@usepowerplant/cli 0.4.20 → 0.4.22

package/dist/hooks/powerplant-cloud-capture.mjs

@@ -0,0 +1,747 @@
+/**
+ * Powerplant cloud session capture: the Stop hook for this repository's
+ * Claude cloud sessions. See docs/cloud-session-rules.md.
+ *
+ * What it sends: after each turn, this session's transcript, redacted here
+ * first with Powerplant's shared redaction and then gzipped, to Powerplant's
+ * API only (POST /api/ingest/cloud-sessions/raw). Two headers name the cloud
+ * session id and this repository's owner/name. It sends no environment
+ * values and no other files.
+ *
+ * Where it runs: only in a Claude cloud session (CLAUDE_CODE_REMOTE=true).
+ * On a laptop it exits at once, and the Powerplant sync service captures the
+ * session instead.
+ *
+ * Credential: the member's cloud capture token. Anthropic's agent proxy adds
+ * it outside the VM when it is an API credential on the cloud environment.
+ * Otherwise the hook reads POWERPLANT_CAPTURE_TOKEN. It never puts the token
+ * on a command line.
+ *
+ * It never blocks the session. It stops for the session when Powerplant
+ * refuses the upload or three turns in a row fail (a busy answer is not a
+ * failure), and writes each result to powerplant-cloud-capture/ in the
+ * system temp directory.
+ *
+ * Generated from apps/api/src/cloudCaptureHook.ts by
+ * apps/api/scripts/build-cloud-capture-hook.mts. Edit the source, not this file.
+ */
+
+// src/cloudCaptureHook.ts
+import { spawn, spawnSync } from "node:child_process";
+import { appendFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { gzipSync } from "node:zlib";
+
+// ../../packages/core/src/encodedImages.ts
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function isEncodedImage(data, mediaType) {
+  return typeof mediaType === "string" && encodedImageMediaType(data) === mediaType;
+}
+var RASTER_TYPES = [
+  ["image/png", isPng],
+  ["image/jpeg", isJpeg],
+  ["image/gif", isGif],
+  ["image/webp", isWebp]
+];
+function encodedImageMediaType(data) {
+  if (data.length < 16 || data.length % 4 !== 0) return null;
+  const padding = data.endsWith("==") ? 2 : data.endsWith("=") ? 1 : 0;
+  const body = data.slice(0, data.length - padding);
+  if (/[^A-Za-z0-9+/]/.test(body)) return null;
+  const last = BASE64_ALPHABET.indexOf(body.at(-1));
+  if (padding === 2 && (last & 15) !== 0 || padding === 1 && (last & 3) !== 0) return null;
+  const bytes = atob(data);
+  return RASTER_TYPES.find(([, valid]) => valid(bytes))?.[0] ?? null;
+}
+function u16(data, offset) {
+  return data.charCodeAt(offset) << 8 | data.charCodeAt(offset + 1);
+}
+function u32(data, offset) {
+  return u16(data, offset) * 65536 + u16(data, offset + 2) >>> 0;
+}
+function little32(data, offset) {
+  return (data.charCodeAt(offset) | data.charCodeAt(offset + 1) << 8 | data.charCodeAt(offset + 2) << 16 | data.charCodeAt(offset + 3) << 24) >>> 0;
+}
+var CRC_TABLE = Array.from({ length: 256 }, (_, value) => {
+  for (let bit = 0; bit < 8; bit++) value = value & 1 ? 3988292384 ^ value >>> 1 : value >>> 1;
+  return value >>> 0;
+});
+function crc32(data, start, end) {
+  let crc = 4294967295;
+  for (let i = start; i < end; i++)
+    crc = CRC_TABLE[(crc ^ data.charCodeAt(i)) & 255] ^ crc >>> 8;
+  return (crc ^ 4294967295) >>> 0;
+}
+function isPng(data) {
+  if (!data.startsWith("\x89PNG\r\n\x1a\n")) return false;
+  let offset = 8;
+  let imageData = false;
+  let dataEnded = false;
+  let palette = false;
+  let indexed = false;
+  while (offset + 12 <= data.length) {
+    const size = u32(data, offset);
+    const type = data.slice(offset + 4, offset + 8);
+    const end = offset + 8 + size;
+    if (size > 2147483647 || end + 4 > data.length || !/^[A-Za-z]{2}[A-Z][A-Za-z]$/.test(type))
+      return false;
+    if (u32(data, end) !== crc32(data, offset + 4, end)) return false;
+    if (offset === 8) {
+      if (type !== "IHDR" || size !== 13 || !u32(data, offset + 8) || !u32(data, offset + 12))
+        return false;
+      const depth = data.charCodeAt(offset + 16);
+      const color = data.charCodeAt(offset + 17);
+      const validDepth = color === 0 ? [1, 2, 4, 8, 16] : color === 3 ? [1, 2, 4, 8] : [8, 16];
+      if (![0, 2, 3, 4, 6].includes(color) || !validDepth.includes(depth)) return false;
+      if (data.charCodeAt(offset + 18) !== 0 || data.charCodeAt(offset + 19) !== 0 || data.charCodeAt(offset + 20) > 1)
+        return false;
+      indexed = color === 3;
+    } else if (type === "IHDR") return false;
+    else if (type === "PLTE") {
+      if (imageData || palette || size === 0 || size > 768 || size % 3 !== 0) return false;
+      palette = true;
+    } else if (type === "IDAT") {
+      if (dataEnded || indexed && !palette) return false;
+      imageData = imageData || size > 0;
+    } else if (type === "IEND") return imageData && size === 0 && end + 4 === data.length;
+    else if (type[0] === type[0].toUpperCase()) return false;
+    if (imageData && type !== "IDAT") dataEnded = true;
+    offset = end + 4;
+  }
+  return false;
+}
+function isJpeg(data) {
+  if (!data.startsWith("\xFF\xD8")) return false;
+  let offset = 2;
+  let frame = false;
+  let scan = false;
+  while (offset < data.length) {
+    if (data.charCodeAt(offset++) !== 255) return false;
+    while (data.charCodeAt(offset) === 255) offset++;
+    const marker = data.charCodeAt(offset++);
+    if (marker === 217) return frame && scan && offset === data.length;
+    if (marker === 0 || marker === 216 || marker >= 208 && marker <= 215) return false;
+    if (marker === 1) continue;
+    if (offset + 2 > data.length) return false;
+    const size = u16(data, offset);
+    if (size < 2 || offset + size > data.length) return false;
+    if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+      if (size < 11 || size !== 8 + 3 * data.charCodeAt(offset + 7) || !u16(data, offset + 3) || !u16(data, offset + 5))
+        return false;
+      frame = true;
+    }
+    if (marker !== 218) {
+      offset += size;
+      continue;
+    }
+    if (!frame || size < 8 || size !== 6 + 2 * data.charCodeAt(offset + 2)) return false;
+    offset += size;
+    const start = offset;
+    for (; ; ) {
+      const next = data.indexOf("\xFF", offset);
+      if (next < 0 || next + 1 >= data.length) return false;
+      const following = data.charCodeAt(next + 1);
+      if (following === 0 || following >= 208 && following <= 215) offset = next + 2;
+      else if (following === 255) offset = next + 1;
+      else {
+        offset = next;
+        break;
+      }
+    }
+    if (offset <= start) return false;
+    scan = true;
+  }
+  return false;
+}
+function skipGifBlocks(data, offset) {
+  while (offset < data.length) {
+    const size = data.charCodeAt(offset++);
+    if (size === 0) return offset;
+    offset += size;
+  }
+  return -1;
+}
+function isGif(data) {
+  if (!data.startsWith("GIF87a") && !data.startsWith("GIF89a") || data.length < 13) return false;
+  if (!(data.charCodeAt(6) | data.charCodeAt(7)) || !(data.charCodeAt(8) | data.charCodeAt(9)))
+    return false;
+  const packed = data.charCodeAt(10);
+  let offset = 13 + (packed & 128 ? 3 * (2 << (packed & 7)) : 0);
+  let image = false;
+  while (offset < data.length) {
+    const marker = data.charCodeAt(offset++);
+    if (marker === 59) return image && offset === data.length;
+    if (marker === 33) offset = skipGifBlocks(data, offset + 1);
+    else if (marker === 44) {
+      if (offset + 9 > data.length || !(data.charCodeAt(offset + 4) | data.charCodeAt(offset + 5)) || !(data.charCodeAt(offset + 6) | data.charCodeAt(offset + 7)))
+        return false;
+      const local = data.charCodeAt(offset + 8);
+      offset += 9 + (local & 128 ? 3 * (2 << (local & 7)) : 0);
+      const codeSize = data.charCodeAt(offset++);
+      if (codeSize < 2 || codeSize > 8 || offset >= data.length || data.charCodeAt(offset) === 0)
+        return false;
+      offset = skipGifBlocks(data, offset);
+      image = true;
+    } else return false;
+    if (offset < 0) return false;
+  }
+  return false;
+}
+function isWebp(data) {
+  return data.startsWith("RIFF") && data.slice(8, 12) === "WEBP" && little32(data, 4) + 8 === data.length && webpChunks(data, 12, data.length, true);
+}
+function webpChunks(data, start, end, allowFrames) {
+  let image = false;
+  let offset = start;
+  while (offset + 8 <= end) {
+    const type = data.slice(offset, offset + 4);
+    const size = little32(data, offset + 4);
+    const body = offset + 8;
+    const next = body + size + size % 2;
+    if (next > end) return false;
+    if (type === "VP8 ") {
+      if (size < 11 || data.charCodeAt(body) & 1 || data.slice(body + 3, body + 6) !== "\x9D\x01*")
+        return false;
+      if (!((data.charCodeAt(body + 6) | data.charCodeAt(body + 7) << 8) & 16383) || !((data.charCodeAt(body + 8) | data.charCodeAt(body + 9) << 8) & 16383))
+        return false;
+      image = true;
+    } else if (type === "VP8L") {
+      if (size < 6 || data.charCodeAt(body) !== 47 || data.charCodeAt(body + 4) & 224)
+        return false;
+      image = true;
+    } else if (type === "VP8X") {
+      if (size !== 10 || !allowFrames) return false;
+    } else if (type === "ANMF") {
+      if (!allowFrames || size < 16 || !webpChunks(data, body + 16, body + size, false))
+        return false;
+      image = true;
+    }
+    offset = next;
+  }
+  return image && offset === end;
+}
+
+// ../../packages/core/src/transcriptImages.ts
+var IMAGE_DATA_URI_RE = /^data:(image\/[\w.+-]+);base64,([A-Za-z0-9+/=_-]*)$/;
+function isImageDataUri(value) {
+  if (!value.startsWith("data:image/")) return false;
+  const match = IMAGE_DATA_URI_RE.exec(value);
+  return match !== null && isEncodedImage(match[2], match[1]);
+}
+function isImageBase64Payload(record, key) {
+  const data = record[key];
+  if (typeof data !== "string") return false;
+  if (key === "data" && record.type === "base64") return isEncodedImage(data, record.media_type);
+  if (key === "base64") return isEncodedImage(data, record.type);
+  return false;
+}
+
+// ../../packages/core/src/powerplantTokenPattern.ts
+var POWERPLANT_TOKEN_PATTERN = /\bpp[mc]_[A-Za-z0-9_-]{43,}/g;
+
+// ../../packages/core/src/redact.ts
+var REDACTED = "[REDACTED]";
+var SECRET_KEYS = /* @__PURE__ */ new Set(["secrets", "env_vars", "secrets_with_domains"]);
+var SECRET_VALUE_KEYS = /* @__PURE__ */ new Set([
+  "password",
+  "passwd",
+  "secret",
+  "token",
+  "accesstoken",
+  "refreshtoken",
+  "idtoken",
+  "apikey",
+  "authorization",
+  "privatekey",
+  "clientsecret",
+  "credential",
+  "credentials",
+  "servicerolekey"
+]);
+function normalizeSecretKey(key) {
+  return key.toLowerCase().replace(/[_-]/g, "");
+}
+var TOKEN_PATTERNS = [
+  POWERPLANT_TOKEN_PATTERN,
+  // JWTs, incl. Supabase anon/service-role keys (three base64url segments).
+  /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}/g,
+  // OpenAI/Anthropic-style keys (sk-…, sk-ant-…, sk-proj-…).
+  /\bsk-[A-Za-z0-9_-]{20,}/g,
+  // GitHub tokens: classic (ghp_/gho_/ghu_/ghs_/ghr_) and fine-grained.
+  /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+  /\bgithub_pat_[A-Za-z0-9_]{22,}/g,
+  // AWS access key ids.
+  /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g,
+  // Slack tokens.
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}/g,
+  // Google API keys.
+  /\bAIza[0-9A-Za-z_-]{35}/g,
+  // Stripe secret/restricted keys and webhook signing secrets.
+  /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g,
+  /\bwhsec_[A-Za-z0-9]{24,}/g,
+  // npm automation tokens.
+  /\bnpm_[A-Za-z0-9]{36}/g,
+  // 1Password service-account tokens (OP_TOKEN values).
+  /\bops_[A-Za-z0-9_-]{16,}/g,
+  // Supabase personal access tokens.
+  /\bsbp_[A-Za-z0-9]{40}/g
+];
+var CONTEXT_PATTERNS = [
+  // PEM private-key blocks, complete header-to-footer.
+  {
+    pattern: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
+    replacement: REDACTED
+  },
+  // Torn PEM body: a transcript cut mid-key has the header and base64 body
+  // but no END marker. Consume the header plus every following run of
+  // base64-looking material (16+ chars, optionally separated by whitespace
+  // or JSON \n escapes), allow one short trailing run (a key's final line
+  // is usually short), and stop at ordinary text. Neither anchored to
+  // end-of-input (that left key-body-then-prose unredacted) nor greedy
+  // over prose (end-of-input as an END alternate wiped whole streams after
+  // one header mention).
+  // The optional short tail is a base64-PADDED line (ends in =): that's the
+  // real shape of a key's short final line, and the padding requirement is
+  // what keeps an ordinary prose word after a torn body from being eaten.
+  {
+    pattern: (
+      // Header/base64 alphabets are fixed; greedy consumption prevents secret
+      // fragments surviving. Existing redaction tests cover torn inputs.
+      // eslint-disable-next-line security/detect-unsafe-regex
+      /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----(?:(?:\s|\\n)*[A-Za-z0-9+/=]{16,})+(?:(?:\s|\\n)+[A-Za-z0-9+/]{0,13}={1,2})?/g
+    ),
+    replacement: REDACTED
+  },
+  // A cut so early only a short fragment follows the header: fires only at
+  // end of input, which is the per-line torn-JSONL shape (each line is its
+  // own input) and the tail of a stream cut mid-write. Prose mentions
+  // mid-stream never reach this rule.
+  {
+    pattern: (
+      // End anchoring bounds the torn short-fragment fallback to one input tail.
+      // eslint-disable-next-line security/detect-unsafe-regex
+      /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----(?:\s|\\n)*(?:[A-Za-z0-9+/=]{1,15})?(?:\s|\\n)*$/g
+    ),
+    replacement: REDACTED
+  },
+  // Passwords inside connection URLs: scheme://user:password@host. The
+  // scheme quantifier is bounded (real schemes are short) — unbounded, it
+  // backtracked O(n) at every offset of a long unbroken alphanumeric run,
+  // making redaction quadratic on big base64-ish payloads (~4s at 64KB).
+  {
+    pattern: /([a-z][a-z0-9+.-]{0,31}:\/\/[^\s:@/"'\\]+:)[^\s@/"'\\]+@/gi,
+    replacement: `$1${REDACTED}@`
+  },
+  // Bearer credentials wherever they appear (headers, curl commands).
+  { pattern: /\b(bearer\s+)[A-Za-z0-9._~+/=-]{16,}/gi, replacement: `$1${REDACTED}` },
+  // Basic credentials only in an Authorization context — bare "basic <word>"
+  // is common prose, "Authorization: Basic <base64>" is not.
+  {
+    pattern: /(authorization\\?["']?\s*[:=]\s*\\?["']?basic\s+)[A-Za-z0-9+/=]{8,}/gi,
+    replacement: `$1${REDACTED}`
+  },
+  // Env-style assignments whose NAME says secret (FOO_TOKEN=…, DB_PASSWORD: …).
+  // Value must be 8+ chars and not purely numeric, so flag words and counter
+  // settings (MAX_TOKENS=4096) survive.
+  {
+    pattern: /\b([A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|API_?KEY|ACCESS_KEY|PRIVATE_KEY|SERVICE_KEY|SERVICE_ROLE_KEY|SIGNING_KEY|ENCRYPTION_KEY|MASTER_KEY|CREDENTIALS?)[A-Z0-9_]*\s*[=:]\s*\\?["']?)(?!\d+["'\s\\,;]|\d+$)[^\s\\"',;]{8,}/g,
+    replacement: `$1${REDACTED}`
+  }
+];
+var SECRET_NAME_WORD = /secret|passw(?:or)?d/;
+var SECRET_NAME_SUFFIX = /(?:token|apikey|accesskey|privatekey|credentials?|servicekey|signingkey|encryptionkey|masterkey)$/;
+function isSecretName(name) {
+  const key = normalizeSecretKey(name);
+  return SECRET_VALUE_KEYS.has(key) || SECRET_NAME_WORD.test(key) || SECRET_NAME_SUFFIX.test(key);
+}
+function isSecretValue(value) {
+  return !/^\d+$/.test(value) && !/^\$[{A-Za-z_]/.test(value);
+}
+var QUOTED_SECRET_VALUE = /\b([A-Za-z_][\w.-]{0,63})(\\?["']?\s*[=:]\s*)(\\?["'])([^"'\\\s]{8,})\3/g;
+var CONFIG_LINE_SECRET_VALUE = (
+  // Anchored to line starts, with bounded prefix and name lengths, so each
+  // line is scanned once. Indentation after a line number sits inside the
+  // line-number group: two adjacent whitespace runs made a long run of
+  // spaces quadratic.
+  // eslint-disable-next-line security/detect-unsafe-regex
+  /^([+-]?(?:(?:[^\s:]{1,256}:)?\d+[:-])?[ \t]*(?:\d+(?:\t|\u2192)[ \t]*)?(?:(?:export|-)[ \t]+)?)([A-Za-z_][\w.-]{0,63})([ \t]*[=:][ \t]*)([^\s"'\\,;()[\]{}<>]{8,})(?=[ \t]*(?:#.*)?\r?$)/gm
+);
+function jsonTokens(text) {
+  const tokens = [];
+  for (const { index } of text.matchAll(/["\r\n]/g)) {
+    if (text[index] !== '"') {
+      tokens.push({ index, level: -1 });
+      continue;
+    }
+    let backslashes = 0;
+    while (text[index - backslashes - 1] === "\\") backslashes += 1;
+    let level = 0;
+    for (let run = backslashes + 1; run % 2 === 0; run /= 2) level += 1;
+    tokens.push({ index, level });
+  }
+  return tokens;
+}
+function stringEnds(tokens) {
+  const ends = [];
+  const pending = [];
+  for (let i = tokens.length - 1; i >= 0; i -= 1) {
+    const { level } = tokens[i];
+    while (pending.length > 0 && tokens[pending.at(-1)].level > level) pending.pop();
+    ends[i] = pending.at(-1) ?? -1;
+    pending.push(i);
+  }
+  return ends;
+}
+function stringTextEnd(text, end) {
+  if (end === void 0) return text.length;
+  return end.level < 0 ? end.index : end.index - (2 ** end.level - 1);
+}
+function skipJsonSpace(text, from, level) {
+  const escapeLength = level === 0 ? 0 : 2 ** (level - 1);
+  let at = from;
+  for (; ; ) {
+    const char = text[at];
+    if (char === " " || level === 0 && (char === "\x09" || char === "\r" || char === "\n")) at += 1;
+    else if (char === "\\" && level > 0 && text.startsWith("\\".repeat(escapeLength), at) && /^[nrt]$/.test(text[at + escapeLength] ?? "")) {
+      at += escapeLength + 1;
+    } else return at;
+  }
+}
+function decodeJsonKey(raw, level) {
+  if (!raw.includes("\\")) return raw;
+  let key = raw;
+  for (let round = 0; round <= level; round += 1) {
+    try {
+      const decoded = JSON.parse(`"${key}"`);
+      if (typeof decoded !== "string") return key;
+      key = decoded;
+    } catch {
+      return key;
+    }
+  }
+  return key;
+}
+function redactJsonSecretValues(text) {
+  if (!text.includes('"')) return text;
+  const tokens = jsonTokens(text);
+  const ends = stringEnds(tokens);
+  let out = "";
+  let copied = 0;
+  for (const [i, { index, level }] of tokens.entries()) {
+    if (level < 0 || index < copied) continue;
+    const keyEnd = ends[i] ?? -1;
+    const keyClose = tokens[keyEnd];
+    if (keyClose?.level !== level) continue;
+    const colon = skipJsonSpace(text, keyClose.index + 1, level);
+    if (text[colon] !== ":") continue;
+    const valueOpen = skipJsonSpace(text, colon + 1, level);
+    let valueQuote = keyEnd + 1;
+    while (tokens[valueQuote]?.level === -1 && (tokens[valueQuote]?.index ?? Infinity) < valueOpen) valueQuote += 1;
+    const quote = tokens[valueQuote];
+    if (quote?.level !== level || quote.index !== valueOpen + 2 ** level - 1) continue;
+    if (!isSecretName(decodeJsonKey(text.slice(index + 1, stringTextEnd(text, keyClose)), level))) continue;
+    const valueStart = quote.index + 1;
+    const valueEnd = stringTextEnd(text, tokens[ends[valueQuote] ?? -1]);
+    if (valueEnd <= valueStart) continue;
+    out += text.slice(copied, valueStart) + REDACTED;
+    copied = valueEnd;
+  }
+  return out + text.slice(copied);
+}
+function redactSecretNamedValues(text) {
+  return redactJsonSecretValues(text).replace(
+    QUOTED_SECRET_VALUE,
+    (match, name, separator, quote, value) => isSecretName(name) && isSecretValue(value) ? `${name}${separator}${quote}${REDACTED}${quote}` : match
+  ).replace(
+    CONFIG_LINE_SECRET_VALUE,
+    (match, prefix, name, separator, value) => isSecretName(name) && isSecretValue(value) && /[\d/+=!@#$%^&*~?]/.test(value) ? `${prefix}${name}${separator}${REDACTED}` : match
+  );
+}
+function redactText(text) {
+  let out = text;
+  for (const { pattern, replacement } of CONTEXT_PATTERNS) {
+    out = out.replace(pattern, replacement);
+  }
+  out = redactSecretNamedValues(out);
+  for (const pattern of TOKEN_PATTERNS) {
+    out = out.replace(pattern, REDACTED);
+  }
+  return out;
+}
+function redactSecrets(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return redactText(text);
+  }
+  const strip = (value) => {
+    if (typeof value === "string") return isImageDataUri(value) ? value : redactText(value);
+    if (Array.isArray(value)) return value.map(strip);
+    if (value && typeof value === "object") {
+      const record = value;
+      for (const key of Object.keys(record)) {
+        if (SECRET_KEYS.has(key)) delete record[key];
+        else if (isSecretName(key) && typeof record[key] === "string") {
+          record[key] = REDACTED;
+        } else if (isImageBase64Payload(record, key)) {
+        } else record[key] = strip(record[key]);
+      }
+    }
+    return value;
+  };
+  return JSON.stringify(strip(parsed));
+}
+function redactJsonl(text) {
+  return text.split("\n").map((line) => line.trim() === "" ? line : redactSecrets(line)).join("\n");
+}
+var utf8Encoder = new TextEncoder();
+var utf8Decoder = new TextDecoder();
+
+// ../../packages/core/src/sessionViews.ts
+var CLOUD_SESSION_ID = /^session_[A-Za-z0-9]+$/;
+function claudeCloudSessionUrl(cloudSessionId) {
+  return CLOUD_SESSION_ID.test(cloudSessionId) ? `https://claude.ai/code/${cloudSessionId}` : null;
+}
+var TEAM_ACTIVITY_FRESH_WINDOW_MS = 48 * 36e5;
+var MACHINE_ENROLL_CALLBACK_PORT = 41999;
+var MACHINE_ENROLL_CALLBACK_PATH = "/callback";
+var MACHINE_ENROLL_CALLBACK_URL = `http://127.0.0.1:${MACHINE_ENROLL_CALLBACK_PORT}${MACHINE_ENROLL_CALLBACK_PATH}`;
+
+// ../../packages/core/src/cloudCaptureToken.ts
+var CLOUD_CAPTURE_TOKEN = /ppu_[A-Za-z0-9_-]{43,}/g;
+function redactCloudCaptureTokens(text) {
+  return text.replace(CLOUD_CAPTURE_TOKEN, "[REDACTED]");
+}
+
+// src/cloudTranscript.ts
+var MAX_CLOUD_TRANSCRIPT_BYTES = 64 * 1024 * 1024;
+var CLOUD_SESSION_HEADER = "x-powerplant-cloud-session";
+var CLOUD_REPO_HEADER = "x-powerplant-repo";
+var CLOUD_REPO_PATTERN = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
+
+// src/cloudCaptureHook.ts
+var DEFAULT_API_URL = "https://api.usepowerplant.com";
+var MAX_GZIPPED_BYTES = MAX_CLOUD_TRANSCRIPT_BYTES / 2;
+var TRANSCRIPT_QUIET_MS = 2e3;
+var TRANSCRIPT_WAIT_MS = 15e3;
+var MAX_FAILED_TURNS = 3;
+var HOOK_DEADLINE_MS = 18e4;
+var CURL_MAX_TIME_SECONDS = 120;
+var TOKEN_PATTERN = /^[A-Za-z0-9_-]+$/;
+function cloudSessionIdFromEnv(value) {
+  const id = (value ?? "").replace(/^cse_/, "session_");
+  return claudeCloudSessionUrl(id) === null ? null : id;
+}
+function repoFromRemoteUrl(remoteUrl) {
+  const segments = remoteUrl.trim().replace(/\/+$/, "").replace(/\.git$/, "").split(/[/:]/);
+  const repo = segments.slice(-2).join("/");
+  return segments.length >= 2 && CLOUD_REPO_PATTERN.test(repo) ? repo : null;
+}
+var upstreamError = (body) => {
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed && typeof parsed === "object" && "error" in parsed && typeof parsed.error === "string") {
+      return parsed.error;
+    }
+  } catch {
+  }
+  return "no error message";
+};
+function uploadOutcome(httpStatus, body) {
+  if (httpStatus === 200) {
+    let data;
+    try {
+      data = JSON.parse(body).data;
+    } catch {
+      data = void 0;
+    }
+    const stored = data && typeof data === "object" && "stored" in data ? data.stored : void 0;
+    if (stored === true) return { result: "stored", next: "continue", message: "Transcript stored." };
+    const reason = data && typeof data === "object" && "reason" in data ? String(data.reason) : "unknown";
+    if (reason === "older") {
+      return { result: "not-stored", next: "continue", message: "Powerplant already has a newer copy." };
+    }
+    return {
+      result: "not-stored",
+      next: "stop",
+      message: reason === "outside-scope" ? "Powerplant does not capture this repository with this token." : reason === "deleted" ? "This session was deleted in Powerplant." : `Powerplant did not store the transcript (${reason}).`
+    };
+  }
+  if (httpStatus === 401) {
+    return {
+      result: "failed",
+      next: "stop",
+      message: "Powerplant got no valid capture token. Add the token to this cloud environment (apps/api/scripts/cloud-capture-token.mts)."
+    };
+  }
+  const message = `HTTP ${httpStatus}: ${upstreamError(body)}`;
+  if (httpStatus === 429) return { result: "busy", next: "continue", message };
+  return { result: "failed", next: httpStatus >= 500 ? "continue" : "stop", message };
+}
+function curlConfig(input) {
+  const quoted = (value) => `"${value.replace(/[\\"]/g, (char) => `\\${char}`).replace(/\n/g, "\\n").replace(/\r/g, "\\r")}"`;
+  const lines = [
+    `url = ${quoted(input.url)}`,
+    `header = "Content-Type: application/gzip"`,
+    `header = ${quoted(`${CLOUD_SESSION_HEADER}: ${input.cloudSessionId}`)}`,
+    `header = ${quoted(`${CLOUD_REPO_HEADER}: ${input.repo}`)}`,
+    `data-binary = ${quoted(`@${input.bodyPath}`)}`,
+    `output = ${quoted(input.responsePath)}`,
+    `write-out = "%{http_code}"`,
+    `max-time = ${CURL_MAX_TIME_SECONDS}`,
+    "silent",
+    "show-error"
+  ];
+  if (input.token) lines.push(`header = ${quoted(`Authorization: Bearer ${input.token}`)}`);
+  return `${lines.join("\n")}
+`;
+}
+function readHookInput(env, stdin) {
+  let transcriptPath;
+  try {
+    transcriptPath = JSON.parse(stdin).transcript_path;
+  } catch {
+    return "The hook input is not JSON.";
+  }
+  if (typeof transcriptPath !== "string" || transcriptPath === "") return "The hook input has no transcript_path.";
+  const cloudSessionId = cloudSessionIdFromEnv(env.CLAUDE_CODE_REMOTE_SESSION_ID);
+  if (!cloudSessionId) return "CLAUDE_CODE_REMOTE_SESSION_ID is missing or is not a session id.";
+  const projectDir = env.CLAUDE_PROJECT_DIR ?? process.cwd();
+  const remote = spawnSync("git", ["-C", projectDir, "remote", "get-url", "origin"], {
+    encoding: "utf8",
+    timeout: 1e4,
+    env: { ...env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  const repo = remote.status === 0 ? repoFromRemoteUrl(remote.stdout) : null;
+  if (!repo) return "Could not read owner/name from this repository's origin remote.";
+  const token = env.POWERPLANT_CAPTURE_TOKEN?.trim() || null;
+  if (token !== null && !TOKEN_PATTERN.test(token)) return "POWERPLANT_CAPTURE_TOKEN has characters a token never has.";
+  const apiUrl = (env.POWERPLANT_API_URL ?? DEFAULT_API_URL).replace(/\/+$/, "");
+  return { transcriptPath, cloudSessionId, repo, apiUrl, token };
+}
+function readFileIfPresent(file) {
+  try {
+    return readFileSync(file, "utf8");
+  } catch {
+    return "";
+  }
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function waitForQuietTranscript(transcriptPath) {
+  const startedAt = Date.now();
+  for (; ; ) {
+    const quietFor = Date.now() - Math.max(startedAt, statSync(transcriptPath).mtimeMs);
+    const remaining = startedAt + TRANSCRIPT_WAIT_MS - Date.now();
+    if (quietFor >= TRANSCRIPT_QUIET_MS || remaining <= 0) return;
+    await sleep(Math.min(TRANSCRIPT_QUIET_MS - quietFor, remaining));
+  }
+}
+function runCurl(config) {
+  return new Promise((resolve) => {
+    const curl = spawn("curl", ["-q", "--config", "-"], { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    curl.stdout.on("data", (chunk) => stdout += chunk.toString("utf8"));
+    curl.stderr.on("data", (chunk) => stderr += chunk.toString("utf8"));
+    curl.on("error", (error) => resolve({ exitCode: null, stdout, stderr: error.message }));
+    curl.on("close", (exitCode) => resolve({ exitCode, stdout, stderr }));
+    curl.stdin.end(config);
+  });
+}
+async function upload(input, stateDir) {
+  await waitForQuietTranscript(input.transcriptPath);
+  if (statSync(input.transcriptPath).size > MAX_CLOUD_TRANSCRIPT_BYTES) {
+    return { result: "failed", next: "stop", message: "The transcript is larger than Powerplant accepts." };
+  }
+  const redacted = redactCloudCaptureTokens(redactJsonl(readFileSync(input.transcriptPath, "utf8")));
+  const gzipped = gzipSync(redacted);
+  if (gzipped.byteLength > MAX_GZIPPED_BYTES) {
+    return { result: "failed", next: "stop", message: "The transcript is larger than Powerplant accepts." };
+  }
+  const workDir = mkdtempSync(path.join(stateDir, "upload-"));
+  try {
+    const bodyPath = path.join(workDir, "transcript.jsonl.gz");
+    const responsePath = path.join(workDir, "response.json");
+    writeFileSync(bodyPath, gzipped, { mode: 384 });
+    const curl = await runCurl(
+      curlConfig({
+        url: `${input.apiUrl}/api/ingest/cloud-sessions/raw`,
+        cloudSessionId: input.cloudSessionId,
+        repo: input.repo,
+        bodyPath,
+        responsePath,
+        token: input.token
+      })
+    );
+    const httpStatus = Number.parseInt(curl.stdout.trim(), 10);
+    if (curl.exitCode !== 0 || !Number.isFinite(httpStatus) || httpStatus === 0) {
+      const detail = curl.stderr.trim().split("\n")[0]?.slice(0, 300) || `curl exited with ${curl.exitCode}`;
+      return { result: "failed", next: "continue", message: `The upload did not reach Powerplant: ${detail}` };
+    }
+    return uploadOutcome(httpStatus, readFileIfPresent(responsePath));
+  } finally {
+    rmSync(workDir, { recursive: true, force: true });
+  }
+}
+async function runCloudCaptureHook(env, stdin) {
+  if (env.CLAUDE_CODE_REMOTE !== "true") return;
+  const stateDir = path.join(os.tmpdir(), "powerplant-cloud-capture");
+  mkdirSync(stateDir, { recursive: true, mode: 448 });
+  const record = (entry) => {
+    const line = JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
+    appendFileSync(path.join(stateDir, "results.jsonl"), `${line}
+`);
+    process.stderr.write(`powerplant-cloud-capture: ${line}
+`);
+  };
+  const input = readHookInput(env, stdin);
+  if (typeof input === "string") {
+    record({ result: "failed", message: input });
+    return;
+  }
+  const stopMarker = path.join(stateDir, `${input.cloudSessionId}.stopped`);
+  const failuresFile = path.join(stateDir, `${input.cloudSessionId}.failures`);
+  try {
+    statSync(stopMarker);
+    return;
+  } catch {
+  }
+  let outcome;
+  try {
+    outcome = await upload(input, stateDir);
+  } catch (error) {
+    outcome = {
+      result: "failed",
+      next: "continue",
+      message: `The hook could not prepare the upload: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  if (outcome.result === "failed" && outcome.next === "continue") {
+    const failures = (Number.parseInt(readFileIfPresent(failuresFile), 10) || 0) + 1;
+    writeFileSync(failuresFile, String(failures));
+    if (failures >= MAX_FAILED_TURNS) {
+      outcome = { ...outcome, next: "stop", message: `${outcome.message} (${failures} failed turns in a row)` };
+    }
+  } else {
+    rmSync(failuresFile, { force: true });
+  }
+  record({ cloudSessionId: input.cloudSessionId, repo: input.repo, ...outcome });
+  if (outcome.next === "stop") writeFileSync(stopMarker, `${outcome.message}
+`);
+}
+async function main() {
+  setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  try {
+    await runCloudCaptureHook(process.env, Buffer.concat(chunks).toString("utf8"));
+  } catch (error) {
+    process.stderr.write(`powerplant-cloud-capture: ${error instanceof Error ? error.message : String(error)}
+`);
+  }
+}
+
+// <stdin>
+await main();