@pinta-ai/pinta-musecode 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.4.2
+
+### Fixed
+- Return opt-in tool denials without waiting for collector network IO, retaining
+  original redacted evidence through bounded retry-queue persistence (PTA-588).
+- Bundle `@pinta-ai/core` `^0.9.2` to distinguish mysql-family short-password
+  options from ordinary `find -path` and `find -print` arguments (PTA-515).
+
+### Compatibility
+- Default shadow observation is unchanged and is not enforcement. This release
+  does not add native CLI proof or after-tool output blocking.
+- Guard budgets, existing transport limits and guard/export ordering remain
+  unchanged.
+
+## 0.4.1
+
+### Changed
+- `@pinta-ai/core` `^0.8.0` → `^0.9.0`. The guard request now declares this
+  adaptor's own timeout (10s) as `x-pinta-guard-budget-ms`, so the manager
+  bounds its work — the backend package check in particular — by the number
+  the caller actually waits rather than by a copy of it in the manager's repo.
+  The value is unchanged, so the manager's behavior for this adaptor is too;
+  the point is that a future change to `TIMEOUT_MS` needs no manager change.
+
+### Compatibility
+- Pinta Manager 0.1.11 or later remains the guard-payload floor. Managers
+  before 0.1.10 ignore the header.
+
+Refs PTA-579.
+
 ## 0.4.0
 
 ### Changed

package/README.md

@@ -53,6 +53,13 @@ Two properties are load-bearing and both are covered by tests:
 - **Enforce before telemetry.** A DENY is written to stdout *before* any
   telemetry work, so a telemetry failure can never bubble into the top-level
   fail-open catch and silently allow a blocked tool.
+  When enforcement is explicitly enabled, the original masked span is queued
+  to disk rather than waiting for collector ACKs or retry flushing. A later
+  observation/allowed hook drains that queue. Persistence is best-effort and
+  is not a claim that ingestion already completed.
+  The queue uses the existing transport's `MAX_POST_BYTES` UTF-8 JSON budget.
+  Oversized evidence is diagnosed and dropped, never sent as a fallback; a
+  guard-only configuration without telemetry retains no queue entries.
 - **Fail open, always.** No endpoint, a timeout, a non-200, a malformed payload,
   or an unhandled throw all resolve to ALLOW. A security gate must not be able
   to wedge the agent.
@@ -125,6 +132,10 @@ staged rollout expressed in code:
 > **our DENY is the first block a user ever experiences.** One false positive and
 > the hook gets deleted. Measure the false-positive rate in shadow first.
 
+`PostToolUse` remains observation-only: there is no verified native output
+denial contract for this host. The deadline fix does not enable enforcement,
+add new events, or turn a package-stdin test into native-host proof.
+
 ## Confirmed contracts
 
 Verified against **`muse 0.1.0-R708.1`** on macOS by running the adapter as a

package/dist/index.js

@@ -1,26 +1,33 @@
-"use strict";var Et=Object.create;var le=Object.defineProperty;var Pt=Object.getOwnPropertyDescriptor;var St=Object.getOwnPropertyNames;var vt=Object.getPrototypeOf,Tt=Object.prototype.hasOwnProperty;var y=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var bt=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of St(t))!Tt.call(e,o)&&o!==r&&le(e,o,{get:()=>t[o],enumerable:!(n=Pt(t,o))||n.enumerable});return e};var m=(e,t,r)=>(r=e!=null?Et(vt(e)):{},bt(t||!e||!e.__esModule?le(r,"default",{value:e,enumerable:!0}):r,e));var Y=y(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.PATTERNS=d.MAX_BYTES=void 0;d.truncateTo=fe;d.truncate=Ot;d.collectMatches=de;d.resolveOverlaps=pe;d.applyMatches=ge;d.redact=At;d.MAX_BYTES=102400;function fe(e,t){let r=Buffer.from(e,"utf-8");return r.length<=t?e:`${r.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function Ot(e){return fe(e,d.MAX_BYTES)}d.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function de(e,t){let r=[];for(let n of d.PATTERNS){if(n.requireContext&&n.requireContext!==t.context)continue;let o=new RegExp(n.regex.source,n.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=n.captureGroup??0,u=i[a];if(u===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,h=i.index+i[0].length,x=c+i[0].indexOf(u),yt=x+u.length;r.push({start:c,end:h,replaceStart:x,replaceEnd:yt,type:n.type}),i.index===o.lastIndex&&o.lastIndex++}}return r}function pe(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),r=[],n=-1;for(let o of t)o.start<n||(r.push(o),n=o.end);return r}function ge(e,t){let r=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),n=e;for(let o of r)n=n.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+n.slice(o.replaceEnd);return n}function At(e,t={}){if(e.length===0)return e;let r=de(e,t);if(r.length===0)return e;let n=pe(r);return ge(e,n)}});var z=y(f=>{"use strict";var kt=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=ye;f.newSpanId=Ee;f.snakeCase=Mt;f.toOtlpValue=Pe;f.attrsFromRecord=Rt;f.guardAttrs=Se;f.clientAttrs=ve;f.enforceSpanBudget=Te;f.buildPayload=Dt;f.attachGuard=be;f.mergeBatch=jt;var wt=kt(require("crypto")),X=Y(),xt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function ye(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let n of e){let o=xt.indexOf(n);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);t=t<<5n|BigInt(o)}let r=(1n<<128n)-1n;return t&=r,t.toString(16).padStart(32,"0")}function Ee(){return wt.default.randomBytes(8).toString("hex")}function Mt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var _e=new Set;function j(e,t,r){let n=(0,X.truncate)(t);if((r.skipRedactKeys??_e).has(e))return n;let o=(r.bashContextKeys??_e).has(e)?"bash":void 0;return(0,X.redact)(n,{context:o})}function Pe(e,t,r={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:j(e,t,r)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:j(e,JSON.stringify(t),r)}}catch{return{stringValue:j(e,String(t),r)}}default:return{stringValue:j(e,String(t),r)}}}function Rt(e,t,r={}){let n=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,u=Pe(a,i,r);u!==null&&n.push({key:a,value:u})}return n}function Se(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function ve(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function me(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var he=1024;function Te(e,t=f.MAX_SPAN_BYTES){let r=me(e);for(let n=0;n<100&&r>t;n++){let o=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let h=Buffer.byteLength(c.value.stringValue,"utf-8");h>i&&(i=h,o=c.value)}if(o===null||i<=he)break;let a=r-t,u=Math.max(he,i-a-64);o.stringValue=(0,X.truncateTo)(o.stringValue,u),r=me(e)}return e}function Dt(e){let t=e.now??Date.now(),r=(BigInt(t)*1000000n).toString(),n=[...e.attributes],o={traceId:ye(e.traceId),spanId:Ee(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};Te(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return be(i,e.guard,e.clientTiming)}function be(e,t,r){let n=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!n)return e;t&&n.attributes.push(...Se(t));let o=r??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&n.attributes.push(...ve(o)),e}function jt(e){let t=[];for(let r of e)t.push(...r.resourceSpans);return{resourceSpans:t}}});var Oe=y(O=>{"use strict";Object.defineProperty(O,"__esModule",{value:!0});O.GUARD_STATUS_REFUSED=void 0;O.evaluateGuard=Bt;var Nt=1e4,It="pinta-core";function N(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var Ct=new Set(["ALLOW","DENY","REVIEW"]);O.GUARD_STATUS_REFUSED=410;async function Bt(e,t,r={}){if(!t||r.disabled)return null;let n=r.timeoutMs??Nt,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),n);try{let u=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??It,"x-pinta-relay-token":r.token??"",...r.agentType?{"x-pinta-agent-type":r.agentType}:{}},body:JSON.stringify(e),signal:i.signal});if(u.status===O.GUARD_STATUS_REFUSED)return N(Date.now()-o,"refused");if(u.status!==200)return N(Date.now()-o,"error");let c=await u.json(),h=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!Ct.has(c.decision)||!h)return N(Date.now()-o,"error");let x=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??x,clientRttMs:x}}catch(u){let c=u.name,h=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return N(Date.now()-o,h)}finally{clearTimeout(a)}}});var I=y(M=>{"use strict";var Lt=M&&M.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(M,"__esModule",{value:!0});M.atomicWriteFileSync=$t;var Ae=Lt(require("fs"));function $t(e,t){let r=`${e}.${process.pid}.tmp`;Ae.default.writeFileSync(r,t),Ae.default.renameSync(r,e)}});var Z=y(E=>{"use strict";var ke=E&&E.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(E,"__esModule",{value:!0});E.MemoryRetryQueue=E.DiskRetryQueue=void 0;var p=ke(require("fs")),C=ke(require("path")),Ut=I(),B=1e3,qt=50,Ft=5,K=class{filePath;lockPath;logPrefix;constructor(t,r){this.filePath=C.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(t){try{p.default.mkdirSync(C.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;p.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
-`)}}readAll(){try{let t=p.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of t.split(`
-`))if(n.trim())try{let o=JSON.parse(n);Array.isArray(o?.payload?.resourceSpans)&&r.push(o)}catch{}return r}catch{return[]}}rewrite(t){try{if(t.length===0){p.default.existsSync(this.filePath)&&p.default.unlinkSync(this.filePath);return}p.default.mkdirSync(C.default.dirname(this.filePath),{recursive:!0}),(0,Ut.atomicWriteFileSync)(this.filePath,t.map(r=>JSON.stringify(r)).join(`
+"use strict";var Dt=Object.create;var ye=Object.defineProperty;var Rt=Object.getOwnPropertyDescriptor;var xt=Object.getOwnPropertyNames;var jt=Object.getPrototypeOf,Nt=Object.prototype.hasOwnProperty;var y=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var It=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of xt(t))!Nt.call(e,s)&&s!==r&&ye(e,s,{get:()=>t[s],enumerable:!(n=Rt(t,s))||n.enumerable});return e};var g=(e,t,r)=>(r=e!=null?Dt(jt(e)):{},It(t||!e||!e.__esModule?ye(r,"default",{value:e,enumerable:!0}):r,e));var Pe=y(Z=>{"use strict";Object.defineProperty(Z,"__esModule",{value:!0});Z.mysqlPasswordRanges=Ft;var Bt=new Set(["mysql","mysqldump","mysqladmin","mysqlcheck","mysqlimport","mysqlshow","mariadb","mariadb-dump","mariadb-admin","mariadb-check","mariadb-import","mariadb-show"]),Ct=new Set(["sh","bash","dash","zsh","ksh"]),$t=new Set(["-u","--user","-h","--host","-P","--port","-D","--database","-S","--socket","-e","--execute","--protocol","--default-character-set","--defaults-file","--defaults-extra-file","--login-path","--init-command","--ssl-ca","--ssl-capath","--ssl-cert","--ssl-key","--ssl-cipher"]),C=16;function ve(e,t,r=e.value.length){return{value:e.value.slice(t,r),ranges:e.ranges.slice(t,r)}}function j(e,t,r,n){e.value+=t.value.slice(r,n);for(let s=r;s<n;s++)e.ranges.push(t.ranges[s])}function Ee(e){if(e?.literal)return e.value.slice(e.value.lastIndexOf("/")+1).replace(/\.exe$/,"")}function Lt(e){let t=0;for(let r=0;r<=C;r++){for(;/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.value??"");)t++;let n=Ee(e[t]);if(!n)return;if(["!","if","then","elif","else","while","until","do"].includes(n)){t++;continue}let s={env:["-u","--unset","-C","--chdir"],sudo:["-u","--user","-g","--group","-p","--prompt","-D","--chdir","-R","--chroot","-C","--close-from","-T","--command-timeout"],exec:["-a"],nice:["-n","--adjustment"],timeout:["-s","--signal","-k","--kill-after"]},i={env:["-i","--ignore-environment","-0","--null"],sudo:["-n","-E","-H","-S","-b","-k"],command:["-p"],exec:["-c","-l"],nohup:[],nice:[],time:["-p"],timeout:["--foreground","--preserve-status"]};if(!(n in i))return t;for(t++;e[t]?.value.startsWith("-");){let o=e[t++].value;if(o==="--")break;if(!i[n].includes(o)){if((s[n]??[]).includes(o)){if(!e[t++])return;continue}if(!(s[n]??[]).some(u=>u.startsWith("--")?o.startsWith(u+"="):o.startsWith(u)&&o.length>2)&&!(n==="nice"&&/^-\d+$/.test(o)))return}}if(n==="timeout"&&!/^\d+(?:\.\d+)?[smhd]?$/.test(e[t++]?.value??""))return}}function Se(e,t){let r=1,n="";for(let s=t;s<e.length;s++){let i=e[s];if(i==="\\"&&n!=="'"){s++;continue}if(n){i===n&&(n="");continue}if(i==="'"||i==='"')n=i;else if(i==="(")r++;else if(i===")"&&--r===0)return s}return e.length}function qt(e,t,r,n){let s={value:"",ranges:[],start:t,end:t,literal:!0},i="",o=t;for(;o<e.value.length;){let u=e.value[o];if(!i&&/[\s;|&()<>{}]/.test(u))break;if(u===i){i="",o++;continue}if(!i&&(u==="'"||u==='"')){i=u,o++;continue}if(u==="\\"&&i!=="'"){let c=e.value[o+1];if(c===`
+`){o+=2;continue}if(c&&(!i||/[$`"\\]/.test(c))){j(s,e,o+1,o+2),o+=2;continue}}if(i!=="'"&&e.value.startsWith("$(",o)){let c=Se(e.value,o+2);e.value[o+2]!=="("&&n<C&&w(ve(e,o+2,c),r,n+1),j(s,e,o,Math.min(c+1,e.value.length)),s.literal=!1,o=Math.min(c+1,e.value.length);continue}if(u==="`"&&i!=="'"){let c=o+1;for(;c<e.value.length&&e.value[c]!=="`";)c+=e.value[c]==="\\"?2:1;n<C&&w(ve(e,o+1,c),r,n+1),j(s,e,o,Math.min(c+1,e.value.length)),s.literal=!1,o=Math.min(c+1,e.value.length);continue}u==="$"&&i!=="'"&&(s.literal=!1),j(s,e,o,o+1),o++}return s.end=o,s}function Ut(e,t,r,n){let s=Lt(t);if(s===void 0)return;let i=Ee(t[s]);if(Ct.has(i)&&n<C){for(let o=s+1;o<t.length;o++){let u=t[o].value;if(u==="--command"||/^-[a-zA-Z]*c[a-zA-Z]*$/.test(u)){let c=t[o+1];c&&w(c,r,n+1);return}if(!u.startsWith("-")||u==="--")return;(u==="-o"||u==="-O")&&o++}return}if(Bt.has(i))for(let o=s+1;o<t.length;o++){let u=t[o];if(u.value==="--")return;if($t.has(u.value)){o++;continue}u.value.startsWith("-p")&&u.value.length>2&&r.push({start:e.ranges[u.start].start,end:e.ranges[u.end-1].end})}}function w(e,t,r=0){let n=[],s,i=[],o=0,u=()=>{Ut(e,n,t,r),n=[],s=void 0};for(;o<e.value.length;){let c=e.value[o];if(c===`
+`){u(),o++;for(let l of i.splice(0))for(;o<e.value.length;){let v=e.value.indexOf(`
+`,o),x=v<0?e.value.length:v,_e=e.value.slice(o,x);if(o=v<0?x:x+1,(l.stripTabs?_e.replace(/^\t+/,""):_e)===l.delimiter)break}}else if(/\s/.test(c))o++;else if(c==="#"){let l=e.value.indexOf(`
+`,o);o=l<0?e.value.length:l}else if(e.value.startsWith("((",o))u(),o=Math.min(Se(e.value,o+1)+1,e.value.length);else if(/[;|&(){}]/.test(c))u(),o++;else if(c==="<"||c===">")n.at(-1)?.end===o&&/^\d+$/.test(n.at(-1).value)&&n.pop(),s=/^(?:<<<|<<-?|>>|<&|>&|[<>])/.exec(e.value.slice(o))?.[0]??c,o+=s.length;else{let l=qt(e,o,t,r);o=l.end,(s==="<<"||s==="<<-")&&i.push({delimiter:l.value,stripTabs:s==="<<-"}),s||n.push(l),s=void 0}}u()}function Gt(e,t,r){let n={value:"",ranges:[]};for(let s=t+1;s<r-1;s++){if(e.value[s]!=="\\"){j(n,e,s,s+1);continue}let i=s+(e.value[s+1]==="u"?6:2),o=JSON.parse(`"${e.value.slice(s,i)}"`);n.value+=o;for(let u=0;u<o.length;u++)n.ranges.push({start:e.ranges[s].start,end:e.ranges[i-1].end});s=i-1}return n}function Ft(e){let t={value:e,ranges:Array.from({length:e.length},(n,s)=>({start:s,end:s+1}))},r=[];if(/^\s*[{[]/.test(e)){let n;try{n=JSON.parse(e)}catch{return w(t,r),r}if(n!==null&&typeof n=="object"){let s=/"(?:[^"\\]|\\.)*"/g,i;for(;i=s.exec(e);){let o=JSON.parse(i[0]);if(o!=="command"&&o!=="cmd"&&o!=="CommandLine")continue;let u=/^\s*:\s*/.exec(e.slice(s.lastIndex));if(!u)continue;let c=s.lastIndex+u[0].length;if(e[c]!=='"')continue;s.lastIndex=c;let l=s.exec(e);l?.index===c&&w(Gt(t,c,c+l[0].length),r)}}return r}return w(t,r),r}});var K=y(p=>{"use strict";Object.defineProperty(p,"__esModule",{value:!0});p.PATTERNS=p.MAX_BYTES=void 0;p.truncateTo=Te;p.truncate=Xt;p.collectMatches=be;p.resolveOverlaps=Oe;p.applyMatches=Ae;p.redact=Yt;var Vt=Pe();p.MAX_BYTES=102400;function Te(e,t){let r=Buffer.from(e,"utf-8");return r.length<=t?e:`${r.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function Xt(e){return Te(e,p.MAX_BYTES)}p.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function be(e,t){let r=[];for(let n of p.PATTERNS){if(n.requireContext&&n.requireContext!==t.context)continue;if(n.type==="cli_password_short"){for(let{start:o,end:u}of(0,Vt.mysqlPasswordRanges)(e))r.push({start:o,end:u,replaceStart:o,replaceEnd:u,type:n.type,replacement:`-p[REDACTED:${n.type}]`});continue}let s=new RegExp(n.regex.source,n.regex.flags),i;for(;(i=s.exec(e))!==null;){let o=n.captureGroup??0,u=i[o];if(u===void 0){i.index===s.lastIndex&&s.lastIndex++;continue}let c=i.index,l=i.index+i[0].length,v=c+i[0].indexOf(u),x=v+u.length;r.push({start:c,end:l,replaceStart:v,replaceEnd:x,type:n.type}),i.index===s.lastIndex&&s.lastIndex++}}return r}function Oe(e){let t=[...e].sort((s,i)=>s.start!==i.start?s.start-i.start:i.end-i.start-(s.end-s.start)),r=[],n=-1;for(let s of t)s.start<n||(r.push(s),n=s.end);return r}function Ae(e,t){let r=[...t].sort((s,i)=>i.replaceStart-s.replaceStart),n=e;for(let s of r)n=n.slice(0,s.replaceStart)+(s.replacement??`[REDACTED:${s.type}]`)+n.slice(s.replaceEnd);return n}function Yt(e,t={}){if(e.length===0)return e;let r=be(e,t);if(r.length===0)return e;let n=Oe(r);return Ae(e,n)}});var Q=y(d=>{"use strict";var Wt=d&&d.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(d,"__esModule",{value:!0});d.MAX_SPAN_BYTES=void 0;d.ulidToTraceId=De;d.newSpanId=Re;d.snakeCase=Zt;d.toOtlpValue=xe;d.attrsFromRecord=Kt;d.guardAttrs=je;d.clientAttrs=Ne;d.enforceSpanBudget=Ie;d.buildPayload=Jt;d.attachGuard=Be;d.mergeBatch=Qt;var zt=Wt(require("crypto")),J=K(),Ht="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function De(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let n of e){let s=Ht.indexOf(n);if(s<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);t=t<<5n|BigInt(s)}let r=(1n<<128n)-1n;return t&=r,t.toString(16).padStart(32,"0")}function Re(){return zt.default.randomBytes(8).toString("hex")}function Zt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var we=new Set;function $(e,t,r){let n=(0,J.truncate)(t);if((r.skipRedactKeys??we).has(e))return n;let s=(r.bashContextKeys??we).has(e)?"bash":void 0;return(0,J.redact)(n,{context:s})}function xe(e,t,r={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:$(e,t,r)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:$(e,JSON.stringify(t),r)}}catch{return{stringValue:$(e,String(t),r)}}default:return{stringValue:$(e,String(t),r)}}}function Kt(e,t,r={}){let n=[];for(let[s,i]of Object.entries(e)){let o=`${t}.${s}`,u=xe(o,i,r);u!==null&&n.push({key:o,value:u})}return n}function je(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ne(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}d.MAX_SPAN_BYTES=800*1024;function ke(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Me=1024;function Ie(e,t=d.MAX_SPAN_BYTES){let r=ke(e);for(let n=0;n<100&&r>t;n++){let s=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>i&&(i=l,s=c.value)}if(s===null||i<=Me)break;let o=r-t,u=Math.max(Me,i-o-64);s.stringValue=(0,J.truncateTo)(s.stringValue,u),r=ke(e)}return e}function Jt(e){let t=e.now??Date.now(),r=(BigInt(t)*1000000n).toString(),n=[...e.attributes],s={traceId:De(e.traceId),spanId:Re(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};Ie(s);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[s]}]}]};return Be(i,e.guard,e.clientTiming)}function Be(e,t,r){let n=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!n)return e;t&&n.attributes.push(...je(t));let s=r??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return s&&n.attributes.push(...Ne(s)),e}function Qt(e){let t=[];for(let r of e)t.push(...r.resourceSpans);return{resourceSpans:t}}});var Ce=y(E=>{"use strict";Object.defineProperty(E,"__esModule",{value:!0});E.GUARD_STATUS_REFUSED=E.GUARD_BUDGET_HEADER=void 0;E.evaluateGuard=nr;var er=1e4,tr="pinta-core";E.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function L(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var rr=new Set(["ALLOW","DENY","REVIEW"]);E.GUARD_STATUS_REFUSED=410;async function nr(e,t,r={}){if(!t||r.disabled)return null;let n=r.timeoutMs??er,s=Date.now(),i=new AbortController,o=setTimeout(()=>i.abort(),n);try{let u=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??tr,"x-pinta-relay-token":r.token??"",...r.agentType?{"x-pinta-agent-type":r.agentType}:{},...Number.isFinite(n)&&n>0?{[E.GUARD_BUDGET_HEADER]:String(n)}:{}},body:JSON.stringify(e),signal:i.signal});if(u.status===E.GUARD_STATUS_REFUSED)return L(Date.now()-s,"refused");if(u.status!==200)return L(Date.now()-s,"error");let c=await u.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!rr.has(c.decision)||!l)return L(Date.now()-s,"error");let v=Date.now()-s;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??v,clientRttMs:v}}catch(u){let c=u.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return L(Date.now()-s,l)}finally{clearTimeout(o)}}});var q=y(N=>{"use strict";var sr=N&&N.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(N,"__esModule",{value:!0});N.atomicWriteFileSync=or;var $e=sr(require("fs"));function or(e,t){let r=`${e}.${process.pid}.tmp`;$e.default.writeFileSync(r,t),$e.default.renameSync(r,e)}});var re=y(S=>{"use strict";var Le=S&&S.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(S,"__esModule",{value:!0});S.MemoryRetryQueue=S.DiskRetryQueue=void 0;var m=Le(require("fs")),U=Le(require("path")),ir=q(),G=1e3,ar=50,ur=5,ee=class{filePath;lockPath;logPrefix;constructor(t,r){this.filePath=U.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(t){try{m.default.mkdirSync(U.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;m.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
+`)}}readAll(){try{let t=m.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of t.split(`
+`))if(n.trim())try{let s=JSON.parse(n);Array.isArray(s?.payload?.resourceSpans)&&r.push(s)}catch{}return r}catch{return[]}}rewrite(t){try{if(t.length===0){m.default.existsSync(this.filePath)&&m.default.unlinkSync(this.filePath);return}m.default.mkdirSync(U.default.dirname(this.filePath),{recursive:!0}),(0,ir.atomicWriteFileSync)(this.filePath,t.map(r=>JSON.stringify(r)).join(`
 `)+`
 `)}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${r}
-`)}}tryAcquireLock(){let t=Date.now();try{p.default.mkdirSync(C.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
-`),!1}for(;Date.now()-t<qt;)try{let r=p.default.openSync(this.lockPath,"wx");return p.default.writeSync(r,String(process.pid)),p.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
-`),!1;try{let i=p.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){p.default.unlinkSync(this.lockPath);continue}}catch{}let n=Ft,o=Date.now()+n;for(;Date.now()<o;);}return!1}release(){try{p.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=B)return;let r=t.length-B;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
-`),this.rewrite(t.slice(r))}};E.DiskRetryQueue=K;var W=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>B&&this.entries.splice(0,this.entries.length-B)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};E.MemoryRetryQueue=W});var je=y(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Re;l.envOptionsResolver=De;l.postOtlp=R;var we=Z(),xe=z(),Gt=5e3;l.MAX_POST_BYTES=900*1024;function L(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Me(e,t,r){let n=[],o=[],i=[],a=0;for(let u of e){let c=t(u);if(c>r){o.push(u);continue}i.length>0&&a+c>r&&(n.push(i),i=[],a=0),i.push(u),a+=c}return i.length>0&&n.push(i),{chunks:n,oversize:o}}function Re(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let r of e.split(",")){let[n,...o]=r.split("=");n&&o.length>0&&(t[n.trim()]=o.join("=").trim())}return t}function De(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return e?r=e.replace(/\/+$/,""):t&&(r=t.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Re(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function R(e,t,r){let n=new AbortController,o=setTimeout(()=>n.abort(),Gt);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:n.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let u=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${i.status} ${t.endpoint}${u}${a?` body=${a}`:""}
+`)}}tryAcquireLock(){let t=Date.now();try{m.default.mkdirSync(U.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
+`),!1}for(;Date.now()-t<ar;)try{let r=m.default.openSync(this.lockPath,"wx");return m.default.writeSync(r,String(process.pid)),m.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
+`),!1;try{let i=m.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){m.default.unlinkSync(this.lockPath);continue}}catch{}let n=ur,s=Date.now()+n;for(;Date.now()<s;);}return!1}release(){try{m.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=G)return;let r=t.length-G;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
+`),this.rewrite(t.slice(r))}};S.DiskRetryQueue=ee;var te=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>G&&this.entries.splice(0,this.entries.length-G)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};S.MemoryRetryQueue=te});var Xe=y(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.MemoryTransport=f.DiskTransport=f.MAX_POST_BYTES=void 0;f.parseHeadersEnv=Fe;f.envOptionsResolver=Ve;f.postOtlp=I;var qe=re(),Ue=Q(),cr=5e3;f.MAX_POST_BYTES=900*1024;function F(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Ge(e,t,r){let n=[],s=[],i=[],o=0;for(let u of e){let c=t(u);if(c>r){s.push(u);continue}i.length>0&&o+c>r&&(n.push(i),i=[],o=0),i.push(u),o+=c}return i.length>0&&n.push(i),{chunks:n,oversize:s}}function Fe(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let r of e.split(",")){let[n,...s]=r.split("=");n&&s.length>0&&(t[n.trim()]=s.join("=").trim())}return t}function Ve(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return e?r=e.replace(/\/+$/,""):t&&(r=t.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Fe(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function I(e,t,r){let n=new AbortController,s=setTimeout(()=>n.abort(),cr);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:n.signal});if(!i.ok){let o="";try{o=(await i.text()).slice(0,200)}catch{}let u=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${i.status} ${t.endpoint}${u}${o?` body=${o}`:""}
 `),!1}return!0}catch(i){return process.stderr.write(`[${r}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var H=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new we.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??De}async send(t){let r=this.resolveOptions();if(!r||this.dropIfOversized(t))return;await R(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:o}=Me(r,u=>L(u.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...n),a=0;for(let u of n){if(!await R((0,xe.mergeBatch)(u.map(h=>h.payload)),t,this.logPrefix))break;a+=u.length}this.queue.rewrite(i.slice(a))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let r=L(t);return r<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=H;var J=class{queue=new we.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let r=this.resolveOptions();if(!r)return;if(L(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await R(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:o}=Me(r,L,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...n),a=0;for(let u of n){if(!await R((0,xe.mergeBatch)(u),t,this.logPrefix))break;a+=u.length}for(let u of i.slice(a))this.queue.enqueue(u)}};l.MemoryTransport=J});var re=y(v=>{"use strict";var te=v&&v.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(v,"__esModule",{value:!0});v.TraceManager=void 0;v.generateUlid=Ie;var Ne=te(require("fs")),Vt=te(require("path")),Yt=te(require("crypto")),Xt=I(),Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ie(){let e=Date.now(),t="",r=e;for(let i=0;i<10;i++)t=Q[r&31]+t,r=Math.floor(r/32);let n=Yt.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=Q[n[i]&31];for(;o.length<16;)o+=Q[0];return t+o}var ee=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=Ie();return this.save(t),t}currentTrace(){try{let t=Ne.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(t);if(r)return r}catch{}return this.newTrace()}save(t){try{Ne.default.mkdirSync(Vt.default.dirname(this.tracePath),{recursive:!0}),(0,Xt.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
-`)}}};v.TraceManager=ee});var Ue=y(P=>{"use strict";var Be=P&&P.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(P,"__esModule",{value:!0});P.MemorySessionTraceManager=P.DiskSessionTraceManager=void 0;var Ce=Be(require("fs")),zt=Be(require("path")),Le=re(),Kt=I(),$e=200,ne=class{tracePath;maxSessions;constructor(t,r={}){this.tracePath=t,this.maxSessions=r.maxSessions??$e}read(){try{let t=JSON.parse(Ce.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Ce.default.mkdirSync(zt.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(t),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):t;(0,Kt.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(t){let r=t||"default",n=(0,Le.generateUlid)(),o=this.read();return o[r]=n,this.write(o),n}currentTrace(t){let r=t||"default",n=this.read()[r];return n||this.newTrace(r)}};P.DiskSessionTraceManager=ne;var oe=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??$e}newTrace(t){let r=t||"default",n=(0,Le.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return n}currentTrace(t){let r=t||"default";return this.map.get(r)??this.newTrace(r)}};P.MemorySessionTraceManager=oe});var Ge=y(T=>{"use strict";var se=T&&T.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(T,"__esModule",{value:!0});T.envFilePath=Ht;T.parseEnvFile=Fe;T.loadEnvFile=Jt;var Wt=se(require("node:fs")),Zt=se(require("node:os")),qe=se(require("node:path"));function Ht(e,t,r){let n=r?process.env[r]:void 0,o=n&&n.length>0?n:qe.default.join(Zt.default.homedir(),e);return qe.default.join(o,t)}function Fe(e){let t={};for(let r of e.split(`
-`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let o=n.indexOf("=");if(o<0)continue;let i=n.slice(0,o).trim(),a=n.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function Jt(e){let t;try{t=Wt.default.readFileSync(e,"utf-8")}catch{return}let r=Fe(t);for(let[n,o]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=o)}});var b=y(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var S=Y();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return S.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return S.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return S.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return S.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return S.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return S.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return S.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return S.MAX_BYTES}});var _=z();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var Ve=Oe();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Ve.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Ve.GUARD_STATUS_REFUSED}});var Ye=Z();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return Ye.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return Ye.MemoryRetryQueue}});var A=je();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return A.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return A.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return A.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return A.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return A.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return A.MAX_POST_BYTES}});var Xe=re();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return Xe.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return Xe.generateUlid}});var ze=Ue();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return ze.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return ze.MemorySessionTraceManager}});var ie=Ge();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return ie.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return ie.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return ie.loadEnvFile}})});var Ke=m(require("node:os")),$=m(require("node:path")),ae=m(b());var Qt="pinta-musecode.env";function er(){let e=process.env.XDG_CONFIG_HOME;return e&&e.length>0?$.default.join(e,"muse"):$.default.join(Ke.default.homedir(),".config","muse")}function tr(){return $.default.join(er(),Qt)}function We(e=tr()){(0,ae.loadEnvFile)(e)}var Ze=m(require("node:os")),ue=m(require("node:path"));function rr(){return process.env.PINTA_MUSECODE_DATA||process.env.PINTA_PLUGIN_DATA||ue.default.join(Ze.default.homedir(),".pinta","adaptors","pinta-musecode")}function He(){let e=rr();return{pluginData:e,tracePath:ue.default.join(e,"trace.json")}}function Je(){return process.env.PINTA_MUSE_ENFORCE==="1"}function Qe(){return process.env.PINTA_MUSE_LLM_EVENTS==="1"}var nr=["SessionStart","UserPromptSubmit","PreToolUse","PermissionRequest","PostToolUse","PreLLMCall","PostLLMCall","PreCompact","PostCompact","SubagentStart","SubagentStop","Stop"],or=new Set(nr);function sr(e){return or.has(e)}var ir=["hook_event_name","event","hook","hook_event","eventName"];function et(e,t){for(let r of e){let n=r.startsWith("--event=")?r.slice(8):r;if(sr(n))return n}for(let r of ir){let n=t[r];if(typeof n=="string"&&n.length>0)return n}return null}function U(e){return e==="PreToolUse"||e==="PermissionRequest"}function tt(e){return e==="PreLLMCall"||e==="PostLLMCall"}var ar=new Set(["subagent_spawn","subagent_status","subagent_send_message","subagent_cancel","subagent_wait","subagent_read_result"]);function rt(e){return e!==void 0&&ar.has(e)}var dt=m(b());var nt=m(b());var k="0.4.0";var ur=1e4,cr=`pinta-musecode/${k}`;function ot(e,t){return(0,nt.evaluateGuard)(e,t,{timeoutMs:ur,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:cr})}function lr(){let e=process.env.PINTA_MUSE_DENY_FORMAT;return e==="exit2"||e==="json"?e:"auto"}function fr(e,t){return U(e)?{hookSpecificOutput:{hookEventName:e,permissionDecision:"deny",permissionDecisionReason:t}}:{decision:"block",reason:t}}function st(e,t,r={}){let n=r.stdout??(a=>process.stdout.write(a)),o=r.stderr??(a=>process.stderr.write(a)),i=lr();return i==="exit2"?(o(`${t}
-`),{written:!0,exitCode:2}):(n(JSON.stringify(fr(e,t))+`
-`),i==="json"?{written:!0,exitCode:0}:(o(`${t}
-`),{written:!0,exitCode:2}))}var it=m(b()),q=class extends it.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-musecode"})}};var at=m(b()),F=class extends at.TraceManager{constructor(t){super(t.tracePath)}};var V=m(require("node:os"));var dr=new Set(["unknown","undefined","null","n/a","none","-","auto","default"]);function ut(e){if(typeof e!="string")return;let t=e.trim();if(!(!t||t.startsWith("{")||t.startsWith("[")||dr.has(t.toLowerCase())))return t}var w=m(b());var pr="musecode",g="muse",G;function gr(){if(G===void 0)try{G=V.default.userInfo().username}catch{G=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return G}function _r(e){for(let t of["muse_version","version","cli_version"]){let r=e[t];if(typeof r=="string"&&r.length>0)return r}return process.env.MUSE_VERSION??"unknown"}var mr=new Set([`${g}.hook`,`${g}.tool_name`,`${g}.tool_use_id`,`${g}.session_id`,`${g}.cwd`,`${g}.permission_mode`,`${g}.agent_id`,`${g}.agent_type`]),hr=new Set([`${g}.tool_input`,`${g}.tool_response`]),yr={skipRedactKeys:mr,bashContextKeys:hr};function Er(e){let t=[];t.push({key:"ingest.type",value:{stringValue:pr}}),t.push({key:`${g}.hook`,value:{stringValue:e.hook_event_name}});let r={},n=ut(e.model);for(let[o,i]of Object.entries(e))if(o!=="hook_event_name"){if(o==="model"){i!==n&&(r.model_raw=i);continue}if(o==="model_source"){r.model_source_raw=i;continue}r[o]=i}return n&&(r.model=n,r.model_source="reported:model"),t.push(...(0,w.attrsFromRecord)(r,g,yr)),t}function Pr(e){return[{key:"service.name",value:{stringValue:"muse-code"}},{key:"service.version",value:{stringValue:_r(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-musecode"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:k}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:gr()}},{key:"host.name",value:{stringValue:V.default.hostname()}},{key:"host.arch",value:{stringValue:V.default.arch()}}]}function ct(e){return(0,w.buildPayload)({traceId:e.traceId,spanName:`${g}.${(0,w.snakeCase)(e.event.hook_event_name)}`,attributes:Er(e.event),resource:Pr(e.event),scope:{name:"pinta-musecode",version:k},now:e.now})}function ce(e,t,r={}){let n=new F(t),o=r.traceMode==="new"?n.newTrace():n.currentTrace();return ct({event:e,traceId:o})}async function lt(e,t){let r=new q(t);await r.flush(),await r.send(e)}async function Sr(e,t,r={}){await lt(ce(e,t,r),t)}async function D(e,t,r={}){try{await Sr(e,t,r)}catch(n){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${n}
-`)}}async function ft(e,t){try{await lt(e,t)}catch(r){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${r}
-`)}}async function pt(e,t){if(rt(e.tool_name))return await D(e,t),0;let r=ce(e,t),n=await ot(r,process.env.PINTA_GUARD_ENDPOINT),o=0;if(n?.decision==="DENY"&&Je()){let i=n.userMessage??n.reason??"guard_deny";o=st(e.hook_event_name,i).exitCode}return(0,dt.attachGuard)(r,n),await ft(r,t),o}async function gt(e,t){return await D(e,t),0}async function _t(e,t){return await D(e,t,{traceMode:"new"}),0}async function mt(e){return 0}async function vr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}function Tr(e){let t=e.trim();if(t.length===0)return{};try{let r=JSON.parse(t);if(r!==null&&typeof r=="object"&&!Array.isArray(r))return r}catch{}return{}}async function br(e,t){let r=e.hook_event_name;return U(r)?pt(e,t):r==="UserPromptSubmit"?_t(e,t):tt(r)&&!Qe()?mt(e):gt(e,t)}async function ht(e=process.argv.slice(2)){let t=0;try{let r=He(),n=Tr(await vr()),o=et(e,n);if(o===null)return process.stderr.write(`[pinta-musecode] could not resolve hook event name; skipping
-`),0;let i={...n,hook_event_name:o};t=await br(i,r)}catch(r){process.stderr.write(`[pinta-musecode] error: ${r}
-`),t=0}return t}We();async function Or(){let e=await ht();process.exit(e)}Or();
+`),!1}finally{clearTimeout(s)}}var ne=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new qe.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ve}async send(t){let r=this.resolveOptions();if(!r||this.dropIfOversized(t))return;await I(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:s}=Ge(r,u=>F(u.payload),f.MAX_POST_BYTES);s.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${s.length} oversized retry ${s.length===1?"entry":"entries"} (each > ${f.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...n),o=0;for(let u of n){if(!await I((0,Ue.mergeBatch)(u.map(l=>l.payload)),t,this.logPrefix))break;o+=u.length}this.queue.rewrite(i.slice(o))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let r=F(t);return r<=f.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};f.DiskTransport=ne;var se=class{queue=new qe.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let r=this.resolveOptions();if(!r)return;if(F(t)>f.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await I(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:s}=Ge(r,F,f.MAX_POST_BYTES);s.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${s.length} oversized buffered ${s.length===1?"payload":"payloads"} (each > ${f.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...n),o=0;for(let u of n){if(!await I((0,Ue.mergeBatch)(u),t,this.logPrefix))break;o+=u.length}for(let u of i.slice(o))this.queue.enqueue(u)}};f.MemoryTransport=se});var ue=y(O=>{"use strict";var ae=O&&O.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(O,"__esModule",{value:!0});O.TraceManager=void 0;O.generateUlid=We;var Ye=ae(require("fs")),lr=ae(require("path")),fr=ae(require("crypto")),dr=q(),oe="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function We(){let e=Date.now(),t="",r=e;for(let i=0;i<10;i++)t=oe[r&31]+t,r=Math.floor(r/32);let n=fr.default.randomBytes(10),s="";for(let i=0;i<10;i++)s+=oe[n[i]&31];for(;s.length<16;)s+=oe[0];return t+s}var ie=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=We();return this.save(t),t}currentTrace(){try{let t=Ye.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(t);if(r)return r}catch{}return this.newTrace()}save(t){try{Ye.default.mkdirSync(lr.default.dirname(this.tracePath),{recursive:!0}),(0,dr.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
+`)}}};O.TraceManager=ie});var Je=y(P=>{"use strict";var He=P&&P.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(P,"__esModule",{value:!0});P.MemorySessionTraceManager=P.DiskSessionTraceManager=void 0;var ze=He(require("fs")),pr=He(require("path")),Ze=ue(),mr=q(),Ke=200,ce=class{tracePath;maxSessions;constructor(t,r={}){this.tracePath=t,this.maxSessions=r.maxSessions??Ke}read(){try{let t=JSON.parse(ze.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{ze.default.mkdirSync(pr.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(t),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):t;(0,mr.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(t){let r=t||"default",n=(0,Ze.generateUlid)(),s=this.read();return s[r]=n,this.write(s),n}currentTrace(t){let r=t||"default",n=this.read()[r];return n||this.newTrace(r)}};P.DiskSessionTraceManager=ce;var le=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Ke}newTrace(t){let r=t||"default",n=(0,Ze.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let s=this.map.keys().next().value;s!==void 0&&this.map.delete(s)}return n}currentTrace(t){let r=t||"default";return this.map.get(r)??this.newTrace(r)}};P.MemorySessionTraceManager=le});var tt=y(A=>{"use strict";var fe=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.envFilePath=_r;A.parseEnvFile=et;A.loadEnvFile=yr;var hr=fe(require("node:fs")),gr=fe(require("node:os")),Qe=fe(require("node:path"));function _r(e,t,r){let n=r?process.env[r]:void 0,s=n&&n.length>0?n:Qe.default.join(gr.default.homedir(),e);return Qe.default.join(s,t)}function et(e){let t={};for(let r of e.split(`
+`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let s=n.indexOf("=");if(s<0)continue;let i=n.slice(0,s).trim(),o=n.slice(s+1).trim();(o.startsWith('"')&&o.endsWith('"')||o.startsWith("'")&&o.endsWith("'"))&&(o=o.slice(1,-1)),i&&(t[i]=o)}return t}function yr(e){let t;try{t=hr.default.readFileSync(e,"utf-8")}catch{return}let r=et(t);for(let[n,s]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=s)}});var b=y(a=>{"use strict";Object.defineProperty(a,"__esModule",{value:!0});a.loadEnvFile=a.parseEnvFile=a.envFilePath=a.MemorySessionTraceManager=a.DiskSessionTraceManager=a.generateUlid=a.TraceManager=a.MAX_POST_BYTES=a.parseHeadersEnv=a.envOptionsResolver=a.postOtlp=a.MemoryTransport=a.DiskTransport=a.MemoryRetryQueue=a.DiskRetryQueue=a.GUARD_BUDGET_HEADER=a.GUARD_STATUS_REFUSED=a.evaluateGuard=a.MAX_SPAN_BYTES=a.enforceSpanBudget=a.mergeBatch=a.attachGuard=a.buildPayload=a.clientAttrs=a.guardAttrs=a.attrsFromRecord=a.toOtlpValue=a.snakeCase=a.newSpanId=a.ulidToTraceId=a.MAX_BYTES=a.PATTERNS=a.applyMatches=a.resolveOverlaps=a.collectMatches=a.truncateTo=a.truncate=a.redact=void 0;var T=K();Object.defineProperty(a,"redact",{enumerable:!0,get:function(){return T.redact}});Object.defineProperty(a,"truncate",{enumerable:!0,get:function(){return T.truncate}});Object.defineProperty(a,"truncateTo",{enumerable:!0,get:function(){return T.truncateTo}});Object.defineProperty(a,"collectMatches",{enumerable:!0,get:function(){return T.collectMatches}});Object.defineProperty(a,"resolveOverlaps",{enumerable:!0,get:function(){return T.resolveOverlaps}});Object.defineProperty(a,"applyMatches",{enumerable:!0,get:function(){return T.applyMatches}});Object.defineProperty(a,"PATTERNS",{enumerable:!0,get:function(){return T.PATTERNS}});Object.defineProperty(a,"MAX_BYTES",{enumerable:!0,get:function(){return T.MAX_BYTES}});var _=Q();Object.defineProperty(a,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(a,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(a,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(a,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(a,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(a,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(a,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(a,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(a,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(a,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(a,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(a,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var de=Ce();Object.defineProperty(a,"evaluateGuard",{enumerable:!0,get:function(){return de.evaluateGuard}});Object.defineProperty(a,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return de.GUARD_STATUS_REFUSED}});Object.defineProperty(a,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return de.GUARD_BUDGET_HEADER}});var rt=re();Object.defineProperty(a,"DiskRetryQueue",{enumerable:!0,get:function(){return rt.DiskRetryQueue}});Object.defineProperty(a,"MemoryRetryQueue",{enumerable:!0,get:function(){return rt.MemoryRetryQueue}});var k=Xe();Object.defineProperty(a,"DiskTransport",{enumerable:!0,get:function(){return k.DiskTransport}});Object.defineProperty(a,"MemoryTransport",{enumerable:!0,get:function(){return k.MemoryTransport}});Object.defineProperty(a,"postOtlp",{enumerable:!0,get:function(){return k.postOtlp}});Object.defineProperty(a,"envOptionsResolver",{enumerable:!0,get:function(){return k.envOptionsResolver}});Object.defineProperty(a,"parseHeadersEnv",{enumerable:!0,get:function(){return k.parseHeadersEnv}});Object.defineProperty(a,"MAX_POST_BYTES",{enumerable:!0,get:function(){return k.MAX_POST_BYTES}});var nt=ue();Object.defineProperty(a,"TraceManager",{enumerable:!0,get:function(){return nt.TraceManager}});Object.defineProperty(a,"generateUlid",{enumerable:!0,get:function(){return nt.generateUlid}});var st=Je();Object.defineProperty(a,"DiskSessionTraceManager",{enumerable:!0,get:function(){return st.DiskSessionTraceManager}});Object.defineProperty(a,"MemorySessionTraceManager",{enumerable:!0,get:function(){return st.MemorySessionTraceManager}});var pe=tt();Object.defineProperty(a,"envFilePath",{enumerable:!0,get:function(){return pe.envFilePath}});Object.defineProperty(a,"parseEnvFile",{enumerable:!0,get:function(){return pe.parseEnvFile}});Object.defineProperty(a,"loadEnvFile",{enumerable:!0,get:function(){return pe.loadEnvFile}})});var ot=g(require("node:os")),V=g(require("node:path")),me=g(b());var vr="pinta-musecode.env";function Er(){let e=process.env.XDG_CONFIG_HOME;return e&&e.length>0?V.default.join(e,"muse"):V.default.join(ot.default.homedir(),".config","muse")}function Sr(){return V.default.join(Er(),vr)}function it(e=Sr()){(0,me.loadEnvFile)(e)}var at=g(require("node:os")),he=g(require("node:path"));function Pr(){return process.env.PINTA_MUSECODE_DATA||process.env.PINTA_PLUGIN_DATA||he.default.join(at.default.homedir(),".pinta","adaptors","pinta-musecode")}function ut(){let e=Pr();return{pluginData:e,tracePath:he.default.join(e,"trace.json")}}function ct(){return process.env.PINTA_MUSE_ENFORCE==="1"}function lt(){return process.env.PINTA_MUSE_LLM_EVENTS==="1"}var Tr=["SessionStart","UserPromptSubmit","PreToolUse","PermissionRequest","PostToolUse","PreLLMCall","PostLLMCall","PreCompact","PostCompact","SubagentStart","SubagentStop","Stop"],br=new Set(Tr);function Or(e){return br.has(e)}var Ar=["hook_event_name","event","hook","hook_event","eventName"];function ft(e,t){for(let r of e){let n=r.startsWith("--event=")?r.slice(8):r;if(Or(n))return n}for(let r of Ar){let n=t[r];if(typeof n=="string"&&n.length>0)return n}return null}function X(e){return e==="PreToolUse"||e==="PermissionRequest"}function dt(e){return e==="PreLLMCall"||e==="PostLLMCall"}var wr=new Set(["subagent_spawn","subagent_status","subagent_send_message","subagent_cancel","subagent_wait","subagent_read_result"]);function pt(e){return e!==void 0&&wr.has(e)}var bt=g(b());var mt=g(b());var M="0.4.2";var kr=1e4,Mr=`pinta-musecode/${M}`;function ht(e,t){return(0,mt.evaluateGuard)(e,t,{timeoutMs:kr,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Mr})}function Dr(){let e=process.env.PINTA_MUSE_DENY_FORMAT;return e==="exit2"||e==="json"?e:"auto"}function Rr(e,t){return X(e)?{hookSpecificOutput:{hookEventName:e,permissionDecision:"deny",permissionDecisionReason:t}}:{decision:"block",reason:t}}function gt(e,t,r={}){let n=r.stdout??(o=>process.stdout.write(o)),s=r.stderr??(o=>process.stderr.write(o)),i=Dr();return i==="exit2"?(s(`${t}
+`),{written:!0,exitCode:2}):(n(JSON.stringify(Rr(e,t))+`
+`),i==="json"?{written:!0,exitCode:0}:(s(`${t}
+`),{written:!0,exitCode:2}))}var R=g(b());var _t=g(b()),Y=class extends _t.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-musecode"})}};var yt=g(b()),W=class extends yt.TraceManager{constructor(t){super(t.tracePath)}};var H=g(require("node:os"));var xr=new Set(["unknown","undefined","null","n/a","none","-","auto","default"]);function vt(e){if(typeof e!="string")return;let t=e.trim();if(!(!t||t.startsWith("{")||t.startsWith("[")||xr.has(t.toLowerCase())))return t}var D=g(b());var jr="musecode",h="muse",z;function Nr(){if(z===void 0)try{z=H.default.userInfo().username}catch{z=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return z}function Ir(e){for(let t of["muse_version","version","cli_version"]){let r=e[t];if(typeof r=="string"&&r.length>0)return r}return process.env.MUSE_VERSION??"unknown"}var Br=new Set([`${h}.hook`,`${h}.tool_name`,`${h}.tool_use_id`,`${h}.session_id`,`${h}.cwd`,`${h}.permission_mode`,`${h}.agent_id`,`${h}.agent_type`]),Cr=new Set([`${h}.tool_input`,`${h}.tool_response`]),$r={skipRedactKeys:Br,bashContextKeys:Cr};function Lr(e){let t=[];t.push({key:"ingest.type",value:{stringValue:jr}}),t.push({key:`${h}.hook`,value:{stringValue:e.hook_event_name}});let r={},n=vt(e.model);for(let[s,i]of Object.entries(e))if(s!=="hook_event_name"){if(s==="model"){i!==n&&(r.model_raw=i);continue}if(s==="model_source"){r.model_source_raw=i;continue}r[s]=i}return n&&(r.model=n,r.model_source="reported:model"),t.push(...(0,D.attrsFromRecord)(r,h,$r)),t}function qr(e){return[{key:"service.name",value:{stringValue:"muse-code"}},{key:"service.version",value:{stringValue:Ir(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-musecode"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:M}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Nr()}},{key:"host.name",value:{stringValue:H.default.hostname()}},{key:"host.arch",value:{stringValue:H.default.arch()}}]}function Et(e){return(0,D.buildPayload)({traceId:e.traceId,spanName:`${h}.${(0,D.snakeCase)(e.event.hook_event_name)}`,attributes:Lr(e.event),resource:qr(e.event),scope:{name:"pinta-musecode",version:M},now:e.now})}function ge(e,t,r={}){let n=new W(t),s=r.traceMode==="new"?n.newTrace():n.currentTrace();return Et({event:e,traceId:s})}async function St(e,t){let r=new Y(t);await r.flush(),await r.send(e)}async function Ur(e,t,r={}){await St(ge(e,t,r),t)}async function B(e,t,r={}){try{await Ur(e,t,r)}catch(n){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${n}
+`)}}async function Pt(e,t){try{await St(e,t)}catch(r){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${r}
+`)}}function Tt(e,t){try{if(!(0,R.envOptionsResolver)())return;if(Buffer.byteLength(JSON.stringify(e),"utf8")>R.MAX_POST_BYTES){process.stderr.write(`[pinta-musecode] deferred telemetry exceeds MAX_POST_BYTES; dropped
+`);return}new R.DiskRetryQueue(t.pluginData,"pinta-musecode").enqueue(e)}catch(r){process.stderr.write(`[pinta-musecode] telemetry enqueue failed: ${r}
+`)}}async function Ot(e,t){if(pt(e.tool_name))return await B(e,t),0;let r=ge(e,t),n=await ht(r,process.env.PINTA_GUARD_ENDPOINT),s=0,i=n?.decision==="DENY"&&ct();if(i){let o=n.userMessage??n.reason??"guard_deny";s=gt(e.hook_event_name,o).exitCode}try{(0,bt.attachGuard)(r,n),i?Tt(r,t):await Pt(r,t)}catch(o){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${o}
+`)}return s}async function At(e,t){return await B(e,t),0}async function wt(e,t){return await B(e,t,{traceMode:"new"}),0}async function kt(e){return 0}async function Gr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}function Fr(e){let t=e.trim();if(t.length===0)return{};try{let r=JSON.parse(t);if(r!==null&&typeof r=="object"&&!Array.isArray(r))return r}catch{}return{}}async function Vr(e,t){let r=e.hook_event_name;return X(r)?Ot(e,t):r==="UserPromptSubmit"?wt(e,t):dt(r)&&!lt()?kt(e):At(e,t)}async function Mt(e=process.argv.slice(2)){let t=0;try{let r=ut(),n=Fr(await Gr()),s=ft(e,n);if(s===null)return process.stderr.write(`[pinta-musecode] could not resolve hook event name; skipping
+`),0;let i={...n,hook_event_name:s};t=await Vr(i,r)}catch(r){process.stderr.write(`[pinta-musecode] error: ${r}
+`),t=0}return t}it();async function Xr(){let e=await Mt();process.exit(e)}Xr();

package/dist/index.mjs

@@ -1,27 +1,34 @@
 import{createRequire as __pintaCreateRequire}from 'node:module';const require=__pintaCreateRequire(import.meta.url);
-var yt=Object.create;var le=Object.defineProperty;var Et=Object.getOwnPropertyDescriptor;var Pt=Object.getOwnPropertyNames;var St=Object.getPrototypeOf,vt=Object.prototype.hasOwnProperty;var m=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var y=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Tt=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Pt(t))!vt.call(e,o)&&o!==r&&le(e,o,{get:()=>t[o],enumerable:!(n=Et(t,o))||n.enumerable});return e};var O=(e,t,r)=>(r=e!=null?yt(St(e)):{},Tt(t||!e||!e.__esModule?le(r,"default",{value:e,enumerable:!0}):r,e));var V=y(d=>{"use strict";Object.defineProperty(d,"__esModule",{value:!0});d.PATTERNS=d.MAX_BYTES=void 0;d.truncateTo=fe;d.truncate=bt;d.collectMatches=de;d.resolveOverlaps=pe;d.applyMatches=ge;d.redact=Ot;d.MAX_BYTES=102400;function fe(e,t){let r=Buffer.from(e,"utf-8");return r.length<=t?e:`${r.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function bt(e){return fe(e,d.MAX_BYTES)}d.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function de(e,t){let r=[];for(let n of d.PATTERNS){if(n.requireContext&&n.requireContext!==t.context)continue;let o=new RegExp(n.regex.source,n.regex.flags),i;for(;(i=o.exec(e))!==null;){let a=n.captureGroup??0,u=i[a];if(u===void 0){i.index===o.lastIndex&&o.lastIndex++;continue}let c=i.index,h=i.index+i[0].length,M=c+i[0].indexOf(u),ht=M+u.length;r.push({start:c,end:h,replaceStart:M,replaceEnd:ht,type:n.type}),i.index===o.lastIndex&&o.lastIndex++}}return r}function pe(e){let t=[...e].sort((o,i)=>o.start!==i.start?o.start-i.start:i.end-i.start-(o.end-o.start)),r=[],n=-1;for(let o of t)o.start<n||(r.push(o),n=o.end);return r}function ge(e,t){let r=[...t].sort((o,i)=>i.replaceStart-o.replaceStart),n=e;for(let o of r)n=n.slice(0,o.replaceStart)+`[REDACTED:${o.type}]`+n.slice(o.replaceEnd);return n}function Ot(e,t={}){if(e.length===0)return e;let r=de(e,t);if(r.length===0)return e;let n=pe(r);return ge(e,n)}});var X=y(f=>{"use strict";var At=f&&f.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(f,"__esModule",{value:!0});f.MAX_SPAN_BYTES=void 0;f.ulidToTraceId=ye;f.newSpanId=Ee;f.snakeCase=xt;f.toOtlpValue=Pe;f.attrsFromRecord=Mt;f.guardAttrs=Se;f.clientAttrs=ve;f.enforceSpanBudget=Te;f.buildPayload=Rt;f.attachGuard=be;f.mergeBatch=Dt;var kt=At(m("crypto")),Y=V(),wt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function ye(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let n of e){let o=wt.indexOf(n);if(o<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);t=t<<5n|BigInt(o)}let r=(1n<<128n)-1n;return t&=r,t.toString(16).padStart(32,"0")}function Ee(){return kt.default.randomBytes(8).toString("hex")}function xt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var me=new Set;function N(e,t,r){let n=(0,Y.truncate)(t);if((r.skipRedactKeys??me).has(e))return n;let o=(r.bashContextKeys??me).has(e)?"bash":void 0;return(0,Y.redact)(n,{context:o})}function Pe(e,t,r={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:N(e,t,r)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:N(e,JSON.stringify(t),r)}}catch{return{stringValue:N(e,String(t),r)}}default:return{stringValue:N(e,String(t),r)}}}function Mt(e,t,r={}){let n=[];for(let[o,i]of Object.entries(e)){let a=`${t}.${o}`,u=Pe(a,i,r);u!==null&&n.push({key:a,value:u})}return n}function Se(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function ve(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}f.MAX_SPAN_BYTES=800*1024;function _e(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var he=1024;function Te(e,t=f.MAX_SPAN_BYTES){let r=_e(e);for(let n=0;n<100&&r>t;n++){let o=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let h=Buffer.byteLength(c.value.stringValue,"utf-8");h>i&&(i=h,o=c.value)}if(o===null||i<=he)break;let a=r-t,u=Math.max(he,i-a-64);o.stringValue=(0,Y.truncateTo)(o.stringValue,u),r=_e(e)}return e}function Rt(e){let t=e.now??Date.now(),r=(BigInt(t)*1000000n).toString(),n=[...e.attributes],o={traceId:ye(e.traceId),spanId:Ee(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};Te(o);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[o]}]}]};return be(i,e.guard,e.clientTiming)}function be(e,t,r){let n=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!n)return e;t&&n.attributes.push(...Se(t));let o=r??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return o&&n.attributes.push(...ve(o)),e}function Dt(e){let t=[];for(let r of e)t.push(...r.resourceSpans);return{resourceSpans:t}}});var Oe=y(A=>{"use strict";Object.defineProperty(A,"__esModule",{value:!0});A.GUARD_STATUS_REFUSED=void 0;A.evaluateGuard=Ct;var jt=1e4,Nt="pinta-core";function I(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var It=new Set(["ALLOW","DENY","REVIEW"]);A.GUARD_STATUS_REFUSED=410;async function Ct(e,t,r={}){if(!t||r.disabled)return null;let n=r.timeoutMs??jt,o=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),n);try{let u=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??Nt,"x-pinta-relay-token":r.token??"",...r.agentType?{"x-pinta-agent-type":r.agentType}:{}},body:JSON.stringify(e),signal:i.signal});if(u.status===A.GUARD_STATUS_REFUSED)return I(Date.now()-o,"refused");if(u.status!==200)return I(Date.now()-o,"error");let c=await u.json(),h=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!It.has(c.decision)||!h)return I(Date.now()-o,"error");let M=Date.now()-o;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??M,clientRttMs:M}}catch(u){let c=u.name,h=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return I(Date.now()-o,h)}finally{clearTimeout(a)}}});var C=y(R=>{"use strict";var Bt=R&&R.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(R,"__esModule",{value:!0});R.atomicWriteFileSync=Lt;var Ae=Bt(m("fs"));function Lt(e,t){let r=`${e}.${process.pid}.tmp`;Ae.default.writeFileSync(r,t),Ae.default.renameSync(r,e)}});var W=y(E=>{"use strict";var ke=E&&E.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(E,"__esModule",{value:!0});E.MemoryRetryQueue=E.DiskRetryQueue=void 0;var p=ke(m("fs")),B=ke(m("path")),$t=C(),L=1e3,Ut=50,Ft=5,z=class{filePath;lockPath;logPrefix;constructor(t,r){this.filePath=B.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(t){try{p.default.mkdirSync(B.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
-`;p.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
-`)}}readAll(){try{let t=p.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of t.split(`
-`))if(n.trim())try{let o=JSON.parse(n);Array.isArray(o?.payload?.resourceSpans)&&r.push(o)}catch{}return r}catch{return[]}}rewrite(t){try{if(t.length===0){p.default.existsSync(this.filePath)&&p.default.unlinkSync(this.filePath);return}p.default.mkdirSync(B.default.dirname(this.filePath),{recursive:!0}),(0,$t.atomicWriteFileSync)(this.filePath,t.map(r=>JSON.stringify(r)).join(`
+var Mt=Object.create;var ye=Object.defineProperty;var Dt=Object.getOwnPropertyDescriptor;var Rt=Object.getOwnPropertyNames;var xt=Object.getPrototypeOf,jt=Object.prototype.hasOwnProperty;var g=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+e+'" is not supported')});var y=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var Nt=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of Rt(t))!jt.call(e,s)&&s!==r&&ye(e,s,{get:()=>t[s],enumerable:!(n=Dt(t,s))||n.enumerable});return e};var O=(e,t,r)=>(r=e!=null?Mt(xt(e)):{},Nt(t||!e||!e.__esModule?ye(r,"default",{value:e,enumerable:!0}):r,e));var Pe=y(H=>{"use strict";Object.defineProperty(H,"__esModule",{value:!0});H.mysqlPasswordRanges=Gt;var It=new Set(["mysql","mysqldump","mysqladmin","mysqlcheck","mysqlimport","mysqlshow","mariadb","mariadb-dump","mariadb-admin","mariadb-check","mariadb-import","mariadb-show"]),Bt=new Set(["sh","bash","dash","zsh","ksh"]),Ct=new Set(["-u","--user","-h","--host","-P","--port","-D","--database","-S","--socket","-e","--execute","--protocol","--default-character-set","--defaults-file","--defaults-extra-file","--login-path","--init-command","--ssl-ca","--ssl-capath","--ssl-cert","--ssl-key","--ssl-cipher"]),$=16;function ve(e,t,r=e.value.length){return{value:e.value.slice(t,r),ranges:e.ranges.slice(t,r)}}function N(e,t,r,n){e.value+=t.value.slice(r,n);for(let s=r;s<n;s++)e.ranges.push(t.ranges[s])}function Ee(e){if(e?.literal)return e.value.slice(e.value.lastIndexOf("/")+1).replace(/\.exe$/,"")}function $t(e){let t=0;for(let r=0;r<=$;r++){for(;/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.value??"");)t++;let n=Ee(e[t]);if(!n)return;if(["!","if","then","elif","else","while","until","do"].includes(n)){t++;continue}let s={env:["-u","--unset","-C","--chdir"],sudo:["-u","--user","-g","--group","-p","--prompt","-D","--chdir","-R","--chroot","-C","--close-from","-T","--command-timeout"],exec:["-a"],nice:["-n","--adjustment"],timeout:["-s","--signal","-k","--kill-after"]},i={env:["-i","--ignore-environment","-0","--null"],sudo:["-n","-E","-H","-S","-b","-k"],command:["-p"],exec:["-c","-l"],nohup:[],nice:[],time:["-p"],timeout:["--foreground","--preserve-status"]};if(!(n in i))return t;for(t++;e[t]?.value.startsWith("-");){let o=e[t++].value;if(o==="--")break;if(!i[n].includes(o)){if((s[n]??[]).includes(o)){if(!e[t++])return;continue}if(!(s[n]??[]).some(u=>u.startsWith("--")?o.startsWith(u+"="):o.startsWith(u)&&o.length>2)&&!(n==="nice"&&/^-\d+$/.test(o)))return}}if(n==="timeout"&&!/^\d+(?:\.\d+)?[smhd]?$/.test(e[t++]?.value??""))return}}function Se(e,t){let r=1,n="";for(let s=t;s<e.length;s++){let i=e[s];if(i==="\\"&&n!=="'"){s++;continue}if(n){i===n&&(n="");continue}if(i==="'"||i==='"')n=i;else if(i==="(")r++;else if(i===")"&&--r===0)return s}return e.length}function Lt(e,t,r,n){let s={value:"",ranges:[],start:t,end:t,literal:!0},i="",o=t;for(;o<e.value.length;){let u=e.value[o];if(!i&&/[\s;|&()<>{}]/.test(u))break;if(u===i){i="",o++;continue}if(!i&&(u==="'"||u==='"')){i=u,o++;continue}if(u==="\\"&&i!=="'"){let c=e.value[o+1];if(c===`
+`){o+=2;continue}if(c&&(!i||/[$`"\\]/.test(c))){N(s,e,o+1,o+2),o+=2;continue}}if(i!=="'"&&e.value.startsWith("$(",o)){let c=Se(e.value,o+2);e.value[o+2]!=="("&&n<$&&k(ve(e,o+2,c),r,n+1),N(s,e,o,Math.min(c+1,e.value.length)),s.literal=!1,o=Math.min(c+1,e.value.length);continue}if(u==="`"&&i!=="'"){let c=o+1;for(;c<e.value.length&&e.value[c]!=="`";)c+=e.value[c]==="\\"?2:1;n<$&&k(ve(e,o+1,c),r,n+1),N(s,e,o,Math.min(c+1,e.value.length)),s.literal=!1,o=Math.min(c+1,e.value.length);continue}u==="$"&&i!=="'"&&(s.literal=!1),N(s,e,o,o+1),o++}return s.end=o,s}function Ut(e,t,r,n){let s=$t(t);if(s===void 0)return;let i=Ee(t[s]);if(Bt.has(i)&&n<$){for(let o=s+1;o<t.length;o++){let u=t[o].value;if(u==="--command"||/^-[a-zA-Z]*c[a-zA-Z]*$/.test(u)){let c=t[o+1];c&&k(c,r,n+1);return}if(!u.startsWith("-")||u==="--")return;(u==="-o"||u==="-O")&&o++}return}if(It.has(i))for(let o=s+1;o<t.length;o++){let u=t[o];if(u.value==="--")return;if(Ct.has(u.value)){o++;continue}u.value.startsWith("-p")&&u.value.length>2&&r.push({start:e.ranges[u.start].start,end:e.ranges[u.end-1].end})}}function k(e,t,r=0){let n=[],s,i=[],o=0,u=()=>{Ut(e,n,t,r),n=[],s=void 0};for(;o<e.value.length;){let c=e.value[o];if(c===`
+`){u(),o++;for(let l of i.splice(0))for(;o<e.value.length;){let v=e.value.indexOf(`
+`,o),j=v<0?e.value.length:v,_e=e.value.slice(o,j);if(o=v<0?j:j+1,(l.stripTabs?_e.replace(/^\t+/,""):_e)===l.delimiter)break}}else if(/\s/.test(c))o++;else if(c==="#"){let l=e.value.indexOf(`
+`,o);o=l<0?e.value.length:l}else if(e.value.startsWith("((",o))u(),o=Math.min(Se(e.value,o+1)+1,e.value.length);else if(/[;|&(){}]/.test(c))u(),o++;else if(c==="<"||c===">")n.at(-1)?.end===o&&/^\d+$/.test(n.at(-1).value)&&n.pop(),s=/^(?:<<<|<<-?|>>|<&|>&|[<>])/.exec(e.value.slice(o))?.[0]??c,o+=s.length;else{let l=Lt(e,o,t,r);o=l.end,(s==="<<"||s==="<<-")&&i.push({delimiter:l.value,stripTabs:s==="<<-"}),s||n.push(l),s=void 0}}u()}function qt(e,t,r){let n={value:"",ranges:[]};for(let s=t+1;s<r-1;s++){if(e.value[s]!=="\\"){N(n,e,s,s+1);continue}let i=s+(e.value[s+1]==="u"?6:2),o=JSON.parse(`"${e.value.slice(s,i)}"`);n.value+=o;for(let u=0;u<o.length;u++)n.ranges.push({start:e.ranges[s].start,end:e.ranges[i-1].end});s=i-1}return n}function Gt(e){let t={value:e,ranges:Array.from({length:e.length},(n,s)=>({start:s,end:s+1}))},r=[];if(/^\s*[{[]/.test(e)){let n;try{n=JSON.parse(e)}catch{return k(t,r),r}if(n!==null&&typeof n=="object"){let s=/"(?:[^"\\]|\\.)*"/g,i;for(;i=s.exec(e);){let o=JSON.parse(i[0]);if(o!=="command"&&o!=="cmd"&&o!=="CommandLine")continue;let u=/^\s*:\s*/.exec(e.slice(s.lastIndex));if(!u)continue;let c=s.lastIndex+u[0].length;if(e[c]!=='"')continue;s.lastIndex=c;let l=s.exec(e);l?.index===c&&k(qt(t,c,c+l[0].length),r)}}return r}return k(t,r),r}});var Z=y(p=>{"use strict";Object.defineProperty(p,"__esModule",{value:!0});p.PATTERNS=p.MAX_BYTES=void 0;p.truncateTo=Te;p.truncate=Vt;p.collectMatches=be;p.resolveOverlaps=Oe;p.applyMatches=Ae;p.redact=Xt;var Ft=Pe();p.MAX_BYTES=102400;function Te(e,t){let r=Buffer.from(e,"utf-8");return r.length<=t?e:`${r.subarray(0,Math.max(0,t)).toString("utf-8")}\u2026[TRUNCATED:${r.length}]`}function Vt(e){return Te(e,p.MAX_BYTES)}p.PATTERNS=[{type:"aws_access_key",regex:/AKIA[0-9A-Z]{16}/g},{type:"aws_secret_key",regex:/(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,captureGroup:1},{type:"gcp_service_account",regex:/\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g},{type:"github_token",regex:/gh[pousr]_[A-Za-z0-9]{36,}/g},{type:"gitlab_token",regex:/glpat-[A-Za-z0-9_-]{20}/g},{type:"slack_token",regex:/xox[abrsp]-[0-9A-Za-z-]{10,}/g},{type:"openai_key",regex:/sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g},{type:"anthropic_key",regex:/sk-ant-[A-Za-z0-9_-]{50,}/g},{type:"stripe_key",regex:/(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g},{type:"jwt",regex:/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g},{type:"private_key_block",regex:/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g},{type:"bearer_token",regex:/bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi,captureGroup:1},{type:"basic_auth",regex:/basic\s+([A-Za-z0-9+/=]{12,})/gi,captureGroup:1},{type:"db_url_password",regex:/\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,captureGroup:1},{type:"cli_password_flag",regex:/(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,captureGroup:1},{type:"cli_password_short",regex:/\s-p([^\s'"]+)/g,captureGroup:1,requireContext:"bash"},{type:"env_var_secret",regex:/^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,captureGroup:2}];function be(e,t){let r=[];for(let n of p.PATTERNS){if(n.requireContext&&n.requireContext!==t.context)continue;if(n.type==="cli_password_short"){for(let{start:o,end:u}of(0,Ft.mysqlPasswordRanges)(e))r.push({start:o,end:u,replaceStart:o,replaceEnd:u,type:n.type,replacement:`-p[REDACTED:${n.type}]`});continue}let s=new RegExp(n.regex.source,n.regex.flags),i;for(;(i=s.exec(e))!==null;){let o=n.captureGroup??0,u=i[o];if(u===void 0){i.index===s.lastIndex&&s.lastIndex++;continue}let c=i.index,l=i.index+i[0].length,v=c+i[0].indexOf(u),j=v+u.length;r.push({start:c,end:l,replaceStart:v,replaceEnd:j,type:n.type}),i.index===s.lastIndex&&s.lastIndex++}}return r}function Oe(e){let t=[...e].sort((s,i)=>s.start!==i.start?s.start-i.start:i.end-i.start-(s.end-s.start)),r=[],n=-1;for(let s of t)s.start<n||(r.push(s),n=s.end);return r}function Ae(e,t){let r=[...t].sort((s,i)=>i.replaceStart-s.replaceStart),n=e;for(let s of r)n=n.slice(0,s.replaceStart)+(s.replacement??`[REDACTED:${s.type}]`)+n.slice(s.replaceEnd);return n}function Xt(e,t={}){if(e.length===0)return e;let r=be(e,t);if(r.length===0)return e;let n=Oe(r);return Ae(e,n)}});var J=y(d=>{"use strict";var Yt=d&&d.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(d,"__esModule",{value:!0});d.MAX_SPAN_BYTES=void 0;d.ulidToTraceId=De;d.newSpanId=Re;d.snakeCase=Ht;d.toOtlpValue=xe;d.attrsFromRecord=Zt;d.guardAttrs=je;d.clientAttrs=Ne;d.enforceSpanBudget=Ie;d.buildPayload=Kt;d.attachGuard=Be;d.mergeBatch=Jt;var Wt=Yt(g("crypto")),K=Z(),zt="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function De(e){if(e.length!==26)throw new Error(`ulidToTraceId: expected 26 chars, got ${e.length}`);let t=0n;for(let n of e){let s=zt.indexOf(n);if(s<0)throw new Error(`ulidToTraceId: invalid Crockford char "${n}"`);t=t<<5n|BigInt(s)}let r=(1n<<128n)-1n;return t&=r,t.toString(16).padStart(32,"0")}function Re(){return Wt.default.randomBytes(8).toString("hex")}function Ht(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z])([A-Z][a-z])/g,"$1_$2").toLowerCase()}var we=new Set;function L(e,t,r){let n=(0,K.truncate)(t);if((r.skipRedactKeys??we).has(e))return n;let s=(r.bashContextKeys??we).has(e)?"bash":void 0;return(0,K.redact)(n,{context:s})}function xe(e,t,r={}){if(t==null)return null;switch(typeof t){case"string":return{stringValue:L(e,t,r)};case"boolean":return{boolValue:t};case"number":return Number.isInteger(t)?{intValue:t}:{doubleValue:t};case"object":try{return{stringValue:L(e,JSON.stringify(t),r)}}catch{return{stringValue:L(e,String(t),r)}}default:return{stringValue:L(e,String(t),r)}}}function Zt(e,t,r={}){let n=[];for(let[s,i]of Object.entries(e)){let o=`${t}.${s}`,u=xe(o,i,r);u!==null&&n.push({key:o,value:u})}return n}function je(e){let t=[{key:"pinta.guard.decision",value:{stringValue:e.decision.toLowerCase()}},{key:"pinta.guard.duration_ms",value:{intValue:e.durationMs}}];return e.reason&&t.push({key:"pinta.guard.matched_rule",value:{stringValue:e.reason}}),e.failOpenReason&&t.push({key:"pinta.guard.fail_open_reason",value:{stringValue:e.failOpenReason}}),t}function Ne(e){return[{key:"pinta.client.rtt_ms",value:Number.isInteger(e.rttMs)?{intValue:e.rttMs}:{doubleValue:e.rttMs}},{key:"pinta.client.op",value:{stringValue:e.op}}]}d.MAX_SPAN_BYTES=800*1024;function ke(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}var Me=1024;function Ie(e,t=d.MAX_SPAN_BYTES){let r=ke(e);for(let n=0;n<100&&r>t;n++){let s=null,i=0;for(let c of e.attributes){if(!("stringValue"in c.value))continue;let l=Buffer.byteLength(c.value.stringValue,"utf-8");l>i&&(i=l,s=c.value)}if(s===null||i<=Me)break;let o=r-t,u=Math.max(Me,i-o-64);s.stringValue=(0,K.truncateTo)(s.stringValue,u),r=ke(e)}return e}function Kt(e){let t=e.now??Date.now(),r=(BigInt(t)*1000000n).toString(),n=[...e.attributes],s={traceId:De(e.traceId),spanId:Re(),name:e.spanName,kind:e.spanKind??1,startTimeUnixNano:r,endTimeUnixNano:r,attributes:n};Ie(s);let i={resourceSpans:[{resource:{attributes:e.resource},scopeSpans:[{scope:e.scope,spans:[s]}]}]};return Be(i,e.guard,e.clientTiming)}function Be(e,t,r){let n=e.resourceSpans[0]?.scopeSpans[0]?.spans[0];if(!n)return e;t&&n.attributes.push(...je(t));let s=r??(t?.clientRttMs!==void 0?{op:"guard",rttMs:t.clientRttMs}:null);return s&&n.attributes.push(...Ne(s)),e}function Jt(e){let t=[];for(let r of e)t.push(...r.resourceSpans);return{resourceSpans:t}}});var Ce=y(E=>{"use strict";Object.defineProperty(E,"__esModule",{value:!0});E.GUARD_STATUS_REFUSED=E.GUARD_BUDGET_HEADER=void 0;E.evaluateGuard=rr;var Qt=1e4,er="pinta-core";E.GUARD_BUDGET_HEADER="x-pinta-guard-budget-ms";function U(e,t){return{decision:"ALLOW",reason:null,userMessage:null,durationMs:e,clientRttMs:e,failOpenReason:t}}var tr=new Set(["ALLOW","DENY","REVIEW"]);E.GUARD_STATUS_REFUSED=410;async function rr(e,t,r={}){if(!t||r.disabled)return null;let n=r.timeoutMs??Qt,s=Date.now(),i=new AbortController,o=setTimeout(()=>i.abort(),n);try{let u=await fetch(t,{method:"POST",headers:{"content-type":"application/json","user-agent":r.userAgent??er,"x-pinta-relay-token":r.token??"",...r.agentType?{"x-pinta-agent-type":r.agentType}:{},...Number.isFinite(n)&&n>0?{[E.GUARD_BUDGET_HEADER]:String(n)}:{}},body:JSON.stringify(e),signal:i.signal});if(u.status===E.GUARD_STATUS_REFUSED)return U(Date.now()-s,"refused");if(u.status!==200)return U(Date.now()-s,"error");let c=await u.json(),l=c?.durationMs===void 0||typeof c.durationMs=="number"&&Number.isFinite(c.durationMs);if(!c||!tr.has(c.decision)||!l)return U(Date.now()-s,"error");let v=Date.now()-s;return{decision:c.decision,reason:c.reason??null,userMessage:c.userMessage??null,durationMs:c.durationMs??v,clientRttMs:v}}catch(u){let c=u.name,l=c==="AbortError"||c==="TimeoutError"?"timeout":"error";return U(Date.now()-s,l)}finally{clearTimeout(o)}}});var q=y(I=>{"use strict";var nr=I&&I.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(I,"__esModule",{value:!0});I.atomicWriteFileSync=sr;var $e=nr(g("fs"));function sr(e,t){let r=`${e}.${process.pid}.tmp`;$e.default.writeFileSync(r,t),$e.default.renameSync(r,e)}});var te=y(S=>{"use strict";var Le=S&&S.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(S,"__esModule",{value:!0});S.MemoryRetryQueue=S.DiskRetryQueue=void 0;var m=Le(g("fs")),G=Le(g("path")),or=q(),F=1e3,ir=50,ar=5,Q=class{filePath;lockPath;logPrefix;constructor(t,r){this.filePath=G.default.join(t,"failed-spans.jsonl"),this.lockPath=this.filePath+".lock",this.logPrefix=r}enqueue(t){try{m.default.mkdirSync(G.default.dirname(this.filePath),{recursive:!0});let r=JSON.stringify({savedAt:new Date().toISOString(),payload:t})+`
+`;m.default.appendFileSync(this.filePath,r),this.trim()}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue enqueue failed: ${r}
+`)}}readAll(){try{let t=m.default.readFileSync(this.filePath,"utf-8"),r=[];for(let n of t.split(`
+`))if(n.trim())try{let s=JSON.parse(n);Array.isArray(s?.payload?.resourceSpans)&&r.push(s)}catch{}return r}catch{return[]}}rewrite(t){try{if(t.length===0){m.default.existsSync(this.filePath)&&m.default.unlinkSync(this.filePath);return}m.default.mkdirSync(G.default.dirname(this.filePath),{recursive:!0}),(0,or.atomicWriteFileSync)(this.filePath,t.map(r=>JSON.stringify(r)).join(`
 `)+`
 `)}catch(r){process.stderr.write(`[${this.logPrefix}] retry-queue rewrite failed: ${r}
-`)}}tryAcquireLock(){let t=Date.now();try{p.default.mkdirSync(B.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
-`),!1}for(;Date.now()-t<Ut;)try{let r=p.default.openSync(this.lockPath,"wx");return p.default.writeSync(r,String(process.pid)),p.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
-`),!1;try{let i=p.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){p.default.unlinkSync(this.lockPath);continue}}catch{}let n=Ft,o=Date.now()+n;for(;Date.now()<o;);}return!1}release(){try{p.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=L)return;let r=t.length-L;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
-`),this.rewrite(t.slice(r))}};E.DiskRetryQueue=z;var K=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>L&&this.entries.splice(0,this.entries.length-L)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};E.MemoryRetryQueue=K});var je=y(l=>{"use strict";Object.defineProperty(l,"__esModule",{value:!0});l.MemoryTransport=l.DiskTransport=l.MAX_POST_BYTES=void 0;l.parseHeadersEnv=Re;l.envOptionsResolver=De;l.postOtlp=D;var we=W(),xe=X(),qt=5e3;l.MAX_POST_BYTES=900*1024;function $(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Me(e,t,r){let n=[],o=[],i=[],a=0;for(let u of e){let c=t(u);if(c>r){o.push(u);continue}i.length>0&&a+c>r&&(n.push(i),i=[],a=0),i.push(u),a+=c}return i.length>0&&n.push(i),{chunks:n,oversize:o}}function Re(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let r of e.split(",")){let[n,...o]=r.split("=");n&&o.length>0&&(t[n.trim()]=o.join("=").trim())}return t}function De(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return e?r=e.replace(/\/+$/,""):t&&(r=t.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Re(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function D(e,t,r){let n=new AbortController,o=setTimeout(()=>n.abort(),qt);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:n.signal});if(!i.ok){let a="";try{a=(await i.text()).slice(0,200)}catch{}let u=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${i.status} ${t.endpoint}${u}${a?` body=${a}`:""}
+`)}}tryAcquireLock(){let t=Date.now();try{m.default.mkdirSync(G.default.dirname(this.lockPath),{recursive:!0})}catch(r){return process.stderr.write(`[${this.logPrefix}] retry-queue lock mkdir failed: ${r}
+`),!1}for(;Date.now()-t<ir;)try{let r=m.default.openSync(this.lockPath,"wx");return m.default.writeSync(r,String(process.pid)),m.default.closeSync(r),!0}catch(r){if(r?.code!=="EEXIST")return process.stderr.write(`[${this.logPrefix}] retry-queue lock open failed: ${r}
+`),!1;try{let i=m.default.statSync(this.lockPath);if(Date.now()-i.mtimeMs>3e4){m.default.unlinkSync(this.lockPath);continue}}catch{}let n=ar,s=Date.now()+n;for(;Date.now()<s;);}return!1}release(){try{m.default.unlinkSync(this.lockPath)}catch{}}trim(){let t=this.readAll();if(t.length<=F)return;let r=t.length-F;process.stderr.write(`[${this.logPrefix}] retry-queue full, dropping ${r} oldest entries
+`),this.rewrite(t.slice(r))}};S.DiskRetryQueue=Q;var ee=class{entries=[];enqueue(t){this.entries.push(t),this.entries.length>F&&this.entries.splice(0,this.entries.length-F)}drain(){let t=this.entries;return this.entries=[],t}get size(){return this.entries.length}};S.MemoryRetryQueue=ee});var Xe=y(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.MemoryTransport=f.DiskTransport=f.MAX_POST_BYTES=void 0;f.parseHeadersEnv=Fe;f.envOptionsResolver=Ve;f.postOtlp=B;var Ue=te(),qe=J(),ur=5e3;f.MAX_POST_BYTES=900*1024;function V(e){let t=JSON.stringify(e);return t===void 0?0:Buffer.byteLength(t,"utf-8")}function Ge(e,t,r){let n=[],s=[],i=[],o=0;for(let u of e){let c=t(u);if(c>r){s.push(u);continue}i.length>0&&o+c>r&&(n.push(i),i=[],o=0),i.push(u),o+=c}return i.length>0&&n.push(i),{chunks:n,oversize:s}}function Fe(e){if(!e)return{};if(typeof e=="object")return{...e};let t={};for(let r of e.split(",")){let[n,...s]=r.split("=");n&&s.length>0&&(t[n.trim()]=s.join("=").trim())}return t}function Ve(){let e=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,t=process.env.OTEL_EXPORTER_OTLP_ENDPOINT,r;return e?r=e.replace(/\/+$/,""):t&&(r=t.replace(/\/+$/,"")+"/v1/traces"),r?{endpoint:r,headers:Fe(process.env.OTEL_EXPORTER_OTLP_HEADERS)}:null}async function B(e,t,r){let n=new AbortController,s=setTimeout(()=>n.abort(),ur);try{let i=await fetch(t.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...t.headers},body:JSON.stringify(e),signal:n.signal});if(!i.ok){let o="";try{o=(await i.text()).slice(0,200)}catch{}let u=i.status===401||i.status===403?" \u2014 check OTEL_EXPORTER_OTLP_HEADERS (relay token)":i.status===404?" \u2014 check OTEL_EXPORTER_OTLP_TRACES_ENDPOINT path":i.status>=500?" \u2014 collector may be down":"";return process.stderr.write(`[${r}] OTLP POST ${i.status} ${t.endpoint}${u}${o?` body=${o}`:""}
 `),!1}return!0}catch(i){return process.stderr.write(`[${r}] OTLP POST failed: ${i.message??String(i)}
-`),!1}finally{clearTimeout(o)}}var Z=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new we.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??De}async send(t){let r=this.resolveOptions();if(!r||this.dropIfOversized(t))return;await D(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:o}=Me(r,u=>$(u.payload),l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized retry ${o.length===1?"entry":"entries"} (each > ${l.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
-`);let i=[].concat(...n),a=0;for(let u of n){if(!await D((0,xe.mergeBatch)(u.map(h=>h.payload)),t,this.logPrefix))break;a+=u.length}this.queue.rewrite(i.slice(a))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
-`)}finally{this.queue.release()}}dropIfOversized(t){let r=$(t);return r<=l.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
-`),!0)}};l.DiskTransport=Z;var H=class{queue=new we.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let r=this.resolveOptions();if(!r)return;if($(t)>l.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${l.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
-`);return}await D(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:o}=Me(r,$,l.MAX_POST_BYTES);o.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${o.length} oversized buffered ${o.length===1?"payload":"payloads"} (each > ${l.MAX_POST_BYTES} bytes \u2014 undeliverable)
-`);let i=[].concat(...n),a=0;for(let u of n){if(!await D((0,xe.mergeBatch)(u),t,this.logPrefix))break;a+=u.length}for(let u of i.slice(a))this.queue.enqueue(u)}};l.MemoryTransport=H});var te=y(v=>{"use strict";var ee=v&&v.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(v,"__esModule",{value:!0});v.TraceManager=void 0;v.generateUlid=Ie;var Ne=ee(m("fs")),Gt=ee(m("path")),Vt=ee(m("crypto")),Yt=C(),J="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function Ie(){let e=Date.now(),t="",r=e;for(let i=0;i<10;i++)t=J[r&31]+t,r=Math.floor(r/32);let n=Vt.default.randomBytes(10),o="";for(let i=0;i<10;i++)o+=J[n[i]&31];for(;o.length<16;)o+=J[0];return t+o}var Q=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=Ie();return this.save(t),t}currentTrace(){try{let t=Ne.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(t);if(r)return r}catch{}return this.newTrace()}save(t){try{Ne.default.mkdirSync(Gt.default.dirname(this.tracePath),{recursive:!0}),(0,Yt.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
-`)}}};v.TraceManager=Q});var Ue=y(P=>{"use strict";var Be=P&&P.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(P,"__esModule",{value:!0});P.MemorySessionTraceManager=P.DiskSessionTraceManager=void 0;var Ce=Be(m("fs")),Xt=Be(m("path")),Le=te(),zt=C(),$e=200,re=class{tracePath;maxSessions;constructor(t,r={}){this.tracePath=t,this.maxSessions=r.maxSessions??$e}read(){try{let t=JSON.parse(Ce.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{Ce.default.mkdirSync(Xt.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(t),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):t;(0,zt.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(t){let r=t||"default",n=(0,Le.generateUlid)(),o=this.read();return o[r]=n,this.write(o),n}currentTrace(t){let r=t||"default",n=this.read()[r];return n||this.newTrace(r)}};P.DiskSessionTraceManager=re;var ne=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??$e}newTrace(t){let r=t||"default",n=(0,Le.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let o=this.map.keys().next().value;o!==void 0&&this.map.delete(o)}return n}currentTrace(t){let r=t||"default";return this.map.get(r)??this.newTrace(r)}};P.MemorySessionTraceManager=ne});var Ge=y(T=>{"use strict";var oe=T&&T.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(T,"__esModule",{value:!0});T.envFilePath=Zt;T.parseEnvFile=qe;T.loadEnvFile=Ht;var Kt=oe(m("node:fs")),Wt=oe(m("node:os")),Fe=oe(m("node:path"));function Zt(e,t,r){let n=r?process.env[r]:void 0,o=n&&n.length>0?n:Fe.default.join(Wt.default.homedir(),e);return Fe.default.join(o,t)}function qe(e){let t={};for(let r of e.split(`
-`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let o=n.indexOf("=");if(o<0)continue;let i=n.slice(0,o).trim(),a=n.slice(o+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),i&&(t[i]=a)}return t}function Ht(e){let t;try{t=Kt.default.readFileSync(e,"utf-8")}catch{return}let r=qe(t);for(let[n,o]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=o)}});var b=y(s=>{"use strict";Object.defineProperty(s,"__esModule",{value:!0});s.loadEnvFile=s.parseEnvFile=s.envFilePath=s.MemorySessionTraceManager=s.DiskSessionTraceManager=s.generateUlid=s.TraceManager=s.MAX_POST_BYTES=s.parseHeadersEnv=s.envOptionsResolver=s.postOtlp=s.MemoryTransport=s.DiskTransport=s.MemoryRetryQueue=s.DiskRetryQueue=s.GUARD_STATUS_REFUSED=s.evaluateGuard=s.MAX_SPAN_BYTES=s.enforceSpanBudget=s.mergeBatch=s.attachGuard=s.buildPayload=s.clientAttrs=s.guardAttrs=s.attrsFromRecord=s.toOtlpValue=s.snakeCase=s.newSpanId=s.ulidToTraceId=s.MAX_BYTES=s.PATTERNS=s.applyMatches=s.resolveOverlaps=s.collectMatches=s.truncateTo=s.truncate=s.redact=void 0;var S=V();Object.defineProperty(s,"redact",{enumerable:!0,get:function(){return S.redact}});Object.defineProperty(s,"truncate",{enumerable:!0,get:function(){return S.truncate}});Object.defineProperty(s,"truncateTo",{enumerable:!0,get:function(){return S.truncateTo}});Object.defineProperty(s,"collectMatches",{enumerable:!0,get:function(){return S.collectMatches}});Object.defineProperty(s,"resolveOverlaps",{enumerable:!0,get:function(){return S.resolveOverlaps}});Object.defineProperty(s,"applyMatches",{enumerable:!0,get:function(){return S.applyMatches}});Object.defineProperty(s,"PATTERNS",{enumerable:!0,get:function(){return S.PATTERNS}});Object.defineProperty(s,"MAX_BYTES",{enumerable:!0,get:function(){return S.MAX_BYTES}});var _=X();Object.defineProperty(s,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(s,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(s,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(s,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(s,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(s,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(s,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(s,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(s,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(s,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(s,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(s,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var Ve=Oe();Object.defineProperty(s,"evaluateGuard",{enumerable:!0,get:function(){return Ve.evaluateGuard}});Object.defineProperty(s,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return Ve.GUARD_STATUS_REFUSED}});var Ye=W();Object.defineProperty(s,"DiskRetryQueue",{enumerable:!0,get:function(){return Ye.DiskRetryQueue}});Object.defineProperty(s,"MemoryRetryQueue",{enumerable:!0,get:function(){return Ye.MemoryRetryQueue}});var k=je();Object.defineProperty(s,"DiskTransport",{enumerable:!0,get:function(){return k.DiskTransport}});Object.defineProperty(s,"MemoryTransport",{enumerable:!0,get:function(){return k.MemoryTransport}});Object.defineProperty(s,"postOtlp",{enumerable:!0,get:function(){return k.postOtlp}});Object.defineProperty(s,"envOptionsResolver",{enumerable:!0,get:function(){return k.envOptionsResolver}});Object.defineProperty(s,"parseHeadersEnv",{enumerable:!0,get:function(){return k.parseHeadersEnv}});Object.defineProperty(s,"MAX_POST_BYTES",{enumerable:!0,get:function(){return k.MAX_POST_BYTES}});var Xe=te();Object.defineProperty(s,"TraceManager",{enumerable:!0,get:function(){return Xe.TraceManager}});Object.defineProperty(s,"generateUlid",{enumerable:!0,get:function(){return Xe.generateUlid}});var ze=Ue();Object.defineProperty(s,"DiskSessionTraceManager",{enumerable:!0,get:function(){return ze.DiskSessionTraceManager}});Object.defineProperty(s,"MemorySessionTraceManager",{enumerable:!0,get:function(){return ze.MemorySessionTraceManager}});var se=Ge();Object.defineProperty(s,"envFilePath",{enumerable:!0,get:function(){return se.envFilePath}});Object.defineProperty(s,"parseEnvFile",{enumerable:!0,get:function(){return se.parseEnvFile}});Object.defineProperty(s,"loadEnvFile",{enumerable:!0,get:function(){return se.loadEnvFile}})});import{realpathSync as Ar}from"node:fs";import{pathToFileURL as kr}from"node:url";var ae=O(b());import Jt from"node:os";import ie from"node:path";var Qt="pinta-musecode.env";function er(){let e=process.env.XDG_CONFIG_HOME;return e&&e.length>0?ie.join(e,"muse"):ie.join(Jt.homedir(),".config","muse")}function tr(){return ie.join(er(),Qt)}function Ke(e=tr()){(0,ae.loadEnvFile)(e)}import rr from"node:os";import We from"node:path";function nr(){return process.env.PINTA_MUSECODE_DATA||process.env.PINTA_PLUGIN_DATA||We.join(rr.homedir(),".pinta","adaptors","pinta-musecode")}function Ze(){let e=nr();return{pluginData:e,tracePath:We.join(e,"trace.json")}}function He(){return process.env.PINTA_MUSE_ENFORCE==="1"}function Je(){return process.env.PINTA_MUSE_LLM_EVENTS==="1"}var or=["SessionStart","UserPromptSubmit","PreToolUse","PermissionRequest","PostToolUse","PreLLMCall","PostLLMCall","PreCompact","PostCompact","SubagentStart","SubagentStop","Stop"],sr=new Set(or);function ir(e){return sr.has(e)}var ar=["hook_event_name","event","hook","hook_event","eventName"];function Qe(e,t){for(let r of e){let n=r.startsWith("--event=")?r.slice(8):r;if(ir(n))return n}for(let r of ar){let n=t[r];if(typeof n=="string"&&n.length>0)return n}return null}function U(e){return e==="PreToolUse"||e==="PermissionRequest"}function et(e){return e==="PreLLMCall"||e==="PostLLMCall"}var ur=new Set(["subagent_spawn","subagent_status","subagent_send_message","subagent_cancel","subagent_wait","subagent_read_result"]);function tt(e){return e!==void 0&&ur.has(e)}var ft=O(b());var rt=O(b());var w="0.4.0";var cr=1e4,lr=`pinta-musecode/${w}`;function nt(e,t){return(0,rt.evaluateGuard)(e,t,{timeoutMs:cr,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:lr})}function fr(){let e=process.env.PINTA_MUSE_DENY_FORMAT;return e==="exit2"||e==="json"?e:"auto"}function dr(e,t){return U(e)?{hookSpecificOutput:{hookEventName:e,permissionDecision:"deny",permissionDecisionReason:t}}:{decision:"block",reason:t}}function ot(e,t,r={}){let n=r.stdout??(a=>process.stdout.write(a)),o=r.stderr??(a=>process.stderr.write(a)),i=fr();return i==="exit2"?(o(`${t}
-`),{written:!0,exitCode:2}):(n(JSON.stringify(dr(e,t))+`
-`),i==="json"?{written:!0,exitCode:0}:(o(`${t}
-`),{written:!0,exitCode:2}))}var st=O(b()),F=class extends st.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-musecode"})}};var it=O(b()),q=class extends it.TraceManager{constructor(t){super(t.tracePath)}};import ue from"node:os";var pr=new Set(["unknown","undefined","null","n/a","none","-","auto","default"]);function at(e){if(typeof e!="string")return;let t=e.trim();if(!(!t||t.startsWith("{")||t.startsWith("[")||pr.has(t.toLowerCase())))return t}var x=O(b());var gr="musecode",g="muse",G;function mr(){if(G===void 0)try{G=ue.userInfo().username}catch{G=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return G}function _r(e){for(let t of["muse_version","version","cli_version"]){let r=e[t];if(typeof r=="string"&&r.length>0)return r}return process.env.MUSE_VERSION??"unknown"}var hr=new Set([`${g}.hook`,`${g}.tool_name`,`${g}.tool_use_id`,`${g}.session_id`,`${g}.cwd`,`${g}.permission_mode`,`${g}.agent_id`,`${g}.agent_type`]),yr=new Set([`${g}.tool_input`,`${g}.tool_response`]),Er={skipRedactKeys:hr,bashContextKeys:yr};function Pr(e){let t=[];t.push({key:"ingest.type",value:{stringValue:gr}}),t.push({key:`${g}.hook`,value:{stringValue:e.hook_event_name}});let r={},n=at(e.model);for(let[o,i]of Object.entries(e))if(o!=="hook_event_name"){if(o==="model"){i!==n&&(r.model_raw=i);continue}if(o==="model_source"){r.model_source_raw=i;continue}r[o]=i}return n&&(r.model=n,r.model_source="reported:model"),t.push(...(0,x.attrsFromRecord)(r,g,Er)),t}function Sr(e){return[{key:"service.name",value:{stringValue:"muse-code"}},{key:"service.version",value:{stringValue:_r(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-musecode"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:w}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:mr()}},{key:"host.name",value:{stringValue:ue.hostname()}},{key:"host.arch",value:{stringValue:ue.arch()}}]}function ut(e){return(0,x.buildPayload)({traceId:e.traceId,spanName:`${g}.${(0,x.snakeCase)(e.event.hook_event_name)}`,attributes:Pr(e.event),resource:Sr(e.event),scope:{name:"pinta-musecode",version:w},now:e.now})}function ce(e,t,r={}){let n=new q(t),o=r.traceMode==="new"?n.newTrace():n.currentTrace();return ut({event:e,traceId:o})}async function ct(e,t){let r=new F(t);await r.flush(),await r.send(e)}async function vr(e,t,r={}){await ct(ce(e,t,r),t)}async function j(e,t,r={}){try{await vr(e,t,r)}catch(n){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${n}
-`)}}async function lt(e,t){try{await ct(e,t)}catch(r){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${r}
-`)}}async function dt(e,t){if(tt(e.tool_name))return await j(e,t),0;let r=ce(e,t),n=await nt(r,process.env.PINTA_GUARD_ENDPOINT),o=0;if(n?.decision==="DENY"&&He()){let i=n.userMessage??n.reason??"guard_deny";o=ot(e.hook_event_name,i).exitCode}return(0,ft.attachGuard)(r,n),await lt(r,t),o}async function pt(e,t){return await j(e,t),0}async function gt(e,t){return await j(e,t,{traceMode:"new"}),0}async function mt(e){return 0}async function Tr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}function br(e){let t=e.trim();if(t.length===0)return{};try{let r=JSON.parse(t);if(r!==null&&typeof r=="object"&&!Array.isArray(r))return r}catch{}return{}}async function Or(e,t){let r=e.hook_event_name;return U(r)?dt(e,t):r==="UserPromptSubmit"?gt(e,t):et(r)&&!Je()?mt(e):pt(e,t)}async function _t(e=process.argv.slice(2)){let t=0;try{let r=Ze(),n=br(await Tr()),o=Qe(e,n);if(o===null)return process.stderr.write(`[pinta-musecode] could not resolve hook event name; skipping
-`),0;let i={...n,hook_event_name:o};t=await Or(i,r)}catch(r){process.stderr.write(`[pinta-musecode] error: ${r}
-`),t=0}return t}Ke();function wr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===kr(Ar(e)).href}catch{return!1}}async function xr(){let e=await _t();process.exit(e)}wr()&&xr();
+`),!1}finally{clearTimeout(s)}}var re=class{queue;logPrefix;resolveOptions;constructor(t){this.queue=new Ue.DiskRetryQueue(t.pluginData,t.logPrefix),this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions??Ve}async send(t){let r=this.resolveOptions();if(!r||this.dropIfOversized(t))return;await B(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(t&&this.queue.tryAcquireLock())try{let r=this.queue.readAll();if(r.length===0)return;let{chunks:n,oversize:s}=Ge(r,u=>V(u.payload),f.MAX_POST_BYTES);s.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${s.length} oversized retry ${s.length===1?"entry":"entries"} (each > ${f.MAX_POST_BYTES} bytes \u2014 the backend caps the request body, so they can never be delivered)
+`);let i=[].concat(...n),o=0;for(let u of n){if(!await B((0,qe.mergeBatch)(u.map(l=>l.payload)),t,this.logPrefix))break;o+=u.length}this.queue.rewrite(i.slice(o))}catch(r){process.stderr.write(`[${this.logPrefix}] flush failed: ${r?.message??String(r)}
+`)}finally{this.queue.release()}}dropIfOversized(t){let r=V(t);return r<=f.MAX_POST_BYTES?!1:(process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (${r} > ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not queued
+`),!0)}};f.DiskTransport=re;var ne=class{queue=new Ue.MemoryRetryQueue;logPrefix;resolveOptions;constructor(t){this.logPrefix=t.logPrefix,this.resolveOptions=t.resolveOptions}async send(t){let r=this.resolveOptions();if(!r)return;if(V(t)>f.MAX_POST_BYTES){process.stderr.write(`[${this.logPrefix}] dropping oversized span payload (> ${f.MAX_POST_BYTES} bytes) \u2014 undeliverable, not buffered
+`);return}await B(t,r,this.logPrefix)||this.queue.enqueue(t)}async flush(){let t=this.resolveOptions();if(!t)return;let r=this.queue.drain();if(r.length===0)return;let{chunks:n,oversize:s}=Ge(r,V,f.MAX_POST_BYTES);s.length>0&&process.stderr.write(`[${this.logPrefix}] dropping ${s.length} oversized buffered ${s.length===1?"payload":"payloads"} (each > ${f.MAX_POST_BYTES} bytes \u2014 undeliverable)
+`);let i=[].concat(...n),o=0;for(let u of n){if(!await B((0,qe.mergeBatch)(u),t,this.logPrefix))break;o+=u.length}for(let u of i.slice(o))this.queue.enqueue(u)}};f.MemoryTransport=ne});var ae=y(A=>{"use strict";var ie=A&&A.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(A,"__esModule",{value:!0});A.TraceManager=void 0;A.generateUlid=We;var Ye=ie(g("fs")),cr=ie(g("path")),lr=ie(g("crypto")),fr=q(),se="0123456789ABCDEFGHJKMNPQRSTVWXYZ";function We(){let e=Date.now(),t="",r=e;for(let i=0;i<10;i++)t=se[r&31]+t,r=Math.floor(r/32);let n=lr.default.randomBytes(10),s="";for(let i=0;i<10;i++)s+=se[n[i]&31];for(;s.length<16;)s+=se[0];return t+s}var oe=class{tracePath;constructor(t){this.tracePath=t}newTrace(){let t=We();return this.save(t),t}currentTrace(){try{let t=Ye.default.readFileSync(this.tracePath,"utf-8"),{traceId:r}=JSON.parse(t);if(r)return r}catch{}return this.newTrace()}save(t){try{Ye.default.mkdirSync(cr.default.dirname(this.tracePath),{recursive:!0}),(0,fr.atomicWriteFileSync)(this.tracePath,JSON.stringify({traceId:t}))}catch(r){process.stderr.write(`[pinta-core] trace persistence failed: ${r}
+`)}}};A.TraceManager=oe});var Je=y(P=>{"use strict";var He=P&&P.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(P,"__esModule",{value:!0});P.MemorySessionTraceManager=P.DiskSessionTraceManager=void 0;var ze=He(g("fs")),dr=He(g("path")),Ze=ae(),pr=q(),Ke=200,ue=class{tracePath;maxSessions;constructor(t,r={}){this.tracePath=t,this.maxSessions=r.maxSessions??Ke}read(){try{let t=JSON.parse(ze.default.readFileSync(this.tracePath,"utf-8"));if(t&&typeof t=="object"&&!("traceId"in t))return t}catch{}return{}}write(t){try{ze.default.mkdirSync(dr.default.dirname(this.tracePath),{recursive:!0});let r=Object.entries(t),n=r.length>this.maxSessions?Object.fromEntries(r.slice(-this.maxSessions)):t;(0,pr.atomicWriteFileSync)(this.tracePath,JSON.stringify(n))}catch{}}newTrace(t){let r=t||"default",n=(0,Ze.generateUlid)(),s=this.read();return s[r]=n,this.write(s),n}currentTrace(t){let r=t||"default",n=this.read()[r];return n||this.newTrace(r)}};P.DiskSessionTraceManager=ue;var ce=class{map=new Map;maxSessions;constructor(t={}){this.maxSessions=t.maxSessions??Ke}newTrace(t){let r=t||"default",n=(0,Ze.generateUlid)();if(this.map.set(r,n),this.map.size>this.maxSessions){let s=this.map.keys().next().value;s!==void 0&&this.map.delete(s)}return n}currentTrace(t){let r=t||"default";return this.map.get(r)??this.newTrace(r)}};P.MemorySessionTraceManager=ce});var tt=y(w=>{"use strict";var le=w&&w.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(w,"__esModule",{value:!0});w.envFilePath=gr;w.parseEnvFile=et;w.loadEnvFile=_r;var mr=le(g("node:fs")),hr=le(g("node:os")),Qe=le(g("node:path"));function gr(e,t,r){let n=r?process.env[r]:void 0,s=n&&n.length>0?n:Qe.default.join(hr.default.homedir(),e);return Qe.default.join(s,t)}function et(e){let t={};for(let r of e.split(`
+`)){let n=r.trim();if(!n||n.startsWith("#"))continue;let s=n.indexOf("=");if(s<0)continue;let i=n.slice(0,s).trim(),o=n.slice(s+1).trim();(o.startsWith('"')&&o.endsWith('"')||o.startsWith("'")&&o.endsWith("'"))&&(o=o.slice(1,-1)),i&&(t[i]=o)}return t}function _r(e){let t;try{t=mr.default.readFileSync(e,"utf-8")}catch{return}let r=et(t);for(let[n,s]of Object.entries(r))process.env[n]===void 0&&(process.env[n]=s)}});var b=y(a=>{"use strict";Object.defineProperty(a,"__esModule",{value:!0});a.loadEnvFile=a.parseEnvFile=a.envFilePath=a.MemorySessionTraceManager=a.DiskSessionTraceManager=a.generateUlid=a.TraceManager=a.MAX_POST_BYTES=a.parseHeadersEnv=a.envOptionsResolver=a.postOtlp=a.MemoryTransport=a.DiskTransport=a.MemoryRetryQueue=a.DiskRetryQueue=a.GUARD_BUDGET_HEADER=a.GUARD_STATUS_REFUSED=a.evaluateGuard=a.MAX_SPAN_BYTES=a.enforceSpanBudget=a.mergeBatch=a.attachGuard=a.buildPayload=a.clientAttrs=a.guardAttrs=a.attrsFromRecord=a.toOtlpValue=a.snakeCase=a.newSpanId=a.ulidToTraceId=a.MAX_BYTES=a.PATTERNS=a.applyMatches=a.resolveOverlaps=a.collectMatches=a.truncateTo=a.truncate=a.redact=void 0;var T=Z();Object.defineProperty(a,"redact",{enumerable:!0,get:function(){return T.redact}});Object.defineProperty(a,"truncate",{enumerable:!0,get:function(){return T.truncate}});Object.defineProperty(a,"truncateTo",{enumerable:!0,get:function(){return T.truncateTo}});Object.defineProperty(a,"collectMatches",{enumerable:!0,get:function(){return T.collectMatches}});Object.defineProperty(a,"resolveOverlaps",{enumerable:!0,get:function(){return T.resolveOverlaps}});Object.defineProperty(a,"applyMatches",{enumerable:!0,get:function(){return T.applyMatches}});Object.defineProperty(a,"PATTERNS",{enumerable:!0,get:function(){return T.PATTERNS}});Object.defineProperty(a,"MAX_BYTES",{enumerable:!0,get:function(){return T.MAX_BYTES}});var _=J();Object.defineProperty(a,"ulidToTraceId",{enumerable:!0,get:function(){return _.ulidToTraceId}});Object.defineProperty(a,"newSpanId",{enumerable:!0,get:function(){return _.newSpanId}});Object.defineProperty(a,"snakeCase",{enumerable:!0,get:function(){return _.snakeCase}});Object.defineProperty(a,"toOtlpValue",{enumerable:!0,get:function(){return _.toOtlpValue}});Object.defineProperty(a,"attrsFromRecord",{enumerable:!0,get:function(){return _.attrsFromRecord}});Object.defineProperty(a,"guardAttrs",{enumerable:!0,get:function(){return _.guardAttrs}});Object.defineProperty(a,"clientAttrs",{enumerable:!0,get:function(){return _.clientAttrs}});Object.defineProperty(a,"buildPayload",{enumerable:!0,get:function(){return _.buildPayload}});Object.defineProperty(a,"attachGuard",{enumerable:!0,get:function(){return _.attachGuard}});Object.defineProperty(a,"mergeBatch",{enumerable:!0,get:function(){return _.mergeBatch}});Object.defineProperty(a,"enforceSpanBudget",{enumerable:!0,get:function(){return _.enforceSpanBudget}});Object.defineProperty(a,"MAX_SPAN_BYTES",{enumerable:!0,get:function(){return _.MAX_SPAN_BYTES}});var fe=Ce();Object.defineProperty(a,"evaluateGuard",{enumerable:!0,get:function(){return fe.evaluateGuard}});Object.defineProperty(a,"GUARD_STATUS_REFUSED",{enumerable:!0,get:function(){return fe.GUARD_STATUS_REFUSED}});Object.defineProperty(a,"GUARD_BUDGET_HEADER",{enumerable:!0,get:function(){return fe.GUARD_BUDGET_HEADER}});var rt=te();Object.defineProperty(a,"DiskRetryQueue",{enumerable:!0,get:function(){return rt.DiskRetryQueue}});Object.defineProperty(a,"MemoryRetryQueue",{enumerable:!0,get:function(){return rt.MemoryRetryQueue}});var M=Xe();Object.defineProperty(a,"DiskTransport",{enumerable:!0,get:function(){return M.DiskTransport}});Object.defineProperty(a,"MemoryTransport",{enumerable:!0,get:function(){return M.MemoryTransport}});Object.defineProperty(a,"postOtlp",{enumerable:!0,get:function(){return M.postOtlp}});Object.defineProperty(a,"envOptionsResolver",{enumerable:!0,get:function(){return M.envOptionsResolver}});Object.defineProperty(a,"parseHeadersEnv",{enumerable:!0,get:function(){return M.parseHeadersEnv}});Object.defineProperty(a,"MAX_POST_BYTES",{enumerable:!0,get:function(){return M.MAX_POST_BYTES}});var nt=ae();Object.defineProperty(a,"TraceManager",{enumerable:!0,get:function(){return nt.TraceManager}});Object.defineProperty(a,"generateUlid",{enumerable:!0,get:function(){return nt.generateUlid}});var st=Je();Object.defineProperty(a,"DiskSessionTraceManager",{enumerable:!0,get:function(){return st.DiskSessionTraceManager}});Object.defineProperty(a,"MemorySessionTraceManager",{enumerable:!0,get:function(){return st.MemorySessionTraceManager}});var de=tt();Object.defineProperty(a,"envFilePath",{enumerable:!0,get:function(){return de.envFilePath}});Object.defineProperty(a,"parseEnvFile",{enumerable:!0,get:function(){return de.parseEnvFile}});Object.defineProperty(a,"loadEnvFile",{enumerable:!0,get:function(){return de.loadEnvFile}})});import{realpathSync as Yr}from"node:fs";import{pathToFileURL as Wr}from"node:url";var me=O(b());import yr from"node:os";import pe from"node:path";var vr="pinta-musecode.env";function Er(){let e=process.env.XDG_CONFIG_HOME;return e&&e.length>0?pe.join(e,"muse"):pe.join(yr.homedir(),".config","muse")}function Sr(){return pe.join(Er(),vr)}function ot(e=Sr()){(0,me.loadEnvFile)(e)}import Pr from"node:os";import it from"node:path";function Tr(){return process.env.PINTA_MUSECODE_DATA||process.env.PINTA_PLUGIN_DATA||it.join(Pr.homedir(),".pinta","adaptors","pinta-musecode")}function at(){let e=Tr();return{pluginData:e,tracePath:it.join(e,"trace.json")}}function ut(){return process.env.PINTA_MUSE_ENFORCE==="1"}function ct(){return process.env.PINTA_MUSE_LLM_EVENTS==="1"}var br=["SessionStart","UserPromptSubmit","PreToolUse","PermissionRequest","PostToolUse","PreLLMCall","PostLLMCall","PreCompact","PostCompact","SubagentStart","SubagentStop","Stop"],Or=new Set(br);function Ar(e){return Or.has(e)}var wr=["hook_event_name","event","hook","hook_event","eventName"];function lt(e,t){for(let r of e){let n=r.startsWith("--event=")?r.slice(8):r;if(Ar(n))return n}for(let r of wr){let n=t[r];if(typeof n=="string"&&n.length>0)return n}return null}function X(e){return e==="PreToolUse"||e==="PermissionRequest"}function ft(e){return e==="PreLLMCall"||e==="PostLLMCall"}var kr=new Set(["subagent_spawn","subagent_status","subagent_send_message","subagent_cancel","subagent_wait","subagent_read_result"]);function dt(e){return e!==void 0&&kr.has(e)}var Tt=O(b());var pt=O(b());var D="0.4.2";var Mr=1e4,Dr=`pinta-musecode/${D}`;function mt(e,t){return(0,pt.evaluateGuard)(e,t,{timeoutMs:Mr,token:process.env.PINTA_RELAY_TOKEN??"",disabled:process.env.PINTA_GUARD_DISABLED==="1",userAgent:Dr})}function Rr(){let e=process.env.PINTA_MUSE_DENY_FORMAT;return e==="exit2"||e==="json"?e:"auto"}function xr(e,t){return X(e)?{hookSpecificOutput:{hookEventName:e,permissionDecision:"deny",permissionDecisionReason:t}}:{decision:"block",reason:t}}function ht(e,t,r={}){let n=r.stdout??(o=>process.stdout.write(o)),s=r.stderr??(o=>process.stderr.write(o)),i=Rr();return i==="exit2"?(s(`${t}
+`),{written:!0,exitCode:2}):(n(JSON.stringify(xr(e,t))+`
+`),i==="json"?{written:!0,exitCode:0}:(s(`${t}
+`),{written:!0,exitCode:2}))}var x=O(b());var gt=O(b()),Y=class extends gt.DiskTransport{constructor(t){super({pluginData:t.pluginData,logPrefix:"pinta-musecode"})}};var _t=O(b()),W=class extends _t.TraceManager{constructor(t){super(t.tracePath)}};import he from"node:os";var jr=new Set(["unknown","undefined","null","n/a","none","-","auto","default"]);function yt(e){if(typeof e!="string")return;let t=e.trim();if(!(!t||t.startsWith("{")||t.startsWith("[")||jr.has(t.toLowerCase())))return t}var R=O(b());var Nr="musecode",h="muse",z;function Ir(){if(z===void 0)try{z=he.userInfo().username}catch{z=process.env.USER??process.env.LOGNAME??(typeof process.getuid=="function"?String(process.getuid()):"unknown")}return z}function Br(e){for(let t of["muse_version","version","cli_version"]){let r=e[t];if(typeof r=="string"&&r.length>0)return r}return process.env.MUSE_VERSION??"unknown"}var Cr=new Set([`${h}.hook`,`${h}.tool_name`,`${h}.tool_use_id`,`${h}.session_id`,`${h}.cwd`,`${h}.permission_mode`,`${h}.agent_id`,`${h}.agent_type`]),$r=new Set([`${h}.tool_input`,`${h}.tool_response`]),Lr={skipRedactKeys:Cr,bashContextKeys:$r};function Ur(e){let t=[];t.push({key:"ingest.type",value:{stringValue:Nr}}),t.push({key:`${h}.hook`,value:{stringValue:e.hook_event_name}});let r={},n=yt(e.model);for(let[s,i]of Object.entries(e))if(s!=="hook_event_name"){if(s==="model"){i!==n&&(r.model_raw=i);continue}if(s==="model_source"){r.model_source_raw=i;continue}r[s]=i}return n&&(r.model=n,r.model_source="reported:model"),t.push(...(0,R.attrsFromRecord)(r,h,Lr)),t}function qr(e){return[{key:"service.name",value:{stringValue:"muse-code"}},{key:"service.version",value:{stringValue:Br(e)}},{key:"telemetry.sdk.name",value:{stringValue:"pinta-musecode"}},{key:"telemetry.sdk.language",value:{stringValue:"nodejs"}},{key:"telemetry.sdk.version",value:{stringValue:D}},{key:"process.pid",value:{intValue:process.pid}},{key:"process.owner",value:{stringValue:Ir()}},{key:"host.name",value:{stringValue:he.hostname()}},{key:"host.arch",value:{stringValue:he.arch()}}]}function vt(e){return(0,R.buildPayload)({traceId:e.traceId,spanName:`${h}.${(0,R.snakeCase)(e.event.hook_event_name)}`,attributes:Ur(e.event),resource:qr(e.event),scope:{name:"pinta-musecode",version:D},now:e.now})}function ge(e,t,r={}){let n=new W(t),s=r.traceMode==="new"?n.newTrace():n.currentTrace();return vt({event:e,traceId:s})}async function Et(e,t){let r=new Y(t);await r.flush(),await r.send(e)}async function Gr(e,t,r={}){await Et(ge(e,t,r),t)}async function C(e,t,r={}){try{await Gr(e,t,r)}catch(n){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${n}
+`)}}async function St(e,t){try{await Et(e,t)}catch(r){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${r}
+`)}}function Pt(e,t){try{if(!(0,x.envOptionsResolver)())return;if(Buffer.byteLength(JSON.stringify(e),"utf8")>x.MAX_POST_BYTES){process.stderr.write(`[pinta-musecode] deferred telemetry exceeds MAX_POST_BYTES; dropped
+`);return}new x.DiskRetryQueue(t.pluginData,"pinta-musecode").enqueue(e)}catch(r){process.stderr.write(`[pinta-musecode] telemetry enqueue failed: ${r}
+`)}}async function bt(e,t){if(dt(e.tool_name))return await C(e,t),0;let r=ge(e,t),n=await mt(r,process.env.PINTA_GUARD_ENDPOINT),s=0,i=n?.decision==="DENY"&&ut();if(i){let o=n.userMessage??n.reason??"guard_deny";s=ht(e.hook_event_name,o).exitCode}try{(0,Tt.attachGuard)(r,n),i?Pt(r,t):await St(r,t)}catch(o){process.stderr.write(`[pinta-musecode] telemetry emit failed: ${o}
+`)}return s}async function Ot(e,t){return await C(e,t),0}async function At(e,t){return await C(e,t,{traceMode:"new"}),0}async function wt(e){return 0}async function Fr(){let e=[];for await(let t of process.stdin)e.push(t);return Buffer.concat(e).toString("utf-8")}function Vr(e){let t=e.trim();if(t.length===0)return{};try{let r=JSON.parse(t);if(r!==null&&typeof r=="object"&&!Array.isArray(r))return r}catch{}return{}}async function Xr(e,t){let r=e.hook_event_name;return X(r)?bt(e,t):r==="UserPromptSubmit"?At(e,t):ft(r)&&!ct()?wt(e):Ot(e,t)}async function kt(e=process.argv.slice(2)){let t=0;try{let r=at(),n=Vr(await Fr()),s=lt(e,n);if(s===null)return process.stderr.write(`[pinta-musecode] could not resolve hook event name; skipping
+`),0;let i={...n,hook_event_name:s};t=await Xr(i,r)}catch(r){process.stderr.write(`[pinta-musecode] error: ${r}
+`),t=0}return t}ot();function zr(){let e=process.argv[1];if(!e)return!1;try{return import.meta.url===Wr(Yr(e)).href}catch{return!1}}async function Hr(){let e=await kt();process.exit(e)}zr()&&Hr();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinta-ai/pinta-musecode",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Generic OTLP forwarder for Meta Muse Code hook events",
   "main": "dist/index.js",
   "exports": {
@@ -39,7 +39,7 @@
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {
-    "@pinta-ai/core": "^0.8.0",
+    "@pinta-ai/core": "^0.9.2",
     "@types/node": "^22.0.0",
     "esbuild": "^0.24.0",
     "tsx": "^4.0.0",