@darkhunt-security/endpoint-codex 0.9.5 → 0.9.7

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -18474,8 +18474,38 @@ var SessionEmitter = class {
     }
     await this.client.flush();
   }
+  /**
+   * Which subagent this transcript is, if any.
+   *
+   * From the path where the endpoint's layout says so, and otherwise from the file:
+   * Codex names only the parent, so the subagent is identified by the thread the
+   * transcript itself is — `seedKey`, which is exactly that.
+   */
+  agentId() {
+    if (this.options.agentId !== void 0)
+      return this.options.agentId;
+    return this.grouping ? this.options.seedKey ?? this.options.sessionId : void 0;
+  }
+  agentType() {
+    return this.options.agentType ?? this.meta["agentType"];
+  }
+  /**
+   * The agent that spawned this one.
+   *
+   * Claude Code names it outright, from a sidecar the host writes, and it arrives as an
+   * option. Codex never says "parent agent" — but it does not need to: a Codex subagent
+   * is a rollout of its own, so its agent id IS its thread id, and `parent_thread_id`
+   * (carried here as `parentSessionId`) therefore names the parent agent exactly.
+   *
+   * At depth 1 that thread is the session rather than a subagent, so the id names a node
+   * the consumer has as a session and not as an agent. That is the consumer's fallback to
+   * resolve; reporting what the producer actually observed is this side's job.
+   */
+  parentAgentId() {
+    return this.options.parentAgentId ?? this.meta["parentSessionId"];
+  }
   defaultTraceName() {
-    const agentType = this.options.agentType ?? this.meta["agentType"];
+    const agentType = this.agentType();
     if (agentType)
       return `subagent: ${agentType}`;
     if (this.options.agentId === void 0) {
@@ -18496,8 +18526,14 @@ var SessionEmitter = class {
         tags: [this.options.vendor, ...this.options.agentId ? ["subagent"] : []],
         metadata: {
           ...this.meta,
-          ...this.options.agentId !== void 0 ? { agentId: this.options.agentId } : {},
-          ...this.options.agentType !== void 0 ? { agentType: this.options.agentType } : {}
+          // `agent_id` / `agent_type`, not camelCase: trace-hub lifts each metadata
+          // attribute onto the span under its own key, and the consumers that read an
+          // agent out of a span already look for the snake_case names other producers
+          // send. A camelCase key arrives intact and is never found.
+          ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
+          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {},
+          ...this.parentAgentId() !== void 0 ? { parent_agent_id: this.parentAgentId() } : {},
+          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {}
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},
@@ -21650,6 +21686,8 @@ async function runForwarder(mapper, options = {}) {
             passKey: String(from),
             ...sub?.agentId !== void 0 ? { agentId: sub.agentId } : {},
             ...sub?.agentType !== void 0 ? { agentType: sub.agentType } : {},
+            ...sub?.parentAgentId !== void 0 ? { parentAgentId: sub.parentAgentId } : {},
+            ...sub?.spawnDepth !== void 0 ? { spawnDepth: sub.spawnDepth } : {},
             ...ids !== void 0 ? { ids } : {},
             ...userId !== void 0 ? { userId } : {},
             ...carried !== void 0 ? { resumeTurn: carried } : {}

package/dist/bin/forwarder.mjs

@@ -18474,8 +18474,38 @@ var SessionEmitter = class {
     }
     await this.client.flush();
   }
+  /**
+   * Which subagent this transcript is, if any.
+   *
+   * From the path where the endpoint's layout says so, and otherwise from the file:
+   * Codex names only the parent, so the subagent is identified by the thread the
+   * transcript itself is — `seedKey`, which is exactly that.
+   */
+  agentId() {
+    if (this.options.agentId !== void 0)
+      return this.options.agentId;
+    return this.grouping ? this.options.seedKey ?? this.options.sessionId : void 0;
+  }
+  agentType() {
+    return this.options.agentType ?? this.meta["agentType"];
+  }
+  /**
+   * The agent that spawned this one.
+   *
+   * Claude Code names it outright, from a sidecar the host writes, and it arrives as an
+   * option. Codex never says "parent agent" — but it does not need to: a Codex subagent
+   * is a rollout of its own, so its agent id IS its thread id, and `parent_thread_id`
+   * (carried here as `parentSessionId`) therefore names the parent agent exactly.
+   *
+   * At depth 1 that thread is the session rather than a subagent, so the id names a node
+   * the consumer has as a session and not as an agent. That is the consumer's fallback to
+   * resolve; reporting what the producer actually observed is this side's job.
+   */
+  parentAgentId() {
+    return this.options.parentAgentId ?? this.meta["parentSessionId"];
+  }
   defaultTraceName() {
-    const agentType = this.options.agentType ?? this.meta["agentType"];
+    const agentType = this.agentType();
     if (agentType)
       return `subagent: ${agentType}`;
     if (this.options.agentId === void 0) {
@@ -18496,8 +18526,14 @@ var SessionEmitter = class {
         tags: [this.options.vendor, ...this.options.agentId ? ["subagent"] : []],
         metadata: {
           ...this.meta,
-          ...this.options.agentId !== void 0 ? { agentId: this.options.agentId } : {},
-          ...this.options.agentType !== void 0 ? { agentType: this.options.agentType } : {}
+          // `agent_id` / `agent_type`, not camelCase: trace-hub lifts each metadata
+          // attribute onto the span under its own key, and the consumers that read an
+          // agent out of a span already look for the snake_case names other producers
+          // send. A camelCase key arrives intact and is never found.
+          ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
+          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {},
+          ...this.parentAgentId() !== void 0 ? { parent_agent_id: this.parentAgentId() } : {},
+          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {}
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},
@@ -21650,6 +21686,8 @@ async function runForwarder(mapper, options = {}) {
             passKey: String(from),
             ...sub?.agentId !== void 0 ? { agentId: sub.agentId } : {},
             ...sub?.agentType !== void 0 ? { agentType: sub.agentType } : {},
+            ...sub?.parentAgentId !== void 0 ? { parentAgentId: sub.parentAgentId } : {},
+            ...sub?.spawnDepth !== void 0 ? { spawnDepth: sub.spawnDepth } : {},
             ...ids !== void 0 ? { ids } : {},
             ...userId !== void 0 ? { userId } : {},
             ...carried !== void 0 ? { resumeTurn: carried } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {