@hayasaka7/haya-pet 0.1.0 → 0.2.0

package/docs/known-issues.md

@@ -1,49 +1,121 @@
-# Known Issues (deferred)
-
-Issues found in live use that are **recorded for later** — not yet fixed. The
-decision on *how* to fix is pending.
-
-## 1. Terminal scrolling breaks when running a CLI through `haya-pet run` (observe/PTY mode)
-
-- **Symptom:** While a CLI is running under `haya-pet run` (default `--observe`), the
-  terminal window can no longer scroll normally.
-- **Trigger:** Only in observe (PTY) mode. The plain `--no-observe` path
-  (`stdio: "inherit"`) does not have this problem.
-- **Diagnosis:** Observe mode runs the CLI inside a `node-pty`/ConPTY pseudo-terminal
-  with a fixed `cols × rows` and tees its output to our `stdout`
-  (`packages/cli-core/src/pty-runner.js`). Full-screen TUIs (Claude Code, Codex)
-  render into that fixed grid, so the outer terminal's scrollback only ever sees
-  redraws of the grid rather than a growing transcript — there is effectively
-  nothing meaningful to scroll. On Windows there is an extra layer: shims are run
-  as `cmd /d /s /c "<shim> ..."` *inside* the PTY, so `cmd.exe` is the PTY's
-  foreground process and the TUI is its child.
-- **Notes for a future fix:** Tools like `script`/`asciinema` interpose a PTY
-  without breaking the terminal, so a faithful passthrough is achievable. Avenues:
-  resolve the shim and spawn the real executable directly in the PTY (drop the
-  `cmd /c` layer); verify `cols/rows` always match the host; revisit whether
-  observe should be the default for interactive TUIs vs. native passthrough.
-
-## 2. Backspace deletes a whole word instead of one character (observe/PTY mode)
-
-- **Symptom:** While a CLI is running under `haya-pet run`, pressing Backspace
-  deletes an entire word rather than a single character.
-- **Trigger:** Only in observe (PTY) mode. Native (`--no-observe`) is unaffected.
-- **Diagnosis:** stdin is put in raw mode and forwarded byte-for-byte into the PTY
-  (`pty-runner.js` `forwardInput` → `child.write(chunk.toString("utf8"))`). The
-  whole-word deletion points to a key-encoding/line-discipline mismatch between the
-  host terminal (Windows Terminal/conhost) and the nested ConPTY (and possibly the
-  intermediate `cmd /c`) — e.g. Backspace `0x7f`/`0x08` being interpreted by the
-  inner app as a word-delete (Ctrl+W `0x17` / Alt+Backspace `ESC 0x7f`), or input
-  bytes being re-segmented across `data` events.
-- **Notes for a future fix:** Forward stdin as raw bytes without a UTF-8 round-trip;
-  audit the exact bytes the host sends for Backspace vs. what the inner app receives
-  (a small PTY echo harness); consider removing the `cmd /c` layer; re-evaluate
-  raw-mode handling. Hard to fully verify without interactive testing.
-
-## Shared root cause & the open decision
-
-Both issues stem from observe mode interposing a pseudo-terminal on an interactive
-session. The plain wrapper path avoids them entirely but cannot report fine-grained
-"thinking / running tools" status. The open product decision: **native terminal by
-default (perfect fidelity, coarser status) vs. keep PTY observation default and
-invest in faithful passthrough.** Deferred until the maintainer decides.
+# Known Issues
+
+Issues found in live use, with their current status.
+
+## ✅ Resolved: pet stuck on "waiting for approval" after a manual denial
+
+- **Symptom:** With Claude Code hooks enabled, denying a permission prompt left the
+  pet showing *waiting for approval* indefinitely (until the next turn), even
+  though nothing was pending.
+- **Root cause:** Claude Code fires **no hook** when the user manually denies a
+  permission — not `Stop`, not `PostToolUse`, not `PermissionDenied` (that one is
+  only for *auto-mode* classifier denials). Verified by `HAYA_PET_HOOK_DEBUG`
+  traces: the event stream simply stops after `Notification(permission_prompt)`.
+  So the hook-driven status had no event to clear `waiting_approval`. A timeout was
+  rejected — it would wrongly clear a *genuinely* pending approval if the user
+  stepped away.
+- **Fix:** An **L3 transcript watcher** (`claude-transcript-watcher.js`) tails the
+  session JSONL (`~/.claude/projects/<sanitized-cwd>/<id>.jsonl`, matched
+  case-insensitively). Claude records a denial as a `tool_result` with
+  `is_error: true` and a "user doesn't want to proceed / user rejected" marker —
+  ground truth, not a timer. On seeing it, the wrapper reports `idle`
+  (source `client_log`). A genuinely-pending approval has no such result yet, so
+  the alert correctly stays up until the user actually decides. Also split the
+  `Notification` hook by type (`permission_prompt`→approval, `idle_prompt`→idle) so
+  non-approval notifications no longer masquerade as approvals.
+
+## ✅ Resolved: Claude Code TUI accepted no keyboard input when hooks were injected
+
+- **Symptom:** With per-session hooks injected by default (`claude --settings
+  <tempfile>`), Claude Code launched but the interactive TUI accepted no typing —
+  the session was unusable. Native passthrough *without* injection was fine.
+- **Root cause:** Two compounding problems. (1) The injected hook **command string
+  baked a per-session `--session <uuid>`**, and the settings file used a fresh
+  `mkdtemp` path each launch — so Claude saw "new, untrusted hooks" every time and
+  blocked the TUI on its *review hooks* trust prompt. (2) Injection was the
+  **default**, so the very first interactive Claude run broke out of the box.
+- **Fix:** (a) Hook injection is now **opt-in** via `HAYA_PET_HOOKS=1`; the default
+  is native passthrough with lifecycle status, which never disrupts the session.
+  (b) When enabled, the hook command string is **stable** (the session id is passed
+  via the `HAYA_PET_SESSION_ID` env var, read by `haya-pet state`, instead of being
+  baked in) and written to a **stable settings path**, so Claude's trust prompt
+  only needs approving once rather than on every launch.
+
+## ✅ Resolved: terminal fidelity broke under `haya-pet run` (Shift+Tab / scroll / word-edit)
+
+- **Symptoms (older builds):** While a CLI ran under `haya-pet run` (which used to
+  default to `--observe`), the terminal lost fidelity — **Shift+Tab** did nothing,
+  the **mouse wheel** couldn't scroll, and **Backspace/word-editing** behaved wrong
+  (e.g. deleting a whole word, or no letter-by-letter delete).
+- **Root cause:** Observe mode interposed a `node-pty`/ConPTY pseudo-terminal
+  (plus, on Windows, an intermediate `cmd /d /s /c "<shim>"` layer) between the host
+  terminal and the interactive TUI. Special input — Shift+Tab (`ESC [ Z`),
+  Alt/Ctrl word-edits, and mouse-wheel reporting — is not ordinary bytes; it must
+  survive ConPTY's VT→`INPUT_RECORD`→VT round-trip, which on Windows mangles or
+  drops those sequences and does not transparently pass mouse events. The fixed
+  `cols × rows` grid also left the host's scrollback with nothing to scroll. This
+  was **architectural**: no amount of stdin-forwarding tweaking makes the ConPTY
+  round-trip lossless for mouse + special keys. The plain `stdio: "inherit"` path
+  never had the problem.
+- **Fix:** `haya-pet run` now defaults to **native passthrough** (`stdio: "inherit"`)
+  — the CLI talks directly to your terminal, so all input modes work exactly as they
+  do without the wrapper. Rich live status is available **opt-in** instead via the
+  client's own hooks; for **Claude Code** these are injected **per session** via
+  `claude --settings` when you set `HAYA_PET_HOOKS=1` (no change to the user's
+  global config, no overhead on their other Claude sessions), which is *higher*
+  fidelity than the old output scraping and costs nothing in the terminal. PTY
+  observation is still available as
+  an explicit opt-in (`haya-pet run --observe …`) for non-interactive runs, where the
+  fidelity tradeoff doesn't matter.
+- **Native-mode follow-ups (also fixed):** the wrapper now installs an interrupt
+  guard so Ctrl+C reaches the CLI (which exits gracefully) instead of killing the
+  wrapper before it can report the exit, and forwards `SIGTERM`/`SIGBREAK` to the
+  child. Sessions whose wrapper is hard-killed without unregistering are marked
+  stale ~15s after the heartbeat stops and dropped at 60s, so the pet no longer
+  sits on a phantom *idle*. The Claude hooks use Claude Code's documented
+  empty-string "match all tools" matcher (a bare `*` is an invalid regex that would
+  silently never fire).
+
+## Per-client status adapters
+
+Status comes from each client's native hooks where implemented, with PTY
+observation (`--observe`) or L1 lifecycle as the fallback. Current state:
+
+- **Claude Code** — native passthrough by default (full terminal fidelity,
+  lifecycle status). Live in-session status is **opt-in** via `HAYA_PET_HOOKS=1`,
+  which injects a settings file (`claude --settings <stable-file>`, no change to
+  your global config) wiring Claude's `UserPromptSubmit`/`PreToolUse`/`PostToolUse`/
+  `Notification`/`PreCompact`/`Stop`/`SubagentStop` events to `haya-pet state
+  <state>`, reported to the daemon over the IPC pipe. `PreToolUse` distinguishes
+  file-editing tools (`Edit`/`Write`/`MultiEdit`/`NotebookEdit` → *editing files*)
+  from other tools (→ *running tools*) via the hook `matcher`. **Why opt-in:**
+  injecting hooks makes Claude show a one-time *review hooks* trust prompt; the
+  command string + settings path are kept stable across sessions so it only needs
+  approving once (a volatile per-session argument would re-trigger it every
+  launch — see the resolved note below). `--observe` is a separate PTY opt-in for
+  non-interactive runs (terminal-fidelity tradeoff).
+- **Codex** — **not yet implemented** (no hook injection). Uses `--observe` PTY
+  observation or L1 lifecycle. A Codex hook adapter (temp `<cwd>/.codex/hooks.json`
+  + `--dangerously-bypass-hook-trust`) is a planned follow-up; note the open
+  upstream bug where hooks may not fire in interactive sessions
+  ([#17532](https://github.com/openai/codex/issues/17532)).
+- **Antigravity (`agy`)** — **not yet implemented** (no hook injection). Uses
+  `--observe` or L1 lifecycle. A Gemini-schema hook adapter is a planned follow-up.
+- **Generic / unknown** — no hooks; PTY observation (`--observe`) or L1 lifecycle.
+
+A future **L3 client-log adapter** (tailing e.g. `~/.codex/sessions` or
+Antigravity's `transcript.jsonl`) could provide activity without a PTY or hooks
+for the clients that lack a hook adapter.
+
+## Status sources, by fidelity
+
+| Tier | Source | How |
+|---|---|---|
+| L1 | process wrapper | default; session lifecycle + exit code |
+| L4 | client hooks | opt-in via `HAYA_PET_HOOKS=1` (Claude Code); reports through `haya-pet state …` |
+| L2 | PTY output scraping | opt-in via `--observe` (terminal-fidelity tradeoff) |
+
+Native passthrough (L1) + opt-in hooks (L4) is the recommended setup for interactive
+TUIs: perfect terminal fidelity *and* the richest status. Use `--observe` (L2)
+only when you want coarse activity tracking for a non-interactive command and
+don't care about terminal fidelity.

package/docs/troubleshooting.md

@@ -8,13 +8,43 @@ deferred problems with known root causes.
 | `haya-pet: command not found` | Install globally (`npm i -g …`), or in a source checkout run `npm link` in the repo root, or call the file directly: `node <repo>/apps/cli/src/haya-pet.js`. |
 | Running a CLI starts the pet but not the command | Fixed — update to the latest version. (Was caused by the auto-start poll exiting early.) |
 | Pet doesn't react to a session | Launch the CLI via `haya-pet run …`. If the overlay didn't auto-start, run `haya-pet start`, or check `HAYA_PET_NO_AUTOSTART` isn't set. |
+| Pet shows complete/working while an approval prompt is waiting | Fixed — update to the latest version. See "Approval prompt hidden by idle/working" below. |
 | Pet shows a blue placeholder box | No spritesheet found — add a pet (see the README); behaviour is otherwise correct. |
 | Pet is off-screen / can't find it | Tray icon → **Reset Position**. |
 | Can't exit the pet | `haya-pet stop`, or right-click the tray icon → **Quit**. |
 | `haya-pet pets` shows "No pets found" | Add a pet folder with **both** `pet.json` and a spritesheet to a search path. |
-| Terminal scroll / backspace odd while a CLI runs under `haya-pet run` | Known PTY-observation tradeoff — see [known-issues.md](known-issues.md). Workaround: `haya-pet run --no-observe …`. |
+| Terminal scroll / Shift+Tab / backspace odd while a CLI runs under `haya-pet run` | Fixed — `haya-pet run` now uses native passthrough by default (full fidelity). If you opted into `--observe`, drop it. See [known-issues.md](known-issues.md). |
+| Pet shows only **idle/lifecycle** while **Claude Code** works | Live in-session status is opt-in: run `haya-pet hooks on` once (persisted). The first `haya-pet run` afterward shows a one-time Claude *review hooks* prompt — approve it. Also make sure the companion is running (`haya-pet start`). Check the toggle with `haya-pet hooks status`. |
+| Typing doesn't work / **Claude Code** TUI frozen under `haya-pet run` | You have hooks enabled and Claude is showing its *review hooks* trust prompt (approve it once), or your Claude is too old for `--settings`. Run `haya-pet hooks off` (or set `HAYA_PET_NO_HOOKS=1`) for native passthrough with lifecycle-only status — typing and Shift+Tab work normally. |
+| Pet shows only **idle/lifecycle** while **Codex** works | Codex has no hook adapter yet — only Claude Code reports live status via hooks. Add `--observe` for coarse PTY activity (terminal-fidelity tradeoff), or accept lifecycle-only status. |
+| Pet shows only **idle/lifecycle** while **Antigravity** (`agy`) works | Antigravity has no hook adapter yet. Add `--observe` for coarse PTY activity, or accept lifecycle-only status. |
+| Claude hooks fail with **"hook exited with code 1"** | The hook command must not bake an **fnm**/node-manager *per-shell* node path (`…\fnm_multishells\<pid>_…\node.exe`) that dies when the shell exits. haya-pet bakes the stable `realpath`-resolved node path into the temp settings instead. Update to the latest version. |
+| Pet shows only **idle** for a generic / unknown CLI | Expected without a hook adapter — add `--observe` for PTY observation, otherwise lifecycle only. |
+| Pet stayed on **waiting for approval** after I denied a tool | Fixed — Claude fires no hook on a manual denial, so the wrapper tails the session transcript and clears to **idle** when the denial is recorded. A genuinely-pending approval (you haven't decided yet) correctly keeps alerting — there's no timer. |
+| Want to see which status events fire | Set `HAYA_PET_HOOK_DEBUG=<file.jsonl>` before `haya-pet run`; each hook- and transcript-sourced status appends one JSON line (timestamp, state, and source/event). |
+| Pet stays **idle** after force-quitting a CLI | The wrapper marks the session stale ~15s after the heartbeat stops, then drops it. Exiting normally (incl. Ctrl+C) reports **exited** immediately. |
+| Ctrl+C doesn't exit the CLI cleanly under `haya-pet run` | Fixed — the wrapper no longer dies on Ctrl+C; the signal reaches the CLI, which exits, and the pet shows the result. |
 | `ENOENT … electron\path.txt` | Electron's install extraction was interrupted — see below. |
 
+## Approval prompt hidden by idle/working
+
+Older builds could show a green complete check when the AI CLI was actually
+waiting on approval, or show working when other terminal output arrived beside
+the approval prompt. The cause was low-fidelity PTY activity/idle observation
+overwriting `waiting_approval`.
+
+The fix keeps user-action states sticky in the observer and preserves native
+hook/plugin approval states over lower-fidelity PTY updates. With native
+passthrough now the default, the most reliable approval signal is the client's
+own hooks — for Claude Code, enabling `HAYA_PET_HOOKS=1` injects settings that
+wire the `Notification` hook to a sticky *waiting for approval* state. Wrapped
+clients also receive `HAYA_PET_SESSION_ID`, so any hook can report directly:
+
+```bash
+haya-pet state waiting_approval --summary "approval needed"
+haya-pet state running_tool --summary "approval resolved"
+```
+
 ## Fixing a broken Electron install
 
 If launching the overlay fails with `ENOENT … node_modules\electron\path.txt`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hayasaka7/haya-pet",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "Generic AI CLI pet runtime foundation.",
   "license": "MIT",

package/packages/adapters/src/claude-hooks.js

@@ -0,0 +1,77 @@
+// Pure builders for Claude Code per-session hook settings. No I/O here — callers
+// resolve paths and write the file. Each hook entry runs the `haya-pet state`
+// reporter with a fixed state (and optional summary) baked into the command.
+
+const EDIT_TOOLS = ["Edit", "Write", "MultiEdit", "NotebookEdit"];
+const EDIT_TOOLS_MATCHER = EDIT_TOOLS.join("|");
+// Negative lookahead: match any tool that is NOT one of the edit tools, so the
+// two PreToolUse entries never both fire for the same tool.
+const NON_EDIT_MATCHER = `^(?!(${EDIT_TOOLS_MATCHER})$).*`;
+
+// The hook table. Each entry → one Claude hook that reports a fixed pet state.
+// `matcher` (when present) filters the event: tool name for PreToolUse, or the
+// notification type for Notification. `summary` is an optional short label that
+// both shows in the bubble and identifies the event in HAYA_PET_HOOK_DEBUG logs.
+//
+// Notification is split by type: only `permission_prompt` means "waiting for
+// approval"; `idle_prompt` (Claude sat idle waiting for input) means idle. Other
+// notification types (auth_success, elicitation_*) are intentionally ignored.
+//
+// PermissionDenied / PostToolUseFailure / StopFailure are subscribed so the pet
+// recovers from a denied or failed tool call — Claude fires no Stop on a denial,
+// so without these the pet would stay on `waiting_approval` until the next turn.
+const HOOK_TABLE = Object.freeze([
+  { event: "UserPromptSubmit", state: "thinking" },
+  { event: "PreToolUse", matcher: EDIT_TOOLS_MATCHER, state: "editing_files" },
+  { event: "PreToolUse", matcher: NON_EDIT_MATCHER, state: "running_tool" },
+  { event: "PostToolUse", state: "thinking" },
+  { event: "PostToolUseFailure", state: "thinking", summary: "tool-failed" },
+  // PermissionRequest fires the instant the dialog appears — earlier than the
+  // permission_prompt Notification, so the "waiting for approval" cue is snappy.
+  { event: "PermissionRequest", state: "waiting_approval" },
+  { event: "Notification", matcher: "permission_prompt", state: "waiting_approval" },
+  { event: "Notification", matcher: "idle_prompt", state: "idle", summary: "idle" },
+  { event: "PermissionDenied", state: "idle", summary: "denied" },
+  { event: "PreCompact", state: "compacting" },
+  { event: "Stop", state: "idle" },
+  { event: "StopFailure", state: "idle", summary: "stopped" },
+  { event: "SubagentStop", state: "idle" }
+]);
+
+// Resolve the pet state for a Claude event. `detail` is the tool name for
+// PreToolUse or the notification type for Notification. Exposed for testing and
+// to keep the mapping logic in one place.
+export function mapClaudeEventToState(event, detail) {
+  if (event === "PreToolUse") {
+    return EDIT_TOOLS.includes(detail) ? "editing_files" : "running_tool";
+  }
+  if (event === "Notification") {
+    if (detail === "permission_prompt") return "waiting_approval";
+    if (detail === "idle_prompt") return "idle";
+    return undefined;
+  }
+  const entry = HOOK_TABLE.find((row) => row.event === event && row.matcher === undefined);
+  return entry?.state;
+}
+
+export function buildClaudeHookSettings({ nodePath, cliPath }) {
+  const command = (state, summary) => {
+    const base = `${quote(nodePath)} ${quote(cliPath)} state ${state}`;
+    return summary ? `${base} --summary ${summary}` : base;
+  };
+
+  const hooks = {};
+  for (const row of HOOK_TABLE) {
+    const hookEntry = { hooks: [{ type: "command", command: command(row.state, row.summary) }] };
+    if (row.matcher !== undefined) {
+      hookEntry.matcher = row.matcher;
+    }
+    (hooks[row.event] ??= []).push(hookEntry);
+  }
+
+  return { hooks };
+}
+
+function quote(value) {
+  return `"${String(value).replace(/"/g, '\\"')}"`;
+}

package/packages/adapters/src/claude-transcript.js

@@ -0,0 +1,74 @@
+// Pure parser for Claude Code session transcript (JSONL) lines. The transcript
+// is ground truth for what actually happened in a turn — in particular it records
+// a `tool_result` for every tool call, including when the USER REJECTS a
+// permission prompt (Claude fires no hook on a manual denial, so this is the only
+// reliable signal that a pending approval was resolved by a denial).
+//
+// The transcript format is stable but undocumented, so every access is defensive.
+
+// Marker phrases Claude writes into a rejected tool's result. Matched
+// case-insensitively; kept broad so a wording tweak doesn't silently break us.
+const REJECTION_MARKERS = Object.freeze([
+  "user doesn't want to proceed",
+  "user rejected",
+  "tool use was rejected",
+  "rejected the tool",
+  "user has denied",
+  "user chose not to"
+]);
+
+// Returns a resolution event for a single transcript line, or undefined.
+// Currently we only surface denials — the approve path is already covered by the
+// PostToolUse hook, and emitting on every result would race with it.
+export function parseTranscriptLine(line) {
+  let entry;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+
+  const content = entry?.message?.content;
+  if (!Array.isArray(content)) {
+    return undefined;
+  }
+
+  for (const block of content) {
+    if (block?.type === "tool_result" && block.is_error === true) {
+      const text = extractText(block.content).toLowerCase();
+      if (REJECTION_MARKERS.some((marker) => text.includes(marker))) {
+        return { type: "tool_denied", toolUseId: block.tool_use_id };
+      }
+    }
+  }
+
+  return undefined;
+}
+
+// Parse a batch of newly-appended lines, returning the resolution events found.
+export function parseTranscriptLines(lines) {
+  const events = [];
+  for (const line of lines) {
+    if (typeof line !== "string" || line.trim() === "") {
+      continue;
+    }
+    const event = parseTranscriptLine(line);
+    if (event) {
+      events.push(event);
+    }
+  }
+  return events;
+}
+
+function extractText(content) {
+  if (typeof content === "string") {
+    return content;
+  }
+  if (Array.isArray(content)) {
+    return content.map((part) => (typeof part === "string" ? part : part?.text ?? "")).join(" ");
+  }
+  if (content && typeof content === "object" && typeof content.text === "string") {
+    return content.text;
+  }
+  return "";
+}

package/packages/adapters/test/claude-hooks.test.mjs

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { test } from "../../../test/harness.mjs";
+import { buildClaudeHookSettings, mapClaudeEventToState } from "../src/claude-hooks.js";
+
+test("mapClaudeEventToState covers activity events", () => {
+  assert.equal(mapClaudeEventToState("UserPromptSubmit"), "thinking");
+  assert.equal(mapClaudeEventToState("PostToolUse"), "thinking");
+  assert.equal(mapClaudeEventToState("PostToolUseFailure"), "thinking");
+  assert.equal(mapClaudeEventToState("PreCompact"), "compacting");
+  assert.equal(mapClaudeEventToState("Stop"), "idle");
+  assert.equal(mapClaudeEventToState("StopFailure"), "idle");
+  assert.equal(mapClaudeEventToState("SubagentStop"), "idle");
+  assert.equal(mapClaudeEventToState("PermissionDenied"), "idle");
+  assert.equal(mapClaudeEventToState("PermissionRequest"), "waiting_approval");
+  assert.equal(mapClaudeEventToState("Unknown"), undefined);
+});
+
+test("mapClaudeEventToState branches PreToolUse on tool name", () => {
+  assert.equal(mapClaudeEventToState("PreToolUse", "Bash"), "running_tool");
+  assert.equal(mapClaudeEventToState("PreToolUse", "Edit"), "editing_files");
+  assert.equal(mapClaudeEventToState("PreToolUse", "MultiEdit"), "editing_files");
+});
+
+test("mapClaudeEventToState branches Notification on type (approval vs idle)", () => {
+  assert.equal(mapClaudeEventToState("Notification", "permission_prompt"), "waiting_approval");
+  assert.equal(mapClaudeEventToState("Notification", "idle_prompt"), "idle");
+  // Other notification types are ignored, not treated as approval.
+  assert.equal(mapClaudeEventToState("Notification", "auth_success"), undefined);
+});
+
+test("buildClaudeHookSettings bakes node + cli, no volatile session id", () => {
+  const settings = buildClaudeHookSettings({
+    nodePath: "/usr/bin/node",
+    cliPath: "/app/haya-pet.js"
+  });
+
+  const cmd = settings.hooks.UserPromptSubmit[0].hooks[0].command;
+  assert.equal(settings.hooks.UserPromptSubmit[0].hooks[0].type, "command");
+  assert.match(cmd, /"\/usr\/bin\/node"/);
+  assert.match(cmd, /"\/app\/haya-pet\.js"/);
+  assert.match(cmd, /state thinking$/);
+  assert.doesNotMatch(JSON.stringify(settings), /--session/);
+});
+
+test("buildClaudeHookSettings is stable across calls (for trust caching)", () => {
+  const a = buildClaudeHookSettings({ nodePath: "n", cliPath: "c" });
+  const b = buildClaudeHookSettings({ nodePath: "n", cliPath: "c" });
+  assert.deepEqual(a, b);
+});
+
+test("buildClaudeHookSettings splits Notification into approval + idle matchers", () => {
+  const settings = buildClaudeHookSettings({ nodePath: "n", cliPath: "c" });
+  const note = settings.hooks.Notification;
+  assert.equal(note.length, 2);
+
+  const approval = note.find((e) => e.matcher === "permission_prompt");
+  const idle = note.find((e) => e.matcher === "idle_prompt");
+  assert.match(approval.hooks[0].command, /state waiting_approval$/);
+  assert.match(idle.hooks[0].command, /state idle --summary idle$/);
+});
+
+test("buildClaudeHookSettings keeps two non-overlapping PreToolUse matchers", () => {
+  const pre = buildClaudeHookSettings({ nodePath: "n", cliPath: "c" }).hooks.PreToolUse;
+  assert.equal(pre.length, 2);
+  const edit = pre.find((e) => /editing_files/.test(e.hooks[0].command));
+  const other = pre.find((e) => /running_tool/.test(e.hooks[0].command));
+  assert.equal(edit.matcher, "Edit|Write|MultiEdit|NotebookEdit");
+  assert.equal(other.matcher, "^(?!(Edit|Write|MultiEdit|NotebookEdit)$).*");
+});
+
+test("buildClaudeHookSettings subscribes to denial/failure recovery events", () => {
+  const settings = buildClaudeHookSettings({ nodePath: "n", cliPath: "c" });
+  assert.match(settings.hooks.PermissionDenied[0].hooks[0].command, /state idle --summary denied$/);
+  assert.match(settings.hooks.PostToolUseFailure[0].hooks[0].command, /state thinking --summary tool-failed$/);
+  assert.match(settings.hooks.StopFailure[0].hooks[0].command, /state idle --summary stopped$/);
+});
+
+test("buildClaudeHookSettings includes all subscribed events", () => {
+  const settings = buildClaudeHookSettings({ nodePath: "n", cliPath: "c" });
+  for (const event of [
+    "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure",
+    "PermissionRequest", "Notification", "PermissionDenied", "PreCompact",
+    "Stop", "StopFailure", "SubagentStop"
+  ]) {
+    assert.ok(settings.hooks[event], `missing hook event ${event}`);
+  }
+});

package/packages/adapters/test/claude-transcript.test.mjs

@@ -0,0 +1,70 @@
+import assert from "node:assert/strict";
+import { test } from "../../../test/harness.mjs";
+import { parseTranscriptLine, parseTranscriptLines } from "../src/claude-transcript.js";
+
+function rejectionLine(toolUseId, phrase = "The user doesn't want to proceed with this tool use.") {
+  return JSON.stringify({
+    type: "user",
+    message: {
+      role: "user",
+      content: [{ type: "tool_result", tool_use_id: toolUseId, is_error: true, content: phrase }]
+    }
+  });
+}
+
+test("parseTranscriptLine detects a user-rejected tool result", () => {
+  assert.deepEqual(parseTranscriptLine(rejectionLine("toolu_1")), {
+    type: "tool_denied",
+    toolUseId: "toolu_1"
+  });
+});
+
+test("parseTranscriptLine ignores a normal tool error (not a rejection)", () => {
+  const line = JSON.stringify({
+    message: { content: [{ type: "tool_result", tool_use_id: "t", is_error: true, content: "command failed: exit 1" }] }
+  });
+  assert.equal(parseTranscriptLine(line), undefined);
+});
+
+test("parseTranscriptLine ignores successful results and other entries", () => {
+  const ok = JSON.stringify({
+    message: { content: [{ type: "tool_result", tool_use_id: "t", is_error: false, content: "done" }] }
+  });
+  const assistant = JSON.stringify({ message: { role: "assistant", content: [{ type: "text", text: "hi" }] } });
+  assert.equal(parseTranscriptLine(ok), undefined);
+  assert.equal(parseTranscriptLine(assistant), undefined);
+});
+
+test("parseTranscriptLine handles array-form tool_result content", () => {
+  const line = JSON.stringify({
+    message: {
+      content: [{
+        type: "tool_result",
+        tool_use_id: "toolu_2",
+        is_error: true,
+        content: [{ type: "text", text: "The user rejected this command." }]
+      }]
+    }
+  });
+  assert.deepEqual(parseTranscriptLine(line), { type: "tool_denied", toolUseId: "toolu_2" });
+});
+
+test("parseTranscriptLine never throws on malformed input", () => {
+  assert.equal(parseTranscriptLine("not json"), undefined);
+  assert.equal(parseTranscriptLine("{}"), undefined);
+  assert.equal(parseTranscriptLine(JSON.stringify({ message: { content: "x" } })), undefined);
+});
+
+test("parseTranscriptLines collects only denial events from a batch", () => {
+  const lines = [
+    JSON.stringify({ message: { role: "assistant", content: [{ type: "text", text: "ok" }] } }),
+    "",
+    rejectionLine("toolu_a"),
+    "garbage",
+    rejectionLine("toolu_b")
+  ];
+  assert.deepEqual(parseTranscriptLines(lines), [
+    { type: "tool_denied", toolUseId: "toolu_a" },
+    { type: "tool_denied", toolUseId: "toolu_b" }
+  ]);
+});

package/packages/app-state/src/state.js

@@ -12,11 +12,26 @@ export function createDefaultPositionState() {
     sessions: {},
     settings: {
       displayMode: "hybrid",
-      attachBubblesToTerminals: true
+      attachBubblesToTerminals: true,
+      claudeHooks: false
     }
   };
 }
 
+export function setClaudeHooksEnabled(state, enabled) {
+  return {
+    ...state,
+    settings: {
+      ...state.settings,
+      claudeHooks: Boolean(enabled)
+    }
+  };
+}
+
+export function getClaudeHooksEnabled(state) {
+  return Boolean(state?.settings?.claudeHooks);
+}
+
 export function updateGlobalPetPosition(state, position) {
   return {
     ...state,

package/packages/cli-core/src/claude-hook-injection.js

@@ -0,0 +1,42 @@
+// Resolves stable paths, builds the per-session Claude settings, and writes them
+// to a STABLE temp path. Both the command strings and the file path are kept
+// identical across sessions so Claude Code's hook-trust review (which would
+// otherwise block the interactive TUI) only has to be approved once. node version
+// managers (fnm) hand out a per-shell symlink for process.execPath that dies when
+// the launching shell exits, so we realpath it before baking it into the hook.
+import { realpathSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildClaudeHookSettings } from "../../adapters/src/claude-hooks.js";
+
+const DEFAULT_CLI_PATH = fileURLToPath(new URL("../../../apps/cli/src/haya-pet.js", import.meta.url));
+const SETTINGS_FILE = "haya-pet-claude-settings.json";
+
+export function injectClaudeHooks({ nodePath, cliPath } = {}) {
+  const resolvedNode = nodePath ?? safeRealpath(process.execPath);
+  const resolvedCli = cliPath ?? safeRealpath(DEFAULT_CLI_PATH);
+
+  const settings = buildClaudeHookSettings({
+    nodePath: resolvedNode,
+    cliPath: resolvedCli
+  });
+
+  // A fixed path with session-independent content: concurrent sessions just
+  // rewrite identical bytes, and the hooks stay "trusted" across launches.
+  const settingsPath = join(tmpdir(), SETTINGS_FILE);
+  writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf8");
+
+  // The settings file is stable and reusable on purpose — leaving it in place is
+  // what lets Claude remember the hooks are trusted. cleanup is a no-op kept for
+  // API symmetry with the caller's finally block.
+  return { settingsPath, cleanup: () => {} };
+}
+
+function safeRealpath(target) {
+  try {
+    return realpathSync(target);
+  } catch {
+    return target;
+  }
+}