@pinta-ai/pinta-codex 1.9.0 → 1.10.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pinta-codex",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Generic OTLP forwarder for Codex hook events",
   "author": {
     "name": "Pinta AI",

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to pinta-codex are documented here.
 
+## [1.10.0] - 2026-09-22
+
+### Added
+
+- Truthful scalar `codex.model` IDs from explicit hook metadata, with source
+  preservation and omission of placeholders or stringified objects/arrays.
+- Bounded, read-only fallback to a rollout's exact session and turn context.
+  `transcript.turn_context` is explicitly requested-model evidence, not proof
+  of routed response identity. Missing turn IDs, conflicting contexts and
+  parent context on subagent lifecycle events remain model-less.
+- Model regressions and built CJS/ESM model/SDK-version wire checks in PR CI.
+
+### Compatibility
+
+- Still requires Pinta Manager 0.1.11 or later. Guard payloads, output envelopes,
+  event counts and redaction are unchanged; bundled `@pinta-ai/core` remains
+  `^0.8.0`. No new required envelope fields.
+
 ## [1.9.0] - 2026-09-20
 
 ### Changed

package/README.md

@@ -76,6 +76,50 @@ Each invocation spawns `node dist/index.js`, maps the event to a single OTLP spa
 - Disk-backed retry queue at `.plugin-data/failed-spans.jsonl` (cap 1000). Drained on the next hook invocation
 - One trace per user turn — based on the `UserPromptSubmit` ULID
 
+### Model attribution and its limits
+
+`codex.model` is the exact host-reported scalar model ID. An explicit hook
+`model` wins, accepting a string or a descriptor's `id` (or `name` when no `id`
+field exists), rather than stringifying the descriptor. Its
+`codex.model_source` preserves the host's supplied source or defaults to
+`hook.model`; a hook model can describe a requested
+selection and is not by itself proof of a provider's routed response.
+
+JSON-stringified objects/arrays (including `[object Object]`) are not IDs.
+Provider and requested/response fields remain unchanged. If a transcript
+replaces an unusable model, `model_source` describes that transcript evidence;
+a previous host source is retained as `codex.model_original_source`.
+
+When the hook has no usable model, `transcript.turn_context` evidence is
+available only with an exact `session_meta.payload.id == session_id` and
+`turn_context.payload.turn_id == turn_id` in the supplied rollout JSONL.
+`turn_context.payload.model` becomes `codex.model`, with
+`codex.model_source=transcript.turn_context`. **This is the requested turn
+model, not a claim about response routing.** Only records at/before the hook
+timestamp (or processing time when absent) qualify. Conflicting same-turn
+models are omitted rather than choosing the latest.
+
+There is no session-wide carry-forward: an older/different turn, another
+session, or a parent's context for `SubagentStart`/`SubagentStop` cannot supply
+the model. Older rollouts without `turn_id`, missing/late-flushed context,
+context outside the read window, and uncorrelated events remain model-less.
+A child session needs its own matching rollout and turn. Global configuration,
+provider names, CLI versions, process names and user prose are never model
+evidence.
+
+Blank, `unknown`, `undefined`, `null`, `n/a`, `none`, `auto` and `default`
+are omissions (case-insensitive), as are non-ID objects, control characters and
+IDs longer than 512 characters. No mandatory event fields are added.
+The original input, other flattened fields, guard behavior, event count and
+redaction pipeline are unchanged.
+
+Model lookup opens only the supplied absolute `.jsonl` regular file, read-only,
+with no subprocess, directory scan or model cache. It reads at most a 256 KiB
+header plus a 1 MiB tail and 4,096 complete records. Missing/unreadable files,
+leaf symlinks, malformed records and invalid identities fail quietly;
+incomplete boundary lines are ignored. It never logs or exports transcript
+contents. An explicit model or missing turn ID needs no model-lookup IO.
+
 ## Configuration
 
 `npm run setup` writes the endpoint and headers to `~/.codex/pinta-codex.env`. Environment variables override file values.
@@ -172,6 +216,14 @@ printf 'http://localhost:3000\n\n' | npm run setup
 
 ## Scripts
 
+`npm run smoke:model` (after `npm run build`) tests the actual CJS and ESM hooks
+against a loopback OTLP collector with isolated HOME/plugin data and no
+manager/guard calls. It covers supplied, missing, placeholder, correlated,
+cross-session/subagent, future, partial and oversized transcript cases and
+writes `.validation/model-smoke.json`. Optionally pass
+`-- --baseline=<previous-built-index.js>` for paired wall-time comparisons;
+these include Node startup, local HTTP and scheduler noise.
+
 | Script | Purpose |
 |--------|---------|
 | `npm run setup` | one-shot interactive installer (build + env + config + hooks) |

package/dist/index.js

@@ -1,26 +1,26 @@
-"use strict";var kt=Object.create;var fe=Object.defineProperty;var At=Object.getOwnPropertyDescriptor;var Rt=Object.getOwnPropertyNames;var wt=Object.getPrototypeOf,Dt=Object.prototype.hasOwnProperty;var h=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Mt=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of Rt(e))!Dt.call(t,o)&&o!==r&&fe(t,o,{get:()=>e[o],enumerable:!(n=At(e,o))||n.enumerable});return t};var f=(t,e,r)=>(r=t!=null?kt(wt(t)):{},Mt(e||!t||!t.__esModule?fe(r,"default",{value:t,enumerable:!0}):r,t));var z=h(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.PATTERNS=d.MAX_BYTES=void 0;d.truncateTo=me;d.truncate=Ct;d.collectMatches=_e;d.resolveOverlaps=ge;d.applyMatches=he;d.redact=Nt;d.MAX_BYTES=102400;function me(t,e){let r=Buffer.from(t,"utf-8");return r.length<=e?t:`${r.subarray(0,Math.max(0,e)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function Ct(t){return me(t,d.MAX_BYTES)}d.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function _e(t,e){let r=[];for(let n of d.PATTERNS){if(n.requireContext&&n.requireContext!==e.context)continue;let o=new RegExp(n.regex.source,n.regex.flags),i;for(;(i=o.exec(t))!==null;){let a=n.captureGroup??0,u=i[a];if(u===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,g=i.index+i[0].length,A=c+i[0].indexOf(u),xt=A+u.length;r.push({start:c,end:g,replaceStart:A,replaceEnd:xt,type:n.type}),i.index===o.lastIndex&&o.lastIndex++}}return r}function ge(t){let e=[...t].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),r=[],n=-1;for(let o of e)o.start<n||(r.push(o),n=o.end);return r}function he(t,e){let r=[...e].sort((o,i)=>i.replaceStart-o.replaceStart),n=t;for(let o of r)n=n.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+n.slice(o.replaceEnd);return n}function Nt(t,e={}){if(t.length===0)return t;let r=_e(t,e);if(r.length===0)return t;let n=ge(r);return he(t,n)}});var Z=h(p=>{"use strict";var jt=p&&p.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(p,"__esModule",{value:!0});p.MAX_SPAN_BYTES=void 0;p.ulidToTraceId=ve;p.newSpanId=Se;p.snakeCase=Ut;p.toOtlpValue=Oe;p.attrsFromRecord=qt;p.guardAttrs=Te;p.clientAttrs=be;p.enforceSpanBudget=xe;p.buildPayload=Lt;p.attachGuard=ke;p.mergeBatch=Gt;var It=jt(require("crypto")),W=z(),Bt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function ve(t){if(t.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${t.length}`);let e=0n;for(let n of t){let o=Bt.indexOf(n);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);e=e<<5n|BigInt(o)}let r=(1n<<128n)-1n;return e&=r,e.toString(16).padStart(32,"0")}function Se(){return It.default.randomBytes(8).toString("hex")}function Ut(t){return t.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var ye=new Set;function I(t,e,r){let n=(0,W.truncate)(e);if((r.skipRedactKeys??ye).has(t))return n;let o=(r.bashContextKeys??ye).has(t)?"bash":void 0;return(0,W.redact)(n,{context:o})}function Oe(t,e,r={}){if(e==null)return null;switch(typeof e){case"string":return{stringValue:I(t,e,r)};case"boolean":return{boolValue:e};case"number":return Number.isInteger(e)?{intValue:e}:{doubleValue:e};case"object":try{return{stringValue:I(t,JSON.stringify(e),r)}}catch{return{stringValue:I(t,String(e),r)}}default:return{stringValue:I(t,String(e),r)}}}function qt(t,e,r={}){let n=[];for(let[o,i]of Object.entries(t)){let a=`${e}.${o}`,u=Oe(a,i,r);u!==null&&n.push({key:a,value:u})}return n}function Te(t){let e=[{key:"pinta.guard.decision",value:{stringValue:t.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:t.durationMs}}];return t.reason&&e.push({key:"pinta.guard.matched_rule",value:{stringValue:t.reason}}),t.failOpenReason&&e.push({key:"pinta.guard.fail_open_reason",value:{stringValue:t.failOpenReason}}),e}function be(t){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(t.rttMs)?{intValue:t.rttMs}:{doubleValue:t.rttMs}},{key:"pinta.client.op",value:{stringValue:t.op}}]}p.MAX_SPAN_BYTES=800*1024;function Pe(t){let e=JSON.stringify(t);return e===void 0?0:Buffer.byteLength(e,"utf-8")}var Ee=1024;function xe(t,e=p.MAX_SPAN_BYTES){let r=Pe(t);for(let n=0;n<100&&r>e;n++){let o=null,i=0;for(let c of t.attributes){if(!("stringValue"in c.value))continue;let g=Buffer.byteLength(c.value.stringValue,"utf-8");g>i&&(i=g,o=c.value)}if(o===null||i<=Ee)break;let a=r-e,u=Math.max(Ee,i-a-64);o.stringValue=(0,W.truncateTo)(o.stringValue,u),r=Pe(t)}return t}function Lt(t){let e=t.now??Date.now(),r=(BigInt(e)*1000000n).toString(),n=[...t.attributes],o={traceId:ve(t.traceId),spanId:Se(),name:t.spanName,kind:t.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};xe(o);let i={resourceSpans:[{resource:{attributes:t.resource},scopeSpans:[{scope:t.scope,spans:[o]}]}]};return ke(i,t.guard,t.clientTiming)}function ke(t,e,r){let n=t.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!n)return t;e&&n.attributes.push(...Te(e));let o=r??(e?.clientRttMs!==void 0?{op:"guard",rttMs:e.clientRttMs}:null);return o&&n.attributes.push(...be(o)),t}function Gt(t){let e=[];for(let r of t)e.push(...r.resourceSpans);return{resourceSpans:e}}});var Ae=h(x=>{"use strict";Object.defineProperty(x,"__esModule",{value:!0});x.GUARD_STATUS_REFUSED=void 0;x.evaluateGuard=Ft;var $t=1e4,Xt="pinta-core";function B(t,e){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:t,clientRttMs:t,failOpenReason:e}}var Yt=new Set(["ALLOW","DENY","REVIEW"]);x.GUARD_STATUS_REFUSED=410;async function Ft(t,e,r={}){if(!e||r.disabled)return null;let n=r.timeoutMs??$t,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),n);try{let u=await fetch(e,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??Xt,"x-pinta-relay-token":r.token??"",...r.agentType?{"x-pinta-agent-type":r.agentType}:{}},body:JSON.stringify(t),signal:i.signal});if(u.status===x.GUARD_STATUS_REFUSED)return B(Date.now()-o,"refused");if(u.status!==200)return B(Date.now()-o,"error");let c=await u.json(),g=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!Yt.has(c.decision)||!g)return B(Date.now()-o,"error");let A=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??A,clientRttMs:A}}catch(u){let c=u.name,g=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return B(Date.now()-o,g)}finally{clearTimeout(a)}}});var U=h(R=>{"use strict";var Vt=R&&R.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(R,"__esModule",{value:!0});R.atomicWriteFileSync=Kt;var Re=Vt(require("fs"));function Kt(t,e){let r=`${t}.${process.pid}.tmp`;Re.default.writeFileSync(r,e),Re.default.renameSync(r,t)}});var ee=h(P=>{"use strict";var we=P&&P.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(P,"__esModule",{value:!0});P.MemoryRetryQueue=P.DiskRetryQueue=void 0;var m=we(require("fs")),q=we(require("path")),Ht=U(),L=1e3,zt=50,Wt=5,J=class{filePath;lockPath;logPrefix;constructor(e,r){this.filePath=q.default.join(e,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(e){try{m.default.mkdirSync(q.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:e})+`
-`;m.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
-`)}}readAll(){try{let e=m.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of e.split(`
-`))if(n.trim())try{let o=JSON.parse(n);Array.isArray(o?.payload?.resourceSpans)&&r.push(o)}catch{}return r}catch{return[]}}rewrite(e){try{if(e.length===0){m.default.existsSync(this.filePath)&&m.default.unlinkSync(this.filePath);return}m.default.mkdirSync(q.default.dirname(this.filePath),{recursive:!0}),(0,Ht.atomicWriteFileSync)(this.filePath,e.map(r=>JSON.stringify(r)).join(`
+"use strict";var Vt=Object.create;var Te=Object.defineProperty;var Xt=Object.getOwnPropertyDescriptor;var Ft=Object.getOwnPropertyNames;var Yt=Object.getPrototypeOf,zt=Object.prototype.hasOwnProperty;var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Kt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Ft(t))!zt.call(e,o)&&o!==n&&Te(e,o,{get:()=>t[o],enumerable:!(r=Xt(t,o))||r.enumerable});return e};var m=(e,t,n)=>(n=e!=null?Vt(Yt(e)):{},Kt(t||!e||!e.__esModule?Te(n,"default",{value:e,enumerable:!0}):n,e));var ee=h(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.PATTERNS=_.MAX_BYTES=void 0;_.truncateTo=be;_.truncate=Ht;_.collectMatches=xe;_.resolveOverlaps=ke;_.applyMatches=Ae;_.redact=Wt;_.MAX_BYTES=102400;function be(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Ht(e){return be(e,_.MAX_BYTES)}_.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function xe(e,t){let n=[];for(let r of _.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=o.exec(e))!==null;){let u=r.captureGroup??0,a=s[u];if(a===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let c=s.index,d=s.index+s[0].length,p=c+s[0].indexOf(a),v=p+a.length;n.push({start:c,end:d,replaceStart:p,replaceEnd:v,type:r.type}),s.index===o.lastIndex&&o.lastIndex++}}return n}function ke(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Ae(e,t){let n=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function Wt(e,t={}){if(e.length===0)return e;let n=xe(e,t);if(n.length===0)return e;let r=ke(n);return Ae(e,r)}});var ne=h(f=>{"use strict";var Zt=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=De;f.newSpanId=Ne;f.snakeCase=en;f.toOtlpValue=Ce;f.attrsFromRecord=tn;f.guardAttrs=je;f.clientAttrs=Ie;f.enforceSpanBudget=Be;f.buildPayload=nn;f.attachGuard=Ue;f.mergeBatch=rn;var Jt=Zt(require("crypto")),te=ee(),Qt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function De(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=Qt.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ne(){return Jt.default.randomBytes(8).toString("hex")}function en(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Re=new Set;function G(e,t,n){let r=(0,te.truncate)(t);if((n.skipRedactKeys??Re).has(e))return r;let o=(n.bashContextKeys??Re).has(e)?"bash":void 0;return(0,te.redact)(r,{context:o})}function Ce(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:G(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:G(e,JSON.stringify(t),n)}}catch{return{stringValue:G(e,String(t),n)}}default:return{stringValue:G(e,String(t),n)}}}function tn(e,t,n={}){let r=[];for(let[o,s]of Object.entries(e)){let u=`${t}.${o}`,a=Ce(u,s,n);a!==null&&r.push({key:u,value:a})}return r}function je(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ie(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function we(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Me=1024;function Be(e,t=f.MAX_SPAN_BYTES){let n=we(e);for(let r=0;r<100&&n>t;r++){let o=null,s=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let d=Buffer.byteLength(c.value.stringValue,"utf-8");d>s&&(s=d,o=c.value)}if(o===null||s<=Me)break;let u=n-t,a=Math.max(Me,s-u-64);o.stringValue=(0,te.truncateTo)(o.stringValue,a),n=we(e)}return e}function nn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:De(e.traceId),spanId:Ne(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Be(o);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Ue(s,e.guard,e.clientTiming)}function Ue(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...je(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Ie(o)),e}function rn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Le=h(w=>{"use strict";Object.defineProperty(w,"__esModule",{value:!0});w.GUARD_STATUS_REFUSED=void 0;w.evaluateGuard=un;var on=1e4,sn="pinta-core";function $(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var an=new Set(["ALLOW","DENY","REVIEW"]);w.GUARD_STATUS_REFUSED=410;async function un(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??on,o=Date.now(),s=new AbortController,u=setTimeout(()=>s.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??sn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{}},body:JSON.stringify(e),signal:s.signal});if(a.status===w.GUARD_STATUS_REFUSED)return $(Date.now()-o,"refused");if(a.status!==200)return $(Date.now()-o,"error");let c=await a.json(),d=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!an.has(c.decision)||!d)return $(Date.now()-o,"error");let p=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??p,clientRttMs:p}}catch(a){let c=a.name,d=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return $(Date.now()-o,d)}finally{clearTimeout(u)}}});var V=h(N=>{"use strict";var cn=N&&N.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(N,"__esModule",{value:!0});N.atomicWriteFileSync=dn;var qe=cn(require("fs"));function dn(e,t){let n=`${e}.${process.pid}.tmp`;qe.default.writeFileSync(n,t),qe.default.renameSync(n,e)}});var se=h(S=>{"use strict";var Ge=S&&S.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(S,"__esModule",{value:!0});S.MemoryRetryQueue=S.DiskRetryQueue=void 0;var g=Ge(require("fs")),X=Ge(require("path")),ln=V(),F=1e3,fn=50,pn=5,re=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=X.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{g.default.mkdirSync(X.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;g.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=g.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){g.default.existsSync(this.filePath)&&g.default.unlinkSync(this.filePath);return}g.default.mkdirSync(X.default.dirname(this.filePath),{recursive:!0}),(0,ln.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
-`)}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${r}
-`)}}tryAcquireLock(){let e=Date.now();try{m.default.mkdirSync(q.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
-`),!1}for(;Date.now()-e<zt;)try{let r=m.default.openSync(this.lockPath,"wx");return m.default.writeSync(r,String(process.pid)),m.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
-`),!1;try{let i=m.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){m.default.unlinkSync(this.lockPath);continue}}catch{}let n=Wt,o=Date.now()+n;for(;Date.now()<o;);}return!1}release(){try{m.default.unlinkSync(this.lockPath)}catch{}}trim(){let e=this.readAll();if(e.length<=L)return;let r=e.length-L;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
-`),this.rewrite(e.slice(r))}};P.DiskRetryQueue=J;var Q=class{entries=[];enqueue(e){this.entries.push(e),this.entries.length>L&&this.entries.splice(0,this.entries.length-L)}drain(){let e=this.entries;return this.entries=[],e}get size(){return this.entries.length}};P.MemoryRetryQueue=Q});var Ie=h(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Ne;l.envOptionsResolver=je;l.postOtlp=w;var De=ee(),Me=Z(),Zt=5e3;l.MAX_POST_BYTES=900*1024;function G(t){let e=JSON.stringify(t);return e===void 0?0:Buffer.byteLength(e,"utf-8")}function Ce(t,e,r){let n=[],o=[],i=[],a=0;for(let u of t){let c=e(u);if(c>r){o.push(u);continue}i.length>0&&a+c>r&&(n.push(i),i=[],a=0),i.push(u),a+=c}return i.length>0&&n.push(i),{chunks:n,oversize:o}}function Ne(t){if(!t)return{};if(typeof t=="object")return{...t};let e={};for(let r of t.split(",")){let[n,...o]=r.split("=");n&&o.length>0&&(e[n.trim()]=o.join("=").trim())}return e}function je(){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,e=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return t?r=t.replace(/\/+$/,""):e&&(r=e.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Ne(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function w(t,e,r){let n=new AbortController,o=setTimeout(()=>n.abort(),Zt);try{let i=await fetch(e.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...e.headers},body:JSON.stringify(t),signal:n.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let u=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${i.status} ${e.endpoint}${u}${a?` body=${a}`:""}
-`),!1}return!0}catch(i){return process.stderr.write(`[${r}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var te=class{queue;logPrefix;resolveOptions;constructor(e){this.queue=new De.DiskRetryQueue(e.pluginData,e.logPrefix),this.logPrefix=e.logPrefix,this.resolveOptions=e.resolveOptions??je}async send(e){let r=this.resolveOptions();if(!r||this.dropIfOversized(e))return;await w(e,r,this.logPrefix)||this.queue.enqueue(e)}async flush(){let e=this.resolveOptions();if(e&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:o}=Ce(r,u=>G(u.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...n),a=0;for(let u of n){if(!await w((0,Me.mergeBatch)(u.map(g=>g.payload)),e,this.logPrefix))break;a+=u.length}this.queue.rewrite(i.slice(a))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
-`)}finally{this.queue.release()}}dropIfOversized(e){let r=G(e);return r<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=te;var re=class{queue=new De.MemoryRetryQueue;logPrefix;resolveOptions;constructor(e){this.logPrefix=e.logPrefix,this.resolveOptions=e.resolveOptions}async send(e){let r=this.resolveOptions();if(!r)return;if(G(e)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await w(e,r,this.logPrefix)||this.queue.enqueue(e)}async flush(){let e=this.resolveOptions();if(!e)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:o}=Ce(r,G,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...n),a=0;for(let u of n){if(!await w((0,Me.mergeBatch)(u),e,this.logPrefix))break;a+=u.length}for(let u of i.slice(a))this.queue.enqueue(u)}};l.MemoryTransport=re});var ie=h(O=>{"use strict";var se=O&&O.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(O,"__esModule",{value:!0});O.TraceManager=void 0;O.generateUlid=Ue;var Be=se(require("fs")),Jt=se(require("path")),Qt=se(require("crypto")),er=U(),ne="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ue(){let t=Date.now(),e="",r=t;for(let i=0;i<10;i++)e=ne[r&31]+e,r=Math.floor(r/32);let n=Qt.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=ne[n[i]&31];for(;o.length<16;)o+=ne[0];return e+o}var oe=class{tracePath;constructor(e){this.tracePath=e}newTrace(){let e=Ue();return this.save(e),e}currentTrace(){try{let e=Be.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(e);if(r)return r}catch{}return this.newTrace()}save(e){try{Be.default.mkdirSync(Jt.default.dirname(this.tracePath),{recursive:!0}),(0,er.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:e}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
-`)}}};O.TraceManager=oe});var Xe=h(E=>{"use strict";var Le=E&&E.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(E,"__esModule",{value:!0});E.MemorySessionTraceManager=E.DiskSessionTraceManager=void 0;var qe=Le(require("fs")),tr=Le(require("path")),Ge=ie(),rr=U(),$e=200,ae=class{tracePath;maxSessions;constructor(e,r={}){this.tracePath=e,this.maxSessions=r.maxSessions??$e}read(){try{let e=JSON.parse(qe.default.readFileSync(this.tracePath,"utf-8"));if(e&&typeof e=="object"&&!("traceId"in e))return e}catch{}return{}}write(e){try{qe.default.mkdirSync(tr.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(e),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):e;(0,rr.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(e){let r=e||"default",n=(0,Ge.generateUlid)(),o=this.read();return o[r]=n,this.write(o),n}currentTrace(e){let r=e||"default",n=this.read()[r];return n||this.newTrace(r)}};E.DiskSessionTraceManager=ae;var ue=class{map=new Map;maxSessions;constructor(e={}){this.maxSessions=e.maxSessions??$e}newTrace(e){let r=e||"default",n=(0,Ge.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return n}currentTrace(e){let r=e||"default";return this.map.get(r)??this.newTrace(r)}};E.MemorySessionTraceManager=ue});var Ve=h(T=>{"use strict";var ce=T&&T.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(T,"__esModule",{value:!0});T.envFilePath=sr;T.parseEnvFile=Fe;T.loadEnvFile=ir;var nr=ce(require("node:fs")),or=ce(require("node:os")),Ye=ce(require("node:path"));function sr(t,e,r){let n=r?process.env[r]:void 0,o=n&&n.length>0?n:Ye.default.join(or.default.homedir(),t);return Ye.default.join(o,e)}function Fe(t){let e={};for(let r of t.split(`
-`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let o=n.indexOf("=");if(o<0)continue;let i=n.slice(0,o).trim(),a=n.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(e[i]=a)}return e}function ir(t){let e;try{e=nr.default.readFileSync(t,"utf-8")}catch{return}let r=Fe(e);for(let[n,o]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=o)}});var S=h(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var v=z();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return v.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return v.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return v.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return v.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return v.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return v.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return v.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return v.MAX_BYTES}});var _=Z();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var Ke=Ae();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Ke.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Ke.GUARD_STATUS_REFUSED}});var He=ee();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return He.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return He.MemoryRetryQueue}});var k=Ie();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return k.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return k.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return k.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return k.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return k.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return k.MAX_POST_BYTES}});var ze=ie();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return ze.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return ze.generateUlid}});var We=Xe();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return We.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return We.MemorySessionTraceManager}});var le=Ve();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return le.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return le.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return le.loadEnvFile}})});var pe=f(require("node:fs")),Ze=f(require("node:os")),D=f(require("node:path")),Je=f(S());function ar(t){let e={},r;try{r=pe.default.readFileSync(t,"utf-8")}catch{return e}for(let n of r.split(`
-`)){let o=n.trim();if(!o||o.startsWith("#"))continue;let i=o.indexOf("=");if(i<0)continue;let a=o.slice(0,i).trim(),u=o.slice(i+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),a&&(e[a]=u)}return e}function ur(t){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??t.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(e)return e;let r=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??t.OTEL_EXPORTER_OTLP_ENDPOINT;return r?r.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??t.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function cr(t){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(t.OTEL_EXPORTER_OTLP_HEADERS)return t.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(t.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${t.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function Qe(){let t=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),e=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??D.default.join(t,".plugin-data"),r=process.env.CODEX_HOME??D.default.join(Ze.default.homedir(),".codex"),n=D.default.join(r,"pinta-codex.env"),o=pe.default.existsSync(n)?ar(n):{},i=ur(o),a=cr(o);if(a&&!process.env.PINTA_RELAY_TOKEN){let c=a.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let u=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:t,pluginData:e,tracePath:D.default.join(e,"trace.json"),endpoint:i?.replace(/\/+$/,""),headers:(0,Je.parseHeadersEnv)(a??""),guardEndpoint:u}}function et(t){return t.hook_event_name==="PreToolUse"}function tt(t){return t.hook_event_name==="PermissionRequest"}function rt(t){return t.hook_event_name==="PostToolUse"}function nt(t){return t.hook_event_name==="UserPromptSubmit"}function ot(t){return t.hook_event_name==="SessionStart"}function st(t){return t.hook_event_name==="Stop"}var lr=["PreToolUse","PermissionRequest"],pr=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],dr=new Set([...lr,...pr]);function it(t){return!dr.has(t.hook_event_name)}var _t=f(S());var at=f(S()),$=class extends at.DiskTransport{constructor(e){super({pluginData:e.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>e.endpoint?{endpoint:e.endpoint,headers:e.headers}:null})}};var ut=f(S()),X=class extends ut.TraceManager{constructor(e){super(e.tracePath)}};var M=f(require("fs")),V=f(require("os")),lt=f(require("path"));var Y="1.9.0";var b=f(S()),F;function fr(){if(F===void 0)try{F=V.default.userInfo().username}catch{F=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return F}var pt=Y,de;function C(t){return typeof t=="string"&&t.trim()!==""?t.trim():void 0}var ct=256*1024;function mr(t){if(!t)return;let e;try{e=M.default.openSync(t,"r");let r=Buffer.allocUnsafe(ct),n=M.default.readSync(e,r,0,ct,0),o=r.toString("utf8",0,n),i=o.indexOf(`
-`);if(i<0)return;let a=JSON.parse(o.slice(0,i));return a?.type!=="session_meta"?void 0:C(a.payload?.cli_version)}catch{return}finally{if(e!==void 0)try{M.default.closeSync(e)}catch{}}}function _r(){let t=C(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(t)try{let e=JSON.parse(M.default.readFileSync(lt.default.join(t,"package.json"),"utf8"));return C(e.version)}catch{return}}function gr(t){return de===void 0&&(de=mr(C(t?.transcript_path))??_r()??C(process.env.CODEX_CLI_VERSION)??null),de??void 0}var hr=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),yr=new Set(["codex.tool_input","codex.tool_response"]),Pr={skipRedactKeys:hr,bashContextKeys:yr};function Er(t){let e=[];e.push({key:"ingest.type",value:{stringValue:"codex"}}),e.push({key:"codex.hook",value:{stringValue:t.hook_event_name}});let r={};for(let[n,o]of Object.entries(t))n!=="hook_event_name"&&(r[n]=o);return e.push(...(0,b.attrsFromRecord)(r,"codex",Pr)),e}function vr(t){let e=gr(t);return[{key:"service.name",value:{stringValue:"codex"}},...e?[{key:"service.version",value:{stringValue:e}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:pt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:fr()}},{key:"host.name",value:{stringValue:V.default.hostname()}},{key:"host.arch",value:{stringValue:V.default.arch()}}]}function dt(t){return(0,b.buildPayload)({traceId:t.traceId,spanName:`codex.${(0,b.snakeCase)(t.event.hook_event_name)}`,attributes:Er(t.event),resource:vr(t.event),scope:{name:"pinta-codex",version:pt},now:t.now})}function N(t,e,r){let n=new X(e),o=r.trace==="new"?n.newTrace():n.currentTrace();return dt({event:t,traceId:o})}async function j(t,e){let r=new $(e);await r.flush(),await r.send(t)}async function y(t,e,r){await j(N(t,e,r),e)}var ft=f(S());var Sr=50,Or=`pinta-codex/${Y}`;async function mt(t,e){let r=await(0,ft.evaluateGuard)(t,e,{timeoutMs:Sr,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Or});if(r===null)return null;let n={decision:r.decision,reason:r.reason,durationMs:r.durationMs,clientRttMs:r.clientRttMs};return r.failOpenReason!==void 0&&(n.failOpenReason=r.failOpenReason),n}async function K(t,e){return mt(t,e.guardEndpoint)}function H(t){let e=t?.reason;return typeof e=="string"&&e.trim().length>0?e:"guard_deny"}async function gt(t,e){let r=N(t,e,{trace:"current"}),n=await K(r,e);if(n?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:H(n)}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,_t.attachGuard)(r,n),await j(r,e)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}var ht=f(S());async function yt(t,e){let r=N(t,e,{trace:"current"}),n=await K(r,e);if(n?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:H(n)}}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,ht.attachGuard)(r,n),await j(r,e)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}async function Pt(t,e){return await y(t,e,{trace:"current"}),0}async function Et(t,e){return await y(t,e,{trace:"new"}),0}async function vt(t,e){return await y(t,e,{trace:"current"}),0}async function St(t,e){return await y(t,e,{trace:"current"}),0}async function Ot(t,e){return await y(t,e,{trace:"current"}),0}async function Tt(t){return 0}async function Tr(){let t=[];for await(let e of process.stdin)t.push(e);return Buffer.concat(t).toString("utf-8")}async function bt(){let t=0;try{let e=Qe(),r=await Tr(),n=JSON.parse(r);it(n)?t=await Tt(n):et(n)?t=await gt(n,e):tt(n)?t=await yt(n,e):rt(n)?t=await Pt(n,e):nt(n)?t=await Et(n,e):ot(n)?t=await vt(n,e):st(n)?t=await St(n,e):t=await Ot(n,e)}catch(e){process.stderr.write(`[pinta-codex] error: ${e}
-`),t=0}return t}async function br(){let t=await bt();process.exit(t)}br();
+`)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
+`)}}tryAcquireLock(){let t=Date.now();try{g.default.mkdirSync(X.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<fn;)try{let n=g.default.openSync(this.lockPath,"wx");return g.default.writeSync(n,String(process.pid)),g.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let s=g.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){g.default.unlinkSync(this.lockPath);continue}}catch{}let r=pn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{g.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=F)return;let n=t.length-F;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};S.DiskRetryQueue=re;var oe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>F&&this.entries.splice(0,this.entries.length-F)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};S.MemoryRetryQueue=oe});var ze=h(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Fe;l.envOptionsResolver=Ye;l.postOtlp=C;var $e=se(),Ve=ne(),mn=5e3;l.MAX_POST_BYTES=900*1024;function Y(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Xe(e,t,n){let r=[],o=[],s=[],u=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}s.length>0&&u+c>n&&(r.push(s),s=[],u=0),s.push(a),u+=c}return s.length>0&&r.push(s),{chunks:r,oversize:o}}function Fe(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function Ye(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Fe(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function C(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),mn);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let u="";try{u=(await s.text()).slice(0,200)}catch{}let a=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${a}${u?` body=${u}`:""}
+`),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
+`),!1}finally{clearTimeout(o)}}var ie=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new $e.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ye}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await C(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Xe(n,a=>Y(a.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let s=[].concat(...r),u=0;for(let a of r){if(!await C((0,Ve.mergeBatch)(a.map(d=>d.payload)),t,this.logPrefix))break;u+=a.length}this.queue.rewrite(s.slice(u))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=Y(t);return n<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};l.DiskTransport=ie;var ae=class{queue=new $e.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(Y(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await C(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Xe(n,Y,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let s=[].concat(...r),u=0;for(let a of r){if(!await C((0,Ve.mergeBatch)(a),t,this.logPrefix))break;u+=a.length}for(let a of s.slice(u))this.queue.enqueue(a)}};l.MemoryTransport=ae});var le=h(x=>{"use strict";var de=x&&x.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(x,"__esModule",{value:!0});x.TraceManager=void 0;x.generateUlid=He;var Ke=de(require("fs")),_n=de(require("path")),gn=de(require("crypto")),yn=V(),ue="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function He(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=ue[n&31]+t,n=Math.floor(n/32);let r=gn.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=ue[r[s]&31];for(;o.length<16;)o+=ue[0];return t+o}var ce=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=He();return this.save(t),t}currentTrace(){try{let t=Ke.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{Ke.default.mkdirSync(_n.default.dirname(this.tracePath),{recursive:!0}),(0,yn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};x.TraceManager=ce});var et=h(O=>{"use strict";var Ze=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.MemorySessionTraceManager=O.DiskSessionTraceManager=void 0;var We=Ze(require("fs")),hn=Ze(require("path")),Je=le(),Pn=V(),Qe=200,fe=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??Qe}read(){try{let t=JSON.parse(We.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{We.default.mkdirSync(hn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Pn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,Je.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};O.DiskSessionTraceManager=fe;var pe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Qe}newTrace(t){let n=t||"default",r=(0,Je.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};O.MemorySessionTraceManager=pe});var rt=h(k=>{"use strict";var me=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.envFilePath=Sn;k.parseEnvFile=nt;k.loadEnvFile=On;var En=me(require("node:fs")),vn=me(require("node:os")),tt=me(require("node:path"));function Sn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:tt.default.join(vn.default.homedir(),e);return tt.default.join(o,t)}function nt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),u=r.slice(o+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),s&&(t[s]=u)}return t}function On(e){let t;try{t=En.default.readFileSync(e,"utf-8")}catch{return}let n=nt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var b=h(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.GUARD_STATUS_REFUSED=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.attachGuard=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var T=ee();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return T.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return T.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return T.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return T.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return T.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return T.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return T.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return T.MAX_BYTES}});var y=ne();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(i,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var ot=Le();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return ot.evaluateGuard}});Object.defineProperty(i,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ot.GUARD_STATUS_REFUSED}});var st=se();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return st.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return st.MemoryRetryQueue}});var M=ze();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return M.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return M.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return M.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return M.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return M.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return M.MAX_POST_BYTES}});var it=le();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return it.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return it.generateUlid}});var at=et();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return at.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return at.MemorySessionTraceManager}});var _e=rt();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return _e.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return _e.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return _e.loadEnvFile}})});var ge=m(require("node:fs")),ut=m(require("node:os")),j=m(require("node:path")),ct=m(b());function Tn(e){let t={},n;try{n=ge.default.readFileSync(e,"utf-8")}catch{return t}for(let r of n.split(`
+`)){let o=r.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<0)continue;let u=o.slice(0,s).trim(),a=o.slice(s+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),u&&(t[u]=a)}return t}function bn(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let n=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return n?n.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function xn(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function dt(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??j.default.join(e,".plugin-data"),n=process.env.CODEX_HOME??j.default.join(ut.default.homedir(),".codex"),r=j.default.join(n,"pinta-codex.env"),o=ge.default.existsSync(r)?Tn(r):{},s=bn(o),u=xn(o);if(u&&!process.env.PINTA_RELAY_TOKEN){let c=u.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let a=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:j.default.join(t,"trace.json"),endpoint:s?.replace(/\/+$/,""),headers:(0,ct.parseHeadersEnv)(u??""),guardEndpoint:a}}function lt(e){return e.hook_event_name==="PreToolUse"}function ft(e){return e.hook_event_name==="PermissionRequest"}function pt(e){return e.hook_event_name==="PostToolUse"}function mt(e){return e.hook_event_name==="UserPromptSubmit"}function _t(e){return e.hook_event_name==="SessionStart"}function gt(e){return e.hook_event_name==="Stop"}var kn=["PreToolUse","PermissionRequest"],An=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],Rn=new Set([...kn,...An]);function yt(e){return!Rn.has(e.hook_event_name)}var Mt=m(b());var ht=m(b()),z=class extends ht.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Pt=m(b()),K=class extends Pt.TraceManager{constructor(t){super(t.tracePath)}};var B=m(require("fs")),Z=m(require("os")),xt=m(require("path"));var H="1.10.0";var P=m(require("node:fs")),ye=m(require("node:path")),wn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),Mn=256*1024,Dn=1024*1024,Nn=4096;function A(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function he(e){let t=A(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!wn.has(r.toLowerCase())?r:void 0}function Et(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Pe(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function I(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function vt(e,t){let n=e.timestamp===void 0?I(t):I(e.timestamp);return n!==void 0&&n<=t?n:void 0}function St(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!ye.default.isAbsolute(e)||ye.default.extname(e)!==".jsonl")return;let t;try{t=P.default.openSync(e,P.default.constants.O_RDONLY|P.default.constants.O_NONBLOCK|(P.default.constants.O_NOFOLLOW??0));let n=P.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,Mn));if(P.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),s;if(o>=0)try{s=A(JSON.parse(r.toString("utf8",0,o)))}catch{}let u=Math.max(0,n.size-Dn),a=n.size<=r.length?r:Buffer.alloc(n.size-u);if(a!==r&&P.default.readSync(t,a,0,a.length,u)!==a.length)return;let c=P.default.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let d=u>0?a.indexOf(10)+1:0,p=a.lastIndexOf(10);if(u>0&&d===0||p<d)return;let v=[],D=0;for(;p>d&&D<Nn;){let $t=a.lastIndexOf(10,p-1),ve=Math.max(d,$t+1),Se=a.toString("utf8",ve,p).trim();if(Se){let Oe=A(JSON.parse(Se));Oe&&v.push(Oe)}p=ve-1,D++}return v.reverse(),{first:s,rows:v,complete:u===0&&p<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{P.default.closeSync(t)}catch{}}}function Ot(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}function Tt(e,t){let n=he(e.model);if(n)return{name:n,source:"hook.model"};try{return Cn(e,t)}catch{return}}function Cn(e,t){if(e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop")return;let n=Pe(e.session_id),r=Pe(e.turn_id),o=vt(e,t);if(!n||!r||o===void 0||e.agent_id!==void 0&&e.agent_id!==n)return;let s=St(e.transcript_path),u=s?.first,a=I(u?.timestamp);if(!s||u?.type!=="session_meta"||A(u.payload)?.id!==n||a===void 0||a>o||s.rows.some(d=>d.type==="session_meta"&&A(d.payload)?.id!==n))return;let c=[];for(let d of s.rows){let p=A(d.payload),v=I(d.timestamp);if(d.type!=="turn_context"||p?.turn_id!==r||v===void 0||v>o||v<a)continue;let D=he(p.model);c.push(D?{name:D,source:"transcript.turn_context"}:void 0)}return Ot(c)}var R=m(b()),W;function jn(){if(W===void 0)try{W=Z.default.userInfo().username}catch{W=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return W}var kt=H,Ee;function U(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var bt=256*1024;function In(e){if(!e)return;let t;try{t=B.default.openSync(e,"r");let n=Buffer.allocUnsafe(bt),r=B.default.readSync(t,n,0,bt,0),o=n.toString("utf8",0,r),s=o.indexOf(`
+`);if(s<0)return;let u=JSON.parse(o.slice(0,s));return u?.type!=="session_meta"?void 0:U(u.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{B.default.closeSync(t)}catch{}}}function Bn(){let e=U(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(B.default.readFileSync(xt.default.join(e,"package.json"),"utf8"));return U(t.version)}catch{return}}function Un(e){return Ee===void 0&&(Ee=In(U(e?.transcript_path))??Bn()??U(process.env.CODEX_CLI_VERSION)??null),Ee??void 0}var Ln=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),qn=new Set(["codex.tool_input","codex.tool_response"]),Gn={skipRedactKeys:Ln,bashContextKeys:qn};function $n(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"codex"}}),n.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,s]of Object.entries(e))o!=="hook_event_name"&&(r[o]=s);return Et(r,Tt(e,t)),n.push(...(0,R.attrsFromRecord)(r,"codex",Gn)),n}function Vn(e){let t=Un(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:kt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:jn()}},{key:"host.name",value:{stringValue:Z.default.hostname()}},{key:"host.arch",value:{stringValue:Z.default.arch()}}]}function At(e){let t=e.now??Date.now();return(0,R.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,R.snakeCase)(e.event.hook_event_name)}`,attributes:$n(e.event,t),resource:Vn(e.event),scope:{name:"pinta-codex",version:kt},now:t})}function L(e,t,n){let r=new K(t),o=n.trace==="new"?r.newTrace():r.currentTrace();return At({event:e,traceId:o})}async function q(e,t){let n=new z(t);await n.flush(),await n.send(e)}async function E(e,t,n){await q(L(e,t,n),t)}var Rt=m(b());var Xn=50,Fn=`pinta-codex/${H}`;async function wt(e,t){let n=await(0,Rt.evaluateGuard)(e,t,{timeoutMs:Xn,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Fn});if(n===null)return null;let r={decision:n.decision,reason:n.reason,durationMs:n.durationMs,clientRttMs:n.clientRttMs};return n.failOpenReason!==void 0&&(r.failOpenReason=n.failOpenReason),r}async function J(e,t){return wt(e,t.guardEndpoint)}function Q(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function Dt(e,t){let n=L(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Q(r)}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Mt.attachGuard)(n,r),await q(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}var Nt=m(b());async function Ct(e,t){let n=L(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:Q(r)}}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Nt.attachGuard)(n,r),await q(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}async function jt(e,t){return await E(e,t,{trace:"current"}),0}async function It(e,t){return await E(e,t,{trace:"new"}),0}async function Bt(e,t){return await E(e,t,{trace:"current"}),0}async function Ut(e,t){return await E(e,t,{trace:"current"}),0}async function Lt(e,t){return await E(e,t,{trace:"current"}),0}async function qt(e){return 0}async function Yn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Gt(){let e=0;try{let t=dt(),n=await Yn(),r=JSON.parse(n);yt(r)?e=await qt(r):lt(r)?e=await Dt(r,t):ft(r)?e=await Ct(r,t):pt(r)?e=await jt(r,t):mt(r)?e=await It(r,t):_t(r)?e=await Bt(r,t):gt(r)?e=await Ut(r,t):e=await Lt(r,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
+`),e=0}return e}async function zn(){let e=await Gt();process.exit(e)}zn();

package/dist/index.mjs

@@ -1,27 +1,27 @@
 import{createRequire as __pintaCreateRequire}from 'node:module';const require=__pintaCreateRequire(import.meta.url);
-var wt=Object.create;var me=Object.defineProperty;var Dt=Object.getOwnPropertyDescriptor;var Mt=Object.getOwnPropertyNames;var Ct=Object.getPrototypeOf,jt=Object.prototype.hasOwnProperty;var m=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Nt=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Mt(t))!jt.call(e,o)&&o!==r&&me(e,o,{get:()=>t[o],enumerable:!(n=Dt(t,o))||n.enumerable});return e};var E=(e,t,r)=>(r=e!=null?wt(Ct(e)):{},Nt(t||!e||!e.__esModule?me(r,"default",{value:e,enumerable:!0}):r,e));var H=h(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.PATTERNS=d.MAX_BYTES=void 0;d.truncateTo=_e;d.truncate=It;d.collectMatches=ge;d.resolveOverlaps=he;d.applyMatches=ye;d.redact=Bt;d.MAX_BYTES=102400;function _e(e,t){let r=Buffer.from(e,"utf-8");return r.length<=t?e:`${r.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function It(e){return _e(e,d.MAX_BYTES)}d.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function ge(e,t){let r=[];for(let n of d.PATTERNS){if(n.requireContext&&n.requireContext!==t.context)continue;let o=new RegExp(n.regex.source,n.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=n.captureGroup??0,c=i[a];if(c===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let u=i.index,g=i.index+i[0].length,R=u+i[0].indexOf(c),Rt=R+c.length;r.push({start:u,end:g,replaceStart:R,replaceEnd:Rt,type:n.type}),i.index===o.lastIndex&&o.lastIndex++}}return r}function he(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),r=[],n=-1;for(let o of t)o.start<n||(r.push(o),n=o.end);return r}function ye(e,t){let r=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),n=e;for(let o of r)n=n.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+n.slice(o.replaceEnd);return n}function Bt(e,t={}){if(e.length===0)return e;let r=ge(e,t);if(r.length===0)return e;let n=he(r);return ye(e,n)}});var Z=h(p=>{"use strict";var Ut=p&&p.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(p,"__esModule",{value:!0});p.MAX_SPAN_BYTES=void 0;p.ulidToTraceId=Se;p.newSpanId=Te;p.snakeCase=Gt;p.toOtlpValue=Oe;p.attrsFromRecord=Ft;p.guardAttrs=be;p.clientAttrs=xe;p.enforceSpanBudget=Ae;p.buildPayload=$t;p.attachGuard=ke;p.mergeBatch=Xt;var qt=Ut(m("crypto")),W=H(),Lt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Se(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let n of e){let o=Lt.indexOf(n);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);t=t<<5n|BigInt(o)}let r=(1n<<128n)-1n;return t&=r,t.toString(16).padStart(32,"0")}function Te(){return qt.default.randomBytes(8).toString("hex")}function Gt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Pe=new Set;function N(e,t,r){let n=(0,W.truncate)(t);if((r.skipRedactKeys??Pe).has(e))return n;let o=(r.bashContextKeys??Pe).has(e)?"bash":void 0;return(0,W.redact)(n,{context:o})}function Oe(e,t,r={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:N(e,t,r)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:N(e,JSON.stringify(t),r)}}catch{return{stringValue:N(e,String(t),r)}}default:return{stringValue:N(e,String(t),r)}}}function Ft(e,t,r={}){let n=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,c=Oe(a,i,r);c!==null&&n.push({key:a,value:c})}return n}function be(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function xe(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}p.MAX_SPAN_BYTES=800*1024;function Ee(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var ve=1024;function Ae(e,t=p.MAX_SPAN_BYTES){let r=Ee(e);for(let n=0;n<100&&r>t;n++){let o=null,i=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let g=Buffer.byteLength(u.value.stringValue,"utf-8");g>i&&(i=g,o=u.value)}if(o===null||i<=ve)break;let a=r-t,c=Math.max(ve,i-a-64);o.stringValue=(0,W.truncateTo)(o.stringValue,c),r=Ee(e)}return e}function $t(e){let t=e.now??Date.now(),r=(BigInt(t)*1000000n).toString(),n=[...e.attributes],o={traceId:Se(e.traceId),spanId:Te(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};Ae(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return ke(i,e.guard,e.clientTiming)}function ke(e,t,r){let n=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!n)return e;t&&n.attributes.push(...be(t));let o=r??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&n.attributes.push(...xe(o)),e}function Xt(e){let t=[];for(let r of e)t.push(...r.resourceSpans);return{resourceSpans:t}}});var Re=h(A=>{"use strict";Object.defineProperty(A,"__esModule",{value:!0});A.GUARD_STATUS_REFUSED=void 0;A.evaluateGuard=zt;var Yt=1e4,Vt="pinta-core";function I(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Kt=new Set(["ALLOW","DENY","REVIEW"]);A.GUARD_STATUS_REFUSED=410;async function zt(e,t,r={}){if(!t||r.disabled)return null;let n=r.timeoutMs??Yt,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),n);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??Vt,"x-pinta-relay-token":r.token??"",...r.agentType?{"x-pinta-agent-type":r.agentType}:{}},body:JSON.stringify(e),signal:i.signal});if(c.status===A.GUARD_STATUS_REFUSED)return I(Date.now()-o,"refused");if(c.status!==200)return I(Date.now()-o,"error");let u=await c.json(),g=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!Kt.has(u.decision)||!g)return I(Date.now()-o,"error");let R=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??R,clientRttMs:R}}catch(c){let u=c.name,g=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return I(Date.now()-o,g)}finally{clearTimeout(a)}}});var B=h(w=>{"use strict";var Ht=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.atomicWriteFileSync=Wt;var we=Ht(m("fs"));function Wt(e,t){let r=`${e}.${process.pid}.tmp`;we.default.writeFileSync(r,t),we.default.renameSync(r,e)}});var ee=h(v=>{"use strict";var De=v&&v.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(v,"__esModule",{value:!0});v.MemoryRetryQueue=v.DiskRetryQueue=void 0;var f=De(m("fs")),U=De(m("path")),Zt=B(),q=1e3,Jt=50,Qt=5,J=class{filePath;lockPath;logPrefix;constructor(t,r){this.filePath=U.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(t){try{f.default.mkdirSync(U.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;f.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
-`)}}readAll(){try{let t=f.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of t.split(`
-`))if(n.trim())try{let o=JSON.parse(n);Array.isArray(o?.payload?.resourceSpans)&&r.push(o)}catch{}return r}catch{return[]}}rewrite(t){try{if(t.length===0){f.default.existsSync(this.filePath)&&f.default.unlinkSync(this.filePath);return}f.default.mkdirSync(U.default.dirname(this.filePath),{recursive:!0}),(0,Zt.atomicWriteFileSync)(this.filePath,t.map(r=>JSON.stringify(r)).join(`
+var Yt=Object.create;var Oe=Object.defineProperty;var zt=Object.getOwnPropertyDescriptor;var Kt=Object.getOwnPropertyNames;var Wt=Object.getPrototypeOf,Ht=Object.prototype.hasOwnProperty;var g=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Zt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Kt(t))!Ht.call(e,o)&&o!==n&&Oe(e,o,{get:()=>t[o],enumerable:!(r=zt(t,o))||r.enumerable});return e};var T=(e,t,n)=>(n=e!=null?Yt(Wt(e)):{},Zt(t||!e||!e.__esModule?Oe(n,"default",{value:e,enumerable:!0}):n,e));var ee=h(m=>{"use strict";Object.defineProperty(m,"__esModule",{value:!0});m.PATTERNS=m.MAX_BYTES=void 0;m.truncateTo=be;m.truncate=Jt;m.collectMatches=xe;m.resolveOverlaps=Ae;m.applyMatches=ke;m.redact=Qt;m.MAX_BYTES=102400;function be(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Jt(e){return be(e,m.MAX_BYTES)}m.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function xe(e,t){let n=[];for(let r of m.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=o.exec(e))!==null;){let u=r.captureGroup??0,a=s[u];if(a===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let c=s.index,l=s.index+s[0].length,p=c+s[0].indexOf(a),E=p+a.length;n.push({start:c,end:l,replaceStart:p,replaceEnd:E,type:r.type}),s.index===o.lastIndex&&o.lastIndex++}}return n}function Ae(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function ke(e,t){let n=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function Qt(e,t={}){if(e.length===0)return e;let n=xe(e,t);if(n.length===0)return e;let r=Ae(n);return ke(e,r)}});var ne=h(f=>{"use strict";var en=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=De;f.newSpanId=Ne;f.snakeCase=rn;f.toOtlpValue=Ce;f.attrsFromRecord=on;f.guardAttrs=je;f.clientAttrs=Ie;f.enforceSpanBudget=Be;f.buildPayload=sn;f.attachGuard=Ue;f.mergeBatch=an;var tn=en(g("crypto")),te=ee(),nn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function De(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=nn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ne(){return tn.default.randomBytes(8).toString("hex")}function rn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Re=new Set;function q(e,t,n){let r=(0,te.truncate)(t);if((n.skipRedactKeys??Re).has(e))return r;let o=(n.bashContextKeys??Re).has(e)?"bash":void 0;return(0,te.redact)(r,{context:o})}function Ce(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:q(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:q(e,JSON.stringify(t),n)}}catch{return{stringValue:q(e,String(t),n)}}default:return{stringValue:q(e,String(t),n)}}}function on(e,t,n={}){let r=[];for(let[o,s]of Object.entries(e)){let u=`${t}.${o}`,a=Ce(u,s,n);a!==null&&r.push({key:u,value:a})}return r}function je(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ie(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function we(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Me=1024;function Be(e,t=f.MAX_SPAN_BYTES){let n=we(e);for(let r=0;r<100&&n>t;r++){let o=null,s=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>s&&(s=l,o=c.value)}if(o===null||s<=Me)break;let u=n-t,a=Math.max(Me,s-u-64);o.stringValue=(0,te.truncateTo)(o.stringValue,a),n=we(e)}return e}function sn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:De(e.traceId),spanId:Ne(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Be(o);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Ue(s,e.guard,e.clientTiming)}function Ue(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...je(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Ie(o)),e}function an(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Le=h(M=>{"use strict";Object.defineProperty(M,"__esModule",{value:!0});M.GUARD_STATUS_REFUSED=void 0;M.evaluateGuard=dn;var un=1e4,cn="pinta-core";function F(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var ln=new Set(["ALLOW","DENY","REVIEW"]);M.GUARD_STATUS_REFUSED=410;async function dn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??un,o=Date.now(),s=new AbortController,u=setTimeout(()=>s.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??cn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{}},body:JSON.stringify(e),signal:s.signal});if(a.status===M.GUARD_STATUS_REFUSED)return F(Date.now()-o,"refused");if(a.status!==200)return F(Date.now()-o,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!ln.has(c.decision)||!l)return F(Date.now()-o,"error");let p=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??p,clientRttMs:p}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return F(Date.now()-o,l)}finally{clearTimeout(u)}}});var G=h(C=>{"use strict";var fn=C&&C.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(C,"__esModule",{value:!0});C.atomicWriteFileSync=pn;var qe=fn(g("fs"));function pn(e,t){let n=`${e}.${process.pid}.tmp`;qe.default.writeFileSync(n,t),qe.default.renameSync(n,e)}});var se=h(O=>{"use strict";var Fe=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.MemoryRetryQueue=O.DiskRetryQueue=void 0;var _=Fe(g("fs")),$=Fe(g("path")),mn=G(),X=1e3,_n=50,gn=5,re=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=$.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{_.default.mkdirSync($.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;_.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=_.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){_.default.existsSync(this.filePath)&&_.default.unlinkSync(this.filePath);return}_.default.mkdirSync($.default.dirname(this.filePath),{recursive:!0}),(0,mn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
-`)}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${r}
-`)}}tryAcquireLock(){let t=Date.now();try{f.default.mkdirSync(U.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
-`),!1}for(;Date.now()-t<Jt;)try{let r=f.default.openSync(this.lockPath,"wx");return f.default.writeSync(r,String(process.pid)),f.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
-`),!1;try{let i=f.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){f.default.unlinkSync(this.lockPath);continue}}catch{}let n=Qt,o=Date.now()+n;for(;Date.now()<o;);}return!1}release(){try{f.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=q)return;let r=t.length-q;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
-`),this.rewrite(t.slice(r))}};v.DiskRetryQueue=J;var Q=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>q&&this.entries.splice(0,this.entries.length-q)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};v.MemoryRetryQueue=Q});var Be=h(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Ne;l.envOptionsResolver=Ie;l.postOtlp=D;var Me=ee(),Ce=Z(),er=5e3;l.MAX_POST_BYTES=900*1024;function L(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function je(e,t,r){let n=[],o=[],i=[],a=0;for(let c of e){let u=t(c);if(u>r){o.push(c);continue}i.length>0&&a+u>r&&(n.push(i),i=[],a=0),i.push(c),a+=u}return i.length>0&&n.push(i),{chunks:n,oversize:o}}function Ne(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let r of e.split(",")){let[n,...o]=r.split("=");n&&o.length>0&&(t[n.trim()]=o.join("=").trim())}return t}function Ie(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return e?r=e.replace(/\/+$/,""):t&&(r=t.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Ne(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function D(e,t,r){let n=new AbortController,o=setTimeout(()=>n.abort(),er);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:n.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let c=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${i.status} ${t.endpoint}${c}${a?` body=${a}`:""}
-`),!1}return!0}catch(i){return process.stderr.write(`[${r}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var te=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Me.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ie}async send(t){let r=this.resolveOptions();if(!r||this.dropIfOversized(t))return;await D(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:o}=je(r,c=>L(c.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...n),a=0;for(let c of n){if(!await D((0,Ce.mergeBatch)(c.map(g=>g.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(i.slice(a))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let r=L(t);return r<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=te;var re=class{queue=new Me.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let r=this.resolveOptions();if(!r)return;if(L(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await D(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:o}=je(r,L,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...n),a=0;for(let c of n){if(!await D((0,Ce.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of i.slice(a))this.queue.enqueue(c)}};l.MemoryTransport=re});var ie=h(O=>{"use strict";var se=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.TraceManager=void 0;O.generateUlid=qe;var Ue=se(m("fs")),tr=se(m("path")),rr=se(m("crypto")),nr=B(),ne="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function qe(){let e=Date.now(),t="",r=e;for(let i=0;i<10;i++)t=ne[r&31]+t,r=Math.floor(r/32);let n=rr.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=ne[n[i]&31];for(;o.length<16;)o+=ne[0];return t+o}var oe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=qe();return this.save(t),t}currentTrace(){try{let t=Ue.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(t);if(r)return r}catch{}return this.newTrace()}save(t){try{Ue.default.mkdirSync(tr.default.dirname(this.tracePath),{recursive:!0}),(0,nr.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
-`)}}};O.TraceManager=oe});var Xe=h(S=>{"use strict";var Ge=S&&S.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(S,"__esModule",{value:!0});S.MemorySessionTraceManager=S.DiskSessionTraceManager=void 0;var Le=Ge(m("fs")),or=Ge(m("path")),Fe=ie(),sr=B(),$e=200,ae=class{tracePath;maxSessions;constructor(t,r={}){this.tracePath=t,this.maxSessions=r.maxSessions??$e}read(){try{let t=JSON.parse(Le.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Le.default.mkdirSync(or.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(t),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):t;(0,sr.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(t){let r=t||"default",n=(0,Fe.generateUlid)(),o=this.read();return o[r]=n,this.write(o),n}currentTrace(t){let r=t||"default",n=this.read()[r];return n||this.newTrace(r)}};S.DiskSessionTraceManager=ae;var ce=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??$e}newTrace(t){let r=t||"default",n=(0,Fe.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return n}currentTrace(t){let r=t||"default";return this.map.get(r)??this.newTrace(r)}};S.MemorySessionTraceManager=ce});var Ke=h(b=>{"use strict";var ue=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.envFilePath=cr;b.parseEnvFile=Ve;b.loadEnvFile=ur;var ir=ue(m("node:fs")),ar=ue(m("node:os")),Ye=ue(m("node:path"));function cr(e,t,r){let n=r?process.env[r]:void 0,o=n&&n.length>0?n:Ye.default.join(ar.default.homedir(),e);return Ye.default.join(o,t)}function Ve(e){let t={};for(let r of e.split(`
-`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let o=n.indexOf("=");if(o<0)continue;let i=n.slice(0,o).trim(),a=n.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function ur(e){let t;try{t=ir.default.readFileSync(e,"utf-8")}catch{return}let r=Ve(t);for(let[n,o]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=o)}});var P=h(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var T=H();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return T.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return T.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return T.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return T.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return T.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return T.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return T.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return T.MAX_BYTES}});var _=Z();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var ze=Re();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return ze.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ze.GUARD_STATUS_REFUSED}});var He=ee();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return He.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return He.MemoryRetryQueue}});var k=Be();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return k.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return k.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return k.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return k.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return k.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return k.MAX_POST_BYTES}});var We=ie();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return We.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return We.generateUlid}});var Ze=Xe();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return Ze.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return Ze.MemorySessionTraceManager}});var le=Ke();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return le.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return le.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return le.loadEnvFile}})});import{realpathSync as Gr}from"node:fs";import{pathToFileURL as Fr}from"node:url";var Qe=E(P());import Je from"node:fs";import lr from"node:os";import G from"node:path";function pr(e){let t={},r;try{r=Je.readFileSync(e,"utf-8")}catch{return t}for(let n of r.split(`
-`)){let o=n.trim();if(!o||o.startsWith("#"))continue;let i=o.indexOf("=");if(i<0)continue;let a=o.slice(0,i).trim(),c=o.slice(i+1).trim();(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),a&&(t[a]=c)}return t}function dr(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let r=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return r?r.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function fr(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function et(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??G.join(e,".plugin-data"),r=process.env.CODEX_HOME??G.join(lr.homedir(),".codex"),n=G.join(r,"pinta-codex.env"),o=Je.existsSync(n)?pr(n):{},i=dr(o),a=fr(o);if(a&&!process.env.PINTA_RELAY_TOKEN){let u=a.match(/x-pinta-relay-token=([^,\s]+)/i);u&&(process.env.PINTA_RELAY_TOKEN=u[1])}let c=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:G.join(t,"trace.json"),endpoint:i?.replace(/\/+$/,""),headers:(0,Qe.parseHeadersEnv)(a??""),guardEndpoint:c}}function tt(e){return e.hook_event_name==="PreToolUse"}function rt(e){return e.hook_event_name==="PermissionRequest"}function nt(e){return e.hook_event_name==="PostToolUse"}function ot(e){return e.hook_event_name==="UserPromptSubmit"}function st(e){return e.hook_event_name==="SessionStart"}function it(e){return e.hook_event_name==="Stop"}var mr=["PreToolUse","PermissionRequest"],_r=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],gr=new Set([...mr,..._r]);function at(e){return!gr.has(e.hook_event_name)}var _t=E(P());var ct=E(P()),F=class extends ct.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var ut=E(P()),$=class extends ut.TraceManager{constructor(t){super(t.tracePath)}};import V from"fs";import de from"os";import hr from"path";var X="1.9.0";var x=E(P()),Y;function yr(){if(Y===void 0)try{Y=de.userInfo().username}catch{Y=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return Y}var pt=X,pe;function M(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var lt=256*1024;function Pr(e){if(!e)return;let t;try{t=V.openSync(e,"r");let r=Buffer.allocUnsafe(lt),n=V.readSync(t,r,0,lt,0),o=r.toString("utf8",0,n),i=o.indexOf(`
-`);if(i<0)return;let a=JSON.parse(o.slice(0,i));return a?.type!=="session_meta"?void 0:M(a.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{V.closeSync(t)}catch{}}}function Er(){let e=M(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(V.readFileSync(hr.join(e,"package.json"),"utf8"));return M(t.version)}catch{return}}function vr(e){return pe===void 0&&(pe=Pr(M(e?.transcript_path))??Er()??M(process.env.CODEX_CLI_VERSION)??null),pe??void 0}var Sr=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),Tr=new Set(["codex.tool_input","codex.tool_response"]),Or={skipRedactKeys:Sr,bashContextKeys:Tr};function br(e){let t=[];t.push({key:"ingest.type",value:{stringValue:"codex"}}),t.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[n,o]of Object.entries(e))n!=="hook_event_name"&&(r[n]=o);return t.push(...(0,x.attrsFromRecord)(r,"codex",Or)),t}function xr(e){let t=vr(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:pt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:yr()}},{key:"host.name",value:{stringValue:de.hostname()}},{key:"host.arch",value:{stringValue:de.arch()}}]}function dt(e){return(0,x.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,x.snakeCase)(e.event.hook_event_name)}`,attributes:br(e.event),resource:xr(e.event),scope:{name:"pinta-codex",version:pt},now:e.now})}function C(e,t,r){let n=new $(t),o=r.trace==="new"?n.newTrace():n.currentTrace();return dt({event:e,traceId:o})}async function j(e,t){let r=new F(t);await r.flush(),await r.send(e)}async function y(e,t,r){await j(C(e,t,r),t)}var ft=E(P());var Ar=50,kr=`pinta-codex/${X}`;async function mt(e,t){let r=await(0,ft.evaluateGuard)(e,t,{timeoutMs:Ar,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:kr});if(r===null)return null;let n={decision:r.decision,reason:r.reason,durationMs:r.durationMs,clientRttMs:r.clientRttMs};return r.failOpenReason!==void 0&&(n.failOpenReason=r.failOpenReason),n}async function K(e,t){return mt(e,t.guardEndpoint)}function z(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function gt(e,t){let r=C(e,t,{trace:"current"}),n=await K(r,t);if(n?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:z(n)}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,_t.attachGuard)(r,n),await j(r,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}var ht=E(P());async function yt(e,t){let r=C(e,t,{trace:"current"}),n=await K(r,t);if(n?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:z(n)}}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,ht.attachGuard)(r,n),await j(r,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}async function Pt(e,t){return await y(e,t,{trace:"current"}),0}async function Et(e,t){return await y(e,t,{trace:"new"}),0}async function vt(e,t){return await y(e,t,{trace:"current"}),0}async function St(e,t){return await y(e,t,{trace:"current"}),0}async function Tt(e,t){return await y(e,t,{trace:"current"}),0}async function Ot(e){return 0}async function Rr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function bt(){let e=0;try{let t=et(),r=await Rr(),n=JSON.parse(r);at(n)?e=await Ot(n):tt(n)?e=await gt(n,t):rt(n)?e=await yt(n,t):nt(n)?e=await Pt(n,t):ot(n)?e=await Et(n,t):st(n)?e=await vt(n,t):it(n)?e=await St(n,t):e=await Tt(n,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
-`),e=0}return e}var xt=E(P());import{opendir as wr,stat as Dr}from"node:fs/promises";import fe from"node:path";var Mr="pinta-codex",Cr=/^rollout-.+-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/;function jr(){return(0,xt.envFilePath)(".codex","sessions","CODEX_HOME")}function Nr(e,t){return fe.relative(e,t).split(fe.sep).join("/")}function Ir(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function Br(e){return e.endsWith(".jsonl")?"session-log":"other"}function Ur(e){let t=e.slice(e.lastIndexOf("/")+1);return Cr.exec(t)?.[1]}async function At(){return[jr()]}async function*kt(e,t){let r;try{r=await wr(t)}catch{return}try{for await(let n of r){let o=fe.join(t,n.name);n.isDirectory()?yield*kt(e,o):n.isFile()&&(yield{absPath:o,relPath:Nr(e,o)})}}catch{return}}async function*qr(e){let[t]=await At(),r=e.since?.getTime();for await(let{absPath:n,relPath:o}of kt(t,t)){let i;try{i=await Dr(n)}catch{continue}r!==void 0&&i.mtime.getTime()<=r||(yield{relPath:o,absPath:n,size:i.size,mtime:i.mtime,sessionId:Ur(o),semantics:Ir(o)})}}var Lr={id:Mr,roots:At,scan:qr,classify:Br};function $r(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===Fr(Gr(e)).href}catch{return!1}}async function Xr(){let e=await bt();process.exit(e)}$r()&&Xr();export{Lr as lifecycle};
+`)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
+`)}}tryAcquireLock(){let t=Date.now();try{_.default.mkdirSync($.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<_n;)try{let n=_.default.openSync(this.lockPath,"wx");return _.default.writeSync(n,String(process.pid)),_.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let s=_.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){_.default.unlinkSync(this.lockPath);continue}}catch{}let r=gn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{_.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=X)return;let n=t.length-X;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};O.DiskRetryQueue=re;var oe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>X&&this.entries.splice(0,this.entries.length-X)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};O.MemoryRetryQueue=oe});var ze=h(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.MemoryTransport=d.DiskTransport=d.MAX_POST_BYTES=void 0;d.parseHeadersEnv=Ve;d.envOptionsResolver=Ye;d.postOtlp=j;var Ge=se(),$e=ne(),yn=5e3;d.MAX_POST_BYTES=900*1024;function V(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Xe(e,t,n){let r=[],o=[],s=[],u=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}s.length>0&&u+c>n&&(r.push(s),s=[],u=0),s.push(a),u+=c}return s.length>0&&r.push(s),{chunks:r,oversize:o}}function Ve(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function Ye(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Ve(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function j(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),yn);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let u="";try{u=(await s.text()).slice(0,200)}catch{}let a=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${a}${u?` body=${u}`:""}
+`),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
+`),!1}finally{clearTimeout(o)}}var ie=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ge.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ye}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await j(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Xe(n,a=>V(a.payload),d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${d.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let s=[].concat(...r),u=0;for(let a of r){if(!await j((0,$e.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;u+=a.length}this.queue.rewrite(s.slice(u))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=V(t);return n<=d.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};d.DiskTransport=ie;var ae=class{queue=new Ge.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(V(t)>d.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await j(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Xe(n,V,d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${d.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let s=[].concat(...r),u=0;for(let a of r){if(!await j((0,$e.mergeBatch)(a),t,this.logPrefix))break;u+=a.length}for(let a of s.slice(u))this.queue.enqueue(a)}};d.MemoryTransport=ae});var de=h(A=>{"use strict";var le=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.TraceManager=void 0;A.generateUlid=We;var Ke=le(g("fs")),hn=le(g("path")),Pn=le(g("crypto")),En=G(),ue="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function We(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=ue[n&31]+t,n=Math.floor(n/32);let r=Pn.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=ue[r[s]&31];for(;o.length<16;)o+=ue[0];return t+o}var ce=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=We();return this.save(t),t}currentTrace(){try{let t=Ke.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{Ke.default.mkdirSync(hn.default.dirname(this.tracePath),{recursive:!0}),(0,En.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};A.TraceManager=ce});var et=h(b=>{"use strict";var Ze=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.MemorySessionTraceManager=b.DiskSessionTraceManager=void 0;var He=Ze(g("fs")),vn=Ze(g("path")),Je=de(),Sn=G(),Qe=200,fe=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??Qe}read(){try{let t=JSON.parse(He.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{He.default.mkdirSync(vn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Sn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,Je.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};b.DiskSessionTraceManager=fe;var pe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Qe}newTrace(t){let n=t||"default",r=(0,Je.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};b.MemorySessionTraceManager=pe});var rt=h(k=>{"use strict";var me=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.envFilePath=bn;k.parseEnvFile=nt;k.loadEnvFile=xn;var Tn=me(g("node:fs")),On=me(g("node:os")),tt=me(g("node:path"));function bn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:tt.default.join(On.default.homedir(),e);return tt.default.join(o,t)}function nt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),u=r.slice(o+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),s&&(t[s]=u)}return t}function xn(e){let t;try{t=Tn.default.readFileSync(e,"utf-8")}catch{return}let n=nt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var v=h(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.GUARD_STATUS_REFUSED=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.attachGuard=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var x=ee();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return x.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return x.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return x.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return x.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return x.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return x.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return x.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return x.MAX_BYTES}});var y=ne();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(i,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var ot=Le();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return ot.evaluateGuard}});Object.defineProperty(i,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ot.GUARD_STATUS_REFUSED}});var st=se();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return st.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return st.MemoryRetryQueue}});var D=ze();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return D.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return D.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return D.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return D.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return D.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return D.MAX_POST_BYTES}});var it=de();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return it.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return it.generateUlid}});var at=et();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return at.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return at.MemorySessionTraceManager}});var _e=rt();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return _e.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return _e.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return _e.loadEnvFile}})});import{realpathSync as cr}from"node:fs";import{pathToFileURL as lr}from"node:url";var ct=T(v());import ut from"node:fs";import An from"node:os";import Y from"node:path";function kn(e){let t={},n;try{n=ut.readFileSync(e,"utf-8")}catch{return t}for(let r of n.split(`
+`)){let o=r.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<0)continue;let u=o.slice(0,s).trim(),a=o.slice(s+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),u&&(t[u]=a)}return t}function Rn(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let n=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return n?n.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function wn(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function lt(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??Y.join(e,".plugin-data"),n=process.env.CODEX_HOME??Y.join(An.homedir(),".codex"),r=Y.join(n,"pinta-codex.env"),o=ut.existsSync(r)?kn(r):{},s=Rn(o),u=wn(o);if(u&&!process.env.PINTA_RELAY_TOKEN){let c=u.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let a=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:Y.join(t,"trace.json"),endpoint:s?.replace(/\/+$/,""),headers:(0,ct.parseHeadersEnv)(u??""),guardEndpoint:a}}function dt(e){return e.hook_event_name==="PreToolUse"}function ft(e){return e.hook_event_name==="PermissionRequest"}function pt(e){return e.hook_event_name==="PostToolUse"}function mt(e){return e.hook_event_name==="UserPromptSubmit"}function _t(e){return e.hook_event_name==="SessionStart"}function gt(e){return e.hook_event_name==="Stop"}var Mn=["PreToolUse","PermissionRequest"],Dn=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],Nn=new Set([...Mn,...Dn]);function yt(e){return!Nn.has(e.hook_event_name)}var Mt=T(v());var ht=T(v()),z=class extends ht.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Pt=T(v()),K=class extends Pt.TraceManager{constructor(t){super(t.tracePath)}};import Z from"fs";import Pe from"os";import Ln from"path";var W="1.10.0";import S from"node:fs";import Et from"node:path";var Cn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),jn=256*1024,In=1024*1024,Bn=4096;function R(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function ge(e){let t=R(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Cn.has(r.toLowerCase())?r:void 0}function vt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function ye(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function I(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function St(e,t){let n=e.timestamp===void 0?I(t):I(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Tt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Et.isAbsolute(e)||Et.extname(e)!==".jsonl")return;let t;try{t=S.openSync(e,S.constants.O_RDONLY|S.constants.O_NONBLOCK|(S.constants.O_NOFOLLOW??0));let n=S.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,jn));if(S.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),s;if(o>=0)try{s=R(JSON.parse(r.toString("utf8",0,o)))}catch{}let u=Math.max(0,n.size-In),a=n.size<=r.length?r:Buffer.alloc(n.size-u);if(a!==r&&S.readSync(t,a,0,a.length,u)!==a.length)return;let c=S.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=u>0?a.indexOf(10)+1:0,p=a.lastIndexOf(10);if(u>0&&l===0||p<l)return;let E=[],N=0;for(;p>l&&N<Bn;){let Vt=a.lastIndexOf(10,p-1),ve=Math.max(l,Vt+1),Se=a.toString("utf8",ve,p).trim();if(Se){let Te=R(JSON.parse(Se));Te&&E.push(Te)}p=ve-1,N++}return E.reverse(),{first:s,rows:E,complete:u===0&&p<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{S.closeSync(t)}catch{}}}function Ot(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}function bt(e,t){let n=ge(e.model);if(n)return{name:n,source:"hook.model"};try{return Un(e,t)}catch{return}}function Un(e,t){if(e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop")return;let n=ye(e.session_id),r=ye(e.turn_id),o=St(e,t);if(!n||!r||o===void 0||e.agent_id!==void 0&&e.agent_id!==n)return;let s=Tt(e.transcript_path),u=s?.first,a=I(u?.timestamp);if(!s||u?.type!=="session_meta"||R(u.payload)?.id!==n||a===void 0||a>o||s.rows.some(l=>l.type==="session_meta"&&R(l.payload)?.id!==n))return;let c=[];for(let l of s.rows){let p=R(l.payload),E=I(l.timestamp);if(l.type!=="turn_context"||p?.turn_id!==r||E===void 0||E>o||E<a)continue;let N=ge(p.model);c.push(N?{name:N,source:"transcript.turn_context"}:void 0)}return Ot(c)}var w=T(v()),H;function qn(){if(H===void 0)try{H=Pe.userInfo().username}catch{H=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return H}var At=W,he;function B(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var xt=256*1024;function Fn(e){if(!e)return;let t;try{t=Z.openSync(e,"r");let n=Buffer.allocUnsafe(xt),r=Z.readSync(t,n,0,xt,0),o=n.toString("utf8",0,r),s=o.indexOf(`
+`);if(s<0)return;let u=JSON.parse(o.slice(0,s));return u?.type!=="session_meta"?void 0:B(u.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{Z.closeSync(t)}catch{}}}function Gn(){let e=B(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(Z.readFileSync(Ln.join(e,"package.json"),"utf8"));return B(t.version)}catch{return}}function $n(e){return he===void 0&&(he=Fn(B(e?.transcript_path))??Gn()??B(process.env.CODEX_CLI_VERSION)??null),he??void 0}var Xn=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),Vn=new Set(["codex.tool_input","codex.tool_response"]),Yn={skipRedactKeys:Xn,bashContextKeys:Vn};function zn(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"codex"}}),n.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,s]of Object.entries(e))o!=="hook_event_name"&&(r[o]=s);return vt(r,bt(e,t)),n.push(...(0,w.attrsFromRecord)(r,"codex",Yn)),n}function Kn(e){let t=$n(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:At}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:qn()}},{key:"host.name",value:{stringValue:Pe.hostname()}},{key:"host.arch",value:{stringValue:Pe.arch()}}]}function kt(e){let t=e.now??Date.now();return(0,w.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,w.snakeCase)(e.event.hook_event_name)}`,attributes:zn(e.event,t),resource:Kn(e.event),scope:{name:"pinta-codex",version:At},now:t})}function U(e,t,n){let r=new K(t),o=n.trace==="new"?r.newTrace():r.currentTrace();return kt({event:e,traceId:o})}async function L(e,t){let n=new z(t);await n.flush(),await n.send(e)}async function P(e,t,n){await L(U(e,t,n),t)}var Rt=T(v());var Wn=50,Hn=`pinta-codex/${W}`;async function wt(e,t){let n=await(0,Rt.evaluateGuard)(e,t,{timeoutMs:Wn,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Hn});if(n===null)return null;let r={decision:n.decision,reason:n.reason,durationMs:n.durationMs,clientRttMs:n.clientRttMs};return n.failOpenReason!==void 0&&(r.failOpenReason=n.failOpenReason),r}async function J(e,t){return wt(e,t.guardEndpoint)}function Q(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function Dt(e,t){let n=U(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Q(r)}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Mt.attachGuard)(n,r),await L(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}var Nt=T(v());async function Ct(e,t){let n=U(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:Q(r)}}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Nt.attachGuard)(n,r),await L(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}async function jt(e,t){return await P(e,t,{trace:"current"}),0}async function It(e,t){return await P(e,t,{trace:"new"}),0}async function Bt(e,t){return await P(e,t,{trace:"current"}),0}async function Ut(e,t){return await P(e,t,{trace:"current"}),0}async function Lt(e,t){return await P(e,t,{trace:"current"}),0}async function qt(e){return 0}async function Zn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Ft(){let e=0;try{let t=lt(),n=await Zn(),r=JSON.parse(n);yt(r)?e=await qt(r):dt(r)?e=await Dt(r,t):ft(r)?e=await Ct(r,t):pt(r)?e=await jt(r,t):mt(r)?e=await It(r,t):_t(r)?e=await Bt(r,t):gt(r)?e=await Ut(r,t):e=await Lt(r,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
+`),e=0}return e}var Gt=T(v());import{opendir as Jn,stat as Qn}from"node:fs/promises";import Ee from"node:path";var er="pinta-codex",tr=/^rollout-.+-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/;function nr(){return(0,Gt.envFilePath)(".codex","sessions","CODEX_HOME")}function rr(e,t){return Ee.relative(e,t).split(Ee.sep).join("/")}function or(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function sr(e){return e.endsWith(".jsonl")?"session-log":"other"}function ir(e){let t=e.slice(e.lastIndexOf("/")+1);return tr.exec(t)?.[1]}async function $t(){return[nr()]}async function*Xt(e,t){let n;try{n=await Jn(t)}catch{return}try{for await(let r of n){let o=Ee.join(t,r.name);r.isDirectory()?yield*Xt(e,o):r.isFile()&&(yield{absPath:o,relPath:rr(e,o)})}}catch{return}}async function*ar(e){let[t]=await $t(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of Xt(t,t)){let s;try{s=await Qn(r)}catch{continue}n!==void 0&&s.mtime.getTime()<=n||(yield{relPath:o,absPath:r,size:s.size,mtime:s.mtime,sessionId:ir(o),semantics:or(o)})}}var ur={id:er,roots:$t,scan:ar,classify:sr};function dr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===lr(cr(e)).href}catch{return!1}}async function fr(){let e=await Ft();process.exit(e)}dr()&&fr();export{ur as lifecycle};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinta-ai/pinta-codex",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Generic OTLP forwarder for Codex hook events",
   "main": "dist/index.js",
   "exports": {
@@ -45,6 +45,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "smoke:import": "node scripts/smoke-import.mjs",
+    "smoke:model": "node scripts/smoke-model.mjs",
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {