@pinta-ai/pinta-copilot 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -2,7 +2,30 @@
 
 All notable changes to pinta-copilot are documented here.
 
-## [Unreleased]
+## [0.10.2] - 2026-09-30
+
+### Fixed
+
+- Bundle `@pinta-ai/core` `^0.9.2`, which limits attached short-password
+  masking to mysql-family executables instead of ordinary `find -path` and
+  `find -print` arguments (PTA-515). Guard/export ordering is unchanged.
+- Emit top-level `permissionDecision` for native camelCase `preToolUse`.
+  Copilot CLI 1.0.88 ignores the previous nested PascalCase envelope and
+  executes the tool despite a guard DENY. Keep the nested `PreToolUse`
+  contract and choose only from the explicit event/binding (PTA-591).
+- Preserve the internal `ask_user` exemption for the documented PascalCase
+  `AskUserQuestion` alias without exempting arbitrary case variants or MCP
+  tool names (PTA-593).
+- Add red-before-green hook and CJS/ESM subprocess regressions for both gaps.
+
+### Compatibility
+
+- Native failed-result protection remains unsupported: Copilot 1.0.88 ignores
+  attempted stop/replacement output from `PostToolUseFailure`. Document this
+  separately from ordinary nonzero shell exits, which use successful
+  `PostToolUse` and its existing replacement gate (PTA-592).
+- Existing REVIEW/disabled/fail-open behavior, successful-output replacement,
+  original-span queueing and no-collector-IO-after-DENY guarantees remain.
 
 ## [0.10.1] - 2026-09-29
 

package/README.md

@@ -55,11 +55,17 @@ PINTA_GUARD_ENDPOINT=https://your-relay.example.com/guard
 
 ## Guard (allow / deny + reason)
 
-On `preToolUse` (all surfaces) and `permissionRequest` (CLI only) the adapter queries `PINTA_GUARD_ENDPOINT`. A `DENY` is emitted in the surface-appropriate format and the reason is shown to the model/user:
+On `preToolUse` (all surfaces) and `permissionRequest` (CLI only) the adapter queries `PINTA_GUARD_ENDPOINT`. A `DENY` is emitted in the registration's protocol format and the reason is shown to the model/user:
 
-- `preToolUse` → `{ "hookSpecificOutput": { "hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": "<reason>" } }`
+- Native camelCase `preToolUse` → `{ "permissionDecision": "deny", "permissionDecisionReason": "<reason>" }`
+- PascalCase `PreToolUse` → `{ "hookSpecificOutput": { "hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": "<reason>" } }`
 - `permissionRequest` → `{ "behavior": "deny", "message": "<reason>" }`
 
+Copilot CLI 1.0.88 ignores the nested PascalCase denial on a native camelCase
+hook. The adapter selects the response from the explicit event discriminator
+or trusted per-hook `PINTA_COPILOT_EVENT` binding, not from tool-input contents.
+Preserve the registered spelling in that binding.
+
 Guard is **fail-open** (no endpoint / timeout / error → allow), so it never breaks a session.
 
 Once a `DENY` is decided, the hook does **not** wait for collector IO. It emits
@@ -106,9 +112,22 @@ the result may remain in the transcript; start a new session, not a resumed
 tainted conversation.
 
 `ALLOW`, `REVIEW`, inactive guarding and existing fail-open behavior are
-unchanged. Internal control tools remain telemetry-only.
-`PostToolUseFailure` remains telemetry-only: this gate covers successful
-results, not failed-tool error content.
+unchanged. Internal control tools `report_intent`, `ask_user` and its documented
+PascalCase alias `AskUserQuestion` remain telemetry-only. Arbitrary case variants
+or similarly named MCP tools are not exempt.
+
+**Native failed-result enforcement is unsupported.** `PostToolUseFailure`
+remains telemetry-only, not a protected phase. In native Copilot CLI 1.0.88,
+the failure hook fires for a failed `view`, but both `continue: false` and
+`modifiedResult` are ignored and the original error reaches the next model
+request. The hook's `error` may also be less complete than the model-facing
+result. A future supported host failure-result/batch contract is required;
+printing a denial alone would falsely claim protection.
+
+Ordinary shell exit status 1 is a different case: Copilot delivers that
+result through successful `PostToolUse`, so it is eligible for the existing
+successful-result gate. Native hook phase, not a guessed exit-code pattern,
+determines which contract applies.
 
 Enforcement requires synchronous hooks, a host honoring the documented
 [Copilot result-replacement](https://docs.github.com/en/copilot/reference/hooks-reference#posttooluse-output)

package/dist/index.js

@@ -1,22 +1,26 @@
-"use strict";var Ft=Object.create;var Me=Object.defineProperty;var Gt=Object.getOwnPropertyDescriptor;var $t=Object.getOwnPropertyNames;var Yt=Object.getPrototypeOf,zt=Object.prototype.hasOwnProperty;var P=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Xt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of $t(t))!zt.call(e,o)&&o!==n&&Me(e,o,{get:()=>t[o],enumerable:!(r=Gt(t,o))||r.enumerable});return e};var _=(e,t,n)=>(n=e!=null?Ft(Yt(e)):{},Xt(t||!e||!e.__esModule?Me(n,"default",{value:e,enumerable:!0}):n,e));var ue=P(g=>{"use strict";Object.defineProperty(g,"__esModule",{value:!0});g.PATTERNS=g.MAX_BYTES=void 0;g.truncateTo=Ie;g.truncate=Kt;g.collectMatches=De;g.resolveOverlaps=xe;g.applyMatches=Ne;g.redact=Ht;g.MAX_BYTES=102400;function Ie(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Kt(e){return Ie(e,g.MAX_BYTES)}g.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function De(e,t){let n=[];for(let r of g.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let u=r.captureGroup??0,a=i[u];if(a===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,f=i.index+i[0].length,l=c+i[0].indexOf(a),S=l+a.length;n.push({start:c,end:f,replaceStart:l,replaceEnd:S,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function xe(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Ne(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function Ht(e,t={}){if(e.length===0)return e;let n=De(e,t);if(n.length===0)return e;let r=xe(n);return Ne(e,r)}});var le=P(m=>{"use strict";var Zt=m&&m.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(m,"__esModule",{value:!0});m.MAX_SPAN_BYTES=void 0;m.ulidToTraceId=Ce;m.newSpanId=Ve;m.snakeCase=Qt;m.toOtlpValue=qe;m.attrsFromRecord=en;m.guardAttrs=Be;m.clientAttrs=Fe;m.enforceSpanBudget=Ge;m.buildPayload=tn;m.attachGuard=$e;m.mergeBatch=nn;var Jt=Zt(require("crypto")),ce=ue(),Wt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ce(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=Wt.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ve(){return Jt.default.randomBytes(8).toString("hex")}function Qt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var je=new Set;function K(e,t,n){let r=(0,ce.truncate)(t);if((n.skipRedactKeys??je).has(e))return r;let o=(n.bashContextKeys??je).has(e)?"bash":void 0;return(0,ce.redact)(r,{context:o})}function qe(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:K(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:K(e,JSON.stringify(t),n)}}catch{return{stringValue:K(e,String(t),n)}}default:return{stringValue:K(e,String(t),n)}}}function en(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let u=`${t}.${o}`,a=qe(u,i,n);a!==null&&r.push({key:u,value:a})}return r}function Be(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Fe(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}m.MAX_SPAN_BYTES=800*1024;function Ue(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Le=1024;function Ge(e,t=m.MAX_SPAN_BYTES){let n=Ue(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let f=Buffer.byteLength(c.value.stringValue,"utf-8");f>i&&(i=f,o=c.value)}if(o===null||i<=Le)break;let u=n-t,a=Math.max(Le,i-u-64);o.stringValue=(0,ce.truncateTo)(o.stringValue,a),n=Ue(e)}return e}function tn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Ce(e.traceId),spanId:Ve(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ge(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return $e(i,e.guard,e.clientTiming)}function $e(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Be(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Fe(o)),e}function nn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Ye=P(R=>{"use strict";Object.defineProperty(R,"__esModule",{value:!0});R.GUARD_STATUS_REFUSED=R.GUARD_BUDGET_HEADER=void 0;R.evaluateGuard=an;var rn=1e4,on="pinta-core";R.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function H(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var sn=new Set(["ALLOW","DENY","REVIEW"]);R.GUARD_STATUS_REFUSED=410;async function an(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??rn,o=Date.now(),i=new AbortController,u=setTimeout(()=>i.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??on,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[R.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(a.status===R.GUARD_STATUS_REFUSED)return H(Date.now()-o,"refused");if(a.status!==200)return H(Date.now()-o,"error");let c=await a.json(),f=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!sn.has(c.decision)||!f)return H(Date.now()-o,"error");let l=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??l,clientRttMs:l}}catch(a){let c=a.name,f=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return H(Date.now()-o,f)}finally{clearTimeout(u)}}});var Z=P(G=>{"use strict";var un=G&&G.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(G,"__esModule",{value:!0});G.atomicWriteFileSync=cn;var ze=un(require("fs"));function cn(e,t){let n=`${e}.${process.pid}.tmp`;ze.default.writeFileSync(n,t),ze.default.renameSync(n,e)}});var pe=P(I=>{"use strict";var Xe=I&&I.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(I,"__esModule",{value:!0});I.MemoryRetryQueue=I.DiskRetryQueue=void 0;var y=Xe(require("fs")),J=Xe(require("path")),ln=Z(),W=1e3,dn=50,fn=5,de=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=J.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{y.default.mkdirSync(J.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;y.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
-`)}}readAll(){try{let t=y.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){y.default.existsSync(this.filePath)&&y.default.unlinkSync(this.filePath);return}y.default.mkdirSync(J.default.dirname(this.filePath),{recursive:!0}),(0,ln.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+"use strict";var Zt=Object.create;var xe=Object.defineProperty;var Jt=Object.getOwnPropertyDescriptor;var Wt=Object.getOwnPropertyNames;var Qt=Object.getPrototypeOf,en=Object.prototype.hasOwnProperty;var E=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var tn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Wt(t))!en.call(e,o)&&o!==n&&xe(e,o,{get:()=>t[o],enumerable:!(r=Jt(t,o))||r.enumerable});return e};var g=(e,t,n)=>(n=e!=null?Zt(Qt(e)):{},tn(t||!e||!e.__esModule?xe(n,"default",{value:e,enumerable:!0}):n,e));var Le=E(de=>{"use strict";Object.defineProperty(de,"__esModule",{value:!0});de.mysqlPasswordRanges=ln;var nn=new Set(["mysql","mysqldump","mysqladmin","mysqlcheck","mysqlimport","mysqlshow","mariadb","mariadb-dump","mariadb-admin","mariadb-check","mariadb-import","mariadb-show"]),rn=new Set(["sh","bash","dash","zsh","ksh"]),on=new Set(["-u","--user","-h","--host","-P","--port","-D","--database","-S","--socket","-e","--execute","--protocol","--default-character-set","--defaults-file","--defaults-extra-file","--login-path","--init-command","--ssl-ca","--ssl-capath","--ssl-cert","--ssl-key","--ssl-cipher"]),J=16;function je(e,t,n=e.value.length){return{value:e.value.slice(t,n),ranges:e.ranges.slice(t,n)}}function F(e,t,n,r){e.value+=t.value.slice(n,r);for(let o=n;o<r;o++)e.ranges.push(t.ranges[o])}function Ue(e){if(e?.literal)return e.value.slice(e.value.lastIndexOf("/")+1).replace(/\.exe$/,"")}function sn(e){let t=0;for(let n=0;n<=J;n++){for(;/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.value??"");)t++;let r=Ue(e[t]);if(!r)return;if(["!","if","then","elif","else","while","until","do"].includes(r)){t++;continue}let o={env:["-u","--unset","-C","--chdir"],sudo:["-u","--user","-g","--group","-p","--prompt","-D","--chdir","-R","--chroot","-C","--close-from","-T","--command-timeout"],exec:["-a"],nice:["-n","--adjustment"],timeout:["-s","--signal","-k","--kill-after"]},i={env:["-i","--ignore-environment","-0","--null"],sudo:["-n","-E","-H","-S","-b","-k"],command:["-p"],exec:["-c","-l"],nohup:[],nice:[],time:["-p"],timeout:["--foreground","--preserve-status"]};if(!(r in i))return t;for(t++;e[t]?.value.startsWith("-");){let s=e[t++].value;if(s==="--")break;if(!i[r].includes(s)){if((o[r]??[]).includes(s)){if(!e[t++])return;continue}if(!(o[r]??[]).some(a=>a.startsWith("--")?s.startsWith(a+"="):s.startsWith(a)&&s.length>2)&&!(r==="nice"&&/^-\d+$/.test(s)))return}}if(r==="timeout"&&!/^\d+(?:\.\d+)?[smhd]?$/.test(e[t++]?.value??""))return}}function Ce(e,t){let n=1,r="";for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"&&r!=="'"){o++;continue}if(r){i===r&&(r="");continue}if(i==="'"||i==='"')r=i;else if(i==="(")n++;else if(i===")"&&--n===0)return o}return e.length}function an(e,t,n,r){let o={value:"",ranges:[],start:t,end:t,literal:!0},i="",s=t;for(;s<e.value.length;){let a=e.value[s];if(!i&&/[\s;|&()<>{}]/.test(a))break;if(a===i){i="",s++;continue}if(!i&&(a==="'"||a==='"')){i=a,s++;continue}if(a==="\\"&&i!=="'"){let c=e.value[s+1];if(c===`
+`){s+=2;continue}if(c&&(!i||/[$`"\\]/.test(c))){F(o,e,s+1,s+2),s+=2;continue}}if(i!=="'"&&e.value.startsWith("$(",s)){let c=Ce(e.value,s+2);e.value[s+2]!=="("&&r<J&&V(je(e,s+2,c),n,r+1),F(o,e,s,Math.min(c+1,e.value.length)),o.literal=!1,s=Math.min(c+1,e.value.length);continue}if(a==="`"&&i!=="'"){let c=s+1;for(;c<e.value.length&&e.value[c]!=="`";)c+=e.value[c]==="\\"?2:1;r<J&&V(je(e,s+1,c),n,r+1),F(o,e,s,Math.min(c+1,e.value.length)),o.literal=!1,s=Math.min(c+1,e.value.length);continue}a==="$"&&i!=="'"&&(o.literal=!1),F(o,e,s,s+1),s++}return o.end=s,o}function un(e,t,n,r){let o=sn(t);if(o===void 0)return;let i=Ue(t[o]);if(rn.has(i)&&r<J){for(let s=o+1;s<t.length;s++){let a=t[s].value;if(a==="--command"||/^-[a-zA-Z]*c[a-zA-Z]*$/.test(a)){let c=t[s+1];c&&V(c,n,r+1);return}if(!a.startsWith("-")||a==="--")return;(a==="-o"||a==="-O")&&s++}return}if(nn.has(i))for(let s=o+1;s<t.length;s++){let a=t[s];if(a.value==="--")return;if(on.has(a.value)){s++;continue}a.value.startsWith("-p")&&a.value.length>2&&n.push({start:e.ranges[a.start].start,end:e.ranges[a.end-1].end})}}function V(e,t,n=0){let r=[],o,i=[],s=0,a=()=>{un(e,r,t,n),r=[],o=void 0};for(;s<e.value.length;){let c=e.value[s];if(c===`
+`){a(),s++;for(let l of i.splice(0))for(;s<e.value.length;){let d=e.value.indexOf(`
+`,s),h=d<0?e.value.length:d,y=e.value.slice(s,h);if(s=d<0?h:h+1,(l.stripTabs?y.replace(/^\t+/,""):y)===l.delimiter)break}}else if(/\s/.test(c))s++;else if(c==="#"){let l=e.value.indexOf(`
+`,s);s=l<0?e.value.length:l}else if(e.value.startsWith("((",s))a(),s=Math.min(Ce(e.value,s+1)+1,e.value.length);else if(/[;|&(){}]/.test(c))a(),s++;else if(c==="<"||c===">")r.at(-1)?.end===s&&/^\d+$/.test(r.at(-1).value)&&r.pop(),o=/^(?:<<<|<<-?|>>|<&|>&|[<>])/.exec(e.value.slice(s))?.[0]??c,s+=o.length;else{let l=an(e,s,t,n);s=l.end,(o==="<<"||o==="<<-")&&i.push({delimiter:l.value,stripTabs:o==="<<-"}),o||r.push(l),o=void 0}}a()}function cn(e,t,n){let r={value:"",ranges:[]};for(let o=t+1;o<n-1;o++){if(e.value[o]!=="\\"){F(r,e,o,o+1);continue}let i=o+(e.value[o+1]==="u"?6:2),s=JSON.parse(`"${e.value.slice(o,i)}"`);r.value+=s;for(let a=0;a<s.length;a++)r.ranges.push({start:e.ranges[o].start,end:e.ranges[i-1].end});o=i-1}return r}function ln(e){let t={value:e,ranges:Array.from({length:e.length},(r,o)=>({start:o,end:o+1}))},n=[];if(/^\s*[{[]/.test(e)){let r;try{r=JSON.parse(e)}catch{return V(t,n),n}if(r!==null&&typeof r=="object"){let o=/"(?:[^"\\]|\\.)*"/g,i;for(;i=o.exec(e);){let s=JSON.parse(i[0]);if(s!=="command"&&s!=="cmd"&&s!=="CommandLine")continue;let a=/^\s*:\s*/.exec(e.slice(o.lastIndex));if(!a)continue;let c=o.lastIndex+a[0].length;if(e[c]!=='"')continue;o.lastIndex=c;let l=o.exec(e);l?.index===c&&V(cn(t,c,c+l[0].length),n)}}return n}return V(t,n),n}});var fe=E(_=>{"use strict";Object.defineProperty(_,"__esModule",{value:!0});_.PATTERNS=_.MAX_BYTES=void 0;_.truncateTo=qe;_.truncate=fn;_.collectMatches=Ve;_.resolveOverlaps=Be;_.applyMatches=$e;_.redact=pn;var dn=Le();_.MAX_BYTES=102400;function qe(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function fn(e){return qe(e,_.MAX_BYTES)}_.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Ve(e,t){let n=[];for(let r of _.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;if(r.type==="cli_password_short"){for(let{start:s,end:a}of(0,dn.mysqlPasswordRanges)(e))n.push({start:s,end:a,replaceStart:s,replaceEnd:a,type:r.type,replacement:`-p[REDACTED:${r.type}]`});continue}let o=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=o.exec(e))!==null;){let s=r.captureGroup??0,a=i[s];if(a===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,l=i.index+i[0].length,d=c+i[0].indexOf(a),h=d+a.length;n.push({start:c,end:l,replaceStart:d,replaceEnd:h,type:r.type}),i.index===o.lastIndex&&o.lastIndex++}}return n}function Be(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function $e(e,t){let n=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+(o.replacement??`[REDACTED:${o.type}]`)+r.slice(o.replaceEnd);return r}function pn(e,t={}){if(e.length===0)return e;let n=Ve(e,t);if(n.length===0)return e;let r=Be(n);return $e(e,r)}});var me=E(m=>{"use strict";var mn=m&&m.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(m,"__esModule",{value:!0});m.MAX_SPAN_BYTES=void 0;m.ulidToTraceId=ze;m.newSpanId=Xe;m.snakeCase=_n;m.toOtlpValue=He;m.attrsFromRecord=yn;m.guardAttrs=Ke;m.clientAttrs=Ze;m.enforceSpanBudget=Je;m.buildPayload=Sn;m.attachGuard=We;m.mergeBatch=Tn;var hn=mn(require("crypto")),pe=fe(),gn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function ze(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=gn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Xe(){return hn.default.randomBytes(8).toString("hex")}function _n(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Ge=new Set;function W(e,t,n){let r=(0,pe.truncate)(t);if((n.skipRedactKeys??Ge).has(e))return r;let o=(n.bashContextKeys??Ge).has(e)?"bash":void 0;return(0,pe.redact)(r,{context:o})}function He(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:W(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:W(e,JSON.stringify(t),n)}}catch{return{stringValue:W(e,String(t),n)}}default:return{stringValue:W(e,String(t),n)}}}function yn(e,t,n={}){let r=[];for(let[o,i]of Object.entries(e)){let s=`${t}.${o}`,a=He(s,i,n);a!==null&&r.push({key:s,value:a})}return r}function Ke(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ze(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}m.MAX_SPAN_BYTES=800*1024;function Fe(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Ye=1024;function Je(e,t=m.MAX_SPAN_BYTES){let n=Fe(e);for(let r=0;r<100&&n>t;r++){let o=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>i&&(i=l,o=c.value)}if(o===null||i<=Ye)break;let s=n-t,a=Math.max(Ye,i-s-64);o.stringValue=(0,pe.truncateTo)(o.stringValue,a),n=Fe(e)}return e}function Sn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:ze(e.traceId),spanId:Xe(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Je(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return We(i,e.guard,e.clientTiming)}function We(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Ke(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...Ze(o)),e}function Tn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Qe=E(R=>{"use strict";Object.defineProperty(R,"__esModule",{value:!0});R.GUARD_STATUS_REFUSED=R.GUARD_BUDGET_HEADER=void 0;R.evaluateGuard=vn;var On=1e4,En="pinta-core";R.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function Q(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Pn=new Set(["ALLOW","DENY","REVIEW"]);R.GUARD_STATUS_REFUSED=410;async function vn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??On,o=Date.now(),i=new AbortController,s=setTimeout(()=>i.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??En,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[R.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(a.status===R.GUARD_STATUS_REFUSED)return Q(Date.now()-o,"refused");if(a.status!==200)return Q(Date.now()-o,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!Pn.has(c.decision)||!l)return Q(Date.now()-o,"error");let d=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??d,clientRttMs:d}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return Q(Date.now()-o,l)}finally{clearTimeout(s)}}});var ee=E(Y=>{"use strict";var bn=Y&&Y.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(Y,"__esModule",{value:!0});Y.atomicWriteFileSync=An;var et=bn(require("fs"));function An(e,t){let n=`${e}.${process.pid}.tmp`;et.default.writeFileSync(n,t),et.default.renameSync(n,e)}});var _e=E(I=>{"use strict";var tt=I&&I.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(I,"__esModule",{value:!0});I.MemoryRetryQueue=I.DiskRetryQueue=void 0;var T=tt(require("fs")),te=tt(require("path")),Rn=ee(),ne=1e3,wn=50,kn=5,he=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=te.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{T.default.mkdirSync(te.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;T.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=T.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){T.default.existsSync(this.filePath)&&T.default.unlinkSync(this.filePath);return}T.default.mkdirSync(te.default.dirname(this.filePath),{recursive:!0}),(0,Rn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{y.default.mkdirSync(J.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<dn;)try{let n=y.default.openSync(this.lockPath,"wx");return y.default.writeSync(n,String(process.pid)),y.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let i=y.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){y.default.unlinkSync(this.lockPath);continue}}catch{}let r=fn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{y.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=W)return;let n=t.length-W;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};I.DiskRetryQueue=de;var fe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>W&&this.entries.splice(0,this.entries.length-W)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};I.MemoryRetryQueue=fe});var Qe=P(p=>{"use strict";Object.defineProperty(p,"__esModule",{value:!0});p.MemoryTransport=p.DiskTransport=p.MAX_POST_BYTES=void 0;p.parseHeadersEnv=Je;p.envOptionsResolver=We;p.postOtlp=$;var Ke=pe(),He=le(),pn=5e3;p.MAX_POST_BYTES=900*1024;function Q(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Ze(e,t,n){let r=[],o=[],i=[],u=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}i.length>0&&u+c>n&&(r.push(i),i=[],u=0),i.push(a),u+=c}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function Je(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function We(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Je(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function $(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),pn);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let u="";try{u=(await i.text()).slice(0,200)}catch{}let a=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${a}${u?` body=${u}`:""}
+`)}}tryAcquireLock(){let t=Date.now();try{T.default.mkdirSync(te.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<wn;)try{let n=T.default.openSync(this.lockPath,"wx");return T.default.writeSync(n,String(process.pid)),T.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let i=T.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){T.default.unlinkSync(this.lockPath);continue}}catch{}let r=kn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{T.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=ne)return;let n=t.length-ne;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};I.DiskRetryQueue=he;var ge=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>ne&&this.entries.splice(0,this.entries.length-ne)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};I.MemoryRetryQueue=ge});var at=E(p=>{"use strict";Object.defineProperty(p,"__esModule",{value:!0});p.MemoryTransport=p.DiskTransport=p.MAX_POST_BYTES=void 0;p.parseHeadersEnv=st;p.envOptionsResolver=it;p.postOtlp=z;var nt=_e(),rt=me(),Mn=5e3;p.MAX_POST_BYTES=900*1024;function re(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function ot(e,t,n){let r=[],o=[],i=[],s=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}i.length>0&&s+c>n&&(r.push(i),i=[],s=0),i.push(a),s+=c}return i.length>0&&r.push(i),{chunks:r,oversize:o}}function st(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function it(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:st(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function z(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),Mn);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let s="";try{s=(await i.text()).slice(0,200)}catch{}let a=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${a}${s?` body=${s}`:""}
 `),!1}return!0}catch(i){return process.stderr.write(`[${n}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var me=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ke.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??We}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await $(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=Ze(n,a=>Q(a.payload),p.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${p.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...r),u=0;for(let a of r){if(!await $((0,He.mergeBatch)(a.map(f=>f.payload)),t,this.logPrefix))break;u+=a.length}this.queue.rewrite(i.slice(u))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=Q(t);return n<=p.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};p.DiskTransport=me;var _e=class{queue=new Ke.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(Q(t)>p.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await $(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=Ze(n,Q,p.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${p.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...r),u=0;for(let a of r){if(!await $((0,He.mergeBatch)(a),t,this.logPrefix))break;u+=a.length}for(let a of i.slice(u))this.queue.enqueue(a)}};p.MemoryTransport=_e});var Se=P(j=>{"use strict";var ye=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=tt;var et=ye(require("fs")),mn=ye(require("path")),_n=ye(require("crypto")),gn=Z(),ge="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function tt(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=ge[n&31]+t,n=Math.floor(n/32);let r=_n.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=ge[r[i]&31];for(;o.length<16;)o+=ge[0];return t+o}var he=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=tt();return this.save(t),t}currentTrace(){try{let t=et.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{et.default.mkdirSync(mn.default.dirname(this.tracePath),{recursive:!0}),(0,gn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};j.TraceManager=he});var it=P(D=>{"use strict";var rt=D&&D.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(D,"__esModule",{value:!0});D.MemorySessionTraceManager=D.DiskSessionTraceManager=void 0;var nt=rt(require("fs")),hn=rt(require("path")),ot=Se(),yn=Z(),st=200,Te=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??st}read(){try{let t=JSON.parse(nt.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{nt.default.mkdirSync(hn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,yn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,ot.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};D.DiskSessionTraceManager=Te;var Oe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??st}newTrace(t){let n=t||"default",r=(0,ot.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};D.MemorySessionTraceManager=Oe});var ct=P(U=>{"use strict";var Pe=U&&U.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(U,"__esModule",{value:!0});U.envFilePath=On;U.parseEnvFile=ut;U.loadEnvFile=Pn;var Sn=Pe(require("node:fs")),Tn=Pe(require("node:os")),at=Pe(require("node:path"));function On(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:at.default.join(Tn.default.homedir(),e);return at.default.join(o,t)}function ut(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),u=r.slice(o+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),i&&(t[i]=u)}return t}function Pn(e){let t;try{t=Sn.default.readFileSync(e,"utf-8")}catch{return}let n=ut(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var L=P(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_BUDGET_HEADER=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var x=ue();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return x.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return x.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return x.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return x.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return x.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return x.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return x.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return x.MAX_BYTES}});var T=le();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return T.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return T.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return T.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return T.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return T.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return T.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return T.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return T.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return T.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return T.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return T.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return T.MAX_SPAN_BYTES}});var Ee=Ye();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Ee.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Ee.GUARD_STATUS_REFUSED}});Object.defineProperty(s,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Ee.GUARD_BUDGET_HEADER}});var lt=pe();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return lt.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return lt.MemoryRetryQueue}});var q=Qe();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return q.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return q.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return q.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return q.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return q.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return q.MAX_POST_BYTES}});var dt=Se();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return dt.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return dt.generateUlid}});var ft=it();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return ft.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return ft.MemorySessionTraceManager}});var be=ct();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return be.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return be.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return be.loadEnvFile}})});var Y=_(L());function En(){return(0,Y.envFilePath)(".copilot","pinta-copilot.env","COPILOT_HOME")}function pt(e=En()){(0,Y.loadEnvFile)(e)}var mt=_(require("os")),ee=_(require("path"));function ve(){return process.env.COPILOT_HOME||ee.default.join(mt.default.homedir(),".copilot")}function _t(){let e=process.env.COPILOT_PLUGIN_DATA||ee.default.join(ve(),"pinta-copilot-data");return{pluginData:e,tracePath:ee.default.join(e,"trace.json")}}function gt(e=process.env){return e.COPILOT_AGENT_JOB_ID||e.COPILOT_AGENT_SESSION_ID||e.COPILOT_AGENT_PROMPT?"cloud":e.ELECTRON_RUN_AS_NODE||e.VSCODE_IPC_HOOK||e.VSCODE_PID?"ext":"cli"}var Vt=_(L());function C(e){return typeof e=="string"?e:void 0}function te(e){return C(e.hook_event_name)??C(e.hookEventName)??C(e.hookName)??(process.env.PINTA_COPILOT_EVENT||void 0)}function ht(e){return C(e.session_id)??C(e.sessionId)}function yt(e){return C(e.tool_name)??C(e.toolName)}var bn={sessionstart:"SessionStart",sessionend:"SessionEnd",userpromptsubmit:"UserPromptSubmit",userpromptsubmitted:"UserPromptSubmit",pretooluse:"PreToolUse",posttooluse:"PostToolUse",posttoolusefailure:"PostToolUseFailure",stop:"Stop",agentstop:"Stop",subagentstart:"SubagentStart",subagentstop:"SubagentStop",precompact:"PreCompact",notification:"Notification",permissionrequest:"PermissionRequest",erroroccurred:"ErrorOccurred"};function ne(e){let t=te(e);return t?bn[t.toLowerCase()]??"Unknown":"Unknown"}function St(e){return e==="PreToolUse"||e==="PermissionRequest"||e==="PostToolUse"}var vn=new Set(["report_intent","ask_user"]);function Tt(e){return e!==void 0&&vn.has(e)}var An="Pinta AI withheld this tool output because it matched a blocking policy. The tool already ran. Do not retry this operation to bypass the block.",Rn="Pinta AI stopped this run because a tool output matched a blocking policy. The tool already ran and its original output may remain in the transcript. Review the incident and start a new session instead of resuming this one.";function Ot(e,t,n="cli",r){if(e==="PreToolUse")return JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:t}});if(e==="PermissionRequest")return JSON.stringify({behavior:"deny",message:t});if(e==="PostToolUse"){let o=r!==void 0&&("tool_result"in r||"toolResult"in r),i=r!==void 0&&"tool_response"in r;return JSON.stringify(!o&&(i||n==="ext")?{continue:!1,stopReason:Rn}:{modifiedResult:{resultType:"success",textResultForLlm:An}})}return null}var w=_(L());function Pt(){let e=process.env.COPILOT_PLUGIN_OPTION_ENDPOINT||process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:(0,w.parseHeadersEnv)(process.env.COPILOT_PLUGIN_OPTION_HEADERS||process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}var re=class extends w.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-copilot",resolveOptions:Pt})}};function Et(e,t){if(!Pt())return;let n=Buffer.byteLength(JSON.stringify(e),"utf-8");if(n>w.MAX_POST_BYTES){process.stderr.write(`[pinta-copilot] dropping oversized span payload (${n} > ${w.MAX_POST_BYTES} bytes) - undeliverable, not queued
-`);return}new w.DiskRetryQueue(t.pluginData,"pinta-copilot").enqueue(e)}var bt=_(L()),oe=class extends bt.DiskSessionTraceManager{constructor(t){super(t.tracePath)}};var Nt=_(require("fs")),ae=_(require("os")),ke=_(require("path"));var se="0.10.1";var V=_(L());var Dt=_(require("node:path"));var E=_(require("node:fs")),Ae=_(require("node:path")),wn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),kn=256*1024,Mn=1024*1024,In=4096;function b(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function z(e){let t=b(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!wn.has(r.toLowerCase())?r:void 0}function vt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Re(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function X(e,t){let n=t.filter(r=>e[r]!==void 0).map(r=>Re(e[r]));return n.length>0&&n[0]!==void 0&&n.every(r=>r===n[0])?n[0]:void 0}function B(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function At(e,t){let n=e.timestamp===void 0?B(t):B(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Rt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Ae.default.isAbsolute(e)||Ae.default.extname(e)!==".jsonl")return;let t;try{t=E.default.openSync(e,E.default.constants.O_RDONLY|E.default.constants.O_NONBLOCK|(E.default.constants.O_NOFOLLOW??0));let n=E.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,kn));if(E.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=b(JSON.parse(r.toString("utf8",0,o)))}catch{}let u=Math.max(0,n.size-Mn),a=n.size<=r.length?r:Buffer.alloc(n.size-u);if(a!==r&&E.default.readSync(t,a,0,a.length,u)!==a.length)return;let c=E.default.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let f=u>0?a.indexOf(10)+1:0,l=a.lastIndexOf(10);if(u>0&&f===0||l<f)return;let S=[],O=0;for(;l>f&&O<In;){let k=a.lastIndexOf(10,l-1),N=Math.max(f,k+1),d=a.toString("utf8",N,l).trim();if(d){let h=b(JSON.parse(d));h&&S.push(h)}l=N-1,O++}return S.reverse(),{first:i,rows:S,complete:u===0&&l<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{E.default.closeSync(t)}catch{}}}function wt(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var Dn=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest"]),kt=["agent_id","agentId"],Mt=["turn_id","turnId"];function xn(e,t,n){let r=[e.transcript_path,e.transcriptPath].filter(o=>o!==void 0);return r.length?r.every(o=>o===r[0])?r[0]:void 0:n==="cli"&&/^[A-Za-z0-9_-]{1,128}$/.test(t)?Dt.default.join(ve(),"session-state",t,"events.jsonl"):void 0}function It(e,t){return e.agentId!==void 0&&e.agentId!==null?Re(e.agentId)===t&&t!==void 0:t===void 0&&b(e.data)?.parentToolCallId==null}function xt(e,t,n){let r=z(e.model);if(r)return{name:r,source:"hook.model"};try{return Nn(e,t,n)}catch{return}}function Nn(e,t,n){let r=ne(e),o=X(e,["tool_use_id","toolUseId","tool_call_id","toolCallId"]),i=r==="SessionStart"&&e.source==="startup";if(!i&&(!Dn.has(r)||!o))return;let u=X(e,["session_id","sessionId"]),a=X(e,kt),c=X(e,Mt),f=At(e,n);if(!u||f===void 0||kt.some(d=>e[d]!==void 0)&&!a||Mt.some(d=>e[d]!==void 0)&&!c||!a&&["agent_name","agentName","agent_type","agentType"].some(d=>e[d]!==void 0))return;let l=Rt(xn(e,u,t)),S=l?.first,O=b(S?.data),k=B(S?.timestamp);if(!l||S?.type!=="session.start"||O?.sessionId!==u||k===void 0||k>f||l.rows.some(d=>d.type==="session.start"&&b(d.data)?.sessionId!==u))return;if(i){if(a||!l.complete||e.timestamp===void 0)return;let d=z(O.selectedModel),h=k;for(let M of l.rows){if(M.type!=="session.model_change"||!It(M,void 0))continue;let A=B(M.timestamp);if(A===void 0)return;if(A>f||A<h)continue;let F=z(b(M.data)?.newModel);if(A===h&&F!==d)return;d=F,h=A}return d?{name:d,source:"transcript.session.selected"}:void 0}let N=[];for(let d of l.rows){let h=b(d.data),M=B(d.timestamp);if(!h||M===void 0||M>f||M<k||!It(d,a)||c!==void 0&&h.turnId!==c)continue;let A=!1;if(d.type==="assistant.message"?A=Array.isArray(h.toolRequests)&&h.toolRequests.some(Bt=>b(Bt)?.toolCallId===o):(d.type==="tool.execution_start"||d.type==="tool.execution_complete")&&(A=h.toolCallId===o),!A)continue;let F=z(h.model);N.push(F?{name:F,source:`transcript.${d.type}`}:void 0)}return wt(N)}var ie;function jn(){if(ie===void 0)try{ie=ae.default.userInfo().username}catch{ie=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ie}var jt=se,Un=new Set(["","unknown","undefined","null","n/a","none"]);function v(e){let t=typeof e=="string"?e.trim():void 0;return t&&!Un.has(t.toLowerCase())?t:void 0}var Ln=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function Cn(e){let t=v(e);return t&&Ln.test(t)?t:void 0}function Vn(e){let t=e?v(e.copilot_version)??v(e.copilotVersion)??v(e.cli_version)??v(e.cliVersion)??v(e.version):void 0;return t||(we===void 0&&(we=qn()),we??void 0)}var we;function qn(){let e=v(process.env.COPILOT_CLI_BINARY_VERSION)??v(process.env.COPILOT_CLI_VERSION);if(e)return e;let t=v(process.env.COPILOT_CLI_RESOLVED_DIST_DIR);if(t){let n=Cn(ke.default.basename(t));if(n)return n;let r=Bn(t);if(r)return r}return null}function Bn(e){try{let t=Nt.default.readFileSync(ke.default.join(e,"package.json"),"utf8");return v(JSON.parse(t).version)}catch{return}}var Fn=new Set(["copilot.hook","copilot.tool_name","copilot.toolName","copilot.tool_use_id","copilot.toolUseId","copilot.session_id","copilot.sessionId","copilot.transcript_path","copilot.transcriptPath","copilot.cwd","copilot.permission_mode","copilot.surface","copilot.agent_id","copilot.agent_type","copilot.agent_name","copilot.agent_display_name","copilot.stop_reason","copilot.notification_type"]),Gn=new Set(["copilot.tool_input","copilot.toolInput","copilot.toolArgs","copilot.tool_response","copilot.tool_result","copilot.toolResult"]),$n={skipRedactKeys:Fn,bashContextKeys:Gn},Yn=new Set(["hook_event_name","hookEventName","hookName"]);function zn(e,t,n){let r=Object.fromEntries(Object.entries(e).filter(([o])=>!Yn.has(o)));return vt(r,xt(e,t,n)),[{key:"ingest.type",value:{stringValue:"copilot"}},{key:"copilot.hook",value:{stringValue:te(e)??"unknown"}},{key:"copilot.surface",value:{stringValue:t}},...(0,V.attrsFromRecord)(r,"copilot",$n)]}function Xn(e){let t=Vn(e);return[{key:"service.name",value:{stringValue:"copilot"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-copilot"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:jt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:jn()}},{key:"host.name",value:{stringValue:ae.default.hostname()}},{key:"host.arch",value:{stringValue:ae.default.arch()}}]}function Ut(e){let t=e.now??Date.now();return(0,V.buildPayload)({traceId:e.traceId,spanName:`copilot.${(0,V.snakeCase)(te(e.event)??"unknown")}`,attributes:zn(e.event,e.surface,t),resource:Xn(e.event),scope:{name:"pinta-copilot",version:jt},now:t})}var Lt=_(L());function Kn(){return Number(process.env.PINTA_GUARD_TIMEOUT_MS)||100}var Hn=`pinta-copilot/${se}`;function Ct(e,t){return(0,Lt.evaluateGuard)(e,t,{timeoutMs:Kn(),token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Hn})}async function Zn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function qt(){try{let e=_t(),t=gt(),n=await Zn(),r=JSON.parse(n),o=ne(r),i=ht(r),u=new oe(e),a=o==="UserPromptSubmit"?u.newTrace(i):u.currentTrace(i),c=Ut({event:r,traceId:a,surface:t}),f=yt(r),l=null;if(St(o)&&!Tt(f)&&(l=await Ct(c,process.env.PINTA_GUARD_ENDPOINT)),l?.decision==="DENY"){let O=Ot(o,l.userMessage??l.reason??"guard_deny",t,r);O&&process.stdout.write(O+`
-`)}if((0,Vt.attachGuard)(c,l),l&&o==="PostToolUse")for(let O of c.resourceSpans)for(let k of O.scopeSpans)for(let N of k.spans)N.attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}});if(l?.decision==="DENY")return Et(c,e),0;let S=new re(e);await S.flush(),await S.send(c)}catch(e){process.stderr.write(`[pinta-copilot] error: ${e}
-`)}return 0}pt();async function Jn(){let e=await qt();process.exit(e)}Jn();
+`),!1}finally{clearTimeout(o)}}var ye=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new nt.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??it}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await z(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=ot(n,a=>re(a.payload),p.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${p.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...r),s=0;for(let a of r){if(!await z((0,rt.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;s+=a.length}this.queue.rewrite(i.slice(s))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=re(t);return n<=p.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};p.DiskTransport=ye;var Se=class{queue=new nt.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(re(t)>p.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await z(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=ot(n,re,p.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${p.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...r),s=0;for(let a of r){if(!await z((0,rt.mergeBatch)(a),t,this.logPrefix))break;s+=a.length}for(let a of i.slice(s))this.queue.enqueue(a)}};p.MemoryTransport=Se});var Pe=E(j=>{"use strict";var Ee=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=ct;var ut=Ee(require("fs")),In=Ee(require("path")),Dn=Ee(require("crypto")),Nn=ee(),Te="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function ct(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=Te[n&31]+t,n=Math.floor(n/32);let r=Dn.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=Te[r[i]&31];for(;o.length<16;)o+=Te[0];return t+o}var Oe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=ct();return this.save(t),t}currentTrace(){try{let t=ut.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{ut.default.mkdirSync(In.default.dirname(this.tracePath),{recursive:!0}),(0,Nn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};j.TraceManager=Oe});var mt=E(D=>{"use strict";var dt=D&&D.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(D,"__esModule",{value:!0});D.MemorySessionTraceManager=D.DiskSessionTraceManager=void 0;var lt=dt(require("fs")),xn=dt(require("path")),ft=Pe(),jn=ee(),pt=200,ve=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??pt}read(){try{let t=JSON.parse(lt.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{lt.default.mkdirSync(xn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,jn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,ft.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};D.DiskSessionTraceManager=ve;var be=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??pt}newTrace(t){let n=t||"default",r=(0,ft.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};D.MemorySessionTraceManager=be});var _t=E(U=>{"use strict";var Ae=U&&U.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(U,"__esModule",{value:!0});U.envFilePath=Ln;U.parseEnvFile=gt;U.loadEnvFile=qn;var Un=Ae(require("node:fs")),Cn=Ae(require("node:os")),ht=Ae(require("node:path"));function Ln(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:ht.default.join(Cn.default.homedir(),e);return ht.default.join(o,t)}function gt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),s=r.slice(o+1).trim();(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),i&&(t[i]=s)}return t}function qn(e){let t;try{t=Un.default.readFileSync(e,"utf-8")}catch{return}let n=gt(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var C=E(u=>{"use strict";Object.defineProperty(u,"__esModule",{value:!0});u.loadEnvFile=u.parseEnvFile=u.envFilePath=u.MemorySessionTraceManager=u.DiskSessionTraceManager=u.generateUlid=u.TraceManager=u.MAX_POST_BYTES=u.parseHeadersEnv=u.envOptionsResolver=u.postOtlp=u.MemoryTransport=u.DiskTransport=u.MemoryRetryQueue=u.DiskRetryQueue=u.GUARD_BUDGET_HEADER=u.GUARD_STATUS_REFUSED=u.evaluateGuard=u.MAX_SPAN_BYTES=u.enforceSpanBudget=u.mergeBatch=u.attachGuard=u.buildPayload=u.clientAttrs=u.guardAttrs=u.attrsFromRecord=u.toOtlpValue=u.snakeCase=u.newSpanId=u.ulidToTraceId=u.MAX_BYTES=u.PATTERNS=u.applyMatches=u.resolveOverlaps=u.collectMatches=u.truncateTo=u.truncate=u.redact=void 0;var N=fe();Object.defineProperty(u,"redact",{enumerable:!0,get:function(){return N.redact}});Object.defineProperty(u,"truncate",{enumerable:!0,get:function(){return N.truncate}});Object.defineProperty(u,"truncateTo",{enumerable:!0,get:function(){return N.truncateTo}});Object.defineProperty(u,"collectMatches",{enumerable:!0,get:function(){return N.collectMatches}});Object.defineProperty(u,"resolveOverlaps",{enumerable:!0,get:function(){return N.resolveOverlaps}});Object.defineProperty(u,"applyMatches",{enumerable:!0,get:function(){return N.applyMatches}});Object.defineProperty(u,"PATTERNS",{enumerable:!0,get:function(){return N.PATTERNS}});Object.defineProperty(u,"MAX_BYTES",{enumerable:!0,get:function(){return N.MAX_BYTES}});var O=me();Object.defineProperty(u,"ulidToTraceId",{enumerable:!0,get:function(){return O.ulidToTraceId}});Object.defineProperty(u,"newSpanId",{enumerable:!0,get:function(){return O.newSpanId}});Object.defineProperty(u,"snakeCase",{enumerable:!0,get:function(){return O.snakeCase}});Object.defineProperty(u,"toOtlpValue",{enumerable:!0,get:function(){return O.toOtlpValue}});Object.defineProperty(u,"attrsFromRecord",{enumerable:!0,get:function(){return O.attrsFromRecord}});Object.defineProperty(u,"guardAttrs",{enumerable:!0,get:function(){return O.guardAttrs}});Object.defineProperty(u,"clientAttrs",{enumerable:!0,get:function(){return O.clientAttrs}});Object.defineProperty(u,"buildPayload",{enumerable:!0,get:function(){return O.buildPayload}});Object.defineProperty(u,"attachGuard",{enumerable:!0,get:function(){return O.attachGuard}});Object.defineProperty(u,"mergeBatch",{enumerable:!0,get:function(){return O.mergeBatch}});Object.defineProperty(u,"enforceSpanBudget",{enumerable:!0,get:function(){return O.enforceSpanBudget}});Object.defineProperty(u,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return O.MAX_SPAN_BYTES}});var Re=Qe();Object.defineProperty(u,"evaluateGuard",{enumerable:!0,get:function(){return Re.evaluateGuard}});Object.defineProperty(u,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Re.GUARD_STATUS_REFUSED}});Object.defineProperty(u,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Re.GUARD_BUDGET_HEADER}});var yt=_e();Object.defineProperty(u,"DiskRetryQueue",{enumerable:!0,get:function(){return yt.DiskRetryQueue}});Object.defineProperty(u,"MemoryRetryQueue",{enumerable:!0,get:function(){return yt.MemoryRetryQueue}});var B=at();Object.defineProperty(u,"DiskTransport",{enumerable:!0,get:function(){return B.DiskTransport}});Object.defineProperty(u,"MemoryTransport",{enumerable:!0,get:function(){return B.MemoryTransport}});Object.defineProperty(u,"postOtlp",{enumerable:!0,get:function(){return B.postOtlp}});Object.defineProperty(u,"envOptionsResolver",{enumerable:!0,get:function(){return B.envOptionsResolver}});Object.defineProperty(u,"parseHeadersEnv",{enumerable:!0,get:function(){return B.parseHeadersEnv}});Object.defineProperty(u,"MAX_POST_BYTES",{enumerable:!0,get:function(){return B.MAX_POST_BYTES}});var St=Pe();Object.defineProperty(u,"TraceManager",{enumerable:!0,get:function(){return St.TraceManager}});Object.defineProperty(u,"generateUlid",{enumerable:!0,get:function(){return St.generateUlid}});var Tt=mt();Object.defineProperty(u,"DiskSessionTraceManager",{enumerable:!0,get:function(){return Tt.DiskSessionTraceManager}});Object.defineProperty(u,"MemorySessionTraceManager",{enumerable:!0,get:function(){return Tt.MemorySessionTraceManager}});var we=_t();Object.defineProperty(u,"envFilePath",{enumerable:!0,get:function(){return we.envFilePath}});Object.defineProperty(u,"parseEnvFile",{enumerable:!0,get:function(){return we.parseEnvFile}});Object.defineProperty(u,"loadEnvFile",{enumerable:!0,get:function(){return we.loadEnvFile}})});var X=g(C());function Vn(){return(0,X.envFilePath)(".copilot","pinta-copilot.env","COPILOT_HOME")}function Ot(e=Vn()){(0,X.loadEnvFile)(e)}var Et=g(require("os")),oe=g(require("path"));function ke(){return process.env.COPILOT_HOME||oe.default.join(Et.default.homedir(),".copilot")}function Pt(){let e=process.env.COPILOT_PLUGIN_DATA||oe.default.join(ke(),"pinta-copilot-data");return{pluginData:e,tracePath:oe.default.join(e,"trace.json")}}function vt(e=process.env){return e.COPILOT_AGENT_JOB_ID||e.COPILOT_AGENT_SESSION_ID||e.COPILOT_AGENT_PROMPT?"cloud":e.ELECTRON_RUN_AS_NODE||e.VSCODE_IPC_HOOK||e.VSCODE_PID?"ext":"cli"}var Xt=g(C());function L(e){return typeof e=="string"?e:void 0}function H(e){return L(e.hook_event_name)??L(e.hookEventName)??L(e.hookName)??(process.env.PINTA_COPILOT_EVENT||void 0)}function bt(e){return L(e.session_id)??L(e.sessionId)}function At(e){return L(e.tool_name)??L(e.toolName)}var Bn={sessionstart:"SessionStart",sessionend:"SessionEnd",userpromptsubmit:"UserPromptSubmit",userpromptsubmitted:"UserPromptSubmit",pretooluse:"PreToolUse",posttooluse:"PostToolUse",posttoolusefailure:"PostToolUseFailure",stop:"Stop",agentstop:"Stop",subagentstart:"SubagentStart",subagentstop:"SubagentStop",precompact:"PreCompact",notification:"Notification",permissionrequest:"PermissionRequest",erroroccurred:"ErrorOccurred"};function se(e){let t=H(e);return t?Bn[t.toLowerCase()]??"Unknown":"Unknown"}function Rt(e){return e==="PreToolUse"||e==="PermissionRequest"||e==="PostToolUse"}var $n=new Set(["report_intent","ask_user","AskUserQuestion"]);function wt(e){return e!==void 0&&$n.has(e)}var Gn="Pinta AI withheld this tool output because it matched a blocking policy. The tool already ran. Do not retry this operation to bypass the block.",Fn="Pinta AI stopped this run because a tool output matched a blocking policy. The tool already ran and its original output may remain in the transcript. Review the incident and start a new session instead of resuming this one.";function kt(e,t,n="cli",r){if(e==="PreToolUse"){let o={permissionDecision:"deny",permissionDecisionReason:t};return r&&H(r)==="preToolUse"?JSON.stringify(o):JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",...o}})}if(e==="PermissionRequest")return JSON.stringify({behavior:"deny",message:t});if(e==="PostToolUse"){let o=r!==void 0&&("tool_result"in r||"toolResult"in r),i=r!==void 0&&"tool_response"in r;return JSON.stringify(!o&&(i||n==="ext")?{continue:!1,stopReason:Fn}:{modifiedResult:{resultType:"success",textResultForLlm:Gn}})}return null}var w=g(C());function Mt(){let e=process.env.COPILOT_PLUGIN_OPTION_ENDPOINT||process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:(0,w.parseHeadersEnv)(process.env.COPILOT_PLUGIN_OPTION_HEADERS||process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}var ie=class extends w.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-copilot",resolveOptions:Mt})}};function It(e,t){if(!Mt())return;let n=Buffer.byteLength(JSON.stringify(e),"utf-8");if(n>w.MAX_POST_BYTES){process.stderr.write(`[pinta-copilot] dropping oversized span payload (${n} > ${w.MAX_POST_BYTES} bytes) - undeliverable, not queued
+`);return}new w.DiskRetryQueue(t.pluginData,"pinta-copilot").enqueue(e)}var Dt=g(C()),ae=class extends Dt.DiskSessionTraceManager{constructor(t){super(t.tracePath)}};var $t=g(require("fs")),le=g(require("os")),Ne=g(require("path"));var ue="0.10.2";var q=g(C());var Vt=g(require("node:path"));var P=g(require("node:fs")),Me=g(require("node:path")),Yn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),zn=256*1024,Xn=1024*1024,Hn=4096;function v(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function K(e){let t=v(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Yn.has(r.toLowerCase())?r:void 0}function Nt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Ie(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function Z(e,t){let n=t.filter(r=>e[r]!==void 0).map(r=>Ie(e[r]));return n.length>0&&n[0]!==void 0&&n.every(r=>r===n[0])?n[0]:void 0}function $(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function xt(e,t){let n=e.timestamp===void 0?$(t):$(e.timestamp);return n!==void 0&&n<=t?n:void 0}function jt(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Me.default.isAbsolute(e)||Me.default.extname(e)!==".jsonl")return;let t;try{t=P.default.openSync(e,P.default.constants.O_RDONLY|P.default.constants.O_NONBLOCK|(P.default.constants.O_NOFOLLOW??0));let n=P.default.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,zn));if(P.default.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),i;if(o>=0)try{i=v(JSON.parse(r.toString("utf8",0,o)))}catch{}let s=Math.max(0,n.size-Xn),a=n.size<=r.length?r:Buffer.alloc(n.size-s);if(a!==r&&P.default.readSync(t,a,0,a.length,s)!==a.length)return;let c=P.default.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=s>0?a.indexOf(10)+1:0,d=a.lastIndexOf(10);if(s>0&&l===0||d<l)return;let h=[],y=0;for(;d>l&&y<Hn;){let k=a.lastIndexOf(10,d-1),x=Math.max(l,k+1),f=a.toString("utf8",x,d).trim();if(f){let S=v(JSON.parse(f));S&&h.push(S)}d=x-1,y++}return h.reverse(),{first:i,rows:h,complete:s===0&&d<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{P.default.closeSync(t)}catch{}}}function Ut(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var Kn=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest"]),Ct=["agent_id","agentId"],Lt=["turn_id","turnId"];function Zn(e,t,n){let r=[e.transcript_path,e.transcriptPath].filter(o=>o!==void 0);return r.length?r.every(o=>o===r[0])?r[0]:void 0:n==="cli"&&/^[A-Za-z0-9_-]{1,128}$/.test(t)?Vt.default.join(ke(),"session-state",t,"events.jsonl"):void 0}function qt(e,t){return e.agentId!==void 0&&e.agentId!==null?Ie(e.agentId)===t&&t!==void 0:t===void 0&&v(e.data)?.parentToolCallId==null}function Bt(e,t,n){let r=K(e.model);if(r)return{name:r,source:"hook.model"};try{return Jn(e,t,n)}catch{return}}function Jn(e,t,n){let r=se(e),o=Z(e,["tool_use_id","toolUseId","tool_call_id","toolCallId"]),i=r==="SessionStart"&&e.source==="startup";if(!i&&(!Kn.has(r)||!o))return;let s=Z(e,["session_id","sessionId"]),a=Z(e,Ct),c=Z(e,Lt),l=xt(e,n);if(!s||l===void 0||Ct.some(f=>e[f]!==void 0)&&!a||Lt.some(f=>e[f]!==void 0)&&!c||!a&&["agent_name","agentName","agent_type","agentType"].some(f=>e[f]!==void 0))return;let d=jt(Zn(e,s,t)),h=d?.first,y=v(h?.data),k=$(h?.timestamp);if(!d||h?.type!=="session.start"||y?.sessionId!==s||k===void 0||k>l||d.rows.some(f=>f.type==="session.start"&&v(f.data)?.sessionId!==s))return;if(i){if(a||!d.complete||e.timestamp===void 0)return;let f=K(y.selectedModel),S=k;for(let M of d.rows){if(M.type!=="session.model_change"||!qt(M,void 0))continue;let A=$(M.timestamp);if(A===void 0)return;if(A>l||A<S)continue;let G=K(v(M.data)?.newModel);if(A===S&&G!==f)return;f=G,S=A}return f?{name:f,source:"transcript.session.selected"}:void 0}let x=[];for(let f of d.rows){let S=v(f.data),M=$(f.timestamp);if(!S||M===void 0||M>l||M<k||!qt(f,a)||c!==void 0&&S.turnId!==c)continue;let A=!1;if(f.type==="assistant.message"?A=Array.isArray(S.toolRequests)&&S.toolRequests.some(Kt=>v(Kt)?.toolCallId===o):(f.type==="tool.execution_start"||f.type==="tool.execution_complete")&&(A=S.toolCallId===o),!A)continue;let G=K(S.model);x.push(G?{name:G,source:`transcript.${f.type}`}:void 0)}return Ut(x)}var ce;function Wn(){if(ce===void 0)try{ce=le.default.userInfo().username}catch{ce=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ce}var Gt=ue,Qn=new Set(["","unknown","undefined","null","n/a","none"]);function b(e){let t=typeof e=="string"?e.trim():void 0;return t&&!Qn.has(t.toLowerCase())?t:void 0}var er=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function tr(e){let t=b(e);return t&&er.test(t)?t:void 0}function nr(e){let t=e?b(e.copilot_version)??b(e.copilotVersion)??b(e.cli_version)??b(e.cliVersion)??b(e.version):void 0;return t||(De===void 0&&(De=rr()),De??void 0)}var De;function rr(){let e=b(process.env.COPILOT_CLI_BINARY_VERSION)??b(process.env.COPILOT_CLI_VERSION);if(e)return e;let t=b(process.env.COPILOT_CLI_RESOLVED_DIST_DIR);if(t){let n=tr(Ne.default.basename(t));if(n)return n;let r=or(t);if(r)return r}return null}function or(e){try{let t=$t.default.readFileSync(Ne.default.join(e,"package.json"),"utf8");return b(JSON.parse(t).version)}catch{return}}var sr=new Set(["copilot.hook","copilot.tool_name","copilot.toolName","copilot.tool_use_id","copilot.toolUseId","copilot.session_id","copilot.sessionId","copilot.transcript_path","copilot.transcriptPath","copilot.cwd","copilot.permission_mode","copilot.surface","copilot.agent_id","copilot.agent_type","copilot.agent_name","copilot.agent_display_name","copilot.stop_reason","copilot.notification_type"]),ir=new Set(["copilot.tool_input","copilot.toolInput","copilot.toolArgs","copilot.tool_response","copilot.tool_result","copilot.toolResult"]),ar={skipRedactKeys:sr,bashContextKeys:ir},ur=new Set(["hook_event_name","hookEventName","hookName"]);function cr(e,t,n){let r=Object.fromEntries(Object.entries(e).filter(([o])=>!ur.has(o)));return Nt(r,Bt(e,t,n)),[{key:"ingest.type",value:{stringValue:"copilot"}},{key:"copilot.hook",value:{stringValue:H(e)??"unknown"}},{key:"copilot.surface",value:{stringValue:t}},...(0,q.attrsFromRecord)(r,"copilot",ar)]}function lr(e){let t=nr(e);return[{key:"service.name",value:{stringValue:"copilot"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-copilot"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Gt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Wn()}},{key:"host.name",value:{stringValue:le.default.hostname()}},{key:"host.arch",value:{stringValue:le.default.arch()}}]}function Ft(e){let t=e.now??Date.now();return(0,q.buildPayload)({traceId:e.traceId,spanName:`copilot.${(0,q.snakeCase)(H(e.event)??"unknown")}`,attributes:cr(e.event,e.surface,t),resource:lr(e.event),scope:{name:"pinta-copilot",version:Gt},now:t})}var Yt=g(C());function dr(){return Number(process.env.PINTA_GUARD_TIMEOUT_MS)||100}var fr=`pinta-copilot/${ue}`;function zt(e,t){return(0,Yt.evaluateGuard)(e,t,{timeoutMs:dr(),token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:fr})}async function pr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Ht(){try{let e=Pt(),t=vt(),n=await pr(),r=JSON.parse(n),o=se(r),i=bt(r),s=new ae(e),a=o==="UserPromptSubmit"?s.newTrace(i):s.currentTrace(i),c=Ft({event:r,traceId:a,surface:t}),l=At(r),d=null;if(Rt(o)&&!wt(l)&&(d=await zt(c,process.env.PINTA_GUARD_ENDPOINT)),d?.decision==="DENY"){let y=kt(o,d.userMessage??d.reason??"guard_deny",t,r);y&&process.stdout.write(y+`
+`)}if((0,Xt.attachGuard)(c,d),d&&o==="PostToolUse")for(let y of c.resourceSpans)for(let k of y.scopeSpans)for(let x of k.spans)x.attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}});if(d?.decision==="DENY")return It(c,e),0;let h=new ie(e);await h.flush(),await h.send(c)}catch(e){process.stderr.write(`[pinta-copilot] error: ${e}
+`)}return 0}Ot();async function mr(){let e=await Ht();process.exit(e)}mr();

package/dist/index.mjs

@@ -1,23 +1,27 @@
 import{createRequire as __pintaCreateRequire}from 'node:module';const require=__pintaCreateRequire(import.meta.url);
-var tn=Object.create;var Ne=Object.defineProperty;var nn=Object.getOwnPropertyDescriptor;var rn=Object.getOwnPropertyNames;var on=Object.getPrototypeOf,sn=Object.prototype.hasOwnProperty;var S=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var P=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var an=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of rn(t))!sn.call(e,o)&&o!==n&&Ne(e,o,{get:()=>t[o],enumerable:!(r=nn(t,o))||r.enumerable});return e};var F=(e,t,n)=>(n=e!=null?tn(on(e)):{},an(t||!e||!e.__esModule?Ne(n,"default",{value:e,enumerable:!0}):n,e));var ce=P(g=>{"use strict";Object.defineProperty(g,"__esModule",{value:!0});g.PATTERNS=g.MAX_BYTES=void 0;g.truncateTo=je;g.truncate=un;g.collectMatches=Ce;g.resolveOverlaps=Le;g.applyMatches=Ue;g.redact=cn;g.MAX_BYTES=102400;function je(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function un(e){return je(e,g.MAX_BYTES)}g.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Ce(e,t){let n=[];for(let r of g.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let o=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=o.exec(e))!==null;){let u=r.captureGroup??0,a=s[u];if(a===void 0){s.index===o.lastIndex&&o.lastIndex++;continue}let c=s.index,l=s.index+s[0].length,d=c+s[0].indexOf(a),_=d+a.length;n.push({start:c,end:l,replaceStart:d,replaceEnd:_,type:r.type}),s.index===o.lastIndex&&o.lastIndex++}}return n}function Le(e){let t=[...e].sort((o,s)=>o.start!==s.start?o.start-s.start:s.end-s.start-(o.end-o.start)),n=[],r=-1;for(let o of t)o.start<r||(n.push(o),r=o.end);return n}function Ue(e,t){let n=[...t].sort((o,s)=>s.replaceStart-o.replaceStart),r=e;for(let o of n)r=r.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+r.slice(o.replaceEnd);return r}function cn(e,t={}){if(e.length===0)return e;let n=Ce(e,t);if(n.length===0)return e;let r=Le(n);return Ue(e,r)}});var de=P(m=>{"use strict";var ln=m&&m.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(m,"__esModule",{value:!0});m.MAX_SPAN_BYTES=void 0;m.ulidToTraceId=Ve;m.newSpanId=$e;m.snakeCase=pn;m.toOtlpValue=Ge;m.attrsFromRecord=mn;m.guardAttrs=Ye;m.clientAttrs=ze;m.enforceSpanBudget=Xe;m.buildPayload=gn;m.attachGuard=Ke;m.mergeBatch=hn;var dn=ln(S("crypto")),le=ce(),fn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ve(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let o=fn.indexOf(r);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(o)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function $e(){return dn.default.randomBytes(8).toString("hex")}function pn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var qe=new Set;function Z(e,t,n){let r=(0,le.truncate)(t);if((n.skipRedactKeys??qe).has(e))return r;let o=(n.bashContextKeys??qe).has(e)?"bash":void 0;return(0,le.redact)(r,{context:o})}function Ge(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:Z(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:Z(e,JSON.stringify(t),n)}}catch{return{stringValue:Z(e,String(t),n)}}default:return{stringValue:Z(e,String(t),n)}}}function mn(e,t,n={}){let r=[];for(let[o,s]of Object.entries(e)){let u=`${t}.${o}`,a=Ge(u,s,n);a!==null&&r.push({key:u,value:a})}return r}function Ye(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function ze(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}m.MAX_SPAN_BYTES=800*1024;function Fe(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Be=1024;function Xe(e,t=m.MAX_SPAN_BYTES){let n=Fe(e);for(let r=0;r<100&&n>t;r++){let o=null,s=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>s&&(s=l,o=c.value)}if(o===null||s<=Be)break;let u=n-t,a=Math.max(Be,s-u-64);o.stringValue=(0,le.truncateTo)(o.stringValue,a),n=Fe(e)}return e}function gn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],o={traceId:Ve(e.traceId),spanId:$e(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Xe(o);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return Ke(s,e.guard,e.clientTiming)}function Ke(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Ye(t));let o=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&r.attributes.push(...ze(o)),e}function hn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var He=P(w=>{"use strict";Object.defineProperty(w,"__esModule",{value:!0});w.GUARD_STATUS_REFUSED=w.GUARD_BUDGET_HEADER=void 0;w.evaluateGuard=Tn;var yn=1e4,_n="pinta-core";w.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function J(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Sn=new Set(["ALLOW","DENY","REVIEW"]);w.GUARD_STATUS_REFUSED=410;async function Tn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??yn,o=Date.now(),s=new AbortController,u=setTimeout(()=>s.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??_n,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[w.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:s.signal});if(a.status===w.GUARD_STATUS_REFUSED)return J(Date.now()-o,"refused");if(a.status!==200)return J(Date.now()-o,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!Sn.has(c.decision)||!l)return J(Date.now()-o,"error");let d=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??d,clientRttMs:d}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return J(Date.now()-o,l)}finally{clearTimeout(u)}}});var W=P(G=>{"use strict";var En=G&&G.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(G,"__esModule",{value:!0});G.atomicWriteFileSync=Pn;var Ze=En(S("fs"));function Pn(e,t){let n=`${e}.${process.pid}.tmp`;Ze.default.writeFileSync(n,t),Ze.default.renameSync(n,e)}});var me=P(I=>{"use strict";var Je=I&&I.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(I,"__esModule",{value:!0});I.MemoryRetryQueue=I.DiskRetryQueue=void 0;var y=Je(S("fs")),Q=Je(S("path")),On=W(),ee=1e3,bn=50,vn=5,fe=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=Q.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{y.default.mkdirSync(Q.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;y.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
-`)}}readAll(){try{let t=y.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let o=JSON.parse(r);Array.isArray(o?.payload?.resourceSpans)&&n.push(o)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){y.default.existsSync(this.filePath)&&y.default.unlinkSync(this.filePath);return}y.default.mkdirSync(Q.default.dirname(this.filePath),{recursive:!0}),(0,On.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+var ln=Object.create;var qe=Object.defineProperty;var dn=Object.getOwnPropertyDescriptor;var fn=Object.getOwnPropertyNames;var pn=Object.getPrototypeOf,mn=Object.prototype.hasOwnProperty;var T=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var P=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var hn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of fn(t))!mn.call(e,s)&&s!==n&&qe(e,s,{get:()=>t[s],enumerable:!(r=dn(t,s))||r.enumerable});return e};var $=(e,t,n)=>(n=e!=null?ln(pn(e)):{},hn(t||!e||!e.__esModule?qe(n,"default",{value:e,enumerable:!0}):n,e));var Fe=P(fe=>{"use strict";Object.defineProperty(fe,"__esModule",{value:!0});fe.mysqlPasswordRanges=On;var gn=new Set(["mysql","mysqldump","mysqladmin","mysqlcheck","mysqlimport","mysqlshow","mariadb","mariadb-dump","mariadb-admin","mariadb-check","mariadb-import","mariadb-show"]),yn=new Set(["sh","bash","dash","zsh","ksh"]),_n=new Set(["-u","--user","-h","--host","-P","--port","-D","--database","-S","--socket","-e","--execute","--protocol","--default-character-set","--defaults-file","--defaults-extra-file","--login-path","--init-command","--ssl-ca","--ssl-capath","--ssl-cert","--ssl-key","--ssl-cipher"]),Q=16;function Ue(e,t,n=e.value.length){return{value:e.value.slice(t,n),ranges:e.ranges.slice(t,n)}}function z(e,t,n,r){e.value+=t.value.slice(n,r);for(let s=n;s<r;s++)e.ranges.push(t.ranges[s])}function $e(e){if(e?.literal)return e.value.slice(e.value.lastIndexOf("/")+1).replace(/\.exe$/,"")}function Sn(e){let t=0;for(let n=0;n<=Q;n++){for(;/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.value??"");)t++;let r=$e(e[t]);if(!r)return;if(["!","if","then","elif","else","while","until","do"].includes(r)){t++;continue}let s={env:["-u","--unset","-C","--chdir"],sudo:["-u","--user","-g","--group","-p","--prompt","-D","--chdir","-R","--chroot","-C","--close-from","-T","--command-timeout"],exec:["-a"],nice:["-n","--adjustment"],timeout:["-s","--signal","-k","--kill-after"]},i={env:["-i","--ignore-environment","-0","--null"],sudo:["-n","-E","-H","-S","-b","-k"],command:["-p"],exec:["-c","-l"],nohup:[],nice:[],time:["-p"],timeout:["--foreground","--preserve-status"]};if(!(r in i))return t;for(t++;e[t]?.value.startsWith("-");){let o=e[t++].value;if(o==="--")break;if(!i[r].includes(o)){if((s[r]??[]).includes(o)){if(!e[t++])return;continue}if(!(s[r]??[]).some(a=>a.startsWith("--")?o.startsWith(a+"="):o.startsWith(a)&&o.length>2)&&!(r==="nice"&&/^-\d+$/.test(o)))return}}if(r==="timeout"&&!/^\d+(?:\.\d+)?[smhd]?$/.test(e[t++]?.value??""))return}}function Be(e,t){let n=1,r="";for(let s=t;s<e.length;s++){let i=e[s];if(i==="\\"&&r!=="'"){s++;continue}if(r){i===r&&(r="");continue}if(i==="'"||i==='"')r=i;else if(i==="(")n++;else if(i===")"&&--n===0)return s}return e.length}function Tn(e,t,n,r){let s={value:"",ranges:[],start:t,end:t,literal:!0},i="",o=t;for(;o<e.value.length;){let a=e.value[o];if(!i&&/[\s;|&()<>{}]/.test(a))break;if(a===i){i="",o++;continue}if(!i&&(a==="'"||a==='"')){i=a,o++;continue}if(a==="\\"&&i!=="'"){let c=e.value[o+1];if(c===`
+`){o+=2;continue}if(c&&(!i||/[$`"\\]/.test(c))){z(s,e,o+1,o+2),o+=2;continue}}if(i!=="'"&&e.value.startsWith("$(",o)){let c=Be(e.value,o+2);e.value[o+2]!=="("&&r<Q&&B(Ue(e,o+2,c),n,r+1),z(s,e,o,Math.min(c+1,e.value.length)),s.literal=!1,o=Math.min(c+1,e.value.length);continue}if(a==="`"&&i!=="'"){let c=o+1;for(;c<e.value.length&&e.value[c]!=="`";)c+=e.value[c]==="\\"?2:1;r<Q&&B(Ue(e,o+1,c),n,r+1),z(s,e,o,Math.min(c+1,e.value.length)),s.literal=!1,o=Math.min(c+1,e.value.length);continue}a==="$"&&i!=="'"&&(s.literal=!1),z(s,e,o,o+1),o++}return s.end=o,s}function En(e,t,n,r){let s=Sn(t);if(s===void 0)return;let i=$e(t[s]);if(yn.has(i)&&r<Q){for(let o=s+1;o<t.length;o++){let a=t[o].value;if(a==="--command"||/^-[a-zA-Z]*c[a-zA-Z]*$/.test(a)){let c=t[o+1];c&&B(c,n,r+1);return}if(!a.startsWith("-")||a==="--")return;(a==="-o"||a==="-O")&&o++}return}if(gn.has(i))for(let o=s+1;o<t.length;o++){let a=t[o];if(a.value==="--")return;if(_n.has(a.value)){o++;continue}a.value.startsWith("-p")&&a.value.length>2&&n.push({start:e.ranges[a.start].start,end:e.ranges[a.end-1].end})}}function B(e,t,n=0){let r=[],s,i=[],o=0,a=()=>{En(e,r,t,n),r=[],s=void 0};for(;o<e.value.length;){let c=e.value[o];if(c===`
+`){a(),o++;for(let l of i.splice(0))for(;o<e.value.length;){let d=e.value.indexOf(`
+`,o),h=d<0?e.value.length:d,y=e.value.slice(o,h);if(o=d<0?h:h+1,(l.stripTabs?y.replace(/^\t+/,""):y)===l.delimiter)break}}else if(/\s/.test(c))o++;else if(c==="#"){let l=e.value.indexOf(`
+`,o);o=l<0?e.value.length:l}else if(e.value.startsWith("((",o))a(),o=Math.min(Be(e.value,o+1)+1,e.value.length);else if(/[;|&(){}]/.test(c))a(),o++;else if(c==="<"||c===">")r.at(-1)?.end===o&&/^\d+$/.test(r.at(-1).value)&&r.pop(),s=/^(?:<<<|<<-?|>>|<&|>&|[<>])/.exec(e.value.slice(o))?.[0]??c,o+=s.length;else{let l=Tn(e,o,t,n);o=l.end,(s==="<<"||s==="<<-")&&i.push({delimiter:l.value,stripTabs:s==="<<-"}),s||r.push(l),s=void 0}}a()}function Pn(e,t,n){let r={value:"",ranges:[]};for(let s=t+1;s<n-1;s++){if(e.value[s]!=="\\"){z(r,e,s,s+1);continue}let i=s+(e.value[s+1]==="u"?6:2),o=JSON.parse(`"${e.value.slice(s,i)}"`);r.value+=o;for(let a=0;a<o.length;a++)r.ranges.push({start:e.ranges[s].start,end:e.ranges[i-1].end});s=i-1}return r}function On(e){let t={value:e,ranges:Array.from({length:e.length},(r,s)=>({start:s,end:s+1}))},n=[];if(/^\s*[{[]/.test(e)){let r;try{r=JSON.parse(e)}catch{return B(t,n),n}if(r!==null&&typeof r=="object"){let s=/"(?:[^"\\]|\\.)*"/g,i;for(;i=s.exec(e);){let o=JSON.parse(i[0]);if(o!=="command"&&o!=="cmd"&&o!=="CommandLine")continue;let a=/^\s*:\s*/.exec(e.slice(s.lastIndex));if(!a)continue;let c=s.lastIndex+a[0].length;if(e[c]!=='"')continue;s.lastIndex=c;let l=s.exec(e);l?.index===c&&B(Pn(t,c,c+l[0].length),n)}}return n}return B(t,n),n}});var pe=P(g=>{"use strict";Object.defineProperty(g,"__esModule",{value:!0});g.PATTERNS=g.MAX_BYTES=void 0;g.truncateTo=Ve;g.truncate=bn;g.collectMatches=Ge;g.resolveOverlaps=ze;g.applyMatches=Ye;g.redact=wn;var vn=Fe();g.MAX_BYTES=102400;function Ve(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function bn(e){return Ve(e,g.MAX_BYTES)}g.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Ge(e,t){let n=[];for(let r of g.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;if(r.type==="cli_password_short"){for(let{start:o,end:a}of(0,vn.mysqlPasswordRanges)(e))n.push({start:o,end:a,replaceStart:o,replaceEnd:a,type:r.type,replacement:`-p[REDACTED:${r.type}]`});continue}let s=new RegExp(r.regex.source,r.regex.flags),i;for(;(i=s.exec(e))!==null;){let o=r.captureGroup??0,a=i[o];if(a===void 0){i.index===s.lastIndex&&s.lastIndex++;continue}let c=i.index,l=i.index+i[0].length,d=c+i[0].indexOf(a),h=d+a.length;n.push({start:c,end:l,replaceStart:d,replaceEnd:h,type:r.type}),i.index===s.lastIndex&&s.lastIndex++}}return n}function ze(e){let t=[...e].sort((s,i)=>s.start!==i.start?s.start-i.start:i.end-i.start-(s.end-s.start)),n=[],r=-1;for(let s of t)s.start<r||(n.push(s),r=s.end);return n}function Ye(e,t){let n=[...t].sort((s,i)=>i.replaceStart-s.replaceStart),r=e;for(let s of n)r=r.slice(0,s.replaceStart)+(s.replacement??`[REDACTED:${s.type}]`)+r.slice(s.replaceEnd);return r}function wn(e,t={}){if(e.length===0)return e;let n=Ge(e,t);if(n.length===0)return e;let r=ze(n);return Ye(e,r)}});var he=P(m=>{"use strict";var An=m&&m.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(m,"__esModule",{value:!0});m.MAX_SPAN_BYTES=void 0;m.ulidToTraceId=We;m.newSpanId=Ze;m.snakeCase=In;m.toOtlpValue=Je;m.attrsFromRecord=Mn;m.guardAttrs=Qe;m.clientAttrs=et;m.enforceSpanBudget=tt;m.buildPayload=Dn;m.attachGuard=nt;m.mergeBatch=Nn;var Rn=An(T("crypto")),me=pe(),kn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function We(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let s=kn.indexOf(r);if(s<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(s)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ze(){return Rn.default.randomBytes(8).toString("hex")}function In(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Xe=new Set;function ee(e,t,n){let r=(0,me.truncate)(t);if((n.skipRedactKeys??Xe).has(e))return r;let s=(n.bashContextKeys??Xe).has(e)?"bash":void 0;return(0,me.redact)(r,{context:s})}function Je(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:ee(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:ee(e,JSON.stringify(t),n)}}catch{return{stringValue:ee(e,String(t),n)}}default:return{stringValue:ee(e,String(t),n)}}}function Mn(e,t,n={}){let r=[];for(let[s,i]of Object.entries(e)){let o=`${t}.${s}`,a=Je(o,i,n);a!==null&&r.push({key:o,value:a})}return r}function Qe(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function et(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}m.MAX_SPAN_BYTES=800*1024;function Ke(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var He=1024;function tt(e,t=m.MAX_SPAN_BYTES){let n=Ke(e);for(let r=0;r<100&&n>t;r++){let s=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>i&&(i=l,s=c.value)}if(s===null||i<=He)break;let o=n-t,a=Math.max(He,i-o-64);s.stringValue=(0,me.truncateTo)(s.stringValue,a),n=Ke(e)}return e}function Dn(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],s={traceId:We(e.traceId),spanId:Ze(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};tt(s);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[s]}]}]};return nt(i,e.guard,e.clientTiming)}function nt(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Qe(t));let s=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return s&&r.attributes.push(...et(s)),e}function Nn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var rt=P(w=>{"use strict";Object.defineProperty(w,"__esModule",{value:!0});w.GUARD_STATUS_REFUSED=w.GUARD_BUDGET_HEADER=void 0;w.evaluateGuard=Ln;var xn=1e4,jn="pinta-core";w.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function te(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Cn=new Set(["ALLOW","DENY","REVIEW"]);w.GUARD_STATUS_REFUSED=410;async function Ln(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??xn,s=Date.now(),i=new AbortController,o=setTimeout(()=>i.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??jn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[w.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:i.signal});if(a.status===w.GUARD_STATUS_REFUSED)return te(Date.now()-s,"refused");if(a.status!==200)return te(Date.now()-s,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!Cn.has(c.decision)||!l)return te(Date.now()-s,"error");let d=Date.now()-s;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??d,clientRttMs:d}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return te(Date.now()-s,l)}finally{clearTimeout(o)}}});var ne=P(Y=>{"use strict";var qn=Y&&Y.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(Y,"__esModule",{value:!0});Y.atomicWriteFileSync=Un;var st=qn(T("fs"));function Un(e,t){let n=`${e}.${process.pid}.tmp`;st.default.writeFileSync(n,t),st.default.renameSync(n,e)}});var _e=P(M=>{"use strict";var ot=M&&M.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(M,"__esModule",{value:!0});M.MemoryRetryQueue=M.DiskRetryQueue=void 0;var S=ot(T("fs")),re=ot(T("path")),$n=ne(),se=1e3,Bn=50,Fn=5,ge=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=re.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{S.default.mkdirSync(re.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;S.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=S.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let s=JSON.parse(r);Array.isArray(s?.payload?.resourceSpans)&&n.push(s)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){S.default.existsSync(this.filePath)&&S.default.unlinkSync(this.filePath);return}S.default.mkdirSync(re.default.dirname(this.filePath),{recursive:!0}),(0,$n.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{y.default.mkdirSync(Q.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<bn;)try{let n=y.default.openSync(this.lockPath,"wx");return y.default.writeSync(n,String(process.pid)),y.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let s=y.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){y.default.unlinkSync(this.lockPath);continue}}catch{}let r=vn,o=Date.now()+r;for(;Date.now()<o;);}return!1}release(){try{y.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=ee)return;let n=t.length-ee;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};I.DiskRetryQueue=fe;var pe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>ee&&this.entries.splice(0,this.entries.length-ee)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};I.MemoryRetryQueue=pe});var rt=P(p=>{"use strict";Object.defineProperty(p,"__esModule",{value:!0});p.MemoryTransport=p.DiskTransport=p.MAX_POST_BYTES=void 0;p.parseHeadersEnv=tt;p.envOptionsResolver=nt;p.postOtlp=Y;var We=me(),Qe=de(),wn=5e3;p.MAX_POST_BYTES=900*1024;function te(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function et(e,t,n){let r=[],o=[],s=[],u=0;for(let a of e){let c=t(a);if(c>n){o.push(a);continue}s.length>0&&u+c>n&&(r.push(s),s=[],u=0),s.push(a),u+=c}return s.length>0&&r.push(s),{chunks:r,oversize:o}}function tt(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...o]=n.split("=");r&&o.length>0&&(t[r.trim()]=o.join("=").trim())}return t}function nt(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:tt(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function Y(e,t,n){let r=new AbortController,o=setTimeout(()=>r.abort(),wn);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let u="";try{u=(await s.text()).slice(0,200)}catch{}let a=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${a}${u?` body=${u}`:""}
-`),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
-`),!1}finally{clearTimeout(o)}}var ge=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new We.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??nt}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await Y(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:o}=et(n,a=>te(a.payload),p.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${p.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let s=[].concat(...r),u=0;for(let a of r){if(!await Y((0,Qe.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;u+=a.length}this.queue.rewrite(s.slice(u))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=te(t);return n<=p.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};p.DiskTransport=ge;var he=class{queue=new We.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(te(t)>p.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await Y(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:o}=et(n,te,p.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${p.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let s=[].concat(...r),u=0;for(let a of r){if(!await Y((0,Qe.mergeBatch)(a),t,this.logPrefix))break;u+=a.length}for(let a of s.slice(u))this.queue.enqueue(a)}};p.MemoryTransport=he});var Te=P(j=>{"use strict";var Se=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=st;var ot=Se(S("fs")),An=Se(S("path")),Rn=Se(S("crypto")),kn=W(),ye="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function st(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=ye[n&31]+t,n=Math.floor(n/32);let r=Rn.default.randomBytes(10),o="";for(let s=0;s<10;s++)o+=ye[r[s]&31];for(;o.length<16;)o+=ye[0];return t+o}var _e=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=st();return this.save(t),t}currentTrace(){try{let t=ot.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{ot.default.mkdirSync(An.default.dirname(this.tracePath),{recursive:!0}),(0,kn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};j.TraceManager=_e});var lt=P(M=>{"use strict";var at=M&&M.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(M,"__esModule",{value:!0});M.MemorySessionTraceManager=M.DiskSessionTraceManager=void 0;var it=at(S("fs")),Dn=at(S("path")),ut=Te(),In=W(),ct=200,Ee=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??ct}read(){try{let t=JSON.parse(it.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{it.default.mkdirSync(Dn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,In.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,ut.generateUlid)(),o=this.read();return o[n]=r,this.write(o),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};M.DiskSessionTraceManager=Ee;var Pe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??ct}newTrace(t){let n=t||"default",r=(0,ut.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};M.MemorySessionTraceManager=Pe});var pt=P(C=>{"use strict";var Oe=C&&C.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(C,"__esModule",{value:!0});C.envFilePath=Nn;C.parseEnvFile=ft;C.loadEnvFile=jn;var Mn=Oe(S("node:fs")),xn=Oe(S("node:os")),dt=Oe(S("node:path"));function Nn(e,t,n){let r=n?process.env[n]:void 0,o=r&&r.length>0?r:dt.default.join(xn.default.homedir(),e);return dt.default.join(o,t)}function ft(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),u=r.slice(o+1).trim();(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))&&(u=u.slice(1,-1)),s&&(t[s]=u)}return t}function jn(e){let t;try{t=Mn.default.readFileSync(e,"utf-8")}catch{return}let n=ft(t);for(let[r,o]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=o)}});var L=P(i=>{"use strict";Object.defineProperty(i,"__esModule",{value:!0});i.loadEnvFile=i.parseEnvFile=i.envFilePath=i.MemorySessionTraceManager=i.DiskSessionTraceManager=i.generateUlid=i.TraceManager=i.MAX_POST_BYTES=i.parseHeadersEnv=i.envOptionsResolver=i.postOtlp=i.MemoryTransport=i.DiskTransport=i.MemoryRetryQueue=i.DiskRetryQueue=i.GUARD_BUDGET_HEADER=i.GUARD_STATUS_REFUSED=i.evaluateGuard=i.MAX_SPAN_BYTES=i.enforceSpanBudget=i.mergeBatch=i.attachGuard=i.buildPayload=i.clientAttrs=i.guardAttrs=i.attrsFromRecord=i.toOtlpValue=i.snakeCase=i.newSpanId=i.ulidToTraceId=i.MAX_BYTES=i.PATTERNS=i.applyMatches=i.resolveOverlaps=i.collectMatches=i.truncateTo=i.truncate=i.redact=void 0;var x=ce();Object.defineProperty(i,"redact",{enumerable:!0,get:function(){return x.redact}});Object.defineProperty(i,"truncate",{enumerable:!0,get:function(){return x.truncate}});Object.defineProperty(i,"truncateTo",{enumerable:!0,get:function(){return x.truncateTo}});Object.defineProperty(i,"collectMatches",{enumerable:!0,get:function(){return x.collectMatches}});Object.defineProperty(i,"resolveOverlaps",{enumerable:!0,get:function(){return x.resolveOverlaps}});Object.defineProperty(i,"applyMatches",{enumerable:!0,get:function(){return x.applyMatches}});Object.defineProperty(i,"PATTERNS",{enumerable:!0,get:function(){return x.PATTERNS}});Object.defineProperty(i,"MAX_BYTES",{enumerable:!0,get:function(){return x.MAX_BYTES}});var T=de();Object.defineProperty(i,"ulidToTraceId",{enumerable:!0,get:function(){return T.ulidToTraceId}});Object.defineProperty(i,"newSpanId",{enumerable:!0,get:function(){return T.newSpanId}});Object.defineProperty(i,"snakeCase",{enumerable:!0,get:function(){return T.snakeCase}});Object.defineProperty(i,"toOtlpValue",{enumerable:!0,get:function(){return T.toOtlpValue}});Object.defineProperty(i,"attrsFromRecord",{enumerable:!0,get:function(){return T.attrsFromRecord}});Object.defineProperty(i,"guardAttrs",{enumerable:!0,get:function(){return T.guardAttrs}});Object.defineProperty(i,"clientAttrs",{enumerable:!0,get:function(){return T.clientAttrs}});Object.defineProperty(i,"buildPayload",{enumerable:!0,get:function(){return T.buildPayload}});Object.defineProperty(i,"attachGuard",{enumerable:!0,get:function(){return T.attachGuard}});Object.defineProperty(i,"mergeBatch",{enumerable:!0,get:function(){return T.mergeBatch}});Object.defineProperty(i,"enforceSpanBudget",{enumerable:!0,get:function(){return T.enforceSpanBudget}});Object.defineProperty(i,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return T.MAX_SPAN_BYTES}});var be=He();Object.defineProperty(i,"evaluateGuard",{enumerable:!0,get:function(){return be.evaluateGuard}});Object.defineProperty(i,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return be.GUARD_STATUS_REFUSED}});Object.defineProperty(i,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return be.GUARD_BUDGET_HEADER}});var mt=me();Object.defineProperty(i,"DiskRetryQueue",{enumerable:!0,get:function(){return mt.DiskRetryQueue}});Object.defineProperty(i,"MemoryRetryQueue",{enumerable:!0,get:function(){return mt.MemoryRetryQueue}});var B=rt();Object.defineProperty(i,"DiskTransport",{enumerable:!0,get:function(){return B.DiskTransport}});Object.defineProperty(i,"MemoryTransport",{enumerable:!0,get:function(){return B.MemoryTransport}});Object.defineProperty(i,"postOtlp",{enumerable:!0,get:function(){return B.postOtlp}});Object.defineProperty(i,"envOptionsResolver",{enumerable:!0,get:function(){return B.envOptionsResolver}});Object.defineProperty(i,"parseHeadersEnv",{enumerable:!0,get:function(){return B.parseHeadersEnv}});Object.defineProperty(i,"MAX_POST_BYTES",{enumerable:!0,get:function(){return B.MAX_POST_BYTES}});var gt=Te();Object.defineProperty(i,"TraceManager",{enumerable:!0,get:function(){return gt.TraceManager}});Object.defineProperty(i,"generateUlid",{enumerable:!0,get:function(){return gt.generateUlid}});var ht=lt();Object.defineProperty(i,"DiskSessionTraceManager",{enumerable:!0,get:function(){return ht.DiskSessionTraceManager}});Object.defineProperty(i,"MemorySessionTraceManager",{enumerable:!0,get:function(){return ht.MemorySessionTraceManager}});var ve=pt();Object.defineProperty(i,"envFilePath",{enumerable:!0,get:function(){return ve.envFilePath}});Object.defineProperty(i,"parseEnvFile",{enumerable:!0,get:function(){return ve.parseEnvFile}});Object.defineProperty(i,"loadEnvFile",{enumerable:!0,get:function(){return ve.loadEnvFile}})});import{realpathSync as qr}from"node:fs";import{pathToFileURL as Fr}from"node:url";var z=F(L());function Cn(){return(0,z.envFilePath)(".copilot","pinta-copilot.env","COPILOT_HOME")}function yt(e=Cn()){(0,z.loadEnvFile)(e)}import Ln from"os";import we from"path";function X(){return process.env.COPILOT_HOME||we.join(Ln.homedir(),".copilot")}function _t(){let e=process.env.COPILOT_PLUGIN_DATA||we.join(X(),"pinta-copilot-data");return{pluginData:e,tracePath:we.join(e,"trace.json")}}function St(e=process.env){return e.COPILOT_AGENT_JOB_ID||e.COPILOT_AGENT_SESSION_ID||e.COPILOT_AGENT_PROMPT?"cloud":e.ELECTRON_RUN_AS_NODE||e.VSCODE_IPC_HOOK||e.VSCODE_PID?"ext":"cli"}var Vt=F(L());function U(e){return typeof e=="string"?e:void 0}function ne(e){return U(e.hook_event_name)??U(e.hookEventName)??U(e.hookName)??(process.env.PINTA_COPILOT_EVENT||void 0)}function Tt(e){return U(e.session_id)??U(e.sessionId)}function Et(e){return U(e.tool_name)??U(e.toolName)}var Un={sessionstart:"SessionStart",sessionend:"SessionEnd",userpromptsubmit:"UserPromptSubmit",userpromptsubmitted:"UserPromptSubmit",pretooluse:"PreToolUse",posttooluse:"PostToolUse",posttoolusefailure:"PostToolUseFailure",stop:"Stop",agentstop:"Stop",subagentstart:"SubagentStart",subagentstop:"SubagentStop",precompact:"PreCompact",notification:"Notification",permissionrequest:"PermissionRequest",erroroccurred:"ErrorOccurred"};function re(e){let t=ne(e);return t?Un[t.toLowerCase()]??"Unknown":"Unknown"}function Pt(e){return e==="PreToolUse"||e==="PermissionRequest"||e==="PostToolUse"}var qn=new Set(["report_intent","ask_user"]);function Ot(e){return e!==void 0&&qn.has(e)}var Fn="Pinta AI withheld this tool output because it matched a blocking policy. The tool already ran. Do not retry this operation to bypass the block.",Bn="Pinta AI stopped this run because a tool output matched a blocking policy. The tool already ran and its original output may remain in the transcript. Review the incident and start a new session instead of resuming this one.";function bt(e,t,n="cli",r){if(e==="PreToolUse")return JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:t}});if(e==="PermissionRequest")return JSON.stringify({behavior:"deny",message:t});if(e==="PostToolUse"){let o=r!==void 0&&("tool_result"in r||"toolResult"in r),s=r!==void 0&&"tool_response"in r;return JSON.stringify(!o&&(s||n==="ext")?{continue:!1,stopReason:Bn}:{modifiedResult:{resultType:"success",textResultForLlm:Fn}})}return null}var A=F(L());function vt(){let e=process.env.COPILOT_PLUGIN_OPTION_ENDPOINT||process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:(0,A.parseHeadersEnv)(process.env.COPILOT_PLUGIN_OPTION_HEADERS||process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}var oe=class extends A.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-copilot",resolveOptions:vt})}};function wt(e,t){if(!vt())return;let n=Buffer.byteLength(JSON.stringify(e),"utf-8");if(n>A.MAX_POST_BYTES){process.stderr.write(`[pinta-copilot] dropping oversized span payload (${n} > ${A.MAX_POST_BYTES} bytes) - undeliverable, not queued
-`);return}new A.DiskRetryQueue(t.pluginData,"pinta-copilot").enqueue(e)}var At=F(L()),se=class extends At.DiskSessionTraceManager{constructor(t){super(t.tracePath)}};import Zn from"fs";import ke from"os";import Lt from"path";var ie="0.10.1";var q=F(L());import zn from"node:path";import R from"node:fs";import Rt from"node:path";var Vn=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),$n=256*1024,Gn=1024*1024,Yn=4096;function O(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function K(e){let t=O(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!Vn.has(r.toLowerCase())?r:void 0}function kt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Ae(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function H(e,t){let n=t.filter(r=>e[r]!==void 0).map(r=>Ae(e[r]));return n.length>0&&n[0]!==void 0&&n.every(r=>r===n[0])?n[0]:void 0}function V(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function Dt(e,t){let n=e.timestamp===void 0?V(t):V(e.timestamp);return n!==void 0&&n<=t?n:void 0}function It(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Rt.isAbsolute(e)||Rt.extname(e)!==".jsonl")return;let t;try{t=R.openSync(e,R.constants.O_RDONLY|R.constants.O_NONBLOCK|(R.constants.O_NOFOLLOW??0));let n=R.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,$n));if(R.readSync(t,r,0,r.length,0)!==r.length)return;let o=r.indexOf(10),s;if(o>=0)try{s=O(JSON.parse(r.toString("utf8",0,o)))}catch{}let u=Math.max(0,n.size-Gn),a=n.size<=r.length?r:Buffer.alloc(n.size-u);if(a!==r&&R.readSync(t,a,0,a.length,u)!==a.length)return;let c=R.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=u>0?a.indexOf(10)+1:0,d=a.lastIndexOf(10);if(u>0&&l===0||d<l)return;let _=[],E=0;for(;d>l&&E<Yn;){let k=a.lastIndexOf(10,d-1),N=Math.max(l,k+1),f=a.toString("utf8",N,d).trim();if(f){let h=O(JSON.parse(f));h&&_.push(h)}d=N-1,E++}return _.reverse(),{first:s,rows:_,complete:u===0&&d<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{R.closeSync(t)}catch{}}}function Mt(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var Xn=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest"]),xt=["agent_id","agentId"],Nt=["turn_id","turnId"];function Kn(e,t,n){let r=[e.transcript_path,e.transcriptPath].filter(o=>o!==void 0);return r.length?r.every(o=>o===r[0])?r[0]:void 0:n==="cli"&&/^[A-Za-z0-9_-]{1,128}$/.test(t)?zn.join(X(),"session-state",t,"events.jsonl"):void 0}function jt(e,t){return e.agentId!==void 0&&e.agentId!==null?Ae(e.agentId)===t&&t!==void 0:t===void 0&&O(e.data)?.parentToolCallId==null}function Ct(e,t,n){let r=K(e.model);if(r)return{name:r,source:"hook.model"};try{return Hn(e,t,n)}catch{return}}function Hn(e,t,n){let r=re(e),o=H(e,["tool_use_id","toolUseId","tool_call_id","toolCallId"]),s=r==="SessionStart"&&e.source==="startup";if(!s&&(!Xn.has(r)||!o))return;let u=H(e,["session_id","sessionId"]),a=H(e,xt),c=H(e,Nt),l=Dt(e,n);if(!u||l===void 0||xt.some(f=>e[f]!==void 0)&&!a||Nt.some(f=>e[f]!==void 0)&&!c||!a&&["agent_name","agentName","agent_type","agentType"].some(f=>e[f]!==void 0))return;let d=It(Kn(e,u,t)),_=d?.first,E=O(_?.data),k=V(_?.timestamp);if(!d||_?.type!=="session.start"||E?.sessionId!==u||k===void 0||k>l||d.rows.some(f=>f.type==="session.start"&&O(f.data)?.sessionId!==u))return;if(s){if(a||!d.complete||e.timestamp===void 0)return;let f=K(E.selectedModel),h=k;for(let D of d.rows){if(D.type!=="session.model_change"||!jt(D,void 0))continue;let v=V(D.timestamp);if(v===void 0)return;if(v>l||v<h)continue;let $=K(O(D.data)?.newModel);if(v===h&&$!==f)return;f=$,h=v}return f?{name:f,source:"transcript.session.selected"}:void 0}let N=[];for(let f of d.rows){let h=O(f.data),D=V(f.timestamp);if(!h||D===void 0||D>l||D<k||!jt(f,a)||c!==void 0&&h.turnId!==c)continue;let v=!1;if(f.type==="assistant.message"?v=Array.isArray(h.toolRequests)&&h.toolRequests.some(en=>O(en)?.toolCallId===o):(f.type==="tool.execution_start"||f.type==="tool.execution_complete")&&(v=h.toolCallId===o),!v)continue;let $=K(h.model);N.push($?{name:$,source:`transcript.${f.type}`}:void 0)}return Mt(N)}var ae;function Jn(){if(ae===void 0)try{ae=ke.userInfo().username}catch{ae=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ae}var Ut=ie,Wn=new Set(["","unknown","undefined","null","n/a","none"]);function b(e){let t=typeof e=="string"?e.trim():void 0;return t&&!Wn.has(t.toLowerCase())?t:void 0}var Qn=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function er(e){let t=b(e);return t&&Qn.test(t)?t:void 0}function tr(e){let t=e?b(e.copilot_version)??b(e.copilotVersion)??b(e.cli_version)??b(e.cliVersion)??b(e.version):void 0;return t||(Re===void 0&&(Re=nr()),Re??void 0)}var Re;function nr(){let e=b(process.env.COPILOT_CLI_BINARY_VERSION)??b(process.env.COPILOT_CLI_VERSION);if(e)return e;let t=b(process.env.COPILOT_CLI_RESOLVED_DIST_DIR);if(t){let n=er(Lt.basename(t));if(n)return n;let r=rr(t);if(r)return r}return null}function rr(e){try{let t=Zn.readFileSync(Lt.join(e,"package.json"),"utf8");return b(JSON.parse(t).version)}catch{return}}var or=new Set(["copilot.hook","copilot.tool_name","copilot.toolName","copilot.tool_use_id","copilot.toolUseId","copilot.session_id","copilot.sessionId","copilot.transcript_path","copilot.transcriptPath","copilot.cwd","copilot.permission_mode","copilot.surface","copilot.agent_id","copilot.agent_type","copilot.agent_name","copilot.agent_display_name","copilot.stop_reason","copilot.notification_type"]),sr=new Set(["copilot.tool_input","copilot.toolInput","copilot.toolArgs","copilot.tool_response","copilot.tool_result","copilot.toolResult"]),ir={skipRedactKeys:or,bashContextKeys:sr},ar=new Set(["hook_event_name","hookEventName","hookName"]);function ur(e,t,n){let r=Object.fromEntries(Object.entries(e).filter(([o])=>!ar.has(o)));return kt(r,Ct(e,t,n)),[{key:"ingest.type",value:{stringValue:"copilot"}},{key:"copilot.hook",value:{stringValue:ne(e)??"unknown"}},{key:"copilot.surface",value:{stringValue:t}},...(0,q.attrsFromRecord)(r,"copilot",ir)]}function cr(e){let t=tr(e);return[{key:"service.name",value:{stringValue:"copilot"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-copilot"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Ut}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Jn()}},{key:"host.name",value:{stringValue:ke.hostname()}},{key:"host.arch",value:{stringValue:ke.arch()}}]}function qt(e){let t=e.now??Date.now();return(0,q.buildPayload)({traceId:e.traceId,spanName:`copilot.${(0,q.snakeCase)(ne(e.event)??"unknown")}`,attributes:ur(e.event,e.surface,t),resource:cr(e.event),scope:{name:"pinta-copilot",version:Ut},now:t})}var Ft=F(L());function lr(){return Number(process.env.PINTA_GUARD_TIMEOUT_MS)||100}var dr=`pinta-copilot/${ie}`;function Bt(e,t){return(0,Ft.evaluateGuard)(e,t,{timeoutMs:lr(),token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:dr})}async function fr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function $t(){try{let e=_t(),t=St(),n=await fr(),r=JSON.parse(n),o=re(r),s=Tt(r),u=new se(e),a=o==="UserPromptSubmit"?u.newTrace(s):u.currentTrace(s),c=qt({event:r,traceId:a,surface:t}),l=Et(r),d=null;if(Pt(o)&&!Ot(l)&&(d=await Bt(c,process.env.PINTA_GUARD_ENDPOINT)),d?.decision==="DENY"){let E=bt(o,d.userMessage??d.reason??"guard_deny",t,r);E&&process.stdout.write(E+`
-`)}if((0,Vt.attachGuard)(c,d),d&&o==="PostToolUse")for(let E of c.resourceSpans)for(let k of E.scopeSpans)for(let N of k.spans)N.attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}});if(d?.decision==="DENY")return wt(c,e),0;let _=new oe(e);await _.flush(),await _.send(c)}catch(e){process.stderr.write(`[pinta-copilot] error: ${e}
-`)}return 0}import{opendir as wr,stat as Ar}from"node:fs/promises";import ue from"node:path";import{spawn as zt}from"node:child_process";import{copyFile as De,mkdtemp as pr,rm as mr,stat as gr}from"node:fs/promises";import hr from"node:os";import Ie from"node:path";var yr=2e3,_r=250,Gt=3,Yt=3e4,Sr=3e4,Me;function Tr(){return Me||(Me=new Promise(e=>{let t=zt("sqlite3",["-version"],{stdio:"ignore"});t.once("error",()=>e(!1)),t.once("exit",n=>e(n===0))})),Me}function Er(e){return`'${e.replace(/'/g,"''")}'`}async function Pr(e,t){let n=`.backup ${Er(t)}`;await new Promise((r,o)=>{let s=zt("sqlite3",[e,n],{stdio:["ignore","ignore","pipe"],timeout:Sr,killSignal:"SIGKILL"}),u="";s.stderr?.on("data",a=>{u+=a.toString()}),s.once("error",o),s.once("exit",a=>{a===0?r():o(new Error(`sqlite3 .backup exited ${a}: ${u.trim()}`))})})}async function xe(e){try{return await gr(e)}catch{return}}function Xt(e,t){return e===void 0||t===void 0?e===void 0&&t===void 0:e.size===t.size&&e.mtimeMs===t.mtimeMs}function Kt(e){return{wal:`${e}-wal`,shm:`${e}-shm`}}async function Or(e){let{wal:t,shm:n}=Kt(e),r=[e,t,n],o=Date.now(),s=o,u=await Promise.all(r.map(async a=>({path:a,st:await xe(a)})));for(;;){if(Date.now()-s>=yr)return u;if(Date.now()-o>=Yt)throw new Error(`snapshot: ${e} never quiesced within ${Yt}ms (actively written?)`);await new Promise(l=>setTimeout(l,_r));let a=await Promise.all(r.map(async l=>({path:l,st:await xe(l)})));a.every((l,d)=>Xt(l.st,u[d].st))||(s=Date.now()),u=a}}async function br(e,t){let{wal:n,shm:r}=Kt(e),o=await Or(e);if(await De(e,t),o.find(a=>a.path===n)?.st!==void 0&&await De(n,`${t}-wal`),o.find(a=>a.path===r)?.st!==void 0&&await De(r,`${t}-shm`),!(await Promise.all([e,n,r].map(async a=>({path:a,st:await xe(a)})))).every((a,c)=>Xt(a.st,o[c].st)))throw new Error(`snapshot: ${e} changed during quiesce-copy (torn-read guard)`)}async function vr(e,t){let n;for(let r=1;r<=Gt;r++)try{await br(e,t);return}catch(o){n=o}throw new Error(`snapshot: quiesce-copy of ${e} failed after ${Gt} attempts: ${String(n)}`)}async function Ht(e,t={}){let n=t.tmpDirBase??hr.tmpdir(),r=await pr(Ie.join(n,"pinta-copilot-snapshot-")),o=Ie.join(r,Ie.basename(e.absPath));try{if(await Tr())try{return await Pr(e.absPath,o),o}catch{}return await vr(e.absPath,o),o}catch(s){throw await mr(r,{recursive:!0,force:!0}).catch(()=>{}),s}}var Rr="pinta-copilot",Zt="events.jsonl",Jt="session.db",kr="rewind-snapshots/backups/";function Dr(){return ue.join(X(),"session-state")}function Ir(e,t){return ue.relative(e,t).split(ue.sep).join("/")}function Mr(e){return e.endsWith(".db-wal")||e.endsWith(".db-shm")}function xr(e){let[t]=e.split("/");return!t||t===e?{}:{sessionId:t}}function Nr(e,t){let n=e.split("/").length===2;return n&&t===Zt?"append-log":n&&t===Jt?"database":"rewritten-doc"}function jr(e){let t=e.split("/"),n=t[t.length-1]??"";return t.length===2&&(n===Zt||n===Jt)?"session-log":e.includes(kr)?"other":"meta"}async function Wt(){return[Dr()]}async function*Qt(e,t){let n;try{n=await wr(t)}catch{return}try{for await(let r of n){let o=ue.join(t,r.name);r.isDirectory()?yield*Qt(e,o):r.isFile()&&(yield{absPath:o,relPath:Ir(e,o)})}}catch{return}}async function*Cr(e){let[t]=await Wt(),n=e.since?.getTime();for await(let{absPath:r,relPath:o}of Qt(t,t)){let s=o.split("/"),u=s[s.length-1]??"";if(Mr(u))continue;let a;try{a=await Ar(r)}catch{continue}n!==void 0&&a.mtime.getTime()<=n||(yield{relPath:o,absPath:r,size:a.size,mtime:a.mtime,...xr(o),semantics:Nr(o,u)})}}async function Lr(e){return Ht(e)}var Ur={id:Rr,roots:Wt,scan:Cr,classify:jr,snapshot:Lr};yt();function Br(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===Fr(qr(e)).href}catch{return!1}}async function Vr(){let e=await $t();process.exit(e)}Br()&&Vr();export{Ur as lifecycle};
+`)}}tryAcquireLock(){let t=Date.now();try{S.default.mkdirSync(re.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<Bn;)try{let n=S.default.openSync(this.lockPath,"wx");return S.default.writeSync(n,String(process.pid)),S.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let i=S.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){S.default.unlinkSync(this.lockPath);continue}}catch{}let r=Fn,s=Date.now()+r;for(;Date.now()<s;);}return!1}release(){try{S.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=se)return;let n=t.length-se;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};M.DiskRetryQueue=ge;var ye=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>se&&this.entries.splice(0,this.entries.length-se)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};M.MemoryRetryQueue=ye});var dt=P(p=>{"use strict";Object.defineProperty(p,"__esModule",{value:!0});p.MemoryTransport=p.DiskTransport=p.MAX_POST_BYTES=void 0;p.parseHeadersEnv=ct;p.envOptionsResolver=lt;p.postOtlp=X;var it=_e(),at=he(),Vn=5e3;p.MAX_POST_BYTES=900*1024;function oe(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function ut(e,t,n){let r=[],s=[],i=[],o=0;for(let a of e){let c=t(a);if(c>n){s.push(a);continue}i.length>0&&o+c>n&&(r.push(i),i=[],o=0),i.push(a),o+=c}return i.length>0&&r.push(i),{chunks:r,oversize:s}}function ct(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...s]=n.split("=");r&&s.length>0&&(t[r.trim()]=s.join("=").trim())}return t}function lt(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:ct(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function X(e,t,n){let r=new AbortController,s=setTimeout(()=>r.abort(),Vn);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!i.ok){let o="";try{o=(await i.text()).slice(0,200)}catch{}let a=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${i.status} ${t.endpoint}${a}${o?` body=${o}`:""}
+`),!1}return!0}catch(i){return process.stderr.write(`[${n}] OTLP POST failed: ${i.message??String(i)}
+`),!1}finally{clearTimeout(s)}}var Se=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new it.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??lt}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await X(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:s}=ut(n,a=>oe(a.payload),p.MAX_POST_BYTES);s.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${s.length} oversized retry ${s.length===1?"entry":"entries"} (each > ${p.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...r),o=0;for(let a of r){if(!await X((0,at.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;o+=a.length}this.queue.rewrite(i.slice(o))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=oe(t);return n<=p.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};p.DiskTransport=Se;var Te=class{queue=new it.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(oe(t)>p.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await X(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:s}=ut(n,oe,p.MAX_POST_BYTES);s.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${s.length} oversized buffered ${s.length===1?"payload":"payloads"} (each > ${p.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...r),o=0;for(let a of r){if(!await X((0,at.mergeBatch)(a),t,this.logPrefix))break;o+=a.length}for(let a of i.slice(o))this.queue.enqueue(a)}};p.MemoryTransport=Te});var ve=P(j=>{"use strict";var Oe=j&&j.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(j,"__esModule",{value:!0});j.TraceManager=void 0;j.generateUlid=pt;var ft=Oe(T("fs")),Gn=Oe(T("path")),zn=Oe(T("crypto")),Yn=ne(),Ee="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function pt(){let e=Date.now(),t="",n=e;for(let i=0;i<10;i++)t=Ee[n&31]+t,n=Math.floor(n/32);let r=zn.default.randomBytes(10),s="";for(let i=0;i<10;i++)s+=Ee[r[i]&31];for(;s.length<16;)s+=Ee[0];return t+s}var Pe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=pt();return this.save(t),t}currentTrace(){try{let t=ft.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{ft.default.mkdirSync(Gn.default.dirname(this.tracePath),{recursive:!0}),(0,Yn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};j.TraceManager=Pe});var _t=P(D=>{"use strict";var ht=D&&D.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(D,"__esModule",{value:!0});D.MemorySessionTraceManager=D.DiskSessionTraceManager=void 0;var mt=ht(T("fs")),Xn=ht(T("path")),gt=ve(),Kn=ne(),yt=200,be=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??yt}read(){try{let t=JSON.parse(mt.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{mt.default.mkdirSync(Xn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Kn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,gt.generateUlid)(),s=this.read();return s[n]=r,this.write(s),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};D.DiskSessionTraceManager=be;var we=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??yt}newTrace(t){let n=t||"default",r=(0,gt.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let s=this.map.keys().next().value;s!==void 0&&this.map.delete(s)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};D.MemorySessionTraceManager=we});var Et=P(C=>{"use strict";var Ae=C&&C.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(C,"__esModule",{value:!0});C.envFilePath=Zn;C.parseEnvFile=Tt;C.loadEnvFile=Jn;var Hn=Ae(T("node:fs")),Wn=Ae(T("node:os")),St=Ae(T("node:path"));function Zn(e,t,n){let r=n?process.env[n]:void 0,s=r&&r.length>0?r:St.default.join(Wn.default.homedir(),e);return St.default.join(s,t)}function Tt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let s=r.indexOf("=");if(s<0)continue;let i=r.slice(0,s).trim(),o=r.slice(s+1).trim();(o.startsWith('"')&&o.endsWith('"')||o.startsWith("'")&&o.endsWith("'"))&&(o=o.slice(1,-1)),i&&(t[i]=o)}return t}function Jn(e){let t;try{t=Hn.default.readFileSync(e,"utf-8")}catch{return}let n=Tt(t);for(let[r,s]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=s)}});var L=P(u=>{"use strict";Object.defineProperty(u,"__esModule",{value:!0});u.loadEnvFile=u.parseEnvFile=u.envFilePath=u.MemorySessionTraceManager=u.DiskSessionTraceManager=u.generateUlid=u.TraceManager=u.MAX_POST_BYTES=u.parseHeadersEnv=u.envOptionsResolver=u.postOtlp=u.MemoryTransport=u.DiskTransport=u.MemoryRetryQueue=u.DiskRetryQueue=u.GUARD_BUDGET_HEADER=u.GUARD_STATUS_REFUSED=u.evaluateGuard=u.MAX_SPAN_BYTES=u.enforceSpanBudget=u.mergeBatch=u.attachGuard=u.buildPayload=u.clientAttrs=u.guardAttrs=u.attrsFromRecord=u.toOtlpValue=u.snakeCase=u.newSpanId=u.ulidToTraceId=u.MAX_BYTES=u.PATTERNS=u.applyMatches=u.resolveOverlaps=u.collectMatches=u.truncateTo=u.truncate=u.redact=void 0;var N=pe();Object.defineProperty(u,"redact",{enumerable:!0,get:function(){return N.redact}});Object.defineProperty(u,"truncate",{enumerable:!0,get:function(){return N.truncate}});Object.defineProperty(u,"truncateTo",{enumerable:!0,get:function(){return N.truncateTo}});Object.defineProperty(u,"collectMatches",{enumerable:!0,get:function(){return N.collectMatches}});Object.defineProperty(u,"resolveOverlaps",{enumerable:!0,get:function(){return N.resolveOverlaps}});Object.defineProperty(u,"applyMatches",{enumerable:!0,get:function(){return N.applyMatches}});Object.defineProperty(u,"PATTERNS",{enumerable:!0,get:function(){return N.PATTERNS}});Object.defineProperty(u,"MAX_BYTES",{enumerable:!0,get:function(){return N.MAX_BYTES}});var E=he();Object.defineProperty(u,"ulidToTraceId",{enumerable:!0,get:function(){return E.ulidToTraceId}});Object.defineProperty(u,"newSpanId",{enumerable:!0,get:function(){return E.newSpanId}});Object.defineProperty(u,"snakeCase",{enumerable:!0,get:function(){return E.snakeCase}});Object.defineProperty(u,"toOtlpValue",{enumerable:!0,get:function(){return E.toOtlpValue}});Object.defineProperty(u,"attrsFromRecord",{enumerable:!0,get:function(){return E.attrsFromRecord}});Object.defineProperty(u,"guardAttrs",{enumerable:!0,get:function(){return E.guardAttrs}});Object.defineProperty(u,"clientAttrs",{enumerable:!0,get:function(){return E.clientAttrs}});Object.defineProperty(u,"buildPayload",{enumerable:!0,get:function(){return E.buildPayload}});Object.defineProperty(u,"attachGuard",{enumerable:!0,get:function(){return E.attachGuard}});Object.defineProperty(u,"mergeBatch",{enumerable:!0,get:function(){return E.mergeBatch}});Object.defineProperty(u,"enforceSpanBudget",{enumerable:!0,get:function(){return E.enforceSpanBudget}});Object.defineProperty(u,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return E.MAX_SPAN_BYTES}});var Re=rt();Object.defineProperty(u,"evaluateGuard",{enumerable:!0,get:function(){return Re.evaluateGuard}});Object.defineProperty(u,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Re.GUARD_STATUS_REFUSED}});Object.defineProperty(u,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Re.GUARD_BUDGET_HEADER}});var Pt=_e();Object.defineProperty(u,"DiskRetryQueue",{enumerable:!0,get:function(){return Pt.DiskRetryQueue}});Object.defineProperty(u,"MemoryRetryQueue",{enumerable:!0,get:function(){return Pt.MemoryRetryQueue}});var F=dt();Object.defineProperty(u,"DiskTransport",{enumerable:!0,get:function(){return F.DiskTransport}});Object.defineProperty(u,"MemoryTransport",{enumerable:!0,get:function(){return F.MemoryTransport}});Object.defineProperty(u,"postOtlp",{enumerable:!0,get:function(){return F.postOtlp}});Object.defineProperty(u,"envOptionsResolver",{enumerable:!0,get:function(){return F.envOptionsResolver}});Object.defineProperty(u,"parseHeadersEnv",{enumerable:!0,get:function(){return F.parseHeadersEnv}});Object.defineProperty(u,"MAX_POST_BYTES",{enumerable:!0,get:function(){return F.MAX_POST_BYTES}});var Ot=ve();Object.defineProperty(u,"TraceManager",{enumerable:!0,get:function(){return Ot.TraceManager}});Object.defineProperty(u,"generateUlid",{enumerable:!0,get:function(){return Ot.generateUlid}});var vt=_t();Object.defineProperty(u,"DiskSessionTraceManager",{enumerable:!0,get:function(){return vt.DiskSessionTraceManager}});Object.defineProperty(u,"MemorySessionTraceManager",{enumerable:!0,get:function(){return vt.MemorySessionTraceManager}});var ke=Et();Object.defineProperty(u,"envFilePath",{enumerable:!0,get:function(){return ke.envFilePath}});Object.defineProperty(u,"parseEnvFile",{enumerable:!0,get:function(){return ke.parseEnvFile}});Object.defineProperty(u,"loadEnvFile",{enumerable:!0,get:function(){return ke.loadEnvFile}})});import{realpathSync as ns}from"node:fs";import{pathToFileURL as rs}from"node:url";var K=$(L());function Qn(){return(0,K.envFilePath)(".copilot","pinta-copilot.env","COPILOT_HOME")}function bt(e=Qn()){(0,K.loadEnvFile)(e)}import er from"os";import Ie from"path";function H(){return process.env.COPILOT_HOME||Ie.join(er.homedir(),".copilot")}function wt(){let e=process.env.COPILOT_PLUGIN_DATA||Ie.join(H(),"pinta-copilot-data");return{pluginData:e,tracePath:Ie.join(e,"trace.json")}}function At(e=process.env){return e.COPILOT_AGENT_JOB_ID||e.COPILOT_AGENT_SESSION_ID||e.COPILOT_AGENT_PROMPT?"cloud":e.ELECTRON_RUN_AS_NODE||e.VSCODE_IPC_HOOK||e.VSCODE_PID?"ext":"cli"}var Wt=$(L());function q(e){return typeof e=="string"?e:void 0}function W(e){return q(e.hook_event_name)??q(e.hookEventName)??q(e.hookName)??(process.env.PINTA_COPILOT_EVENT||void 0)}function Rt(e){return q(e.session_id)??q(e.sessionId)}function kt(e){return q(e.tool_name)??q(e.toolName)}var tr={sessionstart:"SessionStart",sessionend:"SessionEnd",userpromptsubmit:"UserPromptSubmit",userpromptsubmitted:"UserPromptSubmit",pretooluse:"PreToolUse",posttooluse:"PostToolUse",posttoolusefailure:"PostToolUseFailure",stop:"Stop",agentstop:"Stop",subagentstart:"SubagentStart",subagentstop:"SubagentStop",precompact:"PreCompact",notification:"Notification",permissionrequest:"PermissionRequest",erroroccurred:"ErrorOccurred"};function ie(e){let t=W(e);return t?tr[t.toLowerCase()]??"Unknown":"Unknown"}function It(e){return e==="PreToolUse"||e==="PermissionRequest"||e==="PostToolUse"}var nr=new Set(["report_intent","ask_user","AskUserQuestion"]);function Mt(e){return e!==void 0&&nr.has(e)}var rr="Pinta AI withheld this tool output because it matched a blocking policy. The tool already ran. Do not retry this operation to bypass the block.",sr="Pinta AI stopped this run because a tool output matched a blocking policy. The tool already ran and its original output may remain in the transcript. Review the incident and start a new session instead of resuming this one.";function Dt(e,t,n="cli",r){if(e==="PreToolUse"){let s={permissionDecision:"deny",permissionDecisionReason:t};return r&&W(r)==="preToolUse"?JSON.stringify(s):JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",...s}})}if(e==="PermissionRequest")return JSON.stringify({behavior:"deny",message:t});if(e==="PostToolUse"){let s=r!==void 0&&("tool_result"in r||"toolResult"in r),i=r!==void 0&&"tool_response"in r;return JSON.stringify(!s&&(i||n==="ext")?{continue:!1,stopReason:sr}:{modifiedResult:{resultType:"success",textResultForLlm:rr}})}return null}var A=$(L());function Nt(){let e=process.env.COPILOT_PLUGIN_OPTION_ENDPOINT||process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:(0,A.parseHeadersEnv)(process.env.COPILOT_PLUGIN_OPTION_HEADERS||process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}var ae=class extends A.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-copilot",resolveOptions:Nt})}};function xt(e,t){if(!Nt())return;let n=Buffer.byteLength(JSON.stringify(e),"utf-8");if(n>A.MAX_POST_BYTES){process.stderr.write(`[pinta-copilot] dropping oversized span payload (${n} > ${A.MAX_POST_BYTES} bytes) - undeliverable, not queued
+`);return}new A.DiskRetryQueue(t.pluginData,"pinta-copilot").enqueue(e)}var jt=$(L()),ue=class extends jt.DiskSessionTraceManager{constructor(t){super(t.tracePath)}};import pr from"fs";import Ne from"os";import zt from"path";var ce="0.10.2";var U=$(L());import cr from"node:path";import R from"node:fs";import Ct from"node:path";var or=new Set(["","unknown","undefined","null","n/a","none","auto","default"]),ir=256*1024,ar=1024*1024,ur=4096;function O(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0}function Z(e){let t=O(e),n=t?"id"in t?t.id:t.name:e;if(typeof n!="string")return;let r=n.trim();if(!(r.startsWith("{")||r.startsWith("[")))return r.length<=512&&!/[\u0000-\u001f\u007f]/.test(r)&&!or.has(r.toLowerCase())?r:void 0}function Lt(e,t){delete e.model,t&&(e.model=t.name,!(t.source==="hook.model"&&e.model_source!==void 0)&&(e.model_source!==void 0&&(e.model_original_source=e.model_source),e.model_source=t.source))}function Me(e){return typeof e=="string"&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/.test(e)?e:void 0}function J(e,t){let n=t.filter(r=>e[r]!==void 0).map(r=>Me(e[r]));return n.length>0&&n[0]!==void 0&&n.every(r=>r===n[0])?n[0]:void 0}function V(e){let t=typeof e=="number"?e:typeof e=="string"&&/^\d{4}-\d{2}-\d{2}T/.test(e)?Date.parse(e):NaN;return Number.isFinite(t)&&t>=0?t:void 0}function qt(e,t){let n=e.timestamp===void 0?V(t):V(e.timestamp);return n!==void 0&&n<=t?n:void 0}function Ut(e){if(typeof e!="string"||e.length>4096||/[\u0000-\u001f]/.test(e)||!Ct.isAbsolute(e)||Ct.extname(e)!==".jsonl")return;let t;try{t=R.openSync(e,R.constants.O_RDONLY|R.constants.O_NONBLOCK|(R.constants.O_NOFOLLOW??0));let n=R.fstatSync(t);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size<=0)return;let r=Buffer.alloc(Math.min(n.size,ir));if(R.readSync(t,r,0,r.length,0)!==r.length)return;let s=r.indexOf(10),i;if(s>=0)try{i=O(JSON.parse(r.toString("utf8",0,s)))}catch{}let o=Math.max(0,n.size-ar),a=n.size<=r.length?r:Buffer.alloc(n.size-o);if(a!==r&&R.readSync(t,a,0,a.length,o)!==a.length)return;let c=R.fstatSync(t);if(c.size<n.size||c.size===n.size&&c.mtimeMs!==n.mtimeMs)return;let l=o>0?a.indexOf(10)+1:0,d=a.lastIndexOf(10);if(o>0&&l===0||d<l)return;let h=[],y=0;for(;d>l&&y<ur;){let k=a.lastIndexOf(10,d-1),x=Math.max(l,k+1),f=a.toString("utf8",x,d).trim();if(f){let _=O(JSON.parse(f));_&&h.push(_)}d=x-1,y++}return h.reverse(),{first:i,rows:h,complete:o===0&&d<0&&a[a.length-1]===10}}catch{return}finally{if(t!==void 0)try{R.closeSync(t)}catch{}}}function $t(e){let t=e[0];return t&&e.every(n=>n?.name===t.name)?t:void 0}var lr=new Set(["PreToolUse","PostToolUse","PostToolUseFailure","PermissionRequest"]),Bt=["agent_id","agentId"],Ft=["turn_id","turnId"];function dr(e,t,n){let r=[e.transcript_path,e.transcriptPath].filter(s=>s!==void 0);return r.length?r.every(s=>s===r[0])?r[0]:void 0:n==="cli"&&/^[A-Za-z0-9_-]{1,128}$/.test(t)?cr.join(H(),"session-state",t,"events.jsonl"):void 0}function Vt(e,t){return e.agentId!==void 0&&e.agentId!==null?Me(e.agentId)===t&&t!==void 0:t===void 0&&O(e.data)?.parentToolCallId==null}function Gt(e,t,n){let r=Z(e.model);if(r)return{name:r,source:"hook.model"};try{return fr(e,t,n)}catch{return}}function fr(e,t,n){let r=ie(e),s=J(e,["tool_use_id","toolUseId","tool_call_id","toolCallId"]),i=r==="SessionStart"&&e.source==="startup";if(!i&&(!lr.has(r)||!s))return;let o=J(e,["session_id","sessionId"]),a=J(e,Bt),c=J(e,Ft),l=qt(e,n);if(!o||l===void 0||Bt.some(f=>e[f]!==void 0)&&!a||Ft.some(f=>e[f]!==void 0)&&!c||!a&&["agent_name","agentName","agent_type","agentType"].some(f=>e[f]!==void 0))return;let d=Ut(dr(e,o,t)),h=d?.first,y=O(h?.data),k=V(h?.timestamp);if(!d||h?.type!=="session.start"||y?.sessionId!==o||k===void 0||k>l||d.rows.some(f=>f.type==="session.start"&&O(f.data)?.sessionId!==o))return;if(i){if(a||!d.complete||e.timestamp===void 0)return;let f=Z(y.selectedModel),_=k;for(let I of d.rows){if(I.type!=="session.model_change"||!Vt(I,void 0))continue;let b=V(I.timestamp);if(b===void 0)return;if(b>l||b<_)continue;let G=Z(O(I.data)?.newModel);if(b===_&&G!==f)return;f=G,_=b}return f?{name:f,source:"transcript.session.selected"}:void 0}let x=[];for(let f of d.rows){let _=O(f.data),I=V(f.timestamp);if(!_||I===void 0||I>l||I<k||!Vt(f,a)||c!==void 0&&_.turnId!==c)continue;let b=!1;if(f.type==="assistant.message"?b=Array.isArray(_.toolRequests)&&_.toolRequests.some(cn=>O(cn)?.toolCallId===s):(f.type==="tool.execution_start"||f.type==="tool.execution_complete")&&(b=_.toolCallId===s),!b)continue;let G=Z(_.model);x.push(G?{name:G,source:`transcript.${f.type}`}:void 0)}return $t(x)}var le;function mr(){if(le===void 0)try{le=Ne.userInfo().username}catch{le=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return le}var Yt=ce,hr=new Set(["","unknown","undefined","null","n/a","none"]);function v(e){let t=typeof e=="string"?e.trim():void 0;return t&&!hr.has(t.toLowerCase())?t:void 0}var gr=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function yr(e){let t=v(e);return t&&gr.test(t)?t:void 0}function _r(e){let t=e?v(e.copilot_version)??v(e.copilotVersion)??v(e.cli_version)??v(e.cliVersion)??v(e.version):void 0;return t||(De===void 0&&(De=Sr()),De??void 0)}var De;function Sr(){let e=v(process.env.COPILOT_CLI_BINARY_VERSION)??v(process.env.COPILOT_CLI_VERSION);if(e)return e;let t=v(process.env.COPILOT_CLI_RESOLVED_DIST_DIR);if(t){let n=yr(zt.basename(t));if(n)return n;let r=Tr(t);if(r)return r}return null}function Tr(e){try{let t=pr.readFileSync(zt.join(e,"package.json"),"utf8");return v(JSON.parse(t).version)}catch{return}}var Er=new Set(["copilot.hook","copilot.tool_name","copilot.toolName","copilot.tool_use_id","copilot.toolUseId","copilot.session_id","copilot.sessionId","copilot.transcript_path","copilot.transcriptPath","copilot.cwd","copilot.permission_mode","copilot.surface","copilot.agent_id","copilot.agent_type","copilot.agent_name","copilot.agent_display_name","copilot.stop_reason","copilot.notification_type"]),Pr=new Set(["copilot.tool_input","copilot.toolInput","copilot.toolArgs","copilot.tool_response","copilot.tool_result","copilot.toolResult"]),Or={skipRedactKeys:Er,bashContextKeys:Pr},vr=new Set(["hook_event_name","hookEventName","hookName"]);function br(e,t,n){let r=Object.fromEntries(Object.entries(e).filter(([s])=>!vr.has(s)));return Lt(r,Gt(e,t,n)),[{key:"ingest.type",value:{stringValue:"copilot"}},{key:"copilot.hook",value:{stringValue:W(e)??"unknown"}},{key:"copilot.surface",value:{stringValue:t}},...(0,U.attrsFromRecord)(r,"copilot",Or)]}function wr(e){let t=_r(e);return[{key:"service.name",value:{stringValue:"copilot"}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-copilot"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Yt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:mr()}},{key:"host.name",value:{stringValue:Ne.hostname()}},{key:"host.arch",value:{stringValue:Ne.arch()}}]}function Xt(e){let t=e.now??Date.now();return(0,U.buildPayload)({traceId:e.traceId,spanName:`copilot.${(0,U.snakeCase)(W(e.event)??"unknown")}`,attributes:br(e.event,e.surface,t),resource:wr(e.event),scope:{name:"pinta-copilot",version:Yt},now:t})}var Kt=$(L());function Ar(){return Number(process.env.PINTA_GUARD_TIMEOUT_MS)||100}var Rr=`pinta-copilot/${ce}`;function Ht(e,t){return(0,Kt.evaluateGuard)(e,t,{timeoutMs:Ar(),token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Rr})}async function kr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}async function Zt(){try{let e=wt(),t=At(),n=await kr(),r=JSON.parse(n),s=ie(r),i=Rt(r),o=new ue(e),a=s==="UserPromptSubmit"?o.newTrace(i):o.currentTrace(i),c=Xt({event:r,traceId:a,surface:t}),l=kt(r),d=null;if(It(s)&&!Mt(l)&&(d=await Ht(c,process.env.PINTA_GUARD_ENDPOINT)),d?.decision==="DENY"){let y=Dt(s,d.userMessage??d.reason??"guard_deny",t,r);y&&process.stdout.write(y+`
+`)}if((0,Wt.attachGuard)(c,d),d&&s==="PostToolUse")for(let y of c.resourceSpans)for(let k of y.scopeSpans)for(let x of k.spans)x.attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}});if(d?.decision==="DENY")return xt(c,e),0;let h=new ae(e);await h.flush(),await h.send(c)}catch(e){process.stderr.write(`[pinta-copilot] error: ${e}
+`)}return 0}import{opendir as Vr,stat as Gr}from"node:fs/promises";import de from"node:path";import{spawn as en}from"node:child_process";import{copyFile as xe,mkdtemp as Ir,rm as Mr,stat as Dr}from"node:fs/promises";import Nr from"node:os";import je from"node:path";var xr=2e3,jr=250,Jt=3,Qt=3e4,Cr=3e4,Ce;function Lr(){return Ce||(Ce=new Promise(e=>{let t=en("sqlite3",["-version"],{stdio:"ignore"});t.once("error",()=>e(!1)),t.once("exit",n=>e(n===0))})),Ce}function qr(e){return`'${e.replace(/'/g,"''")}'`}async function Ur(e,t){let n=`.backup ${qr(t)}`;await new Promise((r,s)=>{let i=en("sqlite3",[e,n],{stdio:["ignore","ignore","pipe"],timeout:Cr,killSignal:"SIGKILL"}),o="";i.stderr?.on("data",a=>{o+=a.toString()}),i.once("error",s),i.once("exit",a=>{a===0?r():s(new Error(`sqlite3 .backup exited ${a}: ${o.trim()}`))})})}async function Le(e){try{return await Dr(e)}catch{return}}function tn(e,t){return e===void 0||t===void 0?e===void 0&&t===void 0:e.size===t.size&&e.mtimeMs===t.mtimeMs}function nn(e){return{wal:`${e}-wal`,shm:`${e}-shm`}}async function $r(e){let{wal:t,shm:n}=nn(e),r=[e,t,n],s=Date.now(),i=s,o=await Promise.all(r.map(async a=>({path:a,st:await Le(a)})));for(;;){if(Date.now()-i>=xr)return o;if(Date.now()-s>=Qt)throw new Error(`snapshot: ${e} never quiesced within ${Qt}ms (actively written?)`);await new Promise(l=>setTimeout(l,jr));let a=await Promise.all(r.map(async l=>({path:l,st:await Le(l)})));a.every((l,d)=>tn(l.st,o[d].st))||(i=Date.now()),o=a}}async function Br(e,t){let{wal:n,shm:r}=nn(e),s=await $r(e);if(await xe(e,t),s.find(a=>a.path===n)?.st!==void 0&&await xe(n,`${t}-wal`),s.find(a=>a.path===r)?.st!==void 0&&await xe(r,`${t}-shm`),!(await Promise.all([e,n,r].map(async a=>({path:a,st:await Le(a)})))).every((a,c)=>tn(a.st,s[c].st)))throw new Error(`snapshot: ${e} changed during quiesce-copy (torn-read guard)`)}async function Fr(e,t){let n;for(let r=1;r<=Jt;r++)try{await Br(e,t);return}catch(s){n=s}throw new Error(`snapshot: quiesce-copy of ${e} failed after ${Jt} attempts: ${String(n)}`)}async function rn(e,t={}){let n=t.tmpDirBase??Nr.tmpdir(),r=await Ir(je.join(n,"pinta-copilot-snapshot-")),s=je.join(r,je.basename(e.absPath));try{if(await Lr())try{return await Ur(e.absPath,s),s}catch{}return await Fr(e.absPath,s),s}catch(i){throw await Mr(r,{recursive:!0,force:!0}).catch(()=>{}),i}}var zr="pinta-copilot",sn="events.jsonl",on="session.db",Yr="rewind-snapshots/backups/";function Xr(){return de.join(H(),"session-state")}function Kr(e,t){return de.relative(e,t).split(de.sep).join("/")}function Hr(e){return e.endsWith(".db-wal")||e.endsWith(".db-shm")}function Wr(e){let[t]=e.split("/");return!t||t===e?{}:{sessionId:t}}function Zr(e,t){let n=e.split("/").length===2;return n&&t===sn?"append-log":n&&t===on?"database":"rewritten-doc"}function Jr(e){let t=e.split("/"),n=t[t.length-1]??"";return t.length===2&&(n===sn||n===on)?"session-log":e.includes(Yr)?"other":"meta"}async function an(){return[Xr()]}async function*un(e,t){let n;try{n=await Vr(t)}catch{return}try{for await(let r of n){let s=de.join(t,r.name);r.isDirectory()?yield*un(e,s):r.isFile()&&(yield{absPath:s,relPath:Kr(e,s)})}}catch{return}}async function*Qr(e){let[t]=await an(),n=e.since?.getTime();for await(let{absPath:r,relPath:s}of un(t,t)){let i=s.split("/"),o=i[i.length-1]??"";if(Hr(o))continue;let a;try{a=await Gr(r)}catch{continue}n!==void 0&&a.mtime.getTime()<=n||(yield{relPath:s,absPath:r,size:a.size,mtime:a.mtime,...Wr(s),semantics:Zr(s,o)})}}async function es(e){return rn(e)}var ts={id:zr,roots:an,scan:Qr,classify:Jr,snapshot:es};bt();function ss(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===rs(ns(e)).href}catch{return!1}}async function os(){let e=await Zt();process.exit(e)}ss()&&os();export{ts as lifecycle};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinta-ai/pinta-copilot",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Generic OTLP forwarder + guard for GitHub Copilot hook events (CLI + VS Code extension)",
   "main": "dist/index.js",
   "exports": {
@@ -41,7 +41,7 @@
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {
-    "@pinta-ai/core": "^0.9.0",
+    "@pinta-ai/core": "^0.9.2",
     "@types/node": "^22.0.0",
     "esbuild": "^0.24.0",
     "tsx": "^4.0.0",