@pinta-ai/pinta-gemini 0.12.0 → 0.13.1

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.13.1
+
+### Fixed
+- Guard `AfterTool` success and error output before telemetry, returning fixed
+  safe denial feedback instead of the original model-facing content (PTA-585).
+- Complete decided denials without waiting for collector network IO while
+  preserving the original redacted evidence in the bounded retry queue.
+- Bundle `@pinta-ai/core` `^0.9.2` to keep ordinary `find -path` and
+  `find -print` arguments out of mysql-family short-password masking (PTA-515).
+- Preserve mysql password masking in Antigravity's native JSON `CommandLine`
+  field; cover both real password values and unchanged `find` arguments.
+
+### Compatibility
+- Catalog distribution of this output-enforcing release is gated to Manager
+  0.1.14 or later; older Managers keep the preceding compatible adapter.
+- Output protection requires the host's synchronous output hook and a
+  Manager/guard that projects that event as output. Component-level native
+  evidence is not a claim of full authenticated CLI acceptance.
+- Existing guard budgets, REVIEW/disabled/fail-open behavior and guard/export
+  ordering remain unchanged. Output denial does not undo an executed tool.
+
+## 0.13.0
+
+### Changed
+- The guard gate waits **100ms** for a verdict (was 50ms) before failing open.
+  50ms sat under the manager's own round trip at the tail (prod p99 58ms), so
+  calls the manager would have decided were allowed by the timeout instead.
+  Applies to both Gemini CLI and Antigravity.
+- `@pinta-ai/core` `^0.9.0`: the guard request now carries
+  `x-pinta-guard-budget-ms: 100`. Pinta Manager 0.1.10+ bounds its package
+  check by this value (80% of it) instead of its built-in table, which still
+  lists pinta-gemini at 50ms — without the header the manager would keep
+  abandoning the package check at 40ms.
+
+### Compatibility
+- Pinta Manager 0.1.11 or later remains the guard-payload compatibility floor.
+  Older managers ignore the new header; nothing else in the request changes.
+
+Refs PTA-579.
+
 ## 0.12.0
 
 ### Added

package/README.md

@@ -23,7 +23,7 @@ src/
     agent.ts          --agent/--event 파싱 + antigravity 제품 서브라벨(transcriptPath)
     normalize.ts      호스트 payload → canonical (snake/camel 흡수)
     config.ts         endpoint/headers/guard/data-dir 해석
-    guard.ts          원격 guard 평가 (50ms, fail-open)       ← pinta-cc 재사용
+    guard.ts          원격 guard 평가 (100ms, fail-open)      ← pinta-cc 재사용
     decision.ts       호스트별 allow/deny 출력
     otlp.ts           멀티호스트 Bronze flatten + ingest.type/prefix/service.name
     transport.ts      OTLP/HTTP POST (5s) + 실패 시 retry-queue
@@ -61,9 +61,35 @@ npx tsx tools/hook-verify.ts teardown   # 원복 (hook 제거, jsonl 보존)
 - 이벤트/agent 식별: install 시 command 에 박는 `--agent`/`--event` 인자가 유일 수단(인자보존 실측 확정).
 - 출력: stdout 에 **항상 단일 JSON**, **항상 exit 0**(fail-open).
 - deny: gemini `{decision,reason,systemMessage}` / antigravity `{decision,reason}`. allow: gemini `{}` / antigravity PreToolUse `{decision:"allow"}`.
-- guard: `PINTA_GUARD_ENDPOINT` POST, 50ms, fail-open. 텔레메트리: `GEMINI_PLUGIN_OPTION_*` > `OTEL_EXPORTER_OTLP_*`.
+- guard: `PINTA_GUARD_ENDPOINT` POST, 100ms, fail-open. 텔레메트리: `GEMINI_PLUGIN_OPTION_*` > `OTEL_EXPORTER_OTLP_*`.
 - 설정 주입: 호스트가 hook 에 env 를 안 주므로 `~/.gemini/pinta-gemini.env`(어댑터가 읽음)로 주입.
 
+### Gemini tool-output enforcement
+
+Gemini `AfterTool` is also a guard point. The original
+`tool_response.{llmContent,returnDisplay,error}` is submitted, including failed
+tool results. A DENY uses `{decision:"deny",reason:"…"}`: Gemini CLI 0.59.0
+replaces the model-facing result with the reason. This does not undo completed
+side effects or promise that the entire turn stops. `additionalContext` alone
+is not enforcement.
+Output-denial feedback is fixed safe text rather than a guard-supplied reason
+or user message. Original guard metadata remains on the audit span.
+
+The original masked span keeps its IDs and gets
+`pinta.guard.target=tool_output`; the manager/runtime must evaluate this native
+phase as output, not repeat pre-execution rules. ALLOW/REVIEW retain the result.
+Antigravity post-tool events remain observations: no unverified output protocol
+is emitted. `AfterModel` remains skipped.
+
+A decided DENY is persisted to the existing disk retry queue without waiting
+for collector ACKs or backlog flushing. The host gets one JSON response and
+exit 0 promptly; a later non-denied hook retries telemetry. Queue persistence
+is not proof of ingestion, and telemetry failures cannot revoke a denial.
+The response is written before metadata/persistence work. Deferred payloads
+retain the transport's `MAX_POST_BYTES` UTF-8 JSON limit; oversized payloads are
+diagnosed and dropped without a network fallback. A guard-only configuration
+without a telemetry endpoint retains no queue entries.
+
 ## Model telemetry
 
 `gemini.model` / `antigravity.model` is a **scalar, host-supplied model ID**,

package/dist/index.js

@@ -1,23 +1,29 @@
 import { createRequire as __pintaCreateRequire } from 'module'; const require = __pintaCreateRequire(import.meta.url);
-var wt=Object.create;var _e=Object.defineProperty;var Mt=Object.getOwnPropertyDescriptor;var Rt=Object.getOwnPropertyNames;var It=Object.getPrototypeOf,xt=Object.prototype.hasOwnProperty;var y=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var h=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Nt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of Rt(t))!xt.call(e,i)&&i!==n&&_e(e,i,{get:()=>t[i],enumerable:!(r=Mt(t,i))||r.enumerable});return e};var P=(e,t,n)=>(n=e!=null?wt(It(e)):{},Nt(t||!e||!e.__esModule?_e(n,"default",{value:e,enumerable:!0}):n,e));var Z=h(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.PATTERNS=f.MAX_BYTES=void 0;f.truncateTo=he;f.truncate=Dt;f.collectMatches=ve;f.resolveOverlaps=Pe;f.applyMatches=Ee;f.redact=jt;f.MAX_BYTES=102400;function he(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Dt(e){return he(e,f.MAX_BYTES)}f.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function ve(e,t){let n=[];for(let r of f.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let i=new RegExp(r.regex.source,r.regex.flags),o;for(;(o=i.exec(e))!==null;){let a=r.captureGroup??0,u=o[a];if(u===void 0){o.index===i.lastIndex&&i.lastIndex++;continue}let c=o.index,p=o.index+o[0].length,A=c+o[0].indexOf(u),H=A+u.length;n.push({start:c,end:p,replaceStart:A,replaceEnd:H,type:r.type}),o.index===i.lastIndex&&i.lastIndex++}}return n}function Pe(e){let t=[...e].sort((i,o)=>i.start!==o.start?i.start-o.start:o.end-o.start-(i.end-i.start)),n=[],r=-1;for(let i of t)i.start<r||(n.push(i),r=i.end);return n}function Ee(e,t){let n=[...t].sort((i,o)=>o.replaceStart-i.replaceStart),r=e;for(let i of n)r=r.slice(0,i.replaceStart)+`[REDACTED:${i.type}]`+r.slice(i.replaceEnd);return r}function jt(e,t={}){if(e.length===0)return e;let n=ve(e,t);if(n.length===0)return e;let r=Pe(n);return Ee(e,r)}});var J=h(d=>{"use strict";var Gt=d&&d.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(d,"__esModule",{value:!0});d.MAX_SPAN_BYTES=void 0;d.ulidToTraceId=Ae;d.newSpanId=be;d.snakeCase=qt;d.toOtlpValue=ke;d.attrsFromRecord=Bt;d.guardAttrs=we;d.clientAttrs=Me;d.enforceSpanBudget=Re;d.buildPayload=Ft;d.attachGuard=Ie;d.mergeBatch=Lt;var $t=Gt(y("crypto")),W=Z(),Vt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ae(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let i=Vt.indexOf(r);if(i<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(i)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function be(){return $t.default.randomBytes(8).toString("hex")}function qt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Se=new Set;function G(e,t,n){let r=(0,W.truncate)(t);if((n.skipRedactKeys??Se).has(e))return r;let i=(n.bashContextKeys??Se).has(e)?"bash":void 0;return(0,W.redact)(r,{context:i})}function ke(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:G(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:G(e,JSON.stringify(t),n)}}catch{return{stringValue:G(e,String(t),n)}}default:return{stringValue:G(e,String(t),n)}}}function Bt(e,t,n={}){let r=[];for(let[i,o]of Object.entries(e)){let a=`${t}.${i}`,u=ke(a,o,n);u!==null&&r.push({key:a,value:u})}return r}function we(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Me(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}d.MAX_SPAN_BYTES=800*1024;function Oe(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Te=1024;function Re(e,t=d.MAX_SPAN_BYTES){let n=Oe(e);for(let r=0;r<100&&n>t;r++){let i=null,o=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let p=Buffer.byteLength(c.value.stringValue,"utf-8");p>o&&(o=p,i=c.value)}if(i===null||o<=Te)break;let a=n-t,u=Math.max(Te,o-a-64);i.stringValue=(0,W.truncateTo)(i.stringValue,u),n=Oe(e)}return e}function Ft(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],i={traceId:Ae(e.traceId),spanId:be(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Re(i);let o={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[i]}]}]};return Ie(o,e.guard,e.clientTiming)}function Ie(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...we(t));let i=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return i&&r.attributes.push(...Me(i)),e}function Lt(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var xe=h(w=>{"use strict";Object.defineProperty(w,"__esModule",{value:!0});w.GUARD_STATUS_REFUSED=void 0;w.evaluateGuard=Xt;var Ct=1e4,Ut="pinta-core";function $(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Yt=new Set(["ALLOW","DENY","REVIEW"]);w.GUARD_STATUS_REFUSED=410;async function Xt(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??Ct,i=Date.now(),o=new AbortController,a=setTimeout(()=>o.abort(),r);try{let u=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??Ut,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{}},body:JSON.stringify(e),signal:o.signal});if(u.status===w.GUARD_STATUS_REFUSED)return $(Date.now()-i,"refused");if(u.status!==200)return $(Date.now()-i,"error");let c=await u.json(),p=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!Yt.has(c.decision)||!p)return $(Date.now()-i,"error");let A=Date.now()-i;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??A,clientRttMs:A}}catch(u){let c=u.name,p=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return $(Date.now()-i,p)}finally{clearTimeout(a)}}});var V=h(x=>{"use strict";var zt=x&&x.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(x,"__esModule",{value:!0});x.atomicWriteFileSync=Ht;var Ne=zt(y("fs"));function Ht(e,t){let n=`${e}.${process.pid}.tmp`;Ne.default.writeFileSync(n,t),Ne.default.renameSync(n,e)}});var te=h(E=>{"use strict";var De=E&&E.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(E,"__esModule",{value:!0});E.MemoryRetryQueue=E.DiskRetryQueue=void 0;var g=De(y("fs")),q=De(y("path")),Kt=V(),B=1e3,Zt=50,Wt=5,Q=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=q.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{g.default.mkdirSync(q.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;g.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
-`)}}readAll(){try{let t=g.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let i=JSON.parse(r);Array.isArray(i?.payload?.resourceSpans)&&n.push(i)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){g.default.existsSync(this.filePath)&&g.default.unlinkSync(this.filePath);return}g.default.mkdirSync(q.default.dirname(this.filePath),{recursive:!0}),(0,Kt.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+var qt=Object.create;var Te=Object.defineProperty;var Bt=Object.getOwnPropertyDescriptor;var Vt=Object.getOwnPropertyNames;var Ut=Object.getPrototypeOf,Lt=Object.prototype.hasOwnProperty;var y=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var v=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Ct=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of Vt(t))!Lt.call(e,i)&&i!==n&&Te(e,i,{get:()=>t[i],enumerable:!(r=Bt(t,i))||r.enumerable});return e};var P=(e,t,n)=>(n=e!=null?qt(Ut(e)):{},Ct(t||!e||!e.__esModule?Te(n,"default",{value:e,enumerable:!0}):n,e));var we=v(te=>{"use strict";Object.defineProperty(te,"__esModule",{value:!0});te.mysqlPasswordRanges=Zt;var Ft=new Set(["mysql","mysqldump","mysqladmin","mysqlcheck","mysqlimport","mysqlshow","mariadb","mariadb-dump","mariadb-admin","mariadb-check","mariadb-import","mariadb-show"]),Yt=new Set(["sh","bash","dash","zsh","ksh"]),Xt=new Set(["-u","--user","-h","--host","-P","--port","-D","--database","-S","--socket","-e","--execute","--protocol","--default-character-set","--defaults-file","--defaults-extra-file","--login-path","--init-command","--ssl-ca","--ssl-capath","--ssl-cert","--ssl-key","--ssl-cipher"]),L=16;function Ae(e,t,n=e.value.length){return{value:e.value.slice(t,n),ranges:e.ranges.slice(t,n)}}function G(e,t,n,r){e.value+=t.value.slice(n,r);for(let i=n;i<r;i++)e.ranges.push(t.ranges[i])}function be(e){if(e?.literal)return e.value.slice(e.value.lastIndexOf("/")+1).replace(/\.exe$/,"")}function Ht(e){let t=0;for(let n=0;n<=L;n++){for(;/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.value??"");)t++;let r=be(e[t]);if(!r)return;if(["!","if","then","elif","else","while","until","do"].includes(r)){t++;continue}let i={env:["-u","--unset","-C","--chdir"],sudo:["-u","--user","-g","--group","-p","--prompt","-D","--chdir","-R","--chroot","-C","--close-from","-T","--command-timeout"],exec:["-a"],nice:["-n","--adjustment"],timeout:["-s","--signal","-k","--kill-after"]},o={env:["-i","--ignore-environment","-0","--null"],sudo:["-n","-E","-H","-S","-b","-k"],command:["-p"],exec:["-c","-l"],nohup:[],nice:[],time:["-p"],timeout:["--foreground","--preserve-status"]};if(!(r in o))return t;for(t++;e[t]?.value.startsWith("-");){let s=e[t++].value;if(s==="--")break;if(!o[r].includes(s)){if((i[r]??[]).includes(s)){if(!e[t++])return;continue}if(!(i[r]??[]).some(a=>a.startsWith("--")?s.startsWith(a+"="):s.startsWith(a)&&s.length>2)&&!(r==="nice"&&/^-\d+$/.test(s)))return}}if(r==="timeout"&&!/^\d+(?:\.\d+)?[smhd]?$/.test(e[t++]?.value??""))return}}function ke(e,t){let n=1,r="";for(let i=t;i<e.length;i++){let o=e[i];if(o==="\\"&&r!=="'"){i++;continue}if(r){o===r&&(r="");continue}if(o==="'"||o==='"')r=o;else if(o==="(")n++;else if(o===")"&&--n===0)return i}return e.length}function zt(e,t,n,r){let i={value:"",ranges:[],start:t,end:t,literal:!0},o="",s=t;for(;s<e.value.length;){let a=e.value[s];if(!o&&/[\s;|&()<>{}]/.test(a))break;if(a===o){o="",s++;continue}if(!o&&(a==="'"||a==='"')){o=a,s++;continue}if(a==="\\"&&o!=="'"){let c=e.value[s+1];if(c===`
+`){s+=2;continue}if(c&&(!o||/[$`"\\]/.test(c))){G(i,e,s+1,s+2),s+=2;continue}}if(o!=="'"&&e.value.startsWith("$(",s)){let c=ke(e.value,s+2);e.value[s+2]!=="("&&r<L&&M(Ae(e,s+2,c),n,r+1),G(i,e,s,Math.min(c+1,e.value.length)),i.literal=!1,s=Math.min(c+1,e.value.length);continue}if(a==="`"&&o!=="'"){let c=s+1;for(;c<e.value.length&&e.value[c]!=="`";)c+=e.value[c]==="\\"?2:1;r<L&&M(Ae(e,s+1,c),n,r+1),G(i,e,s,Math.min(c+1,e.value.length)),i.literal=!1,s=Math.min(c+1,e.value.length);continue}a==="$"&&o!=="'"&&(i.literal=!1),G(i,e,s,s+1),s++}return i.end=s,i}function Wt(e,t,n,r){let i=Ht(t);if(i===void 0)return;let o=be(t[i]);if(Yt.has(o)&&r<L){for(let s=i+1;s<t.length;s++){let a=t[s].value;if(a==="--command"||/^-[a-zA-Z]*c[a-zA-Z]*$/.test(a)){let c=t[s+1];c&&M(c,n,r+1);return}if(!a.startsWith("-")||a==="--")return;(a==="-o"||a==="-O")&&s++}return}if(Ft.has(o))for(let s=i+1;s<t.length;s++){let a=t[s];if(a.value==="--")return;if(Xt.has(a.value)){s++;continue}a.value.startsWith("-p")&&a.value.length>2&&n.push({start:e.ranges[a.start].start,end:e.ranges[a.end-1].end})}}function M(e,t,n=0){let r=[],i,o=[],s=0,a=()=>{Wt(e,r,t,n),r=[],i=void 0};for(;s<e.value.length;){let c=e.value[s];if(c===`
+`){a(),s++;for(let l of o.splice(0))for(;s<e.value.length;){let h=e.value.indexOf(`
+`,s),k=h<0?e.value.length:h,U=e.value.slice(s,k);if(s=h<0?k:k+1,(l.stripTabs?U.replace(/^\t+/,""):U)===l.delimiter)break}}else if(/\s/.test(c))s++;else if(c==="#"){let l=e.value.indexOf(`
+`,s);s=l<0?e.value.length:l}else if(e.value.startsWith("((",s))a(),s=Math.min(ke(e.value,s+1)+1,e.value.length);else if(/[;|&(){}]/.test(c))a(),s++;else if(c==="<"||c===">")r.at(-1)?.end===s&&/^\d+$/.test(r.at(-1).value)&&r.pop(),i=/^(?:<<<|<<-?|>>|<&|>&|[<>])/.exec(e.value.slice(s))?.[0]??c,s+=i.length;else{let l=zt(e,s,t,n);s=l.end,(i==="<<"||i==="<<-")&&o.push({delimiter:l.value,stripTabs:i==="<<-"}),i||r.push(l),i=void 0}}a()}function Kt(e,t,n){let r={value:"",ranges:[]};for(let i=t+1;i<n-1;i++){if(e.value[i]!=="\\"){G(r,e,i,i+1);continue}let o=i+(e.value[i+1]==="u"?6:2),s=JSON.parse(`"${e.value.slice(i,o)}"`);r.value+=s;for(let a=0;a<s.length;a++)r.ranges.push({start:e.ranges[i].start,end:e.ranges[o-1].end});i=o-1}return r}function Zt(e){let t={value:e,ranges:Array.from({length:e.length},(r,i)=>({start:i,end:i+1}))},n=[];if(/^\s*[{[]/.test(e)){let r;try{r=JSON.parse(e)}catch{return M(t,n),n}if(r!==null&&typeof r=="object"){let i=/"(?:[^"\\]|\\.)*"/g,o;for(;o=i.exec(e);){let s=JSON.parse(o[0]);if(s!=="command"&&s!=="cmd"&&s!=="CommandLine")continue;let a=/^\s*:\s*/.exec(e.slice(i.lastIndex));if(!a)continue;let c=i.lastIndex+a[0].length;if(e[c]!=='"')continue;i.lastIndex=c;let l=i.exec(e);l?.index===c&&M(Kt(t,c,c+l[0].length),n)}}return n}return M(t,n),n}});var ne=v(g=>{"use strict";Object.defineProperty(g,"__esModule",{value:!0});g.PATTERNS=g.MAX_BYTES=void 0;g.truncateTo=Re;g.truncate=Qt;g.collectMatches=Me;g.resolveOverlaps=Ie;g.applyMatches=De;g.redact=en;var Jt=we();g.MAX_BYTES=102400;function Re(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Qt(e){return Re(e,g.MAX_BYTES)}g.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function Me(e,t){let n=[];for(let r of g.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;if(r.type==="cli_password_short"){for(let{start:s,end:a}of(0,Jt.mysqlPasswordRanges)(e))n.push({start:s,end:a,replaceStart:s,replaceEnd:a,type:r.type,replacement:`-p[REDACTED:${r.type}]`});continue}let i=new RegExp(r.regex.source,r.regex.flags),o;for(;(o=i.exec(e))!==null;){let s=r.captureGroup??0,a=o[s];if(a===void 0){o.index===i.lastIndex&&i.lastIndex++;continue}let c=o.index,l=o.index+o[0].length,h=c+o[0].indexOf(a),k=h+a.length;n.push({start:c,end:l,replaceStart:h,replaceEnd:k,type:r.type}),o.index===i.lastIndex&&i.lastIndex++}}return n}function Ie(e){let t=[...e].sort((i,o)=>i.start!==o.start?i.start-o.start:o.end-o.start-(i.end-i.start)),n=[],r=-1;for(let i of t)i.start<r||(n.push(i),r=i.end);return n}function De(e,t){let n=[...t].sort((i,o)=>o.replaceStart-i.replaceStart),r=e;for(let i of n)r=r.slice(0,i.replaceStart)+(i.replacement??`[REDACTED:${i.type}]`)+r.slice(i.replaceEnd);return r}function en(e,t={}){if(e.length===0)return e;let n=Me(e,t);if(n.length===0)return e;let r=Ie(n);return De(e,r)}});var ie=v(f=>{"use strict";var tn=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=Ge;f.newSpanId=$e;f.snakeCase=sn;f.toOtlpValue=qe;f.attrsFromRecord=on;f.guardAttrs=Be;f.clientAttrs=Ve;f.enforceSpanBudget=Ue;f.buildPayload=an;f.attachGuard=Le;f.mergeBatch=un;var nn=tn(y("crypto")),re=ne(),rn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ge(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let i=rn.indexOf(r);if(i<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(i)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function $e(){return nn.default.randomBytes(8).toString("hex")}function sn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Ne=new Set;function C(e,t,n){let r=(0,re.truncate)(t);if((n.skipRedactKeys??Ne).has(e))return r;let i=(n.bashContextKeys??Ne).has(e)?"bash":void 0;return(0,re.redact)(r,{context:i})}function qe(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:C(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:C(e,JSON.stringify(t),n)}}catch{return{stringValue:C(e,String(t),n)}}default:return{stringValue:C(e,String(t),n)}}}function on(e,t,n={}){let r=[];for(let[i,o]of Object.entries(e)){let s=`${t}.${i}`,a=qe(s,o,n);a!==null&&r.push({key:s,value:a})}return r}function Be(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ve(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function je(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var xe=1024;function Ue(e,t=f.MAX_SPAN_BYTES){let n=je(e);for(let r=0;r<100&&n>t;r++){let i=null,o=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>o&&(o=l,i=c.value)}if(i===null||o<=xe)break;let s=n-t,a=Math.max(xe,o-s-64);i.stringValue=(0,re.truncateTo)(i.stringValue,a),n=je(e)}return e}function an(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],i={traceId:Ge(e.traceId),spanId:$e(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ue(i);let o={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[i]}]}]};return Le(o,e.guard,e.clientTiming)}function Le(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...Be(t));let i=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return i&&r.attributes.push(...Ve(i)),e}function un(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Ce=v(E=>{"use strict";Object.defineProperty(E,"__esModule",{value:!0});E.GUARD_STATUS_REFUSED=E.GUARD_BUDGET_HEADER=void 0;E.evaluateGuard=fn;var cn=1e4,ln="pinta-core";E.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function F(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var dn=new Set(["ALLOW","DENY","REVIEW"]);E.GUARD_STATUS_REFUSED=410;async function fn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??cn,i=Date.now(),o=new AbortController,s=setTimeout(()=>o.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??ln,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[E.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:o.signal});if(a.status===E.GUARD_STATUS_REFUSED)return F(Date.now()-i,"refused");if(a.status!==200)return F(Date.now()-i,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!dn.has(c.decision)||!l)return F(Date.now()-i,"error");let h=Date.now()-i;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??h,clientRttMs:h}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return F(Date.now()-i,l)}finally{clearTimeout(s)}}});var Y=v($=>{"use strict";var pn=$&&$.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty($,"__esModule",{value:!0});$.atomicWriteFileSync=gn;var Fe=pn(y("fs"));function gn(e,t){let n=`${e}.${process.pid}.tmp`;Fe.default.writeFileSync(n,t),Fe.default.renameSync(n,e)}});var ae=v(O=>{"use strict";var Ye=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.MemoryRetryQueue=O.DiskRetryQueue=void 0;var m=Ye(y("fs")),X=Ye(y("path")),mn=Y(),H=1e3,hn=50,yn=5,se=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=X.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{m.default.mkdirSync(X.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;m.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=m.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let i=JSON.parse(r);Array.isArray(i?.payload?.resourceSpans)&&n.push(i)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){m.default.existsSync(this.filePath)&&m.default.unlinkSync(this.filePath);return}m.default.mkdirSync(X.default.dirname(this.filePath),{recursive:!0}),(0,mn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{g.default.mkdirSync(q.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<Zt;)try{let n=g.default.openSync(this.lockPath,"wx");return g.default.writeSync(n,String(process.pid)),g.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let o=g.default.statSync(this.lockPath);if(Date.now()-o.mtimeMs>3e4){g.default.unlinkSync(this.lockPath);continue}}catch{}let r=Wt,i=Date.now()+r;for(;Date.now()<i;);}return!1}release(){try{g.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=B)return;let n=t.length-B;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};E.DiskRetryQueue=Q;var ee=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>B&&this.entries.splice(0,this.entries.length-B)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};E.MemoryRetryQueue=ee});var Be=h(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Ve;l.envOptionsResolver=qe;l.postOtlp=N;var je=te(),Ge=J(),Jt=5e3;l.MAX_POST_BYTES=900*1024;function F(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function $e(e,t,n){let r=[],i=[],o=[],a=0;for(let u of e){let c=t(u);if(c>n){i.push(u);continue}o.length>0&&a+c>n&&(r.push(o),o=[],a=0),o.push(u),a+=c}return o.length>0&&r.push(o),{chunks:r,oversize:i}}function Ve(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...i]=n.split("=");r&&i.length>0&&(t[r.trim()]=i.join("=").trim())}return t}function qe(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Ve(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function N(e,t,n){let r=new AbortController,i=setTimeout(()=>r.abort(),Jt);try{let o=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!o.ok){let a="";try{a=(await o.text()).slice(0,200)}catch{}let u=o.status===401||o.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":o.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":o.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${o.status} ${t.endpoint}${u}${a?` body=${a}`:""}
+`)}}tryAcquireLock(){let t=Date.now();try{m.default.mkdirSync(X.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<hn;)try{let n=m.default.openSync(this.lockPath,"wx");return m.default.writeSync(n,String(process.pid)),m.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let o=m.default.statSync(this.lockPath);if(Date.now()-o.mtimeMs>3e4){m.default.unlinkSync(this.lockPath);continue}}catch{}let r=yn,i=Date.now()+r;for(;Date.now()<i;);}return!1}release(){try{m.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=H)return;let n=t.length-H;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};O.DiskRetryQueue=se;var oe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>H&&this.entries.splice(0,this.entries.length-H)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};O.MemoryRetryQueue=oe});var Ze=v(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.MemoryTransport=d.DiskTransport=d.MAX_POST_BYTES=void 0;d.parseHeadersEnv=We;d.envOptionsResolver=Ke;d.postOtlp=q;var Xe=ae(),He=ie(),_n=5e3;d.MAX_POST_BYTES=900*1024;function z(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function ze(e,t,n){let r=[],i=[],o=[],s=0;for(let a of e){let c=t(a);if(c>n){i.push(a);continue}o.length>0&&s+c>n&&(r.push(o),o=[],s=0),o.push(a),s+=c}return o.length>0&&r.push(o),{chunks:r,oversize:i}}function We(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...i]=n.split("=");r&&i.length>0&&(t[r.trim()]=i.join("=").trim())}return t}function Ke(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:We(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function q(e,t,n){let r=new AbortController,i=setTimeout(()=>r.abort(),_n);try{let o=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!o.ok){let s="";try{s=(await o.text()).slice(0,200)}catch{}let a=o.status===401||o.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":o.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":o.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${o.status} ${t.endpoint}${a}${s?` body=${s}`:""}
 `),!1}return!0}catch(o){return process.stderr.write(`[${n}] OTLP POST failed: ${o.message??String(o)}
-`),!1}finally{clearTimeout(i)}}var ne=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new je.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??qe}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await N(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:i}=$e(n,u=>F(u.payload),l.MAX_POST_BYTES);i.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${i.length} oversized retry ${i.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let o=[].concat(...r),a=0;for(let u of r){if(!await N((0,Ge.mergeBatch)(u.map(p=>p.payload)),t,this.logPrefix))break;a+=u.length}this.queue.rewrite(o.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=F(t);return n<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=ne;var re=class{queue=new je.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(F(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await N(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:i}=$e(n,F,l.MAX_POST_BYTES);i.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${i.length} oversized buffered ${i.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let o=[].concat(...r),a=0;for(let u of r){if(!await N((0,Ge.mergeBatch)(u),t,this.logPrefix))break;a+=u.length}for(let u of o.slice(a))this.queue.enqueue(u)}};l.MemoryTransport=re});var ae=h(b=>{"use strict";var se=b&&b.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(b,"__esModule",{value:!0});b.TraceManager=void 0;b.generateUlid=Le;var Fe=se(y("fs")),Qt=se(y("path")),en=se(y("crypto")),tn=V(),ie="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Le(){let e=Date.now(),t="",n=e;for(let o=0;o<10;o++)t=ie[n&31]+t,n=Math.floor(n/32);let r=en.default.randomBytes(10),i="";for(let o=0;o<10;o++)i+=ie[r[o]&31];for(;i.length<16;)i+=ie[0];return t+i}var oe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=Le();return this.save(t),t}currentTrace(){try{let t=Fe.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{Fe.default.mkdirSync(Qt.default.dirname(this.tracePath),{recursive:!0}),(0,tn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};b.TraceManager=oe});var ze=h(S=>{"use strict";var Ue=S&&S.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(S,"__esModule",{value:!0});S.MemorySessionTraceManager=S.DiskSessionTraceManager=void 0;var Ce=Ue(y("fs")),nn=Ue(y("path")),Ye=ae(),rn=V(),Xe=200,ue=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??Xe}read(){try{let t=JSON.parse(Ce.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Ce.default.mkdirSync(nn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,rn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,Ye.generateUlid)(),i=this.read();return i[n]=r,this.write(i),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};S.DiskSessionTraceManager=ue;var ce=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Xe}newTrace(t){let n=t||"default",r=(0,Ye.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let i=this.map.keys().next().value;i!==void 0&&this.map.delete(i)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};S.MemorySessionTraceManager=ce});var Ze=h(k=>{"use strict";var le=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.envFilePath=an;k.parseEnvFile=Ke;k.loadEnvFile=un;var on=le(y("node:fs")),sn=le(y("node:os")),He=le(y("node:path"));function an(e,t,n){let r=n?process.env[n]:void 0,i=r&&r.length>0?r:He.default.join(sn.default.homedir(),e);return He.default.join(i,t)}function Ke(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let i=r.indexOf("=");if(i<0)continue;let o=r.slice(0,i).trim(),a=r.slice(i+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),o&&(t[o]=a)}return t}function un(e){let t;try{t=on.default.readFileSync(e,"utf-8")}catch{return}let n=Ke(t);for(let[r,i]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=i)}});var v=h(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var O=Z();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return O.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return O.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return O.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return O.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return O.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return O.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return O.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return O.MAX_BYTES}});var _=J();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var We=xe();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return We.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return We.GUARD_STATUS_REFUSED}});var Je=te();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return Je.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return Je.MemoryRetryQueue}});var M=Be();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return M.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return M.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return M.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return M.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return M.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return M.MAX_POST_BYTES}});var Qe=ae();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return Qe.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return Qe.generateUlid}});var et=ze();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return et.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return et.MemorySessionTraceManager}});var de=Ze();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return de.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return de.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return de.loadEnvFile}})});var D=P(v(),1);function cn(){return(0,D.envFilePath)(".gemini","pinta-gemini.env","GEMINI_HOME")}function tt(e=cn()){(0,D.loadEnvFile)(e)}var nt=P(v(),1);import ln from"os";import fe from"path";function dn(){return process.env.GEMINI_HOME||fe.join(ln.homedir(),".gemini")}function fn(){let e=process.env.GEMINI_PLUGIN_OPTION_ENDPOINT||process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(e)return e.replace(/\/+$/,"");let t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(t)return t.replace(/\/+$/,"")+"/v1/traces"}function pn(){let e=(0,nt.parseHeadersEnv)(process.env.GEMINI_PLUGIN_OPTION_HEADERS||process.env.OTEL_EXPORTER_OTLP_HEADERS),t=process.env.GEMINI_PLUGIN_OPTION_API_KEY;return t&&!e["x-pinta-relay-token"]&&(e["x-pinta-relay-token"]=t),e}function rt(){let e=process.env.GEMINI_PLUGIN_DATA||fe.join(dn(),"pinta-gemini-data");return!process.env.PINTA_RELAY_TOKEN&&process.env.GEMINI_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.GEMINI_PLUGIN_OPTION_API_KEY),{pluginData:e,tracePath:fe.join(e,"trace.json"),endpoint:fn(),headers:pn(),guardEndpoint:process.env.PINTA_GUARD_ENDPOINT}}function it(e=process.argv){let t=n=>{let r=e.indexOf(n);return r>=0?e[r+1]:void 0};return{agent:t("--agent")||"gemini",event:t("--event")}}function ot(e){let t=e.transcriptPath;if(typeof t=="string"){if(t.includes("/antigravity-cli/brain/"))return"agy";if(t.includes("/antigravity/brain/"))return"antigravity2"}}var m=e=>e==="gemini",gn={identity:{prefix:"gemini",ingest:"gemini",service:"gemini-cli"},gateEvent:"BeforeTool"},mn={identity:{prefix:"antigravity",ingest:"antigravity",service:"antigravity-cli"},gateEvent:"PreToolUse"},st=e=>m(e)?gn:mn;function L(e){return st(e).identity}function at(e){return st(e).gateEvent}var yn=new Set(["AfterModel"]),ut=e=>yn.has(e);function ct(e,t,n){if(m(e))return{hook:t||n.hook_event_name||"unknown",session_id:j(n.session_id),cwd:j(n.cwd),tool_name:j(n.tool_name),tool_input:n.tool_input};let r=n.workspacePaths,i=n.toolCall;return{hook:t||"unknown",session_id:j(n.conversationId),cwd:Array.isArray(r)?j(r[0]):void 0,tool_name:i?.name,tool_input:i?.args}}function j(e){return typeof e=="string"?e:void 0}var bt=P(v(),1);var lt=P(v(),1);var C="0.12.0";var _n=50,hn=`pinta-gemini/${C}`;function dt(e,t,n,r){return(0,lt.evaluateGuard)(e,t,{timeoutMs:_n,token:n??process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:hn,agentType:r?L(r).ingest:void 0})}var ft=P(v(),1),U=class extends ft.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-gemini",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var pt=P(v(),1),Y=class extends pt.DiskSessionTraceManager{constructor(t){super(t.tracePath)}};import me from"os";import{execFileSync as mt}from"node:child_process";import X from"node:fs";import R from"node:path";var vn=new Set(["","unknown","undefined","null","n/a","none","-"]);function ge(e){let t=typeof e=="string"?e.trim():void 0;return t&&!vn.has(t.toLowerCase())?t:void 0}var Pn=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function yt(e){let t=ge(e);return t&&Pn.test(t)?t:void 0}var En=["cli_version","cliVersion","gemini_version","geminiVersion","agent_version","agentVersion","app_version","appVersion","version"],Sn="PINTA_GEMINI_HOST_VERSION",gt="PINTA_GEMINI_VERSION_PROBE",On=2e3,Tn=/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;function _t(e){return m(e)?["gemini"]:["agy","antigravity","antigravity-cli"]}function An(e){let t=e;for(let n=0;n<5;n++){try{let i=X.readFileSync(R.join(t,"package.json"),"utf8"),o=yt(JSON.parse(i).version);if(o)return o}catch{}let r=R.dirname(t);if(r===t)break;t=r}}function bn(e){if(process.env[gt]==="1")return;let t;try{t=mt(e,["--version"],{encoding:"utf8",timeout:On,stdio:["ignore","pipe","ignore"],env:{...process.env,[gt]:"1"}})}catch{return}let n=t.split(/\r?\n/,5).map(r=>r.trim()).filter(Boolean);for(let r of n){let i=yt(r);if(i)return i}for(let r of n){let i=Tn.exec(r);if(i)return i[1]}}function ht(e){let t=e;try{t=X.realpathSync(e)}catch{}return An(R.dirname(t))??bn(e)}function kn(e){if(process.platform==="win32")return;let t=process.ppid;if(!t||t<=1)return;let n;try{n=mt("ps",["-o","command=","-p",String(t)],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{return}if(!n)return;let r=_t(e);for(let i of n.split(/\s+/)){if(!i.startsWith("/"))continue;let o=R.basename(i).replace(/\.(js|mjs|cjs)$/,"");if(!r.includes(o))continue;let a=ht(i);if(a)return a}}function wn(e){let t=(process.env.PATH??"").split(R.delimiter).filter(Boolean);if(t.length===0)return;let n=process.platform==="win32"?[".cmd",".exe",""]:[""];for(let r of _t(e))for(let i of t)for(let o of n){let a=R.join(i,r+o);try{X.accessSync(a,X.constants.X_OK)}catch{continue}let u=ht(a);if(u)return u}}var pe;function Mn(e){return ge(process.env[Sn])??kn(e)??wn(e)??null}function vt(e,t){if(t)for(let n of En){let r=ge(t[n]);if(r)return r}return pe===void 0&&(pe=Mn(e)),pe??void 0}var Rn=new Set(["unknown","undefined","null","n/a","none","-","auto","default"]);function In(e){if(typeof e!="string")return;let t=e.trim();if(!(!t||t.startsWith("{")||t.startsWith("[")||Rn.has(t.toLowerCase())))return t}function Pt(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function I(e,t){let n=In(e);return n?{model:n,source:t}:void 0}function xn(e,t,n){if(m(e)){if(t==="AfterModel"){let r=Pt(n.llm_response),i=I(r?.modelVersion,"response:llm_response.modelVersion")??I(r?.model,"response:llm_response.model");if(i)return i}if(t==="BeforeModel"||t==="BeforeToolSelection"||t==="AfterModel"){let r=I(Pt(n.llm_request)?.model,"requested:llm_request.model");if(r)return r}return I(n.model,"reported:model")}return I(n.model,"reported:model")??I(n.modelId,"reported:modelId")}function Et(e,t,n){let r=xn(e,t,n),{model:i,model_source:o,...a}=n;return"model"in n&&i!==r?.model&&(a.model_raw=i),"model_source"in n&&(a.model_source_raw=o),r&&(a.model=r.model,a.model_source=r.source),a}var T=P(v(),1),Gn=P(v(),1),z;function Nn(){if(z===void 0)try{z=me.userInfo().username}catch{z=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return z}var St=C;function Dn(e){return{skipRedactKeys:new Set([`${e}.hook`,`${e}.agent`,`${e}.tool_name`,`${e}.session_id`,`${e}.transcript_path`,`${e}.transcriptPath`,`${e}.cwd`]),bashContextKeys:new Set([`${e}.tool_input`,`${e}.tool_response`,`${e}.toolCall`])}}function jn(e,t){return[{key:"service.name",value:{stringValue:e}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-gemini"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:St}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Nn()}},{key:"host.name",value:{stringValue:me.hostname()}},{key:"host.arch",value:{stringValue:me.arch()}}]}function Ot(e){let t=L(e.agent),n=Dn(t.prefix),r=[{key:"ingest.type",value:{stringValue:t.ingest}},{key:`${t.prefix}.hook`,value:{stringValue:e.canonical.hook}},{key:`${t.prefix}.agent`,value:{stringValue:e.agent}}];e.product&&r.push({key:`${t.prefix}.product`,value:{stringValue:e.product}}),r.push(...(0,T.attrsFromRecord)(Et(e.agent,e.canonical.hook,e.event),t.prefix,n));let i=new Set(r.map(o=>o.key));for(let[o,a]of[["session_id",e.canonical.session_id],["cwd",e.canonical.cwd],["tool_name",e.canonical.tool_name]]){let u=`${t.prefix}.${o}`;if(a!=null&&!i.has(u)){let c=(0,T.toOtlpValue)(u,String(a),n);c!==null&&r.push({key:u,value:c})}}return(0,T.buildPayload)({traceId:e.traceId,spanName:`${t.ingest}.${(0,T.snakeCase)(e.canonical.hook)}`,attributes:r,resource:jn(t.service,vt(e.agent,e.event)),scope:{name:"pinta-gemini",version:St},now:e.now})}function ye(e,t,n){if(n&&n.decision==="DENY"){let r=n.userMessage??n.reason??"guard_deny";return m(e)?{decision:"deny",reason:r,systemMessage:n.userMessage??void 0}:{decision:"deny",reason:r}}return!m(e)&&t==="PreToolUse"?{decision:"allow"}:{}}import Tt from"fs";import $n from"path";function At(e,t){if(process.env.PINTA_GEMINI_DEBUG==="1")try{Tt.mkdirSync(e.pluginData,{recursive:!0}),Tt.appendFileSync($n.join(e.pluginData,"invocations.jsonl"),JSON.stringify(t)+`
-`)}catch{}}async function Vn(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}function qn(e,t,n){return m(e)?t.hook==="BeforeAgent":t.hook==="PreInvocation"&&n.invocationNum===1}async function kt(){let{agent:e,event:t}=it(),n={},r={},i,o=null,a=rt();try{if(r=JSON.parse(await Vn()||"{}"),i=ct(e,t,r),!ut(i.hook)){let u=new U(a);await u.flush();let c=i.session_id??"unknown",p=new Y(a),A=qn(e,i,r)?p.newTrace(c):p.currentTrace(c),H=m(e)?void 0:ot(r),K=Ot({agent:e,canonical:i,event:r,traceId:A,product:H});i.hook===at(e)&&(o=await dt(K,a.guardEndpoint,a.headers["x-pinta-relay-token"],e)),n=ye(e,t,o),(0,bt.attachGuard)(K,o),await u.send(K)}}catch(u){process.stderr.write(`[pinta-gemini] error: ${u}
-`),n=o?ye(e,t,o):{}}At(a,{ts:new Date().toISOString(),pid:process.pid,agent:e,event:t,argv:process.argv.slice(2),received_payload:r,normalized:i??null,guard:o,decision_returned:n}),process.stdout.write(JSON.stringify(n)+`
-`),process.exit(0)}tt();kt();
+`),!1}finally{clearTimeout(i)}}var ue=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Xe.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ke}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await q(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:i}=ze(n,a=>z(a.payload),d.MAX_POST_BYTES);i.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${i.length} oversized retry ${i.length===1?"entry":"entries"} (each > ${d.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let o=[].concat(...r),s=0;for(let a of r){if(!await q((0,He.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;s+=a.length}this.queue.rewrite(o.slice(s))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=z(t);return n<=d.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};d.DiskTransport=ue;var ce=class{queue=new Xe.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(z(t)>d.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await q(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:i}=ze(n,z,d.MAX_POST_BYTES);i.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${i.length} oversized buffered ${i.length===1?"payload":"payloads"} (each > ${d.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let o=[].concat(...r),s=0;for(let a of r){if(!await q((0,He.mergeBatch)(a),t,this.logPrefix))break;s+=a.length}for(let a of o.slice(s))this.queue.enqueue(a)}};d.MemoryTransport=ce});var pe=v(w=>{"use strict";var fe=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.TraceManager=void 0;w.generateUlid=Qe;var Je=fe(y("fs")),vn=fe(y("path")),En=fe(y("crypto")),Sn=Y(),le="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Qe(){let e=Date.now(),t="",n=e;for(let o=0;o<10;o++)t=le[n&31]+t,n=Math.floor(n/32);let r=En.default.randomBytes(10),i="";for(let o=0;o<10;o++)i+=le[r[o]&31];for(;i.length<16;)i+=le[0];return t+i}var de=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=Qe();return this.save(t),t}currentTrace(){try{let t=Je.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{Je.default.mkdirSync(vn.default.dirname(this.tracePath),{recursive:!0}),(0,Sn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};w.TraceManager=de});var it=v(T=>{"use strict";var tt=T&&T.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(T,"__esModule",{value:!0});T.MemorySessionTraceManager=T.DiskSessionTraceManager=void 0;var et=tt(y("fs")),Pn=tt(y("path")),nt=pe(),On=Y(),rt=200,ge=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??rt}read(){try{let t=JSON.parse(et.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{et.default.mkdirSync(Pn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,On.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,nt.generateUlid)(),i=this.read();return i[n]=r,this.write(i),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};T.DiskSessionTraceManager=ge;var me=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??rt}newTrace(t){let n=t||"default",r=(0,nt.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let i=this.map.keys().next().value;i!==void 0&&this.map.delete(i)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};T.MemorySessionTraceManager=me});var at=v(R=>{"use strict";var he=R&&R.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(R,"__esModule",{value:!0});R.envFilePath=bn;R.parseEnvFile=ot;R.loadEnvFile=kn;var Tn=he(y("node:fs")),An=he(y("node:os")),st=he(y("node:path"));function bn(e,t,n){let r=n?process.env[n]:void 0,i=r&&r.length>0?r:st.default.join(An.default.homedir(),e);return st.default.join(i,t)}function ot(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let i=r.indexOf("=");if(i<0)continue;let o=r.slice(0,i).trim(),s=r.slice(i+1).trim();(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))&&(s=s.slice(1,-1)),o&&(t[o]=s)}return t}function kn(e){let t;try{t=Tn.default.readFileSync(e,"utf-8")}catch{return}let n=ot(t);for(let[r,i]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=i)}});var S=v(u=>{"use strict";Object.defineProperty(u,"__esModule",{value:!0});u.loadEnvFile=u.parseEnvFile=u.envFilePath=u.MemorySessionTraceManager=u.DiskSessionTraceManager=u.generateUlid=u.TraceManager=u.MAX_POST_BYTES=u.parseHeadersEnv=u.envOptionsResolver=u.postOtlp=u.MemoryTransport=u.DiskTransport=u.MemoryRetryQueue=u.DiskRetryQueue=u.GUARD_BUDGET_HEADER=u.GUARD_STATUS_REFUSED=u.evaluateGuard=u.MAX_SPAN_BYTES=u.enforceSpanBudget=u.mergeBatch=u.attachGuard=u.buildPayload=u.clientAttrs=u.guardAttrs=u.attrsFromRecord=u.toOtlpValue=u.snakeCase=u.newSpanId=u.ulidToTraceId=u.MAX_BYTES=u.PATTERNS=u.applyMatches=u.resolveOverlaps=u.collectMatches=u.truncateTo=u.truncate=u.redact=void 0;var A=ne();Object.defineProperty(u,"redact",{enumerable:!0,get:function(){return A.redact}});Object.defineProperty(u,"truncate",{enumerable:!0,get:function(){return A.truncate}});Object.defineProperty(u,"truncateTo",{enumerable:!0,get:function(){return A.truncateTo}});Object.defineProperty(u,"collectMatches",{enumerable:!0,get:function(){return A.collectMatches}});Object.defineProperty(u,"resolveOverlaps",{enumerable:!0,get:function(){return A.resolveOverlaps}});Object.defineProperty(u,"applyMatches",{enumerable:!0,get:function(){return A.applyMatches}});Object.defineProperty(u,"PATTERNS",{enumerable:!0,get:function(){return A.PATTERNS}});Object.defineProperty(u,"MAX_BYTES",{enumerable:!0,get:function(){return A.MAX_BYTES}});var _=ie();Object.defineProperty(u,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(u,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(u,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(u,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(u,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(u,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(u,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(u,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(u,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(u,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(u,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(u,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var ye=Ce();Object.defineProperty(u,"evaluateGuard",{enumerable:!0,get:function(){return ye.evaluateGuard}});Object.defineProperty(u,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ye.GUARD_STATUS_REFUSED}});Object.defineProperty(u,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return ye.GUARD_BUDGET_HEADER}});var ut=ae();Object.defineProperty(u,"DiskRetryQueue",{enumerable:!0,get:function(){return ut.DiskRetryQueue}});Object.defineProperty(u,"MemoryRetryQueue",{enumerable:!0,get:function(){return ut.MemoryRetryQueue}});var I=Ze();Object.defineProperty(u,"DiskTransport",{enumerable:!0,get:function(){return I.DiskTransport}});Object.defineProperty(u,"MemoryTransport",{enumerable:!0,get:function(){return I.MemoryTransport}});Object.defineProperty(u,"postOtlp",{enumerable:!0,get:function(){return I.postOtlp}});Object.defineProperty(u,"envOptionsResolver",{enumerable:!0,get:function(){return I.envOptionsResolver}});Object.defineProperty(u,"parseHeadersEnv",{enumerable:!0,get:function(){return I.parseHeadersEnv}});Object.defineProperty(u,"MAX_POST_BYTES",{enumerable:!0,get:function(){return I.MAX_POST_BYTES}});var ct=pe();Object.defineProperty(u,"TraceManager",{enumerable:!0,get:function(){return ct.TraceManager}});Object.defineProperty(u,"generateUlid",{enumerable:!0,get:function(){return ct.generateUlid}});var lt=it();Object.defineProperty(u,"DiskSessionTraceManager",{enumerable:!0,get:function(){return lt.DiskSessionTraceManager}});Object.defineProperty(u,"MemorySessionTraceManager",{enumerable:!0,get:function(){return lt.MemorySessionTraceManager}});var _e=at();Object.defineProperty(u,"envFilePath",{enumerable:!0,get:function(){return _e.envFilePath}});Object.defineProperty(u,"parseEnvFile",{enumerable:!0,get:function(){return _e.parseEnvFile}});Object.defineProperty(u,"loadEnvFile",{enumerable:!0,get:function(){return _e.loadEnvFile}})});var B=P(S(),1);function wn(){return(0,B.envFilePath)(".gemini","pinta-gemini.env","GEMINI_HOME")}function dt(e=wn()){(0,B.loadEnvFile)(e)}var ft=P(S(),1);import Rn from"os";import ve from"path";function Mn(){return process.env.GEMINI_HOME||ve.join(Rn.homedir(),".gemini")}function In(){let e=process.env.GEMINI_PLUGIN_OPTION_ENDPOINT||process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(e)return e.replace(/\/+$/,"");let t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(t)return t.replace(/\/+$/,"")+"/v1/traces"}function Dn(){let e=(0,ft.parseHeadersEnv)(process.env.GEMINI_PLUGIN_OPTION_HEADERS||process.env.OTEL_EXPORTER_OTLP_HEADERS),t=process.env.GEMINI_PLUGIN_OPTION_API_KEY;return t&&!e["x-pinta-relay-token"]&&(e["x-pinta-relay-token"]=t),e}function pt(){let e=process.env.GEMINI_PLUGIN_DATA||ve.join(Mn(),"pinta-gemini-data");return!process.env.PINTA_RELAY_TOKEN&&process.env.GEMINI_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.GEMINI_PLUGIN_OPTION_API_KEY),{pluginData:e,tracePath:ve.join(e,"trace.json"),endpoint:In(),headers:Dn(),guardEndpoint:process.env.PINTA_GUARD_ENDPOINT}}function gt(e=process.argv){let t=n=>{let r=e.indexOf(n);return r>=0?e[r+1]:void 0};return{agent:t("--agent")||"gemini",event:t("--event")}}function mt(e){let t=e.transcriptPath;if(typeof t=="string"){if(t.includes("/antigravity-cli/brain/"))return"agy";if(t.includes("/antigravity/brain/"))return"antigravity2"}}var p=e=>e==="gemini",Nn={identity:{prefix:"gemini",ingest:"gemini",service:"gemini-cli"},gateEvent:"BeforeTool"},jn={identity:{prefix:"antigravity",ingest:"antigravity",service:"antigravity-cli"},gateEvent:"PreToolUse"},ht=e=>p(e)?Nn:jn;function W(e){return ht(e).identity}function xn(e){return ht(e).gateEvent}function yt(e,t){return t===xn(e)||p(e)&&t==="AfterTool"}var Gn=new Set(["AfterModel"]),_t=e=>Gn.has(e);function vt(e,t,n){if(p(e))return{hook:t||n.hook_event_name||"unknown",session_id:V(n.session_id),cwd:V(n.cwd),tool_name:V(n.tool_name),tool_input:n.tool_input};let r=n.workspacePaths,i=n.toolCall;return{hook:t||"unknown",session_id:V(n.conversationId),cwd:Array.isArray(r)?V(r[0]):void 0,tool_name:i?.name,tool_input:i?.args}}function V(e){return typeof e=="string"?e:void 0}var Gt=P(S(),1);var Et=P(S(),1);var K="0.13.1";var $n=100,qn=`pinta-gemini/${K}`;function St(e,t,n,r){return(0,Et.evaluateGuard)(e,t,{timeoutMs:$n,token:n??process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:qn,agentType:r?W(r).ingest:void 0})}var D=P(S(),1),Z=class extends D.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-gemini",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};function Pt(e,t){if(t.endpoint){if(Buffer.byteLength(JSON.stringify(e),"utf8")>D.MAX_POST_BYTES){process.stderr.write(`[pinta-gemini] deferred telemetry exceeds MAX_POST_BYTES; dropped
+`);return}new D.DiskRetryQueue(t.pluginData,"pinta-gemini").enqueue(e)}}var Ot=P(S(),1),J=class extends Ot.DiskSessionTraceManager{constructor(t){super(t.tracePath)}};import Pe from"os";import{execFileSync as At}from"node:child_process";import Q from"node:fs";import N from"node:path";var Bn=new Set(["","unknown","undefined","null","n/a","none","-"]);function Se(e){let t=typeof e=="string"?e.trim():void 0;return t&&!Bn.has(t.toLowerCase())?t:void 0}var Vn=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function bt(e){let t=Se(e);return t&&Vn.test(t)?t:void 0}var Un=["cli_version","cliVersion","gemini_version","geminiVersion","agent_version","agentVersion","app_version","appVersion","version"],Ln="PINTA_GEMINI_HOST_VERSION",Tt="PINTA_GEMINI_VERSION_PROBE",Cn=2e3,Fn=/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;function kt(e){return p(e)?["gemini"]:["agy","antigravity","antigravity-cli"]}function Yn(e){let t=e;for(let n=0;n<5;n++){try{let i=Q.readFileSync(N.join(t,"package.json"),"utf8"),o=bt(JSON.parse(i).version);if(o)return o}catch{}let r=N.dirname(t);if(r===t)break;t=r}}function Xn(e){if(process.env[Tt]==="1")return;let t;try{t=At(e,["--version"],{encoding:"utf8",timeout:Cn,stdio:["ignore","pipe","ignore"],env:{...process.env,[Tt]:"1"}})}catch{return}let n=t.split(/\r?\n/,5).map(r=>r.trim()).filter(Boolean);for(let r of n){let i=bt(r);if(i)return i}for(let r of n){let i=Fn.exec(r);if(i)return i[1]}}function wt(e){let t=e;try{t=Q.realpathSync(e)}catch{}return Yn(N.dirname(t))??Xn(e)}function Hn(e){if(process.platform==="win32")return;let t=process.ppid;if(!t||t<=1)return;let n;try{n=At("ps",["-o","command=","-p",String(t)],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{return}if(!n)return;let r=kt(e);for(let i of n.split(/\s+/)){if(!i.startsWith("/"))continue;let o=N.basename(i).replace(/\.(js|mjs|cjs)$/,"");if(!r.includes(o))continue;let s=wt(i);if(s)return s}}function zn(e){let t=(process.env.PATH??"").split(N.delimiter).filter(Boolean);if(t.length===0)return;let n=process.platform==="win32"?[".cmd",".exe",""]:[""];for(let r of kt(e))for(let i of t)for(let o of n){let s=N.join(i,r+o);try{Q.accessSync(s,Q.constants.X_OK)}catch{continue}let a=wt(s);if(a)return a}}var Ee;function Wn(e){return Se(process.env[Ln])??Hn(e)??zn(e)??null}function Rt(e,t){if(t)for(let n of Un){let r=Se(t[n]);if(r)return r}return Ee===void 0&&(Ee=Wn(e)),Ee??void 0}var Kn=new Set(["unknown","undefined","null","n/a","none","-","auto","default"]);function Zn(e){if(typeof e!="string")return;let t=e.trim();if(!(!t||t.startsWith("{")||t.startsWith("[")||Kn.has(t.toLowerCase())))return t}function Mt(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function j(e,t){let n=Zn(e);return n?{model:n,source:t}:void 0}function Jn(e,t,n){if(p(e)){if(t==="AfterModel"){let r=Mt(n.llm_response),i=j(r?.modelVersion,"response:llm_response.modelVersion")??j(r?.model,"response:llm_response.model");if(i)return i}if(t==="BeforeModel"||t==="BeforeToolSelection"||t==="AfterModel"){let r=j(Mt(n.llm_request)?.model,"requested:llm_request.model");if(r)return r}return j(n.model,"reported:model")}return j(n.model,"reported:model")??j(n.modelId,"reported:modelId")}function It(e,t,n){let r=Jn(e,t,n),{model:i,model_source:o,...s}=n;return"model"in n&&i!==r?.model&&(s.model_raw=i),"model_source"in n&&(s.model_source_raw=o),r&&(s.model=r.model,s.model_source=r.source),s}var b=P(S(),1),nr=P(S(),1),ee;function Qn(){if(ee===void 0)try{ee=Pe.userInfo().username}catch{ee=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ee}var Dt=K;function er(e){return{skipRedactKeys:new Set([`${e}.hook`,`${e}.agent`,`${e}.tool_name`,`${e}.session_id`,`${e}.transcript_path`,`${e}.transcriptPath`,`${e}.cwd`]),bashContextKeys:new Set([`${e}.tool_input`,`${e}.tool_response`,`${e}.toolCall`])}}function tr(e,t){return[{key:"service.name",value:{stringValue:e}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-gemini"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Dt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Qn()}},{key:"host.name",value:{stringValue:Pe.hostname()}},{key:"host.arch",value:{stringValue:Pe.arch()}}]}function Nt(e){let t=W(e.agent),n=er(t.prefix),r=[{key:"ingest.type",value:{stringValue:t.ingest}},{key:`${t.prefix}.hook`,value:{stringValue:e.canonical.hook}},{key:`${t.prefix}.agent`,value:{stringValue:e.agent}}];e.product&&r.push({key:`${t.prefix}.product`,value:{stringValue:e.product}}),r.push(...(0,b.attrsFromRecord)(It(e.agent,e.canonical.hook,e.event),t.prefix,n));let i=new Set(r.map(o=>o.key));for(let[o,s]of[["session_id",e.canonical.session_id],["cwd",e.canonical.cwd],["tool_name",e.canonical.tool_name]]){let a=`${t.prefix}.${o}`;if(s!=null&&!i.has(a)){let c=(0,b.toOtlpValue)(a,String(s),n);c!==null&&r.push({key:a,value:c})}}return(0,b.buildPayload)({traceId:e.traceId,spanName:`${t.ingest}.${(0,b.snakeCase)(e.canonical.hook)}`,attributes:r,resource:tr(t.service,Rt(e.agent,e.event)),scope:{name:"pinta-gemini",version:Dt},now:e.now})}var rr="Pinta withheld this tool output because it violated an active policy.";function Oe(e,t,n){if(n&&n.decision==="DENY"){if(p(e)&&t==="AfterTool")return{decision:"deny",reason:rr};let r=n.userMessage??n.reason??"guard_deny";return p(e)?{decision:"deny",reason:r,systemMessage:n.userMessage??void 0}:{decision:"deny",reason:r}}return!p(e)&&t==="PreToolUse"?{decision:"allow"}:{}}import jt from"fs";import ir from"path";function xt(e,t){if(process.env.PINTA_GEMINI_DEBUG==="1")try{jt.mkdirSync(e.pluginData,{recursive:!0}),jt.appendFileSync(ir.join(e.pluginData,"invocations.jsonl"),JSON.stringify(t)+`
+`)}catch{}}async function sr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}function or(e,t,n){return p(e)?t.hook==="BeforeAgent":t.hook==="PreInvocation"&&n.invocationNum===1}async function $t(){let{agent:e,event:t}=gt(),n={},r={},i,o=null,s=!1,a=pt();try{if(r=JSON.parse(await sr()||"{}"),i=vt(e,t,r),!_t(i.hook)){let c=new Z(a),l=i.session_id??"unknown",h=new J(a),k=or(e,i,r)?h.newTrace(l):h.currentTrace(l),U=p(e)?void 0:mt(r),x=Nt({agent:e,canonical:i,event:r,traceId:k,product:U});yt(e,i.hook)&&(o=await St(x,a.guardEndpoint,a.headers["x-pinta-relay-token"],e)),n=Oe(e,t,o),o?.decision==="DENY"&&(process.stdout.write(JSON.stringify(n)+`
+`),s=!0),(0,Gt.attachGuard)(x,o),o&&p(e)&&i.hook==="AfterTool"&&x.resourceSpans[0].scopeSpans[0].spans[0].attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}}),o?.decision==="DENY"?Pt(x,a):(await c.flush(),await c.send(x))}}catch(c){process.stderr.write(`[pinta-gemini] error: ${c}
+`),n=o?Oe(e,t,o):{}}xt(a,{ts:new Date().toISOString(),pid:process.pid,agent:e,event:t,argv:process.argv.slice(2),received_payload:r,normalized:i??null,guard:o,decision_returned:n}),s||process.stdout.write(JSON.stringify(n)+`
+`),process.exit(0)}dt();$t();

package/dist/index.mjs

@@ -1,23 +1,29 @@
 import { createRequire as __pintaCreateRequire } from 'module'; const require = __pintaCreateRequire(import.meta.url);
-var Xt=Object.create;var we=Object.defineProperty;var zt=Object.getOwnPropertyDescriptor;var Ht=Object.getOwnPropertyNames;var Wt=Object.getPrototypeOf,Zt=Object.prototype.hasOwnProperty;var P=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var S=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Jt=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of Ht(t))!Zt.call(e,i)&&i!==n&&we(e,i,{get:()=>t[i],enumerable:!(r=zt(t,i))||r.enumerable});return e};var b=(e,t,n)=>(n=e!=null?Xt(Wt(e)):{},Jt(t||!e||!e.__esModule?we(n,"default",{value:e,enumerable:!0}):n,e));var re=S(y=>{"use strict";Object.defineProperty(y,"__esModule",{value:!0});y.PATTERNS=y.MAX_BYTES=void 0;y.truncateTo=Ae;y.truncate=Qt;y.collectMatches=ke;y.resolveOverlaps=Me;y.applyMatches=Ie;y.redact=en;y.MAX_BYTES=102400;function Ae(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function Qt(e){return Ae(e,y.MAX_BYTES)}y.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function ke(e,t){let n=[];for(let r of y.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;let i=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=i.exec(e))!==null;){let a=r.captureGroup??0,c=s[a];if(c===void 0){s.index===i.lastIndex&&i.lastIndex++;continue}let u=s.index,l=s.index+s[0].length,m=u+s[0].indexOf(c),f=m+c.length;n.push({start:u,end:l,replaceStart:m,replaceEnd:f,type:r.type}),s.index===i.lastIndex&&i.lastIndex++}}return n}function Me(e){let t=[...e].sort((i,s)=>i.start!==s.start?i.start-s.start:s.end-s.start-(i.end-i.start)),n=[],r=-1;for(let i of t)i.start<r||(n.push(i),r=i.end);return n}function Ie(e,t){let n=[...t].sort((i,s)=>s.replaceStart-i.replaceStart),r=e;for(let i of n)r=r.slice(0,i.replaceStart)+`[REDACTED:${i.type}]`+r.slice(i.replaceEnd);return r}function en(e,t={}){if(e.length===0)return e;let n=ke(e,t);if(n.length===0)return e;let r=Me(n);return Ie(e,r)}});var se=S(p=>{"use strict";var tn=p&&p.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(p,"__esModule",{value:!0});p.MAX_SPAN_BYTES=void 0;p.ulidToTraceId=De;p.newSpanId=Ne;p.snakeCase=sn;p.toOtlpValue=$e;p.attrsFromRecord=on;p.guardAttrs=qe;p.clientAttrs=Ge;p.enforceSpanBudget=Fe;p.buildPayload=an;p.attachGuard=Ce;p.mergeBatch=cn;var nn=tn(P("crypto")),ie=re(),rn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function De(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let i=rn.indexOf(r);if(i<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(i)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ne(){return nn.default.randomBytes(8).toString("hex")}function sn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Re=new Set;function L(e,t,n){let r=(0,ie.truncate)(t);if((n.skipRedactKeys??Re).has(e))return r;let i=(n.bashContextKeys??Re).has(e)?"bash":void 0;return(0,ie.redact)(r,{context:i})}function $e(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:L(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:L(e,JSON.stringify(t),n)}}catch{return{stringValue:L(e,String(t),n)}}default:return{stringValue:L(e,String(t),n)}}}function on(e,t,n={}){let r=[];for(let[i,s]of Object.entries(e)){let a=`${t}.${i}`,c=$e(a,s,n);c!==null&&r.push({key:a,value:c})}return r}function qe(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ge(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}p.MAX_SPAN_BYTES=800*1024;function je(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var xe=1024;function Fe(e,t=p.MAX_SPAN_BYTES){let n=je(e);for(let r=0;r<100&&n>t;r++){let i=null,s=0;for(let u of e.attributes){if(!("stringValue"in u.value))continue;let l=Buffer.byteLength(u.value.stringValue,"utf-8");l>s&&(s=l,i=u.value)}if(i===null||s<=xe)break;let a=n-t,c=Math.max(xe,s-a-64);i.stringValue=(0,ie.truncateTo)(i.stringValue,c),n=je(e)}return e}function an(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],i={traceId:De(e.traceId),spanId:Ne(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Fe(i);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[i]}]}]};return Ce(s,e.guard,e.clientTiming)}function Ce(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...qe(t));let i=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return i&&r.attributes.push(...Ge(i)),e}function cn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Ve=S(R=>{"use strict";Object.defineProperty(R,"__esModule",{value:!0});R.GUARD_STATUS_REFUSED=void 0;R.evaluateGuard=fn;var un=1e4,ln="pinta-core";function U(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var dn=new Set(["ALLOW","DENY","REVIEW"]);R.GUARD_STATUS_REFUSED=410;async function fn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??un,i=Date.now(),s=new AbortController,a=setTimeout(()=>s.abort(),r);try{let c=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??ln,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{}},body:JSON.stringify(e),signal:s.signal});if(c.status===R.GUARD_STATUS_REFUSED)return U(Date.now()-i,"refused");if(c.status!==200)return U(Date.now()-i,"error");let u=await c.json(),l=u?.durationMs===void 0||typeof u.durationMs=="number"&&Number.isFinite(u.durationMs);if(!u||!dn.has(u.decision)||!l)return U(Date.now()-i,"error");let m=Date.now()-i;return{decision:u.decision,reason:u.reason??null,userMessage:u.userMessage??null,durationMs:u.durationMs??m,clientRttMs:m}}catch(c){let u=c.name,l=u==="AbortError"||u==="TimeoutError"?"timeout":"error";return U(Date.now()-i,l)}finally{clearTimeout(a)}}});var Y=S(G=>{"use strict";var pn=G&&G.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(G,"__esModule",{value:!0});G.atomicWriteFileSync=gn;var Be=pn(P("fs"));function gn(e,t){let n=`${e}.${process.pid}.tmp`;Be.default.writeFileSync(n,t),Be.default.renameSync(n,e)}});var ce=S(O=>{"use strict";var Le=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.MemoryRetryQueue=O.DiskRetryQueue=void 0;var h=Le(P("fs")),K=Le(P("path")),mn=Y(),X=1e3,yn=50,hn=5,oe=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=K.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{h.default.mkdirSync(K.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;h.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
-`)}}readAll(){try{let t=h.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
-`))if(r.trim())try{let i=JSON.parse(r);Array.isArray(i?.payload?.resourceSpans)&&n.push(i)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){h.default.existsSync(this.filePath)&&h.default.unlinkSync(this.filePath);return}h.default.mkdirSync(K.default.dirname(this.filePath),{recursive:!0}),(0,mn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
+var nn=Object.create;var De=Object.defineProperty;var rn=Object.getOwnPropertyDescriptor;var sn=Object.getOwnPropertyNames;var on=Object.getPrototypeOf,an=Object.prototype.hasOwnProperty;var v=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,n)=>(typeof require<"u"?require:t)[n]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var E=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var cn=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of sn(t))!an.call(e,i)&&i!==n&&De(e,i,{get:()=>t[i],enumerable:!(r=rn(t,i))||r.enumerable});return e};var w=(e,t,n)=>(n=e!=null?nn(on(e)):{},cn(t||!e||!e.__esModule?De(n,"default",{value:e,enumerable:!0}):n,e));var $e=E(ae=>{"use strict";Object.defineProperty(ae,"__esModule",{value:!0});ae.mysqlPasswordRanges=hn;var un=new Set(["mysql","mysqldump","mysqladmin","mysqlcheck","mysqlimport","mysqlshow","mariadb","mariadb-dump","mariadb-admin","mariadb-check","mariadb-import","mariadb-show"]),ln=new Set(["sh","bash","dash","zsh","ksh"]),dn=new Set(["-u","--user","-h","--host","-P","--port","-D","--database","-S","--socket","-e","--execute","--protocol","--default-character-set","--defaults-file","--defaults-extra-file","--login-path","--init-command","--ssl-ca","--ssl-capath","--ssl-cert","--ssl-key","--ssl-cipher"]),z=16;function je(e,t,n=e.value.length){return{value:e.value.slice(t,n),ranges:e.ranges.slice(t,n)}}function B(e,t,n,r){e.value+=t.value.slice(n,r);for(let i=n;i<r;i++)e.ranges.push(t.ranges[i])}function Ne(e){if(e?.literal)return e.value.slice(e.value.lastIndexOf("/")+1).replace(/\.exe$/,"")}function fn(e){let t=0;for(let n=0;n<=z;n++){for(;/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.value??"");)t++;let r=Ne(e[t]);if(!r)return;if(["!","if","then","elif","else","while","until","do"].includes(r)){t++;continue}let i={env:["-u","--unset","-C","--chdir"],sudo:["-u","--user","-g","--group","-p","--prompt","-D","--chdir","-R","--chroot","-C","--close-from","-T","--command-timeout"],exec:["-a"],nice:["-n","--adjustment"],timeout:["-s","--signal","-k","--kill-after"]},s={env:["-i","--ignore-environment","-0","--null"],sudo:["-n","-E","-H","-S","-b","-k"],command:["-p"],exec:["-c","-l"],nohup:[],nice:[],time:["-p"],timeout:["--foreground","--preserve-status"]};if(!(r in s))return t;for(t++;e[t]?.value.startsWith("-");){let o=e[t++].value;if(o==="--")break;if(!s[r].includes(o)){if((i[r]??[]).includes(o)){if(!e[t++])return;continue}if(!(i[r]??[]).some(a=>a.startsWith("--")?o.startsWith(a+"="):o.startsWith(a)&&o.length>2)&&!(r==="nice"&&/^-\d+$/.test(o)))return}}if(r==="timeout"&&!/^\d+(?:\.\d+)?[smhd]?$/.test(e[t++]?.value??""))return}}function xe(e,t){let n=1,r="";for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"&&r!=="'"){i++;continue}if(r){s===r&&(r="");continue}if(s==="'"||s==='"')r=s;else if(s==="(")n++;else if(s===")"&&--n===0)return i}return e.length}function pn(e,t,n,r){let i={value:"",ranges:[],start:t,end:t,literal:!0},s="",o=t;for(;o<e.value.length;){let a=e.value[o];if(!s&&/[\s;|&()<>{}]/.test(a))break;if(a===s){s="",o++;continue}if(!s&&(a==="'"||a==='"')){s=a,o++;continue}if(a==="\\"&&s!=="'"){let c=e.value[o+1];if(c===`
+`){o+=2;continue}if(c&&(!s||/[$`"\\]/.test(c))){B(i,e,o+1,o+2),o+=2;continue}}if(s!=="'"&&e.value.startsWith("$(",o)){let c=xe(e.value,o+2);e.value[o+2]!=="("&&r<z&&j(je(e,o+2,c),n,r+1),B(i,e,o,Math.min(c+1,e.value.length)),i.literal=!1,o=Math.min(c+1,e.value.length);continue}if(a==="`"&&s!=="'"){let c=o+1;for(;c<e.value.length&&e.value[c]!=="`";)c+=e.value[c]==="\\"?2:1;r<z&&j(je(e,o+1,c),n,r+1),B(i,e,o,Math.min(c+1,e.value.length)),i.literal=!1,o=Math.min(c+1,e.value.length);continue}a==="$"&&s!=="'"&&(i.literal=!1),B(i,e,o,o+1),o++}return i.end=o,i}function gn(e,t,n,r){let i=fn(t);if(i===void 0)return;let s=Ne(t[i]);if(ln.has(s)&&r<z){for(let o=i+1;o<t.length;o++){let a=t[o].value;if(a==="--command"||/^-[a-zA-Z]*c[a-zA-Z]*$/.test(a)){let c=t[o+1];c&&j(c,n,r+1);return}if(!a.startsWith("-")||a==="--")return;(a==="-o"||a==="-O")&&o++}return}if(un.has(s))for(let o=i+1;o<t.length;o++){let a=t[o];if(a.value==="--")return;if(dn.has(a.value)){o++;continue}a.value.startsWith("-p")&&a.value.length>2&&n.push({start:e.ranges[a.start].start,end:e.ranges[a.end-1].end})}}function j(e,t,n=0){let r=[],i,s=[],o=0,a=()=>{gn(e,r,t,n),r=[],i=void 0};for(;o<e.value.length;){let c=e.value[o];if(c===`
+`){a(),o++;for(let l of s.splice(0))for(;o<e.value.length;){let f=e.value.indexOf(`
+`,o),d=f<0?e.value.length:f,S=e.value.slice(o,d);if(o=f<0?d:d+1,(l.stripTabs?S.replace(/^\t+/,""):S)===l.delimiter)break}}else if(/\s/.test(c))o++;else if(c==="#"){let l=e.value.indexOf(`
+`,o);o=l<0?e.value.length:l}else if(e.value.startsWith("((",o))a(),o=Math.min(xe(e.value,o+1)+1,e.value.length);else if(/[;|&(){}]/.test(c))a(),o++;else if(c==="<"||c===">")r.at(-1)?.end===o&&/^\d+$/.test(r.at(-1).value)&&r.pop(),i=/^(?:<<<|<<-?|>>|<&|>&|[<>])/.exec(e.value.slice(o))?.[0]??c,o+=i.length;else{let l=pn(e,o,t,n);o=l.end,(i==="<<"||i==="<<-")&&s.push({delimiter:l.value,stripTabs:i==="<<-"}),i||r.push(l),i=void 0}}a()}function mn(e,t,n){let r={value:"",ranges:[]};for(let i=t+1;i<n-1;i++){if(e.value[i]!=="\\"){B(r,e,i,i+1);continue}let s=i+(e.value[i+1]==="u"?6:2),o=JSON.parse(`"${e.value.slice(i,s)}"`);r.value+=o;for(let a=0;a<o.length;a++)r.ranges.push({start:e.ranges[i].start,end:e.ranges[s-1].end});i=s-1}return r}function hn(e){let t={value:e,ranges:Array.from({length:e.length},(r,i)=>({start:i,end:i+1}))},n=[];if(/^\s*[{[]/.test(e)){let r;try{r=JSON.parse(e)}catch{return j(t,n),n}if(r!==null&&typeof r=="object"){let i=/"(?:[^"\\]|\\.)*"/g,s;for(;s=i.exec(e);){let o=JSON.parse(s[0]);if(o!=="command"&&o!=="cmd"&&o!=="CommandLine")continue;let a=/^\s*:\s*/.exec(e.slice(i.lastIndex));if(!a)continue;let c=i.lastIndex+a[0].length;if(e[c]!=='"')continue;i.lastIndex=c;let l=i.exec(e);l?.index===c&&j(mn(t,c,c+l[0].length),n)}}return n}return j(t,n),n}});var ce=E(y=>{"use strict";Object.defineProperty(y,"__esModule",{value:!0});y.PATTERNS=y.MAX_BYTES=void 0;y.truncateTo=Ge;y.truncate=_n;y.collectMatches=qe;y.resolveOverlaps=Ce;y.applyMatches=Fe;y.redact=vn;var yn=$e();y.MAX_BYTES=102400;function Ge(e,t){let n=Buffer.from(e,"utf-8");return n.length<=t?e:`${n.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${n.length}]`}function _n(e){return Ge(e,y.MAX_BYTES)}y.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function qe(e,t){let n=[];for(let r of y.PATTERNS){if(r.requireContext&&r.requireContext!==t.context)continue;if(r.type==="cli_password_short"){for(let{start:o,end:a}of(0,yn.mysqlPasswordRanges)(e))n.push({start:o,end:a,replaceStart:o,replaceEnd:a,type:r.type,replacement:`-p[REDACTED:${r.type}]`});continue}let i=new RegExp(r.regex.source,r.regex.flags),s;for(;(s=i.exec(e))!==null;){let o=r.captureGroup??0,a=s[o];if(a===void 0){s.index===i.lastIndex&&i.lastIndex++;continue}let c=s.index,l=s.index+s[0].length,f=c+s[0].indexOf(a),d=f+a.length;n.push({start:c,end:l,replaceStart:f,replaceEnd:d,type:r.type}),s.index===i.lastIndex&&i.lastIndex++}}return n}function Ce(e){let t=[...e].sort((i,s)=>i.start!==s.start?i.start-s.start:s.end-s.start-(i.end-i.start)),n=[],r=-1;for(let i of t)i.start<r||(n.push(i),r=i.end);return n}function Fe(e,t){let n=[...t].sort((i,s)=>s.replaceStart-i.replaceStart),r=e;for(let i of n)r=r.slice(0,i.replaceStart)+(i.replacement??`[REDACTED:${i.type}]`)+r.slice(i.replaceEnd);return r}function vn(e,t={}){if(e.length===0)return e;let n=qe(e,t);if(n.length===0)return e;let r=Ce(n);return Fe(e,r)}});var le=E(g=>{"use strict";var Pn=g&&g.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(g,"__esModule",{value:!0});g.MAX_SPAN_BYTES=void 0;g.ulidToTraceId=Ue;g.newSpanId=Ye;g.snakeCase=Tn;g.toOtlpValue=Xe;g.attrsFromRecord=bn;g.guardAttrs=ze;g.clientAttrs=He;g.enforceSpanBudget=Ke;g.buildPayload=On;g.attachGuard=We;g.mergeBatch=wn;var En=Pn(v("crypto")),ue=ce(),Sn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ue(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let r of e){let i=Sn.indexOf(r);if(i<0)throw new Error(`ulidToTraceId: invalid Crockford char "${r}"`);t=t<<5n|BigInt(i)}let n=(1n<<128n)-1n;return t&=n,t.toString(16).padStart(32,"0")}function Ye(){return En.default.randomBytes(8).toString("hex")}function Tn(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var Be=new Set;function H(e,t,n){let r=(0,ue.truncate)(t);if((n.skipRedactKeys??Be).has(e))return r;let i=(n.bashContextKeys??Be).has(e)?"bash":void 0;return(0,ue.redact)(r,{context:i})}function Xe(e,t,n={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:H(e,t,n)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:H(e,JSON.stringify(t),n)}}catch{return{stringValue:H(e,String(t),n)}}default:return{stringValue:H(e,String(t),n)}}}function bn(e,t,n={}){let r=[];for(let[i,s]of Object.entries(e)){let o=`${t}.${i}`,a=Xe(o,s,n);a!==null&&r.push({key:o,value:a})}return r}function ze(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function He(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}g.MAX_SPAN_BYTES=800*1024;function Ve(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Le=1024;function Ke(e,t=g.MAX_SPAN_BYTES){let n=Ve(e);for(let r=0;r<100&&n>t;r++){let i=null,s=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>s&&(s=l,i=c.value)}if(i===null||s<=Le)break;let o=n-t,a=Math.max(Le,s-o-64);i.stringValue=(0,ue.truncateTo)(i.stringValue,a),n=Ve(e)}return e}function On(e){let t=e.now??Date.now(),n=(BigInt(t)*1000000n).toString(),r=[...e.attributes],i={traceId:Ue(e.traceId),spanId:Ye(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:n,endTimeUnixNano:n,attributes:r};Ke(i);let s={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[i]}]}]};return We(s,e.guard,e.clientTiming)}function We(e,t,n){let r=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!r)return e;t&&r.attributes.push(...ze(t));let i=n??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return i&&r.attributes.push(...He(i)),e}function wn(e){let t=[];for(let n of e)t.push(...n.resourceSpans);return{resourceSpans:t}}});var Ze=E(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.GUARD_STATUS_REFUSED=b.GUARD_BUDGET_HEADER=void 0;b.evaluateGuard=Mn;var An=1e4,kn="pinta-core";b.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function K(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Rn=new Set(["ALLOW","DENY","REVIEW"]);b.GUARD_STATUS_REFUSED=410;async function Mn(e,t,n={}){if(!t||n.disabled)return null;let r=n.timeoutMs??An,i=Date.now(),s=new AbortController,o=setTimeout(()=>s.abort(),r);try{let a=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":n.userAgent??kn,"x-pinta-relay-token":n.token??"",...n.agentType?{"x-pinta-agent-type":n.agentType}:{},...Number.isFinite(r)&&r>0?{[b.GUARD_BUDGET_HEADER]:String(r)}:{}},body:JSON.stringify(e),signal:s.signal});if(a.status===b.GUARD_STATUS_REFUSED)return K(Date.now()-i,"refused");if(a.status!==200)return K(Date.now()-i,"error");let c=await a.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!Rn.has(c.decision)||!l)return K(Date.now()-i,"error");let f=Date.now()-i;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??f,clientRttMs:f}}catch(a){let c=a.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return K(Date.now()-i,l)}finally{clearTimeout(o)}}});var W=E(V=>{"use strict";var In=V&&V.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(V,"__esModule",{value:!0});V.atomicWriteFileSync=Dn;var Je=In(v("fs"));function Dn(e,t){let n=`${e}.${process.pid}.tmp`;Je.default.writeFileSync(n,t),Je.default.renameSync(n,e)}});var pe=E(A=>{"use strict";var Qe=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.MemoryRetryQueue=A.DiskRetryQueue=void 0;var _=Qe(v("fs")),Z=Qe(v("path")),jn=W(),J=1e3,Nn=50,xn=5,de=class{filePath;lockPath;logPrefix;constructor(t,n){this.filePath=Z.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=n}enqueue(t){try{_.default.mkdirSync(Z.default.dirname(this.filePath),{recursive:!0});let n=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;_.default.appendFileSync(this.filePath,n),this.trim()}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${n}
+`)}}readAll(){try{let t=_.default.readFileSync(this.filePath,"utf-8"),n=[];for(let r of t.split(`
+`))if(r.trim())try{let i=JSON.parse(r);Array.isArray(i?.payload?.resourceSpans)&&n.push(i)}catch{}return n}catch{return[]}}rewrite(t){try{if(t.length===0){_.default.existsSync(this.filePath)&&_.default.unlinkSync(this.filePath);return}_.default.mkdirSync(Z.default.dirname(this.filePath),{recursive:!0}),(0,jn.atomicWriteFileSync)(this.filePath,t.map(n=>JSON.stringify(n)).join(`
 `)+`
 `)}catch(n){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${n}
-`)}}tryAcquireLock(){let t=Date.now();try{h.default.mkdirSync(K.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
-`),!1}for(;Date.now()-t<yn;)try{let n=h.default.openSync(this.lockPath,"wx");return h.default.writeSync(n,String(process.pid)),h.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
-`),!1;try{let s=h.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){h.default.unlinkSync(this.lockPath);continue}}catch{}let r=hn,i=Date.now()+r;for(;Date.now()<i;);}return!1}release(){try{h.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=X)return;let n=t.length-X;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
-`),this.rewrite(t.slice(n))}};O.DiskRetryQueue=oe;var ae=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>X&&this.entries.splice(0,this.entries.length-X)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};O.MemoryRetryQueue=ae});var He=S(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.MemoryTransport=d.DiskTransport=d.MAX_POST_BYTES=void 0;d.parseHeadersEnv=Xe;d.envOptionsResolver=ze;d.postOtlp=F;var Ue=ce(),Ye=se(),_n=5e3;d.MAX_POST_BYTES=900*1024;function z(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Ke(e,t,n){let r=[],i=[],s=[],a=0;for(let c of e){let u=t(c);if(u>n){i.push(c);continue}s.length>0&&a+u>n&&(r.push(s),s=[],a=0),s.push(c),a+=u}return s.length>0&&r.push(s),{chunks:r,oversize:i}}function Xe(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...i]=n.split("=");r&&i.length>0&&(t[r.trim()]=i.join("=").trim())}return t}function ze(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:Xe(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function F(e,t,n){let r=new AbortController,i=setTimeout(()=>r.abort(),_n);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let a="";try{a=(await s.text()).slice(0,200)}catch{}let c=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${c}${a?` body=${a}`:""}
+`)}}tryAcquireLock(){let t=Date.now();try{_.default.mkdirSync(Z.default.dirname(this.lockPath),{recursive:!0})}catch(n){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${n}
+`),!1}for(;Date.now()-t<Nn;)try{let n=_.default.openSync(this.lockPath,"wx");return _.default.writeSync(n,String(process.pid)),_.default.closeSync(n),!0}catch(n){if(n?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${n}
+`),!1;try{let s=_.default.statSync(this.lockPath);if(Date.now()-s.mtimeMs>3e4){_.default.unlinkSync(this.lockPath);continue}}catch{}let r=xn,i=Date.now()+r;for(;Date.now()<i;);}return!1}release(){try{_.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=J)return;let n=t.length-J;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${n} oldest entries
+`),this.rewrite(t.slice(n))}};A.DiskRetryQueue=de;var fe=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>J&&this.entries.splice(0,this.entries.length-J)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};A.MemoryRetryQueue=fe});var st=E(p=>{"use strict";Object.defineProperty(p,"__esModule",{value:!0});p.MemoryTransport=p.DiskTransport=p.MAX_POST_BYTES=void 0;p.parseHeadersEnv=rt;p.envOptionsResolver=it;p.postOtlp=L;var et=pe(),tt=le(),$n=5e3;p.MAX_POST_BYTES=900*1024;function Q(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function nt(e,t,n){let r=[],i=[],s=[],o=0;for(let a of e){let c=t(a);if(c>n){i.push(a);continue}s.length>0&&o+c>n&&(r.push(s),s=[],o=0),s.push(a),o+=c}return s.length>0&&r.push(s),{chunks:r,oversize:i}}function rt(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let n of e.split(",")){let[r,...i]=n.split("=");r&&i.length>0&&(t[r.trim()]=i.join("=").trim())}return t}function it(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,n;return e?n=e.replace(/\/+$/,""):t&&(n=t.replace(/\/+$/,"")+"/v1/traces"),n?{endpoint:n,headers:rt(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function L(e,t,n){let r=new AbortController,i=setTimeout(()=>r.abort(),$n);try{let s=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:r.signal});if(!s.ok){let o="";try{o=(await s.text()).slice(0,200)}catch{}let a=s.status===401||s.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":s.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":s.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${n}] OTLP POST ${s.status} ${t.endpoint}${a}${o?` body=${o}`:""}
 `),!1}return!0}catch(s){return process.stderr.write(`[${n}] OTLP POST failed: ${s.message??String(s)}
-`),!1}finally{clearTimeout(i)}}var ue=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ue.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??ze}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await F(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:i}=Ke(n,c=>z(c.payload),d.MAX_POST_BYTES);i.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${i.length} oversized retry ${i.length===1?"entry":"entries"} (each > ${d.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let s=[].concat(...r),a=0;for(let c of r){if(!await F((0,Ye.mergeBatch)(c.map(l=>l.payload)),t,this.logPrefix))break;a+=c.length}this.queue.rewrite(s.slice(a))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let n=z(t);return n<=d.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};d.DiskTransport=ue;var le=class{queue=new Ue.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(z(t)>d.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${d.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await F(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:i}=Ke(n,z,d.MAX_POST_BYTES);i.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${i.length} oversized buffered ${i.length===1?"payload":"payloads"} (each > ${d.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let s=[].concat(...r),a=0;for(let c of r){if(!await F((0,Ye.mergeBatch)(c),t,this.logPrefix))break;a+=c.length}for(let c of s.slice(a))this.queue.enqueue(c)}};d.MemoryTransport=le});var ge=S(M=>{"use strict";var pe=M&&M.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(M,"__esModule",{value:!0});M.TraceManager=void 0;M.generateUlid=Ze;var We=pe(P("fs")),Pn=pe(P("path")),vn=pe(P("crypto")),Sn=Y(),de="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ze(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=de[n&31]+t,n=Math.floor(n/32);let r=vn.default.randomBytes(10),i="";for(let s=0;s<10;s++)i+=de[r[s]&31];for(;i.length<16;)i+=de[0];return t+i}var fe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=Ze();return this.save(t),t}currentTrace(){try{let t=We.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{We.default.mkdirSync(Pn.default.dirname(this.tracePath),{recursive:!0}),(0,Sn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
-`)}}};M.TraceManager=fe});var nt=S(w=>{"use strict";var Qe=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.MemorySessionTraceManager=w.DiskSessionTraceManager=void 0;var Je=Qe(P("fs")),Tn=Qe(P("path")),et=ge(),En=Y(),tt=200,me=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??tt}read(){try{let t=JSON.parse(Je.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Je.default.mkdirSync(Tn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,En.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,et.generateUlid)(),i=this.read();return i[n]=r,this.write(i),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};w.DiskSessionTraceManager=me;var ye=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??tt}newTrace(t){let n=t||"default",r=(0,et.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let i=this.map.keys().next().value;i!==void 0&&this.map.delete(i)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};w.MemorySessionTraceManager=ye});var st=S(I=>{"use strict";var he=I&&I.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(I,"__esModule",{value:!0});I.envFilePath=wn;I.parseEnvFile=it;I.loadEnvFile=An;var bn=he(P("node:fs")),On=he(P("node:os")),rt=he(P("node:path"));function wn(e,t,n){let r=n?process.env[n]:void 0,i=r&&r.length>0?r:rt.default.join(On.default.homedir(),e);return rt.default.join(i,t)}function it(e){let t={};for(let n of e.split(`
-`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let i=r.indexOf("=");if(i<0)continue;let s=r.slice(0,i).trim(),a=r.slice(i+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),s&&(t[s]=a)}return t}function An(e){let t;try{t=bn.default.readFileSync(e,"utf-8")}catch{return}let n=it(t);for(let[r,i]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=i)}});var E=S(o=>{"use strict";Object.defineProperty(o,"__esModule",{value:!0});o.loadEnvFile=o.parseEnvFile=o.envFilePath=o.MemorySessionTraceManager=o.DiskSessionTraceManager=o.generateUlid=o.TraceManager=o.MAX_POST_BYTES=o.parseHeadersEnv=o.envOptionsResolver=o.postOtlp=o.MemoryTransport=o.DiskTransport=o.MemoryRetryQueue=o.DiskRetryQueue=o.GUARD_STATUS_REFUSED=o.evaluateGuard=o.MAX_SPAN_BYTES=o.enforceSpanBudget=o.mergeBatch=o.attachGuard=o.buildPayload=o.clientAttrs=o.guardAttrs=o.attrsFromRecord=o.toOtlpValue=o.snakeCase=o.newSpanId=o.ulidToTraceId=o.MAX_BYTES=o.PATTERNS=o.applyMatches=o.resolveOverlaps=o.collectMatches=o.truncateTo=o.truncate=o.redact=void 0;var A=re();Object.defineProperty(o,"redact",{enumerable:!0,get:function(){return A.redact}});Object.defineProperty(o,"truncate",{enumerable:!0,get:function(){return A.truncate}});Object.defineProperty(o,"truncateTo",{enumerable:!0,get:function(){return A.truncateTo}});Object.defineProperty(o,"collectMatches",{enumerable:!0,get:function(){return A.collectMatches}});Object.defineProperty(o,"resolveOverlaps",{enumerable:!0,get:function(){return A.resolveOverlaps}});Object.defineProperty(o,"applyMatches",{enumerable:!0,get:function(){return A.applyMatches}});Object.defineProperty(o,"PATTERNS",{enumerable:!0,get:function(){return A.PATTERNS}});Object.defineProperty(o,"MAX_BYTES",{enumerable:!0,get:function(){return A.MAX_BYTES}});var v=se();Object.defineProperty(o,"ulidToTraceId",{enumerable:!0,get:function(){return v.ulidToTraceId}});Object.defineProperty(o,"newSpanId",{enumerable:!0,get:function(){return v.newSpanId}});Object.defineProperty(o,"snakeCase",{enumerable:!0,get:function(){return v.snakeCase}});Object.defineProperty(o,"toOtlpValue",{enumerable:!0,get:function(){return v.toOtlpValue}});Object.defineProperty(o,"attrsFromRecord",{enumerable:!0,get:function(){return v.attrsFromRecord}});Object.defineProperty(o,"guardAttrs",{enumerable:!0,get:function(){return v.guardAttrs}});Object.defineProperty(o,"clientAttrs",{enumerable:!0,get:function(){return v.clientAttrs}});Object.defineProperty(o,"buildPayload",{enumerable:!0,get:function(){return v.buildPayload}});Object.defineProperty(o,"attachGuard",{enumerable:!0,get:function(){return v.attachGuard}});Object.defineProperty(o,"mergeBatch",{enumerable:!0,get:function(){return v.mergeBatch}});Object.defineProperty(o,"enforceSpanBudget",{enumerable:!0,get:function(){return v.enforceSpanBudget}});Object.defineProperty(o,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return v.MAX_SPAN_BYTES}});var ot=Ve();Object.defineProperty(o,"evaluateGuard",{enumerable:!0,get:function(){return ot.evaluateGuard}});Object.defineProperty(o,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return ot.GUARD_STATUS_REFUSED}});var at=ce();Object.defineProperty(o,"DiskRetryQueue",{enumerable:!0,get:function(){return at.DiskRetryQueue}});Object.defineProperty(o,"MemoryRetryQueue",{enumerable:!0,get:function(){return at.MemoryRetryQueue}});var j=He();Object.defineProperty(o,"DiskTransport",{enumerable:!0,get:function(){return j.DiskTransport}});Object.defineProperty(o,"MemoryTransport",{enumerable:!0,get:function(){return j.MemoryTransport}});Object.defineProperty(o,"postOtlp",{enumerable:!0,get:function(){return j.postOtlp}});Object.defineProperty(o,"envOptionsResolver",{enumerable:!0,get:function(){return j.envOptionsResolver}});Object.defineProperty(o,"parseHeadersEnv",{enumerable:!0,get:function(){return j.parseHeadersEnv}});Object.defineProperty(o,"MAX_POST_BYTES",{enumerable:!0,get:function(){return j.MAX_POST_BYTES}});var ct=ge();Object.defineProperty(o,"TraceManager",{enumerable:!0,get:function(){return ct.TraceManager}});Object.defineProperty(o,"generateUlid",{enumerable:!0,get:function(){return ct.generateUlid}});var ut=nt();Object.defineProperty(o,"DiskSessionTraceManager",{enumerable:!0,get:function(){return ut.DiskSessionTraceManager}});Object.defineProperty(o,"MemorySessionTraceManager",{enumerable:!0,get:function(){return ut.MemorySessionTraceManager}});var _e=st();Object.defineProperty(o,"envFilePath",{enumerable:!0,get:function(){return _e.envFilePath}});Object.defineProperty(o,"parseEnvFile",{enumerable:!0,get:function(){return _e.parseEnvFile}});Object.defineProperty(o,"loadEnvFile",{enumerable:!0,get:function(){return _e.loadEnvFile}})});import{realpathSync as Mr}from"node:fs";import{pathToFileURL as Ir}from"node:url";var C=b(E(),1);function kn(){return(0,C.envFilePath)(".gemini","pinta-gemini.env","GEMINI_HOME")}function lt(e=kn()){(0,C.loadEnvFile)(e)}var dt=b(E(),1);import Mn from"os";import Pe from"path";function In(){return process.env.GEMINI_HOME||Pe.join(Mn.homedir(),".gemini")}function Rn(){let e=process.env.GEMINI_PLUGIN_OPTION_ENDPOINT||process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(e)return e.replace(/\/+$/,"");let t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(t)return t.replace(/\/+$/,"")+"/v1/traces"}function jn(){let e=(0,dt.parseHeadersEnv)(process.env.GEMINI_PLUGIN_OPTION_HEADERS||process.env.OTEL_EXPORTER_OTLP_HEADERS),t=process.env.GEMINI_PLUGIN_OPTION_API_KEY;return t&&!e["x-pinta-relay-token"]&&(e["x-pinta-relay-token"]=t),e}function ft(){let e=process.env.GEMINI_PLUGIN_DATA||Pe.join(In(),"pinta-gemini-data");return!process.env.PINTA_RELAY_TOKEN&&process.env.GEMINI_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.GEMINI_PLUGIN_OPTION_API_KEY),{pluginData:e,tracePath:Pe.join(e,"trace.json"),endpoint:Rn(),headers:jn(),guardEndpoint:process.env.PINTA_GUARD_ENDPOINT}}function pt(e=process.argv){let t=n=>{let r=e.indexOf(n);return r>=0?e[r+1]:void 0};return{agent:t("--agent")||"gemini",event:t("--event")}}function gt(e){let t=e.transcriptPath;if(typeof t=="string"){if(t.includes("/antigravity-cli/brain/"))return"agy";if(t.includes("/antigravity/brain/"))return"antigravity2"}}var _=e=>e==="gemini",xn={identity:{prefix:"gemini",ingest:"gemini",service:"gemini-cli"},gateEvent:"BeforeTool"},Dn={identity:{prefix:"antigravity",ingest:"antigravity",service:"antigravity-cli"},gateEvent:"PreToolUse"},mt=e=>_(e)?xn:Dn;function H(e){return mt(e).identity}function yt(e){return mt(e).gateEvent}var Nn=new Set(["AfterModel"]),ht=e=>Nn.has(e);function _t(e,t,n){if(_(e))return{hook:t||n.hook_event_name||"unknown",session_id:V(n.session_id),cwd:V(n.cwd),tool_name:V(n.tool_name),tool_input:n.tool_input};let r=n.workspacePaths,i=n.toolCall;return{hook:t||"unknown",session_id:V(n.conversationId),cwd:Array.isArray(r)?V(r[0]):void 0,tool_name:i?.name,tool_input:i?.args}}function V(e){return typeof e=="string"?e:void 0}var Nt=b(E(),1);var Pt=b(E(),1);var W="0.12.0";var $n=50,qn=`pinta-gemini/${W}`;function vt(e,t,n,r){return(0,Pt.evaluateGuard)(e,t,{timeoutMs:$n,token:n??process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:qn,agentType:r?H(r).ingest:void 0})}var St=b(E(),1),Z=class extends St.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-gemini",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};var Tt=b(E(),1),J=class extends Tt.DiskSessionTraceManager{constructor(t){super(t.tracePath)}};import Te from"os";import{execFileSync as bt}from"node:child_process";import Q from"node:fs";import x from"node:path";var Gn=new Set(["","unknown","undefined","null","n/a","none","-"]);function Se(e){let t=typeof e=="string"?e.trim():void 0;return t&&!Gn.has(t.toLowerCase())?t:void 0}var Fn=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function Ot(e){let t=Se(e);return t&&Fn.test(t)?t:void 0}var Cn=["cli_version","cliVersion","gemini_version","geminiVersion","agent_version","agentVersion","app_version","appVersion","version"],Vn="PINTA_GEMINI_HOST_VERSION",Et="PINTA_GEMINI_VERSION_PROBE",Bn=2e3,Ln=/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;function wt(e){return _(e)?["gemini"]:["agy","antigravity","antigravity-cli"]}function Un(e){let t=e;for(let n=0;n<5;n++){try{let i=Q.readFileSync(x.join(t,"package.json"),"utf8"),s=Ot(JSON.parse(i).version);if(s)return s}catch{}let r=x.dirname(t);if(r===t)break;t=r}}function Yn(e){if(process.env[Et]==="1")return;let t;try{t=bt(e,["--version"],{encoding:"utf8",timeout:Bn,stdio:["ignore","pipe","ignore"],env:{...process.env,[Et]:"1"}})}catch{return}let n=t.split(/\r?\n/,5).map(r=>r.trim()).filter(Boolean);for(let r of n){let i=Ot(r);if(i)return i}for(let r of n){let i=Ln.exec(r);if(i)return i[1]}}function At(e){let t=e;try{t=Q.realpathSync(e)}catch{}return Un(x.dirname(t))??Yn(e)}function Kn(e){if(process.platform==="win32")return;let t=process.ppid;if(!t||t<=1)return;let n;try{n=bt("ps",["-o","command=","-p",String(t)],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{return}if(!n)return;let r=wt(e);for(let i of n.split(/\s+/)){if(!i.startsWith("/"))continue;let s=x.basename(i).replace(/\.(js|mjs|cjs)$/,"");if(!r.includes(s))continue;let a=At(i);if(a)return a}}function Xn(e){let t=(process.env.PATH??"").split(x.delimiter).filter(Boolean);if(t.length===0)return;let n=process.platform==="win32"?[".cmd",".exe",""]:[""];for(let r of wt(e))for(let i of t)for(let s of n){let a=x.join(i,r+s);try{Q.accessSync(a,Q.constants.X_OK)}catch{continue}let c=At(a);if(c)return c}}var ve;function zn(e){return Se(process.env[Vn])??Kn(e)??Xn(e)??null}function kt(e,t){if(t)for(let n of Cn){let r=Se(t[n]);if(r)return r}return ve===void 0&&(ve=zn(e)),ve??void 0}var Hn=new Set(["unknown","undefined","null","n/a","none","-","auto","default"]);function Wn(e){if(typeof e!="string")return;let t=e.trim();if(!(!t||t.startsWith("{")||t.startsWith("[")||Hn.has(t.toLowerCase())))return t}function Mt(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function D(e,t){let n=Wn(e);return n?{model:n,source:t}:void 0}function Zn(e,t,n){if(_(e)){if(t==="AfterModel"){let r=Mt(n.llm_response),i=D(r?.modelVersion,"response:llm_response.modelVersion")??D(r?.model,"response:llm_response.model");if(i)return i}if(t==="BeforeModel"||t==="BeforeToolSelection"||t==="AfterModel"){let r=D(Mt(n.llm_request)?.model,"requested:llm_request.model");if(r)return r}return D(n.model,"reported:model")}return D(n.model,"reported:model")??D(n.modelId,"reported:modelId")}function It(e,t,n){let r=Zn(e,t,n),{model:i,model_source:s,...a}=n;return"model"in n&&i!==r?.model&&(a.model_raw=i),"model_source"in n&&(a.model_source_raw=s),r&&(a.model=r.model,a.model_source=r.source),a}var k=b(E(),1),tr=b(E(),1),ee;function Jn(){if(ee===void 0)try{ee=Te.userInfo().username}catch{ee=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return ee}var Rt=W;function Qn(e){return{skipRedactKeys:new Set([`${e}.hook`,`${e}.agent`,`${e}.tool_name`,`${e}.session_id`,`${e}.transcript_path`,`${e}.transcriptPath`,`${e}.cwd`]),bashContextKeys:new Set([`${e}.tool_input`,`${e}.tool_response`,`${e}.toolCall`])}}function er(e,t){return[{key:"service.name",value:{stringValue:e}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-gemini"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Rt}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Jn()}},{key:"host.name",value:{stringValue:Te.hostname()}},{key:"host.arch",value:{stringValue:Te.arch()}}]}function jt(e){let t=H(e.agent),n=Qn(t.prefix),r=[{key:"ingest.type",value:{stringValue:t.ingest}},{key:`${t.prefix}.hook`,value:{stringValue:e.canonical.hook}},{key:`${t.prefix}.agent`,value:{stringValue:e.agent}}];e.product&&r.push({key:`${t.prefix}.product`,value:{stringValue:e.product}}),r.push(...(0,k.attrsFromRecord)(It(e.agent,e.canonical.hook,e.event),t.prefix,n));let i=new Set(r.map(s=>s.key));for(let[s,a]of[["session_id",e.canonical.session_id],["cwd",e.canonical.cwd],["tool_name",e.canonical.tool_name]]){let c=`${t.prefix}.${s}`;if(a!=null&&!i.has(c)){let u=(0,k.toOtlpValue)(c,String(a),n);u!==null&&r.push({key:c,value:u})}}return(0,k.buildPayload)({traceId:e.traceId,spanName:`${t.ingest}.${(0,k.snakeCase)(e.canonical.hook)}`,attributes:r,resource:er(t.service,kt(e.agent,e.event)),scope:{name:"pinta-gemini",version:Rt},now:e.now})}function Ee(e,t,n){if(n&&n.decision==="DENY"){let r=n.userMessage??n.reason??"guard_deny";return _(e)?{decision:"deny",reason:r,systemMessage:n.userMessage??void 0}:{decision:"deny",reason:r}}return!_(e)&&t==="PreToolUse"?{decision:"allow"}:{}}import xt from"fs";import nr from"path";function Dt(e,t){if(process.env.PINTA_GEMINI_DEBUG==="1")try{xt.mkdirSync(e.pluginData,{recursive:!0}),xt.appendFileSync(nr.join(e.pluginData,"invocations.jsonl"),JSON.stringify(t)+`
-`)}catch{}}async function rr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}function ir(e,t,n){return _(e)?t.hook==="BeforeAgent":t.hook==="PreInvocation"&&n.invocationNum===1}async function $t(){let{agent:e,event:t}=pt(),n={},r={},i,s=null,a=ft();try{if(r=JSON.parse(await rr()||"{}"),i=_t(e,t,r),!ht(i.hook)){let c=new Z(a);await c.flush();let u=i.session_id??"unknown",l=new J(a),m=ir(e,i,r)?l.newTrace(u):l.currentTrace(u),f=_(e)?void 0:gt(r),T=jt({agent:e,canonical:i,event:r,traceId:m,product:f});i.hook===yt(e)&&(s=await vt(T,a.guardEndpoint,a.headers["x-pinta-relay-token"],e)),n=Ee(e,t,s),(0,Nt.attachGuard)(T,s),await c.send(T)}}catch(c){process.stderr.write(`[pinta-gemini] error: ${c}
-`),n=s?Ee(e,t,s):{}}Dt(a,{ts:new Date().toISOString(),pid:process.pid,agent:e,event:t,argv:process.argv.slice(2),received_payload:r,normalized:i??null,guard:s,decision_returned:n}),process.stdout.write(JSON.stringify(n)+`
-`),process.exit(0)}import{opendir as Vt,stat as _r}from"node:fs/promises";import{homedir as Pr}from"node:os";import g from"node:path";import{spawn as Gt}from"node:child_process";import{access as sr,copyFile as or,mkdtemp as ar,rm as cr,stat as Ft}from"node:fs/promises";import{constants as ur}from"node:fs";import lr from"node:os";import B from"node:path";var be,dr=["/usr/bin/sqlite3","/opt/homebrew/bin/sqlite3","/usr/local/bin/sqlite3"];async function fr(){for(let t of dr)try{return await sr(t,ur.X_OK),t}catch{}return await new Promise(t=>{let n;try{n=Gt("sqlite3",["--version"],{stdio:"ignore"})}catch{t(!1);return}n.on("error",()=>t(!1)),n.on("close",r=>t(r===0))})?"sqlite3":null}async function pr(){return be===void 0&&(be=await fr()),be}async function gr(e,t,n,r){await new Promise((i,s)=>{let a=Gt(e,[t,`.backup '${n}'`],{stdio:["ignore","ignore","pipe"]}),c="",u=!1,l,m=f=>{u||(u=!0,l&&clearTimeout(l),f())};r>0&&(l=setTimeout(()=>{a.kill("SIGKILL"),m(()=>s(new Error(`sqlite3 .backup timed out after ${r}ms: ${t}`)))},r),l.unref?.()),a.stderr?.on("data",f=>{c+=String(f)}),a.on("error",f=>m(()=>s(f))),a.on("close",f=>{m(()=>{f===0?i():s(new Error(`sqlite3 .backup exited ${f}${c?`: ${c.trim()}`:""}`))})})})}async function mr(e){try{let t=await Ft(e);return`${t.mtimeMs}:${t.size}`}catch{return"absent"}}async function qt(e){let t=new Map;for(let n of e)t.set(n,await mr(n));return t}function yr(e,t){for(let[n,r]of e)if(t.get(n)!==r)return!1;return!0}async function hr(e,t,n,r){let i=r.minStableMs??2e3,s=r.maxRetries??3,a=r.now??Date.now,c=r.sleep??(f=>new Promise(T=>setTimeout(T,f))),u=r.overallTimeoutMs??6e4,l=a(),m=[e,`${e}-wal`,`${e}-shm`];for(let f=1;f<=s;f++){if(u>0&&a()-l>u)throw new Error(`snapshot quiesce-copy exceeded overall deadline of ${u}ms: ${e}`);let T=await qt(m);if(T.get(e)==="absent")throw new Error(`snapshot source vanished: ${e}`);let ne=0;for(let q of m)try{let Kt=await Ft(q);ne=Math.max(ne,Kt.mtimeMs)}catch{}if(a()-ne<i){await c(i);continue}for(let q of m)T.get(q)!=="absent"&&await or(q,B.join(t,B.basename(q)));r.onCopied&&await r.onCopied(f);let Yt=await qt(m);if(yr(T,Yt))return n}throw new Error(`snapshot quiesce-copy did not stabilize after ${s} attempts: ${e}`)}async function Ct(e,t={}){let n=t.tmpDirBase??lr.tmpdir(),r=await ar(B.join(n,"pinta-gemini-snap-"));try{let i=B.join(r,B.basename(e.absPath)),s=t.sqlite3Path!==void 0?t.sqlite3Path:await pr();return s?(await gr(s,e.absPath,i,t.overallTimeoutMs??6e4),i):await hr(e.absPath,r,i,t)}catch(i){throw await cr(r,{recursive:!0,force:!0}).catch(()=>{}),i}}var vr="pinta-gemini",te="antigravity";function Sr(){let e=process.env.GEMINI_HOME;return e&&e.length>0?e:g.join(Pr(),".gemini")}function N(e,t){return g.relative(e,t).split(g.sep).join("/")}function Bt(e){return e.endsWith("/.system_generated/logs/transcript.jsonl")||e.endsWith("/.system_generated/logs/transcript_full.jsonl")}function Tr(e){return e.endsWith(".jsonl")||e.endsWith(".json")}function Oe(e){let t=g.extname(e);return t?e.slice(0,-t.length):e}async function Lt(){return[Sr()]}async function*Ut(e){let t;try{t=await Vt(e)}catch{return}try{for await(let n of t){let r=g.join(e,n.name);n.isDirectory()?yield*Ut(r):n.isFile()&&(yield r)}}catch{return}}async function*$(e){let t;try{t=await Vt(e)}catch{return}try{for await(let n of t)yield{name:n.name,isDir:n.isDirectory(),isFile:n.isFile()}}catch{return}}async function*Er(e){let t=g.join(e,"tmp");for await(let n of $(t)){if(!n.isDir)continue;let r=n.name,i=g.join(t,r),s=g.join(i,"logs.json");yield{absPath:s,relPath:N(e,s),semantics:"rewritten-doc",projectKey:r};let a=g.join(i,"chats");for await(let c of $(a)){if(!c.isFile||!Tr(c.name))continue;let u=g.join(a,c.name);yield{absPath:u,relPath:N(e,u),semantics:"rewritten-doc",sessionId:Oe(c.name),projectKey:r}}}}async function*br(e){let t=g.join(e,"antigravity"),n=g.join(t,"conversations");for await(let s of $(n)){if(!s.isFile||!s.name.endsWith(".db"))continue;let a=g.join(n,s.name);yield{absPath:a,relPath:N(e,a),semantics:"database",sessionId:Oe(s.name),projectKey:te}}let r=g.join(t,"brain");for await(let s of $(r)){if(!s.isDir)continue;let a=s.name,c=g.join(r,a);for await(let u of Ut(c)){let l=N(e,u);yield{absPath:u,relPath:l,semantics:Bt(l)?"append-log":"rewritten-doc",sessionId:a,projectKey:te}}}let i=g.join(t,"annotations");for await(let s of $(i)){if(!s.isFile||!s.name.endsWith(".pbtxt"))continue;let a=g.join(i,s.name);yield{absPath:a,relPath:N(e,a),semantics:"rewritten-doc",sessionId:Oe(s.name),projectKey:te}}for await(let s of $(t))if(s.isFile&&(s.name.endsWith(".pb")||s.name.endsWith(".pbtxt")||s.name==="installation_id")){let a=g.join(t,s.name);yield{absPath:a,relPath:N(e,a),semantics:"rewritten-doc",projectKey:te}}}async function*Or(e){yield*Er(e),yield*br(e)}async function*wr(e){let[t]=await Lt(),n=e.since?.getTime();for await(let r of Or(t)){let i;try{i=await _r(r.absPath)}catch{continue}i.isFile()&&(n!==void 0&&i.mtime.getTime()<=n||(yield{relPath:r.relPath,absPath:r.absPath,size:i.size,mtime:i.mtime,sessionId:r.sessionId,projectKey:r.projectKey,semantics:r.semantics}))}}function Ar(e){let t=e.split("/");if(t[0]==="tmp")return t[2]==="chats"?"session-log":t[2]==="logs.json"&&t.length===3?"meta":"other";if(t[0]==="antigravity")switch(t[1]){case"conversations":return"session-log";case"brain":return Bt(e)?"session-log":"meta";case"annotations":return"meta";default:return"other"}return"other"}var kr={id:vr,roots:Lt,scan:wr,classify:Ar,snapshot:e=>Ct(e)};lt();function Rr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===Ir(Mr(e)).href}catch{return!1}}Rr()&&$t();export{kr as lifecycle};
+`),!1}finally{clearTimeout(i)}}var ge=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new et.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??it}async send(t){let n=this.resolveOptions();if(!n||this.dropIfOversized(t))return;await L(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let n=this.queue.readAll();if(n.length===0)return;let{chunks:r,oversize:i}=nt(n,a=>Q(a.payload),p.MAX_POST_BYTES);i.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${i.length} oversized retry ${i.length===1?"entry":"entries"} (each > ${p.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let s=[].concat(...r),o=0;for(let a of r){if(!await L((0,tt.mergeBatch)(a.map(l=>l.payload)),t,this.logPrefix))break;o+=a.length}this.queue.rewrite(s.slice(o))}catch(n){process.stderr.write(`[${this.logPrefix}] flush failed: ${n?.message??String(n)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let n=Q(t);return n<=p.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${n} > ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};p.DiskTransport=ge;var me=class{queue=new et.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let n=this.resolveOptions();if(!n)return;if(Q(t)>p.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${p.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await L(t,n,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let n=this.queue.drain();if(n.length===0)return;let{chunks:r,oversize:i}=nt(n,Q,p.MAX_POST_BYTES);i.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${i.length} oversized buffered ${i.length===1?"payload":"payloads"} (each > ${p.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let s=[].concat(...r),o=0;for(let a of r){if(!await L((0,tt.mergeBatch)(a),t,this.logPrefix))break;o+=a.length}for(let a of s.slice(o))this.queue.enqueue(a)}};p.MemoryTransport=me});var ve=E(I=>{"use strict";var _e=I&&I.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(I,"__esModule",{value:!0});I.TraceManager=void 0;I.generateUlid=at;var ot=_e(v("fs")),Gn=_e(v("path")),qn=_e(v("crypto")),Cn=W(),he="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function at(){let e=Date.now(),t="",n=e;for(let s=0;s<10;s++)t=he[n&31]+t,n=Math.floor(n/32);let r=qn.default.randomBytes(10),i="";for(let s=0;s<10;s++)i+=he[r[s]&31];for(;i.length<16;)i+=he[0];return t+i}var ye=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=at();return this.save(t),t}currentTrace(){try{let t=ot.default.readFileSync(this.tracePath,"utf-8"),{traceId:n}=JSON.parse(t);if(n)return n}catch{}return this.newTrace()}save(t){try{ot.default.mkdirSync(Gn.default.dirname(this.tracePath),{recursive:!0}),(0,Cn.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(n){process.stderr.write(`[pinta-core] trace persistence failed: ${n}
+`)}}};I.TraceManager=ye});var ft=E(k=>{"use strict";var ut=k&&k.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(k,"__esModule",{value:!0});k.MemorySessionTraceManager=k.DiskSessionTraceManager=void 0;var ct=ut(v("fs")),Fn=ut(v("path")),lt=ve(),Bn=W(),dt=200,Pe=class{tracePath;maxSessions;constructor(t,n={}){this.tracePath=t,this.maxSessions=n.maxSessions??dt}read(){try{let t=JSON.parse(ct.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{ct.default.mkdirSync(Fn.default.dirname(this.tracePath),{recursive:!0});let n=Object.entries(t),r=n.length>this.maxSessions?Object.fromEntries(n.slice(-this.maxSessions)):t;(0,Bn.atomicWriteFileSync)(this.tracePath,JSON.stringify(r))}catch{}}newTrace(t){let n=t||"default",r=(0,lt.generateUlid)(),i=this.read();return i[n]=r,this.write(i),r}currentTrace(t){let n=t||"default",r=this.read()[n];return r||this.newTrace(n)}};k.DiskSessionTraceManager=Pe;var Ee=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??dt}newTrace(t){let n=t||"default",r=(0,lt.generateUlid)();if(this.map.set(n,r),this.map.size>this.maxSessions){let i=this.map.keys().next().value;i!==void 0&&this.map.delete(i)}return r}currentTrace(t){let n=t||"default";return this.map.get(n)??this.newTrace(n)}};k.MemorySessionTraceManager=Ee});var mt=E(D=>{"use strict";var Se=D&&D.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(D,"__esModule",{value:!0});D.envFilePath=Un;D.parseEnvFile=gt;D.loadEnvFile=Yn;var Vn=Se(v("node:fs")),Ln=Se(v("node:os")),pt=Se(v("node:path"));function Un(e,t,n){let r=n?process.env[n]:void 0,i=r&&r.length>0?r:pt.default.join(Ln.default.homedir(),e);return pt.default.join(i,t)}function gt(e){let t={};for(let n of e.split(`
+`)){let r=n.trim();if(!r||r.startsWith("#"))continue;let i=r.indexOf("=");if(i<0)continue;let s=r.slice(0,i).trim(),o=r.slice(i+1).trim();(o.startsWith('"')&&o.endsWith('"')||o.startsWith("'")&&o.endsWith("'"))&&(o=o.slice(1,-1)),s&&(t[s]=o)}return t}function Yn(e){let t;try{t=Vn.default.readFileSync(e,"utf-8")}catch{return}let n=gt(t);for(let[r,i]of Object.entries(n))process.env[r]===void 0&&(process.env[r]=i)}});var O=E(u=>{"use strict";Object.defineProperty(u,"__esModule",{value:!0});u.loadEnvFile=u.parseEnvFile=u.envFilePath=u.MemorySessionTraceManager=u.DiskSessionTraceManager=u.generateUlid=u.TraceManager=u.MAX_POST_BYTES=u.parseHeadersEnv=u.envOptionsResolver=u.postOtlp=u.MemoryTransport=u.DiskTransport=u.MemoryRetryQueue=u.DiskRetryQueue=u.GUARD_BUDGET_HEADER=u.GUARD_STATUS_REFUSED=u.evaluateGuard=u.MAX_SPAN_BYTES=u.enforceSpanBudget=u.mergeBatch=u.attachGuard=u.buildPayload=u.clientAttrs=u.guardAttrs=u.attrsFromRecord=u.toOtlpValue=u.snakeCase=u.newSpanId=u.ulidToTraceId=u.MAX_BYTES=u.PATTERNS=u.applyMatches=u.resolveOverlaps=u.collectMatches=u.truncateTo=u.truncate=u.redact=void 0;var R=ce();Object.defineProperty(u,"redact",{enumerable:!0,get:function(){return R.redact}});Object.defineProperty(u,"truncate",{enumerable:!0,get:function(){return R.truncate}});Object.defineProperty(u,"truncateTo",{enumerable:!0,get:function(){return R.truncateTo}});Object.defineProperty(u,"collectMatches",{enumerable:!0,get:function(){return R.collectMatches}});Object.defineProperty(u,"resolveOverlaps",{enumerable:!0,get:function(){return R.resolveOverlaps}});Object.defineProperty(u,"applyMatches",{enumerable:!0,get:function(){return R.applyMatches}});Object.defineProperty(u,"PATTERNS",{enumerable:!0,get:function(){return R.PATTERNS}});Object.defineProperty(u,"MAX_BYTES",{enumerable:!0,get:function(){return R.MAX_BYTES}});var P=le();Object.defineProperty(u,"ulidToTraceId",{enumerable:!0,get:function(){return P.ulidToTraceId}});Object.defineProperty(u,"newSpanId",{enumerable:!0,get:function(){return P.newSpanId}});Object.defineProperty(u,"snakeCase",{enumerable:!0,get:function(){return P.snakeCase}});Object.defineProperty(u,"toOtlpValue",{enumerable:!0,get:function(){return P.toOtlpValue}});Object.defineProperty(u,"attrsFromRecord",{enumerable:!0,get:function(){return P.attrsFromRecord}});Object.defineProperty(u,"guardAttrs",{enumerable:!0,get:function(){return P.guardAttrs}});Object.defineProperty(u,"clientAttrs",{enumerable:!0,get:function(){return P.clientAttrs}});Object.defineProperty(u,"buildPayload",{enumerable:!0,get:function(){return P.buildPayload}});Object.defineProperty(u,"attachGuard",{enumerable:!0,get:function(){return P.attachGuard}});Object.defineProperty(u,"mergeBatch",{enumerable:!0,get:function(){return P.mergeBatch}});Object.defineProperty(u,"enforceSpanBudget",{enumerable:!0,get:function(){return P.enforceSpanBudget}});Object.defineProperty(u,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return P.MAX_SPAN_BYTES}});var Te=Ze();Object.defineProperty(u,"evaluateGuard",{enumerable:!0,get:function(){return Te.evaluateGuard}});Object.defineProperty(u,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Te.GUARD_STATUS_REFUSED}});Object.defineProperty(u,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return Te.GUARD_BUDGET_HEADER}});var ht=pe();Object.defineProperty(u,"DiskRetryQueue",{enumerable:!0,get:function(){return ht.DiskRetryQueue}});Object.defineProperty(u,"MemoryRetryQueue",{enumerable:!0,get:function(){return ht.MemoryRetryQueue}});var N=st();Object.defineProperty(u,"DiskTransport",{enumerable:!0,get:function(){return N.DiskTransport}});Object.defineProperty(u,"MemoryTransport",{enumerable:!0,get:function(){return N.MemoryTransport}});Object.defineProperty(u,"postOtlp",{enumerable:!0,get:function(){return N.postOtlp}});Object.defineProperty(u,"envOptionsResolver",{enumerable:!0,get:function(){return N.envOptionsResolver}});Object.defineProperty(u,"parseHeadersEnv",{enumerable:!0,get:function(){return N.parseHeadersEnv}});Object.defineProperty(u,"MAX_POST_BYTES",{enumerable:!0,get:function(){return N.MAX_POST_BYTES}});var yt=ve();Object.defineProperty(u,"TraceManager",{enumerable:!0,get:function(){return yt.TraceManager}});Object.defineProperty(u,"generateUlid",{enumerable:!0,get:function(){return yt.generateUlid}});var _t=ft();Object.defineProperty(u,"DiskSessionTraceManager",{enumerable:!0,get:function(){return _t.DiskSessionTraceManager}});Object.defineProperty(u,"MemorySessionTraceManager",{enumerable:!0,get:function(){return _t.MemorySessionTraceManager}});var be=mt();Object.defineProperty(u,"envFilePath",{enumerable:!0,get:function(){return be.envFilePath}});Object.defineProperty(u,"parseEnvFile",{enumerable:!0,get:function(){return be.parseEnvFile}});Object.defineProperty(u,"loadEnvFile",{enumerable:!0,get:function(){return be.loadEnvFile}})});import{realpathSync as Kr}from"node:fs";import{pathToFileURL as Wr}from"node:url";var U=w(O(),1);function Xn(){return(0,U.envFilePath)(".gemini","pinta-gemini.env","GEMINI_HOME")}function vt(e=Xn()){(0,U.loadEnvFile)(e)}var Pt=w(O(),1);import zn from"os";import Oe from"path";function Hn(){return process.env.GEMINI_HOME||Oe.join(zn.homedir(),".gemini")}function Kn(){let e=process.env.GEMINI_PLUGIN_OPTION_ENDPOINT||process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;if(e)return e.replace(/\/+$/,"");let t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT;if(t)return t.replace(/\/+$/,"")+"/v1/traces"}function Wn(){let e=(0,Pt.parseHeadersEnv)(process.env.GEMINI_PLUGIN_OPTION_HEADERS||process.env.OTEL_EXPORTER_OTLP_HEADERS),t=process.env.GEMINI_PLUGIN_OPTION_API_KEY;return t&&!e["x-pinta-relay-token"]&&(e["x-pinta-relay-token"]=t),e}function Et(){let e=process.env.GEMINI_PLUGIN_DATA||Oe.join(Hn(),"pinta-gemini-data");return!process.env.PINTA_RELAY_TOKEN&&process.env.GEMINI_PLUGIN_OPTION_API_KEY&&(process.env.PINTA_RELAY_TOKEN=process.env.GEMINI_PLUGIN_OPTION_API_KEY),{pluginData:e,tracePath:Oe.join(e,"trace.json"),endpoint:Kn(),headers:Wn(),guardEndpoint:process.env.PINTA_GUARD_ENDPOINT}}function St(e=process.argv){let t=n=>{let r=e.indexOf(n);return r>=0?e[r+1]:void 0};return{agent:t("--agent")||"gemini",event:t("--event")}}function Tt(e){let t=e.transcriptPath;if(typeof t=="string"){if(t.includes("/antigravity-cli/brain/"))return"agy";if(t.includes("/antigravity/brain/"))return"antigravity2"}}var h=e=>e==="gemini",Zn={identity:{prefix:"gemini",ingest:"gemini",service:"gemini-cli"},gateEvent:"BeforeTool"},Jn={identity:{prefix:"antigravity",ingest:"antigravity",service:"antigravity-cli"},gateEvent:"PreToolUse"},bt=e=>h(e)?Zn:Jn;function ee(e){return bt(e).identity}function Qn(e){return bt(e).gateEvent}function Ot(e,t){return t===Qn(e)||h(e)&&t==="AfterTool"}var er=new Set(["AfterModel"]),wt=e=>er.has(e);function At(e,t,n){if(h(e))return{hook:t||n.hook_event_name||"unknown",session_id:Y(n.session_id),cwd:Y(n.cwd),tool_name:Y(n.tool_name),tool_input:n.tool_input};let r=n.workspacePaths,i=n.toolCall;return{hook:t||"unknown",session_id:Y(n.conversationId),cwd:Array.isArray(r)?Y(r[0]):void 0,tool_name:i?.name,tool_input:i?.args}}function Y(e){return typeof e=="string"?e:void 0}var Ut=w(O(),1);var kt=w(O(),1);var te="0.13.1";var tr=100,nr=`pinta-gemini/${te}`;function Rt(e,t,n,r){return(0,kt.evaluateGuard)(e,t,{timeoutMs:tr,token:n??process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:nr,agentType:r?ee(r).ingest:void 0})}var x=w(O(),1),ne=class extends x.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-gemini",resolveOptions:()=>t.endpoint?{endpoint:t.endpoint,headers:t.headers}:null})}};function Mt(e,t){if(t.endpoint){if(Buffer.byteLength(JSON.stringify(e),"utf8")>x.MAX_POST_BYTES){process.stderr.write(`[pinta-gemini] deferred telemetry exceeds MAX_POST_BYTES; dropped
+`);return}new x.DiskRetryQueue(t.pluginData,"pinta-gemini").enqueue(e)}}var It=w(O(),1),re=class extends It.DiskSessionTraceManager{constructor(t){super(t.tracePath)}};import ke from"os";import{execFileSync as jt}from"node:child_process";import ie from"node:fs";import $ from"node:path";var rr=new Set(["","unknown","undefined","null","n/a","none","-"]);function Ae(e){let t=typeof e=="string"?e.trim():void 0;return t&&!rr.has(t.toLowerCase())?t:void 0}var ir=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function Nt(e){let t=Ae(e);return t&&ir.test(t)?t:void 0}var sr=["cli_version","cliVersion","gemini_version","geminiVersion","agent_version","agentVersion","app_version","appVersion","version"],or="PINTA_GEMINI_HOST_VERSION",Dt="PINTA_GEMINI_VERSION_PROBE",ar=2e3,cr=/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;function xt(e){return h(e)?["gemini"]:["agy","antigravity","antigravity-cli"]}function ur(e){let t=e;for(let n=0;n<5;n++){try{let i=ie.readFileSync($.join(t,"package.json"),"utf8"),s=Nt(JSON.parse(i).version);if(s)return s}catch{}let r=$.dirname(t);if(r===t)break;t=r}}function lr(e){if(process.env[Dt]==="1")return;let t;try{t=jt(e,["--version"],{encoding:"utf8",timeout:ar,stdio:["ignore","pipe","ignore"],env:{...process.env,[Dt]:"1"}})}catch{return}let n=t.split(/\r?\n/,5).map(r=>r.trim()).filter(Boolean);for(let r of n){let i=Nt(r);if(i)return i}for(let r of n){let i=cr.exec(r);if(i)return i[1]}}function $t(e){let t=e;try{t=ie.realpathSync(e)}catch{}return ur($.dirname(t))??lr(e)}function dr(e){if(process.platform==="win32")return;let t=process.ppid;if(!t||t<=1)return;let n;try{n=jt("ps",["-o","command=","-p",String(t)],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()}catch{return}if(!n)return;let r=xt(e);for(let i of n.split(/\s+/)){if(!i.startsWith("/"))continue;let s=$.basename(i).replace(/\.(js|mjs|cjs)$/,"");if(!r.includes(s))continue;let o=$t(i);if(o)return o}}function fr(e){let t=(process.env.PATH??"").split($.delimiter).filter(Boolean);if(t.length===0)return;let n=process.platform==="win32"?[".cmd",".exe",""]:[""];for(let r of xt(e))for(let i of t)for(let s of n){let o=$.join(i,r+s);try{ie.accessSync(o,ie.constants.X_OK)}catch{continue}let a=$t(o);if(a)return a}}var we;function pr(e){return Ae(process.env[or])??dr(e)??fr(e)??null}function Gt(e,t){if(t)for(let n of sr){let r=Ae(t[n]);if(r)return r}return we===void 0&&(we=pr(e)),we??void 0}var gr=new Set(["unknown","undefined","null","n/a","none","-","auto","default"]);function mr(e){if(typeof e!="string")return;let t=e.trim();if(!(!t||t.startsWith("{")||t.startsWith("[")||gr.has(t.toLowerCase())))return t}function qt(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function G(e,t){let n=mr(e);return n?{model:n,source:t}:void 0}function hr(e,t,n){if(h(e)){if(t==="AfterModel"){let r=qt(n.llm_response),i=G(r?.modelVersion,"response:llm_response.modelVersion")??G(r?.model,"response:llm_response.model");if(i)return i}if(t==="BeforeModel"||t==="BeforeToolSelection"||t==="AfterModel"){let r=G(qt(n.llm_request)?.model,"requested:llm_request.model");if(r)return r}return G(n.model,"reported:model")}return G(n.model,"reported:model")??G(n.modelId,"reported:modelId")}function Ct(e,t,n){let r=hr(e,t,n),{model:i,model_source:s,...o}=n;return"model"in n&&i!==r?.model&&(o.model_raw=i),"model_source"in n&&(o.model_source_raw=s),r&&(o.model=r.model,o.model_source=r.source),o}var M=w(O(),1),Pr=w(O(),1),se;function yr(){if(se===void 0)try{se=ke.userInfo().username}catch{se=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return se}var Ft=te;function _r(e){return{skipRedactKeys:new Set([`${e}.hook`,`${e}.agent`,`${e}.tool_name`,`${e}.session_id`,`${e}.transcript_path`,`${e}.transcriptPath`,`${e}.cwd`]),bashContextKeys:new Set([`${e}.tool_input`,`${e}.tool_response`,`${e}.toolCall`])}}function vr(e,t){return[{key:"service.name",value:{stringValue:e}},...t?[{key:"service.version",value:{stringValue:t}}]:[],{key:"telemetry.sdk.name",value:{stringValue:"pinta-gemini"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:Ft}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:yr()}},{key:"host.name",value:{stringValue:ke.hostname()}},{key:"host.arch",value:{stringValue:ke.arch()}}]}function Bt(e){let t=ee(e.agent),n=_r(t.prefix),r=[{key:"ingest.type",value:{stringValue:t.ingest}},{key:`${t.prefix}.hook`,value:{stringValue:e.canonical.hook}},{key:`${t.prefix}.agent`,value:{stringValue:e.agent}}];e.product&&r.push({key:`${t.prefix}.product`,value:{stringValue:e.product}}),r.push(...(0,M.attrsFromRecord)(Ct(e.agent,e.canonical.hook,e.event),t.prefix,n));let i=new Set(r.map(s=>s.key));for(let[s,o]of[["session_id",e.canonical.session_id],["cwd",e.canonical.cwd],["tool_name",e.canonical.tool_name]]){let a=`${t.prefix}.${s}`;if(o!=null&&!i.has(a)){let c=(0,M.toOtlpValue)(a,String(o),n);c!==null&&r.push({key:a,value:c})}}return(0,M.buildPayload)({traceId:e.traceId,spanName:`${t.ingest}.${(0,M.snakeCase)(e.canonical.hook)}`,attributes:r,resource:vr(t.service,Gt(e.agent,e.event)),scope:{name:"pinta-gemini",version:Ft},now:e.now})}var Er="Pinta withheld this tool output because it violated an active policy.";function Re(e,t,n){if(n&&n.decision==="DENY"){if(h(e)&&t==="AfterTool")return{decision:"deny",reason:Er};let r=n.userMessage??n.reason??"guard_deny";return h(e)?{decision:"deny",reason:r,systemMessage:n.userMessage??void 0}:{decision:"deny",reason:r}}return!h(e)&&t==="PreToolUse"?{decision:"allow"}:{}}import Vt from"fs";import Sr from"path";function Lt(e,t){if(process.env.PINTA_GEMINI_DEBUG==="1")try{Vt.mkdirSync(e.pluginData,{recursive:!0}),Vt.appendFileSync(Sr.join(e.pluginData,"invocations.jsonl"),JSON.stringify(t)+`
+`)}catch{}}async function Tr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}function br(e,t,n){return h(e)?t.hook==="BeforeAgent":t.hook==="PreInvocation"&&n.invocationNum===1}async function Yt(){let{agent:e,event:t}=St(),n={},r={},i,s=null,o=!1,a=Et();try{if(r=JSON.parse(await Tr()||"{}"),i=At(e,t,r),!wt(i.hook)){let c=new ne(a),l=i.session_id??"unknown",f=new re(a),d=br(e,i,r)?f.newTrace(l):f.currentTrace(l),S=h(e)?void 0:Tt(r),T=Bt({agent:e,canonical:i,event:r,traceId:d,product:S});Ot(e,i.hook)&&(s=await Rt(T,a.guardEndpoint,a.headers["x-pinta-relay-token"],e)),n=Re(e,t,s),s?.decision==="DENY"&&(process.stdout.write(JSON.stringify(n)+`
+`),o=!0),(0,Ut.attachGuard)(T,s),s&&h(e)&&i.hook==="AfterTool"&&T.resourceSpans[0].scopeSpans[0].spans[0].attributes.push({key:"pinta.guard.target",value:{stringValue:"tool_output"}}),s?.decision==="DENY"?Mt(T,a):(await c.flush(),await c.send(T))}}catch(c){process.stderr.write(`[pinta-gemini] error: ${c}
+`),n=s?Re(e,t,s):{}}Lt(a,{ts:new Date().toISOString(),pid:process.pid,agent:e,event:t,argv:process.argv.slice(2),received_payload:r,normalized:i??null,guard:s,decision_returned:n}),o||process.stdout.write(JSON.stringify(n)+`
+`),process.exit(0)}import{opendir as Wt,stat as qr}from"node:fs/promises";import{homedir as Cr}from"node:os";import m from"node:path";import{spawn as zt}from"node:child_process";import{access as Or,copyFile as wr,mkdtemp as Ar,rm as kr,stat as Ht}from"node:fs/promises";import{constants as Rr}from"node:fs";import Mr from"node:os";import X from"node:path";var Me,Ir=["/usr/bin/sqlite3","/opt/homebrew/bin/sqlite3","/usr/local/bin/sqlite3"];async function Dr(){for(let t of Ir)try{return await Or(t,Rr.X_OK),t}catch{}return await new Promise(t=>{let n;try{n=zt("sqlite3",["--version"],{stdio:"ignore"})}catch{t(!1);return}n.on("error",()=>t(!1)),n.on("close",r=>t(r===0))})?"sqlite3":null}async function jr(){return Me===void 0&&(Me=await Dr()),Me}async function Nr(e,t,n,r){await new Promise((i,s)=>{let o=zt(e,[t,`.backup '${n}'`],{stdio:["ignore","ignore","pipe"]}),a="",c=!1,l,f=d=>{c||(c=!0,l&&clearTimeout(l),d())};r>0&&(l=setTimeout(()=>{o.kill("SIGKILL"),f(()=>s(new Error(`sqlite3 .backup timed out after ${r}ms: ${t}`)))},r),l.unref?.()),o.stderr?.on("data",d=>{a+=String(d)}),o.on("error",d=>f(()=>s(d))),o.on("close",d=>{f(()=>{d===0?i():s(new Error(`sqlite3 .backup exited ${d}${a?`: ${a.trim()}`:""}`))})})})}async function xr(e){try{let t=await Ht(e);return`${t.mtimeMs}:${t.size}`}catch{return"absent"}}async function Xt(e){let t=new Map;for(let n of e)t.set(n,await xr(n));return t}function $r(e,t){for(let[n,r]of e)if(t.get(n)!==r)return!1;return!0}async function Gr(e,t,n,r){let i=r.minStableMs??2e3,s=r.maxRetries??3,o=r.now??Date.now,a=r.sleep??(d=>new Promise(S=>setTimeout(S,d))),c=r.overallTimeoutMs??6e4,l=o(),f=[e,`${e}-wal`,`${e}-shm`];for(let d=1;d<=s;d++){if(c>0&&o()-l>c)throw new Error(`snapshot quiesce-copy exceeded overall deadline of ${c}ms: ${e}`);let S=await Xt(f);if(S.get(e)==="absent")throw new Error(`snapshot source vanished: ${e}`);let T=0;for(let F of f)try{let tn=await Ht(F);T=Math.max(T,tn.mtimeMs)}catch{}if(o()-T<i){await a(i);continue}for(let F of f)S.get(F)!=="absent"&&await wr(F,X.join(t,X.basename(F)));r.onCopied&&await r.onCopied(d);let en=await Xt(f);if($r(S,en))return n}throw new Error(`snapshot quiesce-copy did not stabilize after ${s} attempts: ${e}`)}async function Kt(e,t={}){let n=t.tmpDirBase??Mr.tmpdir(),r=await Ar(X.join(n,"pinta-gemini-snap-"));try{let i=X.join(r,X.basename(e.absPath)),s=t.sqlite3Path!==void 0?t.sqlite3Path:await jr();return s?(await Nr(s,e.absPath,i,t.overallTimeoutMs??6e4),i):await Gr(e.absPath,r,i,t)}catch(i){throw await kr(r,{recursive:!0,force:!0}).catch(()=>{}),i}}var Fr="pinta-gemini",oe="antigravity";function Br(){let e=process.env.GEMINI_HOME;return e&&e.length>0?e:m.join(Cr(),".gemini")}function q(e,t){return m.relative(e,t).split(m.sep).join("/")}function Zt(e){return e.endsWith("/.system_generated/logs/transcript.jsonl")||e.endsWith("/.system_generated/logs/transcript_full.jsonl")}function Vr(e){return e.endsWith(".jsonl")||e.endsWith(".json")}function Ie(e){let t=m.extname(e);return t?e.slice(0,-t.length):e}async function Jt(){return[Br()]}async function*Qt(e){let t;try{t=await Wt(e)}catch{return}try{for await(let n of t){let r=m.join(e,n.name);n.isDirectory()?yield*Qt(r):n.isFile()&&(yield r)}}catch{return}}async function*C(e){let t;try{t=await Wt(e)}catch{return}try{for await(let n of t)yield{name:n.name,isDir:n.isDirectory(),isFile:n.isFile()}}catch{return}}async function*Lr(e){let t=m.join(e,"tmp");for await(let n of C(t)){if(!n.isDir)continue;let r=n.name,i=m.join(t,r),s=m.join(i,"logs.json");yield{absPath:s,relPath:q(e,s),semantics:"rewritten-doc",projectKey:r};let o=m.join(i,"chats");for await(let a of C(o)){if(!a.isFile||!Vr(a.name))continue;let c=m.join(o,a.name);yield{absPath:c,relPath:q(e,c),semantics:"rewritten-doc",sessionId:Ie(a.name),projectKey:r}}}}async function*Ur(e){let t=m.join(e,"antigravity"),n=m.join(t,"conversations");for await(let s of C(n)){if(!s.isFile||!s.name.endsWith(".db"))continue;let o=m.join(n,s.name);yield{absPath:o,relPath:q(e,o),semantics:"database",sessionId:Ie(s.name),projectKey:oe}}let r=m.join(t,"brain");for await(let s of C(r)){if(!s.isDir)continue;let o=s.name,a=m.join(r,o);for await(let c of Qt(a)){let l=q(e,c);yield{absPath:c,relPath:l,semantics:Zt(l)?"append-log":"rewritten-doc",sessionId:o,projectKey:oe}}}let i=m.join(t,"annotations");for await(let s of C(i)){if(!s.isFile||!s.name.endsWith(".pbtxt"))continue;let o=m.join(i,s.name);yield{absPath:o,relPath:q(e,o),semantics:"rewritten-doc",sessionId:Ie(s.name),projectKey:oe}}for await(let s of C(t))if(s.isFile&&(s.name.endsWith(".pb")||s.name.endsWith(".pbtxt")||s.name==="installation_id")){let o=m.join(t,s.name);yield{absPath:o,relPath:q(e,o),semantics:"rewritten-doc",projectKey:oe}}}async function*Yr(e){yield*Lr(e),yield*Ur(e)}async function*Xr(e){let[t]=await Jt(),n=e.since?.getTime();for await(let r of Yr(t)){let i;try{i=await qr(r.absPath)}catch{continue}i.isFile()&&(n!==void 0&&i.mtime.getTime()<=n||(yield{relPath:r.relPath,absPath:r.absPath,size:i.size,mtime:i.mtime,sessionId:r.sessionId,projectKey:r.projectKey,semantics:r.semantics}))}}function zr(e){let t=e.split("/");if(t[0]==="tmp")return t[2]==="chats"?"session-log":t[2]==="logs.json"&&t.length===3?"meta":"other";if(t[0]==="antigravity")switch(t[1]){case"conversations":return"session-log";case"brain":return Zt(e)?"session-log":"meta";case"annotations":return"meta";default:return"other"}return"other"}var Hr={id:Fr,roots:Jt,scan:Xr,classify:zr,snapshot:e=>Kt(e)};vt();function Zr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===Wr(Kr(e)).href}catch{return!1}}Zr()&&Yt();export{Hr as lifecycle};

package/docs/SPEC.md

@@ -80,7 +80,7 @@
     2. parse argv           --agent, --event
     3. read stdin           raw 이벤트 payload
     4. normalize()          호스트 payload → canonical (snake/camel 흡수)
-    5. guard (gate 이벤트만) PINTA_GUARD_ENDPOINT POST, 50ms, fail-open
+    5. guard (gate 이벤트만) PINTA_GUARD_ENDPOINT POST, 100ms, fail-open
     6. forward()            OTLP span POST (실패 시 retry-queue)
     7. formatDecision()     호스트별 allow/deny JSON
     8. logInvocation()      (DEBUG 시) invocations.jsonl 감사 로그
@@ -144,7 +144,7 @@ guard 평가는 gate 이벤트에서만: gemini=`BeforeTool`, antigravity=`PreTo
 
 - 엔드포인트: `PINTA_GUARD_ENDPOINT` (없으면 guard skip = ALLOW). `PINTA_GUARD_DISABLED=1` 로 비활성.
 - 요청: `POST { "input": { spanId, toolName, toolInput, rawTextFields:{toolInput} } }`, 헤더 `x-pinta-relay-token: $PINTA_RELAY_TOKEN`.
-- 타임아웃 50ms, **fail-open**(timeout/비200/에러 → ALLOW).
+- 타임아웃 100ms, **fail-open**(timeout/비200/에러 → ALLOW). `@pinta-ai/core` 0.9.0+ 는 이 값을 `x-pinta-guard-budget-ms` 헤더로 manager 에 알린다 — manager 는 그 80% 안에 답한다 (PTA-579).
 - 응답: `{ decision:'ALLOW'|'DENY'|'REVIEW', reason, userMessage?, durationMs? }`.
 - MCP/PascalCase 인자도 `rawTextFields.toolInput`(JSON 문자열)에 포함해 정책 매칭 가능하게 한다.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinta-ai/pinta-gemini",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Unified OTLP forwarder + guard adapter for Gemini CLI and Antigravity (agy v1.0.x / 2.0) hooks",
   "type": "module",
   "main": "dist/index.js",
@@ -39,7 +39,7 @@
     "demo": "tsx tools/demo-trace.ts"
   },
   "devDependencies": {
-    "@pinta-ai/core": "^0.8.0",
+    "@pinta-ai/core": "^0.9.2",
     "@types/node": "^22.0.0",
     "esbuild": "^0.24.0",
     "tsx": "^4.0.0",