@darkhunt-security/endpoint-codex 0.9.13 → 0.9.15

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -5674,8 +5674,8 @@ var require_getMachineId_linux = __commonJS({
     var fs_1 = __require("fs");
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     async function getMachineId() {
-      const paths2 = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
-      for (const path of paths2) {
+      const paths = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
+      for (const path of paths) {
         try {
           const result2 = await fs_1.promises.readFile(path, { encoding: "utf8" });
           return result2.trim();
@@ -13248,8 +13248,8 @@ var require_getMachineId_linux2 = __commonJS({
     var fs_1 = __require("fs");
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     async function getMachineId() {
-      const paths2 = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
-      for (const path of paths2) {
+      const paths = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
+      for (const path of paths) {
         try {
           const result2 = await fs_1.promises.readFile(path, { encoding: "utf8" });
           return result2.trim();
@@ -18096,8 +18096,8 @@ var DEFAULT_PROFILE = "default";
 var CREDENTIALS_BASENAME = "endpoint-credentials";
 var DEFAULT_CREDENTIALS_PATH = join2(CONFIG_DIR, `${CREDENTIALS_BASENAME}.json`);
 var CREDENTIALS_ENV = "DARKHUNT_ENDPOINT_CREDENTIALS";
-function resolveProfile(explicit2, fromConfig) {
-  return explicit2 ?? process.env["DARKHUNT_PROFILE"] ?? fromConfig ?? DEFAULT_PROFILE;
+function resolveProfile(explicit, fromConfig) {
+  return explicit ?? process.env["DARKHUNT_PROFILE"] ?? fromConfig ?? DEFAULT_PROFILE;
 }
 function expandPath(path) {
   if (path.startsWith("~/"))
@@ -18109,13 +18109,13 @@ function credentialsSelection(sources = {}) {
   const pointer = s.explicitPath ?? process.env[CREDENTIALS_ENV] ?? s.configuredPath;
   if (pointer)
     return { path: expandPath(pointer), explicit: true };
-  const profile2 = s.profile ?? DEFAULT_PROFILE;
-  if (profile2 === DEFAULT_PROFILE)
+  const profile = s.profile ?? DEFAULT_PROFILE;
+  if (profile === DEFAULT_PROFILE)
     return { path: DEFAULT_CREDENTIALS_PATH, explicit: false };
-  return { path: join2(CONFIG_DIR, `${CREDENTIALS_BASENAME}.${profile2}.json`), explicit: true };
+  return { path: join2(CONFIG_DIR, `${CREDENTIALS_BASENAME}.${profile}.json`), explicit: true };
 }
-function scopeKey(vendor, profile2) {
-  return profile2 === DEFAULT_PROFILE ? vendor : `${vendor}.${profile2}`;
+function scopeKey(vendor, profile) {
+  return profile === DEFAULT_PROFILE ? vendor : `${vendor}.${profile}`;
 }
 
 // packages/core/dist/config/local.js
@@ -18175,11 +18175,11 @@ function readConfigFile(vendor) {
 }
 function loadLocalConfig(vendor, options = {}) {
   const vendorFile = readConfigFile(vendor);
-  const profile2 = resolveProfile(options.profile, vendorFile.profile);
+  const profile = resolveProfile(options.profile, vendorFile.profile);
   const selection = credentialsSelection({
     ...options.credentialsPath !== void 0 ? { explicitPath: options.credentialsPath } : {},
     ...vendorFile.credentials !== void 0 ? { configuredPath: vendorFile.credentials } : {},
-    profile: profile2
+    profile
   });
   const inlineComplete = REQUIRED_FIELDS.every((name) => typeof vendorFile[name] === "string" && vendorFile[name] !== "");
   const useInline = inlineComplete && !selection.explicit;
@@ -18198,13 +18198,13 @@ function loadLocalConfig(vendor, options = {}) {
     ["applicationId", applicationId]
   ]) {
     if (typeof value !== "string" || value === "") {
-      throw new ConfigError(useInline ? `missing ${name} in ${configPath()}` : `missing ${name} for profile '${profile2}' (looked in ${credsPath}, then ${configPath()})`);
+      throw new ConfigError(useInline ? `missing ${name} in ${configPath()}` : `missing ${name} for profile '${profile}' (looked in ${credsPath}, then ${configPath()})`);
     }
   }
   return {
-    profile: profile2,
+    profile,
     credentialsPath: credsPath,
-    scope: scopeKey(vendor, profile2),
+    scope: scopeKey(vendor, profile),
     baseUrl,
     apiKey,
     tenantId,
@@ -18245,16 +18245,16 @@ function loadBeat(scope) {
 function liveTranscripts(beat, now = Date.now()) {
   if (!beat)
     return [];
-  const paths2 = /* @__PURE__ */ new Set();
+  const paths = /* @__PURE__ */ new Set();
   for (const session of Object.values(beat.sessions ?? {})) {
     if (!session.transcriptPath)
       continue;
     const at = Date.parse(session.at);
     if (Number.isNaN(at) || now - at > BEAT_LIVE_MS)
       continue;
-    paths2.add(session.transcriptPath);
+    paths.add(session.transcriptPath);
   }
-  return [...paths2];
+  return [...paths];
 }
 
 // packages/core/dist/emit/ids.js
@@ -18880,6 +18880,19 @@ function isAlive(pid) {
     return false;
   }
 }
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
+async function acquireLockWithin(scope, timeoutMs, sleep2 = (ms) => new Promise((r) => setTimeout(r, ms)), now = Date.now) {
+  const deadline = now() + timeoutMs;
+  for (; ; ) {
+    const release = acquireLock(scope);
+    if (release)
+      return release;
+    const remaining = deadline - now();
+    if (remaining <= 0)
+      return null;
+    await sleep2(Math.min(250, remaining));
+  }
+}
 
 // packages/core/dist/forwarder/export-status.js
 init_esm();
@@ -21270,16 +21283,16 @@ var Generation = class extends Span {
     this.otelSpan.setAttribute(ATTR.MODEL_NAME, model);
     this.otelSpan.setAttribute(GEN_AI.REQUEST_MODEL, model);
   }
-  setUsage(usage) {
-    this.otelSpan.setAttribute(ATTR.USAGE_DETAILS, safeJsonStringify(usage));
-    if (usage.input_tokens !== void 0)
-      this.otelSpan.setAttribute(GEN_AI.USAGE_INPUT_TOKENS, usage.input_tokens);
-    if (usage.output_tokens !== void 0)
-      this.otelSpan.setAttribute(GEN_AI.USAGE_OUTPUT_TOKENS, usage.output_tokens);
-    if (usage.cache_read_tokens !== void 0)
-      this.otelSpan.setAttribute(GEN_AI.USAGE_CACHE_READ_INPUT_TOKENS, usage.cache_read_tokens);
-    if (usage.cache_creation_tokens !== void 0)
-      this.otelSpan.setAttribute(GEN_AI.USAGE_CACHE_CREATION_INPUT_TOKENS, usage.cache_creation_tokens);
+  setUsage(usage2) {
+    this.otelSpan.setAttribute(ATTR.USAGE_DETAILS, safeJsonStringify(usage2));
+    if (usage2.input_tokens !== void 0)
+      this.otelSpan.setAttribute(GEN_AI.USAGE_INPUT_TOKENS, usage2.input_tokens);
+    if (usage2.output_tokens !== void 0)
+      this.otelSpan.setAttribute(GEN_AI.USAGE_OUTPUT_TOKENS, usage2.output_tokens);
+    if (usage2.cache_read_tokens !== void 0)
+      this.otelSpan.setAttribute(GEN_AI.USAGE_CACHE_READ_INPUT_TOKENS, usage2.cache_read_tokens);
+    if (usage2.cache_creation_tokens !== void 0)
+      this.otelSpan.setAttribute(GEN_AI.USAGE_CACHE_CREATION_INPUT_TOKENS, usage2.cache_creation_tokens);
   }
   setCost(cost) {
     this.otelSpan.setAttribute(ATTR.COST_DETAILS, safeJsonStringify(cost));
@@ -21683,19 +21696,19 @@ var SPOOL_KEY = "::spool::";
 var DARKHUNT_SOURCE_HINT = "darkhunt-telemetry";
 function drainSpool(mapper, checkpoints) {
   const path = spoolPath(mapper.vendor);
-  const paths2 = /* @__PURE__ */ new Set();
+  const paths = /* @__PURE__ */ new Set();
   try {
     const { lines, offset, size } = readNewLines(path, resumeOffset(checkpoints, SPOOL_KEY));
     for (const line of lines) {
       try {
         const event = JSON.parse(line.text);
         if (event.transcriptPath)
-          paths2.add(event.transcriptPath);
+          paths.add(event.transcriptPath);
       } catch {
         continue;
       }
     }
-    return { paths: [...paths2], checkpoint: { offset, size } };
+    return { paths: [...paths], checkpoint: { offset, size } };
   } catch {
     return { paths: [] };
   }
@@ -21711,7 +21724,9 @@ function tryLoadConfig(vendor, options) {
 }
 async function runForwarder(mapper, options = {}) {
   const config = options.config ?? tryLoadConfig(mapper.vendor, options);
-  const release = acquireLock(config?.scope ?? mapper.vendor);
+  const scope = config?.scope ?? mapper.vendor;
+  const waited = options.lockWaitMs !== void 0 && options.lockWaitMs > 0;
+  const release = waited ? await acquireLockWithin(scope, options.lockWaitMs) : acquireLock(scope);
   if (!release) {
     return {
       transcripts: 0,
@@ -21719,7 +21734,13 @@ async function runForwarder(mapper, options = {}) {
       skipped: ["another forwarder holds the lock"],
       kinds: {},
       warnings: [],
-      ok: true
+      emitted: { transcripts: 0, records: 0 },
+      lockBusy: true,
+      // A caller that waited and still did not get it has had its request dropped, and
+      // must not exit zero on it. One that never asked to wait was simply beaten to
+      // work that is now someone else's, which is success.
+      ok: !waited,
+      ...waited ? { error: "another forwarder holds the lock" } : {}
     };
   }
   const result2 = {
@@ -21728,6 +21749,7 @@ async function runForwarder(mapper, options = {}) {
     skipped: [],
     kinds: {},
     warnings: [],
+    emitted: { transcripts: 0, records: 0 },
     ok: true
   };
   try {
@@ -21784,8 +21806,8 @@ async function runForwarder(mapper, options = {}) {
     }
     const drain = options.paths ? { paths: options.paths } : drainSpool(mapper, checkpoints);
     const named = options.paths ? drain.paths : [.../* @__PURE__ */ new Set([...drain.paths, ...liveTranscripts(loadBeat(config.scope))])];
-    const paths2 = [...new Set(named.flatMap((path) => [path, ...related(mapper, path)]))];
-    if (paths2.length === 0) {
+    const paths = [...new Set(named.flatMap((path) => [path, ...related(mapper, path)]))];
+    if (paths.length === 0) {
       if (drain.checkpoint)
         checkpoints[SPOOL_KEY] = drain.checkpoint;
       saveCheckpoints(config.scope, checkpoints);
@@ -21815,7 +21837,7 @@ async function runForwarder(mapper, options = {}) {
     const watch = watchExports();
     const staged = { ...checkpoints };
     try {
-      for (const path of paths2) {
+      for (const path of paths) {
         try {
           const from = resumeOffset(checkpoints, path);
           const carried = resumeTurn(checkpoints, path, from);
@@ -21877,6 +21899,7 @@ async function runForwarder(mapper, options = {}) {
       await client.shutdown();
       watch.stop();
     }
+    result2.emitted = { transcripts: result2.transcripts, records: result2.records };
     if (watch.failures() > 0) {
       result2.ok = false;
       result2.error = watch.reason() ?? "span export failed";
@@ -21901,12 +21924,12 @@ async function runForwarder(mapper, options = {}) {
     release();
   }
 }
-function withinDays(paths2, days) {
+function withinDays(paths, days) {
   if (!Number.isFinite(days) || days <= 0) {
     throw new RangeError(`--days must be a positive number of days, got ${days}`);
   }
   const cutoff = Date.now() - days * 24 * 60 * 60 * 1e3;
-  return paths2.filter((path) => {
+  return paths.filter((path) => {
     try {
       return statSync4(path).mtimeMs >= cutoff;
     } catch {
@@ -21958,6 +21981,148 @@ import { homedir as homedir3 } from "node:os";
 import { join as join9 } from "node:path";
 var CLI_CREDENTIALS_PATH = join9(homedir3(), ".darkhunt", "credentials.json");
 
+// packages/core/dist/cli/backfill.js
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["dry-run"]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["profile", "credentials", "days", "batch"]);
+var DEFAULT_BATCH = 25;
+function usage(command) {
+  return [
+    `usage: ${command} [options] [paths...]`,
+    "",
+    "  --dry-run                map only: no network, no checkpoints",
+    "  --days=N                 only transcripts written to in the last N days",
+    "  --batch=N                transcripts per pass (default " + String(DEFAULT_BATCH) + ")",
+    "  --profile=NAME           endpoint profile to ship to",
+    "  --credentials=PATH       explicit credentials file",
+    "  -h, --help               this message",
+    "",
+    "  With no paths this ships EVERY transcript on disk. Narrow it with --days",
+    "  or by naming transcripts, and confirm the destination with --dry-run first."
+  ].join("\n");
+}
+function parseBackfillArgs(argv) {
+  const paths = [];
+  const values = /* @__PURE__ */ new Map();
+  let dryRun = false;
+  for (const arg of argv) {
+    if (arg === "-h" || arg === "--help")
+      return { kind: "help" };
+    if (!arg.startsWith("--")) {
+      paths.push(arg);
+      continue;
+    }
+    const body = arg.slice(2);
+    const eq = body.indexOf("=");
+    const name = eq === -1 ? body : body.slice(0, eq);
+    if (BOOLEAN_FLAGS.has(name)) {
+      if (eq !== -1)
+        return { kind: "error", message: `--${name} takes no value` };
+      dryRun = true;
+      continue;
+    }
+    if (VALUE_FLAGS.has(name)) {
+      if (eq === -1)
+        return { kind: "error", message: `--${name} needs a value, as --${name}=VALUE` };
+      values.set(name, body.slice(eq + 1));
+      continue;
+    }
+    return {
+      kind: "error",
+      message: `unknown option '${arg}'. Known: ${[...BOOLEAN_FLAGS, ...VALUE_FLAGS].map((f) => `--${f}`).sort().join(", ")}, --help`
+    };
+  }
+  const positive = (name) => {
+    const raw = values.get(name);
+    if (raw === void 0)
+      return void 0;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0) {
+      return { kind: "error", message: `--${name} must be a positive number, got '${raw}'` };
+    }
+    return n;
+  };
+  const sinceDays = positive("days");
+  if (typeof sinceDays === "object")
+    return sinceDays;
+  const batch = positive("batch");
+  if (typeof batch === "object")
+    return batch;
+  return {
+    kind: "run",
+    options: {
+      dryRun,
+      paths,
+      ...values.get("profile") !== void 0 ? { profile: values.get("profile") } : {},
+      ...values.get("credentials") !== void 0 ? { credentialsPath: values.get("credentials") } : {},
+      ...sinceDays !== void 0 ? { sinceDays } : {},
+      ...batch !== void 0 ? { batch } : {}
+    }
+  };
+}
+function batches(items, size) {
+  const out = [];
+  for (let i = 0; i < items.length; i += size)
+    out.push(items.slice(i, i + size));
+  return out;
+}
+async function runBackfill(mapper, options, say2) {
+  const discovered = options.paths.length > 0 ? options.paths : discoverTranscripts(mapper);
+  const paths = options.sinceDays === void 0 ? discovered : withinDays(discovered, options.sinceDays);
+  const window2 = options.sinceDays === void 0 ? "" : ` written to in the last ${options.sinceDays} day(s)`;
+  say2(`${options.dryRun ? "DRY RUN \u2014 nothing will be sent. " : ""}${paths.length} transcript(s)${window2}`);
+  const pass = (subset) => runForwarder(mapper, {
+    paths: subset,
+    dryRun: options.dryRun,
+    // A backfill is an instruction, not an opportunistic spawn: it waits for the lock
+    // that a hook-fired forwarder may hold, and treats never getting it as a failure
+    // rather than reporting the `shipped 0` an up-to-date machine also prints.
+    ...options.dryRun ? {} : { lockWaitMs: options.lockWaitMs ?? DEFAULT_LOCK_WAIT_MS },
+    ...options.profile !== void 0 ? { profile: options.profile } : {},
+    ...options.credentialsPath !== void 0 ? { credentialsPath: options.credentialsPath } : {}
+  });
+  if (options.dryRun)
+    return pass(paths);
+  if (paths.length === 0)
+    return pass([]);
+  return runPasses(batches(paths, options.batch ?? DEFAULT_BATCH), pass, say2);
+}
+async function runPasses(groups, pass, say2) {
+  const total = {
+    transcripts: 0,
+    records: 0,
+    skipped: [],
+    kinds: {},
+    warnings: [],
+    emitted: { transcripts: 0, records: 0 },
+    ok: true
+  };
+  for (const [index, group] of groups.entries()) {
+    const result2 = await pass(group);
+    total.transcripts += result2.transcripts;
+    total.records += result2.records;
+    total.emitted.transcripts += result2.emitted.transcripts;
+    total.emitted.records += result2.emitted.records;
+    total.skipped.push(...result2.skipped);
+    total.warnings.push(...result2.warnings);
+    for (const [kind, n] of Object.entries(result2.kinds)) {
+      total.kinds[kind] = (total.kinds[kind] ?? 0) + n;
+    }
+    if (result2.ok === false) {
+      total.ok = false;
+      if (result2.error !== void 0)
+        total.error = result2.error;
+      if (result2.lockBusy === true)
+        total.lockBusy = true;
+      say2(result2.lockBusy === true ? `batch ${index + 1} of ${groups.length} could not start: another forwarder holds the lock` : `stopped in batch ${index + 1} of ${groups.length}; earlier batches are checkpointed`);
+      break;
+    }
+    if (groups.length > 1) {
+      say2(`batch ${index + 1}/${groups.length}: ${result2.records} record(s)`);
+    }
+  }
+  return total;
+}
+
 // adapters/codex/dist/transcript.js
 import { readFileSync as readFileSync6 } from "node:fs";
 import { basename, join as join10 } from "node:path";
@@ -22018,15 +22183,15 @@ function budgeted(steps) {
   return kept;
 }
 function execEnvelope(text) {
-  let parsed;
+  let parsed2;
   try {
-    parsed = JSON.parse(text);
+    parsed2 = JSON.parse(text);
   } catch {
     return void 0;
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+  if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2))
     return void 0;
-  const bag = parsed;
+  const bag = parsed2;
   if (!Object.prototype.hasOwnProperty.call(bag, "output"))
     return void 0;
   const metadata = bag["metadata"];
@@ -22065,13 +22230,13 @@ function jwtClaims(token) {
   }
 }
 function emailFromAuth(raw) {
-  let parsed;
+  let parsed2;
   try {
-    parsed = JSON.parse(raw);
+    parsed2 = JSON.parse(raw);
   } catch {
     return void 0;
   }
-  const tokens = parsed?.tokens;
+  const tokens = parsed2?.tokens;
   const token = tokens?.id_token;
   if (typeof token !== "string" || token === "")
     return void 0;
@@ -22089,11 +22254,11 @@ function repositoryIdentity(url) {
     return `${scp[1]}/${stripSuffix(scp[2])}`;
   const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `ssh://${trimmed}`;
   try {
-    const parsed = new URL(withScheme);
-    if (!parsed.hostname)
+    const parsed2 = new URL(withScheme);
+    if (!parsed2.hostname)
       return trimmed;
-    const path = stripSuffix(parsed.pathname.replace(/^\/+/, ""));
-    return path === "" ? parsed.hostname : `${parsed.hostname}/${path}`;
+    const path = stripSuffix(parsed2.pathname.replace(/^\/+/, ""));
+    return path === "" ? parsed2.hostname : `${parsed2.hostname}/${path}`;
   } catch {
     return trimmed;
   }
@@ -22201,8 +22366,8 @@ var codexTranscript = {
     }
     const kind = str(payload["type"]);
     if (raw.type === "event_msg" && kind === "token_count") {
-      const usage = mapTokenCount(payload["info"]);
-      return usage ? [{ ...base, kind: "usage", usage }] : [];
+      const usage2 = mapTokenCount(payload["info"]);
+      return usage2 ? [{ ...base, kind: "usage", usage: usage2 }] : [];
     }
     if (raw.type === "compacted") {
       const note = str(payload["message"]);
@@ -22337,33 +22502,21 @@ var codexTranscript = {
 };
 
 // adapters/codex/bin/backfill.mjs
-var argv = process.argv.slice(2);
-var dryRun = argv.includes("--dry-run");
-var explicit = argv.filter((a) => !a.startsWith("--"));
-var flag = (n) => {
-  const a = argv.find((x) => x.startsWith(`--${n}=`));
-  return a ? a.slice(n.length + 3) : void 0;
-};
-var profile = flag("profile");
-var credentialsPath2 = flag("credentials");
-var sinceDays;
-if (flag("days") !== void 0) {
-  sinceDays = Number(flag("days"));
-  if (!Number.isFinite(sinceDays) || sinceDays <= 0) {
-    process.stderr.write(`darkhunt: --days must be a positive number, got '${flag("days")}'
-`);
-    process.exit(1);
-  }
-}
-var discovered = explicit.length > 0 ? explicit : discoverTranscripts(codexTranscript);
-var paths = sinceDays === void 0 ? discovered : withinDays(discovered, sinceDays);
-var window2 = sinceDays === void 0 ? "" : ` written to in the last ${sinceDays} day(s)`;
 var say = (m) => process.stderr.write(`darkhunt: ${m}
 `);
-say(`${dryRun ? "DRY RUN \u2014 nothing will be sent. " : ""}${paths.length} transcript(s)${window2}`);
-var result = await runForwarder(codexTranscript, { paths, dryRun, profile, credentialsPath: credentialsPath2 });
+var parsed = parseBackfillArgs(process.argv.slice(2));
+if (parsed.kind === "help") {
+  process.stdout.write(usage("backfill.mjs") + "\n");
+  process.exit(0);
+}
+if (parsed.kind === "error") {
+  say(parsed.message);
+  process.stderr.write(usage("backfill.mjs") + "\n");
+  process.exit(2);
+}
+var result = await runBackfill(codexTranscript, parsed.options, say);
 say(
-  `${dryRun ? "mapped" : "shipped"} ${result.records} record(s) from ${result.transcripts} transcript(s)`
+  `${parsed.options.dryRun ? "mapped" : "shipped"} ${result.records} record(s) from ${result.transcripts} transcript(s)`
 );
 for (const [kind, n] of Object.entries(result.kinds).sort((a, b) => b[1] - a[1])) {
   say(`  ${kind.padEnd(18)} ${n}`);
@@ -22371,7 +22524,17 @@ for (const [kind, n] of Object.entries(result.kinds).sort((a, b) => b[1] - a[1])
 for (const skip of result.skipped) say(`skipped ${skip}`);
 for (const warning of result.warnings ?? []) say(`WARNING ${warning}`);
 if (result.ok === false) {
+  if (result.lockBusy === true) {
+    say("NOT RUN \u2014 another forwarder held the lock for the whole wait");
+    say("nothing was shipped; re-run when the capture lane is idle");
+    process.exit(3);
+  }
   say(`EXPORT FAILED \u2014 ${result.error}`);
+  if (result.emitted.records > 0) {
+    say(
+      `${result.emitted.records} record(s) from ${result.emitted.transcripts} transcript(s) were sent before the failure and may have been stored`
+    );
+  }
   say("checkpoints were NOT advanced; re-run once the cause is fixed");
   process.exit(1);
 }

package/dist/bin/enroll.mjs

@@ -66,6 +66,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {

package/dist/bin/forwarder.mjs

@@ -18880,6 +18880,19 @@ function isAlive(pid) {
     return false;
   }
 }
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
+async function acquireLockWithin(scope, timeoutMs, sleep2 = (ms) => new Promise((r) => setTimeout(r, ms)), now = Date.now) {
+  const deadline = now() + timeoutMs;
+  for (; ; ) {
+    const release = acquireLock(scope);
+    if (release)
+      return release;
+    const remaining = deadline - now();
+    if (remaining <= 0)
+      return null;
+    await sleep2(Math.min(250, remaining));
+  }
+}
 
 // packages/core/dist/forwarder/export-status.js
 init_esm();
@@ -21711,7 +21724,9 @@ function tryLoadConfig(vendor, options) {
 }
 async function runForwarder(mapper, options = {}) {
   const config = options.config ?? tryLoadConfig(mapper.vendor, options);
-  const release = acquireLock(config?.scope ?? mapper.vendor);
+  const scope = config?.scope ?? mapper.vendor;
+  const waited = options.lockWaitMs !== void 0 && options.lockWaitMs > 0;
+  const release = waited ? await acquireLockWithin(scope, options.lockWaitMs) : acquireLock(scope);
   if (!release) {
     return {
       transcripts: 0,
@@ -21719,7 +21734,13 @@ async function runForwarder(mapper, options = {}) {
       skipped: ["another forwarder holds the lock"],
       kinds: {},
       warnings: [],
-      ok: true
+      emitted: { transcripts: 0, records: 0 },
+      lockBusy: true,
+      // A caller that waited and still did not get it has had its request dropped, and
+      // must not exit zero on it. One that never asked to wait was simply beaten to
+      // work that is now someone else's, which is success.
+      ok: !waited,
+      ...waited ? { error: "another forwarder holds the lock" } : {}
     };
   }
   const result = {
@@ -21728,6 +21749,7 @@ async function runForwarder(mapper, options = {}) {
     skipped: [],
     kinds: {},
     warnings: [],
+    emitted: { transcripts: 0, records: 0 },
     ok: true
   };
   try {
@@ -21877,6 +21899,7 @@ async function runForwarder(mapper, options = {}) {
       await client.shutdown();
       watch.stop();
     }
+    result.emitted = { transcripts: result.transcripts, records: result.records };
     if (watch.failures() > 0) {
       result.ok = false;
       result.error = watch.reason() ?? "span export failed";

package/dist/bin/guard.mjs

@@ -399,6 +399,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {

package/dist/bin/init.mjs

@@ -58,6 +58,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {

package/dist/bin/spool.mjs

@@ -201,6 +201,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {

package/dist/bin/status.mjs

@@ -190,6 +190,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // packages/core/dist/forwarder/health.js
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {