@darkhunt-security/endpoint-codex 0.9.6 → 0.9.8

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -18135,6 +18135,11 @@ function readSecure(path) {
     throw new ConfigError(`${path} is mode ${mode.toString(8)}; must be 0600`);
   return readFileSync(path, "utf8");
 }
+function isBlank(path) {
+  if (statSync(path).size === 0)
+    return true;
+  return readFileSync(path, "utf8").trim() === "";
+}
 function readJson(path) {
   try {
     return JSON.parse(readSecure(path));
@@ -18159,6 +18164,9 @@ function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
   }
+  if (isBlank(configPath())) {
+    throw new ConfigMissingError(`${configPath()} is empty \u2014 run init.mjs to create it`);
+  }
   const file = readJson(configPath());
   if (!file) {
     throw new ConfigError(`cannot read ${configPath()} \u2014 it exists but did not parse`);
@@ -18489,6 +18497,21 @@ var SessionEmitter = class {
   agentType() {
     return this.options.agentType ?? this.meta["agentType"];
   }
+  /**
+   * The agent that spawned this one.
+   *
+   * Claude Code names it outright, from a sidecar the host writes, and it arrives as an
+   * option. Codex never says "parent agent" — but it does not need to: a Codex subagent
+   * is a rollout of its own, so its agent id IS its thread id, and `parent_thread_id`
+   * (carried here as `parentSessionId`) therefore names the parent agent exactly.
+   *
+   * At depth 1 that thread is the session rather than a subagent, so the id names a node
+   * the consumer has as a session and not as an agent. That is the consumer's fallback to
+   * resolve; reporting what the producer actually observed is this side's job.
+   */
+  parentAgentId() {
+    return this.options.parentAgentId ?? this.meta["parentSessionId"];
+  }
   defaultTraceName() {
     const agentType = this.agentType();
     if (agentType)
@@ -18516,7 +18539,9 @@ var SessionEmitter = class {
           // agent out of a span already look for the snake_case names other producers
           // send. A camelCase key arrives intact and is never found.
           ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
-          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {}
+          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {},
+          ...this.parentAgentId() !== void 0 ? { parent_agent_id: this.parentAgentId() } : {},
+          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {}
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},
@@ -21669,6 +21694,8 @@ async function runForwarder(mapper, options = {}) {
             passKey: String(from),
             ...sub?.agentId !== void 0 ? { agentId: sub.agentId } : {},
             ...sub?.agentType !== void 0 ? { agentType: sub.agentType } : {},
+            ...sub?.parentAgentId !== void 0 ? { parentAgentId: sub.parentAgentId } : {},
+            ...sub?.spawnDepth !== void 0 ? { spawnDepth: sub.spawnDepth } : {},
             ...ids !== void 0 ? { ids } : {},
             ...userId !== void 0 ? { userId } : {},
             ...carried !== void 0 ? { resumeTurn: carried } : {}

package/dist/bin/forwarder.mjs

@@ -18135,6 +18135,11 @@ function readSecure(path) {
     throw new ConfigError(`${path} is mode ${mode.toString(8)}; must be 0600`);
   return readFileSync(path, "utf8");
 }
+function isBlank(path) {
+  if (statSync(path).size === 0)
+    return true;
+  return readFileSync(path, "utf8").trim() === "";
+}
 function readJson(path) {
   try {
     return JSON.parse(readSecure(path));
@@ -18159,6 +18164,9 @@ function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
   }
+  if (isBlank(configPath())) {
+    throw new ConfigMissingError(`${configPath()} is empty \u2014 run init.mjs to create it`);
+  }
   const file = readJson(configPath());
   if (!file) {
     throw new ConfigError(`cannot read ${configPath()} \u2014 it exists but did not parse`);
@@ -18489,6 +18497,21 @@ var SessionEmitter = class {
   agentType() {
     return this.options.agentType ?? this.meta["agentType"];
   }
+  /**
+   * The agent that spawned this one.
+   *
+   * Claude Code names it outright, from a sidecar the host writes, and it arrives as an
+   * option. Codex never says "parent agent" — but it does not need to: a Codex subagent
+   * is a rollout of its own, so its agent id IS its thread id, and `parent_thread_id`
+   * (carried here as `parentSessionId`) therefore names the parent agent exactly.
+   *
+   * At depth 1 that thread is the session rather than a subagent, so the id names a node
+   * the consumer has as a session and not as an agent. That is the consumer's fallback to
+   * resolve; reporting what the producer actually observed is this side's job.
+   */
+  parentAgentId() {
+    return this.options.parentAgentId ?? this.meta["parentSessionId"];
+  }
   defaultTraceName() {
     const agentType = this.agentType();
     if (agentType)
@@ -18516,7 +18539,9 @@ var SessionEmitter = class {
           // agent out of a span already look for the snake_case names other producers
           // send. A camelCase key arrives intact and is never found.
           ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
-          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {}
+          ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {},
+          ...this.parentAgentId() !== void 0 ? { parent_agent_id: this.parentAgentId() } : {},
+          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {}
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},
@@ -21669,6 +21694,8 @@ async function runForwarder(mapper, options = {}) {
             passKey: String(from),
             ...sub?.agentId !== void 0 ? { agentId: sub.agentId } : {},
             ...sub?.agentType !== void 0 ? { agentType: sub.agentType } : {},
+            ...sub?.parentAgentId !== void 0 ? { parentAgentId: sub.parentAgentId } : {},
+            ...sub?.spawnDepth !== void 0 ? { spawnDepth: sub.spawnDepth } : {},
             ...ids !== void 0 ? { ids } : {},
             ...userId !== void 0 ? { userId } : {},
             ...carried !== void 0 ? { resumeTurn: carried } : {}

package/dist/bin/guard.mjs

@@ -196,6 +196,11 @@ function readSecure(path) {
     throw new ConfigError(`${path} is mode ${mode.toString(8)}; must be 0600`);
   return readFileSync(path, "utf8");
 }
+function isBlank(path) {
+  if (statSync(path).size === 0)
+    return true;
+  return readFileSync(path, "utf8").trim() === "";
+}
 function readJson(path) {
   try {
     return JSON.parse(readSecure(path));
@@ -234,6 +239,9 @@ function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
   }
+  if (isBlank(configPath())) {
+    throw new ConfigMissingError(`${configPath()} is empty \u2014 run init.mjs to create it`);
+  }
   const file = readJson(configPath());
   if (!file) {
     throw new ConfigError(`cannot read ${configPath()} \u2014 it exists but did not parse`);

package/dist/bin/spool.mjs

@@ -42,6 +42,11 @@ function readSecure(path) {
     throw new ConfigError(`${path} is mode ${mode.toString(8)}; must be 0600`);
   return readFileSync(path, "utf8");
 }
+function isBlank(path) {
+  if (statSync(path).size === 0)
+    return true;
+  return readFileSync(path, "utf8").trim() === "";
+}
 function readJson(path) {
   try {
     return JSON.parse(readSecure(path));
@@ -80,6 +85,9 @@ function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
   }
+  if (isBlank(configPath())) {
+    throw new ConfigMissingError(`${configPath()} is empty \u2014 run init.mjs to create it`);
+  }
   const file = readJson(configPath());
   if (!file) {
     throw new ConfigError(`cannot read ${configPath()} \u2014 it exists but did not parse`);

package/dist/bin/status.mjs

@@ -62,6 +62,11 @@ function readSecure(path) {
     throw new ConfigError(`${path} is mode ${mode.toString(8)}; must be 0600`);
   return readFileSync(path, "utf8");
 }
+function isBlank(path) {
+  if (statSync(path).size === 0)
+    return true;
+  return readFileSync(path, "utf8").trim() === "";
+}
 function readJson(path) {
   try {
     return JSON.parse(readSecure(path));
@@ -86,6 +91,9 @@ function readConfigFile(vendor) {
   if (!existsSync(configPath())) {
     throw new ConfigMissingError(`${configPath()} does not exist \u2014 run init.mjs to create it`);
   }
+  if (isBlank(configPath())) {
+    throw new ConfigMissingError(`${configPath()} is empty \u2014 run init.mjs to create it`);
+  }
   const file = readJson(configPath());
   if (!file) {
     throw new ConfigError(`cannot read ${configPath()} \u2014 it exists but did not parse`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {