@darkhunt-security/endpoint-codex 0.9.8 → 0.9.10

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darkhunt-guard",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "hooks": "./hooks/hooks.json",
   "description": "Darkhunt endpoint plugin for Codex CLI \u2014 full session trace capture and PreToolUse guardrails.",
   "author": {

package/dist/bin/backfill.mjs

@@ -18303,6 +18303,10 @@ function summarize(output) {
     return text;
   return `${text.slice(0, TOOL_SUMMARY_LIMIT)}\u2026 [truncated, ${text.length} chars]`;
 }
+function attachmentLabel(record) {
+  const size = record.bytes ? `, ${Math.round(record.bytes / 1024)} KB` : "";
+  return `[${record.mediaType ?? "attachment"}${size}]`;
+}
 var RESUMED_USER_TEXT_LIMIT = 4e3;
 var SessionEmitter = class {
   client;
@@ -18324,8 +18328,12 @@ var SessionEmitter = class {
   /** True while consecutive user records still belong to the same turn. */
   userTurnOpen = false;
   pendingAttachments = [];
+  /** Attachments seen before the trace could be opened knowing the prompt. */
+  deferred = [];
   pendingUsage;
   outputText = [];
+  /** The last thing the assistant said in this pass — the trace's result. */
+  lastAssistantText;
   count = 0;
   constructor(client, options) {
     this.client = client;
@@ -18376,6 +18384,28 @@ var SessionEmitter = class {
       return;
     }
     this.count++;
+    if (record.kind === "attachment")
+      this.pendingAttachments.push(attachmentLabel(record));
+    if (record.kind === "user_message")
+      this.absorbUserTurn(record);
+    if (!this.trace && record.kind === "attachment") {
+      this.deferred.push(record);
+      return;
+    }
+    this.flushDeferred();
+    this.place(record);
+  }
+  /** Open the trace on the turn held back, then replay it. No-op once the trace exists. */
+  flushDeferred() {
+    if (this.deferred.length === 0)
+      return;
+    const held = this.deferred.splice(0);
+    this.ensureTrace(held[0].ts);
+    for (const record of held)
+      this.place(record);
+  }
+  /** Route one record onto its owning trace and emit whatever it is worth. */
+  place(record) {
     const root = this.ensureTrace(record.ts);
     const parentTrace = record.parentUuid ? this.owners.get(record.parentUuid) : void 0;
     let owner = parentTrace ?? root;
@@ -18385,28 +18415,21 @@ var SessionEmitter = class {
         sessionId: this.options.sessionId,
         handoffFrom: [root.handoffToken()],
         startTime: record.ts,
+        // A subagent's first record is the task it was given, and it has already been
+        // absorbed by the time this fires — so the child trace opens with its brief
+        // rather than empty.
+        ...this.lastUserText ? { input: this.lastUserText } : {},
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {}
       }));
       this.sidechains.push(owner);
     }
     this.owners.set(record.uuid, owner);
     switch (record.kind) {
-      case "user_message": {
+      case "user_message":
         this.endGeneration();
-        const part = [this.pendingAttachments.join(" "), record.text].filter(Boolean).join(" ");
-        this.pendingAttachments = [];
-        if (this.userTurnOpen) {
-          this.lastUserText = [this.lastUserText, part].filter(Boolean).join(" ");
-        } else {
-          this.lastUserText = part;
-          this.userTurnOpen = true;
-          this.pendingToolResults = [];
-        }
         break;
-      }
       case "attachment": {
-        const label = `[${record.mediaType ?? "attachment"}${record.bytes ? `, ${Math.round(record.bytes / 1024)} KB` : ""}]`;
-        this.pendingAttachments.push(label);
+        const label = attachmentLabel(record);
         this.seeded(["attachment", record.uuid], () => owner.span("attachment", {
           startTime: record.ts,
           metadata: {
@@ -18463,8 +18486,26 @@ var SessionEmitter = class {
         break;
     }
   }
+  /**
+   * Fold a user record into the turn in flight.
+   *
+   * Split out of the `user_message` case so it can run before the trace is opened —
+   * see the call site in {@link ingest}.
+   */
+  absorbUserTurn(record) {
+    const part = [this.pendingAttachments.join(" "), record.text].filter(Boolean).join(" ");
+    this.pendingAttachments = [];
+    if (this.userTurnOpen) {
+      this.lastUserText = [this.lastUserText, part].filter(Boolean).join(" ");
+    } else {
+      this.lastUserText = part;
+      this.userTurnOpen = true;
+      this.pendingToolResults = [];
+    }
+  }
   /** Ends everything still open and flushes. Safe to call twice. */
   async finish() {
+    this.flushDeferred();
     this.endGeneration();
     for (const span of this.toolSpans.values())
       span.end();
@@ -18475,7 +18516,10 @@ var SessionEmitter = class {
     if (this.trace) {
       this.trace.update({
         metadata: this.meta,
-        ...this.title !== void 0 ? { name: this.title } : {}
+        ...this.title !== void 0 ? { name: this.title } : {},
+        // The pass's result. Paired with the `input` set when the trace opened, this is
+        // what stops the consumer inferring the trace's I/O from a descendant.
+        ...this.lastAssistantText !== void 0 ? { output: this.lastAssistantText } : {}
       });
       this.trace.end();
       this.trace = void 0;
@@ -18513,6 +18557,9 @@ var SessionEmitter = class {
     return this.options.parentAgentId ?? this.meta["parentSessionId"];
   }
   defaultTraceName() {
+    const label = this.options.workflow?.label;
+    if (label)
+      return label;
     const agentType = this.agentType();
     if (agentType)
       return `subagent: ${agentType}`;
@@ -18521,6 +18568,27 @@ var SessionEmitter = class {
     }
     return this.options.agentType ? `subagent: ${this.options.agentType}` : `subagent ${this.options.agentId}`;
   }
+  /**
+   * The run this agent belongs to, flattened onto the trace.
+   *
+   * Flat scalars rather than a nested object: metadata is lifted onto the span one
+   * attribute at a time downstream, so a nested value would arrive as a JSON blob that
+   * nothing can group or filter on. `workflow_id` is the one that matters — it is what
+   * lets a consumer collect the agents of one run out of a session that ran several.
+   */
+  workflowMetadata() {
+    const workflow = this.options.workflow;
+    if (!workflow)
+      return {};
+    return {
+      workflow_id: workflow.id,
+      ...workflow.name !== void 0 ? { workflow_name: workflow.name } : {},
+      ...workflow.label !== void 0 ? { workflow_label: workflow.label } : {},
+      ...workflow.phase !== void 0 ? { workflow_phase: workflow.phase } : {},
+      ...workflow.phaseIndex !== void 0 ? { workflow_phase_index: workflow.phaseIndex } : {},
+      ...workflow.attempt !== void 0 ? { workflow_attempt: workflow.attempt } : {}
+    };
+  }
   /** The session traces group under. Set from the path, or from `session_meta`. */
   grouping;
   ensureTrace(ts) {
@@ -18531,6 +18599,10 @@ var SessionEmitter = class {
         name: this.title ?? this.defaultTraceName(),
         sessionId: this.grouping ?? this.options.sessionId,
         startTime: ts,
+        // What the agent was asked. `TraceArgs.input` is construction-only — the SDK's
+        // `update()` carries output alone — which is why `ingest` absorbs the user turn
+        // before it calls this.
+        ...this.lastUserText ? { input: this.lastUserText } : {},
         tags: [this.options.vendor, ...this.options.agentId ? ["subagent"] : []],
         metadata: {
           ...this.meta,
@@ -18541,7 +18613,10 @@ var SessionEmitter = class {
           ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
           ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {},
           ...this.parentAgentId() !== void 0 ? { parent_agent_id: this.parentAgentId() } : {},
-          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {}
+          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {},
+          // snake_case for the same reason as `agent_id` above: trace-hub lifts each
+          // key through unchanged, and these are read alongside it.
+          ...this.workflowMetadata()
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},
@@ -18596,6 +18671,8 @@ var SessionEmitter = class {
     if (!this.generation)
       return;
     const output = this.outputText.join("\n");
+    if (output)
+      this.lastAssistantText = output;
     this.generation.end({
       ...output ? { outputMessages: [{ role: "assistant", content: output }] } : {},
       ...this.model !== void 0 ? { model: this.model } : {},
@@ -21696,6 +21773,7 @@ async function runForwarder(mapper, options = {}) {
             ...sub?.agentType !== void 0 ? { agentType: sub.agentType } : {},
             ...sub?.parentAgentId !== void 0 ? { parentAgentId: sub.parentAgentId } : {},
             ...sub?.spawnDepth !== void 0 ? { spawnDepth: sub.spawnDepth } : {},
+            ...sub?.workflow !== void 0 ? { workflow: sub.workflow } : {},
             ...ids !== void 0 ? { ids } : {},
             ...userId !== void 0 ? { userId } : {},
             ...carried !== void 0 ? { resumeTurn: carried } : {}
@@ -21824,6 +21902,7 @@ import { join as join9 } from "node:path";
 var CLI_CREDENTIALS_PATH = join9(homedir3(), ".darkhunt", "credentials.json");
 
 // adapters/codex/dist/transcript.js
+import { readFileSync as readFileSync6 } from "node:fs";
 import { basename, join as join10 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function str(value) {
@@ -21860,17 +21939,62 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+function jwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1])
+    return void 0;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    const claims = JSON.parse(json);
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function emailFromAuth(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const tokens = parsed?.tokens;
+  const token = tokens?.id_token;
+  if (typeof token !== "string" || token === "")
+    return void 0;
+  const email = jwtClaims(token)?.["email"];
+  return typeof email === "string" && email !== "" ? email : void 0;
+}
 var codexTranscript = {
   vendor: "codex",
   sessionRoots() {
     return [join10(homedir4(), ".codex", "sessions")];
   },
-  // No `resolveUserId` yet, so Codex traces fall back to the configured `userId`.
-  // The identity exists but not as a plain field: `~/.codex/auth.json` holds
-  // `tokens.account_id` (a UUID, not a person) and an `email` claim inside the
-  // `id_token` JWT. Reading it means decoding an OAuth token and honouring its expiry —
-  // a stale token would attribute sessions to a *wrong* address, which is worse than
-  // leaving them unattributed. Tracked separately.
+  /**
+   * `~/.codex/auth.json` -> the `email` claim of `tokens.id_token`.
+   *
+   * Codex records no identity in the rollout itself and none in plain text anywhere
+   * else: `tokens.account_id` is a UUID, not a person. The address is a claim inside the
+   * OAuth id_token, so reading it means decoding that token — hence {@link jwtClaims}.
+   *
+   * The token's own `exp` is deliberately not enforced. It is an hour long and the file
+   * is only rewritten on sign-in and on refresh, so gating on expiry would leave most
+   * sessions unattributed while answering a question nobody asked: an expired id_token
+   * is evidence that a token needs refreshing, never evidence that a different person is
+   * now signed in. Signing in as someone else rewrites this file, which is what makes
+   * the stale-address worry unfounded — the claim always names the last account to
+   * authenticate on this machine, which is the account that wrote these rollouts.
+   *
+   * `undefined` for API-key auth (`OPENAI_API_KEY` with no tokens), for a signed-out
+   * agent, and for anything unreadable; the caller then falls back to configuration.
+   */
+  resolveUserId() {
+    try {
+      return emailFromAuth(readFileSync6(join10(homedir4(), ".codex", "auth.json"), "utf8"));
+    } catch {
+      return void 0;
+    }
+  },
   sessionIdFor(path) {
     const name = basename(path, ".jsonl");
     const match = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(name);

package/dist/bin/forwarder.mjs

@@ -18303,6 +18303,10 @@ function summarize(output) {
     return text;
   return `${text.slice(0, TOOL_SUMMARY_LIMIT)}\u2026 [truncated, ${text.length} chars]`;
 }
+function attachmentLabel(record) {
+  const size = record.bytes ? `, ${Math.round(record.bytes / 1024)} KB` : "";
+  return `[${record.mediaType ?? "attachment"}${size}]`;
+}
 var RESUMED_USER_TEXT_LIMIT = 4e3;
 var SessionEmitter = class {
   client;
@@ -18324,8 +18328,12 @@ var SessionEmitter = class {
   /** True while consecutive user records still belong to the same turn. */
   userTurnOpen = false;
   pendingAttachments = [];
+  /** Attachments seen before the trace could be opened knowing the prompt. */
+  deferred = [];
   pendingUsage;
   outputText = [];
+  /** The last thing the assistant said in this pass — the trace's result. */
+  lastAssistantText;
   count = 0;
   constructor(client, options) {
     this.client = client;
@@ -18376,6 +18384,28 @@ var SessionEmitter = class {
       return;
     }
     this.count++;
+    if (record.kind === "attachment")
+      this.pendingAttachments.push(attachmentLabel(record));
+    if (record.kind === "user_message")
+      this.absorbUserTurn(record);
+    if (!this.trace && record.kind === "attachment") {
+      this.deferred.push(record);
+      return;
+    }
+    this.flushDeferred();
+    this.place(record);
+  }
+  /** Open the trace on the turn held back, then replay it. No-op once the trace exists. */
+  flushDeferred() {
+    if (this.deferred.length === 0)
+      return;
+    const held = this.deferred.splice(0);
+    this.ensureTrace(held[0].ts);
+    for (const record of held)
+      this.place(record);
+  }
+  /** Route one record onto its owning trace and emit whatever it is worth. */
+  place(record) {
     const root = this.ensureTrace(record.ts);
     const parentTrace = record.parentUuid ? this.owners.get(record.parentUuid) : void 0;
     let owner = parentTrace ?? root;
@@ -18385,28 +18415,21 @@ var SessionEmitter = class {
         sessionId: this.options.sessionId,
         handoffFrom: [root.handoffToken()],
         startTime: record.ts,
+        // A subagent's first record is the task it was given, and it has already been
+        // absorbed by the time this fires — so the child trace opens with its brief
+        // rather than empty.
+        ...this.lastUserText ? { input: this.lastUserText } : {},
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {}
       }));
       this.sidechains.push(owner);
     }
     this.owners.set(record.uuid, owner);
     switch (record.kind) {
-      case "user_message": {
+      case "user_message":
         this.endGeneration();
-        const part = [this.pendingAttachments.join(" "), record.text].filter(Boolean).join(" ");
-        this.pendingAttachments = [];
-        if (this.userTurnOpen) {
-          this.lastUserText = [this.lastUserText, part].filter(Boolean).join(" ");
-        } else {
-          this.lastUserText = part;
-          this.userTurnOpen = true;
-          this.pendingToolResults = [];
-        }
         break;
-      }
       case "attachment": {
-        const label = `[${record.mediaType ?? "attachment"}${record.bytes ? `, ${Math.round(record.bytes / 1024)} KB` : ""}]`;
-        this.pendingAttachments.push(label);
+        const label = attachmentLabel(record);
         this.seeded(["attachment", record.uuid], () => owner.span("attachment", {
           startTime: record.ts,
           metadata: {
@@ -18463,8 +18486,26 @@ var SessionEmitter = class {
         break;
     }
   }
+  /**
+   * Fold a user record into the turn in flight.
+   *
+   * Split out of the `user_message` case so it can run before the trace is opened —
+   * see the call site in {@link ingest}.
+   */
+  absorbUserTurn(record) {
+    const part = [this.pendingAttachments.join(" "), record.text].filter(Boolean).join(" ");
+    this.pendingAttachments = [];
+    if (this.userTurnOpen) {
+      this.lastUserText = [this.lastUserText, part].filter(Boolean).join(" ");
+    } else {
+      this.lastUserText = part;
+      this.userTurnOpen = true;
+      this.pendingToolResults = [];
+    }
+  }
   /** Ends everything still open and flushes. Safe to call twice. */
   async finish() {
+    this.flushDeferred();
     this.endGeneration();
     for (const span of this.toolSpans.values())
       span.end();
@@ -18475,7 +18516,10 @@ var SessionEmitter = class {
     if (this.trace) {
       this.trace.update({
         metadata: this.meta,
-        ...this.title !== void 0 ? { name: this.title } : {}
+        ...this.title !== void 0 ? { name: this.title } : {},
+        // The pass's result. Paired with the `input` set when the trace opened, this is
+        // what stops the consumer inferring the trace's I/O from a descendant.
+        ...this.lastAssistantText !== void 0 ? { output: this.lastAssistantText } : {}
       });
       this.trace.end();
       this.trace = void 0;
@@ -18513,6 +18557,9 @@ var SessionEmitter = class {
     return this.options.parentAgentId ?? this.meta["parentSessionId"];
   }
   defaultTraceName() {
+    const label = this.options.workflow?.label;
+    if (label)
+      return label;
     const agentType = this.agentType();
     if (agentType)
       return `subagent: ${agentType}`;
@@ -18521,6 +18568,27 @@ var SessionEmitter = class {
     }
     return this.options.agentType ? `subagent: ${this.options.agentType}` : `subagent ${this.options.agentId}`;
   }
+  /**
+   * The run this agent belongs to, flattened onto the trace.
+   *
+   * Flat scalars rather than a nested object: metadata is lifted onto the span one
+   * attribute at a time downstream, so a nested value would arrive as a JSON blob that
+   * nothing can group or filter on. `workflow_id` is the one that matters — it is what
+   * lets a consumer collect the agents of one run out of a session that ran several.
+   */
+  workflowMetadata() {
+    const workflow = this.options.workflow;
+    if (!workflow)
+      return {};
+    return {
+      workflow_id: workflow.id,
+      ...workflow.name !== void 0 ? { workflow_name: workflow.name } : {},
+      ...workflow.label !== void 0 ? { workflow_label: workflow.label } : {},
+      ...workflow.phase !== void 0 ? { workflow_phase: workflow.phase } : {},
+      ...workflow.phaseIndex !== void 0 ? { workflow_phase_index: workflow.phaseIndex } : {},
+      ...workflow.attempt !== void 0 ? { workflow_attempt: workflow.attempt } : {}
+    };
+  }
   /** The session traces group under. Set from the path, or from `session_meta`. */
   grouping;
   ensureTrace(ts) {
@@ -18531,6 +18599,10 @@ var SessionEmitter = class {
         name: this.title ?? this.defaultTraceName(),
         sessionId: this.grouping ?? this.options.sessionId,
         startTime: ts,
+        // What the agent was asked. `TraceArgs.input` is construction-only — the SDK's
+        // `update()` carries output alone — which is why `ingest` absorbs the user turn
+        // before it calls this.
+        ...this.lastUserText ? { input: this.lastUserText } : {},
         tags: [this.options.vendor, ...this.options.agentId ? ["subagent"] : []],
         metadata: {
           ...this.meta,
@@ -18541,7 +18613,10 @@ var SessionEmitter = class {
           ...this.agentId() !== void 0 ? { agent_id: this.agentId() } : {},
           ...this.agentType() !== void 0 ? { agent_type: this.agentType() } : {},
           ...this.parentAgentId() !== void 0 ? { parent_agent_id: this.parentAgentId() } : {},
-          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {}
+          ...this.options.spawnDepth !== void 0 ? { spawn_depth: this.options.spawnDepth } : {},
+          // snake_case for the same reason as `agent_id` above: trace-hub lifts each
+          // key through unchanged, and these are read alongside it.
+          ...this.workflowMetadata()
         },
         ...this.options.userId !== void 0 ? { userId: this.options.userId } : {},
         ...this.options.userEmail !== void 0 ? { userEmail: this.options.userEmail } : {},
@@ -18596,6 +18671,8 @@ var SessionEmitter = class {
     if (!this.generation)
       return;
     const output = this.outputText.join("\n");
+    if (output)
+      this.lastAssistantText = output;
     this.generation.end({
       ...output ? { outputMessages: [{ role: "assistant", content: output }] } : {},
       ...this.model !== void 0 ? { model: this.model } : {},
@@ -21696,6 +21773,7 @@ async function runForwarder(mapper, options = {}) {
             ...sub?.agentType !== void 0 ? { agentType: sub.agentType } : {},
             ...sub?.parentAgentId !== void 0 ? { parentAgentId: sub.parentAgentId } : {},
             ...sub?.spawnDepth !== void 0 ? { spawnDepth: sub.spawnDepth } : {},
+            ...sub?.workflow !== void 0 ? { workflow: sub.workflow } : {},
             ...ids !== void 0 ? { ids } : {},
             ...userId !== void 0 ? { userId } : {},
             ...carried !== void 0 ? { resumeTurn: carried } : {}
@@ -21811,6 +21889,7 @@ import { join as join9 } from "node:path";
 var CLI_CREDENTIALS_PATH = join9(homedir3(), ".darkhunt", "credentials.json");
 
 // adapters/codex/dist/transcript.js
+import { readFileSync as readFileSync6 } from "node:fs";
 import { basename, join as join10 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function str(value) {
@@ -21847,17 +21926,62 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+function jwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1])
+    return void 0;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    const claims = JSON.parse(json);
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function emailFromAuth(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const tokens = parsed?.tokens;
+  const token = tokens?.id_token;
+  if (typeof token !== "string" || token === "")
+    return void 0;
+  const email = jwtClaims(token)?.["email"];
+  return typeof email === "string" && email !== "" ? email : void 0;
+}
 var codexTranscript = {
   vendor: "codex",
   sessionRoots() {
     return [join10(homedir4(), ".codex", "sessions")];
   },
-  // No `resolveUserId` yet, so Codex traces fall back to the configured `userId`.
-  // The identity exists but not as a plain field: `~/.codex/auth.json` holds
-  // `tokens.account_id` (a UUID, not a person) and an `email` claim inside the
-  // `id_token` JWT. Reading it means decoding an OAuth token and honouring its expiry —
-  // a stale token would attribute sessions to a *wrong* address, which is worse than
-  // leaving them unattributed. Tracked separately.
+  /**
+   * `~/.codex/auth.json` -> the `email` claim of `tokens.id_token`.
+   *
+   * Codex records no identity in the rollout itself and none in plain text anywhere
+   * else: `tokens.account_id` is a UUID, not a person. The address is a claim inside the
+   * OAuth id_token, so reading it means decoding that token — hence {@link jwtClaims}.
+   *
+   * The token's own `exp` is deliberately not enforced. It is an hour long and the file
+   * is only rewritten on sign-in and on refresh, so gating on expiry would leave most
+   * sessions unattributed while answering a question nobody asked: an expired id_token
+   * is evidence that a token needs refreshing, never evidence that a different person is
+   * now signed in. Signing in as someone else rewrites this file, which is what makes
+   * the stale-address worry unfounded — the claim always names the last account to
+   * authenticate on this machine, which is the account that wrote these rollouts.
+   *
+   * `undefined` for API-key auth (`OPENAI_API_KEY` with no tokens), for a signed-out
+   * agent, and for anything unreadable; the caller then falls back to configuration.
+   */
+  resolveUserId() {
+    try {
+      return emailFromAuth(readFileSync6(join10(homedir4(), ".codex", "auth.json"), "utf8"));
+    } catch {
+      return void 0;
+    }
+  },
   sessionIdFor(path) {
     const name = basename(path, ".jsonl");
     const match = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(name);

package/dist/bin/status.mjs

@@ -3,7 +3,7 @@ import { createRequire as __dhCreateRequire } from 'node:module';
 const require = __dhCreateRequire(import.meta.url);
 
 // adapters/codex/bin/status.mjs
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { dirname, join as join12 } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -1228,6 +1228,7 @@ import { join as join9 } from "node:path";
 var CLI_CREDENTIALS_PATH = join9(homedir3(), ".darkhunt", "credentials.json");
 
 // adapters/codex/dist/transcript.js
+import { readFileSync as readFileSync6 } from "node:fs";
 import { basename, join as join10 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function str(value) {
@@ -1264,17 +1265,62 @@ function textOf(content) {
   const parts = content.map((b) => b && typeof b === "object" ? str(b["text"]) : void 0).filter((t) => !!t);
   return parts.length > 0 ? parts.join("\n") : void 0;
 }
+function jwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1])
+    return void 0;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    const claims = JSON.parse(json);
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function emailFromAuth(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const tokens = parsed?.tokens;
+  const token = tokens?.id_token;
+  if (typeof token !== "string" || token === "")
+    return void 0;
+  const email = jwtClaims(token)?.["email"];
+  return typeof email === "string" && email !== "" ? email : void 0;
+}
 var codexTranscript = {
   vendor: "codex",
   sessionRoots() {
     return [join10(homedir4(), ".codex", "sessions")];
   },
-  // No `resolveUserId` yet, so Codex traces fall back to the configured `userId`.
-  // The identity exists but not as a plain field: `~/.codex/auth.json` holds
-  // `tokens.account_id` (a UUID, not a person) and an `email` claim inside the
-  // `id_token` JWT. Reading it means decoding an OAuth token and honouring its expiry —
-  // a stale token would attribute sessions to a *wrong* address, which is worse than
-  // leaving them unattributed. Tracked separately.
+  /**
+   * `~/.codex/auth.json` -> the `email` claim of `tokens.id_token`.
+   *
+   * Codex records no identity in the rollout itself and none in plain text anywhere
+   * else: `tokens.account_id` is a UUID, not a person. The address is a claim inside the
+   * OAuth id_token, so reading it means decoding that token — hence {@link jwtClaims}.
+   *
+   * The token's own `exp` is deliberately not enforced. It is an hour long and the file
+   * is only rewritten on sign-in and on refresh, so gating on expiry would leave most
+   * sessions unattributed while answering a question nobody asked: an expired id_token
+   * is evidence that a token needs refreshing, never evidence that a different person is
+   * now signed in. Signing in as someone else rewrites this file, which is what makes
+   * the stale-address worry unfounded — the claim always names the last account to
+   * authenticate on this machine, which is the account that wrote these rollouts.
+   *
+   * `undefined` for API-key auth (`OPENAI_API_KEY` with no tokens), for a signed-out
+   * agent, and for anything unreadable; the caller then falls back to configuration.
+   */
+  resolveUserId() {
+    try {
+      return emailFromAuth(readFileSync6(join10(homedir4(), ".codex", "auth.json"), "utf8"));
+    } catch {
+      return void 0;
+    }
+  },
   sessionIdFor(path) {
     const name = basename(path, ".jsonl");
     const match = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(name);
@@ -1373,7 +1419,7 @@ var codexTranscript = {
 };
 
 // adapters/codex/bin/lib/launchers.mjs
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { join as join11 } from "node:path";
 var LAUNCHERS = {
@@ -1399,7 +1445,7 @@ function launcherState(binDir = BIN_DIR, path = process.env["PATH"] ?? "") {
     }
     let body = "";
     try {
-      body = readFileSync6(file, "utf8");
+      body = readFileSync7(file, "utf8");
     } catch {
     }
     if (body !== script(target)) stale.push(name);
@@ -1437,7 +1483,7 @@ try {
   const root = join12(dirname(fileURLToPath(import.meta.url)), "..", "..");
   let installed = "unknown";
   try {
-    installed = JSON.parse(readFileSync7(join12(root, "package.json"), "utf8")).version;
+    installed = JSON.parse(readFileSync8(join12(root, "package.json"), "utf8")).version;
   } catch {
   }
   console.log(`  plugin       ${installed}   ${root}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkhunt-security/endpoint-codex",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "type": "module",
   "description": "Darkhunt endpoint adapter for Codex CLI: hook codec, rollout transcript mapper, plugin manifest.",
   "bin": {
@@ -13,8 +13,8 @@
     ".codex-plugin"
   ],
   "devDependencies": {
-    "@darkhunt-security/endpoint-contracts": "0.9.1",
-    "@darkhunt-security/endpoint-core": "0.9.1"
+    "@darkhunt-security/endpoint-contracts": "0.9.2",
+    "@darkhunt-security/endpoint-core": "0.9.2"
   },
   "publishConfig": {
     "access": "public",