@pinta-ai/pinta-codex 1.9.0 → 1.11.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pinta-codex",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Generic OTLP forwarder for Codex hook events",
   "author": {
     "name": "Pinta AI",

package/CHANGELOG.md

@@ -2,6 +2,43 @@
 
 All notable changes to pinta-codex are documented here.
 
+## [1.11.0] - 2026-09-30
+
+### Changed
+
+- The guard gate now waits 100ms for a verdict, up from 50ms (PTA-579). At 50ms
+  the prod p99 of answers that did come back (58ms) already sat past the cut,
+  so slow-but-real verdicts were thrown away as `timeout` fail-opens.
+- The gate declares that budget to the manager. `@pinta-ai/core` `^0.8.0` →
+  `^0.9.0`, which sends the timeout as `x-pinta-guard-budget-ms`. Manager
+  0.1.10+ reads it instead of the adaptor table it keeps, which still says 50
+  for pinta-codex. Without the header the manager gives up on the backend
+  package check at 40ms. With it the manager has 80ms.
+
+### Compatibility
+
+- Still requires Pinta Manager 0.1.11 or later. Guard payloads, output
+  envelopes, event counts and redaction are unchanged. A manager older than
+  0.1.10 ignores the header and keeps its own table.
+
+## [1.10.0] - 2026-09-22
+
+### Added
+
+- Truthful scalar `codex.model` IDs from explicit hook metadata, with source
+  preservation and omission of placeholders or stringified objects/arrays.
+- Bounded, read-only fallback to a rollout's exact session and turn context.
+  `transcript.turn_context` is explicitly requested-model evidence, not proof
+  of routed response identity. Missing turn IDs, conflicting contexts and
+  parent context on subagent lifecycle events remain model-less.
+- Model regressions and built CJS/ESM model/SDK-version wire checks in PR CI.
+
+### Compatibility
+
+- Still requires Pinta Manager 0.1.11 or later. Guard payloads, output envelopes,
+  event counts and redaction are unchanged; bundled `@pinta-ai/core` remains
+  `^0.8.0`. No new required envelope fields.
+
 ## [1.9.0] - 2026-09-20
 
 ### Changed

package/README.md

@@ -76,6 +76,50 @@ Each invocation spawns `node dist/index.js`, maps the event to a single OTLP spa
 - Disk-backed retry queue at `.plugin-data/failed-spans.jsonl` (cap 1000). Drained on the next hook invocation
 - One trace per user turn — based on the `UserPromptSubmit` ULID
 
+### Model attribution and its limits
+
+`codex.model` is the exact host-reported scalar model ID. An explicit hook
+`model` wins, accepting a string or a descriptor's `id` (or `name` when no `id`
+field exists), rather than stringifying the descriptor. Its
+`codex.model_source` preserves the host's supplied source or defaults to
+`hook.model`; a hook model can describe a requested
+selection and is not by itself proof of a provider's routed response.
+
+JSON-stringified objects/arrays (including `[object Object]`) are not IDs.
+Provider and requested/response fields remain unchanged. If a transcript
+replaces an unusable model, `model_source` describes that transcript evidence;
+a previous host source is retained as `codex.model_original_source`.
+
+When the hook has no usable model, `transcript.turn_context` evidence is
+available only with an exact `session_meta.payload.id == session_id` and
+`turn_context.payload.turn_id == turn_id` in the supplied rollout JSONL.
+`turn_context.payload.model` becomes `codex.model`, with
+`codex.model_source=transcript.turn_context`. **This is the requested turn
+model, not a claim about response routing.** Only records at/before the hook
+timestamp (or processing time when absent) qualify. Conflicting same-turn
+models are omitted rather than choosing the latest.
+
+There is no session-wide carry-forward: an older/different turn, another
+session, or a parent's context for `SubagentStart`/`SubagentStop` cannot supply
+the model. Older rollouts without `turn_id`, missing/late-flushed context,
+context outside the read window, and uncorrelated events remain model-less.
+A child session needs its own matching rollout and turn. Global configuration,
+provider names, CLI versions, process names and user prose are never model
+evidence.
+
+Blank, `unknown`, `undefined`, `null`, `n/a`, `none`, `auto` and `default`
+are omissions (case-insensitive), as are non-ID objects, control characters and
+IDs longer than 512 characters. No mandatory event fields are added.
+The original input, other flattened fields, guard behavior, event count and
+redaction pipeline are unchanged.
+
+Model lookup opens only the supplied absolute `.jsonl` regular file, read-only,
+with no subprocess, directory scan or model cache. It reads at most a 256 KiB
+header plus a 1 MiB tail and 4,096 complete records. Missing/unreadable files,
+leaf symlinks, malformed records and invalid identities fail quietly;
+incomplete boundary lines are ignored. It never logs or exports transcript
+contents. An explicit model or missing turn ID needs no model-lookup IO.
+
 ## Configuration
 
 `npm run setup` writes the endpoint and headers to `~/.codex/pinta-codex.env`. Environment variables override file values.
@@ -172,6 +216,14 @@ printf 'http://localhost:3000\n\n' | npm run setup
 
 ## Scripts
 
+`npm run smoke:model` (after `npm run build`) tests the actual CJS and ESM hooks
+against a loopback OTLP collector with isolated HOME/plugin data and no
+manager/guard calls. It covers supplied, missing, placeholder, correlated,
+cross-session/subagent, future, partial and oversized transcript cases and
+writes `.validation/model-smoke.json`. Optionally pass
+`-- --baseline=<previous-built-index.js>` for paired wall-time comparisons;
+these include Node startup, local HTTP and scheduler noise.
+
 | Script | Purpose |
 |--------|---------|
 | `npm run setup` | one-shot interactive installer (build + env + config + hooks) |

package/dist/index.js

@@ -1,26 +1,26 @@
-"use strict";var kt=Object.create;var fe=Object.defineProperty;var At=Object.getOwnPropertyDescriptor;var Rt=Object.getOwnPropertyNames;var wt=Object.getPrototypeOf,Dt=Object.prototype.hasOwnProperty;var h=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Mt=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of Rt(e))!Dt.call(t,o)&&o!==r&&fe(t,o,{get:()=>e[o],enumerable:!(n=At(e,o))||n.enumerable});return t};var f=(t,e,r)=>(r=t!=null?kt(wt(t)):{},Mt(e||!t||!t.__esModule?fe(r,"default",{value:t,enumerable:!0}):r,t));var z=h(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.PATTERNS=d.MAX_BYTES=void 0;d.truncateTo=me;d.truncate=Ct;d.collectMatches=_e;d.resolveOverlaps=ge;d.applyMatches=he;d.redact=Nt;d.MAX_BYTES=102400;function me(t,e){let r=Buffer.from(t,"utf-8");return r.length<=e?t:`${r.subarray(0,Math.max(0,e)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function Ct(t){return me(t,d.MAX_BYTES)}d.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function _e(t,e){let r=[];for(let n of d.PATTERNS){if(n.requireContext&&n.requireContext!==e.context)continue;let o=new RegExp(n.regex.source,n.regex.flags),i;for(;(i=o.exec(t))!==null;){let a=n.captureGroup??0,u=i[a];if(u===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,g=i.index+i[0].length,A=c+i[0].indexOf(u),xt=A+u.length;r.push({start:c,end:g,replaceStart:A,replaceEnd:xt,type:n.type}),i.index===o.lastIndex&&o.lastIndex++}}return r}function ge(t){let e=[...t].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),r=[],n=-1;for(let o of e)o.start<n||(r.push(o),n=o.end);return r}function he(t,e){let r=[...e].sort((o,i)=>i.replaceStart-o.replaceStart),n=t;for(let o of r)n=n.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+n.slice(o.replaceEnd);return n}function Nt(t,e={}){if(t.length===0)return t;let r=_e(t,e);if(r.length===0)return t;let n=ge(r);return he(t,n)}});var Z=h(p=>{"use strict";var jt=p&&p.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(p,"__esModule",{value:!0});p.MAX_SPAN_BYTES=void 0;p.ulidToTraceId=ve;p.newSpanId=Se;p.snakeCase=Ut;p.toOtlpValue=Oe;p.attrsFromRecord=qt;p.guardAttrs=Te;p.clientAttrs=be;p.enforceSpanBudget=xe;p.buildPayload=Lt;p.attachGuard=ke;p.mergeBatch=Gt;var It=jt(require("crypto")),W=z(),Bt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function ve(t){if(t.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${t.length}`);let e=0n;for(let n of t){let o=Bt.indexOf(n);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);e=e<<5n|BigInt(o)}let r=(1n<<128n)-1n;return e&=r,e.toString(16).padStart(32,"0")}function Se(){return It.default.randomBytes(8).toString("hex")}function Ut(t){return t.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var ye=new Set;function I(t,e,r){let n=(0,W.truncate)(e);if((r.skipRedactKeys??ye).has(t))return n;let o=(r.bashContextKeys??ye).has(t)?"bash":void 0;return(0,W.redact)(n,{context:o})}function Oe(t,e,r={}){if(e==null)return null;switch(typeof e){case"string":return{stringValue:I(t,e,r)};case"boolean":return{boolValue:e};case"number":return Number.isInteger(e)?{intValue:e}:{doubleValue:e};case"object":try{return{stringValue:I(t,JSON.stringify(e),r)}}catch{return{stringValue:I(t,String(e),r)}}default:return{stringValue:I(t,String(e),r)}}}function qt(t,e,r={}){let n=[];for(let[o,i]of Object.entries(t)){let a=`${e}.${o}`,u=Oe(a,i,r);u!==null&&n.push({key:a,value:u})}return n}function Te(t){let e=[{key:"pinta.guard.decision",value:{stringValue:t.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:t.durationMs}}];return t.reason&&e.push({key:"pinta.guard.matched_rule",value:{stringValue:t.reason}}),t.failOpenReason&&e.push({key:"pinta.guard.fail_open_reason",value:{stringValue:t.failOpenReason}}),e}function be(t){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(t.rttMs)?{intValue:t.rttMs}:{doubleValue:t.rttMs}},{key:"pinta.client.op",value:{stringValue:t.op}}]}p.MAX_SPAN_BYTES=800*1024;function Pe(t){let e=JSON.stringify(t);return e===void 0?0:Buffer.byteLength(e,"utf-8")}var Ee=1024;function xe(t,e=p.MAX_SPAN_BYTES){let r=Pe(t);for(let n=0;n<100&&r>e;n++){let o=null,i=0;for(let c of t.attributes){if(!("stringValue"in c.value))continue;let g=Buffer.byteLength(c.value.stringValue,"utf-8");g>i&&(i=g,o=c.value)}if(o===null||i<=Ee)break;let a=r-e,u=Math.max(Ee,i-a-64);o.stringValue=(0,W.truncateTo)(o.stringValue,u),r=Pe(t)}return t}function Lt(t){let e=t.now??Date.now(),r=(BigInt(e)*1000000n).toString(),n=[...t.attributes],o={traceId:ve(t.traceId),spanId:Se(),name:t.spanName,kind:t.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};xe(o);let i={resourceSpans:[{resource:{attributes:t.resource},scopeSpans:[{scope:t.scope,spans:[o]}]}]};return ke(i,t.guard,t.clientTiming)}function ke(t,e,r){let n=t.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!n)return t;e&&n.attributes.push(...Te(e));let o=r??(e?.clientRttMs!==void 0?{op:"guard",rttMs:e.clientRttMs}:null);return o&&n.attributes.push(...be(o)),t}function Gt(t){let e=[];for(let r of t)e.push(...r.resourceSpans);return{resourceSpans:e}}});var Ae=h(x=>{"use strict";Object.defineProperty(x,"__esModule",{value:!0});x.GUARD_STATUS_REFUSED=void 0;x.evaluateGuard=Ft;var $t=1e4,Xt="pinta-core";function B(t,e){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:t,clientRttMs:t,failOpenReason:e}}var Yt=new Set(["ALLOW","DENY","REVIEW"]);x.GUARD_STATUS_REFUSED=410;async function Ft(t,e,r={}){if(!e||r.disabled)return null;let n=r.timeoutMs??$t,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),n);try{let u=await fetch(e,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??Xt,"x-pinta-relay-token":r.token??"",...r.agentType?{"x-pinta-agent-type":r.agentType}:{}},body:JSON.stringify(t),signal:i.signal});if(u.status===x.GUARD_STATUS_REFUSED)return B(Date.now()-o,"refused");if(u.status!==200)return B(Date.now()-o,"error");let c=await u.json(),g=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!Yt.has(c.decision)||!g)return B(Date.now()-o,"error");let A=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??A,clientRttMs:A}}catch(u){let c=u.name,g=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return B(Date.now()-o,g)}finally{clearTimeout(a)}}});var U=h(R=>{"use strict";var Vt=R&&R.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(R,"__esModule",{value:!0});R.atomicWriteFileSync=Kt;var Re=Vt(require("fs"));function Kt(t,e){let r=`${t}.${process.pid}.tmp`;Re.default.writeFileSync(r,e),Re.default.renameSync(r,t)}});var ee=h(P=>{"use strict";var we=P&&P.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(P,"__esModule",{value:!0});P.MemoryRetryQueue=P.DiskRetryQueue=void 0;var m=we(require("fs")),q=we(require("path")),Ht=U(),L=1e3,zt=50,Wt=5,J=class{filePath;lockPath;logPrefix;constructor(e,r){this.filePath=q.default.join(e,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(e){try{m.default.mkdirSync(q.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:e})+`
-`;m.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
-`)}}readAll(){try{let e=m.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of e.split(`
-`))if(n.trim())try{let o=JSON.parse(n);Array.isArray(o?.payload?.resourceSpans)&&r.push(o)}catch{}return r}catch{return[]}}rewrite(e){try{if(e.length===0){m.default.existsSync(this.filePath)&&m.default.unlinkSync(this.filePath);return}m.default.mkdirSync(q.default.dirname(this.filePath),{recursive:!0}),(0,Ht.atomicWriteFileSync)(this.filePath,e.map(r=>JSON.stringify(r)).join(`
+"use strict";var Vt=Object.create;var be=Object.defineProperty;var Xt=Object.getOwnPropertyDescriptor;var Ft=Object.getOwnPropertyNames;var Yt=Object.getPrototypeOf,zt=Object.prototype.hasOwnProperty;var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Kt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Ft(t))!zt.call(e,o)&&o!==n&&be(e,o,{get:()=>t[o],enumerable:!(r=Xt(t,o))||r.enumerable});return e};var m=(e,t,n)=>(n=e!=null?Vt(Yt(e)):{},Kt(t||!e||!e.__esModule?be(n,"default",{value:e,enumerable:!0}):n,e));var ee=h(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.PATTERNS=_.MAX_BYTES=void 0;_.truncateTo=xe;_.truncate=Ht;_.collectMatches=Ae;_.resolveOverlaps=ke;_.applyMatches=Re;_.redact=Wt;_.MAX_BYTES=102400;function xe(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Ht(e){return xe(e,_.MAX_BYTES)}_.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Ae(e,t){let n=[];for(let r of _.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=o.exec(e))!==null;){let u=r.captureGroup??0,a=s[u];if(a===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let c=s.index,d=s.index+s[0].length,p=c+s[0].indexOf(a),v=p+a.length;n.push({start:c,end:d,replaceStart:p,replaceEnd:v,type:r.type}),s.index===o.lastIndex&&o.lastIndex++}}return n}function ke(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Re(e,t){let n=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function Wt(e,t={}){if(e.length===0)return e;let n=Ae(e,t);if(n.length===0)return e;let r=ke(n);return Re(e,r)}});var ne=h(f=>{"use strict";var Zt=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=Ne;f.newSpanId=Ce;f.snakeCase=en;f.toOtlpValue=je;f.attrsFromRecord=tn;f.guardAttrs=Ie;f.clientAttrs=Be;f.enforceSpanBudget=Ue;f.buildPayload=nn;f.attachGuard=Le;f.mergeBatch=rn;var Jt=Zt(require("crypto")),te=ee(),Qt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ne(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=Qt.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ce(){return Jt.default.randomBytes(8).toString("hex")}function en(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var we=new Set;function G(e,t,n){let r=(0,te.truncate)(t);if((n.skipRedactKeys??we).has(e))return r;let o=(n.bashContextKeys??we).has(e)?"bash":void 0;return(0,te.redact)(r,{context:o})}function je(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:G(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:G(e,JSON.stringify(t),n)}}catch{return{stringValue:G(e,String(t),n)}}default:return{stringValue:G(e,String(t),n)}}}function tn(e,t,n={}){let r=[];for(let[o,s]of Object.entries(e)){let u=`${t}.${o}`,a=je(u,s,n);a!==null&&r.push({key:u,value:a})}return r}function Ie(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Be(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function De(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Me=1024;function Ue(e,t=f.MAX_SPAN_BYTES){let n=De(e);for(let r=0;r<100&&n>t;r++){let o=null,s=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let d=Buffer.byteLength(c.value.stringValue,"utf-8");d>s&&(s=d,o=c.value)}if(o===null||s<=Me)break;let u=n-t,a=Math.max(Me,s-u-64);o.stringValue=(0,te.truncateTo)(o.stringValue,a),n=De(e)}return e}function nn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Ne(e.traceId),spanId:Ce(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ue(o);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Le(s,e.guard,e.clientTiming)}function Le(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Ie(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Be(o)),e}function rn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var qe=h(S=>{"use strict";Object.defineProperty(S,"__esModule",{value:!0});S.GUARD_STATUS_REFUSED=S.GUARD_BUDGET_HEADER=void 0;S.evaluateGuard=un;var on=1e4,sn="pinta-core";S.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function $(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var an=new Set(["ALLOW","DENY","REVIEW"]);S.GUARD_STATUS_REFUSED=410;async function un(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??on,o=Date.now(),s=new AbortController,u=setTimeout(()=>s.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??sn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[S.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:s.signal});if(a.status===S.GUARD_STATUS_REFUSED)return $(Date.now()-o,"refused");if(a.status!==200)return $(Date.now()-o,"error");let c=await a.json(),d=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!an.has(c.decision)||!d)return $(Date.now()-o,"error");let p=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??p,clientRttMs:p}}catch(a){let c=a.name,d=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return $(Date.now()-o,d)}finally{clearTimeout(u)}}});var V=h(N=>{"use strict";var cn=N&&N.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(N,"__esModule",{value:!0});N.atomicWriteFileSync=dn;var Ge=cn(require("fs"));function dn(e,t){let n=`${e}.${process.pid}.tmp`;Ge.default.writeFileSync(n,t),Ge.default.renameSync(n,e)}});var se=h(T=>{"use strict";var $e=T&&T.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(T,"__esModule",{value:!0});T.MemoryRetryQueue=T.DiskRetryQueue=void 0;var g=$e(require("fs")),X=$e(require("path")),ln=V(),F=1e3,fn=50,pn=5,re=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=X.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{g.default.mkdirSync(X.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;g.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=g.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){g.default.existsSync(this.filePath)&&g.default.unlinkSync(this.filePath);return}g.default.mkdirSync(X.default.dirname(this.filePath),{recursive:!0}),(0,ln.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
-`)}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${r}
-`)}}tryAcquireLock(){let e=Date.now();try{m.default.mkdirSync(q.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
-`),!1}for(;Date.now()-e<zt;)try{let r=m.default.openSync(this.lockPath,"wx");return m.default.writeSync(r,String(process.pid)),m.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
-`),!1;try{let i=m.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){m.default.unlinkSync(this.lockPath);continue}}catch{}let n=Wt,o=Date.now()+n;for(;Date.now()<o;);}return!1}release(){try{m.default.unlinkSync(this.lockPath)}catch{}}trim(){let e=this.readAll();if(e.length<=L)return;let r=e.length-L;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
-`),this.rewrite(e.slice(r))}};P.DiskRetryQueue=J;var Q=class{entries=[];enqueue(e){this.entries.push(e),this.entries.length>L&&this.entries.splice(0,this.entries.length-L)}drain(){let e=this.entries;return this.entries=[],e}get size(){return this.entries.length}};P.MemoryRetryQueue=Q});var Ie=h(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Ne;l.envOptionsResolver=je;l.postOtlp=w;var De=ee(),Me=Z(),Zt=5e3;l.MAX_POST_BYTES=900*1024;function G(t){let e=JSON.stringify(t);return e===void 0?0:Buffer.byteLength(e,"utf-8")}function Ce(t,e,r){let n=[],o=[],i=[],a=0;for(let u of t){let c=e(u);if(c>r){o.push(u);continue}i.length>0&&a+c>r&&(n.push(i),i=[],a=0),i.push(u),a+=c}return i.length>0&&n.push(i),{chunks:n,oversize:o}}function Ne(t){if(!t)return{};if(typeof t=="object")return{...t};let e={};for(let r of t.split(",")){let[n,...o]=r.split("=");n&&o.length>0&&(e[n.trim()]=o.join("=").trim())}return e}function je(){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,e=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return t?r=t.replace(/\/+$/,""):e&&(r=e.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Ne(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function w(t,e,r){let n=new AbortController,o=setTimeout(()=>n.abort(),Zt);try{let i=await fetch(e.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...e.headers},body:JSON.stringify(t),signal:n.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let u=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${i.status} ${e.endpoint}${u}${a?` body=${a}`:""}
-`),!1}return!0}catch(i){return process.stderr.write(`[${r}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var te=class{queue;logPrefix;resolveOptions;constructor(e){this.queue=new De.DiskRetryQueue(e.pluginData,e.logPrefix),this.logPrefix=e.logPrefix,this.resolveOptions=e.resolveOptions??je}async send(e){let r=this.resolveOptions();if(!r||this.dropIfOversized(e))return;await w(e,r,this.logPrefix)||this.queue.enqueue(e)}async flush(){let e=this.resolveOptions();if(e&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:o}=Ce(r,u=>G(u.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...n),a=0;for(let u of n){if(!await w((0,Me.mergeBatch)(u.map(g=>g.payload)),e,this.logPrefix))break;a+=u.length}this.queue.rewrite(i.slice(a))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
-`)}finally{this.queue.release()}}dropIfOversized(e){let r=G(e);return r<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=te;var re=class{queue=new De.MemoryRetryQueue;logPrefix;resolveOptions;constructor(e){this.logPrefix=e.logPrefix,this.resolveOptions=e.resolveOptions}async send(e){let r=this.resolveOptions();if(!r)return;if(G(e)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await w(e,r,this.logPrefix)||this.queue.enqueue(e)}async flush(){let e=this.resolveOptions();if(!e)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:o}=Ce(r,G,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...n),a=0;for(let u of n){if(!await w((0,Me.mergeBatch)(u),e,this.logPrefix))break;a+=u.length}for(let u of i.slice(a))this.queue.enqueue(u)}};l.MemoryTransport=re});var ie=h(O=>{"use strict";var se=O&&O.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(O,"__esModule",{value:!0});O.TraceManager=void 0;O.generateUlid=Ue;var Be=se(require("fs")),Jt=se(require("path")),Qt=se(require("crypto")),er=U(),ne="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ue(){let t=Date.now(),e="",r=t;for(let i=0;i<10;i++)e=ne[r&31]+e,r=Math.floor(r/32);let n=Qt.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=ne[n[i]&31];for(;o.length<16;)o+=ne[0];return e+o}var oe=class{tracePath;constructor(e){this.tracePath=e}newTrace(){let e=Ue();return this.save(e),e}currentTrace(){try{let e=Be.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(e);if(r)return r}catch{}return this.newTrace()}save(e){try{Be.default.mkdirSync(Jt.default.dirname(this.tracePath),{recursive:!0}),(0,er.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:e}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
-`)}}};O.TraceManager=oe});var Xe=h(E=>{"use strict";var Le=E&&E.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(E,"__esModule",{value:!0});E.MemorySessionTraceManager=E.DiskSessionTraceManager=void 0;var qe=Le(require("fs")),tr=Le(require("path")),Ge=ie(),rr=U(),$e=200,ae=class{tracePath;maxSessions;constructor(e,r={}){this.tracePath=e,this.maxSessions=r.maxSessions??$e}read(){try{let e=JSON.parse(qe.default.readFileSync(this.tracePath,"utf-8"));if(e&&typeof e=="object"&&!("traceId"in e))return e}catch{}return{}}write(e){try{qe.default.mkdirSync(tr.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(e),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):e;(0,rr.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(e){let r=e||"default",n=(0,Ge.generateUlid)(),o=this.read();return o[r]=n,this.write(o),n}currentTrace(e){let r=e||"default",n=this.read()[r];return n||this.newTrace(r)}};E.DiskSessionTraceManager=ae;var ue=class{map=new Map;maxSessions;constructor(e={}){this.maxSessions=e.maxSessions??$e}newTrace(e){let r=e||"default",n=(0,Ge.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return n}currentTrace(e){let r=e||"default";return this.map.get(r)??this.newTrace(r)}};E.MemorySessionTraceManager=ue});var Ve=h(T=>{"use strict";var ce=T&&T.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(T,"__esModule",{value:!0});T.envFilePath=sr;T.parseEnvFile=Fe;T.loadEnvFile=ir;var nr=ce(require("node:fs")),or=ce(require("node:os")),Ye=ce(require("node:path"));function sr(t,e,r){let n=r?process.env[r]:void 0,o=n&&n.length>0?n:Ye.default.join(or.default.homedir(),t);return Ye.default.join(o,e)}function Fe(t){let e={};for(let r of t.split(`
-`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let o=n.indexOf("=");if(o<0)continue;let i=n.slice(0,o).trim(),a=n.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(e[i]=a)}return e}function ir(t){let e;try{e=nr.default.readFileSync(t,"utf-8")}catch{return}let r=Fe(e);for(let[n,o]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=o)}});var S=h(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var v=z();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return v.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return v.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return v.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return v.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return v.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return v.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return v.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return v.MAX_BYTES}});var _=Z();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var Ke=Ae();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Ke.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Ke.GUARD_STATUS_REFUSED}});var He=ee();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return He.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return He.MemoryRetryQueue}});var k=Ie();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return k.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return k.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return k.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return k.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return k.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return k.MAX_POST_BYTES}});var ze=ie();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return ze.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return ze.generateUlid}});var We=Xe();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return We.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return We.MemorySessionTraceManager}});var le=Ve();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return le.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return le.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return le.loadEnvFile}})});var pe=f(require("node:fs")),Ze=f(require("node:os")),D=f(require("node:path")),Je=f(S());function ar(t){let e={},r;try{r=pe.default.readFileSync(t,"utf-8")}catch{return e}for(let n of r.split(`
-`)){let o=n.trim();if(!o||o.startsWith("#"))continue;let i=o.indexOf("=");if(i<0)continue;let a=o.slice(0,i).trim(),u=o.slice(i+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),a&&(e[a]=u)}return e}function ur(t){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??t.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(e)return e;let r=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??t.OTEL_EXPORTER_OTLP_ENDPOINT;return r?r.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??t.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function cr(t){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(t.OTEL_EXPORTER_OTLP_HEADERS)return t.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(t.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${t.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function Qe(){let t=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),e=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??D.default.join(t,".plugin-data"),r=process.env.CODEX_HOME??D.default.join(Ze.default.homedir(),".codex"),n=D.default.join(r,"pinta-codex.env"),o=pe.default.existsSync(n)?ar(n):{},i=ur(o),a=cr(o);if(a&&!process.env.PINTA_RELAY_TOKEN){let c=a.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let u=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:t,pluginData:e,tracePath:D.default.join(e,"trace.json"),endpoint:i?.replace(/\/+$/,""),headers:(0,Je.parseHeadersEnv)(a??""),guardEndpoint:u}}function et(t){return t.hook_event_name==="PreToolUse"}function tt(t){return t.hook_event_name==="PermissionRequest"}function rt(t){return t.hook_event_name==="PostToolUse"}function nt(t){return t.hook_event_name==="UserPromptSubmit"}function ot(t){return t.hook_event_name==="SessionStart"}function st(t){return t.hook_event_name==="Stop"}var lr=["PreToolUse","PermissionRequest"],pr=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],dr=new Set([...lr,...pr]);function it(t){return!dr.has(t.hook_event_name)}var _t=f(S());var at=f(S()),$=class extends at.DiskTransport{constructor(e){super({pluginData:e.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>e.endpoint?{endpoint:e.endpoint,headers:e.headers}:null})}};var ut=f(S()),X=class extends ut.TraceManager{constructor(e){super(e.tracePath)}};var M=f(require("fs")),V=f(require("os")),lt=f(require("path"));var Y="1.9.0";var b=f(S()),F;function fr(){if(F===void 0)try{F=V.default.userInfo().username}catch{F=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return F}var pt=Y,de;function C(t){return typeof t=="string"&&t.trim()!==""?t.trim():void 0}var ct=256*1024;function mr(t){if(!t)return;let e;try{e=M.default.openSync(t,"r");let r=Buffer.allocUnsafe(ct),n=M.default.readSync(e,r,0,ct,0),o=r.toString("utf8",0,n),i=o.indexOf(`
-`);if(i<0)return;let a=JSON.parse(o.slice(0,i));return a?.type!=="session_meta"?void 0:C(a.payload?.cli_version)}catch{return}finally{if(e!==void 0)try{M.default.closeSync(e)}catch{}}}function _r(){let t=C(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(t)try{let e=JSON.parse(M.default.readFileSync(lt.default.join(t,"package.json"),"utf8"));return C(e.version)}catch{return}}function gr(t){return de===void 0&&(de=mr(C(t?.transcript_path))??_r()??C(process.env.CODEX_CLI_VERSION)??null),de??void 0}var hr=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),yr=new Set(["codex.tool_input","codex.tool_response"]),Pr={skipRedactKeys:hr,bashContextKeys:yr};function Er(t){let e=[];e.push({key:"ingest.type",value:{stringValue:"codex"}}),e.push({key:"codex.hook",value:{stringValue:t.hook_event_name}});let r={};for(let[n,o]of Object.entries(t))n!=="hook_event_name"&&(r[n]=o);return e.push(...(0,b.attrsFromRecord)(r,"codex",Pr)),e}function vr(t){let e=gr(t);return[{key:"service.name",value:{stringValue:"codex"}},...e?[{key:"service.version",value:{stringValue:e}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:pt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:fr()}},{key:"host.name",value:{stringValue:V.default.hostname()}},{key:"host.arch",value:{stringValue:V.default.arch()}}]}function dt(t){return(0,b.buildPayload)({traceId:t.traceId,spanName:`codex.${(0,b.snakeCase)(t.event.hook_event_name)}`,attributes:Er(t.event),resource:vr(t.event),scope:{name:"pinta-codex",version:pt},now:t.now})}function N(t,e,r){let n=new X(e),o=r.trace==="new"?n.newTrace():n.currentTrace();return dt({event:t,traceId:o})}async function j(t,e){let r=new $(e);await r.flush(),await r.send(t)}async function y(t,e,r){await j(N(t,e,r),e)}var ft=f(S());var Sr=50,Or=`pinta-codex/${Y}`;async function mt(t,e){let r=await(0,ft.evaluateGuard)(t,e,{timeoutMs:Sr,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Or});if(r===null)return null;let n={decision:r.decision,reason:r.reason,durationMs:r.durationMs,clientRttMs:r.clientRttMs};return r.failOpenReason!==void 0&&(n.failOpenReason=r.failOpenReason),n}async function K(t,e){return mt(t,e.guardEndpoint)}function H(t){let e=t?.reason;return typeof e=="string"&&e.trim().length>0?e:"guard_deny"}async function gt(t,e){let r=N(t,e,{trace:"current"}),n=await K(r,e);if(n?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:H(n)}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,_t.attachGuard)(r,n),await j(r,e)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}var ht=f(S());async function yt(t,e){let r=N(t,e,{trace:"current"}),n=await K(r,e);if(n?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:H(n)}}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,ht.attachGuard)(r,n),await j(r,e)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}async function Pt(t,e){return await y(t,e,{trace:"current"}),0}async function Et(t,e){return await y(t,e,{trace:"new"}),0}async function vt(t,e){return await y(t,e,{trace:"current"}),0}async function St(t,e){return await y(t,e,{trace:"current"}),0}async function Ot(t,e){return await y(t,e,{trace:"current"}),0}async function Tt(t){return 0}async function Tr(){let t=[];for await(let e of process.stdin)t.push(e);return Buffer.concat(t).toString("utf-8")}async function bt(){let t=0;try{let e=Qe(),r=await Tr(),n=JSON.parse(r);it(n)?t=await Tt(n):et(n)?t=await gt(n,e):tt(n)?t=await yt(n,e):rt(n)?t=await Pt(n,e):nt(n)?t=await Et(n,e):ot(n)?t=await vt(n,e):st(n)?t=await St(n,e):t=await Ot(n,e)}catch(e){process.stderr.write(`[pinta-codex] error: ${e}
-`),t=0}return t}async function br(){let t=await bt();process.exit(t)}br();
+`)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
+`)}}tryAcquireLock(){let t=Date.now();try{g.default.mkdirSync(X.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<fn;)try{let n=g.default.openSync(this.lockPath,"wx");return g.default.writeSync(n,String(process.pid)),g.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let s=g.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){g.default.unlinkSync(this.lockPath);continue}}catch{}let r=pn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{g.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=F)return;let n=t.length-F;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};T.DiskRetryQueue=re;var oe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>F&&this.entries.splice(0,this.entries.length-F)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};T.MemoryRetryQueue=oe});var Ke=h(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Ye;l.envOptionsResolver=ze;l.postOtlp=C;var Ve=se(),Xe=ne(),mn=5e3;l.MAX_POST_BYTES=900*1024;function Y(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Fe(e,t,n){let r=[],o=[],s=[],u=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}s.length>0&&u+c>n&&(r.push(s),s=[],u=0),s.push(a),u+=c}return s.length>0&&r.push(s),{chunks:r,oversize:o}}function Ye(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function ze(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Ye(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function C(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),mn);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let u="";try{u=(await s.text()).slice(0,200)}catch{}let a=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${a}${u?` body=${u}`:""}
+`),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
+`),!1}finally{clearTimeout(o)}}var ie=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ve.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??ze}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await C(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Fe(n,a=>Y(a.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let s=[].concat(...r),u=0;for(let a of r){if(!await C((0,Xe.mergeBatch)(a.map(d=>d.payload)),t,this.logPrefix))break;u+=a.length}this.queue.rewrite(s.slice(u))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=Y(t);return n<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};l.DiskTransport=ie;var ae=class{queue=new Ve.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(Y(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await C(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Fe(n,Y,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let s=[].concat(...r),u=0;for(let a of r){if(!await C((0,Xe.mergeBatch)(a),t,this.logPrefix))break;u+=a.length}for(let a of s.slice(u))this.queue.enqueue(a)}};l.MemoryTransport=ae});var le=h(A=>{"use strict";var de=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.TraceManager=void 0;A.generateUlid=We;var He=de(require("fs")),_n=de(require("path")),gn=de(require("crypto")),yn=V(),ue="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function We(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=ue[n&31]+t,n=Math.floor(n/32);let r=gn.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=ue[r[s]&31];for(;o.length<16;)o+=ue[0];return t+o}var ce=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=We();return this.save(t),t}currentTrace(){try{let t=He.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{He.default.mkdirSync(_n.default.dirname(this.tracePath),{recursive:!0}),(0,yn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};A.TraceManager=ce});var tt=h(O=>{"use strict";var Je=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.MemorySessionTraceManager=O.DiskSessionTraceManager=void 0;var Ze=Je(require("fs")),hn=Je(require("path")),Qe=le(),En=V(),et=200,fe=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??et}read(){try{let t=JSON.parse(Ze.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Ze.default.mkdirSync(hn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,En.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,Qe.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};O.DiskSessionTraceManager=fe;var pe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??et}newTrace(t){let n=t||"default",r=(0,Qe.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};O.MemorySessionTraceManager=pe});var ot=h(k=>{"use strict";var me=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.envFilePath=Sn;k.parseEnvFile=rt;k.loadEnvFile=Tn;var Pn=me(require("node:fs")),vn=me(require("node:os")),nt=me(require("node:path"));function Sn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:nt.default.join(vn.default.homedir(),e);return nt.default.join(o,t)}function rt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),u=r.slice(o+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),s&&(t[s]=u)}return t}function Tn(e){let t;try{t=Pn.default.readFileSync(e,"utf-8")}catch{return}let n=rt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var x=h(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.GUARD_BUDGET_HEADER=i.GUARD_STATUS_REFUSED=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.attachGuard=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var b=ee();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return b.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return b.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return b.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return b.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return b.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return b.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return b.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return b.MAX_BYTES}});var y=ne();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(i,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var _e=qe();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return _e.evaluateGuard}});Object.defineProperty(i,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return _e.GUARD_STATUS_REFUSED}});Object.defineProperty(i,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return _e.GUARD_BUDGET_HEADER}});var st=se();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return st.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return st.MemoryRetryQueue}});var D=Ke();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return D.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return D.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return D.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return D.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return D.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return D.MAX_POST_BYTES}});var it=le();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return it.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return it.generateUlid}});var at=tt();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return at.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return at.MemorySessionTraceManager}});var ge=ot();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return ge.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return ge.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return ge.loadEnvFile}})});var ye=m(require("node:fs")),ut=m(require("node:os")),j=m(require("node:path")),ct=m(x());function On(e){let t={},n;try{n=ye.default.readFileSync(e,"utf-8")}catch{return t}for(let r of n.split(`
+`)){let o=r.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<0)continue;let u=o.slice(0,s).trim(),a=o.slice(s+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),u&&(t[u]=a)}return t}function bn(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let n=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return n?n.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function xn(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function dt(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??j.default.join(e,".plugin-data"),n=process.env.CODEX_HOME??j.default.join(ut.default.homedir(),".codex"),r=j.default.join(n,"pinta-codex.env"),o=ye.default.existsSync(r)?On(r):{},s=bn(o),u=xn(o);if(u&&!process.env.PINTA_RELAY_TOKEN){let c=u.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let a=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:j.default.join(t,"trace.json"),endpoint:s?.replace(/\/+$/,""),headers:(0,ct.parseHeadersEnv)(u??""),guardEndpoint:a}}function lt(e){return e.hook_event_name==="PreToolUse"}function ft(e){return e.hook_event_name==="PermissionRequest"}function pt(e){return e.hook_event_name==="PostToolUse"}function mt(e){return e.hook_event_name==="UserPromptSubmit"}function _t(e){return e.hook_event_name==="SessionStart"}function gt(e){return e.hook_event_name==="Stop"}var An=["PreToolUse","PermissionRequest"],kn=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],Rn=new Set([...An,...kn]);function yt(e){return!Rn.has(e.hook_event_name)}var Dt=m(x());var ht=m(x()),z=class extends ht.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Et=m(x()),K=class extends Et.TraceManager{constructor(t){super(t.tracePath)}};var B=m(require("fs")),Z=m(require("os")),xt=m(require("path"));var H="1.11.0";var E=m(require("node:fs")),he=m(require("node:path")),wn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),Dn=256*1024,Mn=1024*1024,Nn=4096;function R(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function Ee(e){let t=R(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!wn.has(r.toLowerCase())?r:void 0}function Pt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Pe(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function I(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function vt(e,t){let n=e.timestamp===void 0?I(t):I(e.timestamp);return n!==void 0&&n<=t?n:void 0}function St(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!he.default.isAbsolute(e)||he.default.extname(e)!==".jsonl")return;let t;try{t=E.default.openSync(e,E.default.constants.O_RDONLY|E.default.constants.O_NONBLOCK|(E.default.constants.O_NOFOLLOW??0));let n=E.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,Dn));if(E.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),s;if(o>=0)try{s=R(JSON.parse(r.toString("utf8",0,o)))}catch{}let u=Math.max(0,n.size-Mn),a=n.size<=r.length?r:Buffer.alloc(n.size-u);if(a!==r&&E.default.readSync(t,a,0,a.length,u)!==a.length)return;let c=E.default.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let d=u>0?a.indexOf(10)+1:0,p=a.lastIndexOf(10);if(u>0&&d===0||p<d)return;let v=[],M=0;for(;p>d&&M<Nn;){let $t=a.lastIndexOf(10,p-1),Se=Math.max(d,$t+1),Te=a.toString("utf8",Se,p).trim();if(Te){let Oe=R(JSON.parse(Te));Oe&&v.push(Oe)}p=Se-1,M++}return v.reverse(),{first:s,rows:v,complete:u===0&&p<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{E.default.closeSync(t)}catch{}}}function Tt(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}function Ot(e,t){let n=Ee(e.model);if(n)return{name:n,source:"hook.model"};try{return Cn(e,t)}catch{return}}function Cn(e,t){if(e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop")return;let n=Pe(e.session_id),r=Pe(e.turn_id),o=vt(e,t);if(!n||!r||o===void 0||e.agent_id!==void 0&&e.agent_id!==n)return;let s=St(e.transcript_path),u=s?.first,a=I(u?.timestamp);if(!s||u?.type!=="session_meta"||R(u.payload)?.id!==n||a===void 0||a>o||s.rows.some(d=>d.type==="session_meta"&&R(d.payload)?.id!==n))return;let c=[];for(let d of s.rows){let p=R(d.payload),v=I(d.timestamp);if(d.type!=="turn_context"||p?.turn_id!==r||v===void 0||v>o||v<a)continue;let M=Ee(p.model);c.push(M?{name:M,source:"transcript.turn_context"}:void 0)}return Tt(c)}var w=m(x()),W;function jn(){if(W===void 0)try{W=Z.default.userInfo().username}catch{W=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return W}var At=H,ve;function U(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var bt=256*1024;function In(e){if(!e)return;let t;try{t=B.default.openSync(e,"r");let n=Buffer.allocUnsafe(bt),r=B.default.readSync(t,n,0,bt,0),o=n.toString("utf8",0,r),s=o.indexOf(`
+`);if(s<0)return;let u=JSON.parse(o.slice(0,s));return u?.type!=="session_meta"?void 0:U(u.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{B.default.closeSync(t)}catch{}}}function Bn(){let e=U(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(B.default.readFileSync(xt.default.join(e,"package.json"),"utf8"));return U(t.version)}catch{return}}function Un(e){return ve===void 0&&(ve=In(U(e?.transcript_path))??Bn()??U(process.env.CODEX_CLI_VERSION)??null),ve??void 0}var Ln=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),qn=new Set(["codex.tool_input","codex.tool_response"]),Gn={skipRedactKeys:Ln,bashContextKeys:qn};function $n(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"codex"}}),n.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,s]of Object.entries(e))o!=="hook_event_name"&&(r[o]=s);return Pt(r,Ot(e,t)),n.push(...(0,w.attrsFromRecord)(r,"codex",Gn)),n}function Vn(e){let t=Un(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:At}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:jn()}},{key:"host.name",value:{stringValue:Z.default.hostname()}},{key:"host.arch",value:{stringValue:Z.default.arch()}}]}function kt(e){let t=e.now??Date.now();return(0,w.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,w.snakeCase)(e.event.hook_event_name)}`,attributes:$n(e.event,t),resource:Vn(e.event),scope:{name:"pinta-codex",version:At},now:t})}function L(e,t,n){let r=new K(t),o=n.trace==="new"?r.newTrace():r.currentTrace();return kt({event:e,traceId:o})}async function q(e,t){let n=new z(t);await n.flush(),await n.send(e)}async function P(e,t,n){await q(L(e,t,n),t)}var Rt=m(x());var Xn=100,Fn=`pinta-codex/${H}`;async function wt(e,t){let n=await(0,Rt.evaluateGuard)(e,t,{timeoutMs:Xn,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Fn});if(n===null)return null;let r={decision:n.decision,reason:n.reason,durationMs:n.durationMs,clientRttMs:n.clientRttMs};return n.failOpenReason!==void 0&&(r.failOpenReason=n.failOpenReason),r}async function J(e,t){return wt(e,t.guardEndpoint)}function Q(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function Mt(e,t){let n=L(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Q(r)}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Dt.attachGuard)(n,r),await q(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}var Nt=m(x());async function Ct(e,t){let n=L(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:Q(r)}}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Nt.attachGuard)(n,r),await q(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}async function jt(e,t){return await P(e,t,{trace:"current"}),0}async function It(e,t){return await P(e,t,{trace:"new"}),0}async function Bt(e,t){return await P(e,t,{trace:"current"}),0}async function Ut(e,t){return await P(e,t,{trace:"current"}),0}async function Lt(e,t){return await P(e,t,{trace:"current"}),0}async function qt(e){return 0}async function Yn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Gt(){let e=0;try{let t=dt(),n=await Yn(),r=JSON.parse(n);yt(r)?e=await qt(r):lt(r)?e=await Mt(r,t):ft(r)?e=await Ct(r,t):pt(r)?e=await jt(r,t):mt(r)?e=await It(r,t):_t(r)?e=await Bt(r,t):gt(r)?e=await Ut(r,t):e=await Lt(r,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
+`),e=0}return e}async function zn(){let e=await Gt();process.exit(e)}zn();

package/dist/index.mjs

@@ -1,27 +1,27 @@
 import{createRequire as __pintaCreateRequire}from 'node:module';const require=__pintaCreateRequire(import.meta.url);
-var wt=Object.create;var me=Object.defineProperty;var Dt=Object.getOwnPropertyDescriptor;var Mt=Object.getOwnPropertyNames;var Ct=Object.getPrototypeOf,jt=Object.prototype.hasOwnProperty;var m=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Nt=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Mt(t))!jt.call(e,o)&&o!==r&&me(e,o,{get:()=>t[o],enumerable:!(n=Dt(t,o))||n.enumerable});return e};var E=(e,t,r)=>(r=e!=null?wt(Ct(e)):{},Nt(t||!e||!e.__esModule?me(r,"default",{value:e,enumerable:!0}):r,e));var H=h(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.PATTERNS=d.MAX_BYTES=void 0;d.truncateTo=_e;d.truncate=It;d.collectMatches=ge;d.resolveOverlaps=he;d.applyMatches=ye;d.redact=Bt;d.MAX_BYTES=102400;function _e(e,t){let r=Buffer.from(e,"utf-8");return r.length<=t?e:`${r.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function It(e){return _e(e,d.MAX_BYTES)}d.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function ge(e,t){let r=[];for(let n of d.PATTERNS){if(n.requireContext&&n.requireContext!==t.context)continue;let o=new RegExp(n.regex.source,n.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=n.captureGroup??0,c=i[a];if(c===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let u=i.index,g=i.index+i[0].length,R=u+i[0].indexOf(c),Rt=R+c.length;r.push({start:u,end:g,replaceStart:R,replaceEnd:Rt,type:n.type}),i.index===o.lastIndex&&o.lastIndex++}}return r}function he(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),r=[],n=-1;for(let o of t)o.start<n||(r.push(o),n=o.end);return r}function ye(e,t){let r=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),n=e;for(let o of r)n=n.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+n.slice(o.replaceEnd);return n}function Bt(e,t={}){if(e.length===0)return e;let r=ge(e,t);if(r.length===0)return e;let n=he(r);return ye(e,n)}});var Z=h(p=>{"use strict";var Ut=p&&p.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(p,"__esModule",{value:!0});p.MAX_SPAN_BYTES=void 0;p.ulidToTraceId=Se;p.newSpanId=Te;p.snakeCase=Gt;p.toOtlpValue=Oe;p.attrsFromRecord=Ft;p.guardAttrs=be;p.clientAttrs=xe;p.enforceSpanBudget=Ae;p.buildPayload=$t;p.attachGuard=ke;p.mergeBatch=Xt;var qt=Ut(m("crypto")),W=H(),Lt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Se(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let n of e){let o=Lt.indexOf(n);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);t=t<<5n|BigInt(o)}let r=(1n<<128n)-1n;return t&=r,t.toString(16).padStart(32,"0")}function Te(){return qt.default.randomBytes(8).toString("hex")}function Gt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Pe=new Set;function N(e,t,r){let n=(0,W.truncate)(t);if((r.skipRedactKeys??Pe).has(e))return n;let o=(r.bashContextKeys??Pe).has(e)?"bash":void 0;return(0,W.redact)(n,{context:o})}function Oe(e,t,r={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:N(e,t,r)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:N(e,JSON.stringify(t),r)}}catch{return{stringValue:N(e,String(t),r)}}default:return{stringValue:N(e,String(t),r)}}}function Ft(e,t,r={}){let n=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,c=Oe(a,i,r);c!==null&&n.push({key:a,value:c})}return n}function be(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function xe(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}p.MAX_SPAN_BYTES=800*1024;function Ee(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var ve=1024;function Ae(e,t=p.MAX_SPAN_BYTES){let r=Ee(e);for(let n=0;n<100&&r>t;n++){let o=null,i=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let g=Buffer.byteLength(u.value.stringValue,"utf-8");g>i&&(i=g,o=u.value)}if(o===null||i<=ve)break;let a=r-t,c=Math.max(ve,i-a-64);o.stringValue=(0,W.truncateTo)(o.stringValue,c),r=Ee(e)}return e}function $t(e){let t=e.now??Date.now(),r=(BigInt(t)*1000000n).toString(),n=[...e.attributes],o={traceId:Se(e.traceId),spanId:Te(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};Ae(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return ke(i,e.guard,e.clientTiming)}function ke(e,t,r){let n=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!n)return e;t&&n.attributes.push(...be(t));let o=r??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&n.attributes.push(...xe(o)),e}function Xt(e){let t=[];for(let r of e)t.push(...r.resourceSpans);return{resourceSpans:t}}});var Re=h(A=>{"use strict";Object.defineProperty(A,"__esModule",{value:!0});A.GUARD_STATUS_REFUSED=void 0;A.evaluateGuard=zt;var Yt=1e4,Vt="pinta-core";function I(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Kt=new Set(["ALLOW","DENY","REVIEW"]);A.GUARD_STATUS_REFUSED=410;async function zt(e,t,r={}){if(!t||r.disabled)return null;let n=r.timeoutMs??Yt,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),n);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??Vt,"x-pinta-relay-token":r.token??"",...r.agentType?{"x-pinta-agent-type":r.agentType}:{}},body:JSON.stringify(e),signal:i.signal});if(c.status===A.GUARD_STATUS_REFUSED)return I(Date.now()-o,"refused");if(c.status!==200)return I(Date.now()-o,"error");let u=await c.json(),g=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!Kt.has(u.decision)||!g)return I(Date.now()-o,"error");let R=Date.now()-o;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??R,clientRttMs:R}}catch(c){let u=c.name,g=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return I(Date.now()-o,g)}finally{clearTimeout(a)}}});var B=h(w=>{"use strict";var Ht=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.atomicWriteFileSync=Wt;var we=Ht(m("fs"));function Wt(e,t){let r=`${e}.${process.pid}.tmp`;we.default.writeFileSync(r,t),we.default.renameSync(r,e)}});var ee=h(v=>{"use strict";var De=v&&v.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(v,"__esModule",{value:!0});v.MemoryRetryQueue=v.DiskRetryQueue=void 0;var f=De(m("fs")),U=De(m("path")),Zt=B(),q=1e3,Jt=50,Qt=5,J=class{filePath;lockPath;logPrefix;constructor(t,r){this.filePath=U.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(t){try{f.default.mkdirSync(U.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;f.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
-`)}}readAll(){try{let t=f.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of t.split(`
-`))if(n.trim())try{let o=JSON.parse(n);Array.isArray(o?.payload?.resourceSpans)&&r.push(o)}catch{}return r}catch{return[]}}rewrite(t){try{if(t.length===0){f.default.existsSync(this.filePath)&&f.default.unlinkSync(this.filePath);return}f.default.mkdirSync(U.default.dirname(this.filePath),{recursive:!0}),(0,Zt.atomicWriteFileSync)(this.filePath,t.map(r=>JSON.stringify(r)).join(`
+var Yt=Object.create;var be=Object.defineProperty;var zt=Object.getOwnPropertyDescriptor;var Kt=Object.getOwnPropertyNames;var Ht=Object.getPrototypeOf,Wt=Object.prototype.hasOwnProperty;var g=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Zt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Kt(t))!Wt.call(e,o)&&o!==n&&be(e,o,{get:()=>t[o],enumerable:!(r=zt(t,o))||r.enumerable});return e};var O=(e,t,n)=>(n=e!=null?Yt(Ht(e)):{},Zt(t||!e||!e.__esModule?be(n,"default",{value:e,enumerable:!0}):n,e));var ee=h(m=>{"use strict";Object.defineProperty(m,"__esModule",{value:!0});m.PATTERNS=m.MAX_BYTES=void 0;m.truncateTo=xe;m.truncate=Jt;m.collectMatches=Ae;m.resolveOverlaps=Re;m.applyMatches=ke;m.redact=Qt;m.MAX_BYTES=102400;function xe(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Jt(e){return xe(e,m.MAX_BYTES)}m.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Ae(e,t){let n=[];for(let r of m.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=o.exec(e))!==null;){let u=r.captureGroup??0,a=s[u];if(a===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let c=s.index,l=s.index+s[0].length,p=c+s[0].indexOf(a),P=p+a.length;n.push({start:c,end:l,replaceStart:p,replaceEnd:P,type:r.type}),s.index===o.lastIndex&&o.lastIndex++}}return n}function Re(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function ke(e,t){let n=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function Qt(e,t={}){if(e.length===0)return e;let n=Ae(e,t);if(n.length===0)return e;let r=Re(n);return ke(e,r)}});var ne=h(f=>{"use strict";var en=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=Ne;f.newSpanId=Ce;f.snakeCase=rn;f.toOtlpValue=je;f.attrsFromRecord=on;f.guardAttrs=Ie;f.clientAttrs=Be;f.enforceSpanBudget=Ue;f.buildPayload=sn;f.attachGuard=Le;f.mergeBatch=an;var tn=en(g("crypto")),te=ee(),nn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ne(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=nn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ce(){return tn.default.randomBytes(8).toString("hex")}function rn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var we=new Set;function q(e,t,n){let r=(0,te.truncate)(t);if((n.skipRedactKeys??we).has(e))return r;let o=(n.bashContextKeys??we).has(e)?"bash":void 0;return(0,te.redact)(r,{context:o})}function je(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:q(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:q(e,JSON.stringify(t),n)}}catch{return{stringValue:q(e,String(t),n)}}default:return{stringValue:q(e,String(t),n)}}}function on(e,t,n={}){let r=[];for(let[o,s]of Object.entries(e)){let u=`${t}.${o}`,a=je(u,s,n);a!==null&&r.push({key:u,value:a})}return r}function Ie(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Be(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function De(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Me=1024;function Ue(e,t=f.MAX_SPAN_BYTES){let n=De(e);for(let r=0;r<100&&n>t;r++){let o=null,s=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>s&&(s=l,o=c.value)}if(o===null||s<=Me)break;let u=n-t,a=Math.max(Me,s-u-64);o.stringValue=(0,te.truncateTo)(o.stringValue,a),n=De(e)}return e}function sn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Ne(e.traceId),spanId:Ce(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ue(o);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Le(s,e.guard,e.clientTiming)}function Le(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Ie(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Be(o)),e}function an(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var qe=h(v=>{"use strict";Object.defineProperty(v,"__esModule",{value:!0});v.GUARD_STATUS_REFUSED=v.GUARD_BUDGET_HEADER=void 0;v.evaluateGuard=dn;var un=1e4,cn="pinta-core";v.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function G(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var ln=new Set(["ALLOW","DENY","REVIEW"]);v.GUARD_STATUS_REFUSED=410;async function dn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??un,o=Date.now(),s=new AbortController,u=setTimeout(()=>s.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??cn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[v.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:s.signal});if(a.status===v.GUARD_STATUS_REFUSED)return G(Date.now()-o,"refused");if(a.status!==200)return G(Date.now()-o,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!ln.has(c.decision)||!l)return G(Date.now()-o,"error");let p=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??p,clientRttMs:p}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return G(Date.now()-o,l)}finally{clearTimeout(u)}}});var F=h(C=>{"use strict";var fn=C&&C.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(C,"__esModule",{value:!0});C.atomicWriteFileSync=pn;var Ge=fn(g("fs"));function pn(e,t){let n=`${e}.${process.pid}.tmp`;Ge.default.writeFileSync(n,t),Ge.default.renameSync(n,e)}});var se=h(b=>{"use strict";var Fe=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.MemoryRetryQueue=b.DiskRetryQueue=void 0;var _=Fe(g("fs")),$=Fe(g("path")),mn=F(),X=1e3,_n=50,gn=5,re=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=$.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{_.default.mkdirSync($.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;_.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=_.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){_.default.existsSync(this.filePath)&&_.default.unlinkSync(this.filePath);return}_.default.mkdirSync($.default.dirname(this.filePath),{recursive:!0}),(0,mn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
-`)}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${r}
-`)}}tryAcquireLock(){let t=Date.now();try{f.default.mkdirSync(U.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
-`),!1}for(;Date.now()-t<Jt;)try{let r=f.default.openSync(this.lockPath,"wx");return f.default.writeSync(r,String(process.pid)),f.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
-`),!1;try{let i=f.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){f.default.unlinkSync(this.lockPath);continue}}catch{}let n=Qt,o=Date.now()+n;for(;Date.now()<o;);}return!1}release(){try{f.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=q)return;let r=t.length-q;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
-`),this.rewrite(t.slice(r))}};v.DiskRetryQueue=J;var Q=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>q&&this.entries.splice(0,this.entries.length-q)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};v.MemoryRetryQueue=Q});var Be=h(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Ne;l.envOptionsResolver=Ie;l.postOtlp=D;var Me=ee(),Ce=Z(),er=5e3;l.MAX_POST_BYTES=900*1024;function L(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function je(e,t,r){let n=[],o=[],i=[],a=0;for(let c of e){let u=t(c);if(u>r){o.push(c);continue}i.length>0&&a+u>r&&(n.push(i),i=[],a=0),i.push(c),a+=u}return i.length>0&&n.push(i),{chunks:n,oversize:o}}function Ne(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let r of e.split(",")){let[n,...o]=r.split("=");n&&o.length>0&&(t[n.trim()]=o.join("=").trim())}return t}function Ie(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return e?r=e.replace(/\/+$/,""):t&&(r=t.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Ne(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function D(e,t,r){let n=new AbortController,o=setTimeout(()=>n.abort(),er);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:n.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let c=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${i.status} ${t.endpoint}${c}${a?` body=${a}`:""}
-`),!1}return!0}catch(i){return process.stderr.write(`[${r}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var te=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Me.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ie}async send(t){let r=this.resolveOptions();if(!r||this.dropIfOversized(t))return;await D(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:o}=je(r,c=>L(c.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...n),a=0;for(let c of n){if(!await D((0,Ce.mergeBatch)(c.map(g=>g.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(i.slice(a))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let r=L(t);return r<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=te;var re=class{queue=new Me.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let r=this.resolveOptions();if(!r)return;if(L(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await D(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:o}=je(r,L,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...n),a=0;for(let c of n){if(!await D((0,Ce.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of i.slice(a))this.queue.enqueue(c)}};l.MemoryTransport=re});var ie=h(O=>{"use strict";var se=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.TraceManager=void 0;O.generateUlid=qe;var Ue=se(m("fs")),tr=se(m("path")),rr=se(m("crypto")),nr=B(),ne="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function qe(){let e=Date.now(),t="",r=e;for(let i=0;i<10;i++)t=ne[r&31]+t,r=Math.floor(r/32);let n=rr.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=ne[n[i]&31];for(;o.length<16;)o+=ne[0];return t+o}var oe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=qe();return this.save(t),t}currentTrace(){try{let t=Ue.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(t);if(r)return r}catch{}return this.newTrace()}save(t){try{Ue.default.mkdirSync(tr.default.dirname(this.tracePath),{recursive:!0}),(0,nr.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
-`)}}};O.TraceManager=oe});var Xe=h(S=>{"use strict";var Ge=S&&S.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(S,"__esModule",{value:!0});S.MemorySessionTraceManager=S.DiskSessionTraceManager=void 0;var Le=Ge(m("fs")),or=Ge(m("path")),Fe=ie(),sr=B(),$e=200,ae=class{tracePath;maxSessions;constructor(t,r={}){this.tracePath=t,this.maxSessions=r.maxSessions??$e}read(){try{let t=JSON.parse(Le.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Le.default.mkdirSync(or.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(t),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):t;(0,sr.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(t){let r=t||"default",n=(0,Fe.generateUlid)(),o=this.read();return o[r]=n,this.write(o),n}currentTrace(t){let r=t||"default",n=this.read()[r];return n||this.newTrace(r)}};S.DiskSessionTraceManager=ae;var ce=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??$e}newTrace(t){let r=t||"default",n=(0,Fe.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return n}currentTrace(t){let r=t||"default";return this.map.get(r)??this.newTrace(r)}};S.MemorySessionTraceManager=ce});var Ke=h(b=>{"use strict";var ue=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.envFilePath=cr;b.parseEnvFile=Ve;b.loadEnvFile=ur;var ir=ue(m("node:fs")),ar=ue(m("node:os")),Ye=ue(m("node:path"));function cr(e,t,r){let n=r?process.env[r]:void 0,o=n&&n.length>0?n:Ye.default.join(ar.default.homedir(),e);return Ye.default.join(o,t)}function Ve(e){let t={};for(let r of e.split(`
-`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let o=n.indexOf("=");if(o<0)continue;let i=n.slice(0,o).trim(),a=n.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function ur(e){let t;try{t=ir.default.readFileSync(e,"utf-8")}catch{return}let r=Ve(t);for(let[n,o]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=o)}});var P=h(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var T=H();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return T.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return T.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return T.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return T.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return T.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return T.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return T.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return T.MAX_BYTES}});var _=Z();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var ze=Re();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return ze.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ze.GUARD_STATUS_REFUSED}});var He=ee();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return He.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return He.MemoryRetryQueue}});var k=Be();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return k.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return k.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return k.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return k.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return k.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return k.MAX_POST_BYTES}});var We=ie();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return We.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return We.generateUlid}});var Ze=Xe();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return Ze.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return Ze.MemorySessionTraceManager}});var le=Ke();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return le.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return le.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return le.loadEnvFile}})});import{realpathSync as Gr}from"node:fs";import{pathToFileURL as Fr}from"node:url";var Qe=E(P());import Je from"node:fs";import lr from"node:os";import G from"node:path";function pr(e){let t={},r;try{r=Je.readFileSync(e,"utf-8")}catch{return t}for(let n of r.split(`
-`)){let o=n.trim();if(!o||o.startsWith("#"))continue;let i=o.indexOf("=");if(i<0)continue;let a=o.slice(0,i).trim(),c=o.slice(i+1).trim();(c.startsWith('"')&&c.endsWith('"')||c.startsWith("'")&&c.endsWith("'"))&&(c=c.slice(1,-1)),a&&(t[a]=c)}return t}function dr(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let r=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return r?r.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function fr(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function et(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??G.join(e,".plugin-data"),r=process.env.CODEX_HOME??G.join(lr.homedir(),".codex"),n=G.join(r,"pinta-codex.env"),o=Je.existsSync(n)?pr(n):{},i=dr(o),a=fr(o);if(a&&!process.env.PINTA_RELAY_TOKEN){let u=a.match(/x-pinta-relay-token=([^,\s]+)/i);u&&(process.env.PINTA_RELAY_TOKEN=u[1])}let c=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:G.join(t,"trace.json"),endpoint:i?.replace(/\/+$/,""),headers:(0,Qe.parseHeadersEnv)(a??""),guardEndpoint:c}}function tt(e){return e.hook_event_name==="PreToolUse"}function rt(e){return e.hook_event_name==="PermissionRequest"}function nt(e){return e.hook_event_name==="PostToolUse"}function ot(e){return e.hook_event_name==="UserPromptSubmit"}function st(e){return e.hook_event_name==="SessionStart"}function it(e){return e.hook_event_name==="Stop"}var mr=["PreToolUse","PermissionRequest"],_r=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],gr=new Set([...mr,..._r]);function at(e){return!gr.has(e.hook_event_name)}var _t=E(P());var ct=E(P()),F=class extends ct.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var ut=E(P()),$=class extends ut.TraceManager{constructor(t){super(t.tracePath)}};import V from"fs";import de from"os";import hr from"path";var X="1.9.0";var x=E(P()),Y;function yr(){if(Y===void 0)try{Y=de.userInfo().username}catch{Y=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return Y}var pt=X,pe;function M(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var lt=256*1024;function Pr(e){if(!e)return;let t;try{t=V.openSync(e,"r");let r=Buffer.allocUnsafe(lt),n=V.readSync(t,r,0,lt,0),o=r.toString("utf8",0,n),i=o.indexOf(`
-`);if(i<0)return;let a=JSON.parse(o.slice(0,i));return a?.type!=="session_meta"?void 0:M(a.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{V.closeSync(t)}catch{}}}function Er(){let e=M(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(V.readFileSync(hr.join(e,"package.json"),"utf8"));return M(t.version)}catch{return}}function vr(e){return pe===void 0&&(pe=Pr(M(e?.transcript_path))??Er()??M(process.env.CODEX_CLI_VERSION)??null),pe??void 0}var Sr=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),Tr=new Set(["codex.tool_input","codex.tool_response"]),Or={skipRedactKeys:Sr,bashContextKeys:Tr};function br(e){let t=[];t.push({key:"ingest.type",value:{stringValue:"codex"}}),t.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[n,o]of Object.entries(e))n!=="hook_event_name"&&(r[n]=o);return t.push(...(0,x.attrsFromRecord)(r,"codex",Or)),t}function xr(e){let t=vr(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:pt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:yr()}},{key:"host.name",value:{stringValue:de.hostname()}},{key:"host.arch",value:{stringValue:de.arch()}}]}function dt(e){return(0,x.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,x.snakeCase)(e.event.hook_event_name)}`,attributes:br(e.event),resource:xr(e.event),scope:{name:"pinta-codex",version:pt},now:e.now})}function C(e,t,r){let n=new $(t),o=r.trace==="new"?n.newTrace():n.currentTrace();return dt({event:e,traceId:o})}async function j(e,t){let r=new F(t);await r.flush(),await r.send(e)}async function y(e,t,r){await j(C(e,t,r),t)}var ft=E(P());var Ar=50,kr=`pinta-codex/${X}`;async function mt(e,t){let r=await(0,ft.evaluateGuard)(e,t,{timeoutMs:Ar,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:kr});if(r===null)return null;let n={decision:r.decision,reason:r.reason,durationMs:r.durationMs,clientRttMs:r.clientRttMs};return r.failOpenReason!==void 0&&(n.failOpenReason=r.failOpenReason),n}async function K(e,t){return mt(e,t.guardEndpoint)}function z(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function gt(e,t){let r=C(e,t,{trace:"current"}),n=await K(r,t);if(n?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:z(n)}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,_t.attachGuard)(r,n),await j(r,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}var ht=E(P());async function yt(e,t){let r=C(e,t,{trace:"current"}),n=await K(r,t);if(n?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:z(n)}}};process.stdout.write(JSON.stringify(o)+`
-`)}try{(0,ht.attachGuard)(r,n),await j(r,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
-`)}return 0}async function Pt(e,t){return await y(e,t,{trace:"current"}),0}async function Et(e,t){return await y(e,t,{trace:"new"}),0}async function vt(e,t){return await y(e,t,{trace:"current"}),0}async function St(e,t){return await y(e,t,{trace:"current"}),0}async function Tt(e,t){return await y(e,t,{trace:"current"}),0}async function Ot(e){return 0}async function Rr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function bt(){let e=0;try{let t=et(),r=await Rr(),n=JSON.parse(r);at(n)?e=await Ot(n):tt(n)?e=await gt(n,t):rt(n)?e=await yt(n,t):nt(n)?e=await Pt(n,t):ot(n)?e=await Et(n,t):st(n)?e=await vt(n,t):it(n)?e=await St(n,t):e=await Tt(n,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
-`),e=0}return e}var xt=E(P());import{opendir as wr,stat as Dr}from"node:fs/promises";import fe from"node:path";var Mr="pinta-codex",Cr=/^rollout-.+-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/;function jr(){return(0,xt.envFilePath)(".codex","sessions","CODEX_HOME")}function Nr(e,t){return fe.relative(e,t).split(fe.sep).join("/")}function Ir(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function Br(e){return e.endsWith(".jsonl")?"session-log":"other"}function Ur(e){let t=e.slice(e.lastIndexOf("/")+1);return Cr.exec(t)?.[1]}async function At(){return[jr()]}async function*kt(e,t){let r;try{r=await wr(t)}catch{return}try{for await(let n of r){let o=fe.join(t,n.name);n.isDirectory()?yield*kt(e,o):n.isFile()&&(yield{absPath:o,relPath:Nr(e,o)})}}catch{return}}async function*qr(e){let[t]=await At(),r=e.since?.getTime();for await(let{absPath:n,relPath:o}of kt(t,t)){let i;try{i=await Dr(n)}catch{continue}r!==void 0&&i.mtime.getTime()<=r||(yield{relPath:o,absPath:n,size:i.size,mtime:i.mtime,sessionId:Ur(o),semantics:Ir(o)})}}var Lr={id:Mr,roots:At,scan:qr,classify:Br};function $r(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===Fr(Gr(e)).href}catch{return!1}}async function Xr(){let e=await bt();process.exit(e)}$r()&&Xr();export{Lr as lifecycle};
+`)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
+`)}}tryAcquireLock(){let t=Date.now();try{_.default.mkdirSync($.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<_n;)try{let n=_.default.openSync(this.lockPath,"wx");return _.default.writeSync(n,String(process.pid)),_.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let s=_.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){_.default.unlinkSync(this.lockPath);continue}}catch{}let r=gn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{_.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=X)return;let n=t.length-X;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};b.DiskRetryQueue=re;var oe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>X&&this.entries.splice(0,this.entries.length-X)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};b.MemoryRetryQueue=oe});var Ke=h(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.MemoryTransport=d.DiskTransport=d.MAX_POST_BYTES=void 0;d.parseHeadersEnv=Ye;d.envOptionsResolver=ze;d.postOtlp=j;var $e=se(),Xe=ne(),yn=5e3;d.MAX_POST_BYTES=900*1024;function V(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Ve(e,t,n){let r=[],o=[],s=[],u=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}s.length>0&&u+c>n&&(r.push(s),s=[],u=0),s.push(a),u+=c}return s.length>0&&r.push(s),{chunks:r,oversize:o}}function Ye(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function ze(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Ye(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function j(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),yn);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let u="";try{u=(await s.text()).slice(0,200)}catch{}let a=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${a}${u?` body=${u}`:""}
+`),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
+`),!1}finally{clearTimeout(o)}}var ie=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new $e.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??ze}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await j(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Ve(n,a=>V(a.payload),d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${d.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let s=[].concat(...r),u=0;for(let a of r){if(!await j((0,Xe.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;u+=a.length}this.queue.rewrite(s.slice(u))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=V(t);return n<=d.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};d.DiskTransport=ie;var ae=class{queue=new $e.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(V(t)>d.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await j(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Ve(n,V,d.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${d.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let s=[].concat(...r),u=0;for(let a of r){if(!await j((0,Xe.mergeBatch)(a),t,this.logPrefix))break;u+=a.length}for(let a of s.slice(u))this.queue.enqueue(a)}};d.MemoryTransport=ae});var de=h(R=>{"use strict";var le=R&&R.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(R,"__esModule",{value:!0});R.TraceManager=void 0;R.generateUlid=We;var He=le(g("fs")),hn=le(g("path")),En=le(g("crypto")),Pn=F(),ue="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function We(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=ue[n&31]+t,n=Math.floor(n/32);let r=En.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=ue[r[s]&31];for(;o.length<16;)o+=ue[0];return t+o}var ce=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=We();return this.save(t),t}currentTrace(){try{let t=He.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{He.default.mkdirSync(hn.default.dirname(this.tracePath),{recursive:!0}),(0,Pn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};R.TraceManager=ce});var tt=h(x=>{"use strict";var Je=x&&x.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(x,"__esModule",{value:!0});x.MemorySessionTraceManager=x.DiskSessionTraceManager=void 0;var Ze=Je(g("fs")),vn=Je(g("path")),Qe=de(),Sn=F(),et=200,fe=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??et}read(){try{let t=JSON.parse(Ze.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Ze.default.mkdirSync(vn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Sn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,Qe.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};x.DiskSessionTraceManager=fe;var pe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??et}newTrace(t){let n=t||"default",r=(0,Qe.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};x.MemorySessionTraceManager=pe});var ot=h(k=>{"use strict";var me=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.envFilePath=bn;k.parseEnvFile=rt;k.loadEnvFile=xn;var Tn=me(g("node:fs")),On=me(g("node:os")),nt=me(g("node:path"));function bn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:nt.default.join(On.default.homedir(),e);return nt.default.join(o,t)}function rt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),u=r.slice(o+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),s&&(t[s]=u)}return t}function xn(e){let t;try{t=Tn.default.readFileSync(e,"utf-8")}catch{return}let n=rt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var S=h(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.GUARD_BUDGET_HEADER=i.GUARD_STATUS_REFUSED=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.attachGuard=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var A=ee();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return A.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return A.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return A.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return A.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return A.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return A.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return A.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return A.MAX_BYTES}});var y=ne();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return y.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return y.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return y.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return y.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return y.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return y.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return y.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return y.buildPayload}});Object.defineProperty(i,"attachGuard",{enumerable:!0,get:function(){return y.attachGuard}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return y.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return y.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return y.MAX_SPAN_BYTES}});var _e=qe();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return _e.evaluateGuard}});Object.defineProperty(i,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return _e.GUARD_STATUS_REFUSED}});Object.defineProperty(i,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return _e.GUARD_BUDGET_HEADER}});var st=se();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return st.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return st.MemoryRetryQueue}});var M=Ke();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return M.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return M.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return M.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return M.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return M.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return M.MAX_POST_BYTES}});var it=de();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return it.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return it.generateUlid}});var at=tt();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return at.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return at.MemorySessionTraceManager}});var ge=ot();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return ge.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return ge.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return ge.loadEnvFile}})});import{realpathSync as cr}from"node:fs";import{pathToFileURL as lr}from"node:url";var ct=O(S());import ut from"node:fs";import An from"node:os";import Y from"node:path";function Rn(e){let t={},n;try{n=ut.readFileSync(e,"utf-8")}catch{return t}for(let r of n.split(`
+`)){let o=r.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<0)continue;let u=o.slice(0,s).trim(),a=o.slice(s+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),u&&(t[u]=a)}return t}function kn(e){let t=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT??e.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(t)return t;let n=process.env.OTEL_EXPORTER_OTLP_ENDPOINT??e.OTEL_EXPORTER_OTLP_ENDPOINT;return n?n.replace(/\/+$/,"")+"/v1/traces":process.env.PINTA_CODEX_ENDPOINT??e.PINTA_CODEX_ENDPOINT??process.env.CLAUDE_PLUGIN_OPTION_ENDPOINT}function wn(e){if(process.env.OTEL_EXPORTER_OTLP_HEADERS)return process.env.OTEL_EXPORTER_OTLP_HEADERS;if(e.OTEL_EXPORTER_OTLP_HEADERS)return e.OTEL_EXPORTER_OTLP_HEADERS;if(process.env.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${process.env.PINTA_CODEX_API_KEY}`;if(e.PINTA_CODEX_API_KEY)return`x-pinta-relay-token=${e.PINTA_CODEX_API_KEY}`;if(process.env.CLAUDE_PLUGIN_OPTION_API_KEY)return`x-pinta-relay-token=${process.env.CLAUDE_PLUGIN_OPTION_API_KEY}`}function lt(){let e=process.env.CODEX_PLUGIN_ROOT??process.env.CLAUDE_PLUGIN_ROOT??process.cwd(),t=process.env.CODEX_PLUGIN_DATA??process.env.CLAUDE_PLUGIN_DATA??Y.join(e,".plugin-data"),n=process.env.CODEX_HOME??Y.join(An.homedir(),".codex"),r=Y.join(n,"pinta-codex.env"),o=ut.existsSync(r)?Rn(r):{},s=kn(o),u=wn(o);if(u&&!process.env.PINTA_RELAY_TOKEN){let c=u.match(/x-pinta-relay-token=([^,\s]+)/i);c&&(process.env.PINTA_RELAY_TOKEN=c[1])}let a=process.env.PINTA_GUARD_ENDPOINT??o.PINTA_GUARD_ENDPOINT;return{pluginRoot:e,pluginData:t,tracePath:Y.join(t,"trace.json"),endpoint:s?.replace(/\/+$/,""),headers:(0,ct.parseHeadersEnv)(u??""),guardEndpoint:a}}function dt(e){return e.hook_event_name==="PreToolUse"}function ft(e){return e.hook_event_name==="PermissionRequest"}function pt(e){return e.hook_event_name==="PostToolUse"}function mt(e){return e.hook_event_name==="UserPromptSubmit"}function _t(e){return e.hook_event_name==="SessionStart"}function gt(e){return e.hook_event_name==="Stop"}var Dn=["PreToolUse","PermissionRequest"],Mn=["PostToolUse","PreCompact","PostCompact","SessionStart","SessionEnd","UserPromptSubmit","SubagentStart","SubagentStop","Stop","Interrupt"],Nn=new Set([...Dn,...Mn]);function yt(e){return!Nn.has(e.hook_event_name)}var Dt=O(S());var ht=O(S()),z=class extends ht.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-codex",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Et=O(S()),K=class extends Et.TraceManager{constructor(t){super(t.tracePath)}};import Z from"fs";import Pe from"os";import Ln from"path";var H="1.11.0";import T from"node:fs";import Pt from"node:path";var Cn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),jn=256*1024,In=1024*1024,Bn=4096;function w(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function ye(e){let t=w(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Cn.has(r.toLowerCase())?r:void 0}function vt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function he(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function I(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function St(e,t){let n=e.timestamp===void 0?I(t):I(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Tt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Pt.isAbsolute(e)||Pt.extname(e)!==".jsonl")return;let t;try{t=T.openSync(e,T.constants.O_RDONLY|T.constants.O_NONBLOCK|(T.constants.O_NOFOLLOW??0));let n=T.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,jn));if(T.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),s;if(o>=0)try{s=w(JSON.parse(r.toString("utf8",0,o)))}catch{}let u=Math.max(0,n.size-In),a=n.size<=r.length?r:Buffer.alloc(n.size-u);if(a!==r&&T.readSync(t,a,0,a.length,u)!==a.length)return;let c=T.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=u>0?a.indexOf(10)+1:0,p=a.lastIndexOf(10);if(u>0&&l===0||p<l)return;let P=[],N=0;for(;p>l&&N<Bn;){let Vt=a.lastIndexOf(10,p-1),Se=Math.max(l,Vt+1),Te=a.toString("utf8",Se,p).trim();if(Te){let Oe=w(JSON.parse(Te));Oe&&P.push(Oe)}p=Se-1,N++}return P.reverse(),{first:s,rows:P,complete:u===0&&p<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{T.closeSync(t)}catch{}}}function Ot(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}function bt(e,t){let n=ye(e.model);if(n)return{name:n,source:"hook.model"};try{return Un(e,t)}catch{return}}function Un(e,t){if(e.hook_event_name==="SubagentStart"||e.hook_event_name==="SubagentStop")return;let n=he(e.session_id),r=he(e.turn_id),o=St(e,t);if(!n||!r||o===void 0||e.agent_id!==void 0&&e.agent_id!==n)return;let s=Tt(e.transcript_path),u=s?.first,a=I(u?.timestamp);if(!s||u?.type!=="session_meta"||w(u.payload)?.id!==n||a===void 0||a>o||s.rows.some(l=>l.type==="session_meta"&&w(l.payload)?.id!==n))return;let c=[];for(let l of s.rows){let p=w(l.payload),P=I(l.timestamp);if(l.type!=="turn_context"||p?.turn_id!==r||P===void 0||P>o||P<a)continue;let N=ye(p.model);c.push(N?{name:N,source:"transcript.turn_context"}:void 0)}return Ot(c)}var D=O(S()),W;function qn(){if(W===void 0)try{W=Pe.userInfo().username}catch{W=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return W}var At=H,Ee;function B(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}var xt=256*1024;function Gn(e){if(!e)return;let t;try{t=Z.openSync(e,"r");let n=Buffer.allocUnsafe(xt),r=Z.readSync(t,n,0,xt,0),o=n.toString("utf8",0,r),s=o.indexOf(`
+`);if(s<0)return;let u=JSON.parse(o.slice(0,s));return u?.type!=="session_meta"?void 0:B(u.payload?.cli_version)}catch{return}finally{if(t!==void 0)try{Z.closeSync(t)}catch{}}}function Fn(){let e=B(process.env.CODEX_MANAGED_PACKAGE_ROOT);if(e)try{let t=JSON.parse(Z.readFileSync(Ln.join(e,"package.json"),"utf8"));return B(t.version)}catch{return}}function $n(e){return Ee===void 0&&(Ee=Gn(B(e?.transcript_path))??Fn()??B(process.env.CODEX_CLI_VERSION)??null),Ee??void 0}var Xn=new Set(["codex.hook","codex.tool_name","codex.tool_use_id","codex.session_id","codex.transcript_path","codex.cwd","codex.permission_mode"]),Vn=new Set(["codex.tool_input","codex.tool_response"]),Yn={skipRedactKeys:Xn,bashContextKeys:Vn};function zn(e,t){let n=[];n.push({key:"ingest.type",value:{stringValue:"codex"}}),n.push({key:"codex.hook",value:{stringValue:e.hook_event_name}});let r={};for(let[o,s]of Object.entries(e))o!=="hook_event_name"&&(r[o]=s);return vt(r,bt(e,t)),n.push(...(0,D.attrsFromRecord)(r,"codex",Yn)),n}function Kn(e){let t=$n(e);return[{key:"service.name",value:{stringValue:"codex"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-codex"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:At}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:qn()}},{key:"host.name",value:{stringValue:Pe.hostname()}},{key:"host.arch",value:{stringValue:Pe.arch()}}]}function Rt(e){let t=e.now??Date.now();return(0,D.buildPayload)({traceId:e.traceId,spanName:`codex.${(0,D.snakeCase)(e.event.hook_event_name)}`,attributes:zn(e.event,t),resource:Kn(e.event),scope:{name:"pinta-codex",version:At},now:t})}function U(e,t,n){let r=new K(t),o=n.trace==="new"?r.newTrace():r.currentTrace();return Rt({event:e,traceId:o})}async function L(e,t){let n=new z(t);await n.flush(),await n.send(e)}async function E(e,t,n){await L(U(e,t,n),t)}var kt=O(S());var Hn=100,Wn=`pinta-codex/${H}`;async function wt(e,t){let n=await(0,kt.evaluateGuard)(e,t,{timeoutMs:Hn,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Wn});if(n===null)return null;let r={decision:n.decision,reason:n.reason,durationMs:n.durationMs,clientRttMs:n.clientRttMs};return n.failOpenReason!==void 0&&(r.failOpenReason=n.failOpenReason),r}async function J(e,t){return wt(e,t.guardEndpoint)}function Q(e){let t=e?.reason;return typeof t=="string"&&t.trim().length>0?t:"guard_deny"}async function Mt(e,t){let n=U(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Q(r)}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Dt.attachGuard)(n,r),await L(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}var Nt=O(S());async function Ct(e,t){let n=U(e,t,{trace:"current"}),r=await J(n,t);if(r?.decision==="DENY"){let o={hookSpecificOutput:{hookEventName:"PermissionRequest",decision:{behavior:"deny",message:Q(r)}}};process.stdout.write(JSON.stringify(o)+`
+`)}try{(0,Nt.attachGuard)(n,r),await L(n,t)}catch(o){process.stderr.write(`[pinta-codex] telemetry emit failed: ${o}
+`)}return 0}async function jt(e,t){return await E(e,t,{trace:"current"}),0}async function It(e,t){return await E(e,t,{trace:"new"}),0}async function Bt(e,t){return await E(e,t,{trace:"current"}),0}async function Ut(e,t){return await E(e,t,{trace:"current"}),0}async function Lt(e,t){return await E(e,t,{trace:"current"}),0}async function qt(e){return 0}async function Zn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Gt(){let e=0;try{let t=lt(),n=await Zn(),r=JSON.parse(n);yt(r)?e=await qt(r):dt(r)?e=await Mt(r,t):ft(r)?e=await Ct(r,t):pt(r)?e=await jt(r,t):mt(r)?e=await It(r,t):_t(r)?e=await Bt(r,t):gt(r)?e=await Ut(r,t):e=await Lt(r,t)}catch(t){process.stderr.write(`[pinta-codex] error: ${t}
+`),e=0}return e}var Ft=O(S());import{opendir as Jn,stat as Qn}from"node:fs/promises";import ve from"node:path";var er="pinta-codex",tr=/^rollout-.+-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$/;function nr(){return(0,Ft.envFilePath)(".codex","sessions","CODEX_HOME")}function rr(e,t){return ve.relative(e,t).split(ve.sep).join("/")}function or(e){return e.endsWith(".jsonl")?"append-log":"rewritten-doc"}function sr(e){return e.endsWith(".jsonl")?"session-log":"other"}function ir(e){let t=e.slice(e.lastIndexOf("/")+1);return tr.exec(t)?.[1]}async function $t(){return[nr()]}async function*Xt(e,t){let n;try{n=await Jn(t)}catch{return}try{for await(let r of n){let o=ve.join(t,r.name);r.isDirectory()?yield*Xt(e,o):r.isFile()&&(yield{absPath:o,relPath:rr(e,o)})}}catch{return}}async function*ar(e){let[t]=await $t(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of Xt(t,t)){let s;try{s=await Qn(r)}catch{continue}n!==void 0&&s.mtime.getTime()<=n||(yield{relPath:o,absPath:r,size:s.size,mtime:s.mtime,sessionId:ir(o),semantics:or(o)})}}var ur={id:er,roots:$t,scan:ar,classify:sr};function dr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===lr(cr(e)).href}catch{return!1}}async function fr(){let e=await Gt();process.exit(e)}dr()&&fr();export{ur as lifecycle};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinta-ai/pinta-codex",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Generic OTLP forwarder for Codex hook events",
   "main": "dist/index.js",
   "exports": {
@@ -45,10 +45,11 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "smoke:import": "node scripts/smoke-import.mjs",
+    "smoke:model": "node scripts/smoke-model.mjs",
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {
-    "@pinta-ai/core": "^0.8.0",
+    "@pinta-ai/core": "^0.9.0",
     "@types/node": "^22.0.0",
     "esbuild": "^0.24.0",
     "typescript": "^5.7.0",