@darkhunt-security/endpoint-codex 0.9.0

package/dist/bin/status.mjs

@@ -0,0 +1,1375 @@
+#!/usr/bin/env node
+import { createRequire as __dhCreateRequire } from 'node:module';
+const require = __dhCreateRequire(import.meta.url);
+
+// packages/core/dist/config/local.js
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join as join3 } from "node:path";
+
+// packages/core/dist/config/paths.js
+import { homedir } from "node:os";
+import { join } from "node:path";
+var CONFIG_DIR = join(homedir(), ".darkhunt");
+
+// packages/core/dist/config/profile.js
+import { homedir as homedir2 } from "node:os";
+import { isAbsolute, join as join2, resolve } from "node:path";
+var DEFAULT_PROFILE = "default";
+var CREDENTIALS_BASENAME = "endpoint-credentials";
+var DEFAULT_CREDENTIALS_PATH = join2(CONFIG_DIR, `${CREDENTIALS_BASENAME}.json`);
+var CREDENTIALS_ENV = "DARKHUNT_ENDPOINT_CREDENTIALS";
+function resolveProfile(explicit, fromConfig) {
+  return explicit ?? process.env["DARKHUNT_PROFILE"] ?? fromConfig ?? DEFAULT_PROFILE;
+}
+function expandPath(path) {
+  if (path.startsWith("~/"))
+    return join2(homedir2(), path.slice(2));
+  return isAbsolute(path) ? path : resolve(CONFIG_DIR, path);
+}
+function credentialsSelection(sources = {}) {
+  const s = typeof sources === "string" ? { profile: sources } : sources;
+  const pointer = s.explicitPath ?? process.env[CREDENTIALS_ENV] ?? s.configuredPath;
+  if (pointer)
+    return { path: expandPath(pointer), explicit: true };
+  const profile = s.profile ?? DEFAULT_PROFILE;
+  if (profile === DEFAULT_PROFILE)
+    return { path: DEFAULT_CREDENTIALS_PATH, explicit: false };
+  return { path: join2(CONFIG_DIR, `${CREDENTIALS_BASENAME}.${profile}.json`), explicit: true };
+}
+function scopeKey(vendor, profile) {
+  return profile === DEFAULT_PROFILE ? vendor : `${vendor}.${profile}`;
+}
+
+// packages/core/dist/config/local.js
+function configPath() {
+  return join3(CONFIG_DIR, `${CONFIG_BASENAME}.json`);
+}
+var CONFIG_BASENAME = "endpoint-config";
+var ConfigError = class extends Error {
+};
+var ConfigMissingError = class extends ConfigError {
+};
+var DEFAULT_API_BASE_URL = "https://api.darkhunt.ai";
+var REQUIRED_FIELDS = ["apiKey", "tenantId", "workspaceId", "applicationId"];
+function readSecure(path) {
+  const mode = statSync(path).mode & 511;
+  if (mode & 63)
+    throw new ConfigError(`${path} is mode ${mode.toString(8)}; must be 0600`);
+  return readFileSync(path, "utf8");
+}
+function readJson(path) {
+  try {
+    return JSON.parse(readSecure(path));
+  } catch (err) {
+    if (err instanceof ConfigError)
+      throw err;
+    return void 0;
+  }
+}
+function settingsFor(file, vendor) {
+  const override = file.endpoints?.[vendor] ?? {};
+  return {
+    ...file,
+    ...override,
+    // Spelled out because these are nested: a spread would let an override naming only
+    // `mode` drop `failClosed` back to its default, quietly turning fail-closed off.
+    ...file.capture ?? override.capture ? { capture: { ...file.capture, ...override.capture } } : {},
+    ...file.enforce ?? override.enforce ? { enforce: { ...file.enforce, ...override.enforce } } : {}
+  };
+}
+function readConfigFile(vendor) {
+  if (!existsSync(configPath())) {
+    throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
+  }
+  const file = readJson(configPath());
+  if (!file) {
+    throw new ConfigError(`cannot read ${configPath()} \u2014 it exists but did not parse`);
+  }
+  return settingsFor(file, vendor);
+}
+function loadLocalConfig(vendor, options = {}) {
+  const vendorFile = readConfigFile(vendor);
+  const profile = resolveProfile(options.profile, vendorFile.profile);
+  const selection = credentialsSelection({
+    ...options.credentialsPath !== void 0 ? { explicitPath: options.credentialsPath } : {},
+    ...vendorFile.credentials !== void 0 ? { configuredPath: vendorFile.credentials } : {},
+    profile
+  });
+  const inlineComplete = REQUIRED_FIELDS.every((name) => typeof vendorFile[name] === "string" && vendorFile[name] !== "");
+  const useInline = inlineComplete && !selection.explicit;
+  const credsPath = useInline ? configPath() : selection.path;
+  const creds = useInline ? {} : readJson(credsPath) ?? {};
+  const apiKey = creds.apiKey ?? vendorFile.apiKey;
+  const tenantId = creds.tenantId ?? vendorFile.tenantId;
+  const apiBaseUrl = (creds.apiBaseUrl ?? vendorFile.apiBaseUrl ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+  const baseUrl = vendorFile.baseUrl ?? `${apiBaseUrl}/trace-hub`;
+  const workspaceId = creds.workspaceId ?? vendorFile.workspaceId;
+  const applicationId = creds.applicationId ?? vendorFile.applicationId;
+  for (const [name, value] of [
+    ["apiKey", apiKey],
+    ["tenantId", tenantId],
+    ["workspaceId", workspaceId],
+    ["applicationId", applicationId]
+  ]) {
+    if (typeof value !== "string" || value === "") {
+      throw new ConfigError(useInline ? `missing ${name} in ${configPath()}` : `missing ${name} for profile '${profile}' (looked in ${credsPath}, then ${configPath()})`);
+    }
+  }
+  return {
+    profile,
+    credentialsPath: credsPath,
+    scope: scopeKey(vendor, profile),
+    baseUrl,
+    apiKey,
+    tenantId,
+    workspaceId,
+    applicationId,
+    ...(creds.userId ?? vendorFile.userId) !== void 0 ? { userId: creds.userId ?? vendorFile.userId } : {},
+    enabled: vendorFile.enabled ?? true,
+    capture: { enabled: vendorFile.capture?.enabled ?? true },
+    enforce: {
+      mode: vendorFile.enforce?.mode ?? "off",
+      failClosed: vendorFile.enforce?.failClosed ?? true
+    }
+  };
+}
+
+// packages/core/dist/spool/spool.js
+import { join as join4 } from "node:path";
+var SPOOL_DIR = join4(CONFIG_DIR, "spool");
+function spoolPath(vendor) {
+  return join4(SPOOL_DIR, `${vendor}.jsonl`);
+}
+
+// packages/core/dist/runtime/beat.js
+import { mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
+import { join as join5 } from "node:path";
+var BEAT_LIVE_MS = 30 * 60 * 1e3;
+function beatPath(scope) {
+  return join5(CONFIG_DIR, `${scope}.hook-beat.json`);
+}
+function loadBeat(scope) {
+  try {
+    const beat = JSON.parse(readFileSync2(beatPath(scope), "utf8"));
+    return { ...beat, sessions: beat.sessions ?? {} };
+  } catch {
+    return void 0;
+  }
+}
+
+// packages/core/dist/forwarder/checkpoint.js
+import { mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, renameSync as renameSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+function checkpointPath(scope) {
+  return join6(CONFIG_DIR, `${scope}.checkpoints.json`);
+}
+function loadCheckpoints(scope) {
+  try {
+    return JSON.parse(readFileSync3(checkpointPath(scope), "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+// packages/core/dist/forwarder/tail.js
+var DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
+var LINE_CEILING = 64 * 1024 * 1024;
+
+// packages/core/dist/forwarder/lock.js
+var STALE_MS = 5 * 60 * 1e3;
+
+// packages/core/dist/forwarder/health.js
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join7 } from "node:path";
+function healthPath(scope) {
+  return join7(CONFIG_DIR, `${scope}.forwarder-health.json`);
+}
+function loadHealth(scope) {
+  try {
+    return JSON.parse(readFileSync4(healthPath(scope), "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+
+// node_modules/@darkhunt-security/telemetry/package.json
+var package_default = {
+  name: "@darkhunt-security/telemetry",
+  version: "0.5.5-build.165",
+  description: "TypeScript SDK for sending LLM traces, generations, and observations to the Darkhunt platform for persistence and security data enrichment. Built on OpenTelemetry primitives, with built-in client-side data masking.",
+  type: "module",
+  license: "Apache-2.0",
+  author: "Darkhunt Limited",
+  homepage: "https://github.com/darkhunt-security/darkhunt-telemetry-ts#readme",
+  bugs: {
+    url: "https://github.com/darkhunt-security/darkhunt-telemetry-ts/issues"
+  },
+  keywords: [
+    "opentelemetry",
+    "otel",
+    "otlp",
+    "llm",
+    "observability",
+    "tracing",
+    "data-masking",
+    "pii"
+  ],
+  engines: {
+    node: "^18.19.0 || >=20.6.0"
+  },
+  main: "dist/index.js",
+  types: "dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js",
+      default: "./dist/index.js"
+    },
+    "./transports": {
+      types: "./dist/transports/index.d.ts",
+      import: "./dist/transports/index.js",
+      default: "./dist/transports/index.js"
+    },
+    "./temporal": {
+      types: "./dist/temporal/index.d.ts",
+      import: "./dist/temporal/index.js",
+      default: "./dist/temporal/index.js"
+    },
+    "./temporal/workflow": {
+      types: "./dist/temporal/workflow-interceptors.d.ts",
+      import: "./dist/temporal/workflow-interceptors.js",
+      default: "./dist/temporal/workflow-interceptors.js"
+    },
+    "./package.json": "./package.json"
+  },
+  files: [
+    "dist/",
+    "LICENSE",
+    "NOTICE",
+    "README.md"
+  ],
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/darkhunt-security/darkhunt-telemetry-ts.git"
+  },
+  scripts: {
+    dev: "tsx watch src/index.ts",
+    prepare: "tsx scripts/generate-rules-json.ts && tsc",
+    prebuild: "tsx scripts/generate-rules-json.ts",
+    build: "tsc",
+    prepublishOnly: "npm run build",
+    pretypecheck: "tsx scripts/generate-rules-json.ts",
+    typecheck: "tsc --noEmit",
+    test: "tsx scripts/generate-rules-json.ts && node --import tsx --test 'test/**/*.test.ts'",
+    "test:coverage": "tsx scripts/generate-rules-json.ts && c8 --reporter=lcov --reporter=text --include 'src/**/*.ts' --exclude 'src/**/*.d.ts' --exclude 'src/masking/rules/**' node --import tsx --test 'test/**/*.test.ts'",
+    lint: "eslint",
+    format: "prettier --write .",
+    "format:check": "prettier --check ."
+  },
+  dependencies: {
+    "@noble/hashes": "^1.8.0",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/context-async-hooks": "^2.0.0",
+    "@opentelemetry/core": "^2.0.0",
+    "@opentelemetry/otlp-transformer": "^0.218.0",
+    "@opentelemetry/resources": "^2.0.0",
+    "@opentelemetry/sdk-trace-base": "^2.0.0",
+    "@opentelemetry/sdk-trace-node": "^2.0.0",
+    "@opentelemetry/semantic-conventions": "^1.30.0"
+  },
+  devDependencies: {
+    "@eslint/js": "^9.0.0",
+    "@temporalio/common": "^1.20.2",
+    "@temporalio/worker": "^1.20.2",
+    "@temporalio/workflow": "^1.20.2",
+    "@types/node": "^25.0.0",
+    c8: "^11.0.0",
+    eslint: "^9.0.0",
+    "eslint-config-prettier": "^10.0.0",
+    "eslint-plugin-prettier": "^5.5.5",
+    prettier: "^3.8.0",
+    tsx: "^4.19.0",
+    typescript: "^5.9.0",
+    "typescript-eslint": "^8.0.0",
+    yaml: "^2.8.4"
+  },
+  peerDependencies: {
+    "@temporalio/common": ">=1.11.0 <2",
+    "@temporalio/worker": ">=1.11.0 <2",
+    "@temporalio/workflow": ">=1.11.0 <2"
+  },
+  peerDependenciesMeta: {
+    "@temporalio/common": {
+      optional: true
+    },
+    "@temporalio/worker": {
+      optional: true
+    },
+    "@temporalio/workflow": {
+      optional: true
+    }
+  }
+};
+
+// node_modules/@darkhunt-security/telemetry/dist/masking/validators/aba.js
+var WEIGHTS = [3, 7, 1, 3, 7, 1, 3, 7, 1];
+function aba(input) {
+  const digits = input.replace(/\s/g, "");
+  if (digits.length !== 9)
+    return false;
+  let sum = 0;
+  for (let i = 0; i < 9; i++) {
+    const n = digits.charCodeAt(i) - 48;
+    if (n < 0 || n > 9)
+      return false;
+    sum += n * WEIGHTS[i];
+  }
+  return sum % 10 === 0;
+}
+
+// node_modules/@noble/hashes/esm/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function anumber(n) {
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new Error("positive integer expected, got " + n);
+}
+function abytes(b, ...lengths) {
+  if (!isBytes(b))
+    throw new Error("Uint8Array expected");
+  if (lengths.length > 0 && !lengths.includes(b.length))
+    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out);
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error("digestInto() expects output buffer of length at least " + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap32(arr) {
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function utf8ToBytes(str2) {
+  if (typeof str2 !== "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(str2));
+}
+function toBytes(data) {
+  if (typeof data === "string")
+    data = utf8ToBytes(data);
+  abytes(data);
+  return data;
+}
+var Hash = class {
+};
+function createHasher(hashCons) {
+  const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
+  const tmp = hashCons();
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = () => hashCons();
+  return hashC;
+}
+
+// node_modules/@noble/hashes/esm/_md.js
+function setBigUint64(view, byteOffset, value, isLE2) {
+  if (typeof view.setBigUint64 === "function")
+    return view.setBigUint64(byteOffset, value, isLE2);
+  const _32n2 = BigInt(32);
+  const _u32_max = BigInt(4294967295);
+  const wh = Number(value >> _32n2 & _u32_max);
+  const wl = Number(value & _u32_max);
+  const h = isLE2 ? 4 : 0;
+  const l = isLE2 ? 0 : 4;
+  view.setUint32(byteOffset + h, wh, isLE2);
+  view.setUint32(byteOffset + l, wl, isLE2);
+}
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class extends Hash {
+  constructor(blockLen, outputLen, padOffset, isLE2) {
+    super();
+    this.finished = false;
+    this.length = 0;
+    this.pos = 0;
+    this.destroyed = false;
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE2;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    data = toBytes(data);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE: isLE2 } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    clean(this.buffer.subarray(pos));
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      pos = 0;
+    }
+    for (let i = pos; i < blockLen; i++)
+      buffer[i] = 0;
+    setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE2);
+    this.process(view, 0);
+    const oview = createView(out);
+    const len = this.outputLen;
+    if (len % 4)
+      throw new Error("_sha2: outputLen should be aligned to 32bit");
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE2);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to || (to = new this.constructor());
+    to.set(...this.get());
+    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// node_modules/@noble/hashes/esm/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var rotlSH = (h, l, s) => h << s | l >>> 32 - s;
+var rotlSL = (h, l, s) => l << s | h >>> 32 - s;
+var rotlBH = (h, l, s) => l << s - 32 | h >>> 64 - s;
+var rotlBL = (h, l, s) => h << s - 32 | l >>> 64 - s;
+
+// node_modules/@noble/hashes/esm/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA256 = class extends HashMD {
+  constructor(outputLen = 32) {
+    super(64, outputLen, 8, false);
+    this.A = SHA256_IV[0] | 0;
+    this.B = SHA256_IV[1] | 0;
+    this.C = SHA256_IV[2] | 0;
+    this.D = SHA256_IV[3] | 0;
+    this.E = SHA256_IV[4] | 0;
+    this.F = SHA256_IV[5] | 0;
+    this.G = SHA256_IV[6] | 0;
+    this.H = SHA256_IV[7] | 0;
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
+
+// node_modules/@noble/hashes/esm/sha256.js
+var sha2562 = sha256;
+
+// node_modules/@darkhunt-security/telemetry/dist/masking/validators/base58check.js
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var BASE = 58n;
+function base58check(input) {
+  if (input.length === 0)
+    return false;
+  let leadingOnes = 0;
+  while (leadingOnes < input.length && input.charAt(leadingOnes) === "1") {
+    leadingOnes++;
+  }
+  let num2 = 0n;
+  for (let i = 0; i < input.length; i++) {
+    const idx = ALPHABET.indexOf(input.charAt(i));
+    if (idx === -1)
+      return false;
+    num2 = num2 * BASE + BigInt(idx);
+  }
+  const bodyBytes = [];
+  while (num2 > 0n) {
+    bodyBytes.unshift(Number(num2 & 0xffn));
+    num2 >>= 8n;
+  }
+  const bytes = new Uint8Array(leadingOnes + bodyBytes.length);
+  for (let i = 0; i < bodyBytes.length; i++)
+    bytes[leadingOnes + i] = bodyBytes[i];
+  if (bytes.length < 5)
+    return false;
+  const payload = bytes.subarray(0, bytes.length - 4);
+  const checksum = bytes.subarray(bytes.length - 4);
+  const hash = sha2562(sha2562(payload));
+  for (let i = 0; i < 4; i++) {
+    if (hash[i] !== checksum[i])
+      return false;
+  }
+  return true;
+}
+
+// node_modules/@darkhunt-security/telemetry/dist/masking/validators/bech32.js
+var CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+var GENERATOR = [996825010, 642813549, 513874426, 1027748829, 705979059];
+var BECH32_CONST = 1;
+var BECH32M_CONST = 734539939;
+function polymod(values) {
+  let chk = 1;
+  for (const v of values) {
+    const top = chk >>> 25;
+    chk = (chk & 33554431) << 5 ^ v;
+    for (let i = 0; i < 5; i++) {
+      if (top >> i & 1)
+        chk ^= GENERATOR[i];
+    }
+  }
+  return chk;
+}
+function hrpExpand(hrp) {
+  const out = [];
+  for (let i = 0; i < hrp.length; i++)
+    out.push(hrp.charCodeAt(i) >> 5);
+  out.push(0);
+  for (let i = 0; i < hrp.length; i++)
+    out.push(hrp.charCodeAt(i) & 31);
+  return out;
+}
+function bech32(input) {
+  if (input.length > 90)
+    return false;
+  const lower = input.toLowerCase();
+  const upper = input.toUpperCase();
+  if (input !== lower && input !== upper)
+    return false;
+  const sepIdx = lower.lastIndexOf("1");
+  if (sepIdx < 1 || sepIdx + 7 > lower.length)
+    return false;
+  const hrp = lower.slice(0, sepIdx);
+  for (let i = 0; i < hrp.length; i++) {
+    const c = hrp.charCodeAt(i);
+    if (c < 33 || c > 126)
+      return false;
+  }
+  const data = [];
+  for (let i = sepIdx + 1; i < lower.length; i++) {
+    const idx = CHARSET.indexOf(lower.charAt(i));
+    if (idx === -1)
+      return false;
+    data.push(idx);
+  }
+  const checksum = polymod(hrpExpand(hrp).concat(data));
+  return checksum === BECH32_CONST || checksum === BECH32M_CONST;
+}
+
+// node_modules/@darkhunt-security/telemetry/dist/masking/validators/luhn.js
+function luhn(input) {
+  let sum = 0;
+  let alternate = false;
+  let len = 0;
+  for (let i = input.length - 1; i >= 0; i--) {
+    const ch = input.charCodeAt(i);
+    if (ch === 32 || ch === 45)
+      continue;
+    const digit = ch - 48;
+    if (digit < 0 || digit > 9)
+      return false;
+    let n = digit;
+    if (alternate) {
+      n *= 2;
+      if (n > 9)
+        n -= 9;
+    }
+    sum += n;
+    alternate = !alternate;
+    len++;
+  }
+  return len > 0 && sum % 10 === 0;
+}
+
+// node_modules/@darkhunt-security/telemetry/dist/masking/validators/creditCard.js
+function creditCard(input) {
+  const digits = input.replace(/[\s-]/g, "");
+  return digits.length >= 13 && digits.length <= 16 && hasValidIin(digits) && luhn(digits);
+}
+function hasValidIin(digits) {
+  const len = digits.length;
+  if (len < 13)
+    return false;
+  return isVisa(digits, len) || isMastercard(digits, len) || isAmex(digits, len) || isDiners(digits, len) || isJcb(digits, len) || isDiscover(digits, len);
+}
+function isVisa(d, len) {
+  return d.startsWith("4") && (len === 13 || len === 16);
+}
+function isMastercard(d, len) {
+  if (len !== 16)
+    return false;
+  if (d.startsWith("5")) {
+    const d1 = d.charAt(1);
+    return d1 >= "1" && d1 <= "5";
+  }
+  if (d.startsWith("2")) {
+    const prefix = Number.parseInt(d.slice(0, 4), 10);
+    return prefix >= 2221 && prefix <= 2720;
+  }
+  return false;
+}
+function isAmex(d, len) {
+  return len === 15 && (d.startsWith("34") || d.startsWith("37"));
+}
+function isDiners(d, len) {
+  if (len !== 14)
+    return false;
+  if (d.startsWith("30")) {
+    const d2 = d.charAt(2);
+    return d2 >= "0" && d2 <= "5";
+  }
+  return d.startsWith("36") || d.startsWith("38");
+}
+function isJcb(d, len) {
+  return len === 16 && d.startsWith("35");
+}
+function isDiscover(d, len) {
+  if (len !== 16)
+    return false;
+  if (d.startsWith("6011"))
+    return true;
+  if (d.startsWith("65"))
+    return true;
+  if (d.startsWith("64")) {
+    const d2 = d.charAt(2);
+    return d2 >= "4" && d2 <= "9";
+  }
+  if (d.startsWith("62")) {
+    const prefix = Number.parseInt(d.slice(0, 6), 10);
+    return prefix >= 622126 && prefix <= 622925;
+  }
+  return false;
+}
+
+// node_modules/@noble/hashes/esm/sha3.js
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+var _2n = BigInt(2);
+var _7n = BigInt(7);
+var _256n = BigInt(256);
+var _0x71n = BigInt(113);
+var SHA3_PI = [];
+var SHA3_ROTL = [];
+var _SHA3_IOTA = [];
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+  [x, y] = [y, (2 * x + 3 * y) % 5];
+  SHA3_PI.push(2 * (5 * y + x));
+  SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+  let t = _0n;
+  for (let j = 0; j < 7; j++) {
+    R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
+    if (R & _2n)
+      t ^= _1n << (_1n << /* @__PURE__ */ BigInt(j)) - _1n;
+  }
+  _SHA3_IOTA.push(t);
+}
+var IOTAS = split(_SHA3_IOTA, true);
+var SHA3_IOTA_H = IOTAS[0];
+var SHA3_IOTA_L = IOTAS[1];
+var rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
+var rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
+function keccakP(s, rounds = 24) {
+  const B = new Uint32Array(5 * 2);
+  for (let round = 24 - rounds; round < 24; round++) {
+    for (let x = 0; x < 10; x++)
+      B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y = 0; y < 50; y += 10) {
+        s[x + y] ^= Th;
+        s[x + y + 1] ^= Tl;
+      }
+    }
+    let curH = s[2];
+    let curL = s[3];
+    for (let t = 0; t < 24; t++) {
+      const shift = SHA3_ROTL[t];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    for (let y = 0; y < 50; y += 10) {
+      for (let x = 0; x < 10; x++)
+        B[x] = s[y + x];
+      for (let x = 0; x < 10; x++)
+        s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+    }
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+var Keccak = class _Keccak extends Hash {
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    super();
+    this.pos = 0;
+    this.posOut = 0;
+    this.finished = false;
+    this.destroyed = false;
+    this.enableXOF = false;
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.rounds = rounds;
+    anumber(outputLen);
+    if (!(0 < blockLen && blockLen < 200))
+      throw new Error("only keccak-f1600 function is supported");
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data) {
+    aexists(this);
+    data = toBytes(data);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i = 0; i < take; i++)
+        state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen)
+        this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    state[pos] ^= suffix;
+    if ((suffix & 128) !== 0 && pos === blockLen - 1)
+      this.keccak();
+    state[blockLen - 1] ^= 128;
+    this.keccak();
+  }
+  writeInto(out) {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen)
+        this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out) {
+    if (!this.enableXOF)
+      throw new Error("XOF is not possible for this instance");
+    return this.writeInto(out);
+  }
+  xof(bytes) {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out) {
+    aoutput(out, this);
+    if (this.finished)
+      throw new Error("digest() was already called");
+    this.writeInto(out);
+    this.destroy();
+    return out;
+  }
+  digest() {
+    return this.digestInto(new Uint8Array(this.outputLen));
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to) {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to || (to = new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds));
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+};
+var gen = (suffix, blockLen, outputLen) => createHasher(() => new Keccak(blockLen, suffix, outputLen));
+var keccak_256 = /* @__PURE__ */ (() => gen(1, 136, 256 / 8))();
+
+// node_modules/@darkhunt-security/telemetry/dist/masking/validators/eip55.js
+var ADDR_RE = /^0[xX][0-9a-fA-F]{40}$/;
+function eip55(input) {
+  if (!ADDR_RE.test(input))
+    return false;
+  const addr = input.slice(2);
+  const lower = addr.toLowerCase();
+  if (addr === lower || addr === addr.toUpperCase())
+    return true;
+  return matchesChecksum(addr, lower);
+}
+function matchesChecksum(addr, lower) {
+  const hashBytes = keccak_256(lower);
+  for (let i = 0; i < 40; i++) {
+    if (!charCaseMatchesNibble(addr.charCodeAt(i), nibbleAt(hashBytes, i))) {
+      return false;
+    }
+  }
+  return true;
+}
+function nibbleAt(bytes, i) {
+  return bytes[i >> 1] >> (i % 2 === 0 ? 4 : 0) & 15;
+}
+function charCaseMatchesNibble(ch, nibble) {
+  if (ch >= 97 && ch <= 102)
+    return nibble < 8;
+  if (ch >= 65 && ch <= 70)
+    return nibble >= 8;
+  return true;
+}
+
+// node_modules/@darkhunt-security/telemetry/dist/masking/validators/ibanMod97.js
+function ibanMod97(input) {
+  const iban = input.replace(/\s/g, "");
+  const len = iban.length;
+  if (len < 15 || len > 34)
+    return false;
+  let rearranged = "";
+  for (let i = 4; i < len + 4; i++) {
+    const c = iban.charCodeAt(i % len);
+    if (c >= 48 && c <= 57) {
+      rearranged += String.fromCharCode(c);
+    } else if (c >= 65 && c <= 90) {
+      rearranged += String(c - 65 + 10);
+    } else if (c >= 97 && c <= 122) {
+      rearranged += String(c - 97 + 10);
+    } else {
+      return false;
+    }
+  }
+  try {
+    return BigInt(rearranged) % 97n === 1n;
+  } catch {
+    return false;
+  }
+}
+
+// node_modules/@darkhunt-security/telemetry/dist/masking/validators/index.js
+var VALIDATORS = Object.freeze({
+  aba,
+  base58check,
+  bech32,
+  credit_card: creditCard,
+  eip55,
+  iban_mod97: ibanMod97,
+  luhn
+});
+
+// node_modules/@darkhunt-security/telemetry/dist/client.js
+var LIB_VERSION = package_default.version;
+
+// packages/core/dist/cli/status.js
+import { existsSync as existsSync2, readFileSync as readFileSync5, statSync as statSync3 } from "node:fs";
+var SESSION_HOOK_STALE_MS = 30 * 60 * 1e3;
+function status(vendor, mapper) {
+  const config = loadLocalConfig(vendor);
+  const checkpoints = loadCheckpoints(config.scope);
+  const transcripts = [];
+  for (const [path, cp] of Object.entries(checkpoints)) {
+    if (path === "::spool::")
+      continue;
+    const size = existsSync2(path) ? statSync3(path).size : 0;
+    transcripts.push({ path, shipped: cp.offset, size, lag: Math.max(0, size - cp.offset) });
+  }
+  const lastPass = loadHealth(config.scope);
+  const spool = spoolPath(vendor);
+  let spoolEvents = 0;
+  let spoolLastAt;
+  if (existsSync2(spool)) {
+    const lines = readFileSync5(spool, "utf8").split("\n").filter(Boolean);
+    spoolEvents = lines.length;
+    const last = lines[lines.length - 1];
+    if (last) {
+      try {
+        const ts = JSON.parse(last).ts;
+        if (ts)
+          spoolLastAt = new Date(ts).toISOString();
+      } catch {
+      }
+    }
+  }
+  const beat = loadBeat(config.scope);
+  const guardAt = beat?.lane === "guard" ? Date.parse(beat.at) : Date.parse(beat?.at ?? "");
+  const sessionAt = Date.parse(spoolLastAt ?? beat?.lastSpoolAt ?? "");
+  const sessionHooksStale = !Number.isNaN(guardAt) && Date.now() - guardAt < SESSION_HOOK_STALE_MS && (Number.isNaN(sessionAt) || guardAt - sessionAt > SESSION_HOOK_STALE_MS);
+  const fromAgent = mapper?.resolveUserId?.();
+  const userId = fromAgent ?? config.userId;
+  return {
+    profile: config.profile,
+    baseUrl: config.baseUrl,
+    tenantId: config.tenantId,
+    workspaceId: config.workspaceId,
+    scope: config.scope,
+    capture: config.capture.enabled && config.enabled,
+    enforce: config.enabled ? config.enforce.mode : "off (kill switch)",
+    spoolEvents,
+    ...spoolLastAt !== void 0 ? { spoolLastAt } : {},
+    ...beat !== void 0 ? { lastHookAt: beat.at, lastHookLane: beat.lane } : {},
+    sessionHooksStale,
+    ...userId !== void 0 ? { userId } : {},
+    userIdSource: fromAgent !== void 0 ? "agent" : userId !== void 0 ? "config" : "none",
+    transcripts,
+    totalLag: transcripts.reduce((sum, t) => sum + t.lag, 0),
+    ...lastPass !== void 0 ? { lastPass } : {},
+    lockHeld: existsSync2(spool.replace(/spool\/.*$/, `${config.scope}.forwarder.lock`))
+  };
+}
+
+// packages/core/dist/cli/enroll.js
+import { homedir as homedir3 } from "node:os";
+import { join as join8 } from "node:path";
+var CLI_CREDENTIALS_PATH = join8(homedir3(), ".darkhunt", "credentials.json");
+
+// adapters/codex/dist/transcript.js
+import { basename, join as join9 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+function str(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function num(value) {
+  return typeof value === "number" ? value : void 0;
+}
+function mapTokenCount(info) {
+  if (!info || typeof info !== "object")
+    return void 0;
+  const bag = info;
+  const last = bag["last_token_usage"] ?? bag["total_token_usage"] ?? bag;
+  const out = {};
+  const input = num(last["input_tokens"]);
+  const output = num(last["output_tokens"]);
+  const cached = num(last["cached_input_tokens"]);
+  const reasoning = num(last["reasoning_output_tokens"]);
+  if (input !== void 0)
+    out.input_tokens = input;
+  if (output !== void 0)
+    out.output_tokens = output;
+  if (cached !== void 0)
+    out.cache_read_tokens = cached;
+  if (reasoning !== void 0)
+    out.thinking_tokens = reasoning;
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function textOf(content) {
+  if (typeof content === "string")
+    return content;
+  if (!Array.isArray(content))
+    return void 0;
+  const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
+  return parts.length > 0 ? parts.join("\n") : void 0;
+}
+var codexTranscript = {
+  vendor: "codex",
+  sessionRoots() {
+    return [join9(homedir4(), ".codex", "sessions")];
+  },
+  // No `resolveUserId` yet, so Codex traces fall back to the configured `userId`.
+  // The identity exists but not as a plain field: `~/.codex/auth.json` holds
+  // `tokens.account_id` (a UUID, not a person) and an `email` claim inside the
+  // `id_token` JWT. Reading it means decoding an OAuth token and honouring its expiry —
+  // a stale token would attribute sessions to a *wrong* address, which is worse than
+  // leaving them unattributed. Tracked separately.
+  sessionIdFor(path) {
+    const name = basename(path, ".jsonl");
+    const match = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(name);
+    return match?.[1] ?? name;
+  },
+  mapLine(line, offset = 0) {
+    const trimmed = line.trim();
+    if (!trimmed)
+      return [];
+    let raw;
+    try {
+      raw = JSON.parse(trimmed);
+    } catch {
+      return [];
+    }
+    const payload = raw.payload;
+    if (!payload)
+      return [];
+    const ts = raw.timestamp ? Date.parse(raw.timestamp) : Date.now();
+    const uuid = `codex:${offset}`;
+    const base = { vendor: "codex", ts, uuid };
+    if (raw.type === "session_meta") {
+      return [
+        {
+          ...base,
+          kind: "session_meta",
+          meta: {
+            ...str(payload["cwd"]) !== void 0 ? { cwd: str(payload["cwd"]) } : {},
+            ...str(payload["cli_version"]) !== void 0 ? { version: str(payload["cli_version"]) } : {},
+            ...str(payload["originator"]) !== void 0 ? { entrypoint: str(payload["originator"]) } : {}
+          }
+        }
+      ];
+    }
+    if (raw.type === "turn_context") {
+      const model = str(payload["model"]);
+      if (!model)
+        return [];
+      return [{ ...base, kind: "session_meta", meta: { model } }];
+    }
+    const kind = str(payload["type"]);
+    if (raw.type === "event_msg" && kind === "token_count") {
+      const usage = mapTokenCount(payload["info"]);
+      return usage ? [{ ...base, kind: "usage", usage }] : [];
+    }
+    if (raw.type !== "response_item")
+      return [];
+    switch (kind) {
+      case "function_call":
+        return [
+          {
+            ...base,
+            kind: "tool_call",
+            toolName: str(payload["name"]) ?? "tool",
+            input: payload["arguments"],
+            ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
+          }
+        ];
+      case "function_call_output":
+        return [
+          {
+            ...base,
+            kind: "tool_result",
+            output: payload["output"],
+            ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
+          }
+        ];
+      case "reasoning": {
+        const text = textOf(payload["summary"]) ?? textOf(payload["content"]);
+        return text ? [{ ...base, kind: "thinking", text }] : [];
+      }
+      case "message": {
+        const text = textOf(payload["content"]);
+        if (!text)
+          return [];
+        switch (str(payload["role"])) {
+          case "user":
+            return [{ ...base, kind: "user_message", text }];
+          case "assistant":
+            return [{ ...base, kind: "assistant_message", text }];
+          default:
+            return [];
+        }
+      }
+      default:
+        return [];
+    }
+  }
+};
+
+// adapters/codex/bin/status.mjs
+try {
+  const s = status("codex", codexTranscript);
+  const n = (x) => x.toLocaleString();
+  console.log(`darkhunt endpoint status \u2014 codex`);
+  console.log(`  profile      ${s.profile}  ->  ${s.baseUrl}`);
+  console.log(`  tenant       ${s.tenantId}   workspace ${s.workspaceId}`);
+  console.log(
+    `  user         ${s.userId ?? "(none \u2014 traces are unattributed)"}` + (s.userIdSource === "none" ? "" : `  [from ${s.userIdSource}]`)
+  );
+  console.log(`  capture      ${s.capture ? "ON" : "OFF"}      enforce ${s.enforce}`);
+  console.log(
+    `  hook events  ${s.spoolEvents}${s.spoolLastAt ? "  last " + s.spoolLastAt : "  (no session hook has ever fired)"}`
+  );
+  if (s.lastHookAt) {
+    console.log(`  last hook    ${s.lastHookAt}  (${s.lastHookLane} lane)`);
+  }
+  if (s.sessionHooksStale) {
+    console.log(
+      "  WARNING      session hooks are not firing \u2014 the guard is running but\n               SessionStart/Stop/SessionEnd have gone quiet. Capture is\n               riding PreToolUse alone; run backfill.mjs to close any gap."
+    );
+  }
+  console.log(`  forwarder    ${s.lockHeld ? "RUNNING" : "idle"}`);
+  if (s.lastPass) {
+    const p = s.lastPass;
+    console.log(
+      `  last pass    ${p.ok ? "OK" : "FAILED"}  ${p.at}` + (p.ok ? `  (${p.transcripts} transcript(s), ${n(p.records)} record(s))` : "")
+    );
+    if (!p.ok) {
+      console.log(`      cause    ${p.error}`);
+      console.log(
+        `      ${p.consecutiveFailures} pass(es) failed in a row \u2014 checkpoints are held, nothing is being lost`
+      );
+    }
+  }
+  if (s.transcripts.length === 0) {
+    console.log("  transcripts  none shipped yet");
+  } else {
+    console.log("  transcripts:");
+    for (const t of s.transcripts) {
+      console.log(`    ${t.path.split("/").pop()}`);
+      console.log(`      shipped ${n(t.shipped)} / ${n(t.size)} bytes   lag ${n(t.lag)}`);
+    }
+  }
+  const note = s.totalLag > 0 ? "  (ships on the next turn)" : s.lastPass && !s.lastPass.ok ? "  (nothing shipped \u2014 see last pass)" : "  (fully caught up)";
+  console.log(`  total lag    ${n(s.totalLag)} bytes${note}`);
+} catch (err) {
+  console.error(`darkhunt: ${err.message}`);
+  process.exit(1);
+}
+/*! Bundled license information:
+
+@noble/hashes/esm/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/