@hayasaka7/haya-pet 0.3.3 → 0.3.5

package/CHANGELOG.md

@@ -7,6 +7,50 @@ All notable changes to HAYA Pet are documented here. This project adheres to
 > 0.2.0 npm publish; they are listed under 0.2.1, which is the first version that
 > ships them.
 
+## [0.3.5]
+
+### Fixed
+- **The pet no longer gets stuck on "compacting" in Claude Code.** `PreCompact`
+  set the status to *compacting*, but nothing ever cleared it — Claude's `Stop`
+  does not fire for a `/compact`, so the pet sat on *compacting* until the next
+  prompt or the 30 s stale sweep. The Claude hook table now also subscribes
+  **`PostCompact`**, split by the documented `manual`/`auto` trigger matcher: a
+  **manual** `/compact` returns to *idle* (control is back at the prompt), while
+  an **auto** compaction (context filled mid-turn) resumes to *thinking* and the
+  next real event refines from there. Mirrors Codex, which already handled
+  `PostCompact`.
+
+### Added
+- **`HAYA_PET_DAEMON_DEBUG` diagnostic.** When set to a file path, the companion
+  appends one JSONL line per incoming non-heartbeat message in daemon **arrival
+  order** (with `updatedAt`), making out-of-order state delivery observable. Added
+  to investigate the Codex interrupt issue below.
+
+### Known issues
+- **Codex interrupt can still leave the pet "working".** On some interrupts the
+  pet keeps a working state instead of *interrupted*. The transcript watcher does
+  record `turn_aborted` (the "a late tool result resets it" theory was ruled out
+  across 257 real aborts), so the suspect is the daemon applying state by IPC
+  **arrival order**, letting a stale "working" message land after *interrupted*.
+  Instrumented via `HAYA_PET_DAEMON_DEBUG`; **fix to follow shortly.** See
+  `docs/known-issues.md`.
+
+## [0.3.4]
+
+### Fixed
+- **Codex "Approve for me" status no longer depends on a timer.** The
+  `PermissionRequest` hook now calls a Codex-specific reporter instead of
+  emitting delayed `waiting_approval`. The wrapper resolves
+  `approvals_reviewer` for the session: `auto_review` / legacy
+  `guardian_subagent` reports *reviewing*, while manual review still reports
+  *waiting for approval*. The daemon no longer has a deferred-state protocol or
+  timer-based approval fallback.
+- **Fresh Codex sessions no longer inherit status from an older active Codex
+  session.** The transcript and guardian watchers now require the rollout's
+  first `session_meta.timestamp` to belong to this wrapper launch, so a
+  different Codex session writing `shell_command` / `thinking` after startup
+  cannot make an idle pet look busy.
+
 ## [0.3.3]
 
 ### Fixed

package/README.md

@@ -187,11 +187,12 @@ Why opt in? Both clients show a one-time trust prompt when hooks are added. HAYA
 Pet lets you decide when to approve that instead of surprising you in the middle
 of work.
 
-Codex live status combines three sources: hooks report `thinking`/`idle` and
-approval requests, a transcript watcher reports tool/file activity, and a
-guardian-review watcher tracks Codex's **"Approve for me"** auto-reviewer — the
-pet shows *reviewing* while the guardian assesses a request and only shows
-*waiting for approval* when Codex actually asks you ("Ask for approval" mode).
+Codex live status combines three sources: hooks report `thinking`/`idle`, a
+Codex-specific permission reporter maps approval requests from the session's
+resolved `approvals_reviewer` setting, and transcript watchers report tool/file
+activity plus guardian-review outcomes. With **"Approve for me"** the pet shows
+*reviewing* immediately; *waiting for approval* is reserved for Codex's manual
+"Ask for approval" mode.
 Per-tool `PreToolUse` hooks still depend on an upstream Codex gap
 ([openai/codex#16732](https://github.com/openai/codex/issues/16732)); the
 transcript watcher covers that in the meantime.

package/apps/cli/src/haya-pet.js

@@ -58,6 +58,10 @@ export function parseAiPetArgs(argv) {
     return parseStateArgs(rest);
   }
 
+  if (command === "codex-permission-request") {
+    return { command: "codex-permission-request" };
+  }
+
   if (command === "hooks") {
     return parseHooksArgs(rest);
   }
@@ -84,6 +88,10 @@ export async function runAiPet(argv, dependencies = {}) {
     return runStateCommand(parsed, dependencies);
   }
 
+  if (parsed.command === "codex-permission-request") {
+    return runCodexPermissionRequestCommand(parsed, dependencies);
+  }
+
   if (parsed.command === "hooks") {
     return runHooksCommand(parsed, dependencies);
   }
@@ -172,6 +180,21 @@ async function reportUpdateNotice(updateCheck, print) {
   }
 }
 
+function runCodexPermissionRequestCommand(_parsed, dependencies = {}) {
+  const env = dependencies.env ?? process.env;
+  const reviewer = normalizeCodexApprovalsReviewer(env.HAYA_PET_CODEX_APPROVAL_REVIEWER);
+  const autoReview = isCodexAutoReviewer(reviewer);
+  return runStateCommand(
+    {
+      command: "state",
+      state: autoReview ? "reviewing" : "waiting_approval",
+      summary: autoReview ? "agent reviewing approval" : "approval",
+      session: undefined
+    },
+    dependencies
+  );
+}
+
 function readOwnVersion() {
   try {
     const packagePath = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "package.json");
@@ -181,6 +204,116 @@ function readOwnVersion() {
   }
 }
 
+function resolveCodexApprovalsReviewer(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = normalizeCodexApprovalsReviewer(env.HAYA_PET_CODEX_APPROVAL_REVIEWER);
+  if (explicit) {
+    return explicit;
+  }
+
+  const fromArgs = findCodexApprovalsReviewerInArgs(options.childArgs ?? []);
+  if (fromArgs) {
+    return fromArgs;
+  }
+
+  const home = options.codexHome ?? env.CODEX_HOME ?? resolveHomeCodexDir(options.homeDir, env);
+  const readFile = options.readFile ?? readFileSync;
+  const fromConfig = readCodexApprovalsReviewerFromConfig(home, readFile);
+  return fromConfig ?? "user";
+}
+
+function resolveHomeCodexDir(homeDir, env) {
+  const home = homeDir ?? env.USERPROFILE ?? env.HOME;
+  return home ? join(home, ".codex") : undefined;
+}
+
+function findCodexApprovalsReviewerInArgs(args) {
+  let reviewer;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    let configValue;
+    if (arg === "-c" || arg === "--config") {
+      configValue = args[index + 1];
+      index += 1;
+    } else if (arg.startsWith("--config=")) {
+      configValue = arg.slice("--config=".length);
+    } else if (arg.startsWith("-c") && arg.length > 2) {
+      configValue = arg.slice(2);
+    }
+
+    const parsed = parseApprovalsReviewerAssignment(configValue);
+    if (parsed) {
+      reviewer = parsed;
+    }
+  }
+  return reviewer;
+}
+
+function readCodexApprovalsReviewerFromConfig(codexHome, readFile) {
+  if (!codexHome) {
+    return undefined;
+  }
+  try {
+    return parseTopLevelApprovalsReviewer(readFile(join(codexHome, "config.toml"), "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+
+function parseTopLevelApprovalsReviewer(toml) {
+  let inTopLevel = true;
+  for (const line of String(toml).split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    if (trimmed.startsWith("[")) {
+      inTopLevel = false;
+      continue;
+    }
+    if (!inTopLevel) {
+      continue;
+    }
+    const reviewer = parseApprovalsReviewerAssignment(trimmed);
+    if (reviewer) {
+      return reviewer;
+    }
+  }
+  return undefined;
+}
+
+function parseApprovalsReviewerAssignment(value) {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const match = /^\s*approvals_reviewer\s*=\s*(.+?)\s*(?:#.*)?$/.exec(value);
+  if (!match) {
+    return undefined;
+  }
+  return normalizeCodexApprovalsReviewer(stripTomlString(match[1]));
+}
+
+function stripTomlString(value) {
+  const trimmed = String(value).trim();
+  const quote = trimmed[0];
+  if ((quote === "\"" || quote === "'") && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+
+function normalizeCodexApprovalsReviewer(value) {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  return normalized || undefined;
+}
+
+function isCodexAutoReviewer(value) {
+  return value === "auto_review" || value === "guardian_subagent";
+}
+
 async function runRunCommand(parsed, dependencies) {
   const runGenericCommand = dependencies.runGenericCommand ?? defaultRunGenericCommand;
   const injectClaudeHooks = dependencies.injectClaudeHooks ?? defaultInjectClaudeHooks;
@@ -276,7 +409,17 @@ async function runRunCommand(parsed, dependencies) {
     } else {
       const injected = injectCodexHooks();
       childArgs = ["-p", injected.profileName, ...parsed.childArgs];
-      childEnv = { ...env, HAYA_PET_SESSION_ID: sessionId };
+      childEnv = {
+        ...env,
+        HAYA_PET_SESSION_ID: sessionId,
+        HAYA_PET_CODEX_APPROVAL_REVIEWER: resolveCodexApprovalsReviewer({
+          childArgs: parsed.childArgs,
+          env,
+          homeDir: dependencies.homeDir,
+          codexHome: dependencies.codexHome,
+          readFile: dependencies.readFile
+        })
+      };
       cleanup = injected.cleanup;
 
       const activeToolCalls = new Set();
@@ -353,8 +496,9 @@ async function runRunCommand(parsed, dependencies) {
       // With "Approve for me" (approvals_reviewer=auto_review, legacy alias
       // guardian_subagent), Codex routes approval requests to a guardian
       // subagent and never shows the human approval UI — yet the
-      // PermissionRequest hook still fires at request creation, which used to
-      // pin the pet on a false "waiting for approval" for the whole review.
+      // PermissionRequest hook still fires at request creation. The hook's
+      // reporter uses the resolved approvals reviewer config: auto-review
+      // reports reviewing immediately, while manual review reports waiting.
       // The guardian's own rollout is the only observable record of the
       // review, so tail it: a review turn starting proves the agent is
       // reviewing; an "allow" verdict proves the action proceeds; a "deny"

package/apps/cli/test/haya-pet.test.mjs

@@ -399,10 +399,56 @@ test("parses the state command", () => {
     command: "state",
     state: "thinking",
     summary: undefined,
-    session: "sess_q"
+    session: "sess_q",
   });
 });
 
+test("parses the Codex permission request reporter command", () => {
+  assert.deepEqual(parseAiPetArgs(["codex-permission-request"]), {
+    command: "codex-permission-request"
+  });
+});
+
+test("Codex permission request reporter shows reviewing for auto-review", async () => {
+  const messages = [];
+  await runAiPet(["codex-permission-request"], {
+    env: {
+      HAYA_PET_SESSION_ID: "sess_review",
+      HAYA_PET_CODEX_APPROVAL_REVIEWER: "auto_review"
+    },
+    now: () => 123,
+    ipcEndpoint: "test-endpoint",
+    createIpcClient: async () => ({
+      send: async (message) => messages.push(message),
+      close: async () => {}
+    })
+  });
+
+  assert.equal(messages.length, 1);
+  assert.equal(messages[0].state, "reviewing");
+  assert.equal(messages[0].summary, "agent reviewing approval");
+});
+
+test("Codex permission request reporter shows waiting for manual reviewer", async () => {
+  const messages = [];
+  await runAiPet(["codex-permission-request"], {
+    env: {
+      HAYA_PET_SESSION_ID: "sess_manual",
+      HAYA_PET_CODEX_APPROVAL_REVIEWER: "user"
+    },
+    now: () => 123,
+    ipcEndpoint: "test-endpoint",
+    createIpcClient: async () => ({
+      send: async (message) => messages.push(message),
+      close: async () => {}
+    })
+  });
+
+  assert.equal(messages.length, 1);
+  assert.equal(messages[0].state, "waiting_approval");
+  assert.equal(messages[0].summary, "approval");
+});
+
 const hooksStateFile = (hooksEnabled) => () => ({
   load: async () => ({ settings: { hooksEnabled } }),
   save: async (state) => state
@@ -509,6 +555,26 @@ test("persisted `hooks on` injects a Codex profile via -p at the front of args",
 
   assert.equal(injected, 1, "config preference enables Codex hooks");
   assert.deepEqual(calls[0].args, ["-p", "haya-pet"], "profile flag goes at the front");
+  assert.equal(calls[0].env.HAYA_PET_CODEX_APPROVAL_REVIEWER, "user");
+});
+
+test("codex hooks pass auto-review config to the PermissionRequest reporter", async () => {
+  const calls = [];
+  await runAiPet(["run", "--client", "codex", "--", "codex"], {
+    cwd: process.cwd(),
+    env: { USERPROFILE: "C:\\Users\\A" },
+    heartbeatIntervalMs: 10,
+    send: async () => {},
+    createStateFile: hooksStateFile(true),
+    injectCodexHooks: () => ({ profileName: "haya-pet", cleanup: () => {} }),
+    readFile: () => 'approvals_reviewer = "auto_review"\n',
+    runGenericCommand: async (options) => {
+      calls.push(options);
+      return { sessionId: options.sessionId, pid: 1, exitCode: 0 };
+    }
+  });
+
+  assert.equal(calls[0].env.HAYA_PET_CODEX_APPROVAL_REVIEWER, "auto_review");
 });
 
 test("codex hooks also start a transcript watcher for tool activity", async () => {

package/apps/companion/src/main/index.js

@@ -1,6 +1,6 @@
 import { app, BrowserWindow, ipcMain, Menu, nativeImage, screen, shell, Tray } from "electron";
 import { fileURLToPath } from "node:url";
-import { readFileSync } from "node:fs";
+import { appendFileSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { createDaemonRuntime } from "../../../../packages/daemon-core/src/daemon-runtime.js";
 import { createIpcServer } from "../../../../packages/daemon-core/src/ipc-server.js";
@@ -30,6 +30,35 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const TRAY_ICON_DATA_URL =
   "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAANElEQVR4nGNgoAXIW/HvPzZMtkaiDCJWM05DKDKAVM0YhowaQAUDBj4dUCUpE2MQQY3kAACyf/g8DHVl5wAAAABJRU5ErkJggg==";
 
+// Best-effort daemon-side diagnostic, mirroring the wrapper's HAYA_PET_HOOK_DEBUG.
+// When HAYA_PET_DAEMON_DEBUG points at a file, append one JSONL line per incoming
+// non-heartbeat message in DAEMON ARRIVAL ORDER, with its updatedAt. This is the
+// only place the true apply order is visible: the registry is last-writer-wins by
+// arrival and ignores updatedAt, so a stale "working" message that arrives after
+// "interrupted" would surface here as the clobber. Never throws.
+function debugLogDaemonMessage(message) {
+  const target = process.env.HAYA_PET_DAEMON_DEBUG;
+  if (!target || !message || message.type === "heartbeat") {
+    return;
+  }
+  try {
+    appendFileSync(
+      target,
+      `${JSON.stringify({
+        ts: Date.now(),
+        type: message.type,
+        sessionId: message.sessionId,
+        state: message.state,
+        source: message.source,
+        updatedAt: message.updatedAt,
+        summary: message.summary
+      })}\n`
+    );
+  } catch {
+    // diagnostics must never break the daemon
+  }
+}
+
 const paths = getDefaultPaths();
 const capabilities = getPlatformCapabilities();
 const stateFile = createStateFile({ statePath: paths.statePath });
@@ -113,6 +142,7 @@ async function bootstrap() {
         app.quit();
         return;
       }
+      debugLogDaemonMessage(message);
       return runtime.handleMessage(message);
     },
     onProtocolError: (error) => console.error("protocol error:", error.message)

package/docs/architecture.md

@@ -74,10 +74,13 @@ notice. Codex's hook command must be unquoted at the program position (it runs v
 transcript watcher tailing the session rollout. `PermissionRequest` fires, but
 once at approval-request creation — before Codex routes the request to either
 the user or its guardian auto-reviewer ("Approve for me"), which never prompts
-the user at all. An L3 **guardian-trunk watcher** tails the guardian's own
+the user at all. The hook therefore calls a Codex-specific permission reporter:
+when the resolved Codex config says `approvals_reviewer = "auto_review"` (or the
+legacy `guardian_subagent` alias), it reports `reviewing`; otherwise it reports
+`waiting_approval`. An L3 **guardian-trunk watcher** tails the guardian's own
 rollout (`source: {subagent:{other:"guardian"}}`, parented to the main thread)
-and refines the state: review running → `reviewing`, verdict allow →
-`running_tool`, verdict deny → `thinking`.
+and refines the state from real review events: review running → `reviewing`,
+verdict allow → `running_tool`, verdict deny → `thinking`.
 
 Hooks alone can't see one moment: clients emit **no event when the user accepts a
 permission prompt** (denial and completion are observable; the accept click is

package/docs/known-issues.md

@@ -2,6 +2,43 @@
 
 Issues found in live use, with their current status.
 
+## ⏳ In progress: Codex interrupt sometimes leaves the pet "working"
+
+- **Symptom:** Pressing Esc to interrupt a Codex turn occasionally does **not**
+  flip the pet to *interrupted* — it keeps showing a working state (*thinking* /
+  *running*) even though the turn was cut short. Intermittent ("some occasions").
+- **Investigation so far:** The "a late `function_call_output` resets the state to
+  *thinking*" theory was **ruled out** — across 257 real `turn_aborted` events in
+  live `~/.codex/sessions`, **zero** had a tool result after the abort. Codex
+  fires no hook on an abort, and the L3 transcript watcher does record
+  `turn_aborted` and emit `interrupted`.
+- **Leading suspect:** The daemon registry applies session state **last-writer-
+  wins by IPC arrival order** (`registry.js` `applyState` ignores `updatedAt` and
+  `confidence`). Hooks (separate `haya-pet state` subprocesses) and the interrupt
+  watcher use different IPC connections, so a stale "working" message can arrive
+  *after* `interrupted` and clobber it. Discovery edges (a resumed session whose
+  `session_meta.timestamp` predates the wrapper launch is filtered out; concurrent
+  Codex sessions can attach the watcher to the wrong rollout) are secondary
+  candidates.
+- **Status:** Instrumented with a daemon-side arrival trace (`HAYA_PET_DAEMON_DEBUG`,
+  in `apps/companion/src/main/index.js`) to confirm whether `interrupted` is never
+  emitted (watcher/discovery) vs. emitted-then-clobbered (arrival-order race).
+  **Fix to follow shortly** — likely an `updatedAt`-monotonic guard in `applyState`.
+
+## ✅ Resolved: Claude pet stuck on "compacting" after a compaction
+
+- **Symptom:** With Claude Code hooks enabled, the pet entered *compacting* on
+  `PreCompact` and never left — it sat there until the 30 s stale sweep or the
+  next prompt. Most visible after a manual `/compact`.
+- **Root cause:** The Claude hook table subscribed `PreCompact` → *compacting* but
+  had **no completion event**. Claude's `Stop` does not fire for a compaction, so
+  nothing cleared the state. (Codex already subscribed `PostCompact`.)
+- **Fix:** The Claude hook table now also subscribes **`PostCompact`**, split by
+  the documented `manual`/`auto` trigger matcher: a **manual** `/compact` returns
+  to *idle* (control is back at the prompt), while an **auto** compaction resumes
+  to *thinking* (the agent continues the turn) and the next real event refines it.
+  Verified live on the manual path; auto uses the identical matcher mechanism.
+
 ## ✅ Resolved: Claude Code subagent completion changed the main session status
 
 - **Symptom:** In Claude Code multi-agent runs, the main agent could already be
@@ -32,12 +69,17 @@ Issues found in live use, with their current status.
   guardian `deny` returns the rationale to the **model** as a rejected tool call
   ("This action was rejected due to unacceptable risk. …"), so no human decision
   is ever pending. Our Codex hook table mapped `PermissionRequest` →
-  `waiting_approval` unconditionally. No better hook exists: nothing fires on
-  guardian start/finish (the guardian session is `SubAgentSource::Other`, which
-  is excluded from Subagent hooks), and `GuardianAssessment` events are
-  explicitly not persisted to the main rollout (`rollout/src/policy.rs`).
-- **Fix:** an **L3 guardian-trunk watcher** (`codex-guardian-watcher.js` +
-  `adapters/codex-guardian.js`). The guardian runs as its own Codex session that
+  `waiting_approval` unconditionally. Nothing fires on guardian start/finish
+  (the guardian session is `SubAgentSource::Other`, which is excluded from
+  Subagent hooks), and `GuardianAssessment` events are explicitly not persisted
+  to the main rollout (`rollout/src/policy.rs`).
+- **Fix:** a Codex-specific `PermissionRequest` reporter plus an **L3
+  guardian-trunk watcher** (`codex-guardian-watcher.js` +
+  `adapters/codex-guardian.js`). The reporter checks the wrapped session's
+  resolved Codex `approvals_reviewer` config: `auto_review` / legacy
+  `guardian_subagent` reports **reviewing** immediately, while manual/unknown
+  reviewer config reports **waiting for approval**. This is config/event-backed,
+  not a timer. The guardian runs as its own Codex session that
   writes its own rollout under `~/.codex/sessions` — session_meta has
   `source: {subagent: {other: "guardian"}}` and `parent_thread_id` = the main
   thread; each review is one turn (`task_started` → `task_complete` with the
@@ -51,17 +93,29 @@ Issues found in live use, with their current status.
   there is no trunk and behavior is unchanged: `PermissionRequest` →
   *waiting for approval* until the user decides (process-tree/denial detection
   resolve it, as before).
-- **Known limitations (accepted):** (1) A ≤ ~1 s *waiting for approval* flicker
-  can precede *reviewing* (the hook fires immediately; the trunk poll is 700 ms).
-  (2) Reviews of a **collab subagent's** actions (multi-agent runs) have their
+- **Known limitations (accepted):** (1) Reviews of a **collab subagent's** actions (multi-agent runs) have their
   own trunks keyed to the subagent's thread and are not watched; a subagent's
-  `PermissionRequest` can still briefly show *waiting for approval* until the
-  next main-session event. (3) After a guardian deny the pet shows *thinking*,
+  `PermissionRequest` still follows the wrapped session's resolved reviewer
+  config; if that subagent is using different approval settings, the parent
+  session may not be able to distinguish it. (2) After a guardian deny the pet shows *thinking*,
   not *waiting for approval* — by design: Codex resolves the request itself and
   the model decides what to do next (it may ask the user in chat, which then
   surfaces as turn-end *idle*). The TUI's passive `/approve` denial-override
   picker is not a blocking prompt.
 
+## ✅ Resolved: Codex pet looked busy immediately after startup
+
+- **Symptom:** Starting a wrapped Codex session and doing nothing could still make
+  the pet show `shell_command` or `thinking` instead of `idle`.
+- **Root cause:** The Codex transcript and guardian watchers originally chose the
+  newest rollout by file mtime, then filtered individual records by timestamp.
+  Another already-running Codex session could keep writing fresh records after
+  HAYA Pet started, making its rollout look like the wrapped session even though
+  it began earlier.
+- **Fix:** Both watchers now inspect the first `session_meta` line and require
+  its timestamp to belong to this wrapper launch. Old-but-active Codex sessions
+  are ignored even if their files continue to receive fresh writes.
+
 ## ✅ Resolved: Codex `/quit` hung on its goodbye (and the pet kept showing "working")
 
 - **Symptom:** Exiting Codex with `/quit` printed the token-usage goodbye and the
@@ -242,8 +296,10 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
   lifecycle status). Live in-session status is **opt-in** via `HAYA_PET_HOOKS=1`,
   which injects a settings file (`claude --settings <stable-file>`, no change to
   your global config) wiring Claude's `UserPromptSubmit`/`PreToolUse`/`PostToolUse`/
-  `Notification`/`PreCompact`/`Stop` events to `haya-pet state <state>`, reported
-  to the daemon over the IPC pipe. `SubagentStop` is intentionally ignored because
+  `Notification`/`PreCompact`/`PostCompact`/`Stop` events to `haya-pet state <state>`,
+  reported to the daemon over the IPC pipe. `PostCompact` is split by its
+  `manual`/`auto` trigger matcher (manual `/compact` → *idle*, auto compaction →
+  *thinking*) so the pet never sticks on *compacting*. `SubagentStop` is intentionally ignored because
   it is not a main-turn idle signal. `PreToolUse` distinguishes
   file-editing tools (`Edit`/`Write`/`MultiEdit`/`NotebookEdit` → *editing files*)
   from other tools (→ *running tools*) via the hook `matcher`. **Why opt-in:**
@@ -298,14 +354,15 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
     reports `editing_files`, and HAYA Pet returns to `thinking` after active tool
     calls drain.
   - **`PermissionRequest` fires** (confirmed live on 0.139.0), but **once, at
-    approval-request creation, before routing** — under "Approve for me"
-    (`approvals_reviewer = auto_review` / legacy `guardian_subagent`) the user is
-    never actually prompted, so the hook alone over-reports *waiting for
-    approval*. An L3 **guardian-trunk watcher** tails the guardian reviewer's own
-    rollout (`source: {subagent:{other:"guardian"}}`, `parent_thread_id` = main
-    thread) and refines the state: review running → *reviewing*, verdict `allow`
-    → *running_tool*, verdict `deny` → *thinking*. See the resolved
-    false-waiting-for-approval entry above.
+    approval-request creation, before routing**. The hook calls
+    `haya-pet codex-permission-request`, which uses the wrapped session's
+    resolved `approvals_reviewer` config: `auto_review` / legacy
+    `guardian_subagent` reports *reviewing*, while manual review reports
+    *waiting for approval*. An L3 **guardian-trunk watcher** tails the guardian
+    reviewer's own rollout (`source: {subagent:{other:"guardian"}}`,
+    `parent_thread_id` = main thread) and refines the state: review running →
+    *reviewing*, verdict `allow` → *running_tool*, verdict `deny` → *thinking*.
+    See the resolved false-waiting-for-approval entry above.
 - **Antigravity (`agy`)** — **not yet implemented** (no hook injection). Uses
   `--observe` or L1 lifecycle. A Gemini-schema hook adapter is a planned follow-up.
 - **Generic / unknown** — no hooks; PTY observation (`--observe`) or L1 lifecycle.

package/docs/troubleshooting.md

@@ -18,7 +18,8 @@ deferred problems with known root causes.
 | Typing doesn't work / **Claude Code** TUI frozen under `haya-pet run` | You have hooks enabled and Claude is showing its *review hooks* trust prompt (approve it once), or your Claude is too old for `--settings`. Run `haya-pet hooks off` (or set `HAYA_PET_NO_HOOKS=1`) for native passthrough with lifecycle-only status — typing and Shift+Tab work normally. |
 | Pet changes status after a **Claude Code** subagent finishes, even though the main agent already stopped | Fixed — Claude `SubagentStop` is ignored because it is not a reliable main-turn state. Update to the latest version and restart the wrapped Claude session so the new hook settings are used. |
 | Pet shows only **idle/lifecycle** while **Codex** works | Live status is opt-in: run `haya-pet hooks on` once (persisted, global), then `haya-pet run --client codex -- codex`; approve Codex's one-time *review hooks* prompt. `thinking`/`idle` come from hooks, `running_tool`/`editing_files` from a transcript watcher, and approval states from the `PermissionRequest` hook plus a guardian-review watcher. |
-| Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now shows **reviewing** during the assessment, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). |
+| Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now reports **reviewing** from the permission hook itself, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). Restart the wrapped Codex session after updating so Codex reloads the changed hook command. |
+| Pet shows **shell_command** or **thinking** right after starting Codex, before you prompt it | Fixed — the Codex transcript and guardian watchers now ignore rollouts whose `session_meta.timestamp` predates the current wrapper launch, so another active Codex session cannot drive this pet's status. Restart the wrapped Codex session after updating. |
 | **Codex** live status didn't turn on / you pass your own `-p`/`--profile` | Codex allows only one profile, so haya-pet skips hook injection when you supply your own and prints a notice. Drop your `-p` for that run to get live status, or accept lifecycle-only. |
 | Pet shows only **idle/lifecycle** while **Antigravity** (`agy`) works | Antigravity has no hook adapter yet. Add `--observe` for coarse PTY activity, or accept lifecycle-only status. |
 | Claude hooks fail with **"hook exited with code 1"** | The hook command must not bake an **fnm**/node-manager *per-shell* node path (`…\fnm_multishells\<pid>_…\node.exe`) that dies when the shell exits. haya-pet bakes the stable `realpath`-resolved node path into the temp settings instead. Update to the latest version. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hayasaka7/haya-pet",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "type": "module",
   "description": "Generic AI CLI pet runtime foundation.",
   "keywords": [

package/packages/adapters/src/claude-hooks.js

@@ -33,6 +33,14 @@ const HOOK_TABLE = Object.freeze([
   { event: "Notification", matcher: "idle_prompt", state: "idle", summary: "idle" },
   { event: "PermissionDenied", state: "idle", summary: "denied" },
   { event: "PreCompact", state: "compacting" },
+  // PostCompact is the authoritative "compaction finished" signal (verified in
+  // the Claude hooks docs). Without it the pet stays stuck on `compacting` until
+  // the 30s stale sweep. The `trigger` matcher splits the two outcomes: a manual
+  // /compact hands control back to an idle prompt, while an AUTO compaction fires
+  // mid-turn and the agent immediately resumes working (thinking) — the next real
+  // event (PreToolUse/Stop) refines from there. Mirrors codex-hooks' PostCompact.
+  { event: "PostCompact", matcher: "manual", state: "idle", summary: "compacted" },
+  { event: "PostCompact", matcher: "auto", state: "thinking", summary: "compacted" },
   { event: "Stop", state: "idle" },
   { event: "StopFailure", state: "idle", summary: "stopped" }
 ]);
@@ -49,6 +57,11 @@ export function mapClaudeEventToState(event, detail) {
     if (detail === "idle_prompt") return "idle";
     return undefined;
   }
+  if (event === "PostCompact") {
+    // `detail` is the compaction trigger ("manual" | "auto"). A manual /compact
+    // ends at an idle prompt; an auto compaction resumes the turn (thinking).
+    return detail === "manual" ? "idle" : "thinking";
+  }
   const entry = HOOK_TABLE.find((row) => row.event === event && row.matcher === undefined);
   return entry?.state;
 }

package/packages/adapters/src/codex-hooks.js

@@ -37,11 +37,12 @@
 //    source): fires ONCE at approval-request creation, BEFORE the request is
 //    routed to the guardian auto-reviewer or the user. Under "Approve for me"
 //    (approvals_reviewer=auto_review, legacy alias guardian_subagent) the user
-//    is never prompted at all, so waiting_approval from this hook over-reports;
-//    the wrapper's codex-guardian-watcher refines it to reviewing /
-//    running_tool / thinking from the guardian's own rollout. The guardian
+//    is never prompted at all, so this hook calls a Codex-specific permission
+//    reporter instead of hard-coding waiting_approval. The wrapper passes the
+//    resolved approvals reviewer mode in env; auto_review reports reviewing,
+//    while manual/unknown reviewer config reports waiting_approval. The guardian
 //    fires NO hooks itself (SubAgentSource::Other is excluded from Subagent
-//    hooks), so these entries can't see it.
+//    hooks), so the wrapper also tails the guardian rollout directly.
 //  - UNTESTED: PreCompact / SubagentStart|Stop (no compaction / subagent
 //    occurred in the probe).
 //
@@ -76,7 +77,7 @@ const HOOK_TABLE = Object.freeze([
   { event: "PreToolUse", matcher: EDIT_TOOLS_MATCHER, state: "editing_files" },
   { event: "PreToolUse", matcher: COMMAND_TOOLS_MATCHER, state: "running_tool" },
   { event: "PostToolUse", state: "thinking" },
-  { event: "PermissionRequest", state: "waiting_approval" },
+  { event: "PermissionRequest", command: "codex-permission-request" },
   { event: "PreCompact", state: "compacting" },
   { event: "PostCompact", state: "thinking", summary: "compacted" },
   // A subagent finishing is mid-turn — the main agent keeps working, so this is
@@ -111,15 +112,21 @@ export function mapCodexEventToState(event, toolName) {
 // node path, which is space-free for fnm/scoop/nvm layouts; a space-tolerant
 // path (short 8.3 name, or `command_windows`) is a follow-up before shipping.
 export function buildCodexHookSettings({ nodePath, cliPath }) {
-  const command = (state, summary) => {
+  const stateCommand = (state, summary) => {
     // nodePath unquoted (must not lead with a quote); cliPath quoted for spaces.
-    const base = `${nodePath} ${quote(cliPath)} state ${state}`;
-    return summary ? `${base} --summary ${summary}` : base;
+    let output = `${nodePath} ${quote(cliPath)} state ${state}`;
+    if (summary) {
+      output += ` --summary ${summary}`;
+    }
+    return output;
   };
+  const command = (row) => row.command
+    ? `${nodePath} ${quote(cliPath)} ${row.command}`
+    : stateCommand(row.state, row.summary);
 
   const hooks = {};
   for (const row of HOOK_TABLE) {
-    const hookEntry = { hooks: [{ type: "command", command: command(row.state, row.summary) }] };
+    const hookEntry = { hooks: [{ type: "command", command: command(row) }] };
     if (row.matcher !== undefined) {
       hookEntry.matcher = row.matcher;
     }

package/packages/adapters/test/claude-hooks.test.mjs

@@ -31,6 +31,15 @@ test("mapClaudeEventToState branches Notification on type (approval vs idle)", (
   assert.equal(mapClaudeEventToState("Notification", "auth_success"), undefined);
 });
 
+test("mapClaudeEventToState branches PostCompact on compaction trigger", () => {
+  // Manual /compact returns to an idle prompt; auto compaction resumes the turn.
+  assert.equal(mapClaudeEventToState("PostCompact", "manual"), "idle");
+  assert.equal(mapClaudeEventToState("PostCompact", "auto"), "thinking");
+  // Unknown/missing trigger defaults to the "still working" assumption, which the
+  // next real event corrects — never leaving the pet stuck on `compacting`.
+  assert.equal(mapClaudeEventToState("PostCompact"), "thinking");
+});
+
 test("buildClaudeHookSettings bakes node + cli, no volatile session id", () => {
   const settings = buildClaudeHookSettings({
     nodePath: "/usr/bin/node",
@@ -62,6 +71,15 @@ test("buildClaudeHookSettings splits Notification into approval + idle matchers"
   assert.match(idle.hooks[0].command, /state idle --summary idle$/);
 });
 
+test("buildClaudeHookSettings splits PostCompact into manual + auto triggers", () => {
+  const post = buildClaudeHookSettings({ nodePath: "n", cliPath: "c" }).hooks.PostCompact;
+  assert.equal(post.length, 2);
+  const manual = post.find((e) => e.matcher === "manual");
+  const auto = post.find((e) => e.matcher === "auto");
+  assert.match(manual.hooks[0].command, /state idle --summary compacted$/);
+  assert.match(auto.hooks[0].command, /state thinking --summary compacted$/);
+});
+
 test("buildClaudeHookSettings keeps two non-overlapping PreToolUse matchers", () => {
   const pre = buildClaudeHookSettings({ nodePath: "n", cliPath: "c" }).hooks.PreToolUse;
   assert.equal(pre.length, 2);
@@ -83,7 +101,7 @@ test("buildClaudeHookSettings includes all subscribed events", () => {
   for (const event of [
     "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure",
     "PermissionRequest", "Notification", "PermissionDenied", "PreCompact",
-    "Stop", "StopFailure"
+    "PostCompact", "Stop", "StopFailure"
   ]) {
     assert.ok(settings.hooks[event], `missing hook event ${event}`);
   }

package/packages/adapters/test/codex-hooks.test.mjs

@@ -10,7 +10,7 @@ import {
 test("mapCodexEventToState covers activity events", () => {
   assert.equal(mapCodexEventToState("UserPromptSubmit"), "thinking");
   assert.equal(mapCodexEventToState("PostToolUse"), "thinking");
-  assert.equal(mapCodexEventToState("PermissionRequest"), "waiting_approval");
+  assert.equal(mapCodexEventToState("PermissionRequest"), undefined);
   assert.equal(mapCodexEventToState("PreCompact"), "compacting");
   assert.equal(mapCodexEventToState("PostCompact"), "thinking");
   assert.equal(mapCodexEventToState("SubagentStart"), "running_tool");
@@ -64,6 +64,13 @@ test("buildCodexHookSettings splits PreToolUse into edit + command matchers", ()
   assert.equal(other.matcher, "shell_command");
 });
 
+test("buildCodexHookSettings routes PermissionRequest through the Codex reporter", () => {
+  const permission = buildCodexHookSettings({ nodePath: "n", cliPath: "c" }).hooks.PermissionRequest;
+  assert.equal(permission.length, 1);
+  assert.match(permission[0].hooks[0].command, /codex-permission-request$/);
+  assert.doesNotMatch(permission[0].hooks[0].command, /--defer-ms/);
+});
+
 test("no matcher uses look-around (Codex's Rust regex crate rejects it)", () => {
   // Regression guard: a `(?!…)` / `(?=…)` matcher is a hard parse error in Codex
   // and disables that hook. Keep all matchers look-around-free.

package/packages/cli-core/src/codex-guardian-watcher.js

@@ -50,6 +50,11 @@ export function watchCodexGuardianReviews(options = {}) {
       return undefined;
     }
     const meta = classifyCodexSessionMeta(firstLine) ?? null;
+    const sessionStartedAt = readSessionMetaTimestamp(firstLine);
+    if (meta && minMtime > 0 && (!Number.isFinite(sessionStartedAt) || sessionStartedAt < minMtime)) {
+      metaByPath.set(file, null);
+      return null;
+    }
     metaByPath.set(file, meta);
     return meta;
   };
@@ -134,3 +139,19 @@ export function watchCodexGuardianReviews(options = {}) {
     _tick: tick
   };
 }
+
+function readSessionMetaTimestamp(line) {
+  let entry;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+
+  if (entry?.type !== "session_meta" || typeof entry.timestamp !== "string") {
+    return undefined;
+  }
+
+  const timestampMs = Date.parse(entry.timestamp);
+  return Number.isFinite(timestampMs) ? timestampMs : undefined;
+}

package/packages/cli-core/src/codex-transcript-watcher.js

@@ -4,7 +4,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { parseCodexTranscriptLines } from "../../adapters/src/codex-transcript.js";
-import { listJsonlFiles, readRange, safeMtime, safeSize } from "./codex-rollout-fs.js";
+import { listJsonlFiles, readFirstLine, readRange, safeMtime, safeSize } from "./codex-rollout-fs.js";
 
 const DEFAULT_POLL_MS = 700;
 const MTIME_SKEW_MS = 2000;
@@ -89,9 +89,34 @@ export function discoverCodexTranscript(root, minMtime = 0) {
     if (mtime < minMtime) {
       continue;
     }
+    const sessionStartedAt = readCodexSessionStartedAt(file);
+    if (!Number.isFinite(sessionStartedAt) || sessionStartedAt < minMtime) {
+      continue;
+    }
     if (!newest || mtime > newest.mtime) {
       newest = { file, mtime };
     }
   }
   return newest?.file;
 }
+
+function readCodexSessionStartedAt(file) {
+  const line = readFirstLine(file);
+  if (line === undefined) {
+    return undefined;
+  }
+
+  let entry;
+  try {
+    entry = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+
+  if (entry?.type !== "session_meta" || typeof entry.timestamp !== "string") {
+    return undefined;
+  }
+
+  const timestampMs = Date.parse(entry.timestamp);
+  return Number.isFinite(timestampMs) ? timestampMs : undefined;
+}

package/packages/cli-core/test/codex-guardian-watcher.test.mjs

@@ -8,7 +8,11 @@ import { watchCodexGuardianReviews } from "../src/codex-guardian-watcher.js";
 const noopTimers = { setInterval: () => ({}), clearInterval: () => {} };
 
 function metaLine(payload) {
-  return `${JSON.stringify({ type: "session_meta", payload })}\n`;
+  return `${JSON.stringify({ timestamp: "2026-06-12T01:36:41.556Z", type: "session_meta", payload })}\n`;
+}
+
+function metaLineAt(timestamp, payload) {
+  return `${JSON.stringify({ timestamp, type: "session_meta", payload })}\n`;
 }
 
 function reviewStarted(turnId = "turn-1", timestamp) {
@@ -136,6 +140,41 @@ test("watchCodexGuardianReviews skips review records from before the session sta
   watcher.stop();
 });
 
+test("watchCodexGuardianReviews ignores guardian trunks for sessions that started before this wrapper", () => {
+  const { root, dir } = makeSessionsRoot();
+  writeFileSync(
+    join(dir, "rollout-main.jsonl"),
+    metaLineAt("2026-06-12T00:00:00.000Z", {
+      id: "main-1",
+      parent_thread_id: null,
+      source: "cli",
+      thread_source: "user"
+    })
+  );
+  writeFileSync(
+    join(dir, "rollout-guardian.jsonl"),
+    metaLineAt("2026-06-12T00:01:00.000Z", {
+      id: "guardian-1",
+      parent_thread_id: "main-1",
+      source: { subagent: { other: "guardian" } }
+    }) + reviewStarted("turn-new", "2026-06-12T02:00:00.000Z")
+  );
+
+  const events = [];
+  const watcher = watchCodexGuardianReviews({
+    sessionsRoot: root,
+    startedAt: Date.parse("2026-06-12T01:00:00.000Z"),
+    onReviewEvent: (event) => events.push(event),
+    ...noopTimers
+  });
+
+  watcher._tick();
+
+  assert.deepEqual(events, []);
+
+  watcher.stop();
+});
+
 test("watchCodexGuardianReviews emits nothing without a classifiable main session", () => {
   const { root, dir } = makeSessionsRoot();
   // Guardian trunk exists but there is no main rollout to bind its parent to.

package/packages/cli-core/test/codex-transcript-watcher.test.mjs

@@ -7,6 +7,14 @@ import { discoverCodexTranscript, watchCodexTranscript } from "../src/codex-tran
 
 const noopTimers = { setInterval: () => ({}), clearInterval: () => {} };
 
+function sessionMeta(timestamp, id = "thread-1") {
+  return `${JSON.stringify({
+    timestamp,
+    type: "session_meta",
+    payload: { id, parent_thread_id: null, source: "cli", thread_source: "user" }
+  })}\n`;
+}
+
 function toolStart(toolName = "shell_command", callId = "call_1", timestamp) {
   return `${JSON.stringify({
     ...(timestamp ? { timestamp } : {}),
@@ -32,8 +40,8 @@ test("discoverCodexTranscript finds the newest session jsonl under date folders"
 
   const oldFile = join(oldDir, "rollout-old.jsonl");
   const newFile = join(newDir, "rollout-new.jsonl");
-  writeFileSync(oldFile, "{}\n");
-  writeFileSync(newFile, "{}\n");
+  writeFileSync(oldFile, sessionMeta("2026-06-07T10:00:00.000Z", "old-thread"));
+  writeFileSync(newFile, sessionMeta("2026-06-08T10:00:00.000Z", "new-thread"));
   appendFileSync(newFile, "{}\n");
 
   assert.equal(discoverCodexTranscript(root), newFile);
@@ -45,7 +53,7 @@ test("discoverCodexTranscript skips files older than session start", () => {
   mkdirSync(dir, { recursive: true });
 
   const oldFile = join(dir, "rollout-old.jsonl");
-  writeFileSync(oldFile, "{}\n");
+  writeFileSync(oldFile, sessionMeta("2026-06-08T10:00:00.000Z", "old-thread"));
   const past = new Date(Date.now() - 3_600_000);
   utimesSync(oldFile, past, past);
 
@@ -88,6 +96,7 @@ test("watchCodexTranscript replays current-session records when a transcript is
   writeFileSync(
     path,
     [
+      sessionMeta("2026-06-08T11:00:00.500Z", "new-thread"),
       toolStart("shell_command", "call_old", "2026-06-08T10:59:59.000Z"),
       toolStart("shell_command", "call_new", "2026-06-08T11:00:01.000Z")
     ].join("")
@@ -115,6 +124,34 @@ test("watchCodexTranscript replays current-session records when a transcript is
   watcher.stop();
 });
 
+test("watchCodexTranscript ignores fresh writes to sessions that started before this wrapper", () => {
+  const root = mkdtempSync(join(tmpdir(), "codex-sessions-"));
+  const dir = join(root, "2026", "06", "08");
+  mkdirSync(dir, { recursive: true });
+  const path = join(dir, "rollout-old-active.jsonl");
+  writeFileSync(
+    path,
+    [
+      sessionMeta("2026-06-08T10:00:00.000Z", "older-thread"),
+      toolStart("shell_command", "call_other_session", "2026-06-08T11:00:01.000Z")
+    ].join("")
+  );
+
+  const events = [];
+  const watcher = watchCodexTranscript({
+    sessionsRoot: root,
+    startedAt: Date.parse("2026-06-08T11:00:00.000Z"),
+    onToolEvent: (event) => events.push(event),
+    ...noopTimers
+  });
+
+  watcher._tick();
+
+  assert.deepEqual(events, []);
+
+  watcher.stop();
+});
+
 test("watchCodexTranscript forwards a turn_aborted interrupt event", () => {
   const dir = mkdtempSync(join(tmpdir(), "codex-transcript-"));
   const path = join(dir, "session.jsonl");

package/packages/cli-core/test/run-state.test.mjs

@@ -37,6 +37,7 @@ test("parseStateArgs reads state, summary, and session", () => {
 test("parseStateArgs rejects a missing state and unknown options", () => {
   assert.throws(() => parseStateArgs([]), /state requires a state name/);
   assert.throws(() => parseStateArgs(["thinking", "--bogus"]), /Unknown state option/);
+  assert.throws(() => parseStateArgs(["waiting_approval", "--defer-ms", "1200"]), /Unknown state option/);
 });
 
 test("runStateCommand sends one official_plugin state message", async () => {

package/packages/daemon-core/src/daemon-runtime.js

@@ -1,3 +1,4 @@
+import { assertProtocolMessage } from "../../protocol/src/messages.js";
 import { createSessionRegistry } from "../../session-core/src/registry.js";
 import { attachProtocolStream } from "./ipc-transport.js";
 
@@ -10,7 +11,8 @@ export function createDaemonRuntime(options = {}) {
     registry,
 
     handleMessage(message) {
-      const session = registry.applyMessage(message);
+      const checked = assertProtocolMessage(message);
+      const session = registry.applyMessage(checked);
       onSessionChanged(session);
       return session;
     },

package/packages/protocol/test/messages.test.mjs

@@ -107,6 +107,10 @@ test("rejects unknown message types", () => {
     () => assertProtocolMessage({ type: "unknown", sessionId: "sess_abc123" }),
     /Unknown protocol message type: unknown/
   );
+  assert.throws(
+    () => assertProtocolMessage({ type: "deferred_state", sessionId: "sess_abc123" }),
+    /Unknown protocol message type: deferred_state/
+  );
 });
 
 test("accepts a shutdown control message without a sessionId", () => {