@pinta-ai/pinta-opencode 0.1.0

package/dist/core/redact.d.ts

@@ -0,0 +1,57 @@
+export interface RedactOptions {
+    /**
+     * Optional context hint that enables context-gated patterns. Currently
+     * only "bash" enables `cli_password_short` (-p<pass>) since matching it
+     * outside Bash command text is too noisy.
+     */
+    context?: "bash";
+}
+/** Tier 3 cap: per-string byte limit before truncation. */
+export declare const MAX_BYTES = 102400;
+/**
+ * Truncate input by UTF-8 byte length. Appends `…[TRUNCATED:<origByteLen>]`
+ * to indicate elision. Returns input unchanged when within cap.
+ *
+ * Uses Buffer for accurate byte counting; slices on byte boundary then
+ * decodes — may produce a U+FFFD if the boundary lands mid-codepoint, which
+ * is acceptable for telemetry.
+ */
+export declare function truncate(input: string): string;
+export interface Pattern {
+    /** Token type printed inside `[REDACTED:<type>]`. */
+    type: string;
+    /** Regex with global flag (`g`). Multiline (`m`) for line-anchored ones. */
+    regex: RegExp;
+    /**
+     * Capture group index whose substring is replaced. 0 (default) = whole match.
+     * Use a positive group when the pattern brackets context that should be
+     * preserved (e.g. `postgres://user:<pwd>@` keeps the URL shape intact).
+     */
+    captureGroup?: number;
+    /**
+     * If set, this pattern only applies when `RedactOptions.context` equals
+     * the listed value. Used for false-positive-prone shapes.
+     */
+    requireContext?: "bash";
+}
+export declare const PATTERNS: ReadonlyArray<Pattern>;
+interface Match {
+    start: number;
+    end: number;
+    replaceStart: number;
+    replaceEnd: number;
+    type: string;
+}
+export declare function collectMatches(input: string, opts: RedactOptions): Match[];
+export declare function resolveOverlaps(matches: Match[]): Match[];
+export declare function applyMatches(input: string, matches: Match[]): string;
+/**
+ * Mask high-confidence secret patterns in `input`. Returns a new string with
+ * matched substrings replaced by `[REDACTED:<type>]`.
+ *
+ * - `opts.context = "bash"` enables context-gated patterns.
+ * - Truncation is NOT applied here — see `truncate()`. The caller decides
+ *   the order (spec §3 Tier 3: truncate first, then redact).
+ */
+export declare function redact(input: string, opts?: RedactOptions): string;
+export {};

package/dist/core/redact.js

@@ -0,0 +1,141 @@
+/** Tier 3 cap: per-string byte limit before truncation. */
+export const MAX_BYTES = 102400;
+/**
+ * Truncate input by UTF-8 byte length. Appends `…[TRUNCATED:<origByteLen>]`
+ * to indicate elision. Returns input unchanged when within cap.
+ *
+ * Uses Buffer for accurate byte counting; slices on byte boundary then
+ * decodes — may produce a U+FFFD if the boundary lands mid-codepoint, which
+ * is acceptable for telemetry.
+ */
+export function truncate(input) {
+    const buf = Buffer.from(input, "utf-8");
+    if (buf.length <= MAX_BYTES)
+        return input;
+    const head = buf.subarray(0, MAX_BYTES).toString("utf-8");
+    return `${head}…[TRUNCATED:${buf.length}]`;
+}
+export const PATTERNS = [
+    { type: "aws_access_key", regex: /AKIA[0-9A-Z]{16}/g },
+    {
+        type: "aws_secret_key",
+        // Context word `aws_secret`/`AWS_SECRET` (with optional separator) followed
+        // by an assignment-ish character then a 40-char base64-ish blob.
+        regex: /(?:aws[_-]?secret(?:[_-]?(?:access)?[_-]?key)?)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,
+        captureGroup: 1,
+    },
+    {
+        type: "gcp_service_account",
+        // Whole JSON blob starting with the service-account discriminator.
+        regex: /\{[\s\S]{0,200}?"type"\s*:\s*"service_account"[\s\S]*?\}/g,
+    },
+    { type: "github_token", regex: /gh[pousr]_[A-Za-z0-9]{36,}/g },
+    { type: "gitlab_token", regex: /glpat-[A-Za-z0-9_-]{20}/g },
+    { type: "slack_token", regex: /xox[abrsp]-[0-9A-Za-z-]{10,}/g },
+    { type: "openai_key", regex: /sk-(?:proj-)?[A-Za-z0-9_-]{40,}/g },
+    { type: "anthropic_key", regex: /sk-ant-[A-Za-z0-9_-]{50,}/g },
+    { type: "stripe_key", regex: /(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g },
+    {
+        type: "jwt",
+        regex: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+    },
+    {
+        type: "private_key_block",
+        regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    },
+    { type: "bearer_token", regex: /bearer\s+([A-Za-z0-9._~+/=-]{12,})/gi, captureGroup: 1 },
+    { type: "basic_auth", regex: /basic\s+([A-Za-z0-9+/=]{12,})/gi, captureGroup: 1 },
+    {
+        type: "db_url_password",
+        regex: /\b(?:postgres|postgresql|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/]+:([^@\s]+)@/gi,
+        captureGroup: 1,
+    },
+    {
+        type: "cli_password_flag",
+        regex: /(?:--password|--pass|--pwd)[=\s]([^\s'"]+)/g,
+        captureGroup: 1,
+    },
+    {
+        type: "cli_password_short",
+        // mysql -p<pass>; only on bash context.
+        regex: /\s-p([^\s'"]+)/g,
+        captureGroup: 1,
+        requireContext: "bash",
+    },
+    {
+        type: "env_var_secret",
+        // Known false positive: trailing `[A-Z0-9_]*` is greedy, so names like
+        // `OPENAI_API_KEY_DESCRIPTION=Used` still match. Acceptable for Bronze.
+        regex: /^(?:export\s+)?([A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|API_KEY)[A-Z0-9_]*)\s*=\s*["']?([^\s"'\n]+)/gm,
+        captureGroup: 2,
+    },
+];
+export function collectMatches(input, opts) {
+    const out = [];
+    for (const pattern of PATTERNS) {
+        if (pattern.requireContext && pattern.requireContext !== opts.context)
+            continue;
+        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
+        let m;
+        while ((m = re.exec(input)) !== null) {
+            const cg = pattern.captureGroup ?? 0;
+            const captured = m[cg];
+            if (captured === undefined) {
+                if (m.index === re.lastIndex)
+                    re.lastIndex++;
+                continue;
+            }
+            const start = m.index;
+            const end = m.index + m[0].length;
+            const replaceStart = start + m[0].indexOf(captured);
+            const replaceEnd = replaceStart + captured.length;
+            out.push({ start, end, replaceStart, replaceEnd, type: pattern.type });
+            if (m.index === re.lastIndex)
+                re.lastIndex++; // guard against zero-length
+        }
+    }
+    return out;
+}
+export function resolveOverlaps(matches) {
+    const sorted = [...matches].sort((a, b) => {
+        if (a.start !== b.start)
+            return a.start - b.start;
+        return (b.end - b.start) - (a.end - a.start); // longer whole-match wins on tie
+    });
+    const kept = [];
+    let lastEnd = -1;
+    for (const m of sorted) {
+        if (m.start < lastEnd)
+            continue; // overlapping later match dropped
+        kept.push(m);
+        lastEnd = m.end;
+    }
+    return kept;
+}
+export function applyMatches(input, matches) {
+    // Apply right-to-left so earlier indices remain valid.
+    const sorted = [...matches].sort((a, b) => b.replaceStart - a.replaceStart);
+    let out = input;
+    for (const m of sorted) {
+        out = out.slice(0, m.replaceStart) + `[REDACTED:${m.type}]` + out.slice(m.replaceEnd);
+    }
+    return out;
+}
+/**
+ * Mask high-confidence secret patterns in `input`. Returns a new string with
+ * matched substrings replaced by `[REDACTED:<type>]`.
+ *
+ * - `opts.context = "bash"` enables context-gated patterns.
+ * - Truncation is NOT applied here — see `truncate()`. The caller decides
+ *   the order (spec §3 Tier 3: truncate first, then redact).
+ */
+export function redact(input, opts = {}) {
+    if (input.length === 0)
+        return input;
+    const all = collectMatches(input, opts);
+    if (all.length === 0)
+        return input;
+    const kept = resolveOverlaps(all);
+    return applyMatches(input, kept);
+}
+//# sourceMappingURL=redact.js.map

package/dist/core/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/core/redact.ts"],"names":[],"mappings":"AASA,2DAA2D;AAC3D,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,GAAG,IAAI,eAAe,GAAG,CAAC,MAAM,GAAG,CAAC;AAC7C,CAAC;AAoBD,MAAM,CAAC,MAAM,QAAQ,GAA2B;IAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,4EAA4E;QAC5E,iEAAiE;QACjE,KAAK,EAAE,wGAAwG;QAC/G,YAAY,EAAE,CAAC;KAChB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,mEAAmE;QACnE,KAAK,EAAE,2DAA2D;KACnE;IACD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC9D,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC3D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,+BAA+B,EAAE;IAC/D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,kCAAkC,EAAE;IACjE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC9D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,8CAA8C,EAAE;IAC7E;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,mEAAmE;KAC3E;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,6EAA6E;KACrF;IACD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,sCAAsC,EAAE,YAAY,EAAE,CAAC,EAAE;IACxF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,iCAAiC,EAAE,YAAY,EAAE,CAAC,EAAE;IACjF;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,2FAA2F;QAClG,YAAY,EAAE,CAAC;KAChB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,6CAA6C;QACpD,YAAY,EAAE,CAAC;KAChB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,wCAAwC;QACxC,KAAK,EAAE,iBAAiB;QACxB,YAAY,EAAE,CAAC;QACf,cAAc,EAAE,MAAM;KACvB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,KAAK,EAAE,sHAAsH;QAC7H,YAAY,EAAE,CAAC;KAChB;CACF,CAAC;AAUF,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAmB;IAC/D,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QAChF,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;oBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACtB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,MAAM,YAAY,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,4BAA4B;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iCAAiC;IACjF,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAY,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,GAAG,OAAO;YAAE,SAAS,CAAC,kCAAkC;QACnE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,OAAgB;IAC1D,uDAAuD;IACvD,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,OAAsB,EAAE;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/core/retry-queue.d.ts

@@ -0,0 +1,14 @@
+import type { OtlpPayload } from "./otlp.js";
+/**
+ * In-memory retry buffer. The plugin is a long-lived in-process module
+ * (verified H-C1), so failed OTLP payloads are buffered in memory and flushed
+ * on the next event. Oldest entries are dropped past the cap. (Disk persistence
+ * across instance restarts is an optional future enhancement — SPEC §6.)
+ */
+export declare class RetryQueue {
+    private entries;
+    enqueue(payload: OtlpPayload): void;
+    /** Remove and return all buffered payloads. */
+    drain(): OtlpPayload[];
+    get size(): number;
+}

package/dist/core/retry-queue.js

@@ -0,0 +1,26 @@
+const MAX_ENTRIES = 1000;
+/**
+ * In-memory retry buffer. The plugin is a long-lived in-process module
+ * (verified H-C1), so failed OTLP payloads are buffered in memory and flushed
+ * on the next event. Oldest entries are dropped past the cap. (Disk persistence
+ * across instance restarts is an optional future enhancement — SPEC §6.)
+ */
+export class RetryQueue {
+    entries = [];
+    enqueue(payload) {
+        this.entries.push(payload);
+        if (this.entries.length > MAX_ENTRIES) {
+            this.entries.splice(0, this.entries.length - MAX_ENTRIES);
+        }
+    }
+    /** Remove and return all buffered payloads. */
+    drain() {
+        const out = this.entries;
+        this.entries = [];
+        return out;
+    }
+    get size() {
+        return this.entries.length;
+    }
+}
+//# sourceMappingURL=retry-queue.js.map

package/dist/core/retry-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-queue.js","sourceRoot":"","sources":["../../src/core/retry-queue.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IACb,OAAO,GAAkB,EAAE,CAAC;IAEpC,OAAO,CAAC,OAAoB;QAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;CACF"}

package/dist/core/trace.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Per-turn trace correlation, keyed by `sessionID`.
+ *
+ * opencode instantiates the plugin once per instance (verified H-C1), so the
+ * map lives in memory for the instance lifetime — no file persistence needed.
+ * `chat.message` (turn-START) rotates a new ULID trace for its session; every
+ * subsequent hook in the turn reuses it. Keyed by sessionID so concurrent
+ * sessions don't collide.
+ */
+export declare class TraceManager {
+    private map;
+    /** Start a new trace for this session (called on chat.message / turn-START). */
+    newTrace(sessionId?: string): string;
+    /** Current trace for this session; create one if none exists yet. */
+    currentTrace(sessionId?: string): string;
+}

package/dist/core/trace.js

@@ -0,0 +1,50 @@
+import crypto from "crypto";
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function generateUlid() {
+    const now = Date.now();
+    let ts = "";
+    let t = now;
+    for (let i = 0; i < 10; i++) {
+        ts = CROCKFORD[t & 31] + ts;
+        t = Math.floor(t / 32);
+    }
+    const rand = crypto.randomBytes(10);
+    let r = "";
+    for (let i = 0; i < 10; i++)
+        r += CROCKFORD[rand[i] & 31];
+    while (r.length < 16)
+        r += CROCKFORD[0];
+    return ts + r;
+}
+const MAX_SESSIONS = 200;
+/**
+ * Per-turn trace correlation, keyed by `sessionID`.
+ *
+ * opencode instantiates the plugin once per instance (verified H-C1), so the
+ * map lives in memory for the instance lifetime — no file persistence needed.
+ * `chat.message` (turn-START) rotates a new ULID trace for its session; every
+ * subsequent hook in the turn reuses it. Keyed by sessionID so concurrent
+ * sessions don't collide.
+ */
+export class TraceManager {
+    map = new Map();
+    /** Start a new trace for this session (called on chat.message / turn-START). */
+    newTrace(sessionId) {
+        const key = sessionId || "default";
+        const traceId = generateUlid();
+        this.map.set(key, traceId);
+        // Cap to avoid unbounded growth over a long-lived instance.
+        if (this.map.size > MAX_SESSIONS) {
+            const oldest = this.map.keys().next().value;
+            if (oldest !== undefined)
+                this.map.delete(oldest);
+        }
+        return traceId;
+    }
+    /** Current trace for this session; create one if none exists yet. */
+    currentTrace(sessionId) {
+        const key = sessionId || "default";
+        return this.map.get(key) ?? this.newTrace(key);
+    }
+}
+//# sourceMappingURL=trace.js.map

package/dist/core/trace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.js","sourceRoot":"","sources":["../../src/core/trace.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACf,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExC,gFAAgF;IAChF,QAAQ,CAAC,SAAkB;QACzB,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,CAAC;QACnC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,4DAA4D;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,YAAY,CAAC,SAAkB;QAC7B,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,CAAC;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;CACF"}

package/dist/core/transport.d.ts

@@ -0,0 +1,20 @@
+import { type OtlpPayload } from "./otlp.js";
+export interface TransportConfig {
+    /** Full OTLP/HTTP traces URL. Undefined → telemetry silently disabled. */
+    endpoint?: string;
+    headers: Record<string, string>;
+}
+/**
+ * Best-effort OTLP/HTTP transport with an in-memory retry buffer. Never throws;
+ * failures are buffered and re-sent (batched) on the next event. Silent-disable
+ * when no endpoint is configured.
+ */
+export declare class Transport {
+    private config;
+    private queue;
+    constructor(config: TransportConfig);
+    send(payload: OtlpPayload): Promise<void>;
+    /** Drain the retry buffer as one batched POST; re-buffer on failure. */
+    flush(): Promise<void>;
+    private post;
+}

package/dist/core/transport.js

@@ -0,0 +1,69 @@
+import { RetryQueue } from "./retry-queue.js";
+import { mergeBatch } from "./otlp.js";
+const TIMEOUT_MS = 5000;
+/**
+ * Best-effort OTLP/HTTP transport with an in-memory retry buffer. Never throws;
+ * failures are buffered and re-sent (batched) on the next event. Silent-disable
+ * when no endpoint is configured.
+ */
+export class Transport {
+    config;
+    queue = new RetryQueue();
+    constructor(config) {
+        this.config = config;
+    }
+    async send(payload) {
+        if (!this.config.endpoint)
+            return;
+        const ok = await this.post(payload);
+        if (!ok)
+            this.queue.enqueue(payload);
+    }
+    /** Drain the retry buffer as one batched POST; re-buffer on failure. */
+    async flush() {
+        if (!this.config.endpoint)
+            return;
+        if (this.queue.size === 0)
+            return;
+        const entries = this.queue.drain();
+        const ok = await this.post(mergeBatch(entries));
+        if (!ok)
+            for (const e of entries)
+                this.queue.enqueue(e);
+    }
+    async post(payload) {
+        const endpoint = this.config.endpoint;
+        if (!endpoint)
+            return false;
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+        try {
+            const res = await fetch(endpoint, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", ...this.config.headers },
+                body: JSON.stringify(payload),
+                signal: ctrl.signal,
+            });
+            if (!res.ok) {
+                const hint = res.status === 401 || res.status === 403
+                    ? " — check relay token"
+                    : res.status === 404
+                        ? " — check traces endpoint path"
+                        : res.status >= 500
+                            ? " — collector may be down"
+                            : "";
+                process.stderr.write(`[pinta-opencode] OTLP POST ${res.status} ${endpoint}${hint}\n`);
+                return false;
+            }
+            return true;
+        }
+        catch (err) {
+            process.stderr.write(`[pinta-opencode] OTLP POST failed: ${err.message ?? String(err)}\n`);
+            return false;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=transport.js.map

package/dist/core/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/core/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAoB,MAAM,WAAW,CAAC;AAEzD,MAAM,UAAU,GAAG,IAAI,CAAC;AAQxB;;;;GAIG;AACH,MAAM,OAAO,SAAS;IAGA;IAFZ,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAEjC,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAE/C,KAAK,CAAC,IAAI,CAAC,OAAoB;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO;QAClC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO;QAClC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,EAAE;YAAE,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,OAAoB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;gBACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBACtC,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;wBAClB,CAAC,CAAC,+BAA+B;wBACjC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG;4BACjB,CAAC,CAAC,0BAA0B;4BAC5B,CAAC,CAAC,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,IAAI,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC;gBACtF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAuC,GAAa,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/env-file.d.ts

@@ -0,0 +1,4 @@
+export declare function envFilePath(): string;
+export declare function parseEnvFile(content: string): Record<string, string>;
+/** Load the env file (if present) and merge only-unset keys into process.env. */
+export declare function loadEnvFile(filePath?: string): void;

package/dist/env-file.js

@@ -0,0 +1,53 @@
+/**
+ * Graceful env-file loader.
+ *
+ * pinta-opencode can read config from `~/.config/opencode/pinta-opencode.env`
+ * (or `$OPENCODE_CONFIG_DIR/pinta-opencode.env`) — `KEY=VALUE` per line. This is
+ * the lowest-priority source; plugin options and explicit process.env win.
+ *
+ * Resolution precedence (highest → lowest): plugin options → process.env →
+ * this file (unset keys only). Missing file is a silent no-op.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+function opencodeConfigDir() {
+    return process.env.OPENCODE_CONFIG_DIR || path.join(os.homedir(), ".config", "opencode");
+}
+export function envFilePath() {
+    return path.join(opencodeConfigDir(), "pinta-opencode.env");
+}
+export function parseEnvFile(content) {
+    const out = {};
+    for (const raw of content.split("\n")) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const idx = line.indexOf("=");
+        if (idx < 0)
+            continue;
+        const key = line.slice(0, idx).trim();
+        let value = line.slice(idx + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        if (key)
+            out[key] = value;
+    }
+    return out;
+}
+/** Load the env file (if present) and merge only-unset keys into process.env. */
+export function loadEnvFile(filePath = envFilePath()) {
+    let content;
+    try {
+        content = fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return; // missing/unreadable → no-op
+    }
+    for (const [key, value] of Object.entries(parseEnvFile(content))) {
+        if (process.env[key] === undefined)
+            process.env[key] = value;
+    }
+}
+//# sourceMappingURL=env-file.js.map

package/dist/env-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../src/env-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,oBAAoB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,WAAmB,WAAW,EAAE;IAC1D,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,6BAA6B;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/D,CAAC;AACH,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,27 @@
+import { type PintaOptions } from "./config.js";
+import { type OpencodeEvent, type ToolBeforeInput, type ToolAfterOutput } from "./telemetry.js";
+/**
+ * pinta-opencode plugin entry. opencode invokes this once per instance with
+ * `(input, options)` and keeps the returned hooks for the instance lifetime
+ * (verified H-C1), so config + transport + trace state live in this closure.
+ *
+ * - Telemetry (event / tool.execute.after): best-effort OTLP, never blocks.
+ * - Governance (tool.execute.before): guard query; DENY → throw(reason), which
+ *   blocks only that tool and surfaces the reason to the model (verified H-A1).
+ *
+ * Fail-open invariant: every telemetry/guard error is swallowed; the only
+ * intentional throw is a guard DENY.
+ */
+export declare const PintaOpencode: (_input: unknown, options?: PintaOptions) => Promise<{
+    "chat.message": (input: {
+        sessionID?: string;
+    }) => Promise<void>;
+    event: (input: {
+        event?: OpencodeEvent;
+    }) => Promise<void>;
+    "tool.execute.before": (input: ToolBeforeInput, output: {
+        args: unknown;
+    }) => Promise<void>;
+    "tool.execute.after": (input: ToolBeforeInput, output: ToolAfterOutput) => Promise<void>;
+}>;
+export default PintaOpencode;

package/dist/plugin.js

@@ -0,0 +1,85 @@
+import { resolveConfig } from "./config.js";
+import { Transport } from "./core/transport.js";
+import { TraceManager } from "./core/trace.js";
+import { evaluateGuard } from "./core/guard.js";
+import { Telemetry } from "./telemetry.js";
+function warn(scope, err) {
+    process.stderr.write(`[pinta-opencode] ${scope}: ${err?.message ?? String(err)}\n`);
+}
+/**
+ * pinta-opencode plugin entry. opencode invokes this once per instance with
+ * `(input, options)` and keeps the returned hooks for the instance lifetime
+ * (verified H-C1), so config + transport + trace state live in this closure.
+ *
+ * - Telemetry (event / tool.execute.after): best-effort OTLP, never blocks.
+ * - Governance (tool.execute.before): guard query; DENY → throw(reason), which
+ *   blocks only that tool and surfaces the reason to the model (verified H-A1).
+ *
+ * Fail-open invariant: every telemetry/guard error is swallowed; the only
+ * intentional throw is a guard DENY.
+ */
+export const PintaOpencode = async (_input, options) => {
+    const config = resolveConfig(options ?? {});
+    const transport = new Transport({ endpoint: config.endpoint, headers: config.headers });
+    const trace = new TraceManager();
+    const telemetry = new Telemetry(transport, trace, config);
+    return {
+        // turn-START → rotate a new trace for this session.
+        "chat.message": async (input) => {
+            try {
+                trace.newTrace(input?.sessionID);
+            }
+            catch (err) {
+                warn("chat.message", err);
+            }
+        },
+        // lifecycle telemetry; flushes the retry buffer on session.idle (turn-END).
+        event: async (input) => {
+            try {
+                if (input?.event)
+                    await telemetry.lifecycle(input.event);
+            }
+            catch (err) {
+                warn("event", err);
+            }
+        },
+        // ★ governance gate: guard query → DENY throws (blocks just this tool).
+        "tool.execute.before": async (input, output) => {
+            let guard = null;
+            try {
+                guard = await evaluateGuard({
+                    spanId: input.sessionID,
+                    toolName: input.tool,
+                    toolInput: output?.args,
+                    rawTextFields: { toolInput: safeStringify(output?.args) },
+                }, config.guardEndpoint, { timeoutMs: config.guardTimeoutMs, token: config.relayToken, disabled: config.guardDisabled });
+                await telemetry.toolBefore(input, output?.args, guard);
+            }
+            catch (err) {
+                warn("tool.execute.before", err); // telemetry/guard infra errors are fail-open
+            }
+            if (guard?.decision === "DENY") {
+                throw new Error(guard.userMessage ?? guard.reason ?? "guard_deny");
+            }
+        },
+        // tool-result telemetry.
+        "tool.execute.after": async (input, output) => {
+            try {
+                await telemetry.toolAfter(input, output);
+            }
+            catch (err) {
+                warn("tool.execute.after", err);
+            }
+        },
+    };
+};
+function safeStringify(v) {
+    try {
+        return typeof v === "string" ? v : JSON.stringify(v) ?? "";
+    }
+    catch {
+        return String(v);
+    }
+}
+export default PintaOpencode;
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAqB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAkE,MAAM,gBAAgB,CAAC;AAE3G,SAAS,IAAI,CAAC,KAAa,EAAE,GAAY;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,KAAM,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,MAAe,EAAE,OAAsB,EAAE,EAAE;IAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAE1D,OAAO;QACL,oDAAoD;QACpD,cAAc,EAAE,KAAK,EAAE,KAA6B,EAAE,EAAE;YACtD,IAAI,CAAC;gBACH,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,KAAK,EAAE,KAAK,EAAE,KAAgC,EAAE,EAAE;YAChD,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,KAAK;oBAAE,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,qBAAqB,EAAE,KAAK,EAAE,KAAsB,EAAE,MAAyB,EAAE,EAAE;YACjF,IAAI,KAAK,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,aAAa,CACzB;oBACE,MAAM,EAAE,KAAK,CAAC,SAAS;oBACvB,QAAQ,EAAE,KAAK,CAAC,IAAI;oBACpB,SAAS,EAAE,MAAM,EAAE,IAAI;oBACvB,aAAa,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;iBAC1D,EACD,MAAM,CAAC,aAAa,EACpB,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,CAC/F,CAAC;gBACF,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,CAAC,6CAA6C;YACjF,CAAC;YACD,IAAI,KAAK,EAAE,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,oBAAoB,EAAE,KAAK,EAAE,KAAsB,EAAE,MAAuB,EAAE,EAAE;YAC9E,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,eAAe,aAAa,CAAC"}

package/dist/telemetry.d.ts

@@ -0,0 +1,37 @@
+import { Transport } from "./core/transport.js";
+import { TraceManager } from "./core/trace.js";
+import type { GuardResult } from "./core/guard.js";
+import type { ResolvedConfig } from "./config.js";
+export interface OpencodeEvent {
+    id?: string;
+    type?: string;
+    properties?: Record<string, unknown>;
+}
+export interface ToolBeforeInput {
+    tool: string;
+    sessionID: string;
+    callID: string;
+}
+export interface ToolAfterOutput {
+    title?: string;
+    output?: unknown;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Maps opencode hook payloads to OTLP spans (verified payload shapes — SPEC §5).
+ * Tool spans are built from tool.execute.before/after (richer: args, output,
+ * exit) rather than the event bus; `event` covers lifecycle + turn boundaries.
+ */
+export declare class Telemetry {
+    private transport;
+    private trace;
+    private config;
+    constructor(transport: Transport, trace: TraceManager, config: ResolvedConfig);
+    private emit;
+    /** Lifecycle span from the `event` hook. Flushes the retry buffer on turn-END. */
+    lifecycle(ev: OpencodeEvent): Promise<void>;
+    /** Tool span from `tool.execute.before`, carrying the guard decision. */
+    toolBefore(input: ToolBeforeInput, args: unknown, guard: GuardResult | null): Promise<void>;
+    /** Tool result span from `tool.execute.after`, incl. exit code / truncation. */
+    toolAfter(input: ToolBeforeInput, output: ToolAfterOutput): Promise<void>;
+}