opencode-swarm 7.150.0 → 7.151.0

package/dist/cli/{index-bhg6brtw.js → index-qa8bmwav.js}

@@ -11,10 +11,13 @@ import {
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-mef0trex.js";
+} from "./index-fkqfcv14.js";
 import {
   init_constants
 } from "./index-cpg98bh1.js";
+import {
+  telemetry
+} from "./index-aw492hpn.js";
 import {
   init_logger,
   warn
@@ -2588,20 +2591,704 @@ function isInDeclaredScope(filePath, scopeEntries, cwd) {
 function redactShellCommand(cmd) {
   if (typeof cmd !== "string")
     return "";
-  let out = cmd.replace(/\/home\/[^/\s"']+/g, "~").replace(/[A-Za-z]:\\Users\\[^\\\s"']+/g, "~").replace(/\/Users\/[^/\s"']+/g, "~");
-  out = out.replace(/\b([A-Z_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_]?KEY|APIKEY|AUTH|CREDENTIAL|PRIVATE[_]?KEY|ACCESS[_]?KEY|_KEY)[A-Z_0-9]*)\s*=\s*(\S+)/gi, "$1=[REDACTED]");
+  let out = cmd.replace(/\/home\/[^/\s"']+/g, "~").replace(/[A-Za-z]:\\Users\\[^\\\s"']+/gi, "~").replace(/\/Users\/[^/\s"']+/g, "~").replace(/\\\\[^\\\s"']+\\[^\\\s"']+\\[^\\\s"']+(?:\\[^\s"']*)?/g, "~");
+  out = out.replace(/([a-zA-Z][a-zA-Z0-9+.-]{0,32}:\/\/[^\s"'@/]+):([^@\s"'/]+)@/g, "$1:[REDACTED]@");
+  const VALUE = String.raw`(?:"[^"]*"|'[^']*'|\S+)`;
+  out = out.replace(new RegExp(String.raw`\b([A-Z_]{0,64}(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_]?KEY|APIKEY|AUTH|CREDENTIAL|PRIVATE[_]?KEY|ACCESS[_]?KEY|_KEY)[A-Z_0-9]{0,64})\s*=\s*` + VALUE, "gi"), "$1=[REDACTED]");
+  out = out.replace(new RegExp(String.raw`(\$env:[A-Za-z_][A-Za-z_0-9]{0,64}(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_]?KEY|APIKEY|AUTH|CREDENTIAL|PRIVATE[_]?KEY|ACCESS[_]?KEY|_KEY)[A-Za-z_0-9]{0,64})(\s*=\s*)` + VALUE, "gi"), "$1=[REDACTED]");
+  out = out.replace(new RegExp(String.raw`\b(set|SET)(\s+"?)([A-Za-z_][A-Za-z_0-9]{0,64}(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_]?KEY|APIKEY|AUTH|CREDENTIAL|PRIVATE[_]?KEY|ACCESS[_]?KEY|_KEY)[A-Za-z_0-9]{0,64})(=?)(\s+)` + VALUE, "gi"), "$1$2$3=[REDACTED]");
   out = out.replace(/--([a-zA-Z-]*(?:token|secret|password|passwd|api[_-]?key|apikey|auth|credential|private[_-]?key|access[_-]?key)[a-zA-Z-]*)=(\S+)/gi, "--$1=[REDACTED]");
   out = out.replace(/(--[a-zA-Z-]*(?:token|secret|password|passwd|api[_-]?key|apikey|auth|credential|private[_-]?key|access[_-]?key)[a-zA-Z-]*)(\s+)(?!--)(\S+)/gi, "$1$2[REDACTED]");
   out = out.replace(/\b(Bearer|Basic)\s+[A-Za-z0-9+/=._-]{4,}/gi, "$1 [REDACTED]");
   out = out.replace(/(-H\s+['"]?(?:Authorization|X-API-Key|X-Auth-Token|[A-Za-z][A-Za-z-]*-(?:key|token|secret|auth|credential)):\s*)([^'">\s][^'">\n]*)(['"]?)/gi, "$1[REDACTED]$3");
+  out = out.replace(/\bsk-[A-Za-z0-9_-]{20,}/g, "[REDACTED:openai]").replace(/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g, "[REDACTED:github]").replace(/\bgithub_pat_[A-Za-z0-9_]{22,}/g, "[REDACTED:github]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED:aws]").replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}/g, "[REDACTED:slack]").replace(/\bAIza[A-Za-z0-9_-]{30,}/g, "[REDACTED:google]");
+  out = out.replace(/[A-Za-z0-9+/]{80,}={0,2}/g, (run) => /[A-Z]/.test(run) && /[a-z]/.test(run) && /[0-9]/.test(run) ? "[REDACTED:base64]" : run);
   return out;
 }
 
+// src/hooks/guardrails/shell-audit-store.ts
+import * as fs from "fs";
+import * as path2 from "path";
+import { StringDecoder } from "string_decoder";
+init_logger();
+var SHELL_AUDIT_LIMITS = {
+  activeMaxBytes: 1024 * 1024,
+  securityMaxEntries: 4000,
+  allowedMaxEntries: 2000,
+  allowedAgeMaxMs: 72 * 60 * 60 * 1000,
+  compactMaxBytes: 256 * 1024,
+  readMaxBytes: 256 * 1024,
+  checkInterval: 25,
+  warnCooldownMs: 60000,
+  headerMaxBytes: 16 * 1024,
+  maxLineBytes: 64 * 1024,
+  maxCommandChars: 4096,
+  maxReasonChars: 1024,
+  migrationMaxBytes: 8 * 1024 * 1024
+};
+function decisionClassOf(event) {
+  return typeof event.type === "string" && event.type.length > 0 ? "security" : "allowed";
+}
+function decisionDiscriminator(event) {
+  if (typeof event.type === "string" && event.type.length > 0) {
+    return event.type.slice(0, 64);
+  }
+  return "shell";
+}
+function decisionTimestamp(event) {
+  if (typeof event.ts !== "string")
+    return null;
+  const ts = Date.parse(event.ts);
+  return Number.isNaN(ts) ? null : event.ts;
+}
+var MANIFEST_TYPE = "swarm-shell-audit-manifest";
+var MANIFEST_SCHEMA = 1;
+var BY_TYPE_MAX_KEYS = 16;
+var BY_TYPE_OTHER = "__other__";
+function emptyFolded() {
+  return {
+    totalDecisions: 0,
+    byType: {},
+    corrupt: 0,
+    dropped: 0,
+    oldestTimestamp: null,
+    newestTimestamp: null
+  };
+}
+function emptyManifest() {
+  return {
+    v: 1,
+    type: MANIFEST_TYPE,
+    schemaVersion: MANIFEST_SCHEMA,
+    folded: emptyFolded(),
+    updatedAt: new Date().toISOString()
+  };
+}
+function parseManifestLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed)
+    return null;
+  try {
+    const obj = JSON.parse(trimmed);
+    if (typeof obj !== "object" || obj === null)
+      return null;
+    const rec = obj;
+    if (rec.type !== MANIFEST_TYPE || rec.v !== 1 || rec.schemaVersion !== MANIFEST_SCHEMA || typeof rec.folded !== "object" || rec.folded === null) {
+      return null;
+    }
+    const f = rec.folded;
+    const manifest = emptyManifest();
+    const num = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0;
+    manifest.folded.totalDecisions = num(f.totalDecisions);
+    manifest.folded.corrupt = num(f.corrupt);
+    manifest.folded.dropped = num(f.dropped);
+    if (typeof f.byType === "object" && f.byType !== null) {
+      for (const [k, v] of Object.entries(f.byType)) {
+        if (typeof v === "number" && Number.isFinite(v) && v >= 0) {
+          manifest.folded.byType[k] = v;
+        }
+      }
+    }
+    if (typeof f.oldestTimestamp === "string") {
+      manifest.folded.oldestTimestamp = f.oldestTimestamp;
+    }
+    if (typeof f.newestTimestamp === "string") {
+      manifest.folded.newestTimestamp = f.newestTimestamp;
+    }
+    manifest.updatedAt = typeof rec.updatedAt === "string" ? rec.updatedAt : new Date().toISOString();
+    return manifest;
+  } catch {
+    return null;
+  }
+}
+var _internals = {
+  appendFileSync: fs.appendFileSync,
+  readFileSync: fs.readFileSync,
+  existsSync: fs.existsSync,
+  mkdirSync: fs.mkdirSync,
+  statSync: fs.statSync,
+  renameSync: fs.renameSync,
+  writeFileSync: fs.writeFileSync,
+  unlinkSync: fs.unlinkSync,
+  openSync: fs.openSync,
+  closeSync: fs.closeSync,
+  readSync: fs.readSync,
+  now: () => Date.now(),
+  limits: SHELL_AUDIT_LIMITS,
+  emitHealth: emitShellAuditHealth
+};
+function shellAuditFilePath(directory) {
+  return path2.join(directory, ".swarm", "session", "shell-audit.jsonl");
+}
+function lockFilePath(directory) {
+  return path2.join(directory, ".swarm", "session", "shell-audit.lock");
+}
+function tmpPathFor(finalPath) {
+  return `${finalPath}.${process.pid}.tmp`;
+}
+function readBoundedChunk(filePath, maxBytes, offset = 0) {
+  try {
+    if (!_internals.existsSync(filePath)) {
+      return { text: "", truncated: false };
+    }
+    const fd = _internals.openSync(filePath, "r");
+    try {
+      const size = _internals.statSync(filePath).size;
+      const readable = Math.max(0, size - offset);
+      const truncated = readable > maxBytes;
+      const len = Math.min(readable, maxBytes);
+      const buf = Buffer.alloc(len);
+      let read = 0;
+      while (read < len) {
+        const n = _internals.readSync(fd, buf, read, len - read, offset + read);
+        if (n <= 0)
+          break;
+        read += n;
+      }
+      return { text: buf.toString("utf-8", 0, read), truncated };
+    } finally {
+      _internals.closeSync(fd);
+    }
+  } catch {
+    warnThrottled("bounded read failed (transient I/O)");
+    return { text: "", truncated: false };
+  }
+}
+function fileSizeOrZero(filePath) {
+  try {
+    if (!_internals.existsSync(filePath))
+      return 0;
+    return _internals.statSync(filePath).size;
+  } catch {
+    return 0;
+  }
+}
+function foldLineInto(folded, event) {
+  folded.totalDecisions += 1;
+  const key = decisionDiscriminator(event);
+  const keys = Object.keys(folded.byType);
+  if (folded.byType[key] !== undefined || keys.length < BY_TYPE_MAX_KEYS) {
+    folded.byType[key] = (folded.byType[key] ?? 0) + 1;
+  } else {
+    folded.byType[BY_TYPE_OTHER] = (folded.byType[BY_TYPE_OTHER] ?? 0) + 1;
+  }
+  const ts = decisionTimestamp(event);
+  if (ts !== null) {
+    if (folded.oldestTimestamp === null || ts < folded.oldestTimestamp) {
+      folded.oldestTimestamp = ts;
+    }
+    if (folded.newestTimestamp === null || ts > folded.newestTimestamp) {
+      folded.newestTimestamp = ts;
+    }
+  }
+}
+function cloneFolded(folded) {
+  return {
+    totalDecisions: folded.totalDecisions,
+    byType: { ...folded.byType },
+    corrupt: folded.corrupt,
+    dropped: folded.dropped,
+    oldestTimestamp: folded.oldestTimestamp,
+    newestTimestamp: folded.newestTimestamp
+  };
+}
+function atomicReplace(directory, content) {
+  const lines = content.split(`
+`);
+  if (lines.length < 2 || lines[lines.length - 1] !== "") {
+    throw new Error("shell-audit atomic replace failed (framing)");
+  }
+  if (parseManifestLine(lines[0] ?? "") === null) {
+    throw new Error("shell-audit atomic replace failed (manifest)");
+  }
+  for (let i = 1;i < lines.length - 1; i += 1) {
+    const line = lines[i];
+    if (line.trim() === "")
+      continue;
+    JSON.parse(line);
+  }
+  const finalPath = shellAuditFilePath(directory);
+  const tmpPath = tmpPathFor(finalPath);
+  try {
+    if (_internals.existsSync(tmpPath)) {
+      try {
+        _internals.unlinkSync(tmpPath);
+      } catch {}
+    }
+    _internals.writeFileSync(tmpPath, content, "utf-8");
+    if (_internals.readFileSync(tmpPath, "utf-8") !== content) {
+      throw new Error("tmp verify mismatch");
+    }
+    renameSyncWithRetry(tmpPath, finalPath);
+  } catch {
+    try {
+      if (_internals.existsSync(tmpPath)) {
+        _internals.unlinkSync(tmpPath);
+      }
+    } catch {}
+    throw new Error("shell-audit atomic replace failed");
+  }
+}
+var LOCK_RETRY_ATTEMPTS = 20;
+var LOCK_RETRY_DELAY_MS = 5;
+var LOCK_STALE_MS = 5 * 60000;
+var sleepScratch = new Int32Array(new SharedArrayBuffer(4));
+function syncSleep(ms) {
+  try {
+    Atomics.wait(sleepScratch, 0, 0, ms);
+  } catch {
+    const start = _internals.now();
+    while (_internals.now() - start < ms) {}
+  }
+}
+var RENAME_RETRY_DELAYS_MS = [10, 25, 50, 100, 200];
+var RETRYABLE_RENAME_CODES = new Set(["EPERM", "EBUSY", "EACCES", "EEXIST"]);
+function renameSyncWithRetry(fromPath, toPath) {
+  let lastError;
+  for (let attempt = 0;attempt <= RENAME_RETRY_DELAYS_MS.length; attempt += 1) {
+    try {
+      _internals.renameSync(fromPath, toPath);
+      return;
+    } catch (err) {
+      lastError = err;
+      const code = err?.code;
+      if (!code || !RETRYABLE_RENAME_CODES.has(code))
+        throw err;
+      if (attempt < RENAME_RETRY_DELAYS_MS.length) {
+        syncSleep(RENAME_RETRY_DELAYS_MS[attempt]);
+      }
+    }
+  }
+  throw lastError;
+}
+function tryLockOnce(directory) {
+  const lockPath = lockFilePath(directory);
+  try {
+    _internals.mkdirSync(path2.dirname(lockPath), { recursive: true });
+    const fd = _internals.openSync(lockPath, "wx");
+    _internals.closeSync(fd);
+    return true;
+  } catch {
+    try {
+      const age = _internals.now() - _internals.statSync(lockPath).mtimeMs;
+      if (age > LOCK_STALE_MS) {
+        try {
+          _internals.unlinkSync(lockPath);
+        } catch {}
+        try {
+          const fd = _internals.openSync(lockPath, "wx");
+          _internals.closeSync(fd);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+    } catch {}
+    return false;
+  }
+}
+function withShellAuditStoreLock(directory, fn) {
+  for (let attempt = 0;attempt < LOCK_RETRY_ATTEMPTS; attempt += 1) {
+    if (tryLockOnce(directory)) {
+      try {
+        return fn();
+      } finally {
+        try {
+          _internals.unlinkSync(lockFilePath(directory));
+        } catch {}
+      }
+    }
+    if (attempt < LOCK_RETRY_ATTEMPTS - 1) {
+      syncSleep(LOCK_RETRY_DELAY_MS);
+    }
+  }
+  return null;
+}
+var _lastWarnAt = 0;
+function warnThrottled(message) {
+  const now = _internals.now();
+  if (now - _lastWarnAt < _internals.limits.warnCooldownMs)
+    return;
+  _lastWarnAt = now;
+  warn(`shell-audit: ${message}`);
+}
+var EMPTY_VIEW = {
+  manifest: null,
+  lines: [],
+  corruptLines: 0,
+  prefixFolded: null
+};
+function streamLegacyStore(filePath) {
+  const size = fileSizeOrZero(filePath);
+  const prefixFolded = emptyFolded();
+  const retained = [];
+  let retainedBytes = 0;
+  const windowBudget = _internals.limits.activeMaxBytes + _internals.limits.headerMaxBytes;
+  const chunkBytes = Math.min(512 * 1024, Math.max(1 * 1024, _internals.limits.compactMaxBytes * 2));
+  const ingest = (line) => {
+    if (line.trim() === "")
+      return;
+    let event = null;
+    try {
+      const parsed = JSON.parse(line);
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        event = parsed;
+      }
+    } catch {}
+    if (event === null) {
+      prefixFolded.corrupt += 1;
+      return;
+    }
+    const lineBytes = Buffer.byteLength(line) + 1;
+    if (retainedBytes + lineBytes > windowBudget && retained.length > 0) {
+      const oldest = retained.shift();
+      retainedBytes -= Buffer.byteLength(oldest.line) + 1;
+      foldLineInto(prefixFolded, oldest.event);
+    }
+    retained.push({ line, event });
+    retainedBytes += lineBytes;
+  };
+  let offset = 0;
+  let carry = "";
+  const decoder = new StringDecoder("utf-8");
+  const fd = _internals.openSync(filePath, "r");
+  try {
+    const buf = Buffer.alloc(chunkBytes);
+    for (;; ) {
+      const n = _internals.readSync(fd, buf, 0, chunkBytes, offset);
+      if (n <= 0)
+        break;
+      offset += n;
+      const decoded = decoder.write(buf.subarray(0, n));
+      const parts = `${carry}${decoded}`.split(`
+`);
+      carry = parts.pop() ?? "";
+      for (const line of parts)
+        ingest(line);
+      if (offset >= size)
+        break;
+    }
+  } finally {
+    _internals.closeSync(fd);
+  }
+  const residue = decoder.end();
+  if (residue !== "")
+    carry += residue;
+  if (carry.trim() !== "")
+    ingest(carry);
+  return { manifest: null, lines: retained, corruptLines: 0, prefixFolded };
+}
+function readStoreFull(directory) {
+  const filePath = shellAuditFilePath(directory);
+  if (!_internals.existsSync(filePath)) {
+    return EMPTY_VIEW;
+  }
+  if (fileSizeOrZero(filePath) > _internals.limits.migrationMaxBytes) {
+    return streamLegacyStore(filePath);
+  }
+  let text;
+  try {
+    text = _internals.readFileSync(filePath, "utf-8");
+  } catch {
+    return EMPTY_VIEW;
+  }
+  const rawLines = text.split(`
+`);
+  const lines = [];
+  let corruptLines = 0;
+  let manifest = null;
+  for (let i = 0;i < rawLines.length; i += 1) {
+    const line = rawLines[i];
+    if (line.trim() === "")
+      continue;
+    if (i === 0) {
+      manifest = parseManifestLine(line);
+      if (manifest)
+        continue;
+    }
+    try {
+      const parsed = JSON.parse(line);
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        lines.push({ line, event: parsed });
+      } else {
+        corruptLines += 1;
+      }
+    } catch {
+      corruptLines += 1;
+    }
+  }
+  return { manifest, lines, corruptLines, prefixFolded: null };
+}
+function coverageFor(fileExists, lineCount, truncated) {
+  if (!fileExists || lineCount === 0)
+    return "empty";
+  return truncated ? "truncated" : "complete";
+}
+function readShellAuditTail(directory, maxBytes) {
+  const bound = Math.max(1024, Math.min(maxBytes ?? _internals.limits.readMaxBytes, _internals.limits.readMaxBytes));
+  const filePath = shellAuditFilePath(directory);
+  if (!_internals.existsSync(filePath)) {
+    return { text: "", truncated: false, coverage: "empty" };
+  }
+  let size = fileSizeOrZero(filePath);
+  let truncated = size > bound;
+  let offset = truncated ? Math.max(0, size - bound) : 0;
+  let text = readBoundedChunk(filePath, bound, offset).text;
+  if (truncated && text === "") {
+    size = fileSizeOrZero(filePath);
+    truncated = size > bound;
+    offset = truncated ? Math.max(0, size - bound) : 0;
+    text = readBoundedChunk(filePath, bound, offset).text;
+  }
+  if (truncated) {
+    const firstNewline = text.indexOf(`
+`);
+    text = firstNewline === -1 ? "" : text.slice(firstNewline + 1);
+  }
+  const lines = text.split(`
+`);
+  const start = parseManifestLine(lines[0] ?? "") !== null ? 1 : 0;
+  if (start === 1) {
+    text = lines.slice(1).join(`
+`);
+  }
+  const decisionLineCount = text.split(`
+`).filter((l) => l.trim() !== "").length;
+  const coverage = start === 1 ? truncated ? "truncated" : "complete" : coverageFor(true, decisionLineCount, truncated);
+  return { text, truncated, coverage };
+}
+function getShellAuditFoldedSummary(directory) {
+  const filePath = shellAuditFilePath(directory);
+  if (!_internals.existsSync(filePath))
+    return null;
+  const head = readBoundedChunk(filePath, _internals.limits.headerMaxBytes + 64);
+  const manifest = parseManifestLine(head.text.split(`
+`)[0] ?? "");
+  return manifest ? manifest.folded : null;
+}
+function foldPass(directory, trigger, forceFull) {
+  const filePath = shellAuditFilePath(directory);
+  if (!_internals.existsSync(filePath))
+    return;
+  const view = readStoreFull(directory);
+  if (view.manifest === null && view.lines.length === 0 && view.corruptLines === 0 && view.prefixFolded === null) {
+    return;
+  }
+  const folded = view.manifest ? cloneFolded(view.manifest.folded) : emptyFolded();
+  if (view.prefixFolded !== null) {
+    folded.totalDecisions += view.prefixFolded.totalDecisions;
+    for (const [k, v] of Object.entries(view.prefixFolded.byType)) {
+      folded.byType[k] = (folded.byType[k] ?? 0) + v;
+    }
+    folded.corrupt += view.prefixFolded.corrupt;
+    folded.dropped += view.prefixFolded.dropped;
+    if (view.prefixFolded.oldestTimestamp !== null && (folded.oldestTimestamp === null || view.prefixFolded.oldestTimestamp < folded.oldestTimestamp)) {
+      folded.oldestTimestamp = view.prefixFolded.oldestTimestamp;
+    }
+    if (view.prefixFolded.newestTimestamp !== null && (folded.newestTimestamp === null || view.prefixFolded.newestTimestamp > folded.newestTimestamp)) {
+      folded.newestTimestamp = view.prefixFolded.newestTimestamp;
+    }
+  }
+  const now = _internals.now();
+  const agePruned = new Set;
+  const kept = [];
+  for (const entry of view.lines) {
+    if (entry.event === null) {
+      agePruned.add(entry);
+      continue;
+    }
+    if (decisionClassOf(entry.event) === "security") {
+      kept.push(entry);
+      continue;
+    }
+    const ts = decisionTimestamp(entry.event);
+    if (ts !== null && now - Date.parse(ts) > _internals.limits.allowedAgeMaxMs) {
+      agePruned.add(entry);
+    } else {
+      kept.push(entry);
+    }
+  }
+  const retained = [];
+  let securityCount = 0;
+  let allowedCount = 0;
+  let bytes = Buffer.byteLength(JSON.stringify(view.manifest ?? emptyManifest())) + 1;
+  for (let i = kept.length - 1;i >= 0; i -= 1) {
+    const entry = kept[i];
+    const lineBytes = Buffer.byteLength(entry.line) + 1;
+    if (bytes + lineBytes > _internals.limits.activeMaxBytes) {
+      break;
+    }
+    const cls = decisionClassOf(entry.event);
+    if (cls === "security") {
+      if (securityCount >= _internals.limits.securityMaxEntries) {
+        continue;
+      }
+      securityCount += 1;
+    } else {
+      if (allowedCount >= _internals.limits.allowedMaxEntries) {
+        continue;
+      }
+      allowedCount += 1;
+    }
+    retained.push(entry);
+    bytes += lineBytes;
+  }
+  retained.reverse();
+  const retainedSet = new Set(retained);
+  const candidates = [];
+  for (const entry of view.lines) {
+    if (entry.event === null) {
+      candidates.push(entry);
+    } else if (!retainedSet.has(entry)) {
+      candidates.push(entry);
+    }
+  }
+  const toFold = new Set;
+  let foldedBytes = 0;
+  for (const cand of candidates) {
+    const cb = Buffer.byteLength(cand.line) + 1;
+    if (!forceFull && foldedBytes + cb > _internals.limits.compactMaxBytes && toFold.size > 0) {
+      break;
+    }
+    toFold.add(cand);
+    foldedBytes += cb;
+  }
+  let dropped = 0;
+  for (const cand of toFold) {
+    if (cand.event === null) {
+      folded.corrupt += 1;
+    } else {
+      foldLineInto(folded, cand.event);
+      if (agePruned.has(cand))
+        dropped += 1;
+    }
+  }
+  folded.dropped += dropped;
+  folded.corrupt += view.corruptLines;
+  const finalRetained = [];
+  for (const entry of view.lines) {
+    if (!toFold.has(entry))
+      finalRetained.push(entry);
+  }
+  const manifest = {
+    ...emptyManifest(),
+    folded,
+    updatedAt: new Date().toISOString()
+  };
+  const outLines = [`${JSON.stringify(manifest)}`];
+  for (const entry of finalRetained)
+    outLines.push(entry.line);
+  atomicReplace(directory, outLines.length > 1 ? `${outLines.join(`
+`)}
+` : `${outLines[0]}
+`);
+  emitHealth(directory, {
+    trigger,
+    accepted: folded.totalDecisions + finalRetained.length,
+    compacted: toFold.size - dropped,
+    retained: finalRetained.length,
+    dropped,
+    corrupt: folded.corrupt,
+    oldest: folded.oldestTimestamp,
+    newest: folded.newestTimestamp,
+    bytes: fileSizeOrZero(filePath),
+    limitBytes: _internals.limits.activeMaxBytes
+  });
+}
+function finalizeShellAuditForClose(directory, options) {
+  try {
+    const filePath = shellAuditFilePath(directory);
+    if (!_internals.existsSync(filePath))
+      return;
+    withShellAuditStoreLock(directory, () => {
+      let prev = Number.POSITIVE_INFINITY;
+      for (let pass = 0;pass < 1e4; pass += 1) {
+        const view = readStoreFull(directory);
+        if (view.manifest !== null)
+          break;
+        if (view.lines.length === 0)
+          break;
+        if (view.lines.length >= prev)
+          break;
+        prev = view.lines.length;
+        foldPass(directory, "close", false);
+      }
+      foldPass(directory, "close", true);
+      const transform = options?.lineTransform;
+      if (transform !== undefined) {
+        const view = readStoreFull(directory);
+        if (view.manifest !== null) {
+          const manifest = {
+            ...view.manifest,
+            folded: cloneFolded(view.manifest.folded),
+            updatedAt: new Date().toISOString()
+          };
+          const outLines = [`${JSON.stringify(manifest)}`];
+          for (const entry of view.lines)
+            outLines.push(transform(entry.line));
+          try {
+            atomicReplace(directory, `${outLines.join(`
+`)}
+`);
+          } catch {
+            warnThrottled("archive re-redaction rewrite failed");
+          }
+        }
+      }
+      return true;
+    });
+  } catch {
+    warnThrottled("finalize failed");
+  }
+}
+function emitShellAuditHealth(directory, payload) {
+  try {
+    telemetry.shellAuditHealth({
+      trigger: payload.trigger,
+      accepted_count: payload.accepted,
+      compacted_count: payload.compacted,
+      retained_count: payload.retained,
+      dropped_count: payload.dropped,
+      corrupt_count: payload.corrupt,
+      oldest_timestamp: payload.oldest,
+      newest_timestamp: payload.newest,
+      bytes: payload.bytes,
+      limit_bytes: payload.limitBytes
+    });
+  } catch {}
+}
+function emitHealth(directory, payload) {
+  _internals.emitHealth(directory, payload);
+}
+
 // src/hooks/guardrails/audit-log.ts
 init_logger();
-import * as path2 from "path";
+import { createHash } from "crypto";
+import * as path3 from "path";
+var SHELL_AUDIT_FIELD_CLASSES = Object.freeze({
+  ts: "timestamp",
+  sessionID: "identifier",
+  agent: "identifier",
+  tool: "identifier",
+  type: "decision-type",
+  command: "redacted-command",
+  commandHash: "content-hash",
+  path: "redacted-path",
+  reason: "free-text-redacted",
+  resolvedScope: "redacted-path",
+  declaredScope: "redacted-path",
+  action: "enum",
+  destructiveCategory: "enum",
+  executorMechanism: "enum",
+  skipReason: "enum"
+});
+function hashRedactedCommand(redacted) {
+  return createHash("sha256").update(redacted, "utf-8").digest("hex").slice(0, 16);
+}
 function redactPath(filePath) {
-  if (typeof filePath !== "string" || filePath.length === 0)
+  if (typeof filePath !== "string")
+    return "";
+  if (filePath.length === 0)
     return filePath;
   const rawPosixHomeMatch = filePath.match(/^(\/home\/[^/]+)(\/.*)$/);
   if (rawPosixHomeMatch) {
@@ -2611,8 +3298,8 @@ function redactPath(filePath) {
   if (rawMacHomeMatch) {
     return `~${rawMacHomeMatch[2]}`;
   }
-  const normalized = path2.normalize(filePath);
-  const windowsHomeMatch = normalized.match(/^([A-Za-z]:\\Users\\[^\\]+)(\\.*)$/);
+  const normalized = path3.normalize(filePath);
+  const windowsHomeMatch = normalized.match(/^([A-Za-z]:\\[Uu][Ss][Ee][Rr][Ss]\\[^\\]+)(\\.*)$/i);
   if (windowsHomeMatch) {
     return `~\\${windowsHomeMatch[2]}`;
   }
@@ -2622,5 +3309,55 @@ function redactPath(filePath) {
   }
   return normalized;
 }
+function redactEmbeddedPaths(text) {
+  return text.replace(/\/home\/[^/\s]+(\/[^\s"'`)]*)?/g, (match) => redactPath(match)).replace(/\/Users\/[^/\s]+(\/[^\s"'`)]*)?/g, (match) => redactPath(match)).replace(/[A-Za-z]:\\Users\\[^\\\s]+(\\[^\s"'`)]*)?/gi, (match) => redactPath(match)).replace(/\\\\[^\\\s]+\\[^\\\s]+\\[^\\\s]+(\\[^\s"'`)]*)?/g, (match) => redactPath(match));
+}
+function redactDecisionLineForArchive(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return line;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return line;
+  }
+  const record = parsed;
+  let changed = false;
+  if (typeof record.command === "string") {
+    const redacted = redactShellCommand(record.command);
+    if (redacted !== record.command) {
+      record.command = redacted;
+      changed = true;
+      if (typeof record.commandHash === "string") {
+        record.commandHash = hashRedactedCommand(redacted);
+      }
+    }
+  }
+  if (typeof record.path === "string") {
+    const redacted = redactPath(record.path);
+    if (redacted !== record.path) {
+      record.path = redacted;
+      changed = true;
+    }
+  }
+  if (typeof record.reason === "string") {
+    const redacted = redactEmbeddedPaths(record.reason);
+    if (redacted !== record.reason) {
+      record.reason = redacted;
+      changed = true;
+    }
+  }
+  for (const field of ["declaredScope", "resolvedScope"]) {
+    if (typeof record[field] === "string") {
+      const redacted = redactPath(record[field]);
+      if (redacted !== record[field]) {
+        record[field] = redacted;
+        changed = true;
+      }
+    }
+  }
+  return changed ? JSON.stringify(record) : line;
+}
 
-export { classifyFile, stableCanonicalStringify, checkFileAuthority, normalizeToolNameLowerCase, isInDeclaredScope, redactShellCommand, redactPath };
+export { classifyFile, stableCanonicalStringify, checkFileAuthority, normalizeToolNameLowerCase, isInDeclaredScope, redactShellCommand, readShellAuditTail, getShellAuditFoldedSummary, finalizeShellAuditForClose, redactPath, redactDecisionLineForArchive };