@hayasaka7/haya-pet 0.3.5 → 0.3.7

package/CHANGELOG.md

@@ -7,7 +7,15 @@ All notable changes to HAYA Pet are documented here. This project adheres to
 > 0.2.0 npm publish; they are listed under 0.2.1, which is the first version that
 > ships them.
 
-## [0.3.5]
+## [0.3.7]
+
+### Changed
+- **The tray menu no longer shows state-only controls.** Hidden **Display Mode**
+  and **Attach Bubbles to Terminals** until those settings have real runtime
+  behavior. **Active Sessions** stays visible while session actions continue in a
+  separate workflow.
+
+## [0.3.6]
 
 ### Fixed
 - **The pet no longer gets stuck on "compacting" in Claude Code.** `PreCompact`
@@ -19,21 +27,37 @@ All notable changes to HAYA Pet are documented here. This project adheres to
   an **auto** compaction (context filled mid-turn) resumes to *thinking* and the
   next real event refines from there. Mirrors Codex, which already handled
   `PostCompact`.
+- **Codex interrupts no longer get clobbered by stale working states.** The Codex
+  transcript watcher already detected `turn_aborted` and emitted
+  *interrupted*, but the daemon registry applied state by IPC arrival order. A
+  slower hook reporter could therefore deliver an older *thinking* / *running*
+  state after the interrupt and overwrite it. The registry now keeps a separate
+  per-session state timestamp and ignores state messages older than the latest
+  accepted state, while heartbeats still update liveness independently.
+- **Codex immediate interrupts in resumed sessions are detected.** In a resumed
+  Codex session, `session_meta.timestamp` stays at the original session start.
+  The prompt-start hook could still set the pet to *thinking*, but the transcript
+  watcher rejected the old rollout before it could see the immediately appended
+  `turn_aborted`. The watcher now also follows a fresh rollout from the wrapped
+  cwd, so resumed sessions can report interrupts while unrelated old sessions
+  remain filtered.
+- **Codex auto-review status works in resumed sessions too.** The guardian-review
+  watcher had the same old-`session_meta.timestamp` filter as the transcript
+  watcher, so a resumed main rollout could be rejected before the guardian trunk
+  was matched to it. The guardian watcher now uses the same fresh-mtime + wrapped
+  cwd rule for resumed main sessions before following the guardian review trunk.
+- **Codex hook review is one-time again.** Codex stores approved hook hashes in
+  the generated `$CODEX_HOME/haya-pet.config.toml` profile under `[hooks.state]`.
+  The injector used to rewrite the whole managed profile on every launch, deleting
+  that trust state and forcing Codex to ask for hook review every time. The
+  injector now preserves Codex's hook trust tables while regenerating the HAYA
+  hook definitions.
 
 ### Added
 - **`HAYA_PET_DAEMON_DEBUG` diagnostic.** When set to a file path, the companion
   appends one JSONL line per incoming non-heartbeat message in daemon **arrival
   order** (with `updatedAt`), making out-of-order state delivery observable. Added
-  to investigate the Codex interrupt issue below.
-
-### Known issues
-- **Codex interrupt can still leave the pet "working".** On some interrupts the
-  pet keeps a working state instead of *interrupted*. The transcript watcher does
-  record `turn_aborted` (the "a late tool result resets it" theory was ruled out
-  across 257 real aborts), so the suspect is the daemon applying state by IPC
-  **arrival order**, letting a stale "working" message land after *interrupted*.
-  Instrumented via `HAYA_PET_DAEMON_DEBUG`; **fix to follow shortly.** See
-  `docs/known-issues.md`.
+  to investigate state-order races such as the Codex interrupt issue.
 
 ## [0.3.4]
 

package/README.md

@@ -136,7 +136,7 @@ success or failure briefly, then fades.
 | Global pet | Reacts to the highest-priority session and can be dragged anywhere. |
 | Session bubbles | One bubble per running AI session, ordered by connect time. |
 | Folder button | Folds the bubbles away when you want a cleaner desktop. |
-| Tray menu | Show/hide, display mode, installed pets, reset position, and quit. |
+| Tray menu | Show/hide, active sessions, installed pets, reset position, updates, and quit. |
 | Resize grip | Hover the pet, drag the corner, and keep the size you like. |
 
 ## Screenshots
@@ -144,7 +144,7 @@ success or failure briefly, then fades.
 | | |
 |---|---|
 | **The global pet** - reacting to the highest-priority session.<br>![Pet overlay](docs/screenshots/pet-overlay.png) | **Session bubbles** - one per active session, with status icons.<br>![Session bubbles](docs/screenshots/session-bubbles.png) |
-| **Folder collapsed** - bubbles tucked away beside the pet.<br>![Folder collapsed](docs/screenshots/folder-collapsed.png) | **Tray menu** - show/hide, pets, reset position, quit.<br>![Tray menu](docs/screenshots/tray-menu.png) |
+| **Folder collapsed** - bubbles tucked away beside the pet.<br>![Folder collapsed](docs/screenshots/folder-collapsed.png) | **Tray menu** - show/hide, sessions, pets, reset position, quit.<br>![Tray menu](docs/screenshots/tray-menu.png) |
 
 ## Supported Clients
 
@@ -217,7 +217,7 @@ non-observe mode keeps terminal input native.
 | Drag | Move the pet; position is saved. |
 | Drag corner grip | Resize from 0.5x to 2x; size is saved. |
 | Double-click grip | Reset to normal size. |
-| Tray icon | Open menu for display, sessions, pets, reset, and quit. |
+| Tray icon | Open menu for sessions, pets, reset, updates, and quit. |
 
 ## Commands
 

package/apps/cli/src/haya-pet.js

@@ -426,6 +426,7 @@ async function runRunCommand(parsed, dependencies) {
       const watcher = watchCodexTranscript({
         homeDir: dependencies.homeDir,
         sessionsRoot: dependencies.codexSessionsRoot,
+        cwd,
         startedAt: now(),
         onToolEvent: (event) => {
           hookDebugLog(env, now, {
@@ -507,6 +508,7 @@ async function runRunCommand(parsed, dependencies) {
       const guardianWatcher = watchCodexGuardianReviews({
         homeDir: dependencies.homeDir,
         sessionsRoot: dependencies.codexSessionsRoot,
+        cwd,
         startedAt: now(),
         onReviewEvent: (event) => {
           hookDebugLog(env, now, {

package/apps/companion/src/main/tray-menu.js

@@ -2,13 +2,6 @@
 // converts these descriptors into a native Menu; keeping it pure makes the
 // recovery controls testable.
 
-const DISPLAY_MODES = Object.freeze([
-  { value: "global", label: "Global" },
-  { value: "cluster", label: "Cluster" },
-  { value: "per-terminal", label: "Per Terminal" },
-  { value: "hybrid", label: "Hybrid" }
-]);
-
 export function buildTrayTooltip() {
   return "HAYA Pet";
 }
@@ -22,17 +15,6 @@ export function buildTrayMenu(state = {}) {
       id: "toggle_pet",
       label: state.petVisible ? "Hide Pet" : "Show Pet"
     },
-    {
-      id: "display_mode",
-      label: "Display Mode",
-      submenu: DISPLAY_MODES.map((mode) => ({
-        id: `display_mode:${mode.value}`,
-        label: mode.label,
-        value: mode.value,
-        type: "radio",
-        checked: state.displayMode === mode.value
-      }))
-    },
     {
       id: "sessions",
       label: "Active Sessions",
@@ -43,17 +25,9 @@ export function buildTrayMenu(state = {}) {
       label: "Installed Pets",
       submenu: buildPetItems(pets, state.selectedPetId)
     },
-    {
-      id: "attach_bubbles",
-      label: "Attach Bubbles to Terminals",
-      type: "checkbox",
-      checked: Boolean(state.attachBubblesToTerminals)
-    },
     { id: "reset_position", label: "Reset Position" },
-    // Parked until a real settings window exists: every current setting already
-    // has a home (tray toggles, `haya-pet hooks`, drag/grip gestures), so the
-    // item would be a dead button. Re-enable once settings outgrow the tray
-    // (e.g. bubble text size, linger duration) and a handler is wired up.
+    // Parked until a real settings window exists; partially implemented knobs
+    // stay hidden instead of showing dead or state-only controls.
     // { id: "settings", label: "Open Settings" },
     // Only present when the daily npm update check found a newer version;
     // clicking it opens the package page (the app never runs npm itself).

package/apps/companion/test/tray-menu.test.mjs

@@ -13,9 +13,11 @@ const baseState = {
 test("includes the documented recovery controls", () => {
   const menu = buildTrayMenu(baseState);
   const ids = menu.map((item) => item.id);
-  for (const id of ["toggle_pet", "display_mode", "sessions", "pets", "attach_bubbles", "reset_position", "quit"]) {
+  for (const id of ["toggle_pet", "sessions", "pets", "reset_position", "quit"]) {
     assert.ok(ids.includes(id), `missing ${id}`);
   }
+  assert.ok(!ids.includes("display_mode"), "display mode should stay hidden until implemented");
+  assert.ok(!ids.includes("attach_bubbles"), "attach bubbles should stay hidden until implemented");
   // "Open Settings" is parked until a settings window exists (every current
   // setting already has a tray/CLI/gesture home) — it must not be shown dead.
   assert.ok(!ids.includes("settings"), "settings item should stay hidden until implemented");
@@ -26,14 +28,6 @@ test("toggles the pet label based on visibility", () => {
   assert.equal(buildTrayMenu({ ...baseState, petVisible: false }).find((i) => i.id === "toggle_pet").label, "Show Pet");
 });
 
-test("checks the current display mode in the submenu", () => {
-  const submenu = buildTrayMenu(baseState).find((i) => i.id === "display_mode").submenu;
-  const hybrid = submenu.find((i) => i.value === "hybrid");
-  const global = submenu.find((i) => i.value === "global");
-  assert.equal(hybrid.checked, true);
-  assert.equal(global.checked, false);
-});
-
 test("lists active sessions or shows an empty placeholder", () => {
   const withSessions = buildTrayMenu(baseState).find((i) => i.id === "sessions").submenu;
   assert.equal(withSessions[0].label, "Codex · netdisk-server");
@@ -42,11 +36,6 @@ test("lists active sessions or shows an empty placeholder", () => {
   assert.equal(empty[0].enabled, false);
 });
 
-test("reflects the attach-bubbles checkbox state", () => {
-  assert.equal(buildTrayMenu(baseState).find((i) => i.id === "attach_bubbles").checked, true);
-  assert.equal(buildTrayMenu({ ...baseState, attachBubblesToTerminals: false }).find((i) => i.id === "attach_bubbles").checked, false);
-});
-
 test("shows the update item only when a newer version is known", () => {
   const withoutUpdate = buildTrayMenu(baseState);
   assert.ok(!withoutUpdate.some((i) => i.id === "update"), "no update item by default");

package/docs/known-issues.md

@@ -2,7 +2,7 @@
 
 Issues found in live use, with their current status.
 
-## ⏳ In progress: Codex interrupt sometimes leaves the pet "working"
+## ✅ Resolved: Codex interrupt sometimes left the pet "working"
 
 - **Symptom:** Pressing Esc to interrupt a Codex turn occasionally does **not**
   flip the pet to *interrupted* — it keeps showing a working state (*thinking* /
@@ -12,18 +12,32 @@ Issues found in live use, with their current status.
   live `~/.codex/sessions`, **zero** had a tool result after the abort. Codex
   fires no hook on an abort, and the L3 transcript watcher does record
   `turn_aborted` and emit `interrupted`.
-- **Leading suspect:** The daemon registry applies session state **last-writer-
-  wins by IPC arrival order** (`registry.js` `applyState` ignores `updatedAt` and
-  `confidence`). Hooks (separate `haya-pet state` subprocesses) and the interrupt
-  watcher use different IPC connections, so a stale "working" message can arrive
-  *after* `interrupted` and clobber it. Discovery edges (a resumed session whose
-  `session_meta.timestamp` predates the wrapper launch is filtered out; concurrent
-  Codex sessions can attach the watcher to the wrong rollout) are secondary
-  candidates.
-- **Status:** Instrumented with a daemon-side arrival trace (`HAYA_PET_DAEMON_DEBUG`,
-  in `apps/companion/src/main/index.js`) to confirm whether `interrupted` is never
-  emitted (watcher/discovery) vs. emitted-then-clobbered (arrival-order race).
-  **Fix to follow shortly** — likely an `updatedAt`-monotonic guard in `applyState`.
+- **Root cause:** The daemon registry applied session state **last-writer-wins by
+  IPC arrival order** (`registry.js` `applyState` ignored state ordering). Hooks
+  (separate `haya-pet state` subprocesses) and the interrupt watcher use different
+  IPC connections, so a stale "working" message could arrive *after*
+  `interrupted` and clobber it.
+- **Fix:** The registry now keeps a separate per-session state timestamp and ignores
+  state messages older than the latest accepted state. Heartbeats still update
+  liveness independently, so a newer heartbeat cannot block a legitimate
+  later-delivered state message.
+- **Follow-up root cause:** Immediate Esc after prompt submit still failed in
+  **resumed** Codex sessions. `UserPromptSubmit` fired and set *thinking*, and
+  Codex wrote a normal `turn_aborted` record, but the watcher rejected the rollout
+  because `session_meta.timestamp` was from the original session start, before the
+  HAYA wrapper launch. The transcript watcher now allows a fresh rollout from the
+  wrapped cwd, preserving the old guard against unrelated stale sessions while
+  covering resumed sessions.
+- **Other affected case checked:** The Codex guardian-review watcher had the same
+  resumed-session shape. It matched guardian trunks by the main thread id, but the
+  old resumed main rollout could be rejected before that id was accepted. It now
+  uses the same fresh-mtime + wrapped-cwd rule for resumed main sessions, so
+  "Approve for me" review status is not lost after a Codex resume.
+- **How to diagnose if it recurs:** Set `HAYA_PET_DAEMON_DEBUG=<path>` before
+  launching the companion. The companion writes daemon-arrival JSONL for
+  non-heartbeat messages. If `interrupted` never appears, the issue is in
+  transcript discovery/watching; if `interrupted` appears before a stale
+  hook-sourced working state, it is an ordering regression.
 
 ## ✅ Resolved: Claude pet stuck on "compacting" after a compaction
 
@@ -103,6 +117,20 @@ Issues found in live use, with their current status.
   surfaces as turn-end *idle*). The TUI's passive `/approve` denial-override
   picker is not a blocking prompt.
 
+## ✅ Resolved: Codex asked to review HAYA hooks on every launch
+
+- **Symptom:** Even after approving HAYA Pet's Codex hooks once, every new
+  `haya-pet run --client codex` showed Codex's hook review prompt again.
+- **Root cause:** HAYA Pet correctly wrote a stable
+  `$CODEX_HOME/haya-pet.config.toml` profile, but Codex stores the user's hook
+  trust decisions back into that same profile under `[hooks.state]` as
+  `trusted_hash` entries. The injector rewrote the entire profile on every
+  launch, so it deleted Codex's trust cache before Codex could reuse it.
+- **Fix:** The Codex hook injector now regenerates the HAYA-managed hook tables
+  while preserving the Codex-managed `[hooks.state]` tables from the existing
+  profile. Users may need to approve once after updating; after that, unchanged
+  hook commands should stay trusted.
+
 ## ✅ Resolved: Codex pet looked busy immediately after startup
 
 - **Symptom:** Starting a wrapped Codex session and doing nothing could still make
@@ -112,9 +140,11 @@ Issues found in live use, with their current status.
   Another already-running Codex session could keep writing fresh records after
   HAYA Pet started, making its rollout look like the wrapped session even though
   it began earlier.
-- **Fix:** Both watchers now inspect the first `session_meta` line and require
-  its timestamp to belong to this wrapper launch. Old-but-active Codex sessions
-  are ignored even if their files continue to receive fresh writes.
+- **Fix:** Both watchers inspect the first `session_meta` line and require either
+  a timestamp that belongs to this wrapper launch, or a fresh rollout whose cwd
+  matches the wrapped Codex cwd for resumed sessions. Old-but-active Codex
+  sessions from unrelated projects are ignored even if their files continue to
+  receive fresh writes.
 
 ## ✅ Resolved: Codex `/quit` hung on its goodbye (and the pet kept showing "working")
 

package/docs/screenshots/README.md

@@ -4,4 +4,4 @@ Place screenshot PNGs referenced by the root README here (~800px wide):
 - `pet-overlay.png` — the pet reacting to the highest-priority session
 - `session-bubbles.png` — bubbles expanded, showing per-session status icons
 - `folder-collapsed.png` — bubbles folded away beside the pet
-- `tray-menu.png` — the tray menu (show/hide, pets, reset position, Quit)
+- `tray-menu.png` — the tray menu (show/hide, sessions, pets, reset position, Quit)

package/docs/troubleshooting.md

@@ -18,6 +18,7 @@ deferred problems with known root causes.
 | Typing doesn't work / **Claude Code** TUI frozen under `haya-pet run` | You have hooks enabled and Claude is showing its *review hooks* trust prompt (approve it once), or your Claude is too old for `--settings`. Run `haya-pet hooks off` (or set `HAYA_PET_NO_HOOKS=1`) for native passthrough with lifecycle-only status — typing and Shift+Tab work normally. |
 | Pet changes status after a **Claude Code** subagent finishes, even though the main agent already stopped | Fixed — Claude `SubagentStop` is ignored because it is not a reliable main-turn state. Update to the latest version and restart the wrapped Claude session so the new hook settings are used. |
 | Pet shows only **idle/lifecycle** while **Codex** works | Live status is opt-in: run `haya-pet hooks on` once (persisted, global), then `haya-pet run --client codex -- codex`; approve Codex's one-time *review hooks* prompt. `thinking`/`idle` come from hooks, `running_tool`/`editing_files` from a transcript watcher, and approval states from the `PermissionRequest` hook plus a guardian-review watcher. |
+| **Codex** asks to review HAYA hooks on every launch | Fixed — update to the latest version, then approve once more. Codex writes trusted hook hashes into `$CODEX_HOME/haya-pet.config.toml` under `[hooks.state]`; HAYA Pet now preserves that Codex-managed block when refreshing the hook profile. |
 | Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now reports **reviewing** from the permission hook itself, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). Restart the wrapped Codex session after updating so Codex reloads the changed hook command. |
 | Pet shows **shell_command** or **thinking** right after starting Codex, before you prompt it | Fixed — the Codex transcript and guardian watchers now ignore rollouts whose `session_meta.timestamp` predates the current wrapper launch, so another active Codex session cannot drive this pet's status. Restart the wrapped Codex session after updating. |
 | **Codex** live status didn't turn on / you pass your own `-p`/`--profile` | Codex allows only one profile, so haya-pet skips hook injection when you supply your own and prints a notice. Drop your `-p` for that run to get live status, or accept lifecycle-only. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hayasaka7/haya-pet",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "type": "module",
   "description": "Generic AI CLI pet runtime foundation.",
   "keywords": [

package/packages/adapters/src/codex-hooks.js

@@ -43,8 +43,11 @@
 //    while manual/unknown reviewer config reports waiting_approval. The guardian
 //    fires NO hooks itself (SubAgentSource::Other is excluded from Subagent
 //    hooks), so the wrapper also tails the guardian rollout directly.
-//  - UNTESTED: PreCompact / SubagentStart|Stop (no compaction / subagent
-//    occurred in the probe).
+//  - PreCompact / PostCompact trigger split follows the same manual/auto matcher
+//    shape as Claude. A manual `/compact` returns to a prompt, while auto compact
+//    happens mid-turn and should resume the pet's working state.
+//  - UNTESTED: PreCompact / SubagentStart|Stop live firing (no compaction /
+//    subagent occurred in the probe).
 //
 // OPEN QUESTION (injection): unlike `claude --settings <file>`, Codex has no
 // per-invocation settings-file flag. Candidate non-mutating paths, best first:
@@ -70,8 +73,9 @@ const EDIT_TOOLS_MATCHER = EDIT_TOOLS.join("|");
 const COMMAND_TOOLS_MATCHER = "shell_command";
 
 // The hook table. Each entry → one Codex hook that reports a fixed pet state.
-// `matcher` (when present) filters PreToolUse by tool name. `summary` is an
-// optional short label shown in the bubble and in HAYA_PET_HOOK_DEBUG logs.
+// `matcher` (when present) filters PreToolUse by tool name or PostCompact by
+// compaction trigger. `summary` is an optional short label shown in the bubble and
+// in HAYA_PET_HOOK_DEBUG logs.
 const HOOK_TABLE = Object.freeze([
   { event: "UserPromptSubmit", state: "thinking" },
   { event: "PreToolUse", matcher: EDIT_TOOLS_MATCHER, state: "editing_files" },
@@ -79,7 +83,8 @@ const HOOK_TABLE = Object.freeze([
   { event: "PostToolUse", state: "thinking" },
   { event: "PermissionRequest", command: "codex-permission-request" },
   { event: "PreCompact", state: "compacting" },
-  { event: "PostCompact", state: "thinking", summary: "compacted" },
+  { event: "PostCompact", matcher: "manual", state: "idle", summary: "compacted" },
+  { event: "PostCompact", matcher: "auto", state: "thinking", summary: "compacted" },
   // A subagent finishing is mid-turn — the main agent keeps working, so this is
   // NOT idle. Turn-end is the dedicated `Stop` event below.
   { event: "SubagentStart", state: "running_tool", summary: "subagent" },
@@ -87,11 +92,15 @@ const HOOK_TABLE = Object.freeze([
   { event: "Stop", state: "idle" }
 ]);
 
-// Resolve the pet state for a Codex event. `toolName` is the tool for PreToolUse.
-// Exposed for testing and to keep the mapping in one place.
-export function mapCodexEventToState(event, toolName) {
+// Resolve the pet state for a Codex event. `detail` is the tool for PreToolUse or
+// the compaction trigger for PostCompact. Exposed for testing and to keep the
+// mapping in one place.
+export function mapCodexEventToState(event, detail) {
   if (event === "PreToolUse") {
-    return EDIT_TOOLS.includes(toolName) ? "editing_files" : "running_tool";
+    return EDIT_TOOLS.includes(detail) ? "editing_files" : "running_tool";
+  }
+  if (event === "PostCompact") {
+    return detail === "manual" ? "idle" : "thinking";
   }
   const entry = HOOK_TABLE.find((row) => row.event === event && row.matcher === undefined);
   return entry?.state;

package/packages/adapters/test/codex-hooks.test.mjs

@@ -25,6 +25,12 @@ test("mapCodexEventToState branches PreToolUse on tool name (apply_patch vs comm
   assert.equal(mapCodexEventToState("PreToolUse", "read_file"), "running_tool");
 });
 
+test("mapCodexEventToState branches PostCompact on compaction trigger", () => {
+  assert.equal(mapCodexEventToState("PostCompact", "manual"), "idle");
+  assert.equal(mapCodexEventToState("PostCompact", "auto"), "thinking");
+  assert.equal(mapCodexEventToState("PostCompact"), "thinking");
+});
+
 test("Stop is the only idle signal — SubagentStop stays working", () => {
   // Regression guard for the key Codex-vs-Claude difference: a subagent finishing
   // mid-turn must NOT flip the pet to idle.
@@ -64,6 +70,15 @@ test("buildCodexHookSettings splits PreToolUse into edit + command matchers", ()
   assert.equal(other.matcher, "shell_command");
 });
 
+test("buildCodexHookSettings splits PostCompact into manual + auto triggers", () => {
+  const post = buildCodexHookSettings({ nodePath: "n", cliPath: "c" }).hooks.PostCompact;
+  assert.equal(post.length, 2);
+  const manual = post.find((e) => e.matcher === "manual");
+  const auto = post.find((e) => e.matcher === "auto");
+  assert.match(manual.hooks[0].command, /state idle --summary compacted$/);
+  assert.match(auto.hooks[0].command, /state thinking --summary compacted$/);
+});
+
 test("buildCodexHookSettings routes PermissionRequest through the Codex reporter", () => {
   const permission = buildCodexHookSettings({ nodePath: "n", cliPath: "c" }).hooks.PermissionRequest;
   assert.equal(permission.length, 1);

package/packages/cli-core/src/codex-guardian-watcher.js

@@ -21,6 +21,7 @@ const MTIME_SKEW_MS = 2000;
 export function watchCodexGuardianReviews(options = {}) {
   const {
     homeDir = process.env.USERPROFILE || process.env.HOME,
+    cwd,
     startedAt = 0,
     onReviewEvent = () => {},
     pollIntervalMs = DEFAULT_POLL_MS,
@@ -31,6 +32,7 @@ export function watchCodexGuardianReviews(options = {}) {
 
   const root = sessionsRoot ?? (homeDir ? join(homeDir, ".codex", "sessions") : undefined);
   const minMtime = startedAt > 0 ? startedAt - MTIME_SKEW_MS : 0;
+  const expectedCwd = normalizePathForCompare(cwd);
 
   // session_meta classifications are immutable once written, so cache them by
   // path. A file with no complete first line yet is NOT cached — it is retried
@@ -50,8 +52,13 @@ export function watchCodexGuardianReviews(options = {}) {
       return undefined;
     }
     const meta = classifyCodexSessionMeta(firstLine) ?? null;
-    const sessionStartedAt = readSessionMetaTimestamp(firstLine);
-    if (meta && minMtime > 0 && (!Number.isFinite(sessionStartedAt) || sessionStartedAt < minMtime)) {
+    const sessionMeta = readSessionMeta(firstLine);
+    const isFreshSession = sessionMeta && sessionMeta.startedAt >= minMtime;
+    const isFreshResume =
+      meta?.kind === "main" &&
+      expectedCwd !== undefined &&
+      normalizePathForCompare(sessionMeta?.cwd) === expectedCwd;
+    if (meta && minMtime > 0 && !isFreshSession && !isFreshResume) {
       metaByPath.set(file, null);
       return null;
     }
@@ -140,7 +147,7 @@ export function watchCodexGuardianReviews(options = {}) {
   };
 }
 
-function readSessionMetaTimestamp(line) {
+function readSessionMeta(line) {
   let entry;
   try {
     entry = JSON.parse(line);
@@ -153,5 +160,19 @@ function readSessionMetaTimestamp(line) {
   }
 
   const timestampMs = Date.parse(entry.timestamp);
-  return Number.isFinite(timestampMs) ? timestampMs : undefined;
+  if (!Number.isFinite(timestampMs)) {
+    return undefined;
+  }
+
+  return {
+    startedAt: timestampMs,
+    cwd: typeof entry.payload?.cwd === "string" ? entry.payload.cwd : undefined
+  };
+}
+
+function normalizePathForCompare(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    return undefined;
+  }
+  return value.trim().replace(/\\/g, "/").replace(/\/+$/g, "").toLowerCase();
 }

package/packages/cli-core/src/codex-hook-injection.js

@@ -8,7 +8,7 @@
 // across sessions so Codex's hook-trust review only needs approving once. fnm hands
 // out a per-shell symlink for process.execPath that dies when the launching shell
 // exits, so we realpath it before baking it into the hook command.
-import { mkdirSync, realpathSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -32,7 +32,8 @@ export function injectCodexHooks({ nodePath, cliPath, codexHome, env = process.e
   // rewrite identical bytes, and the hooks stay "trusted" across launches.
   mkdirSync(home, { recursive: true });
   const profilePath = join(home, PROFILE_FILE);
-  writeFileSync(profilePath, toml, "utf8");
+  const trustedState = readCodexHookTrustState(profilePath);
+  writeFileSync(profilePath, appendCodexHookTrustState(toml, trustedState), "utf8");
 
   // The profile file is stable and reusable on purpose — leaving it in place is
   // what lets Codex remember the hooks are trusted. cleanup is a no-op kept for
@@ -47,3 +48,51 @@ function safeRealpath(target) {
     return target;
   }
 }
+
+function readCodexHookTrustState(profilePath) {
+  try {
+    return extractCodexHookTrustState(readFileSync(profilePath, "utf8"));
+  } catch {
+    return "";
+  }
+}
+
+function appendCodexHookTrustState(toml, trustedState) {
+  if (!trustedState) {
+    return toml;
+  }
+  return `${toml.trimEnd()}\n\n${trustedState.trim()}\n`;
+}
+
+function extractCodexHookTrustState(toml) {
+  const lines = String(toml).split(/\r?\n/);
+  const output = [];
+  let inHookState = false;
+
+  for (const line of lines) {
+    const tableName = readTomlTableName(line);
+    if (tableName) {
+      const isHookStateTable = tableName === "hooks.state" || tableName.startsWith("hooks.state.");
+      if (isHookStateTable) {
+        inHookState = true;
+      } else if (inHookState) {
+        break;
+      }
+    }
+
+    if (inHookState) {
+      output.push(line);
+    }
+  }
+
+  return output.join("\n").trim();
+}
+
+function readTomlTableName(line) {
+  const table = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+  if (table) {
+    return table[1];
+  }
+  const arrayTable = /^\s*\[\[([^\]]+)\]\]\s*$/.exec(line);
+  return arrayTable?.[1];
+}

package/packages/cli-core/src/codex-transcript-watcher.js

@@ -12,6 +12,7 @@ const MTIME_SKEW_MS = 2000;
 export function watchCodexTranscript(options = {}) {
   const {
     homeDir = process.env.USERPROFILE || process.env.HOME,
+    cwd,
     startedAt = 0,
     onToolEvent = () => {},
     pollIntervalMs = DEFAULT_POLL_MS,
@@ -31,7 +32,7 @@ export function watchCodexTranscript(options = {}) {
   const tick = () => {
     try {
       if (!transcriptPath) {
-        transcriptPath = discoverCodexTranscript(root, minMtime);
+        transcriptPath = discoverCodexTranscript(root, minMtime, { cwd });
         if (!transcriptPath) {
           return;
         }
@@ -78,21 +79,29 @@ export function watchCodexTranscript(options = {}) {
   };
 }
 
-export function discoverCodexTranscript(root, minMtime = 0) {
+export function discoverCodexTranscript(root, minMtime = 0, options = {}) {
   if (!root || !existsSync(root)) {
     return undefined;
   }
 
+  const expectedCwd = normalizePathForCompare(options.cwd);
   let newest;
   for (const file of listJsonlFiles(root)) {
     const mtime = safeMtime(file);
     if (mtime < minMtime) {
       continue;
     }
-    const sessionStartedAt = readCodexSessionStartedAt(file);
-    if (!Number.isFinite(sessionStartedAt) || sessionStartedAt < minMtime) {
+    const meta = readCodexSessionMeta(file);
+    if (!meta) {
       continue;
     }
+
+    const isFreshSession = meta.startedAt >= minMtime;
+    const isFreshResume = expectedCwd !== undefined && normalizePathForCompare(meta.cwd) === expectedCwd;
+    if (!isFreshSession && !isFreshResume) {
+      continue;
+    }
+
     if (!newest || mtime > newest.mtime) {
       newest = { file, mtime };
     }
@@ -100,7 +109,7 @@ export function discoverCodexTranscript(root, minMtime = 0) {
   return newest?.file;
 }
 
-function readCodexSessionStartedAt(file) {
+function readCodexSessionMeta(file) {
   const line = readFirstLine(file);
   if (line === undefined) {
     return undefined;
@@ -118,5 +127,19 @@ function readCodexSessionStartedAt(file) {
   }
 
   const timestampMs = Date.parse(entry.timestamp);
-  return Number.isFinite(timestampMs) ? timestampMs : undefined;
+  if (!Number.isFinite(timestampMs)) {
+    return undefined;
+  }
+
+  return {
+    startedAt: timestampMs,
+    cwd: typeof entry.payload?.cwd === "string" ? entry.payload.cwd : undefined
+  };
+}
+
+function normalizePathForCompare(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    return undefined;
+  }
+  return value.trim().replace(/\\/g, "/").replace(/\/+$/g, "").toLowerCase();
 }

package/packages/cli-core/test/codex-guardian-watcher.test.mjs

@@ -175,6 +175,43 @@ test("watchCodexGuardianReviews ignores guardian trunks for sessions that starte
   watcher.stop();
 });
 
+test("watchCodexGuardianReviews follows a resumed main session in the same cwd", () => {
+  const { root, dir } = makeSessionsRoot();
+  writeFileSync(
+    join(dir, "rollout-main-resumed.jsonl"),
+    metaLineAt("2026-06-12T00:00:00.000Z", {
+      id: "main-1",
+      parent_thread_id: null,
+      source: "cli",
+      thread_source: "user",
+      cwd: "D:\\Work\\project"
+    })
+  );
+  writeFileSync(
+    join(dir, "rollout-guardian.jsonl"),
+    metaLineAt("2026-06-12T01:01:00.000Z", {
+      id: "guardian-1",
+      parent_thread_id: "main-1",
+      source: { subagent: { other: "guardian" } }
+    }) + reviewStarted("turn-new", "2026-06-12T01:02:00.000Z")
+  );
+
+  const events = [];
+  const watcher = watchCodexGuardianReviews({
+    sessionsRoot: root,
+    cwd: "D:\\Work\\project",
+    startedAt: Date.parse("2026-06-12T01:00:00.000Z"),
+    onReviewEvent: (event) => events.push(event),
+    ...noopTimers
+  });
+
+  watcher._tick();
+
+  assert.deepEqual(events, [{ type: "review_started" }]);
+
+  watcher.stop();
+});
+
 test("watchCodexGuardianReviews emits nothing without a classifiable main session", () => {
   const { root, dir } = makeSessionsRoot();
   // Guardian trunk exists but there is no main rollout to bind its parent to.

package/packages/cli-core/test/codex-hook-injection.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "../../../test/harness.mjs";
@@ -43,3 +43,32 @@ test("injectCodexHooks honors CODEX_HOME from env and is stable across calls", (
     rmSync(home, { recursive: true, force: true });
   }
 });
+
+test("injectCodexHooks preserves Codex hook trust state in the managed profile", () => {
+  const home = mkdtempSync(join(tmpdir(), "haya-codex-home-"));
+  try {
+    const first = injectCodexHooks({
+      nodePath: "n",
+      cliPath: "c",
+      codexHome: home
+    });
+    const trustedState = `[hooks.state]
+
+[hooks.state.'${first.profilePath}:user_prompt_submit:0:0']
+trusted_hash = "sha256:abc123"
+`;
+    writeFileSync(first.profilePath, `${readFileSync(first.profilePath, "utf8")}\n${trustedState}`, "utf8");
+
+    injectCodexHooks({
+      nodePath: "n",
+      cliPath: "c",
+      codexHome: home
+    });
+
+    const next = readFileSync(first.profilePath, "utf8");
+    assert.match(next, /\[hooks\.state\]/);
+    assert.match(next, /trusted_hash = "sha256:abc123"/);
+  } finally {
+    rmSync(home, { recursive: true, force: true });
+  }
+});

package/packages/cli-core/test/codex-transcript-watcher.test.mjs

@@ -7,11 +7,11 @@ import { discoverCodexTranscript, watchCodexTranscript } from "../src/codex-tran
 
 const noopTimers = { setInterval: () => ({}), clearInterval: () => {} };
 
-function sessionMeta(timestamp, id = "thread-1") {
+function sessionMeta(timestamp, id = "thread-1", cwd) {
   return `${JSON.stringify({
     timestamp,
     type: "session_meta",
-    payload: { id, parent_thread_id: null, source: "cli", thread_source: "user" }
+    payload: { id, parent_thread_id: null, source: "cli", thread_source: "user", ...(cwd ? { cwd } : {}) }
   })}\n`;
 }
 
@@ -152,6 +152,37 @@ test("watchCodexTranscript ignores fresh writes to sessions that started before
   watcher.stop();
 });
 
+test("watchCodexTranscript follows a fresh resumed session in the same cwd", () => {
+  const root = mkdtempSync(join(tmpdir(), "codex-sessions-"));
+  const dir = join(root, "2026", "06", "08");
+  mkdirSync(dir, { recursive: true });
+  const path = join(dir, "rollout-resumed.jsonl");
+  writeFileSync(
+    path,
+    [
+      sessionMeta("2026-06-08T10:00:00.000Z", "resumed-thread", "D:\\Work\\project"),
+      turnAborted("2026-06-08T11:00:01.000Z")
+    ].join("")
+  );
+  const fresh = new Date("2026-06-08T11:00:01.500Z");
+  utimesSync(path, fresh, fresh);
+
+  const events = [];
+  const watcher = watchCodexTranscript({
+    sessionsRoot: root,
+    cwd: "D:\\Work\\project",
+    startedAt: Date.parse("2026-06-08T11:00:00.000Z"),
+    onToolEvent: (event) => events.push(event),
+    ...noopTimers
+  });
+
+  watcher._tick();
+
+  assert.deepEqual(events, [{ type: "turn_aborted", reason: "interrupted" }]);
+
+  watcher.stop();
+});
+
 test("watchCodexTranscript forwards a turn_aborted interrupt event", () => {
   const dir = mkdtempSync(join(tmpdir(), "codex-transcript-"));
   const path = join(dir, "session.jsonl");

package/packages/session-core/src/registry.js

@@ -11,6 +11,7 @@ export function createSessionRegistry(options = {}) {
 class SessionRegistry {
   constructor(options) {
     this.sessions = new Map();
+    this.lastStateUpdatedAt = new Map();
     this.staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
     this.dropAfterMs = options.dropAfterMs ?? DEFAULT_DROP_AFTER_MS;
   }
@@ -58,6 +59,7 @@ class SessionRegistry {
       // real update — marking stale must NOT bump updatedAt, or it never elapses.
       if (now - session.updatedAt > this.dropAfterMs) {
         this.sessions.delete(sessionId);
+        this.lastStateUpdatedAt.delete(sessionId);
         continue;
       }
 
@@ -70,6 +72,7 @@ class SessionRegistry {
         session.source = "wrapper";
         session.confidence = 0.3;
         session.summary = "heartbeat stale";
+        this.lastStateUpdatedAt.set(sessionId, now);
         staleSessions.push(snapshotSession(session));
       }
     }
@@ -93,6 +96,7 @@ class SessionRegistry {
     };
 
     this.sessions.set(message.sessionId, session);
+    this.lastStateUpdatedAt.set(message.sessionId, message.startedAt);
     return snapshotSession(session);
   }
 
@@ -104,10 +108,17 @@ class SessionRegistry {
 
   applyState(message) {
     const session = this.requireSession(message.sessionId);
+    const lastStateUpdatedAt = this.lastStateUpdatedAt.get(message.sessionId) ?? session.startedAt;
+
+    if (message.updatedAt < lastStateUpdatedAt) {
+      return snapshotSession(session);
+    }
+
+    this.lastStateUpdatedAt.set(message.sessionId, message.updatedAt);
     session.state = message.state;
     session.confidence = message.confidence;
     session.source = message.source;
-    session.updatedAt = message.updatedAt;
+    session.updatedAt = Math.max(session.updatedAt, message.updatedAt);
 
     if (Object.prototype.hasOwnProperty.call(message, "summary")) {
       session.summary = message.summary;
@@ -126,6 +137,7 @@ class SessionRegistry {
     session.exitCode = message.exitCode;
     session.finishedAt = message.finishedAt;
     session.updatedAt = message.finishedAt;
+    this.lastStateUpdatedAt.set(message.sessionId, message.finishedAt);
     return snapshotSession(session);
   }
 

package/packages/session-core/test/registry.test.mjs

@@ -65,6 +65,60 @@ test("applies state and heartbeat messages without losing session metadata", ()
   assert.equal(session.projectName, "project");
 });
 
+test("ignores late state messages older than the latest accepted state", () => {
+  const registry = createSessionRegistry();
+
+  registry.applyMessage(registerMessage("sess_a"));
+  registry.applyMessage({
+    type: "state",
+    sessionId: "sess_a",
+    state: "interrupted",
+    summary: "interrupted",
+    confidence: 0.9,
+    source: "client_log",
+    updatedAt: 2000
+  });
+  registry.applyMessage({
+    type: "state",
+    sessionId: "sess_a",
+    state: "thinking",
+    confidence: 0.9,
+    source: "official_plugin",
+    updatedAt: 1500
+  });
+
+  const session = registry.getSession("sess_a");
+  assert.equal(session.state, "interrupted");
+  assert.equal(session.summary, "interrupted");
+  assert.equal(session.source, "client_log");
+  assert.equal(session.updatedAt, 2000);
+});
+
+test("heartbeats do not block later-delivered state messages", () => {
+  const registry = createSessionRegistry();
+
+  registry.applyMessage(registerMessage("sess_a"));
+  registry.applyMessage({
+    type: "heartbeat",
+    sessionId: "sess_a",
+    updatedAt: 3000
+  });
+  registry.applyMessage({
+    type: "state",
+    sessionId: "sess_a",
+    state: "running_tool",
+    summary: "shell_command",
+    confidence: 0.85,
+    source: "client_log",
+    updatedAt: 2000
+  });
+
+  const session = registry.getSession("sess_a");
+  assert.equal(session.state, "running_tool");
+  assert.equal(session.summary, "shell_command");
+  assert.equal(session.updatedAt, 3000);
+});
+
 test("unregister marks sessions as exited and preserves exit details", () => {
   const registry = createSessionRegistry();