Event Schema

All Omnodex events follow a consistent schema regardless of which interceptor captured them.

Base Event Fields

Every event contains these fields:

interface TraceEvent {
  id: string;            // Unique event identifier
  timestamp: string;     // ISO 8601 timestamp
  sessionId: string;     // Session this event belongs to
  kind: InterceptorKind; // Which interceptor captured it
  type: EventType;       // What type of event
  payload: object;       // Event-specific data
}

InterceptorKind

Identifies the source of the event:

Value	Description
claude-code-hook	Captured by the Claude Code hook
codex-hook	Captured by the Codex hook
mcp-proxy	Captured by the MCP proxy interceptor

EventType

Value	Description
session.start	Agent session began
session.end	Agent session ended
tool.invoked	A tool was called
tool.result	A tool returned a result

Payload: tool.invoked

The most common event type. Payload structure:

{
  tool: string;     // Tool name (e.g., "Read", "Bash", "WebSearch")
  params: object;   // Parameters passed to the tool
  result?: object;  // Result returned (when available)
}

Payload: session.start

{
  agent: string;    // Agent identifier
  model?: string;   // Model used (when available)
  cwd?: string;     // Working directory
}

Payload: session.end

{
  duration: number; // Session duration in milliseconds
  eventCount: number; // Total events in session
}

JSONL Format

Events are stored one per line in JSONL (JSON Lines) format:

{"id":"evt_001","timestamp":"2026-05-16T10:00:00Z","sessionId":"sess_abc","kind":"claude-code-hook","type":"session.start","payload":{"agent":"claude-code","model":"claude-sonnet-4-6"}}
{"id":"evt_002","timestamp":"2026-05-16T10:00:01Z","sessionId":"sess_abc","kind":"claude-code-hook","type":"tool.invoked","payload":{"tool":"Read","params":{"file_path":"/src/index.ts"}}}

Each line is a complete, self-contained JSON object. The file can be processed with standard tools:

# Count events
wc -l $OMNODEX_HOME/events.jsonl

# Filter by type
cat $OMNODEX_HOME/events.jsonl | jq 'select(.type == "tool.invoked")'

# Find credential-related events
cat $OMNODEX_HOME/events.jsonl | jq 'select(.payload.tool == "Bash")'

Next Steps

• Events and Traces - Conceptual overview of the event model
• Configuration - Configure event storage location