@hayasaka7/haya-pet 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -7,6 +7,31 @@ All notable changes to HAYA Pet are documented here. This project adheres to
 > 0.2.0 npm publish; they are listed under 0.2.1, which is the first version that
 > ships them.
 
+## [0.3.4]
+
+### Fixed
+- **Codex "Approve for me" status no longer depends on a timer.** The
+  `PermissionRequest` hook now calls a Codex-specific reporter instead of
+  emitting delayed `waiting_approval`. The wrapper resolves
+  `approvals_reviewer` for the session: `auto_review` / legacy
+  `guardian_subagent` reports *reviewing*, while manual review still reports
+  *waiting for approval*. The daemon no longer has a deferred-state protocol or
+  timer-based approval fallback.
+- **Fresh Codex sessions no longer inherit status from an older active Codex
+  session.** The transcript and guardian watchers now require the rollout's
+  first `session_meta.timestamp` to belong to this wrapper launch, so a
+  different Codex session writing `shell_command` / `thinking` after startup
+  cannot make an idle pet look busy.
+
+## [0.3.3]
+
+### Fixed
+- **Claude Code subagent completion no longer changes the main session status.**
+  Claude Code can emit `SubagentStop` after the main agent has already stopped,
+  so treating that event as `idle` could make the pet react to a stale subagent
+  completion instead of the main agent's real state. The Claude hook adapter now
+  ignores `SubagentStop`; the main turn still ends on Claude's `Stop` event.
+
 ## [0.3.2]
 
 ### Changed

package/README.md

@@ -64,7 +64,7 @@ npm install -g @hayasaka7/haya-pet
 From source:
 
 ```bash
-git clone <repo-url> haya-pet
+git clone https://github.com/HAYASAKA7/HAYA-PET.git haya-pet
 cd haya-pet
 npm install
 npm link
@@ -187,11 +187,12 @@ Why opt in? Both clients show a one-time trust prompt when hooks are added. HAYA
 Pet lets you decide when to approve that instead of surprising you in the middle
 of work.
 
-Codex live status combines three sources: hooks report `thinking`/`idle` and
-approval requests, a transcript watcher reports tool/file activity, and a
-guardian-review watcher tracks Codex's **"Approve for me"** auto-reviewer — the
-pet shows *reviewing* while the guardian assesses a request and only shows
-*waiting for approval* when Codex actually asks you ("Ask for approval" mode).
+Codex live status combines three sources: hooks report `thinking`/`idle`, a
+Codex-specific permission reporter maps approval requests from the session's
+resolved `approvals_reviewer` setting, and transcript watchers report tool/file
+activity plus guardian-review outcomes. With **"Approve for me"** the pet shows
+*reviewing* immediately; *waiting for approval* is reserved for Codex's manual
+"Ask for approval" mode.
 Per-tool `PreToolUse` hooks still depend on an upstream Codex gap
 ([openai/codex#16732](https://github.com/openai/codex/issues/16732)); the
 transcript watcher covers that in the meantime.

package/apps/cli/src/haya-pet.js

@@ -58,6 +58,10 @@ export function parseAiPetArgs(argv) {
     return parseStateArgs(rest);
   }
 
+  if (command === "codex-permission-request") {
+    return { command: "codex-permission-request" };
+  }
+
   if (command === "hooks") {
     return parseHooksArgs(rest);
   }
@@ -84,6 +88,10 @@ export async function runAiPet(argv, dependencies = {}) {
     return runStateCommand(parsed, dependencies);
   }
 
+  if (parsed.command === "codex-permission-request") {
+    return runCodexPermissionRequestCommand(parsed, dependencies);
+  }
+
   if (parsed.command === "hooks") {
     return runHooksCommand(parsed, dependencies);
   }
@@ -172,6 +180,21 @@ async function reportUpdateNotice(updateCheck, print) {
   }
 }
 
+function runCodexPermissionRequestCommand(_parsed, dependencies = {}) {
+  const env = dependencies.env ?? process.env;
+  const reviewer = normalizeCodexApprovalsReviewer(env.HAYA_PET_CODEX_APPROVAL_REVIEWER);
+  const autoReview = isCodexAutoReviewer(reviewer);
+  return runStateCommand(
+    {
+      command: "state",
+      state: autoReview ? "reviewing" : "waiting_approval",
+      summary: autoReview ? "agent reviewing approval" : "approval",
+      session: undefined
+    },
+    dependencies
+  );
+}
+
 function readOwnVersion() {
   try {
     const packagePath = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "package.json");
@@ -181,6 +204,116 @@ function readOwnVersion() {
   }
 }
 
+function resolveCodexApprovalsReviewer(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = normalizeCodexApprovalsReviewer(env.HAYA_PET_CODEX_APPROVAL_REVIEWER);
+  if (explicit) {
+    return explicit;
+  }
+
+  const fromArgs = findCodexApprovalsReviewerInArgs(options.childArgs ?? []);
+  if (fromArgs) {
+    return fromArgs;
+  }
+
+  const home = options.codexHome ?? env.CODEX_HOME ?? resolveHomeCodexDir(options.homeDir, env);
+  const readFile = options.readFile ?? readFileSync;
+  const fromConfig = readCodexApprovalsReviewerFromConfig(home, readFile);
+  return fromConfig ?? "user";
+}
+
+function resolveHomeCodexDir(homeDir, env) {
+  const home = homeDir ?? env.USERPROFILE ?? env.HOME;
+  return home ? join(home, ".codex") : undefined;
+}
+
+function findCodexApprovalsReviewerInArgs(args) {
+  let reviewer;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    let configValue;
+    if (arg === "-c" || arg === "--config") {
+      configValue = args[index + 1];
+      index += 1;
+    } else if (arg.startsWith("--config=")) {
+      configValue = arg.slice("--config=".length);
+    } else if (arg.startsWith("-c") && arg.length > 2) {
+      configValue = arg.slice(2);
+    }
+
+    const parsed = parseApprovalsReviewerAssignment(configValue);
+    if (parsed) {
+      reviewer = parsed;
+    }
+  }
+  return reviewer;
+}
+
+function readCodexApprovalsReviewerFromConfig(codexHome, readFile) {
+  if (!codexHome) {
+    return undefined;
+  }
+  try {
+    return parseTopLevelApprovalsReviewer(readFile(join(codexHome, "config.toml"), "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+
+function parseTopLevelApprovalsReviewer(toml) {
+  let inTopLevel = true;
+  for (const line of String(toml).split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    if (trimmed.startsWith("[")) {
+      inTopLevel = false;
+      continue;
+    }
+    if (!inTopLevel) {
+      continue;
+    }
+    const reviewer = parseApprovalsReviewerAssignment(trimmed);
+    if (reviewer) {
+      return reviewer;
+    }
+  }
+  return undefined;
+}
+
+function parseApprovalsReviewerAssignment(value) {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const match = /^\s*approvals_reviewer\s*=\s*(.+?)\s*(?:#.*)?$/.exec(value);
+  if (!match) {
+    return undefined;
+  }
+  return normalizeCodexApprovalsReviewer(stripTomlString(match[1]));
+}
+
+function stripTomlString(value) {
+  const trimmed = String(value).trim();
+  const quote = trimmed[0];
+  if ((quote === "\"" || quote === "'") && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+
+function normalizeCodexApprovalsReviewer(value) {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  return normalized || undefined;
+}
+
+function isCodexAutoReviewer(value) {
+  return value === "auto_review" || value === "guardian_subagent";
+}
+
 async function runRunCommand(parsed, dependencies) {
   const runGenericCommand = dependencies.runGenericCommand ?? defaultRunGenericCommand;
   const injectClaudeHooks = dependencies.injectClaudeHooks ?? defaultInjectClaudeHooks;
@@ -276,7 +409,17 @@ async function runRunCommand(parsed, dependencies) {
     } else {
       const injected = injectCodexHooks();
       childArgs = ["-p", injected.profileName, ...parsed.childArgs];
-      childEnv = { ...env, HAYA_PET_SESSION_ID: sessionId };
+      childEnv = {
+        ...env,
+        HAYA_PET_SESSION_ID: sessionId,
+        HAYA_PET_CODEX_APPROVAL_REVIEWER: resolveCodexApprovalsReviewer({
+          childArgs: parsed.childArgs,
+          env,
+          homeDir: dependencies.homeDir,
+          codexHome: dependencies.codexHome,
+          readFile: dependencies.readFile
+        })
+      };
       cleanup = injected.cleanup;
 
       const activeToolCalls = new Set();
@@ -353,8 +496,9 @@ async function runRunCommand(parsed, dependencies) {
       // With "Approve for me" (approvals_reviewer=auto_review, legacy alias
       // guardian_subagent), Codex routes approval requests to a guardian
       // subagent and never shows the human approval UI — yet the
-      // PermissionRequest hook still fires at request creation, which used to
-      // pin the pet on a false "waiting for approval" for the whole review.
+      // PermissionRequest hook still fires at request creation. The hook's
+      // reporter uses the resolved approvals reviewer config: auto-review
+      // reports reviewing immediately, while manual review reports waiting.
       // The guardian's own rollout is the only observable record of the
       // review, so tail it: a review turn starting proves the agent is
       // reviewing; an "allow" verdict proves the action proceeds; a "deny"

package/apps/cli/test/haya-pet.test.mjs

@@ -399,10 +399,56 @@ test("parses the state command", () => {
     command: "state",
     state: "thinking",
     summary: undefined,
-    session: "sess_q"
+    session: "sess_q",
   });
 });
 
+test("parses the Codex permission request reporter command", () => {
+  assert.deepEqual(parseAiPetArgs(["codex-permission-request"]), {
+    command: "codex-permission-request"
+  });
+});
+
+test("Codex permission request reporter shows reviewing for auto-review", async () => {
+  const messages = [];
+  await runAiPet(["codex-permission-request"], {
+    env: {
+      HAYA_PET_SESSION_ID: "sess_review",
+      HAYA_PET_CODEX_APPROVAL_REVIEWER: "auto_review"
+    },
+    now: () => 123,
+    ipcEndpoint: "test-endpoint",
+    createIpcClient: async () => ({
+      send: async (message) => messages.push(message),
+      close: async () => {}
+    })
+  });
+
+  assert.equal(messages.length, 1);
+  assert.equal(messages[0].state, "reviewing");
+  assert.equal(messages[0].summary, "agent reviewing approval");
+});
+
+test("Codex permission request reporter shows waiting for manual reviewer", async () => {
+  const messages = [];
+  await runAiPet(["codex-permission-request"], {
+    env: {
+      HAYA_PET_SESSION_ID: "sess_manual",
+      HAYA_PET_CODEX_APPROVAL_REVIEWER: "user"
+    },
+    now: () => 123,
+    ipcEndpoint: "test-endpoint",
+    createIpcClient: async () => ({
+      send: async (message) => messages.push(message),
+      close: async () => {}
+    })
+  });
+
+  assert.equal(messages.length, 1);
+  assert.equal(messages[0].state, "waiting_approval");
+  assert.equal(messages[0].summary, "approval");
+});
+
 const hooksStateFile = (hooksEnabled) => () => ({
   load: async () => ({ settings: { hooksEnabled } }),
   save: async (state) => state
@@ -509,6 +555,26 @@ test("persisted `hooks on` injects a Codex profile via -p at the front of args",
 
   assert.equal(injected, 1, "config preference enables Codex hooks");
   assert.deepEqual(calls[0].args, ["-p", "haya-pet"], "profile flag goes at the front");
+  assert.equal(calls[0].env.HAYA_PET_CODEX_APPROVAL_REVIEWER, "user");
+});
+
+test("codex hooks pass auto-review config to the PermissionRequest reporter", async () => {
+  const calls = [];
+  await runAiPet(["run", "--client", "codex", "--", "codex"], {
+    cwd: process.cwd(),
+    env: { USERPROFILE: "C:\\Users\\A" },
+    heartbeatIntervalMs: 10,
+    send: async () => {},
+    createStateFile: hooksStateFile(true),
+    injectCodexHooks: () => ({ profileName: "haya-pet", cleanup: () => {} }),
+    readFile: () => 'approvals_reviewer = "auto_review"\n',
+    runGenericCommand: async (options) => {
+      calls.push(options);
+      return { sessionId: options.sessionId, pid: 1, exitCode: 0 };
+    }
+  });
+
+  assert.equal(calls[0].env.HAYA_PET_CODEX_APPROVAL_REVIEWER, "auto_review");
 });
 
 test("codex hooks also start a transcript watcher for tool activity", async () => {

package/docs/architecture.md

@@ -74,10 +74,13 @@ notice. Codex's hook command must be unquoted at the program position (it runs v
 transcript watcher tailing the session rollout. `PermissionRequest` fires, but
 once at approval-request creation — before Codex routes the request to either
 the user or its guardian auto-reviewer ("Approve for me"), which never prompts
-the user at all. An L3 **guardian-trunk watcher** tails the guardian's own
+the user at all. The hook therefore calls a Codex-specific permission reporter:
+when the resolved Codex config says `approvals_reviewer = "auto_review"` (or the
+legacy `guardian_subagent` alias), it reports `reviewing`; otherwise it reports
+`waiting_approval`. An L3 **guardian-trunk watcher** tails the guardian's own
 rollout (`source: {subagent:{other:"guardian"}}`, parented to the main thread)
-and refines the state: review running → `reviewing`, verdict allow →
-`running_tool`, verdict deny → `thinking`.
+and refines the state from real review events: review running → `reviewing`,
+verdict allow → `running_tool`, verdict deny → `thinking`.
 
 Hooks alone can't see one moment: clients emit **no event when the user accepts a
 permission prompt** (denial and completion are observable; the accept click is

package/docs/known-issues.md

@@ -2,6 +2,20 @@
 
 Issues found in live use, with their current status.
 
+## ✅ Resolved: Claude Code subagent completion changed the main session status
+
+- **Symptom:** In Claude Code multi-agent runs, the main agent could already be
+  stopped while a subagent was still finishing. When that late subagent emitted
+  `SubagentStop`, the pet treated it as a main-session `idle` update and could
+  show a misleading working/done transition after the main agent had settled.
+- **Root cause:** The Claude hook table mapped `SubagentStop` to `idle`. That is
+  only safe if subagent completion is ordered before the main turn finishes, which
+  Claude Code does not guarantee.
+- **Fix:** Claude `SubagentStop` is now ignored. Main-session idle still comes
+  from Claude's real `Stop` hook, while late subagent completion cannot override
+  the current main-agent state. Codex keeps its separate behavior because Codex
+  uses `Stop` as the only idle signal and treats `SubagentStop` as mid-turn.
+
 ## ✅ Resolved: false "waiting for approval" while Codex auto-reviews an approval (Approve for me)
 
 - **Symptom:** Running Codex under the pet with the **"Approve for me"** preset
@@ -18,12 +32,17 @@ Issues found in live use, with their current status.
   guardian `deny` returns the rationale to the **model** as a rejected tool call
   ("This action was rejected due to unacceptable risk. …"), so no human decision
   is ever pending. Our Codex hook table mapped `PermissionRequest` →
-  `waiting_approval` unconditionally. No better hook exists: nothing fires on
-  guardian start/finish (the guardian session is `SubAgentSource::Other`, which
-  is excluded from Subagent hooks), and `GuardianAssessment` events are
-  explicitly not persisted to the main rollout (`rollout/src/policy.rs`).
-- **Fix:** an **L3 guardian-trunk watcher** (`codex-guardian-watcher.js` +
-  `adapters/codex-guardian.js`). The guardian runs as its own Codex session that
+  `waiting_approval` unconditionally. Nothing fires on guardian start/finish
+  (the guardian session is `SubAgentSource::Other`, which is excluded from
+  Subagent hooks), and `GuardianAssessment` events are explicitly not persisted
+  to the main rollout (`rollout/src/policy.rs`).
+- **Fix:** a Codex-specific `PermissionRequest` reporter plus an **L3
+  guardian-trunk watcher** (`codex-guardian-watcher.js` +
+  `adapters/codex-guardian.js`). The reporter checks the wrapped session's
+  resolved Codex `approvals_reviewer` config: `auto_review` / legacy
+  `guardian_subagent` reports **reviewing** immediately, while manual/unknown
+  reviewer config reports **waiting for approval**. This is config/event-backed,
+  not a timer. The guardian runs as its own Codex session that
   writes its own rollout under `~/.codex/sessions` — session_meta has
   `source: {subagent: {other: "guardian"}}` and `parent_thread_id` = the main
   thread; each review is one turn (`task_started` → `task_complete` with the
@@ -37,17 +56,29 @@ Issues found in live use, with their current status.
   there is no trunk and behavior is unchanged: `PermissionRequest` →
   *waiting for approval* until the user decides (process-tree/denial detection
   resolve it, as before).
-- **Known limitations (accepted):** (1) A ≤ ~1 s *waiting for approval* flicker
-  can precede *reviewing* (the hook fires immediately; the trunk poll is 700 ms).
-  (2) Reviews of a **collab subagent's** actions (multi-agent runs) have their
+- **Known limitations (accepted):** (1) Reviews of a **collab subagent's** actions (multi-agent runs) have their
   own trunks keyed to the subagent's thread and are not watched; a subagent's
-  `PermissionRequest` can still briefly show *waiting for approval* until the
-  next main-session event. (3) After a guardian deny the pet shows *thinking*,
+  `PermissionRequest` still follows the wrapped session's resolved reviewer
+  config; if that subagent is using different approval settings, the parent
+  session may not be able to distinguish it. (2) After a guardian deny the pet shows *thinking*,
   not *waiting for approval* — by design: Codex resolves the request itself and
   the model decides what to do next (it may ask the user in chat, which then
   surfaces as turn-end *idle*). The TUI's passive `/approve` denial-override
   picker is not a blocking prompt.
 
+## ✅ Resolved: Codex pet looked busy immediately after startup
+
+- **Symptom:** Starting a wrapped Codex session and doing nothing could still make
+  the pet show `shell_command` or `thinking` instead of `idle`.
+- **Root cause:** The Codex transcript and guardian watchers originally chose the
+  newest rollout by file mtime, then filtered individual records by timestamp.
+  Another already-running Codex session could keep writing fresh records after
+  HAYA Pet started, making its rollout look like the wrapped session even though
+  it began earlier.
+- **Fix:** Both watchers now inspect the first `session_meta` line and require
+  its timestamp to belong to this wrapper launch. Old-but-active Codex sessions
+  are ignored even if their files continue to receive fresh writes.
+
 ## ✅ Resolved: Codex `/quit` hung on its goodbye (and the pet kept showing "working")
 
 - **Symptom:** Exiting Codex with `/quit` printed the token-usage goodbye and the
@@ -228,8 +259,9 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
   lifecycle status). Live in-session status is **opt-in** via `HAYA_PET_HOOKS=1`,
   which injects a settings file (`claude --settings <stable-file>`, no change to
   your global config) wiring Claude's `UserPromptSubmit`/`PreToolUse`/`PostToolUse`/
-  `Notification`/`PreCompact`/`Stop`/`SubagentStop` events to `haya-pet state
-  <state>`, reported to the daemon over the IPC pipe. `PreToolUse` distinguishes
+  `Notification`/`PreCompact`/`Stop` events to `haya-pet state <state>`, reported
+  to the daemon over the IPC pipe. `SubagentStop` is intentionally ignored because
+  it is not a main-turn idle signal. `PreToolUse` distinguishes
   file-editing tools (`Edit`/`Write`/`MultiEdit`/`NotebookEdit` → *editing files*)
   from other tools (→ *running tools*) via the hook `matcher`. **Why opt-in:**
   injecting hooks makes Claude show a one-time *review hooks* trust prompt; the
@@ -283,14 +315,15 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
     reports `editing_files`, and HAYA Pet returns to `thinking` after active tool
     calls drain.
   - **`PermissionRequest` fires** (confirmed live on 0.139.0), but **once, at
-    approval-request creation, before routing** — under "Approve for me"
-    (`approvals_reviewer = auto_review` / legacy `guardian_subagent`) the user is
-    never actually prompted, so the hook alone over-reports *waiting for
-    approval*. An L3 **guardian-trunk watcher** tails the guardian reviewer's own
-    rollout (`source: {subagent:{other:"guardian"}}`, `parent_thread_id` = main
-    thread) and refines the state: review running → *reviewing*, verdict `allow`
-    → *running_tool*, verdict `deny` → *thinking*. See the resolved
-    false-waiting-for-approval entry above.
+    approval-request creation, before routing**. The hook calls
+    `haya-pet codex-permission-request`, which uses the wrapped session's
+    resolved `approvals_reviewer` config: `auto_review` / legacy
+    `guardian_subagent` reports *reviewing*, while manual review reports
+    *waiting for approval*. An L3 **guardian-trunk watcher** tails the guardian
+    reviewer's own rollout (`source: {subagent:{other:"guardian"}}`,
+    `parent_thread_id` = main thread) and refines the state: review running →
+    *reviewing*, verdict `allow` → *running_tool*, verdict `deny` → *thinking*.
+    See the resolved false-waiting-for-approval entry above.
 - **Antigravity (`agy`)** — **not yet implemented** (no hook injection). Uses
   `--observe` or L1 lifecycle. A Gemini-schema hook adapter is a planned follow-up.
 - **Generic / unknown** — no hooks; PTY observation (`--observe`) or L1 lifecycle.

package/docs/troubleshooting.md

@@ -16,8 +16,10 @@ deferred problems with known root causes.
 | Terminal scroll / Shift+Tab / backspace odd while a CLI runs under `haya-pet run` | Fixed — `haya-pet run` now uses native passthrough by default (full fidelity). If you opted into `--observe`, drop it. See [known-issues.md](known-issues.md). |
 | Pet shows only **idle/lifecycle** while **Claude Code** works | Live in-session status is opt-in: run `haya-pet hooks on` once (persisted). The first `haya-pet run` afterward shows a one-time Claude *review hooks* prompt — approve it. Also make sure the companion is running (`haya-pet start`). Check the toggle with `haya-pet hooks status`. |
 | Typing doesn't work / **Claude Code** TUI frozen under `haya-pet run` | You have hooks enabled and Claude is showing its *review hooks* trust prompt (approve it once), or your Claude is too old for `--settings`. Run `haya-pet hooks off` (or set `HAYA_PET_NO_HOOKS=1`) for native passthrough with lifecycle-only status — typing and Shift+Tab work normally. |
+| Pet changes status after a **Claude Code** subagent finishes, even though the main agent already stopped | Fixed — Claude `SubagentStop` is ignored because it is not a reliable main-turn state. Update to the latest version and restart the wrapped Claude session so the new hook settings are used. |
 | Pet shows only **idle/lifecycle** while **Codex** works | Live status is opt-in: run `haya-pet hooks on` once (persisted, global), then `haya-pet run --client codex -- codex`; approve Codex's one-time *review hooks* prompt. `thinking`/`idle` come from hooks, `running_tool`/`editing_files` from a transcript watcher, and approval states from the `PermissionRequest` hook plus a guardian-review watcher. |
-| Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now shows **reviewing** during the assessment, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). |
+| Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now reports **reviewing** from the permission hook itself, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). Restart the wrapped Codex session after updating so Codex reloads the changed hook command. |
+| Pet shows **shell_command** or **thinking** right after starting Codex, before you prompt it | Fixed — the Codex transcript and guardian watchers now ignore rollouts whose `session_meta.timestamp` predates the current wrapper launch, so another active Codex session cannot drive this pet's status. Restart the wrapped Codex session after updating. |
 | **Codex** live status didn't turn on / you pass your own `-p`/`--profile` | Codex allows only one profile, so haya-pet skips hook injection when you supply your own and prints a notice. Drop your `-p` for that run to get live status, or accept lifecycle-only. |
 | Pet shows only **idle/lifecycle** while **Antigravity** (`agy`) works | Antigravity has no hook adapter yet. Add `--observe` for coarse PTY activity, or accept lifecycle-only status. |
 | Claude hooks fail with **"hook exited with code 1"** | The hook command must not bake an **fnm**/node-manager *per-shell* node path (`…\fnm_multishells\<pid>_…\node.exe`) that dies when the shell exits. haya-pet bakes the stable `realpath`-resolved node path into the temp settings instead. Update to the latest version. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hayasaka7/haya-pet",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "type": "module",
   "description": "Generic AI CLI pet runtime foundation.",
   "keywords": [

package/packages/adapters/src/claude-hooks.js

@@ -34,8 +34,7 @@ const HOOK_TABLE = Object.freeze([
   { event: "PermissionDenied", state: "idle", summary: "denied" },
   { event: "PreCompact", state: "compacting" },
   { event: "Stop", state: "idle" },
-  { event: "StopFailure", state: "idle", summary: "stopped" },
-  { event: "SubagentStop", state: "idle" }
+  { event: "StopFailure", state: "idle", summary: "stopped" }
 ]);
 
 // Resolve the pet state for a Claude event. `detail` is the tool name for

package/packages/adapters/src/codex-hooks.js

@@ -37,11 +37,12 @@
 //    source): fires ONCE at approval-request creation, BEFORE the request is
 //    routed to the guardian auto-reviewer or the user. Under "Approve for me"
 //    (approvals_reviewer=auto_review, legacy alias guardian_subagent) the user
-//    is never prompted at all, so waiting_approval from this hook over-reports;
-//    the wrapper's codex-guardian-watcher refines it to reviewing /
-//    running_tool / thinking from the guardian's own rollout. The guardian
+//    is never prompted at all, so this hook calls a Codex-specific permission
+//    reporter instead of hard-coding waiting_approval. The wrapper passes the
+//    resolved approvals reviewer mode in env; auto_review reports reviewing,
+//    while manual/unknown reviewer config reports waiting_approval. The guardian
 //    fires NO hooks itself (SubAgentSource::Other is excluded from Subagent
-//    hooks), so these entries can't see it.
+//    hooks), so the wrapper also tails the guardian rollout directly.
 //  - UNTESTED: PreCompact / SubagentStart|Stop (no compaction / subagent
 //    occurred in the probe).
 //
@@ -76,7 +77,7 @@ const HOOK_TABLE = Object.freeze([
   { event: "PreToolUse", matcher: EDIT_TOOLS_MATCHER, state: "editing_files" },
   { event: "PreToolUse", matcher: COMMAND_TOOLS_MATCHER, state: "running_tool" },
   { event: "PostToolUse", state: "thinking" },
-  { event: "PermissionRequest", state: "waiting_approval" },
+  { event: "PermissionRequest", command: "codex-permission-request" },
   { event: "PreCompact", state: "compacting" },
   { event: "PostCompact", state: "thinking", summary: "compacted" },
   // A subagent finishing is mid-turn — the main agent keeps working, so this is
@@ -111,15 +112,21 @@ export function mapCodexEventToState(event, toolName) {
 // node path, which is space-free for fnm/scoop/nvm layouts; a space-tolerant
 // path (short 8.3 name, or `command_windows`) is a follow-up before shipping.
 export function buildCodexHookSettings({ nodePath, cliPath }) {
-  const command = (state, summary) => {
+  const stateCommand = (state, summary) => {
     // nodePath unquoted (must not lead with a quote); cliPath quoted for spaces.
-    const base = `${nodePath} ${quote(cliPath)} state ${state}`;
-    return summary ? `${base} --summary ${summary}` : base;
+    let output = `${nodePath} ${quote(cliPath)} state ${state}`;
+    if (summary) {
+      output += ` --summary ${summary}`;
+    }
+    return output;
   };
+  const command = (row) => row.command
+    ? `${nodePath} ${quote(cliPath)} ${row.command}`
+    : stateCommand(row.state, row.summary);
 
   const hooks = {};
   for (const row of HOOK_TABLE) {
-    const hookEntry = { hooks: [{ type: "command", command: command(row.state, row.summary) }] };
+    const hookEntry = { hooks: [{ type: "command", command: command(row) }] };
     if (row.matcher !== undefined) {
       hookEntry.matcher = row.matcher;
     }

package/packages/adapters/test/claude-hooks.test.mjs

@@ -9,12 +9,15 @@ test("mapClaudeEventToState covers activity events", () => {
   assert.equal(mapClaudeEventToState("PreCompact"), "compacting");
   assert.equal(mapClaudeEventToState("Stop"), "idle");
   assert.equal(mapClaudeEventToState("StopFailure"), "idle");
-  assert.equal(mapClaudeEventToState("SubagentStop"), "idle");
   assert.equal(mapClaudeEventToState("PermissionDenied"), "idle");
   assert.equal(mapClaudeEventToState("PermissionRequest"), "waiting_approval");
   assert.equal(mapClaudeEventToState("Unknown"), undefined);
 });
 
+test("mapClaudeEventToState ignores Claude SubagentStop", () => {
+  assert.equal(mapClaudeEventToState("SubagentStop"), undefined);
+});
+
 test("mapClaudeEventToState branches PreToolUse on tool name", () => {
   assert.equal(mapClaudeEventToState("PreToolUse", "Bash"), "running_tool");
   assert.equal(mapClaudeEventToState("PreToolUse", "Edit"), "editing_files");
@@ -80,8 +83,9 @@ test("buildClaudeHookSettings includes all subscribed events", () => {
   for (const event of [
     "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure",
     "PermissionRequest", "Notification", "PermissionDenied", "PreCompact",
-    "Stop", "StopFailure", "SubagentStop"
+    "Stop", "StopFailure"
   ]) {
     assert.ok(settings.hooks[event], `missing hook event ${event}`);
   }
+  assert.equal(settings.hooks.SubagentStop, undefined);
 });

package/packages/adapters/test/codex-hooks.test.mjs

@@ -10,7 +10,7 @@ import {
 test("mapCodexEventToState covers activity events", () => {
   assert.equal(mapCodexEventToState("UserPromptSubmit"), "thinking");
   assert.equal(mapCodexEventToState("PostToolUse"), "thinking");
-  assert.equal(mapCodexEventToState("PermissionRequest"), "waiting_approval");
+  assert.equal(mapCodexEventToState("PermissionRequest"), undefined);
   assert.equal(mapCodexEventToState("PreCompact"), "compacting");
   assert.equal(mapCodexEventToState("PostCompact"), "thinking");
   assert.equal(mapCodexEventToState("SubagentStart"), "running_tool");
@@ -64,6 +64,13 @@ test("buildCodexHookSettings splits PreToolUse into edit + command matchers", ()
   assert.equal(other.matcher, "shell_command");
 });
 
+test("buildCodexHookSettings routes PermissionRequest through the Codex reporter", () => {
+  const permission = buildCodexHookSettings({ nodePath: "n", cliPath: "c" }).hooks.PermissionRequest;
+  assert.equal(permission.length, 1);
+  assert.match(permission[0].hooks[0].command, /codex-permission-request$/);
+  assert.doesNotMatch(permission[0].hooks[0].command, /--defer-ms/);
+});
+
 test("no matcher uses look-around (Codex's Rust regex crate rejects it)", () => {
   // Regression guard: a `(?!…)` / `(?=…)` matcher is a hard parse error in Codex
   // and disables that hook. Keep all matchers look-around-free.

package/packages/cli-core/src/codex-guardian-watcher.js

@@ -50,6 +50,11 @@ export function watchCodexGuardianReviews(options = {}) {
       return undefined;
     }
     const meta = classifyCodexSessionMeta(firstLine) ?? null;
+    const sessionStartedAt = readSessionMetaTimestamp(firstLine);
+    if (meta && minMtime > 0 && (!Number.isFinite(sessionStartedAt) || sessionStartedAt < minMtime)) {
+      metaByPath.set(file, null);
+      return null;
+    }
     metaByPath.set(file, meta);
     return meta;
   };
@@ -134,3 +139,19 @@ export function watchCodexGuardianReviews(options = {}) {
     _tick: tick
   };
 }
+
+function readSessionMetaTimestamp(line) {
+  let entry;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+
+  if (entry?.type !== "session_meta" || typeof entry.timestamp !== "string") {
+    return undefined;
+  }
+
+  const timestampMs = Date.parse(entry.timestamp);
+  return Number.isFinite(timestampMs) ? timestampMs : undefined;
+}

package/packages/cli-core/src/codex-transcript-watcher.js

@@ -4,7 +4,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { parseCodexTranscriptLines } from "../../adapters/src/codex-transcript.js";
-import { listJsonlFiles, readRange, safeMtime, safeSize } from "./codex-rollout-fs.js";
+import { listJsonlFiles, readFirstLine, readRange, safeMtime, safeSize } from "./codex-rollout-fs.js";
 
 const DEFAULT_POLL_MS = 700;
 const MTIME_SKEW_MS = 2000;
@@ -89,9 +89,34 @@ export function discoverCodexTranscript(root, minMtime = 0) {
     if (mtime < minMtime) {
       continue;
     }
+    const sessionStartedAt = readCodexSessionStartedAt(file);
+    if (!Number.isFinite(sessionStartedAt) || sessionStartedAt < minMtime) {
+      continue;
+    }
     if (!newest || mtime > newest.mtime) {
       newest = { file, mtime };
     }
   }
   return newest?.file;
 }
+
+function readCodexSessionStartedAt(file) {
+  const line = readFirstLine(file);
+  if (line === undefined) {
+    return undefined;
+  }
+
+  let entry;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+
+  if (entry?.type !== "session_meta" || typeof entry.timestamp !== "string") {
+    return undefined;
+  }
+
+  const timestampMs = Date.parse(entry.timestamp);
+  return Number.isFinite(timestampMs) ? timestampMs : undefined;
+}

package/packages/cli-core/test/codex-guardian-watcher.test.mjs

@@ -8,7 +8,11 @@ import { watchCodexGuardianReviews } from "../src/codex-guardian-watcher.js";
 const noopTimers = { setInterval: () => ({}), clearInterval: () => {} };
 
 function metaLine(payload) {
-  return `${JSON.stringify({ type: "session_meta", payload })}\n`;
+  return `${JSON.stringify({ timestamp: "2026-06-12T01:36:41.556Z", type: "session_meta", payload })}\n`;
+}
+
+function metaLineAt(timestamp, payload) {
+  return `${JSON.stringify({ timestamp, type: "session_meta", payload })}\n`;
 }
 
 function reviewStarted(turnId = "turn-1", timestamp) {
@@ -136,6 +140,41 @@ test("watchCodexGuardianReviews skips review records from before the session sta
   watcher.stop();
 });
 
+test("watchCodexGuardianReviews ignores guardian trunks for sessions that started before this wrapper", () => {
+  const { root, dir } = makeSessionsRoot();
+  writeFileSync(
+    join(dir, "rollout-main.jsonl"),
+    metaLineAt("2026-06-12T00:00:00.000Z", {
+      id: "main-1",
+      parent_thread_id: null,
+      source: "cli",
+      thread_source: "user"
+    })
+  );
+  writeFileSync(
+    join(dir, "rollout-guardian.jsonl"),
+    metaLineAt("2026-06-12T00:01:00.000Z", {
+      id: "guardian-1",
+      parent_thread_id: "main-1",
+      source: { subagent: { other: "guardian" } }
+    }) + reviewStarted("turn-new", "2026-06-12T02:00:00.000Z")
+  );
+
+  const events = [];
+  const watcher = watchCodexGuardianReviews({
+    sessionsRoot: root,
+    startedAt: Date.parse("2026-06-12T01:00:00.000Z"),
+    onReviewEvent: (event) => events.push(event),
+    ...noopTimers
+  });
+
+  watcher._tick();
+
+  assert.deepEqual(events, []);
+
+  watcher.stop();
+});
+
 test("watchCodexGuardianReviews emits nothing without a classifiable main session", () => {
   const { root, dir } = makeSessionsRoot();
   // Guardian trunk exists but there is no main rollout to bind its parent to.

package/packages/cli-core/test/codex-transcript-watcher.test.mjs

@@ -7,6 +7,14 @@ import { discoverCodexTranscript, watchCodexTranscript } from "../src/codex-tran
 
 const noopTimers = { setInterval: () => ({}), clearInterval: () => {} };
 
+function sessionMeta(timestamp, id = "thread-1") {
+  return `${JSON.stringify({
+    timestamp,
+    type: "session_meta",
+    payload: { id, parent_thread_id: null, source: "cli", thread_source: "user" }
+  })}\n`;
+}
+
 function toolStart(toolName = "shell_command", callId = "call_1", timestamp) {
   return `${JSON.stringify({
     ...(timestamp ? { timestamp } : {}),
@@ -32,8 +40,8 @@ test("discoverCodexTranscript finds the newest session jsonl under date folders"
 
   const oldFile = join(oldDir, "rollout-old.jsonl");
   const newFile = join(newDir, "rollout-new.jsonl");
-  writeFileSync(oldFile, "{}\n");
-  writeFileSync(newFile, "{}\n");
+  writeFileSync(oldFile, sessionMeta("2026-06-07T10:00:00.000Z", "old-thread"));
+  writeFileSync(newFile, sessionMeta("2026-06-08T10:00:00.000Z", "new-thread"));
   appendFileSync(newFile, "{}\n");
 
   assert.equal(discoverCodexTranscript(root), newFile);
@@ -45,7 +53,7 @@ test("discoverCodexTranscript skips files older than session start", () => {
   mkdirSync(dir, { recursive: true });
 
   const oldFile = join(dir, "rollout-old.jsonl");
-  writeFileSync(oldFile, "{}\n");
+  writeFileSync(oldFile, sessionMeta("2026-06-08T10:00:00.000Z", "old-thread"));
   const past = new Date(Date.now() - 3_600_000);
   utimesSync(oldFile, past, past);
 
@@ -88,6 +96,7 @@ test("watchCodexTranscript replays current-session records when a transcript is
   writeFileSync(
     path,
     [
+      sessionMeta("2026-06-08T11:00:00.500Z", "new-thread"),
       toolStart("shell_command", "call_old", "2026-06-08T10:59:59.000Z"),
       toolStart("shell_command", "call_new", "2026-06-08T11:00:01.000Z")
     ].join("")
@@ -115,6 +124,34 @@ test("watchCodexTranscript replays current-session records when a transcript is
   watcher.stop();
 });
 
+test("watchCodexTranscript ignores fresh writes to sessions that started before this wrapper", () => {
+  const root = mkdtempSync(join(tmpdir(), "codex-sessions-"));
+  const dir = join(root, "2026", "06", "08");
+  mkdirSync(dir, { recursive: true });
+  const path = join(dir, "rollout-old-active.jsonl");
+  writeFileSync(
+    path,
+    [
+      sessionMeta("2026-06-08T10:00:00.000Z", "older-thread"),
+      toolStart("shell_command", "call_other_session", "2026-06-08T11:00:01.000Z")
+    ].join("")
+  );
+
+  const events = [];
+  const watcher = watchCodexTranscript({
+    sessionsRoot: root,
+    startedAt: Date.parse("2026-06-08T11:00:00.000Z"),
+    onToolEvent: (event) => events.push(event),
+    ...noopTimers
+  });
+
+  watcher._tick();
+
+  assert.deepEqual(events, []);
+
+  watcher.stop();
+});
+
 test("watchCodexTranscript forwards a turn_aborted interrupt event", () => {
   const dir = mkdtempSync(join(tmpdir(), "codex-transcript-"));
   const path = join(dir, "session.jsonl");

package/packages/cli-core/test/run-state.test.mjs

@@ -37,6 +37,7 @@ test("parseStateArgs reads state, summary, and session", () => {
 test("parseStateArgs rejects a missing state and unknown options", () => {
   assert.throws(() => parseStateArgs([]), /state requires a state name/);
   assert.throws(() => parseStateArgs(["thinking", "--bogus"]), /Unknown state option/);
+  assert.throws(() => parseStateArgs(["waiting_approval", "--defer-ms", "1200"]), /Unknown state option/);
 });
 
 test("runStateCommand sends one official_plugin state message", async () => {

package/packages/daemon-core/src/daemon-runtime.js

@@ -1,3 +1,4 @@
+import { assertProtocolMessage } from "../../protocol/src/messages.js";
 import { createSessionRegistry } from "../../session-core/src/registry.js";
 import { attachProtocolStream } from "./ipc-transport.js";
 
@@ -10,7 +11,8 @@ export function createDaemonRuntime(options = {}) {
     registry,
 
     handleMessage(message) {
-      const session = registry.applyMessage(message);
+      const checked = assertProtocolMessage(message);
+      const session = registry.applyMessage(checked);
       onSessionChanged(session);
       return session;
     },

package/packages/protocol/test/messages.test.mjs

@@ -107,6 +107,10 @@ test("rejects unknown message types", () => {
     () => assertProtocolMessage({ type: "unknown", sessionId: "sess_abc123" }),
     /Unknown protocol message type: unknown/
   );
+  assert.throws(
+    () => assertProtocolMessage({ type: "deferred_state", sessionId: "sess_abc123" }),
+    /Unknown protocol message type: deferred_state/
+  );
 });
 
 test("accepts a shutdown control message without a sessionId", () => {