@pinta-ai/pinta-gemini 0.1.0

package/dist/index.js

@@ -0,0 +1,700 @@
+// src/env-file.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+function envFilePath() {
+  const home = process.env.GEMINI_HOME || path.join(os.homedir(), ".gemini");
+  return path.join(home, "pinta-gemini.env");
+}
+function parseEnvFile(content) {
+  const out = {};
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const idx = line.indexOf("=");
+    if (idx < 0) continue;
+    const key = line.slice(0, idx).trim();
+    let value = line.slice(idx + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (key) out[key] = value;
+  }
+  return out;
+}
+function loadEnvFile(filePath = envFilePath()) {
+  let content;
+  try {
+    content = fs.readFileSync(filePath, "utf-8");
+  } catch {
+    return;
+  }
+  for (const [key, value] of Object.entries(parseEnvFile(content))) {
+    if (process.env[key] === void 0) process.env[key] = value;
+  }
+}
+
+// src/core/config.ts
+import os2 from "os";
+import path2 from "path";
+function geminiHome() {
+  return process.env.GEMINI_HOME || path2.join(os2.homedir(), ".gemini");
+}
+function parseHeaders(raw) {
+  const out = {};
+  if (!raw) return out;
+  for (const pair of raw.split(",")) {
+    const [k, ...rest] = pair.split("=");
+    if (k && rest.length) out[k.trim()] = rest.join("=").trim();
+  }
+  return out;
+}
+function resolveEndpoint() {
+  const traces = process.env.GEMINI_PLUGIN_OPTION_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;
+  if (traces) return traces.replace(/\/+$/, "");
+  const base = process.env.OTEL_EXPORTER_OTLP_ENDPOINT;
+  if (base) return base.replace(/\/+$/, "") + "/v1/traces";
+  return void 0;
+}
+function resolveHeaders() {
+  const headers = parseHeaders(process.env.GEMINI_PLUGIN_OPTION_HEADERS || process.env.OTEL_EXPORTER_OTLP_HEADERS);
+  const apiKey = process.env.GEMINI_PLUGIN_OPTION_API_KEY;
+  if (apiKey && !headers["x-pinta-relay-token"]) headers["x-pinta-relay-token"] = apiKey;
+  return headers;
+}
+function loadConfig() {
+  const pluginData = process.env.GEMINI_PLUGIN_DATA || path2.join(geminiHome(), "pinta-gemini-data");
+  if (!process.env.PINTA_RELAY_TOKEN && process.env.GEMINI_PLUGIN_OPTION_API_KEY) {
+    process.env.PINTA_RELAY_TOKEN = process.env.GEMINI_PLUGIN_OPTION_API_KEY;
+  }
+  return {
+    pluginData,
+    tracePath: path2.join(pluginData, "trace.json"),
+    endpoint: resolveEndpoint(),
+    headers: resolveHeaders(),
+    guardEndpoint: process.env.PINTA_GUARD_ENDPOINT
+  };
+}
+
+// src/core/agent.ts
+function parseInvocation(argv = process.argv) {
+  const get = (name) => {
+    const i = argv.indexOf(name);
+    return i >= 0 ? argv[i + 1] : void 0;
+  };
+  return { agent: get("--agent") || "gemini", event: get("--event") };
+}
+function antigravityProduct(ev) {
+  const tp = ev["transcriptPath"];
+  if (typeof tp !== "string") return void 0;
+  if (tp.includes("/antigravity-cli/brain/")) return "agy";
+  if (tp.includes("/antigravity/brain/")) return "antigravity2";
+  return void 0;
+}
+
+// src/core/types.ts
+var isGemini = (agent) => agent === "gemini";
+function identity(agent) {
+  return isGemini(agent) ? { prefix: "gemini", ingest: "gemini", service: "gemini-cli" } : { prefix: "antigravity", ingest: "antigravity", service: "antigravity-cli" };
+}
+function gateEvent(agent) {
+  return isGemini(agent) ? "BeforeTool" : "PreToolUse";
+}
+var SKIP_HOOKS = /* @__PURE__ */ new Set(["AfterModel"]);
+var isSkippedHook = (hook) => SKIP_HOOKS.has(hook);
+
+// src/core/normalize.ts
+function normalize(agent, event, ev) {
+  if (isGemini(agent)) {
+    return {
+      hook: event || ev["hook_event_name"] || "unknown",
+      session_id: asString(ev["session_id"]),
+      cwd: asString(ev["cwd"]),
+      tool_name: asString(ev["tool_name"]),
+      tool_input: ev["tool_input"]
+    };
+  }
+  const workspacePaths = ev["workspacePaths"];
+  const toolCall = ev["toolCall"];
+  return {
+    hook: event || "unknown",
+    session_id: asString(ev["conversationId"]),
+    cwd: Array.isArray(workspacePaths) ? asString(workspacePaths[0]) : void 0,
+    tool_name: toolCall?.name,
+    tool_input: toolCall?.args
+  };
+}
+function asString(v) {
+  return typeof v === "string" ? v : void 0;
+}
+
+// src/core/guard.ts
+var TIMEOUT_MS = 50;
+function sleep(ms) {
+  return new Promise(
+    (_, reject) => setTimeout(() => {
+      const err = new Error("Guard request timed out");
+      err.name = "TimeoutError";
+      reject(err);
+    }, ms)
+  );
+}
+async function evaluateGuard(input, endpoint) {
+  if (!endpoint) return null;
+  if (process.env.PINTA_GUARD_DISABLED === "1") return null;
+  const start = Date.now();
+  try {
+    const res = await Promise.race([
+      fetch(endpoint, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-pinta-relay-token": process.env.PINTA_RELAY_TOKEN ?? ""
+        },
+        body: JSON.stringify({ input })
+      }),
+      sleep(TIMEOUT_MS)
+    ]);
+    if (res.status !== 200) {
+      return { decision: "ALLOW", reason: null, userMessage: null, durationMs: Date.now() - start, failOpenReason: "error" };
+    }
+    const body = await res.json();
+    return {
+      decision: body.decision,
+      reason: body.reason,
+      userMessage: body.userMessage ?? null,
+      durationMs: body.durationMs ?? Date.now() - start
+    };
+  } catch (err) {
+    const reason = err.name === "TimeoutError" ? "timeout" : "error";
+    return { decision: "ALLOW", reason: null, userMessage: null, durationMs: Date.now() - start, failOpenReason: reason };
+  }
+}
+
+// src/core/retry-queue.ts
+import fs2 from "fs";
+import path3 from "path";
+var MAX_ENTRIES = 1e3;
+var LOCK_TIMEOUT_MS = 50;
+var LOCK_POLL_MS = 5;
+var RetryQueue = class {
+  filePath;
+  lockPath;
+  constructor(pluginData) {
+    this.filePath = path3.join(pluginData, "failed-spans.jsonl");
+    this.lockPath = this.filePath + ".lock";
+  }
+  /** Append a single payload. Best-effort: any IO error is swallowed (logged to stderr). */
+  enqueue(payload) {
+    try {
+      fs2.mkdirSync(path3.dirname(this.filePath), { recursive: true });
+      const line = JSON.stringify({ savedAt: (/* @__PURE__ */ new Date()).toISOString(), payload }) + "\n";
+      fs2.appendFileSync(this.filePath, line);
+      this.trim();
+    } catch (err) {
+      process.stderr.write(`[pinta-gemini] retry-queue enqueue failed: ${err}
+`);
+    }
+  }
+  /**
+   * Read all entries oldest-first. Returns [] if the file does not exist or is unreadable.
+   * Does NOT delete the file — callers handle persistence via `rewrite`.
+   */
+  readAll() {
+    try {
+      const raw = fs2.readFileSync(this.filePath, "utf-8");
+      const out = [];
+      for (const line of raw.split("\n")) {
+        if (!line.trim()) continue;
+        try {
+          out.push(JSON.parse(line));
+        } catch {
+        }
+      }
+      return out;
+    } catch {
+      return [];
+    }
+  }
+  /** Replace the queue with the given entries (or delete the file when empty). */
+  rewrite(entries) {
+    try {
+      if (entries.length === 0) {
+        if (fs2.existsSync(this.filePath)) fs2.unlinkSync(this.filePath);
+        return;
+      }
+      fs2.mkdirSync(path3.dirname(this.filePath), { recursive: true });
+      fs2.writeFileSync(this.filePath, entries.map((e) => JSON.stringify(e)).join("\n") + "\n");
+    } catch (err) {
+      process.stderr.write(`[pinta-gemini] retry-queue rewrite failed: ${err}
+`);
+    }
+  }
+  /**
+   * Try to acquire the lock for ~LOCK_TIMEOUT_MS. Returns true on success.
+   * Caller MUST call `release()` if true is returned.
+   */
+  tryAcquireLock() {
+    const start = Date.now();
+    fs2.mkdirSync(path3.dirname(this.lockPath), { recursive: true });
+    while (Date.now() - start < LOCK_TIMEOUT_MS) {
+      try {
+        const fd = fs2.openSync(this.lockPath, "wx");
+        fs2.writeSync(fd, String(process.pid));
+        fs2.closeSync(fd);
+        return true;
+      } catch (err) {
+        if (err?.code !== "EEXIST") {
+          process.stderr.write(`[pinta-gemini] retry-queue lock open failed: ${err}
+`);
+          return false;
+        }
+        try {
+          const st = fs2.statSync(this.lockPath);
+          if (Date.now() - st.mtimeMs > 3e4) {
+            fs2.unlinkSync(this.lockPath);
+            continue;
+          }
+        } catch {
+        }
+        const wait = LOCK_POLL_MS;
+        const end = Date.now() + wait;
+        while (Date.now() < end) {
+        }
+      }
+    }
+    return false;
+  }
+  release() {
+    try {
+      fs2.unlinkSync(this.lockPath);
+    } catch {
+    }
+  }
+  trim() {
+    const entries = this.readAll();
+    if (entries.length <= MAX_ENTRIES) return;
+    const drop = entries.length - MAX_ENTRIES;
+    process.stderr.write(`[pinta-gemini] retry-queue full, dropping ${drop} oldest entries
+`);
+    this.rewrite(entries.slice(drop));
+  }
+};
+
+// src/core/otlp.ts
+import crypto from "crypto";
+import os3 from "os";
+
+// src/core/redact.ts
+var MAX_BYTES = 102400;
+function truncate(input) {
+  const buf = Buffer.from(input, "utf-8");
+  if (buf.length <= MAX_BYTES) return input;
+  const head = buf.subarray(0, MAX_BYTES).toString("utf-8");
+  return `${head}\u2026[TRUNCATED:${buf.length}]`;
+}
+var PATTERNS = [
+  { type: "aws_access_key", regex: /AKIA[0-9A-Z]{16}/g },
+  {
+    type: "aws_secret_key",
+    // Context word `aws_secret`/`AWS_SECRET` (with optional separator) followed
+    // by an assignment-ish character then a 40-char base64-ish blob.
+    regex: /(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,
+    captureGroup: 1
+  },
+  {
+    type: "gcp_service_account",
+    // Whole JSON blob starting with the service-account discriminator.
+    regex: /\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g
+  },
+  { type: "github_token", regex: /gh[pousr]_[A-Za-z0-9]{36,}/g },
+  { type: "gitlab_token", regex: /glpat-[A-Za-z0-9_-]{20}/g },
+  { type: "slack_token", regex: /xox[abrsp]-[0-9A-Za-z-]{10,}/g },
+  { type: "openai_key", regex: /sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g },
+  { type: "anthropic_key", regex: /sk-ant-[A-Za-z0-9_-]{50,}/g },
+  { type: "stripe_key", regex: /(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g },
+  {
+    type: "jwt",
+    regex: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+  },
+  {
+    type: "private_key_block",
+    regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g
+  },
+  { type: "bearer_token", regex: /bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi, captureGroup: 1 },
+  { type: "basic_auth", regex: /basic\s+([A-Za-z0-9+/=]{12,})/gi, captureGroup: 1 },
+  {
+    type: "db_url_password",
+    regex: /\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,
+    captureGroup: 1
+  },
+  {
+    type: "cli_password_flag",
+    regex: /(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,
+    captureGroup: 1
+  },
+  {
+    type: "cli_password_short",
+    // mysql -p<pass>; only on bash context.
+    regex: /\s-p([^\s'"]+)/g,
+    captureGroup: 1,
+    requireContext: "bash"
+  },
+  {
+    type: "env_var_secret",
+    // Known false positive: trailing `[A-Z0-9_]*` is greedy, so names like
+    // `OPENAI_API_KEY_DESCRIPTION=Used` still match. Acceptable for Bronze.
+    regex: /^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,
+    captureGroup: 2
+  }
+];
+function collectMatches(input, opts) {
+  const out = [];
+  for (const pattern of PATTERNS) {
+    if (pattern.requireContext && pattern.requireContext !== opts.context) continue;
+    const re = new RegExp(pattern.regex.source, pattern.regex.flags);
+    let m;
+    while ((m = re.exec(input)) !== null) {
+      const cg = pattern.captureGroup ?? 0;
+      const captured = m[cg];
+      if (captured === void 0) {
+        if (m.index === re.lastIndex) re.lastIndex++;
+        continue;
+      }
+      const start = m.index;
+      const end = m.index + m[0].length;
+      const replaceStart = start + m[0].indexOf(captured);
+      const replaceEnd = replaceStart + captured.length;
+      out.push({ start, end, replaceStart, replaceEnd, type: pattern.type });
+      if (m.index === re.lastIndex) re.lastIndex++;
+    }
+  }
+  return out;
+}
+function resolveOverlaps(matches) {
+  const sorted = [...matches].sort((a, b) => {
+    if (a.start !== b.start) return a.start - b.start;
+    return b.end - b.start - (a.end - a.start);
+  });
+  const kept = [];
+  let lastEnd = -1;
+  for (const m of sorted) {
+    if (m.start < lastEnd) continue;
+    kept.push(m);
+    lastEnd = m.end;
+  }
+  return kept;
+}
+function applyMatches(input, matches) {
+  const sorted = [...matches].sort((a, b) => b.replaceStart - a.replaceStart);
+  let out = input;
+  for (const m of sorted) {
+    out = out.slice(0, m.replaceStart) + `[REDACTED:${m.type}]` + out.slice(m.replaceEnd);
+  }
+  return out;
+}
+function redact(input, opts = {}) {
+  if (input.length === 0) return input;
+  const all = collectMatches(input, opts);
+  if (all.length === 0) return input;
+  const kept = resolveOverlaps(all);
+  return applyMatches(input, kept);
+}
+
+// src/core/otlp.ts
+var PLUGIN_VERSION = "0.1.0";
+var CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function ulidToTraceId(ulid) {
+  if (ulid.length !== 26) throw new Error(`ulidToTraceId: expected 26 chars, got ${ulid.length}`);
+  let n = 0n;
+  for (const ch of ulid) {
+    const idx = CROCKFORD.indexOf(ch);
+    if (idx < 0) throw new Error(`ulidToTraceId: invalid Crockford char "${ch}"`);
+    n = n << 5n | BigInt(idx);
+  }
+  n &= (1n << 128n) - 1n;
+  return n.toString(16).padStart(32, "0");
+}
+function newSpanId() {
+  return crypto.randomBytes(8).toString("hex");
+}
+function snakeCase(s) {
+  return s.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase();
+}
+function maybeRedactString(prefix, key, raw) {
+  const truncated = truncate(raw);
+  const skip = /* @__PURE__ */ new Set([`${prefix}.hook`, `${prefix}.agent`, `${prefix}.tool_name`, `${prefix}.session_id`, `${prefix}.transcript_path`, `${prefix}.transcriptPath`, `${prefix}.cwd`]);
+  if (skip.has(key)) return truncated;
+  const context = key === `${prefix}.tool_input` || key === `${prefix}.tool_response` || key === `${prefix}.toolCall` ? "bash" : void 0;
+  return redact(truncated, { context });
+}
+function toOtlpValue(prefix, key, v) {
+  if (v === null || v === void 0) return null;
+  switch (typeof v) {
+    case "string":
+      return { stringValue: maybeRedactString(prefix, key, v) };
+    case "boolean":
+      return { boolValue: v };
+    case "number":
+      return Number.isInteger(v) ? { intValue: v } : { doubleValue: v };
+    case "object":
+      try {
+        return { stringValue: maybeRedactString(prefix, key, JSON.stringify(v)) };
+      } catch {
+        return { stringValue: maybeRedactString(prefix, key, String(v)) };
+      }
+    default:
+      return { stringValue: maybeRedactString(prefix, key, String(v)) };
+  }
+}
+function resourceAttrs(serviceName) {
+  return [
+    { key: "service.name", value: { stringValue: serviceName } },
+    { key: "telemetry.sdk.name", value: { stringValue: "pinta-gemini" } },
+    { key: "telemetry.sdk.language", value: { stringValue: "nodejs" } },
+    { key: "telemetry.sdk.version", value: { stringValue: PLUGIN_VERSION } },
+    { key: "process.pid", value: { intValue: process.pid } },
+    { key: "process.owner", value: { stringValue: os3.userInfo().username } },
+    { key: "host.name", value: { stringValue: os3.hostname() } },
+    { key: "host.arch", value: { stringValue: os3.arch() } }
+  ];
+}
+function buildOtlpPayload(args) {
+  const id = identity(args.agent);
+  const ts = args.now ?? Date.now();
+  const tsNano = (BigInt(ts) * 1000000n).toString();
+  const attrs = [
+    { key: "ingest.type", value: { stringValue: id.ingest } },
+    { key: `${id.prefix}.hook`, value: { stringValue: args.canonical.hook } },
+    { key: `${id.prefix}.agent`, value: { stringValue: args.agent } }
+  ];
+  if (args.product) attrs.push({ key: `${id.prefix}.product`, value: { stringValue: args.product } });
+  for (const [k, v] of Object.entries(args.event)) {
+    const key = `${id.prefix}.${k}`;
+    const value = toOtlpValue(id.prefix, key, v);
+    if (value !== null) attrs.push({ key, value });
+  }
+  const have = new Set(attrs.map((a) => a.key));
+  for (const [field, val] of [
+    ["session_id", args.canonical.session_id],
+    ["cwd", args.canonical.cwd],
+    ["tool_name", args.canonical.tool_name]
+  ]) {
+    const key = `${id.prefix}.${field}`;
+    if (val != null && !have.has(key)) attrs.push({ key, value: { stringValue: maybeRedactString(id.prefix, key, String(val)) } });
+  }
+  if (args.guard) {
+    attrs.push(
+      { key: "pinta.guard.decision", value: { stringValue: args.guard.decision.toLowerCase() } },
+      { key: "pinta.guard.duration_ms", value: { intValue: args.guard.durationMs } }
+    );
+    if (args.guard.reason) attrs.push({ key: "pinta.guard.matched_rule", value: { stringValue: args.guard.reason } });
+    if (args.guard.failOpenReason) attrs.push({ key: "pinta.guard.fail_open_reason", value: { stringValue: args.guard.failOpenReason } });
+  }
+  const span = {
+    traceId: ulidToTraceId(args.traceId),
+    spanId: newSpanId(),
+    name: `${id.ingest}.${snakeCase(args.canonical.hook)}`,
+    kind: 1,
+    startTimeUnixNano: tsNano,
+    endTimeUnixNano: tsNano,
+    attributes: attrs
+  };
+  return {
+    resourceSpans: [{ resource: { attributes: resourceAttrs(id.service) }, scopeSpans: [{ scope: { name: "pinta-gemini", version: PLUGIN_VERSION }, spans: [span] }] }]
+  };
+}
+function mergeBatch(payloads) {
+  const out = [];
+  for (const p of payloads) out.push(...p.resourceSpans);
+  return { resourceSpans: out };
+}
+
+// src/core/transport.ts
+var TIMEOUT_MS2 = 5e3;
+var Transport = class {
+  constructor(config) {
+    this.config = config;
+    this.queue = new RetryQueue(config.pluginData);
+  }
+  queue;
+  async send(payload) {
+    if (!this.config.endpoint) return;
+    const ok = await this.post(payload);
+    if (!ok) this.queue.enqueue(payload);
+  }
+  async flush() {
+    if (!this.config.endpoint) return;
+    if (!this.queue.tryAcquireLock()) return;
+    try {
+      const entries = this.queue.readAll();
+      if (entries.length === 0) return;
+      const ok = await this.post(mergeBatch(entries.map((e) => e.payload)));
+      if (ok) this.queue.rewrite([]);
+    } finally {
+      this.queue.release();
+    }
+  }
+  async post(payload) {
+    const endpoint = this.config.endpoint;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS2);
+    try {
+      const res = await fetch(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...this.config.headers },
+        body: JSON.stringify(payload),
+        signal: ctrl.signal
+      });
+      if (!res.ok) {
+        process.stderr.write(`[pinta-gemini] OTLP POST ${res.status} ${endpoint}
+`);
+        return false;
+      }
+      return true;
+    } catch (err) {
+      process.stderr.write(`[pinta-gemini] OTLP POST failed: ${err.message ?? String(err)}
+`);
+      return false;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// src/core/trace.ts
+import fs3 from "fs";
+import path4 from "path";
+import crypto2 from "crypto";
+var CROCKFORD2 = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function generateUlid() {
+  const now = Date.now();
+  let ts = "";
+  let t = now;
+  for (let i = 0; i < 10; i++) {
+    ts = CROCKFORD2[t & 31] + ts;
+    t = Math.floor(t / 32);
+  }
+  const rand = crypto2.randomBytes(10);
+  let r = "";
+  for (let i = 0; i < 10; i++) r += CROCKFORD2[rand[i] & 31];
+  while (r.length < 16) r += CROCKFORD2[0];
+  return ts + r;
+}
+var TraceManager = class {
+  tracePath;
+  constructor(config) {
+    this.tracePath = config.tracePath;
+  }
+  read() {
+    try {
+      const data = JSON.parse(fs3.readFileSync(this.tracePath, "utf-8"));
+      return data && typeof data === "object" ? data : {};
+    } catch {
+      return {};
+    }
+  }
+  write(map) {
+    try {
+      fs3.mkdirSync(path4.dirname(this.tracePath), { recursive: true });
+      fs3.writeFileSync(this.tracePath, JSON.stringify(map));
+    } catch {
+    }
+  }
+  /** Start a fresh trace for this session (turn boundary). */
+  newTrace(sessionId) {
+    const map = this.read();
+    const traceId = generateUlid();
+    map[sessionId] = traceId;
+    this.write(map);
+    return traceId;
+  }
+  /** Current trace for this session; creates one if absent. */
+  currentTrace(sessionId) {
+    const map = this.read();
+    if (map[sessionId]) return map[sessionId];
+    return this.newTrace(sessionId);
+  }
+};
+
+// src/core/decision.ts
+function formatDecision(agent, event, guard) {
+  if (guard && guard.decision === "DENY") {
+    const reason = guard.userMessage ?? guard.reason ?? "guard_deny";
+    if (isGemini(agent)) return { decision: "deny", reason, systemMessage: guard.userMessage ?? void 0 };
+    return { decision: "deny", reason };
+  }
+  if (!isGemini(agent) && event === "PreToolUse") return { decision: "allow" };
+  return {};
+}
+
+// src/core/invocation-log.ts
+import fs4 from "fs";
+import path5 from "path";
+function logInvocation(config, rec) {
+  if (process.env.PINTA_GEMINI_DEBUG !== "1") return;
+  try {
+    fs4.mkdirSync(config.pluginData, { recursive: true });
+    fs4.appendFileSync(path5.join(config.pluginData, "invocations.jsonl"), JSON.stringify(rec) + "\n");
+  } catch {
+  }
+}
+
+// src/index.ts
+loadEnvFile();
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf-8");
+}
+function isTurnStart(agent, c, ev) {
+  if (isGemini(agent)) return c.hook === "BeforeAgent";
+  return c.hook === "PreInvocation" && ev["invocationNum"] === 1;
+}
+async function main() {
+  const { agent, event } = parseInvocation();
+  let out = {};
+  let ev = {};
+  let c;
+  let guard = null;
+  const config = loadConfig();
+  try {
+    ev = JSON.parse(await readStdin() || "{}");
+    c = normalize(agent, event, ev);
+    if (!isSkippedHook(c.hook)) {
+      const transport = new Transport(config);
+      await transport.flush();
+      const sessionId = c.session_id ?? "unknown";
+      const trace = new TraceManager(config);
+      const traceId = isTurnStart(agent, c, ev) ? trace.newTrace(sessionId) : trace.currentTrace(sessionId);
+      if (c.hook === gateEvent(agent)) {
+        const rawToolInput = typeof c.tool_input === "string" ? c.tool_input : JSON.stringify(c.tool_input ?? null);
+        guard = await evaluateGuard(
+          { spanId: sessionId, toolName: c.tool_name, toolInput: c.tool_input, rawTextFields: { toolInput: rawToolInput } },
+          config.guardEndpoint
+        );
+      }
+      const product = isGemini(agent) ? void 0 : antigravityProduct(ev);
+      await transport.send(buildOtlpPayload({ agent, canonical: c, event: ev, traceId, guard, product }));
+      out = formatDecision(agent, event, guard);
+    }
+  } catch (e) {
+    process.stderr.write(`[pinta-gemini] error: ${e}
+`);
+    out = {};
+  }
+  logInvocation(config, {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    pid: process.pid,
+    agent,
+    event,
+    argv: process.argv.slice(2),
+    received_payload: ev,
+    normalized: c ?? null,
+    guard,
+    decision_returned: out
+  });
+  process.stdout.write(JSON.stringify(out) + "\n");
+  process.exit(0);
+}
+main();