@darkhunt-security/endpoint-codex 0.9.16 → 0.9.18

package/dist/bin/status.mjs

@@ -3,8 +3,8 @@ import { createRequire as __dhCreateRequire } from 'node:module';
 const require = __dhCreateRequire(import.meta.url);
 
 // adapters/codex/bin/status.mjs
-import { readFileSync as readFileSync8 } from "node:fs";
-import { dirname, join as join12 } from "node:path";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { dirname, join as join13 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // packages/core/dist/config/local.js
@@ -87,6 +87,9 @@ function settingsFor(file, vendor) {
     ...file.enforce ?? override.enforce ? { enforce: { ...file.enforce, ...override.enforce } } : {}
   };
 }
+function resolveCapture(capture) {
+  return { enabled: capture?.enabled ?? true, backfill: capture?.backfill ?? false };
+}
 function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
@@ -139,7 +142,7 @@ function loadLocalConfig(vendor, options = {}) {
     applicationId,
     ...(creds.userId ?? vendorFile.userId) !== void 0 ? { userId: creds.userId ?? vendorFile.userId } : {},
     enabled: vendorFile.enabled ?? true,
-    capture: { enabled: vendorFile.capture?.enabled ?? true },
+    capture: resolveCapture(vendorFile.capture),
     enforce: {
       mode: vendorFile.enforce?.mode ?? "off",
       failClosed: vendorFile.enforce?.failClosed ?? true
@@ -170,8 +173,11 @@ function loadBeat(scope) {
   }
 }
 
+// packages/core/dist/emit/emitter.js
+var PAYLOAD_LIMIT = 128 * 1024;
+
 // packages/core/dist/forwarder/checkpoint.js
-import { mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, renameSync as renameSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { copyFileSync, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, renameSync as renameSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join6 } from "node:path";
 function checkpointPath(scope) {
   return join6(CONFIG_DIR, `${scope}.checkpoints.json`);
@@ -190,6 +196,7 @@ var LINE_CEILING = 64 * 1024 * 1024;
 
 // packages/core/dist/forwarder/lock.js
 var STALE_MS = 5 * 60 * 1e3;
+var HEARTBEAT_MS = 60 * 1e3;
 var DEFAULT_LOCK_WAIT_MS = 60 * 1e3;
 
 // packages/core/dist/forwarder/health.js
@@ -206,6 +213,35 @@ function loadHealth(scope) {
   }
 }
 
+// packages/core/dist/forwarder/pending.js
+import { existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync4, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join8 } from "node:path";
+function pendingPath(scope) {
+  return join8(CONFIG_DIR, `${scope}.pending.json`);
+}
+function loadPending(scope) {
+  try {
+    const backlog = JSON.parse(readFileSync5(pendingPath(scope), "utf8"));
+    if (!Array.isArray(backlog.paths))
+      return void 0;
+    return backlog;
+  } catch {
+    return void 0;
+  }
+}
+function pendingTranscripts(scope) {
+  const backlog = loadPending(scope);
+  if (!backlog)
+    return [];
+  return backlog.paths.filter((path) => {
+    try {
+      return existsSync2(path);
+    } catch {
+      return false;
+    }
+  });
+}
+
 // node_modules/@darkhunt-security/telemetry/package.json
 var package_default = {
   name: "@darkhunt-security/telemetry",
@@ -1132,9 +1168,12 @@ var VALIDATORS = Object.freeze({
 // node_modules/@darkhunt-security/telemetry/dist/client.js
 var LIB_VERSION = package_default.version;
 
+// packages/core/dist/forwarder/retry.js
+var CLAIM_STALE_MS = 45 * 60 * 1e3;
+
 // packages/core/dist/cli/status.js
-import { existsSync as existsSync2, readFileSync as readFileSync5, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { join as join9 } from "node:path";
 var SESSION_HOOK_STALE_MS = 30 * 60 * 1e3;
 function countSubagents(mapper, checkpoints) {
   if (!mapper?.subagentOf || !mapper.sessionRoots)
@@ -1149,7 +1188,7 @@ function countSubagents(mapper, checkpoints) {
       return;
     }
     for (const entry of entries) {
-      const full = join8(dir, entry.name);
+      const full = join9(dir, entry.name);
       if (entry.isDirectory()) {
         walk(full);
         continue;
@@ -1174,16 +1213,19 @@ function status(vendor, mapper) {
   for (const [path, cp] of Object.entries(checkpoints)) {
     if (path === "::spool::")
       continue;
-    const size = existsSync2(path) ? statSync3(path).size : 0;
+    const size = existsSync3(path) ? statSync3(path).size : 0;
     transcripts.push({ path, shipped: cp.offset, size, lag: Math.max(0, size - cp.offset) });
   }
   const subagents = countSubagents(mapper, checkpoints);
   const lastPass = loadHealth(config.scope);
+  const backlog = loadPending(config.scope);
+  const heldTranscripts = pendingTranscripts(config.scope).length;
+  const pending = backlog && heldTranscripts > 0 ? { transcripts: heldTranscripts, since: backlog.since, at: backlog.at } : void 0;
   const spool = spoolPath(vendor);
   let spoolEvents = 0;
   let spoolLastAt;
-  if (existsSync2(spool)) {
-    const lines = readFileSync5(spool, "utf8").split("\n").filter(Boolean);
+  if (existsSync3(spool)) {
+    const lines = readFileSync6(spool, "utf8").split("\n").filter(Boolean);
     spoolEvents = lines.length;
     const last = lines[lines.length - 1];
     if (last) {
@@ -1208,6 +1250,9 @@ function status(vendor, mapper) {
     workspaceId: config.workspaceId,
     scope: config.scope,
     capture: config.capture.enabled && config.enabled,
+    // Each switch above it can also stop an import, so all three have to agree before
+    // this may claim a backfill would run.
+    backfill: config.capture.backfill && config.capture.enabled && config.enabled,
     enforce: config.enabled ? config.enforce.mode : "off (kill switch)",
     spoolEvents,
     ...spoolLastAt !== void 0 ? { spoolLastAt } : {},
@@ -1218,19 +1263,20 @@ function status(vendor, mapper) {
     transcripts,
     totalLag: transcripts.reduce((sum, t) => sum + t.lag, 0),
     ...lastPass !== void 0 ? { lastPass } : {},
+    ...pending !== void 0 ? { pending } : {},
     ...subagents !== void 0 ? { subagents } : {},
-    lockHeld: existsSync2(spool.replace(/spool\/.*$/, `${config.scope}.forwarder.lock`))
+    lockHeld: existsSync3(spool.replace(/spool\/.*$/, `${config.scope}.forwarder.lock`))
   };
 }
 
 // packages/core/dist/cli/enroll.js
 import { homedir as homedir3 } from "node:os";
-import { join as join9 } from "node:path";
-var CLI_CREDENTIALS_PATH = join9(homedir3(), ".darkhunt", "credentials.json");
+import { join as join10 } from "node:path";
+var CLI_CREDENTIALS_PATH = join10(homedir3(), ".darkhunt", "credentials.json");
 
 // adapters/codex/dist/transcript.js
-import { readFileSync as readFileSync6 } from "node:fs";
-import { basename, join as join10 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { basename, join as join11 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function str(value) {
   return typeof value === "string" ? value : void 0;
@@ -1374,7 +1420,7 @@ function stripSuffix(path) {
 var codexTranscript = {
   vendor: "codex",
   sessionRoots() {
-    return [join10(homedir4(), ".codex", "sessions")];
+    return [join11(homedir4(), ".codex", "sessions")];
   },
   /**
    * `~/.codex/auth.json` -> the `email` claim of `tokens.id_token`.
@@ -1396,7 +1442,7 @@ var codexTranscript = {
    */
   resolveUserId() {
     try {
-      return emailFromAuth(readFileSync6(join10(homedir4(), ".codex", "auth.json"), "utf8"));
+      return emailFromAuth(readFileSync7(join11(homedir4(), ".codex", "auth.json"), "utf8"));
     } catch {
       return void 0;
     }
@@ -1607,14 +1653,14 @@ var codexTranscript = {
 };
 
 // adapters/codex/bin/lib/launchers.mjs
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var LAUNCHERS = {
   "darkhunt-codex-spool": "spool.mjs",
   "darkhunt-codex-guard": "guard.mjs"
 };
-var BIN_DIR = join11(homedir5(), ".local", "bin");
+var BIN_DIR = join12(homedir5(), ".local", "bin");
 var script = (target) => `#!/bin/sh
 # Installed by darkhunt endpoint-plugins. Resolves the newest installed
 # plugin version at run time; do not hard-code a version here.
@@ -1626,14 +1672,14 @@ function launcherState(binDir = BIN_DIR, path = process.env["PATH"] ?? "") {
   const missing = [];
   const stale = [];
   for (const [name, target] of Object.entries(LAUNCHERS)) {
-    const file = join11(binDir, name);
-    if (!existsSync3(file)) {
+    const file = join12(binDir, name);
+    if (!existsSync4(file)) {
       missing.push(name);
       continue;
     }
     let body = "";
     try {
-      body = readFileSync7(file, "utf8");
+      body = readFileSync8(file, "utf8");
     } catch {
     }
     if (body !== script(target)) stale.push(name);
@@ -1668,10 +1714,10 @@ try {
   const s = status("codex", codexTranscript);
   const n = (x) => x.toLocaleString();
   console.log(`darkhunt endpoint status \u2014 codex`);
-  const root = join12(dirname(fileURLToPath(import.meta.url)), "..", "..");
+  const root = join13(dirname(fileURLToPath(import.meta.url)), "..", "..");
   let installed = "unknown";
   try {
-    installed = JSON.parse(readFileSync8(join12(root, "package.json"), "utf8")).version;
+    installed = JSON.parse(readFileSync9(join13(root, "package.json"), "utf8")).version;
   } catch {
   }
   console.log(`  plugin       ${installed}   ${root}`);
@@ -1680,7 +1726,9 @@ try {
   console.log(
     `  user         ${s.userId ?? "(none \u2014 traces are unattributed)"}` + (s.userIdSource === "none" ? "" : `  [from ${s.userIdSource}]`)
   );
-  console.log(`  capture      ${s.capture ? "ON" : "OFF"}      enforce ${s.enforce}`);
+  console.log(
+    `  capture      ${s.capture ? "ON" : "OFF"}      enforce ${s.enforce}      backfill ${s.backfill ? "ON" : "OFF"}`
+  );
   if (s.subagents && s.subagents.found > 0) {
     const { found, shipped } = s.subagents;
     console.log(
@@ -1717,6 +1765,11 @@ try {
       );
     }
   }
+  if (s.pending) {
+    console.log(
+      `  held         ${s.pending.transcripts} transcript(s) waiting on the platform  since ${s.pending.since}`
+    );
+  }
   if (s.transcripts.length === 0) {
     console.log("  transcripts  none shipped yet");
   } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.16",
+  "version": "0.9.18",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {
@@ -14,7 +14,7 @@
   ],
   "devDependencies": {
     "@darkhunt-security/endpoint-contracts": "0.9.3",
-    "@darkhunt-security/endpoint-core": "0.9.3"
+    "@darkhunt-security/endpoint-core": "0.9.4"
   },
   "publishConfig": {
     "access": "public",