opencode-rehydra-core 0.14.0

package/dist/opencode-plugin/plugin.js

@@ -0,0 +1,294 @@
+/**
+ * Rehydra OpenCode Plugin — Plugin V2.
+ *
+ * Uses OpenCode Plugin V2 hooks to anonymize secrets before they reach the LLM
+ * and rehydrate PII tags before local tool execution:
+ * - session.hook("context" | "compaction" | "generate") — anonymize all request
+ *   messages in place and inject the rehydra instruction when needed.
+ * - session.hook("title") — anonymize the title request messages only.
+ * - tool.hook("execute.before") — rehydrate PII tags in tool arguments.
+ * - tool.hook("execute.after") — rehydrate PII tags in completed tool results.
+ * - session.hook("http.response") — rehydrate PII tags in the primary answer
+ *   body (JSON and SSE) before OpenCode renders it.
+ * - session.hook("experimental.ws.receive") — rehydrate PII tags in WebSocket
+ *   frames carrying model output.
+ */
+import { createAnonymizer } from "../core/anonymizer.js";
+import { AnonymizerSessionImpl } from "../storage/session-base.js";
+import { InMemoryPIIStorageProvider } from "../storage/in-memory.js";
+import { InMemoryKeyProvider } from "../crypto/index.js";
+import { DEFAULT_TAG_FORMAT, SECRET_PII_TYPES, createDefaultPolicy, } from "../types/index.js";
+import { buildPIISystemInstruction } from "../proxy/system-instruction.js";
+import { buildTagPrefix } from "../utils/regex.js";
+import { githubUsernameRecognizer } from "./github-username.js";
+import { protectIdentityTags } from "./identity-recognizer.js";
+import { gitIdentityRecognizer } from "./git-identity.js";
+import { AnonymizationState } from "./v2/anon-state.js";
+import { createLogger } from "./v2/logger.js";
+import { anonymizerConfigFromOptions, normalizePluginOptions, policyFromOptions, } from "./v2/options.js";
+import { SessionStore } from "./v2/sessions.js";
+import { registerSessionContextHook, registerSessionTitleHook, registerToolAfterHook, registerToolBeforeHook, } from "./v2/register-hooks.js";
+import { InMemoryRehydrateTailStore, rehydrateHttpResponse, rehydrateWsFrame, } from "./v2/response-rehydrate.js";
+/**
+ * Resolves the project directory from the V2 context, falling back through the
+ * legacy V1 fields and finally the process working directory.
+ */
+export function directoryFromContext(ctx) {
+    const location = ctx.location?.directory;
+    if (typeof location === "string" && location.length > 0)
+        return location;
+    if (typeof ctx.directory === "string" && ctx.directory.length > 0) {
+        return ctx.directory;
+    }
+    if (typeof ctx.worktree === "string" && ctx.worktree.length > 0) {
+        return ctx.worktree;
+    }
+    return process.cwd();
+}
+/** Normalizes an unknown thrown value into a loggable message. */
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Registers the response-side hooks that restore PII tags in model output.
+ *
+ * Both registrations are best-effort: if OpenCode does not expose a hook (or
+ * rejects it), the failure is logged and the remaining hooks still work.
+ */
+async function registerResponseHooks(ctx, registrations, logger, resolveSession, responseDeps) {
+    try {
+        const httpRegistration = await ctx.session.hook("http.response", async (event) => {
+            try {
+                const session = resolveSession(event.sessionID);
+                await rehydrateHttpResponse(event, {
+                    rehydrate: (input) => session.rehydrate(input),
+                    log: logger,
+                    sessionID: event.sessionID,
+                    kind: event.kind,
+                    tagPrefix: responseDeps.tagPrefix,
+                    tagClose: responseDeps.tagClose,
+                    tailStore: responseDeps.tailStore,
+                });
+            }
+            catch (error) {
+                logger.error("rehydra http.response hook failed", {
+                    error: errorMessage(error),
+                });
+            }
+        });
+        registrations.push(httpRegistration);
+    }
+    catch (error) {
+        logger.error("failed to register rehydra http.response hook", {
+            error: errorMessage(error),
+        });
+    }
+    try {
+        const wsRegistration = await ctx.session.hook("experimental.ws.receive", async (event) => {
+            try {
+                const session = resolveSession(event.sessionID);
+                await rehydrateWsFrame(event, {
+                    rehydrate: (input) => session.rehydrate(input),
+                    log: logger,
+                    sessionID: event.sessionID,
+                    tagPrefix: responseDeps.tagPrefix,
+                    tagClose: responseDeps.tagClose,
+                    tailStore: responseDeps.tailStore,
+                });
+            }
+            catch (error) {
+                logger.error("rehydra experimental.ws.receive hook failed", {
+                    error: errorMessage(error),
+                });
+            }
+        });
+        registrations.push(wsRegistration);
+    }
+    catch (error) {
+        logger.error("failed to register rehydra experimental.ws.receive hook", {
+            error: errorMessage(error),
+        });
+    }
+}
+/**
+ * Creates a Rehydra plugin for OpenCode.
+ *
+ * @example
+ * ```typescript
+ * // .opencode/plugins/rehydra.ts
+ * import { createRehydraPlugin } from "rehydra/opencode-plugin";
+ * export default createRehydraPlugin({
+ *   envFiles: [".env", ".env.local"],
+ * });
+ * ```
+ */
+export function createRehydraPlugin(options) {
+    return {
+        id: "rehydra",
+        async setup(ctx) {
+            const directory = directoryFromContext(ctx);
+            const logger = createLogger(ctx, "rehydra");
+            const registrations = [];
+            const tailStore = new InMemoryRehydrateTailStore();
+            let anonymizer;
+            // Releases every resource acquired by this setup. It is idempotent and
+            // isolates each dispose so one throwing registration cannot strand the
+            // others or the anonymizer. Called by the returned cleanup and by the
+            // failure path below.
+            let disposed = false;
+            const disposeAll = async () => {
+                if (disposed)
+                    return;
+                disposed = true;
+                const pending = registrations.splice(0, registrations.length);
+                await Promise.all(pending.map(async (registration) => {
+                    try {
+                        await registration.dispose();
+                    }
+                    catch (error) {
+                        logger.warn("failed to dispose rehydra hook", {
+                            error: errorMessage(error),
+                        });
+                    }
+                }));
+                tailStore.clear();
+                if (anonymizer !== undefined) {
+                    try {
+                        await anonymizer.dispose();
+                    }
+                    catch (error) {
+                        logger.warn("failed to dispose rehydra anonymizer", {
+                            error: errorMessage(error),
+                        });
+                    }
+                }
+            };
+            let succeeded = false;
+            try {
+                // Constructor options (local config scripts) take precedence over
+                // options supplied by OpenCode itself; both are untrusted and normalized
+                // below.
+                const resolved = normalizePluginOptions({ ...ctx.options, ...options }, directory);
+                const anonymizerConfig = anonymizerConfigFromOptions(resolved, directory);
+                const tagFormat = anonymizerConfig.tagFormat ?? resolved.tagFormat ?? DEFAULT_TAG_FORMAT;
+                const tagPrefix = buildTagPrefix(tagFormat);
+                const rehydraInstruction = `<rehydra>\n${buildPIISystemInstruction(tagFormat)}\n</rehydra>`;
+                const keyProvider = new InMemoryKeyProvider();
+                const piiStorage = new InMemoryPIIStorageProvider();
+                const createdAnonymizer = createAnonymizer({
+                    ...anonymizerConfig,
+                    tagFormat,
+                    keyProvider,
+                    piiStorageProvider: piiStorage,
+                });
+                anonymizer = createdAnonymizer;
+                if (resolved.vcsIdentities === true) {
+                    createdAnonymizer
+                        .getRegistry()
+                        .register(protectIdentityTags(githubUsernameRecognizer, tagFormat));
+                    createdAnonymizer
+                        .getRegistry()
+                        .register(protectIdentityTags(gitIdentityRecognizer, tagFormat));
+                }
+                await createdAnonymizer.initialize();
+                // Base policy: URL and IP_ADDRESS disabled by default.
+                // `policyFromOptions` re-adds the opt-in secret types the anonymizer
+                // registers internally.
+                const disableTypes = resolved.disableTypes ?? ["URL", "IP_ADDRESS"];
+                const policy = policyFromOptions(resolved);
+                const locale = resolved.locale;
+                const identityPolicy = (types) => {
+                    const defaults = createDefaultPolicy();
+                    const configPolicy = anonymizerConfig.defaultPolicy;
+                    const enabledTypes = new Set(policy?.enabledTypes ??
+                        configPolicy?.enabledTypes ??
+                        defaults.enabledTypes);
+                    const regexEnabledTypes = new Set(policy?.regexEnabledTypes ??
+                        configPolicy?.regexEnabledTypes ??
+                        defaults.regexEnabledTypes);
+                    if (anonymizerConfig.secrets?.enabled === true) {
+                        for (const type of SECRET_PII_TYPES) {
+                            if (!disableTypes.includes(type)) {
+                                enabledTypes.add(type);
+                                regexEnabledTypes.add(type);
+                            }
+                        }
+                    }
+                    for (const type of types) {
+                        if (!disableTypes.includes(type)) {
+                            enabledTypes.add(type);
+                            regexEnabledTypes.add(type);
+                        }
+                    }
+                    return {
+                        ...policy,
+                        enabledTypes,
+                        regexEnabledTypes,
+                        reuseIdsForRepeatedPII: true,
+                    };
+                };
+                // One session per OpenCode session, keyed by sessionID.
+                const sessionStore = new SessionStore();
+                const resolveSession = (sessionID) => sessionStore.get(sessionID, () => new AnonymizerSessionImpl(createdAnonymizer, sessionID, piiStorage, keyProvider));
+                const state = new AnonymizationState();
+                const scrubOptions = {
+                    locale,
+                    policy,
+                    vcsIdentities: resolved.vcsIdentities === true,
+                    identityPolicy,
+                };
+                const deps = {
+                    logger,
+                    resolveSession,
+                    state,
+                    rehydraInstruction,
+                    tagPrefix,
+                    scrubOptions,
+                };
+                // Register each hook group independently: a rejected registration must
+                // not prevent the remaining groups from being installed.
+                const registerGroup = async (label, register) => {
+                    try {
+                        const registered = await register();
+                        if (registered !== undefined) {
+                            registrations.push(...registered);
+                        }
+                    }
+                    catch (error) {
+                        logger.error(`failed to register rehydra ${label} hooks`, {
+                            error: errorMessage(error),
+                        });
+                    }
+                };
+                await registerGroup("session context", () => registerSessionContextHook(ctx, deps));
+                await registerGroup("session title", () => registerSessionTitleHook(ctx, deps));
+                await registerGroup("tool execute.before", () => registerToolBeforeHook(ctx, deps));
+                await registerGroup("tool execute.after", () => registerToolAfterHook(ctx, deps));
+                // Response hooks restore the real values in model output before
+                // OpenCode renders them. Registration is best-effort: an unavailable
+                // hook must not prevent the plugin (and OpenCode) from starting.
+                await registerGroup("response", () => registerResponseHooks(ctx, registrations, logger, resolveSession, {
+                    tagPrefix,
+                    tagClose: tagFormat.close,
+                    tailStore,
+                }));
+                logger.info("plugin initialized", {
+                    envFiles: anonymizerConfig.secrets?.envFiles,
+                    redactValueCount: resolved.redactValues?.length ?? 0,
+                    disableTypes,
+                });
+                succeeded = true;
+                return disposeAll;
+            }
+            finally {
+                if (!succeeded) {
+                    await disposeAll();
+                }
+            }
+        },
+    };
+}
+/** Default plugin instance used by `opencode.json`. */
+export const plugin = createRehydraPlugin();
+export default plugin;
+//# sourceMappingURL=plugin.js.map

package/dist/opencode-plugin/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/opencode-plugin/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAElB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AAWpC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAyB;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzE,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAyB,EACzB,aAAiC,EACjC,MAAgB,EAChB,cAA+B,EAC/B,YAIC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAC7C,eAAe,EACf,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChD,MAAM,qBAAqB,CAAC,KAAK,EAAE;oBACjC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;oBAC9C,GAAG,EAAE,MAAM;oBACX,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,SAAS,EAAE,YAAY,CAAC,SAAS;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBAChD,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CACF,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE;YAC5D,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAC3C,yBAAyB,EACzB,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChD,MAAM,gBAAgB,CAAC,KAAK,EAAE;oBAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;oBAC9C,GAAG,EAAE,MAAM;oBACX,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,SAAS,EAAE,YAAY,CAAC,SAAS;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBAC1D,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CACF,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE;YACtE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA8B;IAChE,OAAO;QACL,EAAE,EAAE,SAAS;QACb,KAAK,CAAC,KAAK,CAAC,GAAyB;YACnC,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAE5C,MAAM,aAAa,GAAuB,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,IAAI,0BAA0B,EAAE,CAAC;YACnD,IAAI,UAAkC,CAAC;YAEvC,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,sBAAsB;YACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;gBAC3C,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC9D,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE;oBACjC,IAAI,CAAC;wBACH,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC/B,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;4BAC5C,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;yBAC3B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CACH,CAAC;gBACF,SAAS,CAAC,KAAK,EAAE,CAAC;gBAClB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,IAAI,CAAC;wBACH,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;oBAC7B,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;4BAClD,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;yBAC3B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;YAEF,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC;gBACH,kEAAkE;gBAClE,yEAAyE;gBACzE,SAAS;gBACT,MAAM,QAAQ,GAAG,sBAAsB,CACrC,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,EAC9B,SAAS,CACV,CAAC;gBACF,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC1E,MAAM,SAAS,GACb,gBAAgB,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,kBAAkB,CAAC;gBACzE,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,kBAAkB,GAAG,cAAc,yBAAyB,CAAC,SAAS,CAAC,cAAc,CAAC;gBAE5F,MAAM,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;gBAC9C,MAAM,UAAU,GAAG,IAAI,0BAA0B,EAAE,CAAC;gBAEpD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;oBACzC,GAAG,gBAAgB;oBACnB,SAAS;oBACT,WAAW;oBACX,kBAAkB,EAAE,UAAU;iBAC/B,CAAC,CAAC;gBACH,UAAU,GAAG,iBAAiB,CAAC;gBAC/B,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;oBACpC,iBAAiB;yBACd,WAAW,EAAE;yBACb,QAAQ,CAAC,mBAAmB,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CAAC;oBACtE,iBAAiB;yBACd,WAAW,EAAE;yBACb,QAAQ,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,iBAAiB,CAAC,UAAU,EAAE,CAAC;gBAErC,uDAAuD;gBACvD,qEAAqE;gBACrE,wBAAwB;gBACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBACpE,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAE/B,MAAM,cAAc,GAAG,CACrB,KAAgB,EACc,EAAE;oBAChC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;oBACvC,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,CAAC;oBACpD,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,MAAM,EAAE,YAAY;wBAClB,YAAY,EAAE,YAAY;wBAC1B,QAAQ,CAAC,YAAY,CACxB,CAAC;oBACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,MAAM,EAAE,iBAAiB;wBACvB,YAAY,EAAE,iBAAiB;wBAC/B,QAAQ,CAAC,iBAAiB,CAC7B,CAAC;oBACF,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;wBAC/C,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;4BACpC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gCACjC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gCACvB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BAC9B,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;4BACjC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BACvB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC9B,CAAC;oBACH,CAAC;oBACD,OAAO;wBACL,GAAG,MAAM;wBACT,YAAY;wBACZ,iBAAiB;wBACjB,sBAAsB,EAAE,IAAI;qBAC7B,CAAC;gBACJ,CAAC,CAAC;gBAEF,wDAAwD;gBACxD,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;gBACxC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAyB,EAAE,CAClE,YAAY,CAAC,GAAG,CACd,SAAS,EACT,GAAG,EAAE,CACH,IAAI,qBAAqB,CACvB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,WAAW,CACZ,CACJ,CAAC;gBACJ,MAAM,KAAK,GAAG,IAAI,kBAAkB,EAAE,CAAC;gBACvC,MAAM,YAAY,GAAyB;oBACzC,MAAM;oBACN,MAAM;oBACN,aAAa,EAAE,QAAQ,CAAC,aAAa,KAAK,IAAI;oBAC9C,cAAc;iBACf,CAAC;gBAEF,MAAM,IAAI,GAAsB;oBAC9B,MAAM;oBACN,cAAc;oBACd,KAAK;oBACL,kBAAkB;oBAClB,SAAS;oBACT,YAAY;iBACb,CAAC;gBAEF,uEAAuE;gBACvE,yDAAyD;gBACzD,MAAM,aAAa,GAAG,KAAK,EACzB,KAAa,EACb,QAAkD,EACnC,EAAE;oBACjB,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,MAAM,QAAQ,EAAE,CAAC;wBACpC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;4BAC7B,aAAa,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;wBACpC,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,KAAK,QAAQ,EAAE;4BACxD,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;yBAC3B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC;gBAEF,MAAM,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAC1C,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,CACtC,CAAC;gBACF,MAAM,aAAa,CAAC,eAAe,EAAE,GAAG,EAAE,CACxC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CACpC,CAAC;gBACF,MAAM,aAAa,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAC9C,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAClC,CAAC;gBACF,MAAM,aAAa,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAC7C,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,CACjC,CAAC;gBAEF,gEAAgE;gBAChE,qEAAqE;gBACrE,iEAAiE;gBACjE,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,CACnC,qBAAqB,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE;oBAChE,SAAS;oBACT,QAAQ,EAAE,SAAS,CAAC,KAAK;oBACzB,SAAS;iBACV,CAAC,CACH,CAAC;gBAEF,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBAChC,QAAQ,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ;oBAC5C,gBAAgB,EAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;oBACpD,YAAY;iBACb,CAAC,CAAC;gBAEH,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO,UAAU,CAAC;YACpB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,UAAU,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,MAAM,GAAW,mBAAmB,EAAE,CAAC;AAEpD,eAAe,MAAM,CAAC"}

package/dist/opencode-plugin/types.d.ts

@@ -0,0 +1,33 @@
+/**
+ * OpenCode Plugin Configuration Types
+ */
+import type { AnonymizerConfig } from "../core/anonymizer.js";
+import type { AnonymizationPolicy, TagFormat } from "../types/index.js";
+import type { PIIType } from "../types/pii-types.js";
+/** PII type names as strings, for convenience in plugin config */
+export type PIITypeName = `${PIIType}`;
+/**
+ * Configuration options for the Rehydra OpenCode plugin.
+ */
+export interface RehydraPluginOptions {
+    /** Paths/globs relative to the OpenCode project directory. Defaults to recursive .env discovery.
+     * Skips node_modules, .git, and symlinks. Pass [] to disable file loading. */
+    envFiles?: string[];
+    /** Explicit values to always redact */
+    redactValues?: string[];
+    /** Minimum value length to consider as a secret (default: 4) */
+    minValueLength?: number;
+    /** PII types to disable (default: ["URL", "IP_ADDRESS"]). Pass [] to enable all types. */
+    disableTypes?: PIITypeName[];
+    /** Locale hint for anonymization */
+    locale?: string;
+    /** Redact identities found in Git and GitHub CLI output */
+    vcsIdentities?: boolean;
+    /** Policy overrides */
+    policy?: Partial<AnonymizationPolicy>;
+    /** Advanced: full anonymizer config (overrides envFiles/redactValues/minValueLength) */
+    anonymizer?: AnonymizerConfig;
+    /** Tag format configuration (shorthand — also available via anonymizer.tagFormat) */
+    tagFormat?: TagFormat;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/opencode-plugin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/opencode-plugin/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,kEAAkE;AAClE,MAAM,MAAM,WAAW,GAAG,GAAG,OAAO,EAAE,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;kFAC8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAE7B,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,uBAAuB;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEtC,wFAAwF;IACxF,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B,qFAAqF;IACrF,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB"}

package/dist/opencode-plugin/types.js

@@ -0,0 +1,5 @@
+/**
+ * OpenCode Plugin Configuration Types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/opencode-plugin/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/opencode-plugin/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/opencode-plugin/v2/anon-state.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Tracks whether any anonymization has occurred during a plugin's lifetime.
+ *
+ * The system-prompt instruction is only injected once anonymization has
+ * actually happened, so the flag lives outside the individual hooks.
+ */
+export declare class AnonymizationState {
+    hasAnonymized: boolean;
+    /** Clears the flag, e.g. when a fresh plugin instance takes over. */
+    reset(): void;
+}
+//# sourceMappingURL=anon-state.d.ts.map

package/dist/opencode-plugin/v2/anon-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anon-state.d.ts","sourceRoot":"","sources":["../../../src/opencode-plugin/v2/anon-state.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B,aAAa,UAAS;IAEtB,qEAAqE;IACrE,KAAK,IAAI,IAAI;CAGd"}

package/dist/opencode-plugin/v2/anon-state.js

@@ -0,0 +1,14 @@
+/**
+ * Tracks whether any anonymization has occurred during a plugin's lifetime.
+ *
+ * The system-prompt instruction is only injected once anonymization has
+ * actually happened, so the flag lives outside the individual hooks.
+ */
+export class AnonymizationState {
+    hasAnonymized = false;
+    /** Clears the flag, e.g. when a fresh plugin instance takes over. */
+    reset() {
+        this.hasAnonymized = false;
+    }
+}
+//# sourceMappingURL=anon-state.js.map

package/dist/opencode-plugin/v2/anon-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anon-state.js","sourceRoot":"","sources":["../../../src/opencode-plugin/v2/anon-state.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAC7B,aAAa,GAAG,KAAK,CAAC;IAEtB,qEAAqE;IACrE,KAAK;QACH,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;CACF"}

package/dist/opencode-plugin/v2/deep-rehydrate.d.ts

@@ -0,0 +1,13 @@
+/**
+ * PII tag rehydration for OpenCode Plugin V2 tool hooks.
+ */
+import type { AnonymizerSessionImpl } from "../../storage/session-base.js";
+/**
+ * Recursively rehydrate all string values containing PII tags.
+ * Returns a new value (for strings/arrays) or the same object mutated in-place
+ * (for plain objects). The in-place mutation is required because OpenCode's
+ * tool hooks use the original reference for execution — replacing the object
+ * wholesale has no effect.
+ */
+export declare function deepRehydrate(value: unknown, session: AnonymizerSessionImpl, tagPrefix: string): Promise<unknown>;
+//# sourceMappingURL=deep-rehydrate.d.ts.map

package/dist/opencode-plugin/v2/deep-rehydrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-rehydrate.d.ts","sourceRoot":"","sources":["../../../src/opencode-plugin/v2/deep-rehydrate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAqBlB"}

package/dist/opencode-plugin/v2/deep-rehydrate.js

@@ -0,0 +1,33 @@
+/**
+ * PII tag rehydration for OpenCode Plugin V2 tool hooks.
+ */
+/**
+ * Recursively rehydrate all string values containing PII tags.
+ * Returns a new value (for strings/arrays) or the same object mutated in-place
+ * (for plain objects). The in-place mutation is required because OpenCode's
+ * tool hooks use the original reference for execution — replacing the object
+ * wholesale has no effect.
+ */
+export async function deepRehydrate(value, session, tagPrefix) {
+    if (typeof value === "string") {
+        if (value.includes(tagPrefix)) {
+            return session.rehydrate(value);
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            value[i] = await deepRehydrate(value[i], session, tagPrefix);
+        }
+        return value;
+    }
+    if (value !== null && typeof value === "object") {
+        const obj = value;
+        for (const key of Object.keys(obj)) {
+            obj[key] = await deepRehydrate(obj[key], session, tagPrefix);
+        }
+        return obj;
+    }
+    return value;
+}
+//# sourceMappingURL=deep-rehydrate.js.map

package/dist/opencode-plugin/v2/deep-rehydrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-rehydrate.js","sourceRoot":"","sources":["../../../src/opencode-plugin/v2/deep-rehydrate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAc,EACd,OAA8B,EAC9B,SAAiB;IAEjB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,KAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/opencode-plugin/v2/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * V2 OpenCode plugin shared helpers.
+ *
+ * Barrel export so the plugin entry point can import every helper from a
+ * single path.
+ */
+export * from "./types.js";
+export * from "./logger.js";
+export * from "./options.js";
+export * from "./sessions.js";
+export * from "./anon-state.js";
+export * from "./deep-rehydrate.js";
+export * from "./scrub-messages.js";
+export * from "./register-hooks.js";
+export * from "./sse.js";
+export * from "./response-rehydrate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/opencode-plugin/v2/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/opencode-plugin/v2/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,UAAU,CAAC;AACzB,cAAc,yBAAyB,CAAC"}

package/dist/opencode-plugin/v2/index.js

@@ -0,0 +1,17 @@
+/**
+ * V2 OpenCode plugin shared helpers.
+ *
+ * Barrel export so the plugin entry point can import every helper from a
+ * single path.
+ */
+export * from "./types.js";
+export * from "./logger.js";
+export * from "./options.js";
+export * from "./sessions.js";
+export * from "./anon-state.js";
+export * from "./deep-rehydrate.js";
+export * from "./scrub-messages.js";
+export * from "./register-hooks.js";
+export * from "./sse.js";
+export * from "./response-rehydrate.js";
+//# sourceMappingURL=index.js.map

package/dist/opencode-plugin/v2/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/opencode-plugin/v2/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,UAAU,CAAC;AACzB,cAAc,yBAAyB,CAAC"}

package/dist/opencode-plugin/v2/logger.d.ts

@@ -0,0 +1,24 @@
+/**
+ * OpenCode plugin logger.
+ *
+ * Accommodates both client shapes the plugin may receive:
+ * - V2: `ctx.client.app.log({ body: { service, level, message, extra? } })`,
+ *   where `client` / `app` may be absent entirely.
+ * - V1: a raw client exposing `app.log(...)`.
+ *
+ * When no usable sink exists — or the sink throws / rejects — the message is
+ * emitted to `console.warn` / `console.error` so swallowed hook failures stay
+ * observable in development and tests.
+ *
+ * Logging is best-effort: it must never propagate into plugin hook execution.
+ */
+import type { V2Logger } from "./types.js";
+/**
+ * Creates a logger bound to a plugin context (or raw OpenCode client).
+ *
+ * @param source - Plugin context (`ctx.client.app.log`) or a raw client
+ *   (`source.app.log`). Either shape may be missing.
+ * @param service - Service tag reported to OpenCode's log stream.
+ */
+export declare function createLogger(source: unknown, service?: string): V2Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/opencode-plugin/v2/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/opencode-plugin/v2/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA6B3C;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,SAAY,GAAG,QAAQ,CAkD3E"}

package/dist/opencode-plugin/v2/logger.js

@@ -0,0 +1,73 @@
+/**
+ * OpenCode plugin logger.
+ *
+ * Accommodates both client shapes the plugin may receive:
+ * - V2: `ctx.client.app.log({ body: { service, level, message, extra? } })`,
+ *   where `client` / `app` may be absent entirely.
+ * - V1: a raw client exposing `app.log(...)`.
+ *
+ * When no usable sink exists — or the sink throws / rejects — the message is
+ * emitted to `console.warn` / `console.error` so swallowed hook failures stay
+ * observable in development and tests.
+ *
+ * Logging is best-effort: it must never propagate into plugin hook execution.
+ */
+/** Serializes extra context without ever throwing. */
+function safeStringify(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+/**
+ * Creates a logger bound to a plugin context (or raw OpenCode client).
+ *
+ * @param source - Plugin context (`ctx.client.app.log`) or a raw client
+ *   (`source.app.log`). Either shape may be missing.
+ * @param service - Service tag reported to OpenCode's log stream.
+ */
+export function createLogger(source, service = "rehydra") {
+    const candidate = source;
+    const app = candidate?.client?.app ?? candidate?.app;
+    function fallback(level, message, extra) {
+        const suffix = extra === undefined ? "" : ` extra=${safeStringify(extra)}`;
+        const line = `service=${service} level=${level} message=${message}${suffix}`;
+        if (level === "error") {
+            // eslint-disable-next-line no-console
+            console.error(line);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.warn(line);
+        }
+    }
+    function log(level, message, extra) {
+        const logFn = app?.log;
+        if (typeof logFn !== "function") {
+            fallback(level, message, extra);
+            return;
+        }
+        try {
+            const result = logFn.call(app, {
+                body: { service, level, message, extra },
+            });
+            if (result instanceof Promise) {
+                result.catch(() => {
+                    fallback(level, message, extra);
+                });
+            }
+        }
+        catch {
+            fallback(level, message, extra);
+        }
+    }
+    return {
+        debug: (message, extra) => log("debug", message, extra),
+        info: (message, extra) => log("info", message, extra),
+        warn: (message, extra) => log("warn", message, extra),
+        error: (message, extra) => log("error", message, extra),
+    };
+}
+//# sourceMappingURL=logger.js.map

package/dist/opencode-plugin/v2/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../src/opencode-plugin/v2/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsBH,sDAAsD;AACtD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe,EAAE,OAAO,GAAG,SAAS;IAC/D,MAAM,SAAS,GAAG,MAA2C,CAAC;IAC9D,MAAM,GAAG,GAAG,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,GAAG,CAAC;IAErD,SAAS,QAAQ,CACf,KAAe,EACf,OAAe,EACf,KAA+B;QAE/B,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,WAAW,OAAO,UAAU,KAAK,YAAY,OAAO,GAAG,MAAM,EAAE,CAAC;QAC7E,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,SAAS,GAAG,CACV,KAAe,EACf,OAAe,EACf,KAA+B;QAE/B,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC7B,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;oBAChB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QACvD,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACrD,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACrD,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/dist/opencode-plugin/v2/options.d.ts

@@ -0,0 +1,40 @@
+/**
+ * OpenCode plugin option normalization.
+ *
+ * OpenCode passes plugin options as untrusted, untyped data. These helpers
+ * validate the shape against {@link RehydraPluginOptions}, drop unknown or
+ * malformed fields, apply the plugin's documented defaults, and never throw.
+ *
+ * The resolved helpers mirror the behaviour of the original plugin:
+ * - {@link anonymizerConfigFromOptions} defaults `secrets.envBaseDirectory` to
+ *   the project directory.
+ * - {@link policyFromOptions} keeps URL/IP_ADDRESS disabled by default while
+ *   re-adding the opt-in secret types the anonymizer enables internally.
+ */
+import type { AnonymizerConfig } from "../../core/anonymizer.js";
+import type { AnonymizationPolicy } from "../../types/index.js";
+import type { RehydraPluginOptions } from "../types.js";
+/**
+ * Validates and normalizes raw OpenCode plugin options.
+ *
+ * Unknown or malformed fields are ignored and missing fields fall back to the
+ * plugin defaults. When no `anonymizer` is supplied, one is derived from the
+ * top-level secrets fields.
+ *
+ * @param raw - Untrusted options from OpenCode configuration.
+ * @param ctxDirectory - Project directory, used as `secrets.envBaseDirectory`.
+ */
+export declare function normalizePluginOptions(raw: unknown, ctxDirectory: string): RehydraPluginOptions;
+/**
+ * Resolves the anonymizer configuration, defaulting the secrets base directory
+ * to the project directory when the caller did not set one.
+ */
+export declare function anonymizerConfigFromOptions(options: RehydraPluginOptions, ctxDirectory: string): AnonymizerConfig;
+/**
+ * Builds the policy override implied by `disableTypes`.
+ *
+ * Returns `options.policy` unchanged when nothing is disabled (or the caller
+ * explicitly disabled nothing), matching the original plugin behaviour.
+ */
+export declare function policyFromOptions(options: RehydraPluginOptions): Partial<AnonymizationPolicy> | undefined;
+//# sourceMappingURL=options.d.ts.map