@darkhunt-security/endpoint-codex 0.9.4 → 0.9.6

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -18371,7 +18371,7 @@ var SessionEmitter = class {
     const root = this.ensureTrace(record.ts);
     const parentTrace = record.parentUuid ? this.owners.get(record.parentUuid) : void 0;
     let owner = parentTrace ?? root;
-    if (record.isSidechain && owner === root) {
+    if (record.isSidechain && owner === root && this.options.agentId === void 0) {
       owner = this.seeded(["subagent", record.uuid], () => this.client.trace({
         name: "subagent",
         sessionId: this.options.sessionId,
@@ -18474,8 +18474,23 @@ var SessionEmitter = class {
     }
     await this.client.flush();
   }
+  /**
+   * Which subagent this transcript is, if any.
+   *
+   * From the path where the endpoint's layout says so, and otherwise from the file:
+   * Codex names only the parent, so the subagent is identified by the thread the
+   * transcript itself is — `seedKey`, which is exactly that.
+   */
+  agentId() {
+    if (this.options.agentId !== void 0)
+      return this.options.agentId;
+    return this.grouping ? this.options.seedKey ?? this.options.sessionId : void 0;
+  }
+  agentType() {
+    return this.options.agentType ?? this.meta["agentType"];
+  }
   defaultTraceName() {
-    const agentType = this.options.agentType ?? this.meta["agentType"];
+    const agentType = this.agentType();
     if (agentType)
       return `subagent: ${agentType}`;
     if (this.options.agentId === void 0) {
@@ -18496,8 +18511,12 @@ var SessionEmitter = class {
         tags: [this.options.vendor, ...this.options.agentId ? ["subagent"] : []],
         metadata: {
           ...this.meta,
-          ...this.options.agentId !== void 0 ? { agentId: this.options.agentId } : {},
-          ...this.options.agentType !== void 0 ? { agentType: this.options.agentType } : {}
+          // `agent_id` / `agent_type`, not camelCase: trace-hub lifts each metadata
+          // attribute onto the span under its own key, and the consumers that read an
+          // agent out of a span already look for the snake_case names other producers
+          // send. A camelCase key arrives intact and is never found.
+          ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
+          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {}
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},

package/dist/bin/forwarder.mjs

@@ -18371,7 +18371,7 @@ var SessionEmitter = class {
     const root = this.ensureTrace(record.ts);
     const parentTrace = record.parentUuid ? this.owners.get(record.parentUuid) : void 0;
     let owner = parentTrace ?? root;
-    if (record.isSidechain && owner === root) {
+    if (record.isSidechain && owner === root && this.options.agentId === void 0) {
       owner = this.seeded(["subagent", record.uuid], () => this.client.trace({
         name: "subagent",
         sessionId: this.options.sessionId,
@@ -18474,8 +18474,23 @@ var SessionEmitter = class {
     }
     await this.client.flush();
   }
+  /**
+   * Which subagent this transcript is, if any.
+   *
+   * From the path where the endpoint's layout says so, and otherwise from the file:
+   * Codex names only the parent, so the subagent is identified by the thread the
+   * transcript itself is — `seedKey`, which is exactly that.
+   */
+  agentId() {
+    if (this.options.agentId !== void 0)
+      return this.options.agentId;
+    return this.grouping ? this.options.seedKey ?? this.options.sessionId : void 0;
+  }
+  agentType() {
+    return this.options.agentType ?? this.meta["agentType"];
+  }
   defaultTraceName() {
-    const agentType = this.options.agentType ?? this.meta["agentType"];
+    const agentType = this.agentType();
     if (agentType)
       return `subagent: ${agentType}`;
     if (this.options.agentId === void 0) {
@@ -18496,8 +18511,12 @@ var SessionEmitter = class {
         tags: [this.options.vendor, ...this.options.agentId ? ["subagent"] : []],
         metadata: {
           ...this.meta,
-          ...this.options.agentId !== void 0 ? { agentId: this.options.agentId } : {},
-          ...this.options.agentType !== void 0 ? { agentType: this.options.agentType } : {}
+          // `agent_id` / `agent_type`, not camelCase: trace-hub lifts each metadata
+          // attribute onto the span under its own key, and the consumers that read an
+          // agent out of a span already look for the snake_case names other producers
+          // send. A camelCase key arrives intact and is never found.
+          ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
+          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {}
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {