pinta-musecode

Pinta AI adapter for Meta Muse Code — forwards Muse Code lifecycle hook
events to an OTLP collector and, optionally, enforces guard decisions.

Status: stage 1, verified end to end against muse 0.1.0-R708.1.
Telemetry and blocking are both confirmed against a real binary — the
adapter's own deny output cancelled a live turn. Enforcement is still off by
default, because the tool-side deny shape could not be exercised (the test
account hit a billing error before any tool call) and because stage 2 wants
false-positive data first. See Confirmed contracts.

Implementation plan: 🎼 Meta MuseCode 어댑터 구현 계획

---

Platform support

macOS and Linux. Both are supported; there is nothing mac-specific in src/.

Windows is not a gap in this adapter — Muse Code itself has no Windows build.
Meta ships "a native binary on your path for macOS and Linux", and the sandbox
exists in exactly two forms (Seatbelt on macOS, bundled bubblewrap on Linux). So
there is no host to hook on Windows, and none of the .cmd wrapper handling the
other Pinta adapters carry applies here.

OS	Muse Code	Node available	Result
macOS	yes	pinta-manager bundles it	works
Linux	yes	no bundled Node — literal node	works iff system Node is present
Windows	no	—	not applicable

The only platform variable is therefore the Node runtime on Linux, not the
adapter code. See Linux requires Node.

---

How it works

Muse Code binds a shell command to exactly one of its twelve lifecycle events.
The manager installs this adapter as a managed hook, which Muse Code treats
as pre-approved and runs without a trust step.

muse ──spawn──> node dist/index.js <EventName> ──stdin──> payload JSON
                        │
                        ├─ PreToolUse / PermissionRequest ─> POST /guard/evaluate ─> DENY? ─> stdout
                        └─ everything else ────────────────> OTLP span

Two properties are load-bearing and both are covered by tests:

• Enforce before telemetry. A DENY is written to stdout before any
  telemetry work, so a telemetry failure can never bubble into the top-level
  fail-open catch and silently allow a blocked tool.
• **Fail open, a