@hayasaka7/haya-pet 0.3.10 → 0.3.11

package/CHANGELOG.md

@@ -7,6 +7,17 @@ All notable changes to HAYA Pet are documented here. This project adheres to
 > 0.2.0 npm publish; they are listed under 0.2.1, which is the first version that
 > ships them.
 
+## [0.3.11]
+
+### Fixed
+- **Codex live-status hooks now work with custom profiles.** HAYA Pet no longer
+  injects its own `-p haya-pet` profile or skips hooks when the wrapped Codex
+  command already has `-p` / `--profile`. Instead it merges stable HAYA-managed
+  hook entries into `$CODEX_HOME/hooks.json`, preserving any existing user hooks
+  and leaving profile args such as `--profile fugu` untouched. The wrapper still
+  resolves profile-specific `approvals_reviewer` settings so approval status
+  matches the selected Codex profile.
+
 ## [0.3.10]
 
 ### Fixed

package/README.md

@@ -193,6 +193,12 @@ resolved `approvals_reviewer` setting, and transcript watchers report tool/file
 activity plus guardian-review outcomes. With **"Approve for me"** the pet shows
 *reviewing* immediately; *waiting for approval* is reserved for Codex's manual
 "Ask for approval" mode.
+
+Codex custom profiles are preserved. HAYA Pet installs its live-status hooks in
+`$CODEX_HOME/hooks.json` instead of passing its own `-p` profile, so launches such
+as `haya-pet run --client codex -- codex --profile fugu` keep both the selected
+Codex profile and HAYA live status.
+
 Per-tool `PreToolUse` hooks still depend on an upstream Codex gap
 ([openai/codex#16732](https://github.com/openai/codex/issues/16732)); the
 transcript watcher covers that in the meantime.

package/apps/cli/src/haya-pet.js

@@ -219,8 +219,10 @@ function resolveCodexApprovalsReviewer(options = {}) {
 
   const home = options.codexHome ?? env.CODEX_HOME ?? resolveHomeCodexDir(options.homeDir, env);
   const readFile = options.readFile ?? readFileSync;
+  const profileName = findCodexProfileInArgs(options.childArgs ?? []);
+  const fromProfile = profileName ? readCodexApprovalsReviewerFromProfile(home, profileName, readFile) : undefined;
   const fromConfig = readCodexApprovalsReviewerFromConfig(home, readFile);
-  return fromConfig ?? "user";
+  return fromProfile ?? fromConfig ?? "user";
 }
 
 function resolveHomeCodexDir(homeDir, env) {
@@ -250,12 +252,49 @@ function findCodexApprovalsReviewerInArgs(args) {
   return reviewer;
 }
 
+function findCodexProfileInArgs(args) {
+  let profileName;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    let value;
+    if (arg === "-p" || arg === "--profile") {
+      value = args[index + 1];
+      index += 1;
+    } else if (arg.startsWith("--profile=")) {
+      value = arg.slice("--profile=".length);
+    } else if (arg.startsWith("-p=")) {
+      value = arg.slice("-p=".length);
+    } else if (arg.startsWith("-p") && arg.length > 2) {
+      value = arg.slice(2);
+    }
+
+    if (isCodexProfileName(value)) {
+      profileName = value;
+    }
+  }
+  return profileName;
+}
+
+function isCodexProfileName(value) {
+  return typeof value === "string" && /^[A-Za-z0-9_-]+$/.test(value);
+}
+
+function readCodexApprovalsReviewerFromProfile(codexHome, profileName, readFile) {
+  if (!codexHome || !isCodexProfileName(profileName)) {
+    return undefined;
+  }
+  return readCodexApprovalsReviewerFromFile(join(codexHome, `${profileName}.config.toml`), readFile);
+}
 function readCodexApprovalsReviewerFromConfig(codexHome, readFile) {
   if (!codexHome) {
     return undefined;
   }
+  return readCodexApprovalsReviewerFromFile(join(codexHome, "config.toml"), readFile);
+}
+
+function readCodexApprovalsReviewerFromFile(path, readFile) {
   try {
-    return parseTopLevelApprovalsReviewer(readFile(join(codexHome, "config.toml"), "utf8"));
+    return parseTopLevelApprovalsReviewer(readFile(path, "utf8"));
   } catch {
     return undefined;
   }
@@ -407,162 +446,154 @@ async function runRunCommand(parsed, dependencies) {
     };
   }
 
-  // Codex: no `--settings` equivalent, so inject a stable profile and add
-  // `-p <name>` at the FRONT (a global flag must precede any subcommand). Codex
-  // takes only one profile, so if the user already passes their own -p/--profile
-  // we skip injection and say so rather than clobber their choice. Codex
+  // Codex: no `--settings` equivalent, so install stable user-level hooks in
+  // CODEX_HOME/hooks.json. Codex loads user hooks alongside any selected
+  // -p/--profile, so the wrapper never consumes the user's single profile slot.
   // PreToolUse is not reliable, so a transcript watcher supplies tool activity.
   const codexHooksOn = hooksOn && parsed.clientId === "codex";
   if (codexHooksOn) {
-    if (hasProfileArg(parsed.childArgs)) {
-      print(
-        "haya-pet: Codex live-status hooks skipped — you passed your own -p/--profile (Codex allows only one)."
-      );
-    } else {
-      const injected = injectCodexHooks();
-      childArgs = ["-p", injected.profileName, ...parsed.childArgs];
-      childEnv = {
-        ...env,
-        HAYA_PET_SESSION_ID: sessionId,
-        HAYA_PET_CODEX_APPROVAL_REVIEWER: resolveCodexApprovalsReviewer({
-          childArgs: parsed.childArgs,
-          env,
-          homeDir: dependencies.homeDir,
-          codexHome: dependencies.codexHome,
-          readFile: dependencies.readFile
-        })
-      };
-      cleanup = injected.cleanup;
-
-      // Pin both Codex watchers to THIS session's rollout via the
-      // session->transcript link the `haya-pet state` reporter records from the
-      // hook payload's transcript_path, instead of guessing newest-by-mtime (which
-      // leaks a concurrent same-cwd session's activity/interrupts).
-      const sessionDir = resolveSessionDir(dependencies, env);
-
-      const activeToolCalls = new Set();
-      const watcher = watchCodexTranscript({
+    const injected = injectCodexHooks();
+    childEnv = {
+      ...env,
+      HAYA_PET_SESSION_ID: sessionId,
+      HAYA_PET_CODEX_APPROVAL_REVIEWER: resolveCodexApprovalsReviewer({
+        childArgs: parsed.childArgs,
+        env,
         homeDir: dependencies.homeDir,
-        sessionsRoot: dependencies.codexSessionsRoot,
-        cwd,
-        startedAt: now(),
-        sessionId,
-        sessionDir,
-        onToolEvent: (event) => {
-          hookDebugLog(env, now, {
-            source: "codex_transcript",
-            event: event.type,
-            toolCallId: event.toolCallId,
-            toolName: event.toolName,
-            state: event.state
-          });
-
-          // Esc-interrupt fires no Stop hook, so without this the pet stays stuck
-          // on "thinking"/"running" until the stale sweep.
-          if (event.type === "turn_aborted") {
-            activeToolCalls.clear();
-            messageSender
-              .send({
-                type: "state",
-                sessionId,
-                state: "interrupted",
-                summary: "interrupted",
-                confidence: 0.9,
-                source: "client_log",
-                updatedAt: now()
-              })
-              .catch(() => {});
-            return;
-          }
+        codexHome: dependencies.codexHome,
+        readFile: dependencies.readFile
+      })
+    };
+    cleanup = injected.cleanup;
 
-          if (event.type === "tool_started") {
-            activeToolCalls.add(event.toolCallId);
-            messageSender
-              .send({
-                type: "state",
-                sessionId,
-                state: event.state,
-                summary: event.toolName,
-                confidence: 0.85,
-                source: "client_log",
-                updatedAt: now()
-              })
-              .catch(() => {});
-            return;
-          }
+    // Pin both Codex watchers to THIS session's rollout via the
+    // session->transcript link the `haya-pet state` reporter records from the
+    // hook payload's transcript_path, instead of guessing newest-by-mtime (which
+    // leaks a concurrent same-cwd session's activity/interrupts).
+    const sessionDir = resolveSessionDir(dependencies, env);
 
-          if (event.type === "tool_finished") {
-            activeToolCalls.delete(event.toolCallId);
-            if (activeToolCalls.size === 0) {
-              messageSender
-                .send({
-                  type: "state",
-                  sessionId,
-                  state: "thinking",
-                  confidence: 0.85,
-                  source: "client_log",
-                  updatedAt: now()
-                })
-                .catch(() => {});
-            }
-          }
+    const activeToolCalls = new Set();
+    const watcher = watchCodexTranscript({
+      homeDir: dependencies.homeDir,
+      sessionsRoot: dependencies.codexSessionsRoot,
+      cwd,
+      startedAt: now(),
+      sessionId,
+      sessionDir,
+      onToolEvent: (event) => {
+        hookDebugLog(env, now, {
+          source: "codex_transcript",
+          event: event.type,
+          toolCallId: event.toolCallId,
+          toolName: event.toolName,
+          state: event.state
+        });
+
+        // Esc-interrupt fires no Stop hook, so without this the pet stays stuck
+        // on "thinking"/"running" until the stale sweep.
+        if (event.type === "turn_aborted") {
+          activeToolCalls.clear();
+          messageSender
+            .send({
+              type: "state",
+              sessionId,
+              state: "interrupted",
+              summary: "interrupted",
+              confidence: 0.9,
+              source: "client_log",
+              updatedAt: now()
+            })
+            .catch(() => {});
+          return;
         }
-      });
-      const previousStopWatcher = stopWatcher;
-      stopWatcher = () => {
-        watcher.stop();
-        previousStopWatcher();
-      };
-
-      // With "Approve for me" (approvals_reviewer=auto_review, legacy alias
-      // guardian_subagent), Codex routes approval requests to a guardian
-      // subagent and never shows the human approval UI — yet the
-      // PermissionRequest hook still fires at request creation. The hook's
-      // reporter uses the resolved approvals reviewer config: auto-review
-      // reports reviewing immediately, while manual review reports waiting.
-      // The guardian's own rollout is the only observable record of the
-      // review, so tail it: a review turn starting proves the agent is
-      // reviewing; an "allow" verdict proves the action proceeds; a "deny"
-      // verdict goes back to the model, which keeps working. An unreadable
-      // verdict reports nothing — a pending cue is never cleared on a guess.
-      const guardianWatcher = watchCodexGuardianReviews({
-        homeDir: dependencies.homeDir,
-        sessionsRoot: dependencies.codexSessionsRoot,
-        cwd,
-        startedAt: now(),
-        sessionId,
-        sessionDir,
-        onReviewEvent: (event) => {
-          hookDebugLog(env, now, {
-            source: "codex_guardian",
-            event: event.type,
-            outcome: event.outcome
-          });
-
-          const report = resolveGuardianStateReport(event);
-          if (!report) {
-            return;
-          }
+
+        if (event.type === "tool_started") {
+          activeToolCalls.add(event.toolCallId);
           messageSender
             .send({
               type: "state",
               sessionId,
-              state: report.state,
-              summary: report.summary,
+              state: event.state,
+              summary: event.toolName,
               confidence: 0.85,
               source: "client_log",
               updatedAt: now()
             })
             .catch(() => {});
+          return;
         }
-      });
-      const stopWithoutGuardian = stopWatcher;
-      stopWatcher = () => {
-        guardianWatcher.stop();
-        stopWithoutGuardian();
-        removeSessionTranscriptLink({ sessionDir, sessionId });
-      };
-    }
+
+        if (event.type === "tool_finished") {
+          activeToolCalls.delete(event.toolCallId);
+          if (activeToolCalls.size === 0) {
+            messageSender
+              .send({
+                type: "state",
+                sessionId,
+                state: "thinking",
+                confidence: 0.85,
+                source: "client_log",
+                updatedAt: now()
+              })
+              .catch(() => {});
+          }
+        }
+      }
+    });
+    const previousStopWatcher = stopWatcher;
+    stopWatcher = () => {
+      watcher.stop();
+      previousStopWatcher();
+    };
+
+    // With "Approve for me" (approvals_reviewer=auto_review, legacy alias
+    // guardian_subagent), Codex routes approval requests to a guardian
+    // subagent and never shows the human approval UI — yet the
+    // PermissionRequest hook still fires at request creation. The hook's
+    // reporter uses the resolved approvals reviewer config: auto-review
+    // reports reviewing immediately, while manual review reports waiting.
+    // The guardian's own rollout is the only observable record of the
+    // review, so tail it: a review turn starting proves the agent is
+    // reviewing; an "allow" verdict proves the action proceeds; a "deny"
+    // verdict goes back to the model, which keeps working. An unreadable
+    // verdict reports nothing — a pending cue is never cleared on a guess.
+    const guardianWatcher = watchCodexGuardianReviews({
+      homeDir: dependencies.homeDir,
+      sessionsRoot: dependencies.codexSessionsRoot,
+      cwd,
+      startedAt: now(),
+      sessionId,
+      sessionDir,
+      onReviewEvent: (event) => {
+        hookDebugLog(env, now, {
+          source: "codex_guardian",
+          event: event.type,
+          outcome: event.outcome
+        });
+
+        const report = resolveGuardianStateReport(event);
+        if (!report) {
+          return;
+        }
+        messageSender
+          .send({
+            type: "state",
+            sessionId,
+            state: report.state,
+            summary: report.summary,
+            confidence: 0.85,
+            source: "client_log",
+            updatedAt: now()
+          })
+          .catch(() => {});
+      }
+    });
+    const stopWithoutGuardian = stopWatcher;
+    stopWatcher = () => {
+      guardianWatcher.stop();
+      stopWithoutGuardian();
+      removeSessionTranscriptLink({ sessionDir, sessionId });
+    };
   }
 
   try {
@@ -629,13 +660,6 @@ function isTruthyFlag(value) {
   return value === "1" || value === "true";
 }
 
-// Detect a user-supplied Codex profile flag so we don't clobber it: -p, --profile,
-// or the `--profile=foo` / `-p=foo` forms.
-function hasProfileArg(args) {
-  return args.some(
-    (arg) => arg === "-p" || arg === "--profile" || arg.startsWith("--profile=") || arg.startsWith("-p=")
-  );
-}
 
 function createConfigStateFile(dependencies) {
   const paths = getDefaultPaths({

package/apps/cli/test/haya-pet.test.mjs

@@ -537,7 +537,7 @@ test("hooks command parses and persists the toggle", async () => {
   assert.ok(lines.some((l) => l.includes("on")));
 });
 
-test("persisted `hooks on` injects a Codex profile via -p at the front of args", async () => {
+test("persisted `hooks on` installs Codex hooks without consuming the profile slot", async () => {
   const calls = [];
   let injected = 0;
   await runAiPet(["run", "--client", "codex", "--", "codex"], {
@@ -546,7 +546,7 @@ test("persisted `hooks on` injects a Codex profile via -p at the front of args",
     heartbeatIntervalMs: 10,
     send: async () => {},
     createStateFile: hooksStateFile(true),
-    injectCodexHooks: () => { injected += 1; return { profileName: "haya-pet", cleanup: () => {} }; },
+    injectCodexHooks: () => { injected += 1; return { hooksPath: "C:\\Users\\A\\.codex\\hooks.json", cleanup: () => {} }; },
     runGenericCommand: async (options) => {
       calls.push(options);
       return { sessionId: options.sessionId, pid: 1, exitCode: 0 };
@@ -554,7 +554,8 @@ test("persisted `hooks on` injects a Codex profile via -p at the front of args",
   });
 
   assert.equal(injected, 1, "config preference enables Codex hooks");
-  assert.deepEqual(calls[0].args, ["-p", "haya-pet"], "profile flag goes at the front");
+  assert.deepEqual(calls[0].args, [], "Codex args stay untouched");
+  assert.equal(calls[0].env.HAYA_PET_SESSION_ID, calls[0].sessionId);
   assert.equal(calls[0].env.HAYA_PET_CODEX_APPROVAL_REVIEWER, "user");
 });
 
@@ -577,6 +578,27 @@ test("codex hooks pass auto-review config to the PermissionRequest reporter", as
   assert.equal(calls[0].env.HAYA_PET_CODEX_APPROVAL_REVIEWER, "auto_review");
 });
 
+test("codex hooks read approvals reviewer from the selected profile config", async () => {
+  const calls = [];
+  await runAiPet(["run", "--client", "codex", "--", "codex", "--profile=fugu"], {
+    cwd: process.cwd(),
+    env: { USERPROFILE: "C:\\Users\\A" },
+    heartbeatIntervalMs: 10,
+    send: async () => {},
+    createStateFile: hooksStateFile(true),
+    injectCodexHooks: () => ({ hooksPath: "C:\\Users\\A\\.codex\\hooks.json", cleanup: () => {} }),
+    readFile: (path) => String(path).endsWith("fugu.config.toml")
+      ? 'approvals_reviewer = "auto_review"\n'
+      : 'approvals_reviewer = "user"\n',
+    runGenericCommand: async (options) => {
+      calls.push(options);
+      return { sessionId: options.sessionId, pid: 1, exitCode: 0 };
+    }
+  });
+
+  assert.deepEqual(calls[0].args, ["--profile=fugu"], "profile arg is untouched");
+  assert.equal(calls[0].env.HAYA_PET_CODEX_APPROVAL_REVIEWER, "auto_review");
+});
 test("codex hooks also start a transcript watcher for tool activity", async () => {
   const sent = [];
   let fireToolEvent;
@@ -658,9 +680,10 @@ test("codex hooks also start a guardian-review watcher that reports review state
   ]);
 });
 
-test("codex hooks are skipped (with a notice) when the user passes their own -p", async () => {
+test("codex hooks preserve user profile args and still wire live status", async () => {
   const calls = [];
   let injected = 0;
+  let watched = 0;
   const lines = [];
   await runAiPet(["run", "--client", "codex", "--", "codex", "-p", "mine"], {
     cwd: process.cwd(),
@@ -669,16 +692,19 @@ test("codex hooks are skipped (with a notice) when the user passes their own -p"
     send: async () => {},
     createStateFile: hooksStateFile(true),
     print: (line) => lines.push(line),
-    injectCodexHooks: () => { injected += 1; return { profileName: "haya-pet", cleanup: () => {} }; },
+    injectCodexHooks: () => { injected += 1; return { hooksPath: "C:\\Users\\A\\.codex\\hooks.json", cleanup: () => {} }; },
+    watchCodexTranscript: () => { watched += 1; return { stop: () => {} }; },
     runGenericCommand: async (options) => {
       calls.push(options);
       return { sessionId: options.sessionId, pid: 1, exitCode: 0 };
     }
   });
 
-  assert.equal(injected, 0, "user's profile is respected — no injection");
+  assert.equal(injected, 1, "hooks are installed even when Codex gets a user profile");
+  assert.equal(watched, 1, "transcript watcher still starts for profiled runs");
   assert.deepEqual(calls[0].args, ["-p", "mine"], "user args untouched");
-  assert.ok(lines.some((l) => /skipped/i.test(l)), "user is told why");
+  assert.equal(calls[0].env.HAYA_PET_SESSION_ID, calls[0].sessionId);
+  assert.ok(!lines.some((l) => /skipped/i.test(l)), "profile runs no longer skip hooks");
 });
 
 test("codex does NOT inject hooks by default (safe out-of-box)", async () => {

package/docs/architecture.md

@@ -63,11 +63,10 @@ in-session activity through the shared, client-agnostic `haya-pet state` command
 
 The injection mechanism differs per client. **Claude Code** takes a stable
 `claude --settings <file>`. **Codex** has no per-invocation settings flag, so the
-wrapper writes a stable `$CODEX_HOME/haya-pet.config.toml` profile and prepends
-`-p haya-pet` to the codex args (a profile layers on top of the user's base config,
-leaving auth/model/MCP intact, and is inert otherwise). Codex allows only one
-profile, so if the user already passes `-p/--profile`, injection is skipped with a
-notice. Codex's hook command must be unquoted at the program position (it runs via
+wrapper merges stable user-level hooks into `$CODEX_HOME/hooks.json`. Codex loads
+that hook source alongside any selected `-p/--profile`, so custom profiles remain
+untouched while HAYA Pet still sets the per-session environment and watchers.
+Codex's hook command must be unquoted at the program position (it runs via
 `cmd /c`, which strips a leading quote) and its matchers can't use look-around
 (Rust regex) — see [known-issues.md](known-issues.md). Codex's L4 is **partial**:
 `PreToolUse` doesn't fire upstream yet, so tool activity comes from an L3

package/docs/known-issues.md

@@ -259,15 +259,13 @@ Issues found in live use, with their current status.
 
 - **Symptom:** Even after approving HAYA Pet's Codex hooks once, every new
   `haya-pet run --client codex` showed Codex's hook review prompt again.
-- **Root cause:** HAYA Pet correctly wrote a stable
-  `$CODEX_HOME/haya-pet.config.toml` profile, but Codex stores the user's hook
-  trust decisions back into that same profile under `[hooks.state]` as
-  `trusted_hash` entries. The injector rewrote the entire profile on every
-  launch, so it deleted Codex's trust cache before Codex could reuse it.
-- **Fix:** The Codex hook injector now regenerates the HAYA-managed hook tables
-  while preserving the Codex-managed `[hooks.state]` tables from the existing
-  profile. Users may need to approve once after updating; after that, unchanged
-  hook commands should stay trusted.
+- **Root cause:** Older builds wrote a stable `$CODEX_HOME/haya-pet.config.toml`
+  profile, but Codex stored hook trust decisions back into that same profile
+  under `[hooks.state]`. Rewriting the profile on launch deleted that trust cache.
+- **Fix:** The Codex hook injector now writes stable commands into
+  `$CODEX_HOME/hooks.json` and preserves existing user hooks while refreshing
+  HAYA-managed entries. Users may need to approve once after updating; after
+  that, unchanged hook commands should stay trusted.
 
 ## ✅ Resolved: Codex pet looked busy immediately after startup
 
@@ -481,9 +479,9 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
   launch — see the resolved note below). `--observe` is a separate PTY opt-in for
   non-interactive runs (terminal-fidelity tradeoff).
 - **Codex** — **implemented (partial).** Opt-in via the global `haya-pet hooks on`;
-  the wrapper injects `packages/adapters/src/codex-hooks.js` as a stable
-  `$CODEX_HOME/haya-pet.config.toml` profile and launches `codex -p haya-pet`
-  (`packages/cli-core/src/codex-hook-injection.js`). Falls back to `--observe` / L1
+  the wrapper injects `packages/adapters/src/codex-hooks.js` as stable user-level
+  hooks in `$CODEX_HOME/hooks.json` (`packages/cli-core/src/codex-hook-injection.js`).
+  Custom Codex `-p/--profile` args remain untouched. Falls back to `--observe` / L1
   when not enabled. Findings (verified against `codex-cli` 0.137.0 on Windows):
   - **Mechanism fits.** Codex has a lifecycle-hooks system (`[[hooks.<Event>]]` in
     `config.toml` or a `hooks.json`), with the `hooks` feature flag `stable` and ON
@@ -497,11 +495,10 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
     signal (`SubagentStop` is mid-turn → stays *thinking*). `PermissionRequest`
     exists, so the approval cue is reachable.
   - **Injection differs** — Codex has no `claude --settings <file>` equivalent.
-    Candidate non-mutating paths: `codex -p haya-pet` layering a generated
-    `$CODEX_HOME/haya-pet.config.toml` profile on top of the user's base config, or a
-    `hooks.json` next to the active config layer. Codex has its own *review hooks*
-    trust prompt (bypass: `--dangerously-bypass-hook-trust`), so the same one-time
-    trust UX as Claude applies.
+    HAYA Pet uses `$CODEX_HOME/hooks.json`, merging HAYA-managed entries with any
+    existing user hooks. Codex loads that hook source alongside selected profiles,
+    and has its own *review hooks* trust prompt (bypass:
+    `--dangerously-bypass-hook-trust`), so the same one-time trust UX as Claude applies.
   - **Windows command quoting (fixed in the adapter):** Codex runs a hook `command`
     via `cmd /c "<cmd>"`, which strips a **leading** quote — so Claude's
     `"<node>" "<cli>" …` form dies with *"hook exited with code 1"*. The Codex

package/docs/troubleshooting.md

@@ -18,10 +18,10 @@ deferred problems with known root causes.
 | Typing doesn't work / **Claude Code** TUI frozen under `haya-pet run` | You have hooks enabled and Claude is showing its *review hooks* trust prompt (approve it once), or your Claude is too old for `--settings`. Run `haya-pet hooks off` (or set `HAYA_PET_NO_HOOKS=1`) for native passthrough with lifecycle-only status — typing and Shift+Tab work normally. |
 | Pet changes status after a **Claude Code** subagent finishes, even though the main agent already stopped | Fixed — Claude `SubagentStop` is ignored because it is not a reliable main-turn state. Update to the latest version and restart the wrapped Claude session so the new hook settings are used. |
 | Pet shows only **idle/lifecycle** while **Codex** works | Live status is opt-in: run `haya-pet hooks on` once (persisted, global), then `haya-pet run --client codex -- codex`; approve Codex's one-time *review hooks* prompt. `thinking`/`idle` come from hooks, `running_tool`/`editing_files` from a transcript watcher, and approval states from the `PermissionRequest` hook plus a guardian-review watcher. |
-| **Codex** asks to review HAYA hooks on every launch | Fixed — update to the latest version, then approve once more. Codex writes trusted hook hashes into `$CODEX_HOME/haya-pet.config.toml` under `[hooks.state]`; HAYA Pet now preserves that Codex-managed block when refreshing the hook profile. |
+| **Codex** asks to review HAYA hooks on every launch | Fixed — update to the latest version, then approve once more. HAYA Pet now writes stable hook commands into `$CODEX_HOME/hooks.json` and preserves existing user hooks when refreshing that file. |
 | Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now reports **reviewing** from the permission hook itself, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). Restart the wrapped Codex session after updating so Codex reloads the changed hook command. |
 | Pet shows **shell_command** or **thinking** right after starting Codex, before you prompt it | Fixed — the Codex transcript and guardian watchers now ignore rollouts whose `session_meta.timestamp` predates the current wrapper launch, so another active Codex session cannot drive this pet's status. Restart the wrapped Codex session after updating. |
-| **Codex** live status didn't turn on / you pass your own `-p`/`--profile` | Codex allows only one profile, so haya-pet skips hook injection when you supply your own and prints a notice. Drop your `-p` for that run to get live status, or accept lifecycle-only. |
+| **Codex** live status didn't turn on with a custom `-p`/`--profile` | Fixed — HAYA Pet installs Codex hooks through `$CODEX_HOME/hooks.json`, so profile args are preserved. Run `haya-pet hooks on`, restart the wrapped Codex session, and approve the one-time hook review if Codex asks. |
 | Pet shows only **idle/lifecycle** while **Antigravity** (`agy`) works | Antigravity has no hook adapter yet. Add `--observe` for coarse PTY activity, or accept lifecycle-only status. |
 | Claude hooks fail with **"hook exited with code 1"** | The hook command must not bake an **fnm**/node-manager *per-shell* node path (`…\fnm_multishells\<pid>_…\node.exe`) that dies when the shell exits. haya-pet bakes the stable `realpath`-resolved node path into the temp settings instead. Update to the latest version. |
 | Pet shows only **idle** for a generic / unknown CLI | Expected without a hook adapter — add `--observe` for PTY observation, otherwise lifecycle only. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hayasaka7/haya-pet",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "type": "module",
   "description": "Generic AI CLI pet runtime foundation.",
   "keywords": [

package/packages/adapters/src/codex-hooks.js

@@ -49,14 +49,12 @@
 //  - UNTESTED: PreCompact / SubagentStart|Stop live firing (no compaction /
 //    subagent occurred in the probe).
 //
-// OPEN QUESTION (injection): unlike `claude --settings <file>`, Codex has no
-// per-invocation settings-file flag. Candidate non-mutating paths, best first:
-//   1. `codex -p haya-pet` + a generated `$CODEX_HOME/haya-pet.config.toml` profile
-//      that layers ON TOP of the user's base config (auth/config preserved).
-//   2. a `hooks.json` next to the active config layer ($CODEX_HOME/hooks.json) —
-//      simple but global to every codex session (harmless: the reporter no-ops
-//      without HAYA_PET_SESSION_ID).
-// Both still trip Codex's one-time hook-trust prompt, exactly like the Claude path.
+// Injection: unlike `claude --settings <file>`, Codex has no per-invocation
+// settings-file flag. The wrapper writes stable user-level hooks to
+// $CODEX_HOME/hooks.json, merging HAYA-managed entries with any existing user
+// hooks. This avoids consuming Codex's single -p/--profile slot; the reporter
+// still no-ops without HAYA_PET_SESSION_ID.
+// This still trips Codex's one-time hook-trust prompt, exactly like the Claude path.
 
 // Codex's file-editing tool(s) vs. its command tool.
 const EDIT_TOOLS = ["apply_patch"];

package/packages/cli-core/src/codex-hook-injection.js

@@ -1,8 +1,7 @@
-// Resolves stable paths, builds the Codex hook settings, serializes them to TOML,
-// and writes them to a STABLE named-profile file inside CODEX_HOME. The wrapper
-// then launches `codex -p <profileName>`, which layers these hooks ON TOP of the
-// user's base config (auth/model/MCP untouched) and is inert for any codex run
-// that doesn't pass `-p <profileName>`.
+// Resolves stable paths, builds the Codex hook settings, and writes them to the
+// user-level hooks.json inside CODEX_HOME. Codex loads user-level hooks alongside
+// any selected profile, so HAYA Pet does not consume Codex's single -p/--profile
+// slot and custom profiles keep working.
 //
 // Like the Claude injector, the file path and command strings are kept identical
 // across sessions so Codex's hook-trust review only needs approving once. fnm hands
@@ -12,33 +11,31 @@ import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildCodexHookSettings, serializeCodexHooksToml } from "../../adapters/src/codex-hooks.js";
+import { buildCodexHookSettings } from "../../adapters/src/codex-hooks.js";
 
 const DEFAULT_CLI_PATH = fileURLToPath(new URL("../../../apps/cli/src/haya-pet.js", import.meta.url));
-const PROFILE_NAME = "haya-pet";
-const PROFILE_FILE = `${PROFILE_NAME}.config.toml`;
+const HOOKS_FILE = "hooks.json";
+const HAYA_HOOK_STATUS = "HAYA Pet live status";
 
 export function injectCodexHooks({ nodePath, cliPath, codexHome, env = process.env } = {}) {
   const resolvedNode = nodePath ?? safeRealpath(process.execPath);
   const resolvedCli = cliPath ?? safeRealpath(DEFAULT_CLI_PATH);
   const home = codexHome ?? env.CODEX_HOME ?? join(homedir(), ".codex");
 
-  const settings = buildCodexHookSettings({ nodePath: resolvedNode, cliPath: resolvedCli });
-  const toml = serializeCodexHooksToml(settings, {
-    header: "haya-pet live-status hooks profile. Managed by haya-pet; safe to delete."
-  });
+  const settings = markManagedHooks(buildCodexHookSettings({ nodePath: resolvedNode, cliPath: resolvedCli }));
 
-  // A fixed path with session-independent content: concurrent sessions just
-  // rewrite identical bytes, and the hooks stay "trusted" across launches.
+  // A fixed user-level hook source works with every Codex profile. We merge rather
+  // than overwrite because hooks.json may already contain user hooks.
   mkdirSync(home, { recursive: true });
-  const profilePath = join(home, PROFILE_FILE);
-  const trustedState = readCodexHookTrustState(profilePath);
-  writeFileSync(profilePath, appendCodexHookTrustState(toml, trustedState), "utf8");
-
-  // The profile file is stable and reusable on purpose — leaving it in place is
-  // what lets Codex remember the hooks are trusted. cleanup is a no-op kept for
-  // API symmetry with the caller's finally block.
-  return { profileName: PROFILE_NAME, profilePath, cleanup: () => {} };
+  const hooksPath = join(home, HOOKS_FILE);
+  const existing = readHooksJson(hooksPath);
+  const next = mergeHooksJson(existing, settings);
+  writeFileSync(hooksPath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+
+  // The hook file is stable and reusable on purpose — leaving it in place is what
+  // lets Codex remember the hooks are trusted. cleanup is a no-op kept for API
+  // symmetry with the caller's finally block.
+  return { hooksPath, cleanup: () => {} };
 }
 
 function safeRealpath(target) {
@@ -49,50 +46,98 @@ function safeRealpath(target) {
   }
 }
 
-function readCodexHookTrustState(profilePath) {
+function readHooksJson(hooksPath) {
   try {
-    return extractCodexHookTrustState(readFileSync(profilePath, "utf8"));
-  } catch {
-    return "";
+    const parsed = JSON.parse(readFileSync(hooksPath, "utf8"));
+    return isPlainObject(parsed) ? parsed : {};
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return {};
+    }
+    throw new Error(`haya-pet: could not update Codex ${HOOKS_FILE} (${error.message})`, { cause: error });
   }
 }
 
-function appendCodexHookTrustState(toml, trustedState) {
-  if (!trustedState) {
-    return toml;
+function markManagedHooks(settings) {
+  const hooks = {};
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    hooks[event] = entries.map((entry) => ({
+      ...entry,
+      hooks: (entry.hooks ?? []).map((hook) => ({
+        ...hook,
+        statusMessage: HAYA_HOOK_STATUS
+      }))
+    }));
   }
-  return `${toml.trimEnd()}\n\n${trustedState.trim()}\n`;
+  return { hooks };
 }
 
-function extractCodexHookTrustState(toml) {
-  const lines = String(toml).split(/\r?\n/);
-  const output = [];
-  let inHookState = false;
-
-  for (const line of lines) {
-    const tableName = readTomlTableName(line);
-    if (tableName) {
-      const isHookStateTable = tableName === "hooks.state" || tableName.startsWith("hooks.state.");
-      if (isHookStateTable) {
-        inHookState = true;
-      } else if (inHookState) {
-        break;
-      }
-    }
+function mergeHooksJson(existing, managed) {
+  const output = isPlainObject(existing) ? { ...existing } : {};
+  const existingHooks = isPlainObject(output.hooks) ? output.hooks : {};
+  const managedHooks = managed.hooks ?? {};
+  const hooks = {};
+  const events = new Set([...Object.keys(existingHooks), ...Object.keys(managedHooks)]);
+
+  for (const event of events) {
+    const preserved = removeManagedEntries(existingHooks[event]);
+    const nextEntries = managedHooks[event] ?? [];
 
-    if (inHookState) {
-      output.push(line);
+    if (Array.isArray(preserved)) {
+      hooks[event] = [...preserved, ...nextEntries];
+    } else if (nextEntries.length > 0) {
+      hooks[event] = nextEntries;
+    } else if (preserved !== undefined) {
+      hooks[event] = preserved;
     }
   }
 
-  return output.join("\n").trim();
+  output.hooks = hooks;
+  return output;
 }
 
-function readTomlTableName(line) {
-  const table = /^\s*\[([^\]]+)\]\s*$/.exec(line);
-  if (table) {
-    return table[1];
+function removeManagedEntries(entries) {
+  if (!Array.isArray(entries)) {
+    return entries;
+  }
+
+  return entries
+    .map((entry) => removeManagedHooksFromEntry(entry))
+    .filter((entry) => entry !== undefined);
+}
+
+function removeManagedHooksFromEntry(entry) {
+  if (!isPlainObject(entry) || !Array.isArray(entry.hooks)) {
+    return entry;
+  }
+
+  const hooks = entry.hooks.filter((hook) => !isManagedHook(hook));
+  if (hooks.length === 0) {
+    return undefined;
   }
-  const arrayTable = /^\s*\[\[([^\]]+)\]\]\s*$/.exec(line);
-  return arrayTable?.[1];
+  if (hooks.length === entry.hooks.length) {
+    return entry;
+  }
+  return { ...entry, hooks };
+}
+
+function isManagedHook(hook) {
+  if (!isPlainObject(hook)) {
+    return false;
+  }
+  if (hook.statusMessage === HAYA_HOOK_STATUS) {
+    return true;
+  }
+  return isLegacyHayaPetCommand(hook.command);
+}
+
+function isLegacyHayaPetCommand(command) {
+  if (typeof command !== "string") {
+    return false;
+  }
+  return /haya-pet\.js"?\s+(state|codex-permission-request)\b/.test(command);
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }

package/packages/cli-core/test/codex-hook-injection.test.mjs

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { test } from "../../../test/harness.mjs";
 import { injectCodexHooks } from "../src/codex-hook-injection.js";
 
-test("injectCodexHooks writes a stable profile into CODEX_HOME and returns its name", () => {
+test("injectCodexHooks writes stable user-level hooks into CODEX_HOME", () => {
   const home = mkdtempSync(join(tmpdir(), "haya-codex-home-"));
   try {
     const result = injectCodexHooks({
@@ -14,15 +14,15 @@ test("injectCodexHooks writes a stable profile into CODEX_HOME and returns its n
       codexHome: home
     });
 
-    assert.equal(result.profileName, "haya-pet");
-    assert.equal(result.profilePath, join(home, "haya-pet.config.toml"));
+    assert.equal(result.hooksPath, join(home, "hooks.json"));
 
-    const toml = readFileSync(result.profilePath, "utf8");
-    assert.match(toml, /\[\[hooks\.UserPromptSubmit\]\]/);
-    assert.match(toml, /state thinking/);
+    const json = JSON.parse(readFileSync(result.hooksPath, "utf8"));
+    const promptHook = json.hooks.UserPromptSubmit[0].hooks[0];
+    assert.equal(promptHook.type, "command");
+    assert.match(promptHook.command, /state thinking/);
+    assert.equal(promptHook.statusMessage, "HAYA Pet live status");
     // Program unquoted (cmd /c strips a leading quote on Windows).
-    const cmdLine = toml.split("\n").find((l) => l.startsWith("command ="));
-    assert.doesNotMatch(cmdLine, /^command = "\\"/);
+    assert.doesNotMatch(promptHook.command, /^"/);
   } finally {
     rmSync(home, { recursive: true, force: true });
   }
@@ -33,31 +33,32 @@ test("injectCodexHooks honors CODEX_HOME from env and is stable across calls", (
   try {
     const opts = { nodePath: "n", cliPath: "c", env: { CODEX_HOME: home } };
     const a = injectCodexHooks(opts);
-    const first = readFileSync(a.profilePath, "utf8");
+    const first = readFileSync(a.hooksPath, "utf8");
     const b = injectCodexHooks(opts);
-    const second = readFileSync(b.profilePath, "utf8");
+    const second = readFileSync(b.hooksPath, "utf8");
 
-    assert.equal(a.profilePath, join(home, "haya-pet.config.toml"));
+    assert.equal(a.hooksPath, join(home, "hooks.json"));
     assert.equal(first, second, "stable content keeps Codex hook-trust cached");
   } finally {
     rmSync(home, { recursive: true, force: true });
   }
 });
 
-test("injectCodexHooks preserves Codex hook trust state in the managed profile", () => {
+test("injectCodexHooks preserves user hooks and replaces prior HAYA hooks", () => {
   const home = mkdtempSync(join(tmpdir(), "haya-codex-home-"));
   try {
-    const first = injectCodexHooks({
-      nodePath: "n",
-      cliPath: "c",
-      codexHome: home
-    });
-    const trustedState = `[hooks.state]
-
-[hooks.state.'${first.profilePath}:user_prompt_submit:0:0']
-trusted_hash = "sha256:abc123"
-`;
-    writeFileSync(first.profilePath, `${readFileSync(first.profilePath, "utf8")}\n${trustedState}`, "utf8");
+    writeFileSync(join(home, "hooks.json"), JSON.stringify({
+      hooks: {
+        Stop: [
+          {
+            hooks: [
+              { type: "command", command: "echo user" },
+              { type: "command", command: "old-node old-cli state idle", statusMessage: "HAYA Pet live status" }
+            ]
+          }
+        ]
+      }
+    }, null, 2), "utf8");
 
     injectCodexHooks({
       nodePath: "n",
@@ -65,9 +66,11 @@ trusted_hash = "sha256:abc123"
       codexHome: home
     });
 
-    const next = readFileSync(first.profilePath, "utf8");
-    assert.match(next, /\[hooks\.state\]/);
-    assert.match(next, /trusted_hash = "sha256:abc123"/);
+    const next = JSON.parse(readFileSync(join(home, "hooks.json"), "utf8"));
+    const stopCommands = next.hooks.Stop.flatMap((entry) => entry.hooks.map((hook) => hook.command));
+    assert.ok(stopCommands.includes("echo user"), "existing user hook is preserved");
+    assert.ok(stopCommands.some((command) => command === 'n "c" state idle'), "fresh HAYA hook is installed");
+    assert.ok(!stopCommands.some((command) => command.includes("old-node")), "stale HAYA hook is removed");
   } finally {
     rmSync(home, { recursive: true, force: true });
   }