@hayasaka7/haya-pet 0.2.4 → 0.2.6

package/apps/cli/test/haya-pet.test.mjs

@@ -483,6 +483,47 @@ test("codex hooks also start a transcript watcher for tool activity", async () =
   assert.ok(sent.every((message) => message.updatedAt === undefined || message.updatedAt === 42));
 });
 
+test("codex hooks also start a guardian-review watcher that reports review states", async () => {
+  const sent = [];
+  let fireReviewEvent;
+  let stopped = false;
+
+  await runAiPet(["run", "--client", "codex", "--", "codex"], {
+    cwd: process.cwd(),
+    env: { USERPROFILE: "C:\\Users\\A" },
+    now: () => 42,
+    heartbeatIntervalMs: 10,
+    send: async (message) => sent.push(message),
+    createStateFile: hooksStateFile(true),
+    injectCodexHooks: () => ({ profileName: "haya-pet", cleanup: () => {} }),
+    watchCodexTranscript: () => ({ stop: () => {} }),
+    watchCodexGuardianReviews: ({ onReviewEvent }) => {
+      fireReviewEvent = onReviewEvent;
+      return { stop: () => { stopped = true; } };
+    },
+    runGenericCommand: async (options) => {
+      fireReviewEvent({ type: "review_started" });
+      fireReviewEvent({ type: "review_finished", outcome: "allow" });
+      fireReviewEvent({ type: "review_started" });
+      fireReviewEvent({ type: "review_finished", outcome: "deny" });
+      // An unreadable verdict must not change the state (leave the cue as-is).
+      fireReviewEvent({ type: "review_finished", outcome: undefined });
+      return { sessionId: options.sessionId, pid: 1, exitCode: 0 };
+    }
+  });
+
+  assert.ok(stopped, "guardian watcher is stopped after the wrapped command exits");
+  const reviewStates = sent
+    .filter((message) => message.type === "state" && message.source === "client_log")
+    .map((message) => [message.state, message.summary]);
+  assert.deepEqual(reviewStates, [
+    ["reviewing", "agent reviewing approval"],
+    ["running_tool", "reviewer approved"],
+    ["reviewing", "agent reviewing approval"],
+    ["thinking", "reviewer denied"]
+  ]);
+});
+
 test("codex hooks are skipped (with a notice) when the user passes their own -p", async () => {
   const calls = [];
   let injected = 0;

package/apps/companion/README.md

@@ -1,11 +1,11 @@
-# Haya Pet Companion (Electron overlay)
+# HAYA Pet Companion (Electron overlay)
 
 The desktop overlay app for the AI CLI pet runtime. It hosts the daemon IPC
 server, renders the global pet, and shows the session bubbles. (A reply/approval
 "task talk window" is scaffolded but parked — see below.)
 
 > Most users never launch this directly: `haya-pet run` auto-starts it. This doc
-> covers its internals. For installing/using Haya Pet, see the
+> covers its internals. For installing/using HAYA Pet, see the
 > [root README](../../README.md) and [docs/architecture.md](../../docs/architecture.md).
 
 ## Architecture

package/apps/companion/src/main/index.js

@@ -15,7 +15,7 @@ import { clampScale } from "../../../../packages/pet-core/src/pet-scale.js";
 import { buildPetWindowOptions, PET_SIZE } from "./window-options.js";
 import { resolveSavedPosition } from "./display-manager.js";
 import { getPetScale, setPetScale, setSelectedPet, updateGlobalPetPosition } from "./position-store.js";
-import { buildTrayMenu } from "./tray-menu.js";
+import { buildTrayMenu, buildTrayTooltip } from "./tray-menu.js";
 import { createStateFile } from "./state-file.js";
 import { discoverPets } from "./pet-loader.js";
 
@@ -188,7 +188,7 @@ function clampPetLocal(local) {
 function createTray() {
   try {
     tray = new Tray(loadTrayIcon());
-    tray.setToolTip("Haya Pet — right-click to Quit");
+    tray.setToolTip(buildTrayTooltip());
   } catch (error) {
     // A failed tray must not take the whole app down; log and continue.
     console.error("tray unavailable:", error.message);

package/apps/companion/src/main/tray-menu.js

@@ -9,6 +9,10 @@ const DISPLAY_MODES = Object.freeze([
   { value: "hybrid", label: "Hybrid" }
 ]);
 
+export function buildTrayTooltip() {
+  return "HAYA Pet";
+}
+
 export function buildTrayMenu(state = {}) {
   const sessions = Array.isArray(state.sessions) ? state.sessions : [];
   const pets = Array.isArray(state.pets) ? state.pets : [];

package/apps/companion/src/renderer/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta http-equiv="Content-Security-Policy" content="default-src 'self' file:; img-src 'self' file: data:; style-src 'self' 'unsafe-inline';" />
-    <title>Haya Pet</title>
+    <title>HAYA Pet</title>
     <link rel="stylesheet" href="styles.css" />
   </head>
   <body>

package/apps/companion/test/tray-menu.test.mjs

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { test } from "../../../test/harness.mjs";
-import { buildTrayMenu } from "../src/main/tray-menu.js";
+import { buildTrayMenu, buildTrayTooltip } from "../src/main/tray-menu.js";
 
 const baseState = {
   petVisible: true,
@@ -46,3 +46,7 @@ test("reflects the attach-bubbles checkbox state", () => {
   assert.equal(buildTrayMenu(baseState).find((i) => i.id === "attach_bubbles").checked, true);
   assert.equal(buildTrayMenu({ ...baseState, attachBubblesToTerminals: false }).find((i) => i.id === "attach_bubbles").checked, false);
 });
+
+test("uses the HAYA Pet brand in the tray hover text", () => {
+  assert.equal(buildTrayTooltip(), "HAYA Pet");
+});

package/apps/pet-preview/index.html

@@ -3,13 +3,13 @@
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Haya Pet Preview</title>
+    <title>HAYA Pet Preview</title>
     <link rel="stylesheet" href="./src/preview.css">
   </head>
   <body>
     <main class="app-shell">
       <section class="toolbar" aria-label="Preview controls">
-        <h1 class="brand">Haya Pet Preview</h1>
+        <h1 class="brand">HAYA Pet Preview</h1>
         <label class="file-input">
           <span>Spritesheet</span>
           <input id="spritesheet-file" type="file" accept="image/png,image/webp">

package/docs/architecture.md

@@ -1,6 +1,6 @@
 # Architecture
 
-How Haya Pet is put together. For installing and using it, see the
+How HAYA Pet is put together. For installing and using it, see the
 [README](../README.md); this doc is for contributors and the curious.
 
 ## Pipeline
@@ -70,8 +70,14 @@ profile, so if the user already passes `-p/--profile`, injection is skipped with
 notice. Codex's hook command must be unquoted at the program position (it runs via
 `cmd /c`, which strips a leading quote) and its matchers can't use look-around
 (Rust regex) — see [known-issues.md](known-issues.md). Codex's L4 is **partial**:
-`PreToolUse`/`PermissionRequest` don't fire upstream yet, so only `thinking`/`idle`
-arrive today.
+`PreToolUse` doesn't fire upstream yet, so tool activity comes from an L3
+transcript watcher tailing the session rollout. `PermissionRequest` fires, but
+once at approval-request creation — before Codex routes the request to either
+the user or its guardian auto-reviewer ("Approve for me"), which never prompts
+the user at all. An L3 **guardian-trunk watcher** tails the guardian's own
+rollout (`source: {subagent:{other:"guardian"}}`, parented to the main thread)
+and refines the state: review running → `reviewing`, verdict allow →
+`running_tool`, verdict deny → `thinking`.
 
 Hooks alone can't see one moment: clients emit **no event when the user accepts a
 permission prompt** (denial and completion are observable; the accept click is

package/docs/known-issues.md

@@ -2,6 +2,52 @@
 
 Issues found in live use, with their current status.
 
+## ✅ Resolved: false "waiting for approval" while Codex auto-reviews an approval (Approve for me)
+
+- **Symptom:** Running Codex under the pet with the **"Approve for me"** preset
+  (`approvals_reviewer = auto_review`; the user's config had the legacy alias
+  `guardian_subagent`), the pet showed *waiting for approval* whenever an action
+  needed approval — even though Codex's guardian was reviewing it automatically
+  and the user was never asked anything. The false state lasted the whole review
+  (~8–30 s per request, up to Codex's 90 s review timeout) plus the approved
+  command's runtime.
+- **Root cause (verified against codex-rs 0.139.0 source + a live trunk
+  rollout):** Codex fires the `PermissionRequest` hook once, at approval-request
+  creation, **before** routing — and for guardian-routed requests the human
+  approval UI is *never* shown: a guardian `allow` lets the action proceed; a
+  guardian `deny` returns the rationale to the **model** as a rejected tool call
+  ("This action was rejected due to unacceptable risk. …"), so no human decision
+  is ever pending. Our Codex hook table mapped `PermissionRequest` →
+  `waiting_approval` unconditionally. No better hook exists: nothing fires on
+  guardian start/finish (the guardian session is `SubAgentSource::Other`, which
+  is excluded from Subagent hooks), and `GuardianAssessment` events are
+  explicitly not persisted to the main rollout (`rollout/src/policy.rs`).
+- **Fix:** an **L3 guardian-trunk watcher** (`codex-guardian-watcher.js` +
+  `adapters/codex-guardian.js`). The guardian runs as its own Codex session that
+  writes its own rollout under `~/.codex/sessions` — session_meta has
+  `source: {subagent: {other: "guardian"}}` and `parent_thread_id` = the main
+  thread; each review is one turn (`task_started` → `task_complete` with the
+  verdict JSON in `last_agent_message`, e.g. `{"outcome":"allow"}`). The watcher
+  binds the trunk to the wrapped session's main thread id and maps real events:
+  review turn starts → **reviewing**; verdict `allow` → **running_tool**
+  ("reviewer approved" — the action verifiably proceeds); verdict `deny` →
+  **thinking** ("reviewer denied" — the model received the rejection and keeps
+  working). An unreadable verdict reports nothing, so a pending cue is never
+  cleared on a guess. With `approvals_reviewer = "user"` ("Ask for approval")
+  there is no trunk and behavior is unchanged: `PermissionRequest` →
+  *waiting for approval* until the user decides (process-tree/denial detection
+  resolve it, as before).
+- **Known limitations (accepted):** (1) A ≤ ~1 s *waiting for approval* flicker
+  can precede *reviewing* (the hook fires immediately; the trunk poll is 700 ms).
+  (2) Reviews of a **collab subagent's** actions (multi-agent runs) have their
+  own trunks keyed to the subagent's thread and are not watched; a subagent's
+  `PermissionRequest` can still briefly show *waiting for approval* until the
+  next main-session event. (3) After a guardian deny the pet shows *thinking*,
+  not *waiting for approval* — by design: Codex resolves the request itself and
+  the model decides what to do next (it may ask the user in chat, which then
+  surfaces as turn-end *idle*). The TUI's passive `/approve` denial-override
+  picker is not a blocking prompt.
+
 ## ✅ Resolved: pet stuck on "waiting for approval" after a manual denial
 
 - **Symptom:** With Claude Code hooks enabled, denying a permission prompt left the
@@ -175,11 +221,17 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
     [openai/codex#16732](https://github.com/openai/codex/issues/16732)). Tool
     activity is covered by an L3 Codex transcript watcher that tails
     `~/.codex/sessions` JSONL: normal tools report `running_tool`, `apply_patch`
-    reports `editing_files`, and Haya Pet returns to `thinking` after active tool
-    calls drain. `PermissionRequest` (the *waiting for approval* cue — the
-    highest-value state) is **unconfirmed**; it likely depends on an
-    approval-required flow and needs a dedicated test before the feature is worth
-    wiring in.
+    reports `editing_files`, and HAYA Pet returns to `thinking` after active tool
+    calls drain.
+  - **`PermissionRequest` fires** (confirmed live on 0.139.0), but **once, at
+    approval-request creation, before routing** — under "Approve for me"
+    (`approvals_reviewer = auto_review` / legacy `guardian_subagent`) the user is
+    never actually prompted, so the hook alone over-reports *waiting for
+    approval*. An L3 **guardian-trunk watcher** tails the guardian reviewer's own
+    rollout (`source: {subagent:{other:"guardian"}}`, `parent_thread_id` = main
+    thread) and refines the state: review running → *reviewing*, verdict `allow`
+    → *running_tool*, verdict `deny` → *thinking*. See the resolved
+    false-waiting-for-approval entry above.
 - **Antigravity (`agy`)** — **not yet implemented** (no hook injection). Uses
   `--observe` or L1 lifecycle. A Gemini-schema hook adapter is a planned follow-up.
 - **Generic / unknown** — no hooks; PTY observation (`--observe`) or L1 lifecycle.
@@ -194,7 +246,7 @@ remains a possible follow-up.
 |---|---|---|
 | L1 | process wrapper | default; session lifecycle + exit code |
 | L4 | client hooks | opt-in via `haya-pet hooks on` (Claude Code full, Codex partial); reports through `haya-pet state …` |
-| L3 | client logs | Codex session JSONL watcher for tool activity; Claude denial recovery; future clients can add similar transcript adapters |
+| L3 | client logs | Codex session JSONL watcher for tool activity; Codex guardian-trunk watcher for auto-review status; Claude denial recovery; future clients can add similar transcript adapters |
 | L3 | process tree | approval-accept detection: a `waiting_approval` session flips to `running_tool` when the approved command verifiably starts under the client's pid |
 | L2 | PTY output scraping | opt-in via `--observe` (terminal-fidelity tradeoff) |
 

package/docs/publishing.md

@@ -1,6 +1,6 @@
 # Publishing
 
-How Haya Pet is released to npm. Most users never need this — see the
+How HAYA Pet is released to npm. Most users never need this — see the
 [README](../README.md) to install and use it.
 
 ## Release flow

package/docs/troubleshooting.md

@@ -16,7 +16,8 @@ deferred problems with known root causes.
 | Terminal scroll / Shift+Tab / backspace odd while a CLI runs under `haya-pet run` | Fixed — `haya-pet run` now uses native passthrough by default (full fidelity). If you opted into `--observe`, drop it. See [known-issues.md](known-issues.md). |
 | Pet shows only **idle/lifecycle** while **Claude Code** works | Live in-session status is opt-in: run `haya-pet hooks on` once (persisted). The first `haya-pet run` afterward shows a one-time Claude *review hooks* prompt — approve it. Also make sure the companion is running (`haya-pet start`). Check the toggle with `haya-pet hooks status`. |
 | Typing doesn't work / **Claude Code** TUI frozen under `haya-pet run` | You have hooks enabled and Claude is showing its *review hooks* trust prompt (approve it once), or your Claude is too old for `--settings`. Run `haya-pet hooks off` (or set `HAYA_PET_NO_HOOKS=1`) for native passthrough with lifecycle-only status — typing and Shift+Tab work normally. |
-| Pet shows only **idle/lifecycle** while **Codex** works | Live status is opt-in: run `haya-pet hooks on` once (persisted, global), then `haya-pet run --client codex -- codex`; approve Codex's one-time *review hooks* prompt. `thinking`/`idle` come from hooks and `running_tool`/`editing_files` from a transcript watcher; *waiting for approval* doesn't fire yet (upstream [openai/codex#16732](https://github.com/openai/codex/issues/16732)). |
+| Pet shows only **idle/lifecycle** while **Codex** works | Live status is opt-in: run `haya-pet hooks on` once (persisted, global), then `haya-pet run --client codex -- codex`; approve Codex's one-time *review hooks* prompt. `thinking`/`idle` come from hooks, `running_tool`/`editing_files` from a transcript watcher, and approval states from the `PermissionRequest` hook plus a guardian-review watcher. |
+| Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now shows **reviewing** during the assessment, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). |
 | **Codex** live status didn't turn on / you pass your own `-p`/`--profile` | Codex allows only one profile, so haya-pet skips hook injection when you supply your own and prints a notice. Drop your `-p` for that run to get live status, or accept lifecycle-only. |
 | Pet shows only **idle/lifecycle** while **Antigravity** (`agy`) works | Antigravity has no hook adapter yet. Add `--observe` for coarse PTY activity, or accept lifecycle-only status. |
 | Claude hooks fail with **"hook exited with code 1"** | The hook command must not bake an **fnm**/node-manager *per-shell* node path (`…\fnm_multishells\<pid>_…\node.exe`) that dies when the shell exits. haya-pet bakes the stable `realpath`-resolved node path into the temp settings instead. Update to the latest version. |

package/native/win-window-helper/Program.cs

@@ -1,4 +1,4 @@
-// Haya Pet — Windows window helper.
+// HAYA Pet - Windows window helper.
 //
 // Implements the line-delimited JSON helper protocol documented in
 // ../README.md. Reads one JSON request per line on stdin and writes one JSON

package/package.json

@@ -1,8 +1,30 @@
 {
   "name": "@hayasaka7/haya-pet",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "type": "module",
   "description": "Generic AI CLI pet runtime foundation.",
+  "keywords": [
+    "haya-pet",
+    "desktop-pet",
+    "virtual-pet",
+    "desktop-companion",
+    "ai",
+    "ai-agents",
+    "coding-agents",
+    "ai-cli",
+    "codex",
+    "codex-cli",
+    "claude-code",
+    "gemini-cli",
+    "aider",
+    "antigravity",
+    "electron",
+    "cli",
+    "terminal",
+    "developer-tools",
+    "local-first",
+    "productivity"
+  ],
   "license": "MIT",
   "author": "Ai Hayasaka",
   "repository": {

package/packages/adapters/src/codex-guardian.js

@@ -0,0 +1,131 @@
+// Pure parser for Codex guardian-review rollouts. When `approvals_reviewer` is
+// `auto_review` (legacy alias `guardian_subagent`, the TUI's "Approve for me"),
+// Codex routes approval requests to a guardian subagent instead of prompting the
+// user — the PermissionRequest hook still fires at request creation, but the
+// human approval UI never appears. The only persisted trace of the review is a
+// separate "guardian trunk" rollout under ~/.codex/sessions whose session_meta
+// carries source.subagent.other == "guardian" and parent_thread_id == the main
+// thread; each review is one turn there (task_started → task_complete with the
+// verdict JSON in last_agent_message). Verified against codex-cli 0.139.0
+// (codex-rs guardian/review_session.rs; rollout/src/policy.rs excludes the
+// GuardianAssessment events themselves from persistence).
+
+// Classify a rollout's first JSONL line (the session_meta record) so watchers
+// can tell main sessions, guardian review sessions, and other subagents apart.
+export function classifyCodexSessionMeta(line) {
+  let entry;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+
+  if (entry?.type !== "session_meta") {
+    return undefined;
+  }
+
+  const payload = entry.payload;
+  if (!payload || typeof payload !== "object") {
+    return undefined;
+  }
+
+  const threadId = typeof payload.id === "string" ? payload.id : undefined;
+  const parentThreadId =
+    typeof payload.parent_thread_id === "string" ? payload.parent_thread_id : undefined;
+
+  return { kind: resolveSessionKind(payload), threadId, parentThreadId };
+}
+
+function resolveSessionKind(payload) {
+  const subagentSource =
+    typeof payload.source === "object" && payload.source !== null
+      ? payload.source.subagent
+      : undefined;
+
+  if (typeof subagentSource === "object" && subagentSource !== null) {
+    if (subagentSource.other === "guardian") {
+      return "guardian";
+    }
+    return "subagent";
+  }
+
+  if (payload.thread_source === "subagent") {
+    return "subagent";
+  }
+
+  return "main";
+}
+
+// Parse one guardian-trunk JSONL line into a review lifecycle event. Each review
+// turn yields task_started (the guardian began assessing an approval request)
+// and task_complete (verdict in last_agent_message: `{"outcome":"allow"|"deny"}`,
+// optionally with risk_level/rationale). An unreadable verdict maps to
+// outcome: undefined so callers can leave the pet state untouched (safe: the
+// existing waiting cue stays up rather than being cleared on a guess).
+export function parseGuardianTranscriptLine(line, options = {}) {
+  let entry;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+
+  if (entry?.type !== "event_msg") {
+    return undefined;
+  }
+
+  // Same replay guard as the main transcript parser: skip records from before
+  // the current session, keep records without a parseable timestamp.
+  const minTimestampMs = options.minTimestampMs ?? 0;
+  if (minTimestampMs > 0 && typeof entry.timestamp === "string") {
+    const timestampMs = Date.parse(entry.timestamp);
+    if (Number.isFinite(timestampMs) && timestampMs < minTimestampMs) {
+      return undefined;
+    }
+  }
+
+  const payload = entry.payload;
+  if (!payload || typeof payload !== "object") {
+    return undefined;
+  }
+
+  if (payload.type === "task_started") {
+    return { type: "review_started" };
+  }
+
+  if (payload.type === "task_complete") {
+    return { type: "review_finished", outcome: parseVerdictOutcome(payload.last_agent_message) };
+  }
+
+  return undefined;
+}
+
+function parseVerdictOutcome(lastAgentMessage) {
+  if (typeof lastAgentMessage !== "string") {
+    return undefined;
+  }
+
+  let verdict;
+  try {
+    verdict = JSON.parse(lastAgentMessage);
+  } catch {
+    return undefined;
+  }
+
+  const outcome = verdict?.outcome;
+  return outcome === "allow" || outcome === "deny" ? outcome : undefined;
+}
+
+export function parseGuardianTranscriptLines(lines, options = {}) {
+  const events = [];
+  for (const line of lines) {
+    if (typeof line !== "string" || line.trim() === "") {
+      continue;
+    }
+    const event = parseGuardianTranscriptLine(line, options);
+    if (event) {
+      events.push(event);
+    }
+  }
+  return events;
+}

package/packages/adapters/src/codex-hooks.js

@@ -33,8 +33,17 @@
 //  - NOT FIRING (0.137): PreToolUse — so `running_tool` / `editing_files` never
 //    arrive in practice yet (upstream coverage gap, openai/codex#16732). The
 //    entries are kept (harmless no-ops) so they light up once Codex fixes it.
-//  - UNTESTED: PermissionRequest / PreCompact / SubagentStart|Stop (no approval /
-//    compaction / subagent occurred in the probe).
+//  - PermissionRequest (verified live on 0.139.0, semantics from codex-rs
+//    source): fires ONCE at approval-request creation, BEFORE the request is
+//    routed to the guardian auto-reviewer or the user. Under "Approve for me"
+//    (approvals_reviewer=auto_review, legacy alias guardian_subagent) the user
+//    is never prompted at all, so waiting_approval from this hook over-reports;
+//    the wrapper's codex-guardian-watcher refines it to reviewing /
+//    running_tool / thinking from the guardian's own rollout. The guardian
+//    fires NO hooks itself (SubAgentSource::Other is excluded from Subagent
+//    hooks), so these entries can't see it.
+//  - UNTESTED: PreCompact / SubagentStart|Stop (no compaction / subagent
+//    occurred in the probe).
 //
 // OPEN QUESTION (injection): unlike `claude --settings <file>`, Codex has no
 // per-invocation settings-file flag. Candidate non-mutating paths, best first:

package/packages/adapters/test/codex-guardian.test.mjs

@@ -0,0 +1,174 @@
+import assert from "node:assert/strict";
+import { test } from "../../../test/harness.mjs";
+import {
+  classifyCodexSessionMeta,
+  parseGuardianTranscriptLine,
+  parseGuardianTranscriptLines
+} from "../src/codex-guardian.js";
+
+function metaLine(payload) {
+  return JSON.stringify({ timestamp: "2026-06-12T01:36:41.556Z", type: "session_meta", payload });
+}
+
+test("classifyCodexSessionMeta identifies a main session", () => {
+  const line = metaLine({
+    id: "main-1",
+    parent_thread_id: null,
+    originator: "codex-tui",
+    source: "cli",
+    thread_source: "user"
+  });
+
+  assert.deepEqual(classifyCodexSessionMeta(line), {
+    kind: "main",
+    threadId: "main-1",
+    parentThreadId: undefined
+  });
+});
+
+test("classifyCodexSessionMeta identifies a guardian review session", () => {
+  const line = metaLine({
+    id: "guardian-1",
+    parent_thread_id: "main-1",
+    source: { subagent: { other: "guardian" } },
+    thread_source: "subagent"
+  });
+
+  assert.deepEqual(classifyCodexSessionMeta(line), {
+    kind: "guardian",
+    threadId: "guardian-1",
+    parentThreadId: "main-1"
+  });
+});
+
+test("classifyCodexSessionMeta identifies non-guardian subagent sessions", () => {
+  const bySource = metaLine({
+    id: "agent-1",
+    parent_thread_id: "main-1",
+    source: { subagent: { other: "collab" } }
+  });
+  const byThreadSource = metaLine({
+    id: "agent-2",
+    parent_thread_id: "main-1",
+    source: "cli",
+    thread_source: "subagent"
+  });
+
+  assert.equal(classifyCodexSessionMeta(bySource).kind, "subagent");
+  assert.equal(classifyCodexSessionMeta(byThreadSource).kind, "subagent");
+});
+
+test("classifyCodexSessionMeta rejects non-meta and malformed lines", () => {
+  assert.equal(classifyCodexSessionMeta("not json"), undefined);
+  assert.equal(classifyCodexSessionMeta("{}"), undefined);
+  assert.equal(
+    classifyCodexSessionMeta(JSON.stringify({ type: "response_item", payload: { type: "message" } })),
+    undefined
+  );
+  assert.equal(classifyCodexSessionMeta(metaLine(null)), undefined);
+});
+
+test("parseGuardianTranscriptLine maps task_started to review_started", () => {
+  const line = JSON.stringify({
+    timestamp: "2026-06-12T01:36:41.557Z",
+    type: "event_msg",
+    payload: { type: "task_started", turn_id: "turn-1" }
+  });
+
+  assert.deepEqual(parseGuardianTranscriptLine(line), { type: "review_started" });
+});
+
+test("parseGuardianTranscriptLine extracts the verdict from task_complete", () => {
+  const allow = JSON.stringify({
+    type: "event_msg",
+    payload: { type: "task_complete", turn_id: "turn-1", last_agent_message: '{"outcome":"allow"}' }
+  });
+  const deny = JSON.stringify({
+    type: "event_msg",
+    payload: {
+      type: "task_complete",
+      turn_id: "turn-2",
+      last_agent_message:
+        '{"risk_level":"high","user_authorization":"low","outcome":"deny","rationale":"too risky"}'
+    }
+  });
+
+  assert.deepEqual(parseGuardianTranscriptLine(allow), { type: "review_finished", outcome: "allow" });
+  assert.deepEqual(parseGuardianTranscriptLine(deny), { type: "review_finished", outcome: "deny" });
+});
+
+test("parseGuardianTranscriptLine reports an unknown outcome when the verdict is unreadable", () => {
+  const garbled = JSON.stringify({
+    type: "event_msg",
+    payload: { type: "task_complete", turn_id: "turn-1", last_agent_message: "I think it is fine" }
+  });
+  const missing = JSON.stringify({
+    type: "event_msg",
+    payload: { type: "task_complete", turn_id: "turn-1" }
+  });
+  const unexpected = JSON.stringify({
+    type: "event_msg",
+    payload: { type: "task_complete", turn_id: "turn-1", last_agent_message: '{"outcome":"maybe"}' }
+  });
+
+  assert.deepEqual(parseGuardianTranscriptLine(garbled), { type: "review_finished", outcome: undefined });
+  assert.deepEqual(parseGuardianTranscriptLine(missing), { type: "review_finished", outcome: undefined });
+  assert.deepEqual(parseGuardianTranscriptLine(unexpected), { type: "review_finished", outcome: undefined });
+});
+
+test("parseGuardianTranscriptLine ignores unrelated and malformed records", () => {
+  assert.equal(parseGuardianTranscriptLine("not json"), undefined);
+  assert.equal(
+    parseGuardianTranscriptLine(
+      JSON.stringify({ type: "event_msg", payload: { type: "token_count" } })
+    ),
+    undefined
+  );
+  assert.equal(
+    parseGuardianTranscriptLine(
+      JSON.stringify({ type: "response_item", payload: { type: "message", role: "assistant" } })
+    ),
+    undefined
+  );
+});
+
+test("parseGuardianTranscriptLine skips records from before the session start", () => {
+  const old = JSON.stringify({
+    timestamp: "2026-06-12T01:00:00.000Z",
+    type: "event_msg",
+    payload: { type: "task_started", turn_id: "turn-0" }
+  });
+  const fresh = JSON.stringify({
+    timestamp: "2026-06-12T02:00:00.000Z",
+    type: "event_msg",
+    payload: { type: "task_started", turn_id: "turn-1" }
+  });
+  const untimestamped = JSON.stringify({
+    type: "event_msg",
+    payload: { type: "task_started", turn_id: "turn-2" }
+  });
+  const minTimestampMs = Date.parse("2026-06-12T01:30:00.000Z");
+
+  assert.equal(parseGuardianTranscriptLine(old, { minTimestampMs }), undefined);
+  assert.deepEqual(parseGuardianTranscriptLine(fresh, { minTimestampMs }), { type: "review_started" });
+  assert.deepEqual(parseGuardianTranscriptLine(untimestamped, { minTimestampMs }), {
+    type: "review_started"
+  });
+});
+
+test("parseGuardianTranscriptLines collects events and skips blank lines", () => {
+  const lines = [
+    "",
+    JSON.stringify({ type: "event_msg", payload: { type: "task_started", turn_id: "t1" } }),
+    "   ",
+    JSON.stringify({
+      type: "event_msg",
+      payload: { type: "task_complete", turn_id: "t1", last_agent_message: '{"outcome":"allow"}' }
+    })
+  ];
+
+  assert.deepEqual(parseGuardianTranscriptLines(lines), [
+    { type: "review_started" },
+    { type: "review_finished", outcome: "allow" }
+  ]);
+});