@darkhunt-security/endpoint-codex 0.9.6 → 0.9.7

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -18489,6 +18489,21 @@ var SessionEmitter = class {
   agentType() {
     return this.options.agentType ?? this.meta["agentType"];
   }
+  /**
+   * The agent that spawned this one.
+   *
+   * Claude Code names it outright, from a sidecar the host writes, and it arrives as an
+   * option. Codex never says "parent agent" — but it does not need to: a Codex subagent
+   * is a rollout of its own, so its agent id IS its thread id, and `parent_thread_id`
+   * (carried here as `parentSessionId`) therefore names the parent agent exactly.
+   *
+   * At depth 1 that thread is the session rather than a subagent, so the id names a node
+   * the consumer has as a session and not as an agent. That is the consumer's fallback to
+   * resolve; reporting what the producer actually observed is this side's job.
+   */
+  parentAgentId() {
+    return this.options.parentAgentId ?? this.meta["parentSessionId"];
+  }
   defaultTraceName() {
     const agentType = this.agentType();
     if (agentType)
@@ -18516,7 +18531,9 @@ var SessionEmitter = class {
           // agent out of a span already look for the snake_case names other producers
           // send. A camelCase key arrives intact and is never found.
           ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
-          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {}
+          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {},
+          ...this.parentAgentId() !== void 0 ? { parent_agent_id: this.parentAgentId() } : {},
+          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {}
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},
@@ -21669,6 +21686,8 @@ async function runForwarder(mapper, options = {}) {
             passKey: String(from),
             ...sub?.agentId !== void 0 ? { agentId: sub.agentId } : {},
             ...sub?.agentType !== void 0 ? { agentType: sub.agentType } : {},
+            ...sub?.parentAgentId !== void 0 ? { parentAgentId: sub.parentAgentId } : {},
+            ...sub?.spawnDepth !== void 0 ? { spawnDepth: sub.spawnDepth } : {},
             ...ids !== void 0 ? { ids } : {},
             ...userId !== void 0 ? { userId } : {},
             ...carried !== void 0 ? { resumeTurn: carried } : {}

package/dist/bin/forwarder.mjs

@@ -18489,6 +18489,21 @@ var SessionEmitter = class {
   agentType() {
     return this.options.agentType ?? this.meta["agentType"];
   }
+  /**
+   * The agent that spawned this one.
+   *
+   * Claude Code names it outright, from a sidecar the host writes, and it arrives as an
+   * option. Codex never says "parent agent" — but it does not need to: a Codex subagent
+   * is a rollout of its own, so its agent id IS its thread id, and `parent_thread_id`
+   * (carried here as `parentSessionId`) therefore names the parent agent exactly.
+   *
+   * At depth 1 that thread is the session rather than a subagent, so the id names a node
+   * the consumer has as a session and not as an agent. That is the consumer's fallback to
+   * resolve; reporting what the producer actually observed is this side's job.
+   */
+  parentAgentId() {
+    return this.options.parentAgentId ?? this.meta["parentSessionId"];
+  }
   defaultTraceName() {
     const agentType = this.agentType();
     if (agentType)
@@ -18516,7 +18531,9 @@ var SessionEmitter = class {
           // agent out of a span already look for the snake_case names other producers
           // send. A camelCase key arrives intact and is never found.
           ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
-          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {}
+          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {},
+          ...this.parentAgentId() !== void 0 ? { parent_agent_id: this.parentAgentId() } : {},
+          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {}
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},
@@ -21669,6 +21686,8 @@ async function runForwarder(mapper, options = {}) {
             passKey: String(from),
             ...sub?.agentId !== void 0 ? { agentId: sub.agentId } : {},
             ...sub?.agentType !== void 0 ? { agentType: sub.agentType } : {},
+            ...sub?.parentAgentId !== void 0 ? { parentAgentId: sub.parentAgentId } : {},
+            ...sub?.spawnDepth !== void 0 ? { spawnDepth: sub.spawnDepth } : {},
             ...ids !== void 0 ? { ids } : {},
             ...userId !== void 0 ? { userId } : {},
             ...carried !== void 0 ? { resumeTurn: carried } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.6",
+  "version": "0.9.7",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {