@darkhunt-security/endpoint-codex 0.9.10 → 0.9.12

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -18308,6 +18308,7 @@ function attachmentLabel(record) {
   return `[${record.mediaType ?? "attachment"}${size}]`;
 }
 var RESUMED_USER_TEXT_LIMIT = 4e3;
+var USAGE_WIRE_NAMES = { thinking_tokens: "reasoning" };
 var SessionEmitter = class {
   client;
   options;
@@ -18331,6 +18332,8 @@ var SessionEmitter = class {
   /** Attachments seen before the trace could be opened knowing the prompt. */
   deferred = [];
   pendingUsage;
+  /** Set when the model call this generation stands for failed. Cleared with it. */
+  generationError;
   outputText = [];
   /** The last thing the assistant said in this pass — the trace's result. */
   lastAssistantText;
@@ -18386,9 +18389,10 @@ var SessionEmitter = class {
     this.count++;
     if (record.kind === "attachment")
       this.pendingAttachments.push(attachmentLabel(record));
-    if (record.kind === "user_message")
+    if (record.kind === "user_message" && !record.isError && !record.synthetic) {
       this.absorbUserTurn(record);
-    if (!this.trace && record.kind === "attachment") {
+    }
+    if (!this.trace && (record.kind === "attachment" || record.synthetic === true)) {
       this.deferred.push(record);
       return;
     }
@@ -18426,6 +18430,15 @@ var SessionEmitter = class {
     this.owners.set(record.uuid, owner);
     switch (record.kind) {
       case "user_message":
+        if (record.synthetic) {
+          this.seeded(["injected", record.uuid], () => owner.span("context_injection", {
+            startTime: record.ts,
+            ...record.text !== void 0 ? { output: summarize(record.text) } : {}
+          })).end({ endTime: record.ts });
+          break;
+        }
+        if (record.isError)
+          this.generationError = record.errorKind ?? "error";
         this.endGeneration();
         break;
       case "attachment": {
@@ -18442,7 +18455,9 @@ var SessionEmitter = class {
       }
       case "assistant_message":
         this.openGeneration(record, owner);
-        if (record.text)
+        if (record.isError)
+          this.generationError = record.errorKind ?? "error";
+        else if (record.text)
           this.outputText.push(record.text);
         break;
       case "thinking": {
@@ -18471,15 +18486,44 @@ var SessionEmitter = class {
       case "tool_result": {
         const span = record.toolCallId ? this.toolSpans.get(record.toolCallId) : void 0;
         if (span) {
-          span.end({ output: record.output, endTime: record.ts });
+          span.end({
+            output: record.output,
+            endTime: record.ts,
+            ...record.isError ? { level: "ERROR" } : {},
+            ...record.errorKind !== void 0 ? { statusMessage: record.errorKind } : {}
+          });
           this.toolSpans.delete(record.toolCallId);
         }
         this.pendingToolResults.push(summarize(record.output));
         break;
       }
+      case "compaction":
+        this.endGeneration();
+        this.seeded(["compaction", record.uuid], () => owner.span("compaction", {
+          startTime: record.ts,
+          ...record.text ? { output: record.text } : {}
+        })).end({ endTime: record.ts });
+        break;
+      case "permission_grant": {
+        const snapshot = record.input && typeof record.input === "object" ? record.input : void 0;
+        const steps = Array.isArray(snapshot?.steps) ? snapshot.steps : [];
+        this.seeded(["permission", record.uuid], () => owner.span("permission_grant", {
+          startTime: record.ts,
+          // `input`, not `output`: the list is what this record IS, not a result it
+          // produced.
+          input: steps,
+          metadata: {
+            // The true count, which is larger than `steps.length` when the mapper
+            // truncated the snapshot to its byte budget.
+            count: String(snapshot?.count ?? steps.length),
+            full: String(snapshot?.full === true)
+          }
+        })).end({ endTime: record.ts });
+        break;
+      }
       case "usage":
         if (record.usage) {
-          this.pendingUsage = Object.fromEntries(Object.entries(record.usage).filter(([, v]) => typeof v === "number"));
+          this.pendingUsage = Object.fromEntries(Object.entries(record.usage).filter(([, v]) => typeof v === "number").map(([key, value]) => [USAGE_WIRE_NAMES[key] ?? key, value]));
         }
         if (record.model)
           this.model = record.model;
@@ -18636,7 +18680,18 @@ var SessionEmitter = class {
       this.model = record.model;
     this.generation = this.seeded(["generation", id], () => owner.generation("assistant", {
       startTime: record.ts,
-      ...this.model !== void 0 ? { model: this.model } : {}
+      ...this.model !== void 0 ? { model: this.model } : {},
+      // What drove this model call — an installed skill, an MCP server's output, a
+      // plugin. A flat scalar like every other metadata value emitted here, because
+      // trace-hub lifts each key onto the span unchanged and a nested value would
+      // arrive as a blob nothing can group or filter on. One lowercase word, so unlike
+      // `agent_id` there is no camelCase to convert.
+      //
+      // Set once, at open, and never through update(): this method early-returns when
+      // the generation is already open, so the value has to be constant across a
+      // message group. Measured over the claude-code corpus, 0 of 1,381 attributed
+      // groups carry two different tokens.
+      ...record.attribution !== void 0 ? { metadata: { attribution: record.attribution } } : {}
     }));
     const input = this.buildInputMessages();
     if (input.inputMessages)
@@ -18676,12 +18731,14 @@ var SessionEmitter = class {
     this.generation.end({
       ...output ? { outputMessages: [{ role: "assistant", content: output }] } : {},
       ...this.model !== void 0 ? { model: this.model } : {},
-      ...this.pendingUsage !== void 0 ? { usage: this.pendingUsage } : {}
+      ...this.pendingUsage !== void 0 ? { usage: this.pendingUsage } : {},
+      ...this.generationError !== void 0 ? { level: "ERROR", statusMessage: this.generationError } : {}
     });
     this.generation = void 0;
     this.generationId = void 0;
     this.outputText = [];
     this.pendingUsage = void 0;
+    this.generationError = void 0;
   }
 };
 
@@ -21939,6 +21996,62 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+var CODEX_APPROVAL_MODES = {
+  never: "auto",
+  "on-request": "ask"
+};
+var CODEX_SANDBOX_MODES = {
+  "workspace-write": "workspace-write",
+  "read-only": "read-only",
+  "danger-full-access": "danger-full-access"
+};
+var PERMISSION_SNAPSHOT_LIMIT = 32e3;
+function budgeted(steps) {
+  const kept = [];
+  let bytes = 0;
+  for (const step of steps) {
+    bytes += JSON.stringify(step ?? null).length + 1;
+    if (bytes > PERMISSION_SNAPSHOT_LIMIT)
+      break;
+    kept.push(step);
+  }
+  return kept;
+}
+function execEnvelope(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    return void 0;
+  const bag = parsed;
+  if (!Object.prototype.hasOwnProperty.call(bag, "output"))
+    return void 0;
+  const metadata = bag["metadata"];
+  const exitCode = num(bag["exit_code"]) ?? (metadata && typeof metadata === "object" ? num(metadata["exit_code"]) : void 0);
+  if (exitCode === void 0)
+    return void 0;
+  return { output: bag["output"], exitCode };
+}
+function execResult(value) {
+  if (typeof value === "string")
+    return execEnvelope(value) ?? { output: value };
+  if (Array.isArray(value)) {
+    for (const block of value) {
+      if (!block || typeof block !== "object")
+        continue;
+      const text = block["text"];
+      if (typeof text !== "string")
+        continue;
+      const envelope = execEnvelope(text);
+      if (envelope)
+        return envelope;
+    }
+  }
+  return { output: textOf(value) ?? value };
+}
 function jwtClaims(token) {
   const parts = token.split(".");
   if (parts.length !== 3 || !parts[1])
@@ -21965,6 +22078,29 @@ function emailFromAuth(raw) {
   const email = jwtClaims(token)?.["email"];
   return typeof email === "string" && email !== "" ? email : void 0;
 }
+function repositoryIdentity(url) {
+  if (url === void 0)
+    return void 0;
+  const trimmed = url.trim();
+  if (trimmed === "")
+    return void 0;
+  const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(\S+)$/.exec(trimmed);
+  if (scp)
+    return `${scp[1]}/${stripSuffix(scp[2])}`;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `ssh://${trimmed}`;
+  try {
+    const parsed = new URL(withScheme);
+    if (!parsed.hostname)
+      return trimmed;
+    const path = stripSuffix(parsed.pathname.replace(/^\/+/, ""));
+    return path === "" ? parsed.hostname : `${parsed.hostname}/${path}`;
+  } catch {
+    return trimmed;
+  }
+}
+function stripSuffix(path) {
+  return path.replace(/\/+$/, "").replace(/\.git$/i, "");
+}
 var codexTranscript = {
   vendor: "codex",
   sessionRoots() {
@@ -22017,12 +22153,20 @@ var codexTranscript = {
     const uuid = `codex:${offset}`;
     const base = { vendor: "codex", ts, uuid };
     if (raw.type === "session_meta") {
+      const rawGit = payload["git"];
+      const git = rawGit && typeof rawGit === "object" ? rawGit : void 0;
+      const gitBranch = str(git?.["branch"]);
+      const gitRepositoryUrl = repositoryIdentity(str(git?.["repository_url"]));
       return [
         {
           ...base,
           kind: "session_meta",
           meta: {
             ...str(payload["cwd"]) !== void 0 ? { cwd: str(payload["cwd"]) } : {},
+            // Conditional spread rather than a plain assignment: the 7 `{}` blocks and
+            // the 92 absent ones must leave the key absent, not present-and-undefined.
+            ...gitBranch !== void 0 ? { gitBranch } : {},
+            ...gitRepositoryUrl !== void 0 ? { gitRepositoryUrl } : {},
             ...str(payload["cli_version"]) !== void 0 ? { version: str(payload["cli_version"]) } : {},
             ...str(payload["originator"]) !== void 0 ? { entrypoint: str(payload["originator"]) } : {},
             // A Codex subagent is a rollout of its own, a peer of its parent in the
@@ -22038,15 +22182,61 @@ var codexTranscript = {
     }
     if (raw.type === "turn_context") {
       const model = str(payload["model"]);
-      if (!model)
+      const approval = str(payload["approval_policy"]);
+      const sandbox = payload["sandbox_policy"];
+      const sandboxMode = (() => {
+        if (!sandbox || typeof sandbox !== "object")
+          return void 0;
+        const bag = sandbox;
+        return str(bag["mode"]) ?? str(bag["type"]);
+      })();
+      const meta = {
+        ...model !== void 0 ? { model } : {},
+        ...approval !== void 0 ? { approvalMode: CODEX_APPROVAL_MODES[approval] ?? approval } : {},
+        ...sandboxMode !== void 0 ? { sandboxMode: CODEX_SANDBOX_MODES[sandboxMode] ?? sandboxMode } : {}
+      };
+      if (Object.keys(meta).length === 0)
         return [];
-      return [{ ...base, kind: "session_meta", meta: { model } }];
+      return [{ ...base, kind: "session_meta", meta }];
     }
     const kind = str(payload["type"]);
     if (raw.type === "event_msg" && kind === "token_count") {
       const usage = mapTokenCount(payload["info"]);
       return usage ? [{ ...base, kind: "usage", usage }] : [];
     }
+    if (raw.type === "compacted") {
+      const note = str(payload["message"]);
+      return [{ ...base, kind: "compaction", ...note ? { text: note } : {} }];
+    }
+    if (raw.type === "world_state") {
+      const state = payload["state"];
+      const perms = state && typeof state === "object" ? state["permissions"] : void 0;
+      if (!perms || typeof perms !== "object")
+        return [];
+      const list = perms["approved_command_prefixes"];
+      const steps = Array.isArray(list) ? list : [];
+      return [
+        {
+          ...base,
+          kind: "permission_grant",
+          input: {
+            steps: budgeted(steps),
+            count: steps.length,
+            ...payload["full"] === true ? { full: true } : {}
+          }
+        }
+      ];
+    }
+    if (raw.type === "event_msg" && kind === "turn_aborted") {
+      return [
+        {
+          ...base,
+          kind: "user_message",
+          isError: true,
+          errorKind: `aborted:${str(payload["reason"]) ?? "unknown"}`
+        }
+      ];
+    }
     if (raw.type !== "response_item")
       return [];
     switch (kind) {
@@ -22060,18 +22250,72 @@ var codexTranscript = {
             ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
           }
         ];
-      case "function_call_output":
+      case "function_call_output": {
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,
             kind: "tool_result",
-            output: payload["output"],
+            output,
+            // Only where an exit status was actually found. On the 993 string outputs
+            // that are not envelopes and the 144 array ones the key stays ABSENT rather
+            // than `false`: the emitter tests `record.isError`, and "this tool reported
+            // success" is a different claim from "nothing here reported an outcome".
+            ...exitCode !== void 0 ? { isError: exitCode !== 0 } : {},
             ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
           }
         ];
+      }
+      // Codex's OTHER tool-call shape, and the one it actually uses: `exec` and
+      // `apply_patch` arrive as `custom_tool_call`, never as `function_call`. Measured
+      // across 251 rollouts, 2179 of 5382 tool calls — 40% — took this shape, so
+      // handling only `function_call` left every shell command and every file write
+      // this endpoint made invisible to both the trace and anything reading it.
+      case "custom_tool_call":
+        return [
+          {
+            ...base,
+            kind: "tool_call",
+            toolName: str(payload["name"]) ?? "tool",
+            input: payload["input"],
+            ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
+          }
+        ];
+      case "custom_tool_call_output": {
+        const { output, exitCode } = execResult(payload["output"]);
+        return [
+          {
+            ...base,
+            kind: "tool_result",
+            output,
+            ...exitCode !== void 0 ? { isError: exitCode !== 0 } : {},
+            ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
+          }
+        ];
+      }
+      // The model's own web reads. 49 across the corpus in 9 rollouts — `search` 31,
+      // `open_page` 16, `find_in_page` 2 — every one of which mapped to nothing, so a
+      // session where the agent searched and opened pages rendered as reasoning
+      // followed by an answer with no source anywhere in it. The queries and the URLs
+      // are the whole point of the record: they are the evidence of what the agent
+      // read from outside the machine.
+      //
+      // `action` is passed through whole. It is already a vendor-neutral argument bag
+      // ({type, query?, queries?, url?, pattern?}) and it is small — 322 bytes at the
+      // worst, 121 on average across all 49.
+      //
+      // Deliberately unpaired: no `toolCallId`. Only 1 of the 49 lines carries an
+      // `id`, `call_id` is the pairing key everywhere else in this stream, and no
+      // response_item output line ever pairs with a search — so setting one would
+      // register a span in the emitter's pairing table that nothing ever closes, and
+      // `finish()` would end it at pass end and stamp a multi-minute duration on a
+      // search that took seconds. Left unpaired, the emitter closes it at the call
+      // timestamp, which is the truthful reading.
+      case "web_search_call":
+        return [{ ...base, kind: "tool_call", toolName: "web_search", input: payload["action"] }];
       case "reasoning": {
         const text = textOf(payload["summary"]) ?? textOf(payload["content"]);
-        return text ? [{ ...base, kind: "thinking", text }] : [];
+        return [{ ...base, kind: "thinking", ...text !== void 0 ? { text } : {} }];
       }
       case "message": {
         const text = textOf(payload["content"]);

package/dist/bin/forwarder.mjs

@@ -18308,6 +18308,7 @@ function attachmentLabel(record) {
   return `[${record.mediaType ?? "attachment"}${size}]`;
 }
 var RESUMED_USER_TEXT_LIMIT = 4e3;
+var USAGE_WIRE_NAMES = { thinking_tokens: "reasoning" };
 var SessionEmitter = class {
   client;
   options;
@@ -18331,6 +18332,8 @@ var SessionEmitter = class {
   /** Attachments seen before the trace could be opened knowing the prompt. */
   deferred = [];
   pendingUsage;
+  /** Set when the model call this generation stands for failed. Cleared with it. */
+  generationError;
   outputText = [];
   /** The last thing the assistant said in this pass — the trace's result. */
   lastAssistantText;
@@ -18386,9 +18389,10 @@ var SessionEmitter = class {
     this.count++;
     if (record.kind === "attachment")
       this.pendingAttachments.push(attachmentLabel(record));
-    if (record.kind === "user_message")
+    if (record.kind === "user_message" && !record.isError && !record.synthetic) {
       this.absorbUserTurn(record);
-    if (!this.trace && record.kind === "attachment") {
+    }
+    if (!this.trace && (record.kind === "attachment" || record.synthetic === true)) {
       this.deferred.push(record);
       return;
     }
@@ -18426,6 +18430,15 @@ var SessionEmitter = class {
     this.owners.set(record.uuid, owner);
     switch (record.kind) {
       case "user_message":
+        if (record.synthetic) {
+          this.seeded(["injected", record.uuid], () => owner.span("context_injection", {
+            startTime: record.ts,
+            ...record.text !== void 0 ? { output: summarize(record.text) } : {}
+          })).end({ endTime: record.ts });
+          break;
+        }
+        if (record.isError)
+          this.generationError = record.errorKind ?? "error";
         this.endGeneration();
         break;
       case "attachment": {
@@ -18442,7 +18455,9 @@ var SessionEmitter = class {
       }
       case "assistant_message":
         this.openGeneration(record, owner);
-        if (record.text)
+        if (record.isError)
+          this.generationError = record.errorKind ?? "error";
+        else if (record.text)
           this.outputText.push(record.text);
         break;
       case "thinking": {
@@ -18471,15 +18486,44 @@ var SessionEmitter = class {
       case "tool_result": {
         const span = record.toolCallId ? this.toolSpans.get(record.toolCallId) : void 0;
         if (span) {
-          span.end({ output: record.output, endTime: record.ts });
+          span.end({
+            output: record.output,
+            endTime: record.ts,
+            ...record.isError ? { level: "ERROR" } : {},
+            ...record.errorKind !== void 0 ? { statusMessage: record.errorKind } : {}
+          });
           this.toolSpans.delete(record.toolCallId);
         }
         this.pendingToolResults.push(summarize(record.output));
         break;
       }
+      case "compaction":
+        this.endGeneration();
+        this.seeded(["compaction", record.uuid], () => owner.span("compaction", {
+          startTime: record.ts,
+          ...record.text ? { output: record.text } : {}
+        })).end({ endTime: record.ts });
+        break;
+      case "permission_grant": {
+        const snapshot = record.input && typeof record.input === "object" ? record.input : void 0;
+        const steps = Array.isArray(snapshot?.steps) ? snapshot.steps : [];
+        this.seeded(["permission", record.uuid], () => owner.span("permission_grant", {
+          startTime: record.ts,
+          // `input`, not `output`: the list is what this record IS, not a result it
+          // produced.
+          input: steps,
+          metadata: {
+            // The true count, which is larger than `steps.length` when the mapper
+            // truncated the snapshot to its byte budget.
+            count: String(snapshot?.count ?? steps.length),
+            full: String(snapshot?.full === true)
+          }
+        })).end({ endTime: record.ts });
+        break;
+      }
       case "usage":
         if (record.usage) {
-          this.pendingUsage = Object.fromEntries(Object.entries(record.usage).filter(([, v]) => typeof v === "number"));
+          this.pendingUsage = Object.fromEntries(Object.entries(record.usage).filter(([, v]) => typeof v === "number").map(([key, value]) => [USAGE_WIRE_NAMES[key] ?? key, value]));
         }
         if (record.model)
           this.model = record.model;
@@ -18636,7 +18680,18 @@ var SessionEmitter = class {
       this.model = record.model;
     this.generation = this.seeded(["generation", id], () => owner.generation("assistant", {
       startTime: record.ts,
-      ...this.model !== void 0 ? { model: this.model } : {}
+      ...this.model !== void 0 ? { model: this.model } : {},
+      // What drove this model call — an installed skill, an MCP server's output, a
+      // plugin. A flat scalar like every other metadata value emitted here, because
+      // trace-hub lifts each key onto the span unchanged and a nested value would
+      // arrive as a blob nothing can group or filter on. One lowercase word, so unlike
+      // `agent_id` there is no camelCase to convert.
+      //
+      // Set once, at open, and never through update(): this method early-returns when
+      // the generation is already open, so the value has to be constant across a
+      // message group. Measured over the claude-code corpus, 0 of 1,381 attributed
+      // groups carry two different tokens.
+      ...record.attribution !== void 0 ? { metadata: { attribution: record.attribution } } : {}
     }));
     const input = this.buildInputMessages();
     if (input.inputMessages)
@@ -18676,12 +18731,14 @@ var SessionEmitter = class {
     this.generation.end({
       ...output ? { outputMessages: [{ role: "assistant", content: output }] } : {},
       ...this.model !== void 0 ? { model: this.model } : {},
-      ...this.pendingUsage !== void 0 ? { usage: this.pendingUsage } : {}
+      ...this.pendingUsage !== void 0 ? { usage: this.pendingUsage } : {},
+      ...this.generationError !== void 0 ? { level: "ERROR", statusMessage: this.generationError } : {}
     });
     this.generation = void 0;
     this.generationId = void 0;
     this.outputText = [];
     this.pendingUsage = void 0;
+    this.generationError = void 0;
   }
 };
 
@@ -21926,6 +21983,62 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+var CODEX_APPROVAL_MODES = {
+  never: "auto",
+  "on-request": "ask"
+};
+var CODEX_SANDBOX_MODES = {
+  "workspace-write": "workspace-write",
+  "read-only": "read-only",
+  "danger-full-access": "danger-full-access"
+};
+var PERMISSION_SNAPSHOT_LIMIT = 32e3;
+function budgeted(steps) {
+  const kept = [];
+  let bytes = 0;
+  for (const step of steps) {
+    bytes += JSON.stringify(step ?? null).length + 1;
+    if (bytes > PERMISSION_SNAPSHOT_LIMIT)
+      break;
+    kept.push(step);
+  }
+  return kept;
+}
+function execEnvelope(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    return void 0;
+  const bag = parsed;
+  if (!Object.prototype.hasOwnProperty.call(bag, "output"))
+    return void 0;
+  const metadata = bag["metadata"];
+  const exitCode = num(bag["exit_code"]) ?? (metadata && typeof metadata === "object" ? num(metadata["exit_code"]) : void 0);
+  if (exitCode === void 0)
+    return void 0;
+  return { output: bag["output"], exitCode };
+}
+function execResult(value) {
+  if (typeof value === "string")
+    return execEnvelope(value) ?? { output: value };
+  if (Array.isArray(value)) {
+    for (const block of value) {
+      if (!block || typeof block !== "object")
+        continue;
+      const text = block["text"];
+      if (typeof text !== "string")
+        continue;
+      const envelope = execEnvelope(text);
+      if (envelope)
+        return envelope;
+    }
+  }
+  return { output: textOf(value) ?? value };
+}
 function jwtClaims(token) {
   const parts = token.split(".");
   if (parts.length !== 3 || !parts[1])
@@ -21952,6 +22065,29 @@ function emailFromAuth(raw) {
   const email = jwtClaims(token)?.["email"];
   return typeof email === "string" && email !== "" ? email : void 0;
 }
+function repositoryIdentity(url) {
+  if (url === void 0)
+    return void 0;
+  const trimmed = url.trim();
+  if (trimmed === "")
+    return void 0;
+  const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(\S+)$/.exec(trimmed);
+  if (scp)
+    return `${scp[1]}/${stripSuffix(scp[2])}`;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `ssh://${trimmed}`;
+  try {
+    const parsed = new URL(withScheme);
+    if (!parsed.hostname)
+      return trimmed;
+    const path = stripSuffix(parsed.pathname.replace(/^\/+/, ""));
+    return path === "" ? parsed.hostname : `${parsed.hostname}/${path}`;
+  } catch {
+    return trimmed;
+  }
+}
+function stripSuffix(path) {
+  return path.replace(/\/+$/, "").replace(/\.git$/i, "");
+}
 var codexTranscript = {
   vendor: "codex",
   sessionRoots() {
@@ -22004,12 +22140,20 @@ var codexTranscript = {
     const uuid = `codex:${offset}`;
     const base = { vendor: "codex", ts, uuid };
     if (raw.type === "session_meta") {
+      const rawGit = payload["git"];
+      const git = rawGit && typeof rawGit === "object" ? rawGit : void 0;
+      const gitBranch = str(git?.["branch"]);
+      const gitRepositoryUrl = repositoryIdentity(str(git?.["repository_url"]));
       return [
         {
           ...base,
           kind: "session_meta",
           meta: {
             ...str(payload["cwd"]) !== void 0 ? { cwd: str(payload["cwd"]) } : {},
+            // Conditional spread rather than a plain assignment: the 7 `{}` blocks and
+            // the 92 absent ones must leave the key absent, not present-and-undefined.
+            ...gitBranch !== void 0 ? { gitBranch } : {},
+            ...gitRepositoryUrl !== void 0 ? { gitRepositoryUrl } : {},
             ...str(payload["cli_version"]) !== void 0 ? { version: str(payload["cli_version"]) } : {},
             ...str(payload["originator"]) !== void 0 ? { entrypoint: str(payload["originator"]) } : {},
             // A Codex subagent is a rollout of its own, a peer of its parent in the
@@ -22025,15 +22169,61 @@ var codexTranscript = {
     }
     if (raw.type === "turn_context") {
       const model = str(payload["model"]);
-      if (!model)
+      const approval = str(payload["approval_policy"]);
+      const sandbox = payload["sandbox_policy"];
+      const sandboxMode = (() => {
+        if (!sandbox || typeof sandbox !== "object")
+          return void 0;
+        const bag = sandbox;
+        return str(bag["mode"]) ?? str(bag["type"]);
+      })();
+      const meta = {
+        ...model !== void 0 ? { model } : {},
+        ...approval !== void 0 ? { approvalMode: CODEX_APPROVAL_MODES[approval] ?? approval } : {},
+        ...sandboxMode !== void 0 ? { sandboxMode: CODEX_SANDBOX_MODES[sandboxMode] ?? sandboxMode } : {}
+      };
+      if (Object.keys(meta).length === 0)
         return [];
-      return [{ ...base, kind: "session_meta", meta: { model } }];
+      return [{ ...base, kind: "session_meta", meta }];
     }
     const kind = str(payload["type"]);
     if (raw.type === "event_msg" && kind === "token_count") {
       const usage = mapTokenCount(payload["info"]);
       return usage ? [{ ...base, kind: "usage", usage }] : [];
     }
+    if (raw.type === "compacted") {
+      const note = str(payload["message"]);
+      return [{ ...base, kind: "compaction", ...note ? { text: note } : {} }];
+    }
+    if (raw.type === "world_state") {
+      const state = payload["state"];
+      const perms = state && typeof state === "object" ? state["permissions"] : void 0;
+      if (!perms || typeof perms !== "object")
+        return [];
+      const list = perms["approved_command_prefixes"];
+      const steps = Array.isArray(list) ? list : [];
+      return [
+        {
+          ...base,
+          kind: "permission_grant",
+          input: {
+            steps: budgeted(steps),
+            count: steps.length,
+            ...payload["full"] === true ? { full: true } : {}
+          }
+        }
+      ];
+    }
+    if (raw.type === "event_msg" && kind === "turn_aborted") {
+      return [
+        {
+          ...base,
+          kind: "user_message",
+          isError: true,
+          errorKind: `aborted:${str(payload["reason"]) ?? "unknown"}`
+        }
+      ];
+    }
     if (raw.type !== "response_item")
       return [];
     switch (kind) {
@@ -22047,18 +22237,72 @@ var codexTranscript = {
             ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
           }
         ];
-      case "function_call_output":
+      case "function_call_output": {
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,
             kind: "tool_result",
-            output: payload["output"],
+            output,
+            // Only where an exit status was actually found. On the 993 string outputs
+            // that are not envelopes and the 144 array ones the key stays ABSENT rather
+            // than `false`: the emitter tests `record.isError`, and "this tool reported
+            // success" is a different claim from "nothing here reported an outcome".
+            ...exitCode !== void 0 ? { isError: exitCode !== 0 } : {},
             ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
           }
         ];
+      }
+      // Codex's OTHER tool-call shape, and the one it actually uses: `exec` and
+      // `apply_patch` arrive as `custom_tool_call`, never as `function_call`. Measured
+      // across 251 rollouts, 2179 of 5382 tool calls — 40% — took this shape, so
+      // handling only `function_call` left every shell command and every file write
+      // this endpoint made invisible to both the trace and anything reading it.
+      case "custom_tool_call":
+        return [
+          {
+            ...base,
+            kind: "tool_call",
+            toolName: str(payload["name"]) ?? "tool",
+            input: payload["input"],
+            ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
+          }
+        ];
+      case "custom_tool_call_output": {
+        const { output, exitCode } = execResult(payload["output"]);
+        return [
+          {
+            ...base,
+            kind: "tool_result",
+            output,
+            ...exitCode !== void 0 ? { isError: exitCode !== 0 } : {},
+            ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
+          }
+        ];
+      }
+      // The model's own web reads. 49 across the corpus in 9 rollouts — `search` 31,
+      // `open_page` 16, `find_in_page` 2 — every one of which mapped to nothing, so a
+      // session where the agent searched and opened pages rendered as reasoning
+      // followed by an answer with no source anywhere in it. The queries and the URLs
+      // are the whole point of the record: they are the evidence of what the agent
+      // read from outside the machine.
+      //
+      // `action` is passed through whole. It is already a vendor-neutral argument bag
+      // ({type, query?, queries?, url?, pattern?}) and it is small — 322 bytes at the
+      // worst, 121 on average across all 49.
+      //
+      // Deliberately unpaired: no `toolCallId`. Only 1 of the 49 lines carries an
+      // `id`, `call_id` is the pairing key everywhere else in this stream, and no
+      // response_item output line ever pairs with a search — so setting one would
+      // register a span in the emitter's pairing table that nothing ever closes, and
+      // `finish()` would end it at pass end and stamp a multi-minute duration on a
+      // search that took seconds. Left unpaired, the emitter closes it at the call
+      // timestamp, which is the truthful reading.
+      case "web_search_call":
+        return [{ ...base, kind: "tool_call", toolName: "web_search", input: payload["action"] }];
       case "reasoning": {
         const text = textOf(payload["summary"]) ?? textOf(payload["content"]);
-        return text ? [{ ...base, kind: "thinking", text }] : [];
+        return [{ ...base, kind: "thinking", ...text !== void 0 ? { text } : {} }];
       }
       case "message": {
         const text = textOf(payload["content"]);

package/dist/bin/guard.mjs

@@ -1378,6 +1378,14 @@ var codexCodec = {
     };
   },
   encodeDecision(decision) {
+    const noOpinion = decision.decision === "allow" && decision.updatedInput === void 0 && (decision.ruleId === null || decision.enforcement === "advisory");
+    if (noOpinion) {
+      const message = [decision.reason, decision.remediation].filter(Boolean).join(" ");
+      return {
+        stdout: message ? JSON.stringify({ systemMessage: message }) : "",
+        exitCode: 0
+      };
+    }
     const hookSpecificOutput = {
       hookEventName: "PreToolUse",
       permissionDecision: decision.decision

package/dist/bin/spool.mjs

@@ -1180,6 +1180,14 @@ var codexCodec = {
     };
   },
   encodeDecision(decision) {
+    const noOpinion = decision.decision === "allow" && decision.updatedInput === void 0 && (decision.ruleId === null || decision.enforcement === "advisory");
+    if (noOpinion) {
+      const message = [decision.reason, decision.remediation].filter(Boolean).join(" ");
+      return {
+        stdout: message ? JSON.stringify({ systemMessage: message }) : "",
+        exitCode: 0
+      };
+    }
     const hookSpecificOutput = {
       hookEventName: "PreToolUse",
       permissionDecision: decision.decision

package/dist/bin/status.mjs

@@ -1265,6 +1265,62 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+var CODEX_APPROVAL_MODES = {
+  never: "auto",
+  "on-request": "ask"
+};
+var CODEX_SANDBOX_MODES = {
+  "workspace-write": "workspace-write",
+  "read-only": "read-only",
+  "danger-full-access": "danger-full-access"
+};
+var PERMISSION_SNAPSHOT_LIMIT = 32e3;
+function budgeted(steps) {
+  const kept = [];
+  let bytes = 0;
+  for (const step of steps) {
+    bytes += JSON.stringify(step ?? null).length + 1;
+    if (bytes > PERMISSION_SNAPSHOT_LIMIT)
+      break;
+    kept.push(step);
+  }
+  return kept;
+}
+function execEnvelope(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    return void 0;
+  const bag = parsed;
+  if (!Object.prototype.hasOwnProperty.call(bag, "output"))
+    return void 0;
+  const metadata = bag["metadata"];
+  const exitCode = num(bag["exit_code"]) ?? (metadata && typeof metadata === "object" ? num(metadata["exit_code"]) : void 0);
+  if (exitCode === void 0)
+    return void 0;
+  return { output: bag["output"], exitCode };
+}
+function execResult(value) {
+  if (typeof value === "string")
+    return execEnvelope(value) ?? { output: value };
+  if (Array.isArray(value)) {
+    for (const block of value) {
+      if (!block || typeof block !== "object")
+        continue;
+      const text = block["text"];
+      if (typeof text !== "string")
+        continue;
+      const envelope = execEnvelope(text);
+      if (envelope)
+        return envelope;
+    }
+  }
+  return { output: textOf(value) ?? value };
+}
 function jwtClaims(token) {
   const parts = token.split(".");
   if (parts.length !== 3 || !parts[1])
@@ -1291,6 +1347,29 @@ function emailFromAuth(raw) {
   const email = jwtClaims(token)?.["email"];
   return typeof email === "string" && email !== "" ? email : void 0;
 }
+function repositoryIdentity(url) {
+  if (url === void 0)
+    return void 0;
+  const trimmed = url.trim();
+  if (trimmed === "")
+    return void 0;
+  const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(\S+)$/.exec(trimmed);
+  if (scp)
+    return `${scp[1]}/${stripSuffix(scp[2])}`;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `ssh://${trimmed}`;
+  try {
+    const parsed = new URL(withScheme);
+    if (!parsed.hostname)
+      return trimmed;
+    const path = stripSuffix(parsed.pathname.replace(/^\/+/, ""));
+    return path === "" ? parsed.hostname : `${parsed.hostname}/${path}`;
+  } catch {
+    return trimmed;
+  }
+}
+function stripSuffix(path) {
+  return path.replace(/\/+$/, "").replace(/\.git$/i, "");
+}
 var codexTranscript = {
   vendor: "codex",
   sessionRoots() {
@@ -1343,12 +1422,20 @@ var codexTranscript = {
     const uuid = `codex:${offset}`;
     const base = { vendor: "codex", ts, uuid };
     if (raw.type === "session_meta") {
+      const rawGit = payload["git"];
+      const git = rawGit && typeof rawGit === "object" ? rawGit : void 0;
+      const gitBranch = str(git?.["branch"]);
+      const gitRepositoryUrl = repositoryIdentity(str(git?.["repository_url"]));
       return [
         {
           ...base,
           kind: "session_meta",
           meta: {
             ...str(payload["cwd"]) !== void 0 ? { cwd: str(payload["cwd"]) } : {},
+            // Conditional spread rather than a plain assignment: the 7 `{}` blocks and
+            // the 92 absent ones must leave the key absent, not present-and-undefined.
+            ...gitBranch !== void 0 ? { gitBranch } : {},
+            ...gitRepositoryUrl !== void 0 ? { gitRepositoryUrl } : {},
             ...str(payload["cli_version"]) !== void 0 ? { version: str(payload["cli_version"]) } : {},
             ...str(payload["originator"]) !== void 0 ? { entrypoint: str(payload["originator"]) } : {},
             // A Codex subagent is a rollout of its own, a peer of its parent in the
@@ -1364,15 +1451,61 @@ var codexTranscript = {
     }
     if (raw.type === "turn_context") {
       const model = str(payload["model"]);
-      if (!model)
+      const approval = str(payload["approval_policy"]);
+      const sandbox = payload["sandbox_policy"];
+      const sandboxMode = (() => {
+        if (!sandbox || typeof sandbox !== "object")
+          return void 0;
+        const bag = sandbox;
+        return str(bag["mode"]) ?? str(bag["type"]);
+      })();
+      const meta = {
+        ...model !== void 0 ? { model } : {},
+        ...approval !== void 0 ? { approvalMode: CODEX_APPROVAL_MODES[approval] ?? approval } : {},
+        ...sandboxMode !== void 0 ? { sandboxMode: CODEX_SANDBOX_MODES[sandboxMode] ?? sandboxMode } : {}
+      };
+      if (Object.keys(meta).length === 0)
         return [];
-      return [{ ...base, kind: "session_meta", meta: { model } }];
+      return [{ ...base, kind: "session_meta", meta }];
     }
     const kind = str(payload["type"]);
     if (raw.type === "event_msg" && kind === "token_count") {
       const usage = mapTokenCount(payload["info"]);
       return usage ? [{ ...base, kind: "usage", usage }] : [];
     }
+    if (raw.type === "compacted") {
+      const note = str(payload["message"]);
+      return [{ ...base, kind: "compaction", ...note ? { text: note } : {} }];
+    }
+    if (raw.type === "world_state") {
+      const state = payload["state"];
+      const perms = state && typeof state === "object" ? state["permissions"] : void 0;
+      if (!perms || typeof perms !== "object")
+        return [];
+      const list = perms["approved_command_prefixes"];
+      const steps = Array.isArray(list) ? list : [];
+      return [
+        {
+          ...base,
+          kind: "permission_grant",
+          input: {
+            steps: budgeted(steps),
+            count: steps.length,
+            ...payload["full"] === true ? { full: true } : {}
+          }
+        }
+      ];
+    }
+    if (raw.type === "event_msg" && kind === "turn_aborted") {
+      return [
+        {
+          ...base,
+          kind: "user_message",
+          isError: true,
+          errorKind: `aborted:${str(payload["reason"]) ?? "unknown"}`
+        }
+      ];
+    }
     if (raw.type !== "response_item")
       return [];
     switch (kind) {
@@ -1386,18 +1519,72 @@ var codexTranscript = {
             ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
           }
         ];
-      case "function_call_output":
+      case "function_call_output": {
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,
             kind: "tool_result",
-            output: payload["output"],
+            output,
+            // Only where an exit status was actually found. On the 993 string outputs
+            // that are not envelopes and the 144 array ones the key stays ABSENT rather
+            // than `false`: the emitter tests `record.isError`, and "this tool reported
+            // success" is a different claim from "nothing here reported an outcome".
+            ...exitCode !== void 0 ? { isError: exitCode !== 0 } : {},
             ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
           }
         ];
+      }
+      // Codex's OTHER tool-call shape, and the one it actually uses: `exec` and
+      // `apply_patch` arrive as `custom_tool_call`, never as `function_call`. Measured
+      // across 251 rollouts, 2179 of 5382 tool calls — 40% — took this shape, so
+      // handling only `function_call` left every shell command and every file write
+      // this endpoint made invisible to both the trace and anything reading it.
+      case "custom_tool_call":
+        return [
+          {
+            ...base,
+            kind: "tool_call",
+            toolName: str(payload["name"]) ?? "tool",
+            input: payload["input"],
+            ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
+          }
+        ];
+      case "custom_tool_call_output": {
+        const { output, exitCode } = execResult(payload["output"]);
+        return [
+          {
+            ...base,
+            kind: "tool_result",
+            output,
+            ...exitCode !== void 0 ? { isError: exitCode !== 0 } : {},
+            ...str(payload["call_id"]) !== void 0 ? { toolCallId: str(payload["call_id"]) } : {}
+          }
+        ];
+      }
+      // The model's own web reads. 49 across the corpus in 9 rollouts — `search` 31,
+      // `open_page` 16, `find_in_page` 2 — every one of which mapped to nothing, so a
+      // session where the agent searched and opened pages rendered as reasoning
+      // followed by an answer with no source anywhere in it. The queries and the URLs
+      // are the whole point of the record: they are the evidence of what the agent
+      // read from outside the machine.
+      //
+      // `action` is passed through whole. It is already a vendor-neutral argument bag
+      // ({type, query?, queries?, url?, pattern?}) and it is small — 322 bytes at the
+      // worst, 121 on average across all 49.
+      //
+      // Deliberately unpaired: no `toolCallId`. Only 1 of the 49 lines carries an
+      // `id`, `call_id` is the pairing key everywhere else in this stream, and no
+      // response_item output line ever pairs with a search — so setting one would
+      // register a span in the emitter's pairing table that nothing ever closes, and
+      // `finish()` would end it at pass end and stamp a multi-minute duration on a
+      // search that took seconds. Left unpaired, the emitter closes it at the call
+      // timestamp, which is the truthful reading.
+      case "web_search_call":
+        return [{ ...base, kind: "tool_call", toolName: "web_search", input: payload["action"] }];
       case "reasoning": {
         const text = textOf(payload["summary"]) ?? textOf(payload["content"]);
-        return text ? [{ ...base, kind: "thinking", text }] : [];
+        return [{ ...base, kind: "thinking", ...text !== void 0 ? { text } : {} }];
       }
       case "message": {
         const text = textOf(payload["content"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {
@@ -13,8 +13,8 @@
     ".codex-plugin"
   ],
   "devDependencies": {
-    "@darkhunt-security/endpoint-contracts": "0.9.2",
-    "@darkhunt-security/endpoint-core": "0.9.2"
+    "@darkhunt-security/endpoint-contracts": "0.9.3",
+    "@darkhunt-security/endpoint-core": "0.9.3"
   },
   "publishConfig": {
     "access": "public",