@darkhunt-security/endpoint-codex 0.9.16 → 0.9.18

package/dist/bin/enroll.mjs

@@ -60,12 +60,16 @@ async function readStdin(stream) {
   return Buffer.concat(chunks).toString("utf8");
 }
 
+// packages/core/dist/emit/emitter.js
+var PAYLOAD_LIMIT = 128 * 1024;
+
 // packages/core/dist/forwarder/tail.js
 var DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
 var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var HEARTBEAT_MS = 60 * 1e3;
 var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
@@ -994,6 +998,9 @@ var VALIDATORS = Object.freeze({
 // node_modules/@darkhunt-security/telemetry/dist/client.js
 var LIB_VERSION = package_default.version;
 
+// packages/core/dist/forwarder/retry.js
+var CLAIM_STALE_MS = 45 * 60 * 1e3;
+
 // packages/core/dist/cli/init.js
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 function init(argv) {
@@ -1033,7 +1040,11 @@ function init(argv) {
     // a named profile resolve without the flag on every later run.
     ...separateFile ? { profile, credentials: credsPath, ...stripCredentials(existingConfig) } : credentials,
     enabled: existingConfig["enabled"] ?? true,
-    capture: existingConfig["capture"] ?? { enabled: true },
+    // Written explicitly rather than left to the default: `backfill: false` is the one
+    // setting someone is likely to go looking for, and a key that is not in the file is
+    // not findable. An existing block is preserved untouched, so this never flips a
+    // machine that had already opted in.
+    capture: existingConfig["capture"] ?? { enabled: true, backfill: false },
     // Enforcement stays off until the mapper is validated — capture only for now.
     enforce: existingConfig["enforce"] ?? { mode: "off", failClosed: true },
     // Whatever another endpoint wrote is preserved: one file, several endpoints, and

package/dist/bin/forwarder.mjs

@@ -18160,6 +18160,9 @@ function settingsFor(file, vendor) {
     ...file.enforce ?? override.enforce ? { enforce: { ...file.enforce, ...override.enforce } } : {}
   };
 }
+function resolveCapture(capture) {
+  return { enabled: capture?.enabled ?? true, backfill: capture?.backfill ?? false };
+}
 function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
@@ -18212,7 +18215,7 @@ function loadLocalConfig(vendor, options = {}) {
     applicationId,
     ...(creds.userId ?? vendorFile.userId) !== void 0 ? { userId: creds.userId ?? vendorFile.userId } : {},
     enabled: vendorFile.enabled ?? true,
-    capture: { enabled: vendorFile.capture?.enabled ?? true },
+    capture: resolveCapture(vendorFile.capture),
     enforce: {
       mode: vendorFile.enforce?.mode ?? "off",
       failClosed: vendorFile.enforce?.failClosed ?? true
@@ -18257,6 +18260,9 @@ function liveTranscripts(beat, now = Date.now()) {
   return [...paths];
 }
 
+// packages/core/dist/emit/emitter.js
+import { createHash as createHash2 } from "node:crypto";
+
 // packages/core/dist/emit/ids.js
 import { createHash, randomBytes } from "node:crypto";
 var SPAN_ID_HEX = 16;
@@ -18296,6 +18302,20 @@ var SeededIdGenerator = class {
 };
 
 // packages/core/dist/emit/emitter.js
+var PAYLOAD_LIMIT = 128 * 1024;
+function capPayload(value, limit = PAYLOAD_LIMIT) {
+  if (value === void 0 || value === null)
+    return value;
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  if (text === void 0 || text.length <= limit)
+    return value;
+  const digest = createHash2("sha256").update(text).digest("hex").slice(0, 16);
+  const marker = `\u2026 [truncated by darkhunt: ${text.length} chars total, sha256:${digest}]`;
+  return `${text.slice(0, Math.max(0, limit - marker.length))}${marker}`;
+}
+function capText(text, limit = PAYLOAD_LIMIT) {
+  return capPayload(text, limit);
+}
 var TOOL_SUMMARY_LIMIT = 2e3;
 function summarize(output) {
   const text = typeof output === "string" ? output : JSON.stringify(output ?? null);
@@ -18422,7 +18442,7 @@ var SessionEmitter = class {
         // A subagent's first record is the task it was given, and it has already been
         // absorbed by the time this fires — so the child trace opens with its brief
         // rather than empty.
-        ...this.lastUserText ? { input: this.lastUserText } : {},
+        ...this.lastUserText ? { input: capText(this.lastUserText) } : {},
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {}
       }));
       this.sidechains.push(owner);
@@ -18463,7 +18483,7 @@ var SessionEmitter = class {
       case "thinking": {
         this.openGeneration(record, owner);
         const host = this.generation ?? owner;
-        this.seeded(["thinking", record.uuid], () => host.span("thinking", { startTime: record.ts, output: record.text })).end({ endTime: record.ts });
+        this.seeded(["thinking", record.uuid], () => host.span("thinking", { startTime: record.ts, output: capPayload(record.text) })).end({ endTime: record.ts });
         break;
       }
       case "tool_call": {
@@ -18474,8 +18494,8 @@ var SessionEmitter = class {
           startTime: record.ts,
           ...record.toolName !== void 0 ? { toolName: record.toolName } : {},
           ...record.toolCallId !== void 0 ? { toolCallId: record.toolCallId } : {},
-          toolArguments: record.input,
-          input: record.input
+          toolArguments: capPayload(record.input),
+          input: capPayload(record.input)
         }));
         if (record.toolCallId)
           this.toolSpans.set(record.toolCallId, span);
@@ -18487,7 +18507,7 @@ var SessionEmitter = class {
         const span = record.toolCallId ? this.toolSpans.get(record.toolCallId) : void 0;
         if (span) {
           span.end({
-            output: record.output,
+            output: capPayload(record.output),
             endTime: record.ts,
             ...record.isError ? { level: "ERROR" } : {},
             ...record.errorKind !== void 0 ? { statusMessage: record.errorKind } : {}
@@ -18501,7 +18521,7 @@ var SessionEmitter = class {
         this.endGeneration();
         this.seeded(["compaction", record.uuid], () => owner.span("compaction", {
           startTime: record.ts,
-          ...record.text ? { output: record.text } : {}
+          ...record.text ? { output: capPayload(record.text) } : {}
         })).end({ endTime: record.ts });
         break;
       case "permission_grant": {
@@ -18563,7 +18583,7 @@ var SessionEmitter = class {
         ...this.title !== void 0 ? { name: this.title } : {},
         // The pass's result. Paired with the `input` set when the trace opened, this is
         // what stops the consumer inferring the trace's I/O from a descendant.
-        ...this.lastAssistantText !== void 0 ? { output: this.lastAssistantText } : {}
+        ...this.lastAssistantText !== void 0 ? { output: capText(this.lastAssistantText) } : {}
       });
       this.trace.end();
       this.trace = void 0;
@@ -18646,7 +18666,7 @@ var SessionEmitter = class {
         // What the agent was asked. `TraceArgs.input` is construction-only — the SDK's
         // `update()` carries output alone — which is why `ingest` absorbs the user turn
         // before it calls this.
-        ...this.lastUserText ? { input: this.lastUserText } : {},
+        ...this.lastUserText ? { input: capText(this.lastUserText) } : {},
         tags: [this.options.vendor, ...this.options.agentId ? ["subagent"] : []],
         metadata: {
           ...this.meta,
@@ -18715,7 +18735,7 @@ var SessionEmitter = class {
   buildInputMessages() {
     const messages = [];
     if (this.lastUserText !== void 0) {
-      messages.push({ role: "user", content: this.lastUserText });
+      messages.push({ role: "user", content: capText(this.lastUserText) });
     }
     for (const result of this.pendingToolResults) {
       messages.push({ role: "tool", content: result });
@@ -18725,7 +18745,7 @@ var SessionEmitter = class {
   endGeneration() {
     if (!this.generation)
       return;
-    const output = this.outputText.join("\n");
+    const output = capText(this.outputText.join("\n"));
     if (output)
       this.lastAssistantText = output;
     this.generation.end({
@@ -18754,8 +18774,9 @@ function installSeededIdGenerator(client) {
 }
 
 // packages/core/dist/forwarder/checkpoint.js
-import { mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, renameSync as renameSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { copyFileSync, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, renameSync as renameSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join6 } from "node:path";
+var SPOOL_KEY = "::spool::";
 function checkpointPath(scope) {
   return join6(CONFIG_DIR, `${scope}.checkpoints.json`);
 }
@@ -18766,6 +18787,25 @@ function loadCheckpoints(scope) {
     return {};
   }
 }
+function laggingTranscripts(checkpoints, now = statSize) {
+  const paths = [];
+  for (const [path, checkpoint] of Object.entries(checkpoints)) {
+    if (path === SPOOL_KEY)
+      continue;
+    const size = now(path);
+    if (size === void 0 || size === checkpoint.offset)
+      continue;
+    paths.push(path);
+  }
+  return paths;
+}
+function statSize(path) {
+  try {
+    return statSync2(path).size;
+  } catch {
+    return void 0;
+  }
+}
 function orphanedScopes(vendor, scope) {
   const suffix = ".checkpoints.json";
   try {
@@ -18849,6 +18889,7 @@ function readNewLines(path, offset, maxBytes = DEFAULT_MAX_BYTES) {
 import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join7 } from "node:path";
 var STALE_MS = 5 * 60 * 1e3;
+var HEARTBEAT_MS = 60 * 1e3;
 function acquireLock(scope) {
   mkdirSync3(CONFIG_DIR, { recursive: true, mode: 448 });
   const path = join7(CONFIG_DIR, `${scope}.forwarder.lock`);
@@ -18870,7 +18911,17 @@ function acquireLock(scope) {
   } catch {
     return null;
   }
-  return () => rmSync(path, { force: true });
+  const beat = setInterval(() => {
+    try {
+      writeFileSync3(path, JSON.stringify({ pid: process.pid, ts: Date.now() }), { mode: 384 });
+    } catch {
+    }
+  }, HEARTBEAT_MS);
+  beat.unref();
+  return () => {
+    clearInterval(beat);
+    rmSync(path, { force: true });
+  };
 }
 function isAlive(pid, kill = (p, s) => {
   process.kill(p, s);
@@ -18971,6 +19022,65 @@ function saveHealth(scope, health) {
   }
 }
 
+// packages/core/dist/forwarder/pending.js
+import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join9 } from "node:path";
+var MAX_PENDING_PATHS = 256;
+function pendingPath(scope) {
+  return join9(CONFIG_DIR, `${scope}.pending.json`);
+}
+function loadPending(scope) {
+  try {
+    const backlog = JSON.parse(readFileSync6(pendingPath(scope), "utf8"));
+    if (!Array.isArray(backlog.paths))
+      return void 0;
+    return backlog;
+  } catch {
+    return void 0;
+  }
+}
+function pendingTranscripts(scope) {
+  const backlog = loadPending(scope);
+  if (!backlog)
+    return [];
+  return backlog.paths.filter((path) => {
+    try {
+      return existsSync3(path);
+    } catch {
+      return false;
+    }
+  });
+}
+function savePending(scope, paths, now = /* @__PURE__ */ new Date()) {
+  try {
+    const at = now.toISOString();
+    const previous = loadPending(scope);
+    const merged = [.../* @__PURE__ */ new Set([...previous?.paths ?? [], ...paths])];
+    const kept = merged.slice(Math.max(0, merged.length - MAX_PENDING_PATHS));
+    if (kept.length === 0)
+      return;
+    write(scope, { since: previous?.since ?? at, at, paths: kept });
+  } catch {
+  }
+}
+function clearPending(scope) {
+  try {
+    rmSync2(pendingPath(scope), { force: true });
+  } catch {
+  }
+}
+function write(scope, backlog) {
+  mkdirSync5(CONFIG_DIR, { recursive: true, mode: 448 });
+  const target = pendingPath(scope);
+  const tmp = `${target}.tmp`;
+  writeFileSync5(tmp, JSON.stringify(backlog), { mode: 384 });
+  renameSync4(tmp, target);
+}
+
+// packages/core/dist/forwarder/retry.js
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join10 } from "node:path";
+
 // packages/core/dist/forwarder/run.js
 import { readdirSync as readdirSync2, statSync as statSync4 } from "node:fs";
 
@@ -21694,7 +21804,6 @@ function toFloat(value, fallback) {
 }
 
 // packages/core/dist/forwarder/run.js
-var SPOOL_KEY = "::spool::";
 var DARKHUNT_SOURCE_HINT = "darkhunt-telemetry";
 function drainSpool(mapper, checkpoints) {
   const path = spoolPath(mapper.vendor);
@@ -21807,7 +21916,14 @@ async function runForwarder(mapper, options = {}) {
       }
     }
     const drain = options.paths ? { paths: options.paths } : drainSpool(mapper, checkpoints);
-    const named = options.paths ? drain.paths : [.../* @__PURE__ */ new Set([...drain.paths, ...liveTranscripts(loadBeat(config.scope))])];
+    const named = options.paths ? drain.paths : [
+      .../* @__PURE__ */ new Set([
+        ...drain.paths,
+        ...liveTranscripts(loadBeat(config.scope)),
+        ...pendingTranscripts(config.scope),
+        ...laggingTranscripts(checkpoints)
+      ])
+    ];
     const paths = [...new Set(named.flatMap((path) => [path, ...related(mapper, path)]))];
     if (paths.length === 0) {
       if (drain.checkpoint)
@@ -21904,13 +22020,16 @@ async function runForwarder(mapper, options = {}) {
     result.emitted = { transcripts: result.transcripts, records: result.records };
     if (watch.failures() > 0) {
       result.ok = false;
+      result.retryable = true;
       result.error = watch.reason() ?? "span export failed";
       result.transcripts = 0;
       result.records = 0;
+      savePending(config.scope, paths);
     } else {
       if (drain.checkpoint)
         staged[SPOOL_KEY] = drain.checkpoint;
       saveCheckpoints(config.scope, staged);
+      clearPending(config.scope);
     }
     const previous = loadHealth(config.scope);
     saveHealth(config.scope, {
@@ -21962,17 +22081,103 @@ function discoverTranscripts(mapper) {
   return found;
 }
 
+// packages/core/dist/forwarder/retry.js
+var RETRY_DELAYS_MS = [
+  3e4,
+  6e4,
+  12e4,
+  3e5,
+  6e5,
+  9e5,
+  18e5
+];
+var CLAIM_STALE_MS = 45 * 60 * 1e3;
+function retryClaimPath(scope) {
+  return join10(CONFIG_DIR, `${scope}.forwarder-retry.lock`);
+}
+function claimRetry(scope, now = Date.now()) {
+  const path = retryClaimPath(scope);
+  try {
+    mkdirSync6(CONFIG_DIR, { recursive: true, mode: 448 });
+    if (existsSync4(path)) {
+      try {
+        const held = JSON.parse(readFileSync7(path, "utf8"));
+        if (isAlive(held.pid) && now - held.ts < CLAIM_STALE_MS)
+          return null;
+      } catch {
+      }
+      rmSync3(path, { force: true });
+    }
+    const stamp = () => {
+      writeFileSync6(path, JSON.stringify({ pid: process.pid, ts: Date.now() }), { mode: 384 });
+    };
+    stamp();
+    return {
+      renew: () => {
+        try {
+          stamp();
+        } catch {
+        }
+      },
+      release: () => rmSync3(path, { force: true })
+    };
+  } catch {
+    return null;
+  }
+}
+function retriesEnabled() {
+  const flag = process.env["DARKHUNT_FORWARDER_RETRY"];
+  return flag !== "0" && flag !== "off" && flag !== "false";
+}
+function scopeOf(mapper, options) {
+  try {
+    return loadLocalConfig(mapper.vendor, options.profile !== void 0 ? { profile: options.profile } : {}).scope;
+  } catch {
+    return mapper.vendor;
+  }
+}
+async function runForwarderWithRetry(mapper, options = {}) {
+  const pass = options.pass ?? ((m, o) => runForwarder(m, o));
+  const sleep2 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const forwarding = {
+    ...options.paths !== void 0 ? { paths: options.paths } : {},
+    ...options.profile !== void 0 ? { profile: options.profile } : {}
+  };
+  let last = await pass(mapper, forwarding);
+  if (!last.retryable || !retriesEnabled())
+    return last;
+  const claim = claimRetry(scopeOf(mapper, options));
+  if (!claim)
+    return last;
+  try {
+    const delays = options.delaysMs ?? RETRY_DELAYS_MS;
+    for (const [index, delay] of delays.entries()) {
+      options.onRetry?.(last, index + 1, delay);
+      await sleep2(delay);
+      claim.renew();
+      last = await pass(mapper, forwarding);
+      if (last.lockBusy)
+        continue;
+      if (!last.retryable)
+        return last;
+    }
+    return last;
+  } finally {
+    claim.release();
+  }
+}
+
 // packages/core/dist/cli/status.js
 var SESSION_HOOK_STALE_MS = 30 * 60 * 1e3;
 
 // packages/core/dist/cli/enroll.js
 import { homedir as homedir3 } from "node:os";
-import { join as join9 } from "node:path";
-var CLI_CREDENTIALS_PATH = join9(homedir3(), ".darkhunt", "credentials.json");
+import { join as join11 } from "node:path";
+var CLI_CREDENTIALS_PATH = join11(homedir3(), ".darkhunt", "credentials.json");
 
 // adapters/codex/dist/transcript.js
-import { readFileSync as readFileSync6 } from "node:fs";
-import { basename, join as join10 } from "node:path";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { basename, join as join12 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function str(value) {
   return typeof value === "string" ? value : void 0;
@@ -22116,7 +22321,7 @@ function stripSuffix(path) {
 var codexTranscript = {
   vendor: "codex",
   sessionRoots() {
-    return [join10(homedir4(), ".codex", "sessions")];
+    return [join12(homedir4(), ".codex", "sessions")];
   },
   /**
    * `~/.codex/auth.json` -> the `email` claim of `tokens.id_token`.
@@ -22138,7 +22343,7 @@ var codexTranscript = {
    */
   resolveUserId() {
     try {
-      return emailFromAuth(readFileSync6(join10(homedir4(), ".codex", "auth.json"), "utf8"));
+      return emailFromAuth(readFileSync8(join12(homedir4(), ".codex", "auth.json"), "utf8"));
     } catch {
       return void 0;
     }
@@ -22350,7 +22555,7 @@ var codexTranscript = {
 
 // adapters/codex/bin/forwarder.mjs
 try {
-  await runForwarder(codexTranscript);
+  await runForwarderWithRetry(codexTranscript);
 } catch {
   process.exit(1);
 }

package/dist/bin/guard.mjs

@@ -228,13 +228,16 @@ function loadRuntimeSettings(vendor, options = {}) {
     profile,
     scope: scopeKey(vendor, profile),
     enabled: vendorFile.enabled ?? true,
-    capture: { enabled: vendorFile.capture?.enabled ?? true },
+    capture: resolveCapture(vendorFile.capture),
     enforce: {
       mode: vendorFile.enforce?.mode ?? "off",
       failClosed: vendorFile.enforce?.failClosed ?? true
     }
   };
 }
+function resolveCapture(capture) {
+  return { enabled: capture?.enabled ?? true, backfill: capture?.backfill ?? false };
+}
 function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
@@ -393,12 +396,16 @@ async function readStdin(stream) {
   return Buffer.concat(chunks).toString("utf8");
 }
 
+// packages/core/dist/emit/emitter.js
+var PAYLOAD_LIMIT = 128 * 1024;
+
 // packages/core/dist/forwarder/tail.js
 var DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
 var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var HEARTBEAT_MS = 60 * 1e3;
 var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
@@ -1327,6 +1334,9 @@ var VALIDATORS = Object.freeze({
 // node_modules/@darkhunt-security/telemetry/dist/client.js
 var LIB_VERSION = package_default.version;
 
+// packages/core/dist/forwarder/retry.js
+var CLAIM_STALE_MS = 45 * 60 * 1e3;
+
 // packages/core/dist/cli/status.js
 var SESSION_HOOK_STALE_MS = 30 * 60 * 1e3;
 

package/dist/bin/init.mjs

@@ -52,12 +52,16 @@ var SPOOL_DIR = join4(CONFIG_DIR, "spool");
 // packages/core/dist/runtime/beat.js
 var BEAT_LIVE_MS = 30 * 60 * 1e3;
 
+// packages/core/dist/emit/emitter.js
+var PAYLOAD_LIMIT = 128 * 1024;
+
 // packages/core/dist/forwarder/tail.js
 var DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
 var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var HEARTBEAT_MS = 60 * 1e3;
 var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
@@ -986,6 +990,9 @@ var VALIDATORS = Object.freeze({
 // node_modules/@darkhunt-security/telemetry/dist/client.js
 var LIB_VERSION = package_default.version;
 
+// packages/core/dist/forwarder/retry.js
+var CLAIM_STALE_MS = 45 * 60 * 1e3;
+
 // packages/core/dist/cli/init.js
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 function init(argv) {
@@ -1025,7 +1032,11 @@ function init(argv) {
     // a named profile resolve without the flag on every later run.
     ...separateFile ? { profile, credentials: credsPath, ...stripCredentials(existingConfig) } : credentials,
     enabled: existingConfig["enabled"] ?? true,
-    capture: existingConfig["capture"] ?? { enabled: true },
+    // Written explicitly rather than left to the default: `backfill: false` is the one
+    // setting someone is likely to go looking for, and a key that is not in the file is
+    // not findable. An existing block is preserved untouched, so this never flips a
+    // machine that had already opted in.
+    capture: existingConfig["capture"] ?? { enabled: true, backfill: false },
     // Enforcement stays off until the mapper is validated — capture only for now.
     enforce: existingConfig["enforce"] ?? { mode: "off", failClosed: true },
     // Whatever another endpoint wrote is preserved: one file, several endpoints, and

package/dist/bin/spool.mjs

@@ -74,13 +74,16 @@ function loadRuntimeSettings(vendor, options = {}) {
     profile,
     scope: scopeKey(vendor, profile),
     enabled: vendorFile.enabled ?? true,
-    capture: { enabled: vendorFile.capture?.enabled ?? true },
+    capture: resolveCapture(vendorFile.capture),
     enforce: {
       mode: vendorFile.enforce?.mode ?? "off",
       failClosed: vendorFile.enforce?.failClosed ?? true
     }
   };
 }
+function resolveCapture(capture) {
+  return { enabled: capture?.enabled ?? true, backfill: capture?.backfill ?? false };
+}
 function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
@@ -195,12 +198,16 @@ async function readStdin(stream) {
   return Buffer.concat(chunks).toString("utf8");
 }
 
+// packages/core/dist/emit/emitter.js
+var PAYLOAD_LIMIT = 128 * 1024;
+
 // packages/core/dist/forwarder/tail.js
 var DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
 var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var HEARTBEAT_MS = 60 * 1e3;
 var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // node_modules/@darkhunt-security/telemetry/package.json
@@ -1129,6 +1136,9 @@ var VALIDATORS = Object.freeze({
 // node_modules/@darkhunt-security/telemetry/dist/client.js
 var LIB_VERSION = package_default.version;
 
+// packages/core/dist/forwarder/retry.js
+var CLAIM_STALE_MS = 45 * 60 * 1e3;
+
 // packages/core/dist/cli/status.js
 var SESSION_HOOK_STALE_MS = 30 * 60 * 1e3;