@darkhunt-security/endpoint-codex 0.9.14 → 0.9.16

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.14",
+  "version": "0.9.16",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -18872,12 +18872,27 @@ function acquireLock(scope) {
   }
   return () => rmSync(path, { force: true });
 }
-function isAlive(pid) {
+function isAlive(pid, kill = (p, s) => {
+  process.kill(p, s);
+}) {
   try {
-    process.kill(pid, 0);
+    kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (err) {
+    return err.code !== "ESRCH";
+  }
+}
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
+async function acquireLockWithin(scope, timeoutMs, sleep2 = (ms) => new Promise((r) => setTimeout(r, ms)), now = Date.now) {
+  const deadline = now() + timeoutMs;
+  for (; ; ) {
+    const release = acquireLock(scope);
+    if (release)
+      return release;
+    const remaining = deadline - now();
+    if (remaining <= 0)
+      return null;
+    await sleep2(Math.min(250, remaining));
   }
 }
 
@@ -21711,7 +21726,9 @@ function tryLoadConfig(vendor, options) {
 }
 async function runForwarder(mapper, options = {}) {
   const config = options.config ?? tryLoadConfig(mapper.vendor, options);
-  const release = acquireLock(config?.scope ?? mapper.vendor);
+  const scope = config?.scope ?? mapper.vendor;
+  const waited = options.lockWaitMs !== void 0 && options.lockWaitMs > 0;
+  const release = waited ? await acquireLockWithin(scope, options.lockWaitMs) : acquireLock(scope);
   if (!release) {
     return {
       transcripts: 0,
@@ -21720,7 +21737,12 @@ async function runForwarder(mapper, options = {}) {
       kinds: {},
       warnings: [],
       emitted: { transcripts: 0, records: 0 },
-      ok: true
+      lockBusy: true,
+      // A caller that waited and still did not get it has had its request dropped, and
+      // must not exit zero on it. One that never asked to wait was simply beaten to
+      // work that is now someone else's, which is success.
+      ok: !waited,
+      ...waited ? { error: "another forwarder holds the lock" } : {}
     };
   }
   const result2 = {
@@ -22053,6 +22075,10 @@ async function runBackfill(mapper, options, say2) {
   const pass = (subset) => runForwarder(mapper, {
     paths: subset,
     dryRun: options.dryRun,
+    // A backfill is an instruction, not an opportunistic spawn: it waits for the lock
+    // that a hook-fired forwarder may hold, and treats never getting it as a failure
+    // rather than reporting the `shipped 0` an up-to-date machine also prints.
+    ...options.dryRun ? {} : { lockWaitMs: options.lockWaitMs ?? DEFAULT_LOCK_WAIT_MS },
     ...options.profile !== void 0 ? { profile: options.profile } : {},
     ...options.credentialsPath !== void 0 ? { credentialsPath: options.credentialsPath } : {}
   });
@@ -22087,7 +22113,9 @@ async function runPasses(groups, pass, say2) {
       total.ok = false;
       if (result2.error !== void 0)
         total.error = result2.error;
-      say2(`stopped in batch ${index + 1} of ${groups.length}; earlier batches are checkpointed`);
+      if (result2.lockBusy === true)
+        total.lockBusy = true;
+      say2(result2.lockBusy === true ? `batch ${index + 1} of ${groups.length} could not start: another forwarder holds the lock` : `stopped in batch ${index + 1} of ${groups.length}; earlier batches are checkpointed`);
       break;
     }
     if (groups.length > 1) {
@@ -22498,6 +22526,11 @@ for (const [kind, n] of Object.entries(result.kinds).sort((a, b) => b[1] - a[1])
 for (const skip of result.skipped) say(`skipped ${skip}`);
 for (const warning of result.warnings ?? []) say(`WARNING ${warning}`);
 if (result.ok === false) {
+  if (result.lockBusy === true) {
+    say("NOT RUN \u2014 another forwarder held the lock for the whole wait");
+    say("nothing was shipped; re-run when the capture lane is idle");
+    process.exit(3);
+  }
   say(`EXPORT FAILED \u2014 ${result.error}`);
   if (result.emitted.records > 0) {
     say(

package/dist/bin/enroll.mjs

@@ -66,6 +66,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {

package/dist/bin/forwarder.mjs

@@ -18872,12 +18872,27 @@ function acquireLock(scope) {
   }
   return () => rmSync(path, { force: true });
 }
-function isAlive(pid) {
+function isAlive(pid, kill = (p, s) => {
+  process.kill(p, s);
+}) {
   try {
-    process.kill(pid, 0);
+    kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (err) {
+    return err.code !== "ESRCH";
+  }
+}
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
+async function acquireLockWithin(scope, timeoutMs, sleep2 = (ms) => new Promise((r) => setTimeout(r, ms)), now = Date.now) {
+  const deadline = now() + timeoutMs;
+  for (; ; ) {
+    const release = acquireLock(scope);
+    if (release)
+      return release;
+    const remaining = deadline - now();
+    if (remaining <= 0)
+      return null;
+    await sleep2(Math.min(250, remaining));
   }
 }
 
@@ -21711,7 +21726,9 @@ function tryLoadConfig(vendor, options) {
 }
 async function runForwarder(mapper, options = {}) {
   const config = options.config ?? tryLoadConfig(mapper.vendor, options);
-  const release = acquireLock(config?.scope ?? mapper.vendor);
+  const scope = config?.scope ?? mapper.vendor;
+  const waited = options.lockWaitMs !== void 0 && options.lockWaitMs > 0;
+  const release = waited ? await acquireLockWithin(scope, options.lockWaitMs) : acquireLock(scope);
   if (!release) {
     return {
       transcripts: 0,
@@ -21720,7 +21737,12 @@ async function runForwarder(mapper, options = {}) {
       kinds: {},
       warnings: [],
       emitted: { transcripts: 0, records: 0 },
-      ok: true
+      lockBusy: true,
+      // A caller that waited and still did not get it has had its request dropped, and
+      // must not exit zero on it. One that never asked to wait was simply beaten to
+      // work that is now someone else's, which is success.
+      ok: !waited,
+      ...waited ? { error: "another forwarder holds the lock" } : {}
     };
   }
   const result = {

package/dist/bin/guard.mjs

@@ -399,6 +399,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {

package/dist/bin/init.mjs

@@ -58,6 +58,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {

package/dist/bin/spool.mjs

@@ -201,6 +201,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {

package/dist/bin/status.mjs

@@ -190,6 +190,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // packages/core/dist/forwarder/health.js
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.14",
+  "version": "0.9.16",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {