@darkhunt-security/endpoint-codex 0.9.11 → 0.9.13

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -22017,28 +22017,41 @@ function budgeted(steps) {
   }
   return kept;
 }
-function unwrapExecOutput(value) {
-  if (typeof value !== "string")
-    return { output: value };
+function execEnvelope(text) {
   let parsed;
   try {
-    parsed = JSON.parse(value);
+    parsed = JSON.parse(text);
   } catch {
-    return { output: value };
+    return void 0;
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-    return { output: value };
+    return void 0;
   const bag = parsed;
   if (!Object.prototype.hasOwnProperty.call(bag, "output"))
-    return { output: value };
+    return void 0;
   const metadata = bag["metadata"];
-  if (!metadata || typeof metadata !== "object")
-    return { output: value };
-  const exitCode = num(metadata["exit_code"]);
+  const exitCode = num(bag["exit_code"]) ?? (metadata && typeof metadata === "object" ? num(metadata["exit_code"]) : void 0);
   if (exitCode === void 0)
-    return { output: value };
+    return void 0;
   return { output: bag["output"], exitCode };
 }
+function execResult(value) {
+  if (typeof value === "string")
+    return execEnvelope(value) ?? { output: value };
+  if (Array.isArray(value)) {
+    for (const block of value) {
+      if (!block || typeof block !== "object")
+        continue;
+      const text = block["text"];
+      if (typeof text !== "string")
+        continue;
+      const envelope = execEnvelope(text);
+      if (envelope)
+        return envelope;
+    }
+  }
+  return { output: textOf(value) ?? value };
+}
 function jwtClaims(token) {
   const parts = token.split(".");
   if (parts.length !== 3 || !parts[1])
@@ -22238,8 +22251,7 @@ var codexTranscript = {
           }
         ];
       case "function_call_output": {
-        const flattened = textOf(payload["output"]) ?? payload["output"];
-        const { output, exitCode } = unwrapExecOutput(flattened);
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,
@@ -22270,8 +22282,7 @@ var codexTranscript = {
           }
         ];
       case "custom_tool_call_output": {
-        const flattened = textOf(payload["output"]) ?? payload["output"];
-        const { output, exitCode } = unwrapExecOutput(flattened);
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,

package/dist/bin/forwarder.mjs

@@ -22004,28 +22004,41 @@ function budgeted(steps) {
   }
   return kept;
 }
-function unwrapExecOutput(value) {
-  if (typeof value !== "string")
-    return { output: value };
+function execEnvelope(text) {
   let parsed;
   try {
-    parsed = JSON.parse(value);
+    parsed = JSON.parse(text);
   } catch {
-    return { output: value };
+    return void 0;
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-    return { output: value };
+    return void 0;
   const bag = parsed;
   if (!Object.prototype.hasOwnProperty.call(bag, "output"))
-    return { output: value };
+    return void 0;
   const metadata = bag["metadata"];
-  if (!metadata || typeof metadata !== "object")
-    return { output: value };
-  const exitCode = num(metadata["exit_code"]);
+  const exitCode = num(bag["exit_code"]) ?? (metadata && typeof metadata === "object" ? num(metadata["exit_code"]) : void 0);
   if (exitCode === void 0)
-    return { output: value };
+    return void 0;
   return { output: bag["output"], exitCode };
 }
+function execResult(value) {
+  if (typeof value === "string")
+    return execEnvelope(value) ?? { output: value };
+  if (Array.isArray(value)) {
+    for (const block of value) {
+      if (!block || typeof block !== "object")
+        continue;
+      const text = block["text"];
+      if (typeof text !== "string")
+        continue;
+      const envelope = execEnvelope(text);
+      if (envelope)
+        return envelope;
+    }
+  }
+  return { output: textOf(value) ?? value };
+}
 function jwtClaims(token) {
   const parts = token.split(".");
   if (parts.length !== 3 || !parts[1])
@@ -22225,8 +22238,7 @@ var codexTranscript = {
           }
         ];
       case "function_call_output": {
-        const flattened = textOf(payload["output"]) ?? payload["output"];
-        const { output, exitCode } = unwrapExecOutput(flattened);
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,
@@ -22257,8 +22269,7 @@ var codexTranscript = {
           }
         ];
       case "custom_tool_call_output": {
-        const flattened = textOf(payload["output"]) ?? payload["output"];
-        const { output, exitCode } = unwrapExecOutput(flattened);
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,

package/dist/bin/guard.mjs

@@ -1378,6 +1378,14 @@ var codexCodec = {
     };
   },
   encodeDecision(decision) {
+    const noOpinion = decision.decision === "allow" && decision.updatedInput === void 0 && (decision.ruleId === null || decision.enforcement === "advisory");
+    if (noOpinion) {
+      const message = [decision.reason, decision.remediation].filter(Boolean).join(" ");
+      return {
+        stdout: message ? JSON.stringify({ systemMessage: message }) : "",
+        exitCode: 0
+      };
+    }
     const hookSpecificOutput = {
       hookEventName: "PreToolUse",
       permissionDecision: decision.decision

package/dist/bin/spool.mjs

@@ -1180,6 +1180,14 @@ var codexCodec = {
     };
   },
   encodeDecision(decision) {
+    const noOpinion = decision.decision === "allow" && decision.updatedInput === void 0 && (decision.ruleId === null || decision.enforcement === "advisory");
+    if (noOpinion) {
+      const message = [decision.reason, decision.remediation].filter(Boolean).join(" ");
+      return {
+        stdout: message ? JSON.stringify({ systemMessage: message }) : "",
+        exitCode: 0
+      };
+    }
     const hookSpecificOutput = {
       hookEventName: "PreToolUse",
       permissionDecision: decision.decision

package/dist/bin/status.mjs

@@ -1286,28 +1286,41 @@ function budgeted(steps) {
   }
   return kept;
 }
-function unwrapExecOutput(value) {
-  if (typeof value !== "string")
-    return { output: value };
+function execEnvelope(text) {
   let parsed;
   try {
-    parsed = JSON.parse(value);
+    parsed = JSON.parse(text);
   } catch {
-    return { output: value };
+    return void 0;
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-    return { output: value };
+    return void 0;
   const bag = parsed;
   if (!Object.prototype.hasOwnProperty.call(bag, "output"))
-    return { output: value };
+    return void 0;
   const metadata = bag["metadata"];
-  if (!metadata || typeof metadata !== "object")
-    return { output: value };
-  const exitCode = num(metadata["exit_code"]);
+  const exitCode = num(bag["exit_code"]) ?? (metadata && typeof metadata === "object" ? num(metadata["exit_code"]) : void 0);
   if (exitCode === void 0)
-    return { output: value };
+    return void 0;
   return { output: bag["output"], exitCode };
 }
+function execResult(value) {
+  if (typeof value === "string")
+    return execEnvelope(value) ?? { output: value };
+  if (Array.isArray(value)) {
+    for (const block of value) {
+      if (!block || typeof block !== "object")
+        continue;
+      const text = block["text"];
+      if (typeof text !== "string")
+        continue;
+      const envelope = execEnvelope(text);
+      if (envelope)
+        return envelope;
+    }
+  }
+  return { output: textOf(value) ?? value };
+}
 function jwtClaims(token) {
   const parts = token.split(".");
   if (parts.length !== 3 || !parts[1])
@@ -1507,8 +1520,7 @@ var codexTranscript = {
           }
         ];
       case "function_call_output": {
-        const flattened = textOf(payload["output"]) ?? payload["output"];
-        const { output, exitCode } = unwrapExecOutput(flattened);
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,
@@ -1539,8 +1551,7 @@ var codexTranscript = {
           }
         ];
       case "custom_tool_call_output": {
-        const flattened = textOf(payload["output"]) ?? payload["output"];
-        const { output, exitCode } = unwrapExecOutput(flattened);
+        const { output, exitCode } = execResult(payload["output"]);
         return [
           {
             ...base,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {