatches=xe;m.resolveOverlaps=Ae;m.applyMatches=ke;m.redact=Qt;m.MAX_BYTES=102400;function be(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Jt(e){return be(e,m.MAX_BYTES)}m.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function xe(e,t){let n=[];for(let r of m.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=o.exec(e))!==null;){let u=r.captureGroup??0,a=s[u];if(a===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let c=s.index,l=s.index+s[0].length,p=c+s[0].indexOf(a),E=p+a.length;n.push({start:c,end:l,replaceStart:p,replaceEnd:E,type:r.type}),s.index===o.lastIndex&&o.lastIndex++}}return n}function Ae(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function ke(e,t){let n=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function Qt(e,t={}){if(e.length===0)return e;let n=xe(e,t);if(n.length===0)return e;let r=Ae(n);return ke(e,r)}});var ne=h(f=>{"use strict";var en=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=De;f.newSpanId=Ne;f.snakeCase=rn;f.toOtlpValue=Ce;f.attrsFromRecord=on;f.guardAttrs=je;f.clientAttrs=Ie;f.enforceSpanBudget=Be;f.buildPayload=sn;f.attachGuard=Ue;f.mergeBatch=an;var tn=en(g("crypto")),te=ee(),nn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function De(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=nn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ne(){return tn.default.randomBytes(8).toString("hex")}function rn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Re=new Set;function q(e,t,n){let r=(0,te.truncate)(t);if((n.skipRedactKeys??Re).has(e))return r;let o=(n.bashContextKeys??Re).has(e)?"bash":void 0;return(0,te.redact)(r,{context:o})}function Ce(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:q(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:q(e,JSON.stringify(t),n)}}catch{return{stringValue:q(e,String(t),n)}}default:return{stringValue:q(e,String(t),n)}}}function on(e,t,n={}){let r=[];for(let[o,s]of Object.entries(e)){let u=`${t}.${o}`,a=Ce(u,s,n);a!==null&&r.push({key:u,value:a})}return r}function je(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ie(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function we(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Me=1024;function Be(e,t=f.MAX_SPAN_BYTES){let n=we(e);for(let r=0;r<100&&n>t;r++){let o=null,s=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>s&&(s=l,o=c.value)}if(o===null||s<=Me)break;let u=n-t,a=Math.max(Me,s-u-64);o.stringValue=(0,te.truncateTo)(o.stringValue,a),n=we(e)}return e}function sn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:De(e.traceId),spanId:Ne(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Be(o);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Ue(s,e.guard,e.clientTiming)}function Ue(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...je(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Ie(o)),e}function an(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Le=h(M=>{"use strict";Object.defineProperty(M,"__esModule",{value:!0});M.GUARD_STATUS_REFUSED=void 0;M.evaluateGuard=dn;var un=1e4,cn="pinta-core";function F(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var ln=new Set(["ALLOW","DENY","REVIEW"]);M.GUARD_STATUS_REFUSED=410;async function dn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??un,o=Date.now(),s=new AbortController,u=setTimeout(()=>s.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??cn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{}},body:JSON.stringify(e),signal:s.signal});if(a.status===M.GUARD_STATUS_REFUSED)return F(Date.now()-o,"refused");if(a.status!==200)return F(Date.now()-o,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!ln.has(c.decision)||!l)return F(Date.now()-o,"error");let p=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??p,clientRttMs:p}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return F(Date.now()-o,l)}finally{clearTimeout(u)}}});var G=h(C=>{"use strict";var fn=C&&C.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(C,"__esModule",{value:!0});C.atomicWriteFileSync=pn;var qe=fn(g("fs"));function pn(e,t){let n=`${e}.${process.pid}.tmp`;qe.default.writeFileSync(n,t),qe.default.renameSync(n,e)}});var se=h(O=>{"use strict";var Fe=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.MemoryRetryQueue=O.DiskRetryQueue=void 0;var _=Fe(g("fs")),$=Fe(g("path")),mn=G(),X=1e3,_n=50,gn=5,re=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=$.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{_.default.mkdirSync($.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;_.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
-`)}}readAll(){try{let t=_.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){_.default.existsSync(this.filePath)&&_.default.unlinkSync(this.filePath);return}_.default.mkdirSync($.default.dirname(this.filePath),{recursive:!0}),(0,mn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+var rn=Object.create;var De=Object.defineProperty;var on=Object.getOwnPropertyDescriptor;var sn=Object.getOwnPropertyNames;var an=Object.getPrototypeOf,un=Object.prototype.hasOwnProperty;var _=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var E=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var cn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of sn(t))!un.call(e,o)&&o!==n&&De(e,o,{get:()=>t[o],enumerable:!(r=on(t,o))||r.enumerable});return e};var v=(e,t,n)=>(n=e!=null?rn(an(e)):{},cn(t||!e||!e.__esModule?De(n,"default",{value:e,enumerable:!0}):n,e));var Ie=E(se=>{"use strict";Object.defineProperty(se,"__esModule",{value:!0});se.mysqlPasswordRanges=_n;var ln=new Set(["mysql","mysqldump","mysqladmin","mysqlcheck","mysqlimport","mysqlshow","mariadb","mariadb-dump","mariadb-admin","mariadb-check","mariadb-import","mariadb-show"]),dn=new Set(["sh","bash","dash","zsh","ksh"]),fn=new Set(["-u","--user","-h","--host","-P","--port","-D","--database","-S","--socket","-e","--execute","--protocol","--default-character-set","--defaults-file","--defaults-extra-file","--login-path","--init-command","--ssl-ca","--ssl-capath","--ssl-cert","--ssl-key","--ssl-cipher"]),X=16;function Me(e,t,n=e.value.length){return{value:e.value.slice(t,n),ranges:e.ranges.slice(t,n)}}function L(e,t,n,r){e.value+=t.value.slice(n,r);for(let o=n;o<r;o++)e.ranges.push(t.ranges[o])}function Ne(e){if(e?.literal)return e.value.slice(e.value.lastIndexOf("/")+1).replace(/\.exe$/,"")}function pn(e){let t=0;for(let n=0;n<=X;n++){for(;/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.value??"");)t++;let r=Ne(e[t]);if(!r)return;if(["!","if","then","elif","else","while","until","do"].includes(r)){t++;continue}let o={env:["-u","--unset","-C","--chdir"],sudo:["-u","--user","-g","--group","-p","--prompt","-D","--chdir","-R","--chroot","-C","--close-from","-T","--command-timeout"],exec:["-a"],nice:["-n","--adjustment"],timeout:["-s","--signal","-k","--kill-after"]},i={env:["-i","--ignore-environment","-0","--null"],sudo:["-n","-E","-H","-S","-b","-k"],command:["-p"],exec:["-c","-l"],nohup:[],nice:[],time:["-p"],timeout:["--foreground","--preserve-status"]};if(!(r in i))return t;for(t++;e[t]?.value.startsWith("-");){let s=e[t++].value;if(s==="--")break;if(!i[r].includes(s)){if((o[r]??[]).includes(s)){if(!e[t++])return;continue}if(!(o[r]??[]).some(a=>a.startsWith("--")?s.startsWith(a+"="):s.startsWith(a)&&s.length>2)&&!(r==="nice"&&/^-\d+$/.test(s)))return}}if(r==="timeout"&&!/^\d+(?:\.\d+)?[smhd]?$/.test(e[t++]?.value??""))return}}function Ce(e,t){let n=1,r="";for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"&&r!=="'"){o++;continue}if(r){i===r&&(r="");continue}if(i==="'"||i==='"')r=i;else if(i==="(")n++;else if(i===")"&&--n===0)return o}return e.length}function mn(e,t,n,r){let o={value:"",ranges:[],start:t,end:t,literal:!0},i="",s=t;for(;s<e.value.length;){let a=e.value[s];if(!i&&/[\s;|&()<>{}]/.test(a))break;if(a===i){i="",s++;continue}if(!i&&(a==="'"||a==='"')){i=a,s++;continue}if(a==="\\"&&i!=="'"){let c=e.value[s+1];if(c===`
+`){s+=2;continue}if(c&&(!i||/[$`"\\]/.test(c))){L(o,e,s+1,s+2),s+=2;continue}}if(i!=="'"&&e.value.startsWith("$(",s)){let c=Ce(e.value,s+2);e.value[s+2]!=="("&&r<X&&I(Me(e,s+2,c),n,r+1),L(o,e,s,Math.min(c+1,e.value.length)),o.literal=!1,s=Math.min(c+1,e.value.length);continue}if(a==="`"&&i!=="'"){let c=s+1;for(;c<e.value.length&&e.value[c]!=="`";)c+=e.value[c]==="\\"?2:1;r<X&&I(Me(e,s+1,c),n,r+1),L(o,e,s,Math.min(c+1,e.value.length)),o.literal=!1,s=Math.min(c+1,e.value.length);continue}a==="$"&&i!=="'"&&(o.literal=!1),L(o,e,s,s+1),s++}return o.end=s,o}function hn(e,t,n,r){let o=pn(t);if(o===void 0)return;let i=Ne(t[o]);if(dn.has(i)&&r<X){for(let s=o+1;s<t.length;s++){let a=t[s].value;if(a==="--command"||/^-[a-zA-Z]*c[a-zA-Z]*$/.test(a)){let c=t[s+1];c&&I(c,n,r+1);return}if(!a.startsWith("-")||a==="--")return;(a==="-o"||a==="-O")&&s++}return}if(ln.has(i))for(let s=o+1;s<t.length;s++){let a=t[s];if(a.value==="--")return;if(fn.has(a.value)){s++;continue}a.value.startsWith("-p")&&a.value.length>2&&n.push({start:e.ranges[a.start].start,end:e.ranges[a.end-1].end})}}function I(e,t,n=0){let r=[],o,i=[],s=0,a=()=>{hn(e,r,t,n),r=[],o=void 0};for(;s<e.value.length;){let c=e.value[s];if(c===`
+`){a(),s++;for(let l of i.splice(0))for(;s<e.value.length;){let d=e.value.indexOf(`
+`,s),h=d<0?e.value.length:d,O=e.value.slice(s,h);if(s=d<0?h:h+1,(l.stripTabs?O.replace(/^\t+/,""):O)===l.delimiter)break}}else if(/\s/.test(c))s++;else if(c==="#"){let l=e.value.indexOf(`
+`,s);s=l<0?e.value.length:l}else if(e.value.startsWith("((",s))a(),s=Math.min(Ce(e.value,s+1)+1,e.value.length);else if(/[;|&(){}]/.test(c))a(),s++;else if(c==="<"||c===">")r.at(-1)?.end===s&&/^\d+$/.test(r.at(-1).value)&&r.pop(),o=/^(?:<<<|<<-?|>>|<&|>&|[<>])/.exec(e.value.slice(s))?.[0]??c,s+=o.length;else{let l=mn(e,s,t,n);s=l.end,(o==="<<"||o==="<<-")&&i.push({delimiter:l.value,stripTabs:o==="<<-"}),o||r.push(l),o=void 0}}a()}function gn(e,t,n){let r={value:"",ranges:[]};for(let o=t+1;o<n-1;o++){if(e.value[o]!=="\\"){L(r,e,o,o+1);continue}let i=o+(e.value[o+1]==="u"?6:2),s=JSON.parse(`"${e.value.slice(o,i)}"`);r.value+=s;for(let a=0;a<s.length;a++)r.ranges.push({start:e.ranges[o].start,end:e.ranges[i-1].end});o=i-1}return r}function _n(e){let t={value:e,ranges:Array.from({length:e.length},(r,o)=>({start:o,end:o+1}))},n=[];if(/^\s*[{[]/.test(e)){let r;try{r=JSON.parse(e)}catch{return I(t,n),n}if(r!==null&&typeof r=="object"){let o=/"(?:[^"\\]|\\.)*"/g,i;for(;i=o.exec(e);){let s=JSON.parse(i[0]);if(s!=="command"&&s!=="cmd"&&s!=="CommandLine")continue;let a=/^\s*:\s*/.exec(e.slice(o.lastIndex));if(!a)continue;let c=o.lastIndex+a[0].length;if(e[c]!=='"')continue;o.lastIndex=c;let l=o.exec(e);l?.index===c&&I(gn(t,c,c+l[0].length),n)}}return n}return I(t,n),n}});var ie=E(m=>{"use strict";Object.defineProperty(m,"__esModule",{value:!0});m.PATTERNS=m.MAX_BYTES=void 0;m.truncateTo=je;m.truncate=En;m.collectMatches=Be;m.resolveOverlaps=Ue;m.applyMatches=Le;m.redact=Pn;var yn=Ie();m.MAX_BYTES=102400;function je(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function En(e){return je(e,m.MAX_BYTES)}m.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Be(e,t){let n=[];for(let r of m.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;if(r.type==="cli_password_short"){for(let{start:s,end:a}of(0,yn.mysqlPasswordRanges)(e))n.push({start:s,end:a,replaceStart:s,replaceEnd:a,type:r.type,replacement:`-p[REDACTED:${r.type}]`});continue}let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let s=r.captureGroup??0,a=i[s];if(a===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,l=i.index+i[0].length,d=c+i[0].indexOf(a),h=d+a.length;n.push({start:c,end:l,replaceStart:d,replaceEnd:h,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function Ue(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Le(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+(o.replacement??`[REDACTED:${o.type}]`)+r.slice(o.replaceEnd);return r}function Pn(e,t={}){if(e.length===0)return e;let n=Be(e,t);if(n.length===0)return e;let r=Ue(n);return Le(e,r)}});var ue=E(p=>{"use strict";var vn=p&&p.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(p,"__esModule",{value:!0});p.MAX_SPAN_BYTES=void 0;p.ulidToTraceId=Fe;p.newSpanId=Xe;p.snakeCase=On;p.toOtlpValue=Ve;p.attrsFromRecord=bn;p.guardAttrs=Ye;p.clientAttrs=ze;p.enforceSpanBudget=We;p.buildPayload=An;p.attachGuard=He;p.mergeBatch=xn;var Sn=vn(_("crypto")),ae=ie(),Tn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Fe(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=Tn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Xe(){return Sn.default.randomBytes(8).toString("hex")}function On(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var qe=new Set;function V(e,t,n){let r=(0,ae.truncate)(t);if((n.skipRedactKeys??qe).has(e))return r;let o=(n.bashContextKeys??qe).has(e)?"bash":void 0;return(0,ae.redact)(r,{context:o})}function Ve(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:V(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:V(e,JSON.stringify(t),n)}}catch{return{stringValue:V(e,String(t),n)}}default:return{stringValue:V(e,String(t),n)}}}function bn(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let s=`${t}.${o}`,a=Ve(s,i,n);a!==null&&r.push({key:s,value:a})}return r}function Ye(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function ze(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}p.MAX_SPAN_BYTES=800*1024;function Ge(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var $e=1024;function We(e,t=p.MAX_SPAN_BYTES){let n=Ge(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>i&&(i=l,o=c.value)}if(o===null||i<=$e)break;let s=n-t,a=Math.max($e,i-s-64);o.stringValue=(0,ae.truncateTo)(o.stringValue,a),n=Ge(e)}return e}function An(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Fe(e.traceId),spanId:Xe(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};We(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return He(i,e.guard,e.clientTiming)}function He(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Ye(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...ze(o)),e}function xn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Ke=E(S=>{"use strict";Object.defineProperty(S,"__esModule",{value:!0});S.GUARD_STATUS_REFUSED=S.GUARD_BUDGET_HEADER=void 0;S.evaluateGuard=Dn;var kn=1e4,Rn="pinta-core";S.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function Y(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var wn=new Set(["ALLOW","DENY","REVIEW"]);S.GUARD_STATUS_REFUSED=410;async function Dn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??kn,o=Date.now(),i=new AbortController,s=setTimeout(()=>i.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??Rn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[S.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(a.status===S.GUARD_STATUS_REFUSED)return Y(Date.now()-o,"refused");if(a.status!==200)return Y(Date.now()-o,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!wn.has(c.decision)||!l)return Y(Date.now()-o,"error");let d=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??d,clientRttMs:d}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return Y(Date.now()-o,l)}finally{clearTimeout(s)}}});var z=E(q=>{"use strict";var Mn=q&&q.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(q,"__esModule",{value:!0});q.atomicWriteFileSync=Nn;var Ze=Mn(_("fs"));function Nn(e,t){let n=`${e}.${process.pid}.tmp`;Ze.default.writeFileSync(n,t),Ze.default.renameSync(n,e)}});var de=E(b=>{"use strict";var Je=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.MemoryRetryQueue=b.DiskRetryQueue=void 0;var g=Je(_("fs")),W=Je(_("path")),Cn=z(),H=1e3,In=50,jn=5,ce=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=W.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{g.default.mkdirSync(W.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;g.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=g.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){g.default.existsSync(this.filePath)&&g.default.unlinkSync(this.filePath);return}g.default.mkdirSync(W.default.dirname(this.filePath),{recursive:!0}),(0,Cn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{_.default.mkdirSync($.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<_n;)try{let n=_.default.openSync(this.lockPath,"wx");return _.default.writeSync(n,String(process.pid)),_.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let s=_.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){_.default.unlinkSync(this.lockPath);continue}}catch{}let r=gn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{_.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=X)return;let n=t.length-X;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};O.DiskRetryQueue=re;var oe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>X&&this.entries.splice(0,this.entries.length-X)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};O.MemoryRetryQueue=oe});var ze=h(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.MemoryTransport=d.DiskTransport=d.MAX_POST_BYTES=void 0;d.parseHeadersEnv=Ve;d.envOptionsResolver=Ye;d.postOtlp=j;var Ge=se(),$e=ne(),yn=5e3;d.MAX_POST_BYTES=900*1024;function V(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Xe(e,t,n){let r=[],o=[],s=[],u=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}s.length>0&&u+c>n&&(r.push(s),s=[],u=0),s.push(a),u+=c}return s.length>0&&r.push(s),{chunks:r,oversize:o}}function Ve(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function Ye(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Ve(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function j(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),yn);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let u="";try{u=(await s.text()).slice(0,200)}catch{}let a=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${a}${u?` body=${u}`:""}
-`),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
-`),!1}finally{clearTimeout(o)}}var ie=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ge.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ye}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await j(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Xe(n,a=>V(a.payload),d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${d.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let s=[].concat(...r),u=0;for(let a of r){if(!await j((0,$e.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;u+=a.length}this.queue.rewrite(s.slice(u))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=V(t);return n<=d.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};d.DiskTransport=ie;var ae=class{queue=new Ge.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(V(t)>d.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await j(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Xe(n,V,d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${d.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let s=[].concat(...r),u=0;for(let a of r){if(!await j((0,$e.mergeBatch)(a),t,this.logPrefix))break;u+=a.length}for(let a of s.slice(u))this.queue.enqueue(a)}};d.MemoryTransport=ae});var de=h(A=>{"use strict";var le=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.TraceManager=void 0;A.generateUlid=We;var Ke=le(g("fs")),hn=le(g("path")),Pn=le(g("crypto")),En=G(),ue="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function We(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=ue[n&31]+t,n=Math.floor(n/32);let r=Pn.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=ue[r[s]&31];for(;o.length<16;)o+=ue[0];return t+o}var ce=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=We();return this.save(t),t}currentTrace(){try{let t=Ke.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{Ke.default.mkdirSync(hn.default.dirname(this.tracePath),{recursive:!0}),(0,En.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};A.TraceManager=ce});var et=h(b=>{"use strict";var Ze=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.MemorySessionTraceManager=b.DiskSessionTraceManager=void 0;var He=Ze(g("fs")),vn=Ze(g("path")),Je=de(),Sn=G(),Qe=200,fe=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??Qe}read(){try{let t=JSON.parse(He.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{He.default.mkdirSync(vn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Sn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,Je.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};b.DiskSessionTraceManager=fe;var pe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Qe}newTrace(t){let n=t||"default",r=(0,Je.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};b.MemorySessionTraceManager=pe});var rt=h(k=>{"use strict";var me=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.envFilePath=bn;k.parseEnvFile=nt;k.loadEnvFile=xn;var Tn=me(g("node:fs")),On=me(g("node:os")),tt=me(g("node:path"));function bn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:tt.default.join(On.default.homedir(),e);return tt.default.join(o,t)}function nt(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),u=r.slice(o+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),s&&(t[s]=u)}return t}function xn(e){let t;try{t=Tn.default.readFileSync(e,"utf-8")}catch{return}let n=nt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var v=h(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.GUARD_STATUS_REFUSED=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.attachGuard=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var x=ee();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return x.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return x.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return x.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return x.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return x.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return x.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return x.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return x.MAX_BYTES}});var y=ne();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(i,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var ot=Le();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return ot.evaluateGuard}});Object.defineProperty(i,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ot.GUARD_STATUS_REFUSED}});var st=se();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return st.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return st.MemoryRetryQueue}});var D=ze();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return D.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return D.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return D.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return D.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return D.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return D.MAX_POST_BYTES}});var it=de();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return it.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return it.generateUlid}});var at=et();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return at.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return at.MemorySessionTraceManager}});var _e=rt();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return _e.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return _e.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return _e.loadEnvFile}})});import{realpathSync as cr}from"node:fs";import{pathToFileURL as lr}from"node:url";var ct=T(v());import ut from"node:fs";import An from"node:os";import Y from"node:path";function kn(e){let t={},n;try{n=ut.readFileSync(e,"utf-8")}catch{return t}for(let r of n.split(`
-`)){let o=r.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<0)continue;let u=o.slice(0,s).trim(),a=o.slice(s+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),u&&(t[u]=a)}return t}function Rn(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let n=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return n?n.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function wn(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function lt(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??Y.join(e,".plugin-data"),n=process.env.CODEX_HOME??Y.join(An.homedir(),".codex"),r=Y.join(n,"pinta-codex.env"),o=ut.existsSync(r)?kn(r):{},s=Rn(o),u=wn(o);if(u&&!process.env.PINTA_RELAY_TOKEN){let c=u.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let a=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:Y.join(t,"trace.json"),endpoint:s?.replace(/\/+$/,""),headers:(0,ct.parseHeadersEnv)(u??""),guardEndpoint:a}}function dt(e){return e.hook_event_name==="PreToolUse"}function ft(e){return e.hook_event_name==="PermissionRequest"}function pt(e){return e.hook_event_name==="PostToolUse"}function mt(e){return e.hook_event_name==="UserPromptSubmit"}function _t(e){return e.hook_event_name==="SessionStart"}function gt(e){return e.hook_event_name==="Stop"}var Mn=["PreToolUse","PermissionRequest"],Dn=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],Nn=new Set([...Mn,...Dn]);function yt(e){return!Nn.has(e.hook_event_name)}var Mt=T(v());var ht=T(v()),z=class extends ht.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Pt=T(v()),K=class extends Pt.TraceManager{constructor(t){super(t.tracePath)}};import Z from"fs";import Pe from"os";import Ln from"path";var W="1.10.0";import S from"node:fs";import Et from"node:path";var Cn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),jn=256*1024,In=1024*1024,Bn=4096;function R(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function ge(e){let t=R(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Cn.has(r.toLowerCase())?r:void 0}function vt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function ye(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function I(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function St(e,t){let n=e.timestamp===void 0?I(t):I(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Tt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Et.isAbsolute(e)||Et.extname(e)!==".jsonl")return;let t;try{t=S.openSync(e,S.constants.O_RDONLY|S.constants.O_NONBLOCK|(S.constants.O_NOFOLLOW??0));let n=S.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,jn));if(S.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),s;if(o>=0)try{s=R(JSON.parse(r.toString("utf8",0,o)))}catch{}let u=Math.max(0,n.size-In),a=n.size<=r.length?r:Buffer.alloc(n.size-u);if(a!==r&&S.readSync(t,a,0,a.length,u)!==a.length)return;let c=S.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=u>0?a.indexOf(10)+1:0,p=a.lastIndexOf(10);if(u>0&&l===0||p<l)return;let E=[],N=0;for(;p>l&&N<Bn;){let Vt=a.lastIndexOf(10,p-1),ve=Math.max(l,Vt+1),Se=a.toString("utf8",ve,p).trim();if(Se){let Te=R(JSON.parse(Se));Te&&E.push(Te)}p=ve-1,N++}return E.reverse(),{first:s,rows:E,complete:u===0&&p<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{S.closeSync(t)}catch{}}}function Ot(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}function bt(e,t){let n=ge(e.model);if(n)return{name:n,source:"hook.model"};try{return Un(e,t)}catch{return}}function Un(e,t){if(e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop")return;let n=ye(e.session_id),r=ye(e.turn_id),o=St(e,t);if(!n||!r||o===void 0||e.agent_id!==void 0&&e.agent_id!==n)return;let s=Tt(e.transcript_path),u=s?.first,a=I(u?.timestamp);if(!s||u?.type!=="session_meta"||R(u.payload)?.id!==n||a===void 0||a>o||s.rows.some(l=>l.type==="session_meta"&&R(l.payload)?.id!==n))return;let c=[];for(let l of s.rows){let p=R(l.payload),E=I(l.timestamp);if(l.type!=="turn_context"||p?.turn_id!==r||E===void 0||E>o||E<a)continue;let N=ge(p.model);c.push(N?{name:N,source:"transcript.turn_context"}:void 0)}return Ot(c)}var w=T(v()),H;function qn(){if(H===void 0)try{H=Pe.userInfo().username}catch{H=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return H}var At=W,he;function B(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var xt=256*1024;function Fn(e){if(!e)return;let t;try{t=Z.openSync(e,"r");let n=Buffer.allocUnsafe(xt),r=Z.readSync(t,n,0,xt,0),o=n.toString("utf8",0,r),s=o.indexOf(`
-`);if(s<0)return;let u=JSON.parse(o.slice(0,s));return u?.type!=="session_meta"?void 0:B(u.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{Z.closeSync(t)}catch{}}}function Gn(){let e=B(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(Z.readFileSync(Ln.join(e,"package.json"),"utf8"));return B(t.version)}catch{return}}function $n(e){return he===void 0&&(he=Fn(B(e?.transcript_path))??Gn()??B(process.env.CODEX_CLI_VERSION)??null),he??void 0}var Xn=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),Vn=new Set(["codex.tool_input","codex.tool_response"]),Yn={skipRedactKeys:Xn,bashContextKeys:Vn};function zn(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"codex"}}),n.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,s]of Object.entries(e))o!=="hook_event_name"&&(r[o]=s);return vt(r,bt(e,t)),n.push(...(0,w.attrsFromRecord)(r,"codex",Yn)),n}function Kn(e){let t=$n(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:At}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:qn()}},{key:"host.name",value:{stringValue:Pe.hostname()}},{key:"host.arch",value:{stringValue:Pe.arch()}}]}function kt(e){let t=e.now??Date.now();return(0,w.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,w.snakeCase)(e.event.hook_event_name)}`,attributes:zn(e.event,t),resource:Kn(e.event),scope:{name:"pinta-codex",version:At},now:t})}function U(e,t,n){let r=new K(t),o=n.trace==="new"?r.newTrace():r.currentTrace();return kt({event:e,traceId:o})}async function L(e,t){let n=new z(t);await n.flush(),await n.send(e)}async function P(e,t,n){await L(U(e,t,n),t)}var Rt=T(v());var Wn=50,Hn=`pinta-codex/${W}`;async function wt(e,t){let n=await(0,Rt.evaluateGuard)(e,t,{timeoutMs:Wn,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Hn});if(n===null)return null;let r={decision:n.decision,reason:n.reason,durationMs:n.durationMs,clientRttMs:n.clientRttMs};return n.failOpenReason!==void 0&&(r.failOpenReason=n.failOpenReason),r}async function J(e,t){return wt(e,t.guardEndpoint)}function Q(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function Dt(e,t){let n=U(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Q(r)}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,Mt.attachGuard)(n,r),await L(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}var Nt=T(v());async function Ct(e,t){let n=U(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:Q(r)}}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,Nt.attachGuard)(n,r),await L(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}async function jt(e,t){return await P(e,t,{trace:"current"}),0}async function It(e,t){return await P(e,t,{trace:"new"}),0}async function Bt(e,t){return await P(e,t,{trace:"current"}),0}async function Ut(e,t){return await P(e,t,{trace:"current"}),0}async function Lt(e,t){return await P(e,t,{trace:"current"}),0}async function qt(e){return 0}async function Zn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Ft(){let e=0;try{let t=lt(),n=await Zn(),r=JSON.parse(n);yt(r)?e=await qt(r):dt(r)?e=await Dt(r,t):ft(r)?e=await Ct(r,t):pt(r)?e=await jt(r,t):mt(r)?e=await It(r,t):_t(r)?e=await Bt(r,t):gt(r)?e=await Ut(r,t):e=await Lt(r,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
-`),e=0}return e}var Gt=T(v());import{opendir as Jn,stat as Qn}from"node:fs/promises";import Ee from"node:path";var er="pinta-codex",tr=/^rollout-.+-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/;function nr(){return(0,Gt.envFilePath)(".codex","sessions","CODEX_HOME")}function rr(e,t){return Ee.relative(e,t).split(Ee.sep).join("/")}function or(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function sr(e){return e.endsWith(".jsonl")?"session-log":"other"}function ir(e){let t=e.slice(e.lastIndexOf("/")+1);return tr.exec(t)?.[1]}async function $t(){return[nr()]}async function*Xt(e,t){let n;try{n=await Jn(t)}catch{return}try{for await(let r of n){let o=Ee.join(t,r.name);r.isDirectory()?yield*Xt(e,o):r.isFile()&&(yield{absPath:o,relPath:rr(e,o)})}}catch{return}}async function*ar(e){let[t]=await $t(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of Xt(t,t)){let s;try{s=await Qn(r)}catch{continue}n!==void 0&&s.mtime.getTime()<=n||(yield{relPath:o,absPath:r,size:s.size,mtime:s.mtime,sessionId:ir(o),semantics:or(o)})}}var ur={id:er,roots:$t,scan:ar,classify:sr};function dr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===lr(cr(e)).href}catch{return!1}}async function fr(){let e=await Ft();process.exit(e)}dr()&&fr();export{ur as lifecycle};
+`)}}tryAcquireLock(){let t=Date.now();try{g.default.mkdirSync(W.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<In;)try{let n=g.default.openSync(this.lockPath,"wx");return g.default.writeSync(n,String(process.pid)),g.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let i=g.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){g.default.unlinkSync(this.lockPath);continue}}catch{}let r=jn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{g.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=H)return;let n=t.length-H;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};b.DiskRetryQueue=ce;var le=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>H&&this.entries.splice(0,this.entries.length-H)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};b.MemoryRetryQueue=le});var ot=E(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.MemoryTransport=f.DiskTransport=f.MAX_POST_BYTES=void 0;f.parseHeadersEnv=nt;f.envOptionsResolver=rt;f.postOtlp=G;var Qe=de(),et=ue(),Bn=5e3;f.MAX_POST_BYTES=900*1024;function K(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function tt(e,t,n){let r=[],o=[],i=[],s=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}i.length>0&&s+c>n&&(r.push(i),i=[],s=0),i.push(a),s+=c}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function nt(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function rt(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:nt(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function G(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),Bn);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let s="";try{s=(await i.text()).slice(0,200)}catch{}let a=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${a}${s?` body=${s}`:""}
+`),!1}return!0}catch(i){return process.stderr.write(`[${n}] OTLP POST failed: ${i.message??String(i)}
+`),!1}finally{clearTimeout(o)}}var fe=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Qe.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??rt}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await G(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=tt(n,a=>K(a.payload),f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${f.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...r),s=0;for(let a of r){if(!await G((0,et.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;s+=a.length}this.queue.rewrite(i.slice(s))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=K(t);return n<=f.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};f.DiskTransport=fe;var pe=class{queue=new Qe.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(K(t)>f.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await G(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=tt(n,K,f.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${f.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...r),s=0;for(let a of r){if(!await G((0,et.mergeBatch)(a),t,this.logPrefix))break;s+=a.length}for(let a of i.slice(s))this.queue.enqueue(a)}};f.MemoryTransport=pe});var _e=E(R=>{"use strict";var ge=R&&R.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(R,"__esModule",{value:!0});R.TraceManager=void 0;R.generateUlid=it;var st=ge(_("fs")),Un=ge(_("path")),Ln=ge(_("crypto")),qn=z(),me="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function it(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=me[n&31]+t,n=Math.floor(n/32);let r=Ln.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=me[r[i]&31];for(;o.length<16;)o+=me[0];return t+o}var he=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=it();return this.save(t),t}currentTrace(){try{let t=st.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{st.default.mkdirSync(Un.default.dirname(this.tracePath),{recursive:!0}),(0,qn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};R.TraceManager=he});var dt=E(A=>{"use strict";var ut=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.MemorySessionTraceManager=A.DiskSessionTraceManager=void 0;var at=ut(_("fs")),Gn=ut(_("path")),ct=_e(),$n=z(),lt=200,ye=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??lt}read(){try{let t=JSON.parse(at.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{at.default.mkdirSync(Gn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,$n.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,ct.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};A.DiskSessionTraceManager=ye;var Ee=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??lt}newTrace(t){let n=t||"default",r=(0,ct.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};A.MemorySessionTraceManager=Ee});var mt=E(w=>{"use strict";var Pe=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.envFilePath=Vn;w.parseEnvFile=pt;w.loadEnvFile=Yn;var Fn=Pe(_("node:fs")),Xn=Pe(_("node:os")),ft=Pe(_("node:path"));function Vn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:ft.default.join(Xn.default.homedir(),e);return ft.default.join(o,t)}function pt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),s=r.slice(o+1).trim();(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),i&&(t[i]=s)}return t}function Yn(e){let t;try{t=Fn.default.readFileSync(e,"utf-8")}catch{return}let n=pt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var P=E(u=>{"use strict";Object.defineProperty(u,"__esModule",{value:!0});u.loadEnvFile=u.parseEnvFile=u.envFilePath=u.MemorySessionTraceManager=u.DiskSessionTraceManager=u.generateUlid=u.TraceManager=u.MAX_POST_BYTES=u.parseHeadersEnv=u.envOptionsResolver=u.postOtlp=u.MemoryTransport=u.DiskTransport=u.MemoryRetryQueue=u.DiskRetryQueue=u.GUARD_BUDGET_HEADER=u.GUARD_STATUS_REFUSED=u.evaluateGuard=u.MAX_SPAN_BYTES=u.enforceSpanBudget=u.mergeBatch=u.attachGuard=u.buildPayload=u.clientAttrs=u.guardAttrs=u.attrsFromRecord=u.toOtlpValue=u.snakeCase=u.newSpanId=u.ulidToTraceId=u.MAX_BYTES=u.PATTERNS=u.applyMatches=u.resolveOverlaps=u.collectMatches=u.truncateTo=u.truncate=u.redact=void 0;var x=ie();Object.defineProperty(u,"redact",{enumerable:!0,get:function(){return x.redact}});Object.defineProperty(u,"truncate",{enumerable:!0,get:function(){return x.truncate}});Object.defineProperty(u,"truncateTo",{enumerable:!0,get:function(){return x.truncateTo}});Object.defineProperty(u,"collectMatches",{enumerable:!0,get:function(){return x.collectMatches}});Object.defineProperty(u,"resolveOverlaps",{enumerable:!0,get:function(){return x.resolveOverlaps}});Object.defineProperty(u,"applyMatches",{enumerable:!0,get:function(){return x.applyMatches}});Object.defineProperty(u,"PATTERNS",{enumerable:!0,get:function(){return x.PATTERNS}});Object.defineProperty(u,"MAX_BYTES",{enumerable:!0,get:function(){return x.MAX_BYTES}});var y=ue();Object.defineProperty(u,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(u,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(u,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(u,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(u,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(u,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(u,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(u,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(u,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(u,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(u,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(u,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var ve=Ke();Object.defineProperty(u,"evaluateGuard",{enumerable:!0,get:function(){return ve.evaluateGuard}});Object.defineProperty(u,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ve.GUARD_STATUS_REFUSED}});Object.defineProperty(u,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return ve.GUARD_BUDGET_HEADER}});var ht=de();Object.defineProperty(u,"DiskRetryQueue",{enumerable:!0,get:function(){return ht.DiskRetryQueue}});Object.defineProperty(u,"MemoryRetryQueue",{enumerable:!0,get:function(){return ht.MemoryRetryQueue}});var j=ot();Object.defineProperty(u,"DiskTransport",{enumerable:!0,get:function(){return j.DiskTransport}});Object.defineProperty(u,"MemoryTransport",{enumerable:!0,get:function(){return j.MemoryTransport}});Object.defineProperty(u,"postOtlp",{enumerable:!0,get:function(){return j.postOtlp}});Object.defineProperty(u,"envOptionsResolver",{enumerable:!0,get:function(){return j.envOptionsResolver}});Object.defineProperty(u,"parseHeadersEnv",{enumerable:!0,get:function(){return j.parseHeadersEnv}});Object.defineProperty(u,"MAX_POST_BYTES",{enumerable:!0,get:function(){return j.MAX_POST_BYTES}});var gt=_e();Object.defineProperty(u,"TraceManager",{enumerable:!0,get:function(){return gt.TraceManager}});Object.defineProperty(u,"generateUlid",{enumerable:!0,get:function(){return gt.generateUlid}});var _t=dt();Object.defineProperty(u,"DiskSessionTraceManager",{enumerable:!0,get:function(){return _t.DiskSessionTraceManager}});Object.defineProperty(u,"MemorySessionTraceManager",{enumerable:!0,get:function(){return _t.MemorySessionTraceManager}});var Se=mt();Object.defineProperty(u,"envFilePath",{enumerable:!0,get:function(){return Se.envFilePath}});Object.defineProperty(u,"parseEnvFile",{enumerable:!0,get:function(){return Se.parseEnvFile}});Object.defineProperty(u,"loadEnvFile",{enumerable:!0,get:function(){return Se.loadEnvFile}})});import{realpathSync as Dr}from"node:fs";import{pathToFileURL as Mr}from"node:url";var Et=v(P());import yt from"node:fs";import zn from"node:os";import Z from"node:path";function Wn(e){let t={},n;try{n=yt.readFileSync(e,"utf-8")}catch{return t}for(let r of n.split(`
+`)){let o=r.trim();if(!o||o.startsWith("#"))continue;let i=o.indexOf("=");if(i<0)continue;let s=o.slice(0,i).trim(),a=o.slice(i+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),s&&(t[s]=a)}return t}function Hn(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let n=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return n?n.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function Kn(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function Pt(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??Z.join(e,".plugin-data"),n=process.env.CODEX_HOME??Z.join(zn.homedir(),".codex"),r=Z.join(n,"pinta-codex.env"),o=yt.existsSync(r)?Wn(r):{},i=Hn(o),s=Kn(o);if(s&&!process.env.PINTA_RELAY_TOKEN){let c=s.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let a=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:Z.join(t,"trace.json"),endpoint:i?.replace(/\/+$/,""),headers:(0,Et.parseHeadersEnv)(s??""),guardEndpoint:a}}function vt(e){return e.hook_event_name==="PreToolUse"}function St(e){return e.hook_event_name==="PermissionRequest"}function Tt(e){return e.hook_event_name==="PostToolUse"}function Ot(e){return e.hook_event_name==="UserPromptSubmit"}function bt(e){return e.hook_event_name==="SessionStart"}function At(e){return e.hook_event_name==="Stop"}var Zn=["PreToolUse","PermissionRequest"],Jn=["PostToolUse"],Qn=["PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],er=new Set([...Zn,...Jn,...Qn]);function xt(e){return!er.has(e.hook_event_name)}var Gt=v(P());var re=v(P());var kt=v(P()),J=class extends kt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Rt=v(P()),Q=class extends Rt.TraceManager{constructor(t){super(t.tracePath)}};import ne from"fs";import Ae from"os";import ir from"path";var ee="1.11.1";import T from"node:fs";import wt from"node:path";var tr=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),nr=256*1024,rr=1024*1024,or=4096;function D(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function Te(e){let t=D(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!tr.has(r.toLowerCase())?r:void 0}function Dt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Oe(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function $(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Mt(e,t){let n=e.timestamp===void 0?$(t):$(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Nt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!wt.isAbsolute(e)||wt.extname(e)!==".jsonl")return;let t;try{t=T.openSync(e,T.constants.O_RDONLY|T.constants.O_NONBLOCK|(T.constants.O_NOFOLLOW??0));let n=T.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,nr));if(T.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=D(JSON.parse(r.toString("utf8",0,o)))}catch{}let s=Math.max(0,n.size-rr),a=n.size<=r.length?r:Buffer.alloc(n.size-s);if(a!==r&&T.readSync(t,a,0,a.length,s)!==a.length)return;let c=T.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=s>0?a.indexOf(10)+1:0,d=a.lastIndexOf(10);if(s>0&&l===0||d<l)return;let h=[],O=0;for(;d>l&&O<or;){let nn=a.lastIndexOf(10,d-1),ke=Math.max(l,nn+1),Re=a.toString("utf8",ke,d).trim();if(Re){let we=D(JSON.parse(Re));we&&h.push(we)}d=ke-1,O++}return h.reverse(),{first:i,rows:h,complete:s===0&&d<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{T.closeSync(t)}catch{}}}function Ct(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}function It(e,t){let n=Te(e.model);if(n)return{name:n,source:"hook.model"};try{return sr(e,t)}catch{return}}function sr(e,t){if(e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop")return;let n=Oe(e.session_id),r=Oe(e.turn_id),o=Mt(e,t);if(!n||!r||o===void 0||e.agent_id!==void 0&&e.agent_id!==n)return;let i=Nt(e.transcript_path),s=i?.first,a=$(s?.timestamp);if(!i||s?.type!=="session_meta"||D(s.payload)?.id!==n||a===void 0||a>o||i.rows.some(l=>l.type==="session_meta"&&D(l.payload)?.id!==n))return;let c=[];for(let l of i.rows){let d=D(l.payload),h=$(l.timestamp);if(l.type!=="turn_context"||d?.turn_id!==r||h===void 0||h>o||h<a)continue;let O=Te(d.model);c.push(O?{name:O,source:"transcript.turn_context"}:void 0)}return Ct(c)}var M=v(P()),te;function ar(){if(te===void 0)try{te=Ae.userInfo().username}catch{te=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return te}var Bt=ee,be;function F(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var jt=256*1024;function ur(e){if(!e)return;let t;try{t=ne.openSync(e,"r");let n=Buffer.allocUnsafe(jt),r=ne.readSync(t,n,0,jt,0),o=n.toString("utf8",0,r),i=o.indexOf(`
+`);if(i<0)return;let s=JSON.parse(o.slice(0,i));return s?.type!=="session_meta"?void 0:F(s.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{ne.closeSync(t)}catch{}}}function cr(){let e=F(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(ne.readFileSync(ir.join(e,"package.json"),"utf8"));return F(t.version)}catch{return}}function lr(e){return be===void 0&&(be=ur(F(e?.transcript_path))??cr()??F(process.env.CODEX_CLI_VERSION)??null),be??void 0}var dr=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),fr=new Set(["codex.tool_input","codex.tool_response"]),pr={skipRedactKeys:dr,bashContextKeys:fr};function mr(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"codex"}}),n.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,i]of Object.entries(e))o!=="hook_event_name"&&(r[o]=i);return Dt(r,It(e,t)),n.push(...(0,M.attrsFromRecord)(r,"codex",pr)),n}function hr(e){let t=lr(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Bt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:ar()}},{key:"host.name",value:{stringValue:Ae.hostname()}},{key:"host.arch",value:{stringValue:Ae.arch()}}]}function Ut(e){let t=e.now??Date.now();return(0,M.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,M.snakeCase)(e.event.hook_event_name)}`,attributes:mr(e.event,t),resource:hr(e.event),scope:{name:"pinta-codex",version:Bt},now:t})}function N(e,t,n){let r=new Q(t),o=n.trace==="new"?r.newTrace():r.currentTrace();return Ut({event:e,traceId:o})}async function C(e,t){let n=new J(t);await n.flush(),await n.send(e)}function B(e,t){if(t.endpoint){if(Buffer.byteLength(JSON.stringify(e),"utf8")>re.MAX_POST_BYTES){process.stderr.write(`[pinta-codex] deferred telemetry exceeds MAX_POST_BYTES; dropped
+`);return}new re.DiskRetryQueue(t.pluginData,"pinta-codex").enqueue(e)}}async function k(e,t,n){await C(N(e,t,n),t)}var Lt=v(P());var gr=100,_r=`pinta-codex/${ee}`;async function qt(e,t){let n=await(0,Lt.evaluateGuard)(e,t,{timeoutMs:gr,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:_r});if(n===null)return null;let r={decision:n.decision,reason:n.reason,durationMs:n.durationMs,clientRttMs:n.clientRttMs};return n.failOpenReason!==void 0&&(r.failOpenReason=n.failOpenReason),r}async function U(e,t){return qt(e,t.guardEndpoint)}function oe(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function $t(e,t){let n=N(e,t,{trace:"current"}),r=await U(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:oe(r)}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Gt.attachGuard)(n,r),r?.decision==="DENY"?B(n,t):await C(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}var Ft=v(P());async function Xt(e,t){let n=N(e,t,{trace:"current"}),r=await U(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:oe(r)}}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Ft.attachGuard)(n,r),r?.decision==="DENY"?B(n,t):await C(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}var Vt=v(P());var yr="Pinta withheld this tool output because it violated an active policy.";async function Yt(e,t){let n=N(e,t,{trace:"current"}),r=await U(n,t);if(r?.decision==="DENY"){let o={decision:"block",reason:yr};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Vt.attachGuard)(n,r),r&&n.resourceSpans[0].scopeSpans[0].spans[0].attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}}),r?.decision==="DENY"?B(n,t):await C(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}async function zt(e,t){return await k(e,t,{trace:"new"}),0}async function Wt(e,t){return await k(e,t,{trace:"current"}),0}async function Ht(e,t){return await k(e,t,{trace:"current"}),0}async function Kt(e,t){return await k(e,t,{trace:"current"}),0}async function Zt(e){return 0}async function Er(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Jt(){let e=0;try{let t=Pt(),n=await Er(),r=JSON.parse(n);xt(r)?e=await Zt(r):vt(r)?e=await $t(r,t):St(r)?e=await Xt(r,t):Tt(r)?e=await Yt(r,t):Ot(r)?e=await zt(r,t):bt(r)?e=await Wt(r,t):At(r)?e=await Ht(r,t):e=await Kt(r,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
+`),e=0}return e}var Qt=v(P());import{opendir as Pr,stat as vr}from"node:fs/promises";import xe from"node:path";var Sr="pinta-codex",Tr=/^rollout-.+-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/;function Or(){return(0,Qt.envFilePath)(".codex","sessions","CODEX_HOME")}function br(e,t){return xe.relative(e,t).split(xe.sep).join("/")}function Ar(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function xr(e){return e.endsWith(".jsonl")?"session-log":"other"}function kr(e){let t=e.slice(e.lastIndexOf("/")+1);return Tr.exec(t)?.[1]}async function en(){return[Or()]}async function*tn(e,t){let n;try{n=await Pr(t)}catch{return}try{for await(let r of n){let o=xe.join(t,r.name);r.isDirectory()?yield*tn(e,o):r.isFile()&&(yield{absPath:o,relPath:br(e,o)})}}catch{return}}async function*Rr(e){let[t]=await en(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of tn(t,t)){let i;try{i=await vr(r)}catch{continue}n!==void 0&&i.mtime.getTime()<=n||(yield{relPath:o,absPath:r,size:i.size,mtime:i.mtime,sessionId:kr(o),semantics:Ar(o)})}}var wr={id:Sr,roots:en,scan:Rr,classify:xr};function Nr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===Mr(Dr(e)).href}catch{return!1}}async function Cr(){let e=await Jt();process.exit(e)}Nr()&&Cr();export{wr as lifecycle};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinta-ai/pinta-codex",
-  "version": "1.10.0",
+  "version": "1.11.1",
   "description": "Generic OTLP forwarder for Codex hook events",
   "main": "dist/index.js",
   "exports": {
@@ -49,7 +49,7 @@
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {
-    "@pinta-ai/core": "^0.8.0",
+    "@pinta-ai/core": "^0.9.2",
     "@types/node": "^22.0.0",
     "esbuild": "^0.24.0",
     "typescript": "^5.7.0",