@hayasaka7/haya-pet 0.3.6 → 0.3.8

package/docs/known-issues.md

@@ -2,6 +2,107 @@
 
 Issues found in live use, with their current status.
 
+## 🔲 Open: cross-session status contamination on Codex
+
+- **Symptom (same class as the resolved Claude entry below):** interrupting one
+  Codex session can flip a **different, concurrent** Codex session's pet to
+  *interrupted* (and more generally mirror another session's tool/working
+  states). Most likely when two Codex sessions run in the **same folder** and one
+  is busy while the other is idle. Not yet fixed.
+- **Root cause:** `discoverCodexTranscript` (`codex-transcript-watcher.js`) picks
+  the rollout by **newest `.jsonl` by mtime**, filtered only by
+  `session_meta.cwd` / freshness — it does **not** bind to a specific session, so
+  an idle session's watcher can lock onto a busy session's rollout and then read
+  that session's `turn_aborted` (Codex's interrupt signal) as its own. The rollout
+  *does* identify itself (`session_meta.payload.id` = the Codex thread id, plus a
+  unique per-session filename), but (1) we never learn **which** thread id belongs
+  to the session our wrapper launched — the Codex hooks pass only
+  `HAYA_PET_SESSION_ID` via env and the reporter currently **discards Codex's hook
+  stdin** — and (2) the watcher matches on mtime+cwd, not on that id. The
+  `isFreshSession` branch even admits recently-started rollouts from **other
+  cwds**, so the exposure is slightly *wider* than Claude's (which is scoped to one
+  project dir). This is the residual same-session-folder case the earlier
+  "Codex pet looked busy immediately after startup" fix narrowed but did not
+  eliminate.
+- **Plan (handle later):** port the Claude binding to Codex. Verify against the
+  live Codex CLI whether the hook **stdin payload** carries the rollout path or
+  the thread id (`session_id`); if so, have the `haya-pet state` reporter record a
+  per-session session→rollout link (reusing `session-transcript-link.js`) and pin
+  the watcher to it — or, failing that, match `session_meta.payload.id` once we
+  can learn our session's id. Fall back to current behavior when no identifier is
+  available. No timer, consistent with the rest of the status model.
+- **Status:** unfixed. The binding fix shipped this session is **Claude-only** and
+  does not touch the Codex watcher or the guardian-review watcher (which shares the
+  same discovery shape and should be checked alongside it).
+
+## ✅ Resolved: Claude interrupt/denial leaked into a concurrent idle session
+
+- **Symptom:** With Claude Code hooks enabled, interrupting (Esc) one Claude
+  session could also flip a **different, idle** Claude session's pet to
+  *interrupted* (and mirror its working states). Intermittent — most visible when
+  the two ran in the **same folder** and one was busy while the other sat idle.
+- **Root cause:** the L3 transcript watcher had **no binding to a specific
+  session's transcript**. It discovered the file by "newest `.jsonl` by mtime in
+  the project dir" (`claude-transcript-watcher.js` `discoverTranscript`). Two
+  Claude sessions in one folder share a project dir
+  (`~/.claude/projects/<sanitized-cwd>/`), each with its own UUID file, so an idle
+  session's watcher could lock onto a **busy** session's transcript and then read
+  that session's `[Request interrupted by user]` marker (or a denial) and report
+  it for itself. `HAYA_PET_SESSION_ID` identified the session to the daemon, but
+  nothing tied the watched **file** to the session.
+- **Fix:** bind each watcher to its own transcript via the **`transcript_path`
+  Claude includes in every hook payload** (ground truth). The `haya-pet state`
+  reporter — already a hook child that knows `HAYA_PET_SESSION_ID` — reads the hook
+  payload from stdin (only in the real process entry, never in tests/other
+  commands) and records a per-session **session→transcript link**
+  (`packages/cli-core/src/session-transcript-link.js`, stored under
+  `…/haya-pet/sessions/<id>.json`). The watcher pins to that exact file instead of
+  guessing; until the link exists it simply idles (nothing to interrupt yet)
+  rather than locking onto another session's file. Newest-by-mtime remains only as
+  a fallback for the no-session case (never hit in production, where the watcher
+  only runs with hooks on). The link is removed on wrapper exit. Local-only and
+  best-effort; **no timer** is involved.
+- **Tests:** `session-transcript-link.test.mjs` (write/read round-trip + per-session
+  isolation) and a `claude-transcript-watcher.test.mjs` case proving an interrupt
+  in session A is **not** reported for idle session B, plus a case that the watcher
+  idles until its link appears.
+- **How to diagnose if it recurs:** with `HAYA_PET_HOOK_DEBUG=<path>` set, the
+  transcript-sourced `interrupted` line is logged with its `sessionId`; if it
+  appears under a session that was idle, the binding (the
+  `…/haya-pet/sessions/<id>.json` link) resolved to the wrong file.
+
+## ✅ Resolved: pet disappeared (and could not be restored) after a display change
+
+- **Symptom:** the pet sometimes vanished from the screen while the companion was
+  still running — and once gone, **Show/Hide Pet** and **Reset Position** both
+  failed to bring it back. Intermittent.
+- **Root cause:** the overlay is a single full-work-area `BrowserWindow` whose
+  bounds are computed **once**, at creation, for whichever display it resolved to
+  then. The companion subscribed to **no** `screen` events and never called
+  `setBounds` again, so a display-layout change underneath it — monitor unplugged,
+  resolution/DPI change, dock/undock, or sleep→resume — left the window at
+  coordinates that were now **off-screen or on a display that no longer exists**.
+  The window stayed alive and `isVisible() === true`; it was just painting where no
+  monitor covered. The two recovery actions failed for the same reason: *Show/Hide*
+  only flips `isVisible()` (an off-screen window is already "visible", so it
+  toggled between hidden and shown-at-the-same-bad-bounds), and *Reset Position*
+  only moved the **sprite's CSS position inside** the overlay (against a stale work
+  area), never the window's bounds.
+- **Fix:** the companion now re-homes the overlay onto a currently-valid display.
+  It listens for `screen` `display-metrics-changed` / `display-added` /
+  `display-removed` and `powerMonitor` `resume`, re-resolving the target display
+  and calling `setBounds` (decision logic in the pure, tested
+  `display-manager.js` `resolveOverlayPlacement`). **Reset Position**, **Show
+  Pet**, and relaunch now re-home the window itself, not just the sprite.
+  Automatic re-homes do **not** persist the position, so the user's preferred
+  display is remembered and the pet returns there when that monitor comes back. No
+  timer is involved — every re-home is driven by a real display/power event or a
+  user action.
+- **Known residual (Windows):** a transparent surface can still occasionally go
+  blank after resume even with correct bounds (an Electron compositor issue);
+  re-asserting bounds repaints it in the common case, and a hide/show repaint nudge
+  is the fallback if it recurs.
+
 ## ✅ Resolved: Codex interrupt sometimes left the pet "working"
 
 - **Symptom:** Pressing Esc to interrupt a Codex turn occasionally does **not**
@@ -117,6 +218,20 @@ Issues found in live use, with their current status.
   surfaces as turn-end *idle*). The TUI's passive `/approve` denial-override
   picker is not a blocking prompt.
 
+## ✅ Resolved: Codex asked to review HAYA hooks on every launch
+
+- **Symptom:** Even after approving HAYA Pet's Codex hooks once, every new
+  `haya-pet run --client codex` showed Codex's hook review prompt again.
+- **Root cause:** HAYA Pet correctly wrote a stable
+  `$CODEX_HOME/haya-pet.config.toml` profile, but Codex stores the user's hook
+  trust decisions back into that same profile under `[hooks.state]` as
+  `trusted_hash` entries. The injector rewrote the entire profile on every
+  launch, so it deleted Codex's trust cache before Codex could reuse it.
+- **Fix:** The Codex hook injector now regenerates the HAYA-managed hook tables
+  while preserving the Codex-managed `[hooks.state]` tables from the existing
+  profile. Users may need to approve once after updating; after that, unchanged
+  hook commands should stay trusted.
+
 ## ✅ Resolved: Codex pet looked busy immediately after startup
 
 - **Symptom:** Starting a wrapped Codex session and doing nothing could still make

package/docs/screenshots/README.md

@@ -4,4 +4,4 @@ Place screenshot PNGs referenced by the root README here (~800px wide):
 - `pet-overlay.png` — the pet reacting to the highest-priority session
 - `session-bubbles.png` — bubbles expanded, showing per-session status icons
 - `folder-collapsed.png` — bubbles folded away beside the pet
-- `tray-menu.png` — the tray menu (show/hide, pets, reset position, Quit)
+- `tray-menu.png` — the tray menu (show/hide, sessions, pets, reset position, Quit)

package/docs/troubleshooting.md

@@ -18,6 +18,7 @@ deferred problems with known root causes.
 | Typing doesn't work / **Claude Code** TUI frozen under `haya-pet run` | You have hooks enabled and Claude is showing its *review hooks* trust prompt (approve it once), or your Claude is too old for `--settings`. Run `haya-pet hooks off` (or set `HAYA_PET_NO_HOOKS=1`) for native passthrough with lifecycle-only status — typing and Shift+Tab work normally. |
 | Pet changes status after a **Claude Code** subagent finishes, even though the main agent already stopped | Fixed — Claude `SubagentStop` is ignored because it is not a reliable main-turn state. Update to the latest version and restart the wrapped Claude session so the new hook settings are used. |
 | Pet shows only **idle/lifecycle** while **Codex** works | Live status is opt-in: run `haya-pet hooks on` once (persisted, global), then `haya-pet run --client codex -- codex`; approve Codex's one-time *review hooks* prompt. `thinking`/`idle` come from hooks, `running_tool`/`editing_files` from a transcript watcher, and approval states from the `PermissionRequest` hook plus a guardian-review watcher. |
+| **Codex** asks to review HAYA hooks on every launch | Fixed — update to the latest version, then approve once more. Codex writes trusted hook hashes into `$CODEX_HOME/haya-pet.config.toml` under `[hooks.state]`; HAYA Pet now preserves that Codex-managed block when refreshing the hook profile. |
 | Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now reports **reviewing** from the permission hook itself, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). Restart the wrapped Codex session after updating so Codex reloads the changed hook command. |
 | Pet shows **shell_command** or **thinking** right after starting Codex, before you prompt it | Fixed — the Codex transcript and guardian watchers now ignore rollouts whose `session_meta.timestamp` predates the current wrapper launch, so another active Codex session cannot drive this pet's status. Restart the wrapped Codex session after updating. |
 | **Codex** live status didn't turn on / you pass your own `-p`/`--profile` | Codex allows only one profile, so haya-pet skips hook injection when you supply your own and prints a notice. Drop your `-p` for that run to get live status, or accept lifecycle-only. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hayasaka7/haya-pet",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "type": "module",
   "description": "Generic AI CLI pet runtime foundation.",
   "keywords": [

package/packages/cli-core/src/claude-transcript-watcher.js

@@ -15,6 +15,7 @@ import {
 } from "node:fs";
 import { basename, join } from "node:path";
 import { parseTranscriptLines } from "../../adapters/src/claude-transcript.js";
+import { readSessionTranscriptLink } from "./session-transcript-link.js";
 
 const DEFAULT_POLL_MS = 700;
 
@@ -37,6 +38,8 @@ export function watchClaudeTranscript(options = {}) {
     onInterrupt = () => {},
     pollIntervalMs = DEFAULT_POLL_MS,
     projectsRoot,
+    sessionId,
+    sessionDir,
     transcriptPath: fixedPath,
     setInterval: setIntervalFn = setInterval,
     clearInterval: clearIntervalFn = clearInterval
@@ -47,6 +50,13 @@ export function watchClaudeTranscript(options = {}) {
   // before Claude has created THIS session's transcript.
   const minMtime = startedAt > 0 ? startedAt - MTIME_SKEW_MS : 0;
 
+  // Preferred resolution: pin to the exact transcript this session's hook reported
+  // (via the session->transcript link). Only when no session identity is available
+  // (e.g. hooks off, or older tests) do we fall back to the newest-by-mtime guess —
+  // which is unsafe with multiple concurrent sessions in one folder. In production
+  // the watcher only runs with hooks on, so the link path is always used.
+  const useLink = Boolean(sessionId && sessionDir);
+
   let transcriptPath = fixedPath;
   let offset = 0;
   let carry = "";
@@ -54,7 +64,9 @@ export function watchClaudeTranscript(options = {}) {
   const tick = () => {
     try {
       if (!transcriptPath) {
-        transcriptPath = discoverTranscript(root, cwd, minMtime);
+        transcriptPath = useLink
+          ? resolveLinkedTranscript(sessionDir, sessionId)
+          : discoverTranscript(root, cwd, minMtime);
         if (!transcriptPath) {
           return;
         }
@@ -106,6 +118,18 @@ export function watchClaudeTranscript(options = {}) {
   };
 }
 
+// Resolve the transcript this session's hook bound itself to. Returns undefined
+// until the link exists and points at a real file, so before the first hook fires
+// the watcher simply idles (there is nothing to interrupt yet) rather than
+// guessing a file that might belong to another session.
+function resolveLinkedTranscript(sessionDir, sessionId) {
+  const linked = readSessionTranscriptLink({ sessionDir, sessionId });
+  if (!linked || !existsSync(linked)) {
+    return undefined;
+  }
+  return linked;
+}
+
 export function discoverTranscript(root, cwd, minMtime = 0) {
   if (!root || !existsSync(root)) {
     return undefined;

package/packages/cli-core/src/codex-hook-injection.js

@@ -8,7 +8,7 @@
 // across sessions so Codex's hook-trust review only needs approving once. fnm hands
 // out a per-shell symlink for process.execPath that dies when the launching shell
 // exits, so we realpath it before baking it into the hook command.
-import { mkdirSync, realpathSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -32,7 +32,8 @@ export function injectCodexHooks({ nodePath, cliPath, codexHome, env = process.e
   // rewrite identical bytes, and the hooks stay "trusted" across launches.
   mkdirSync(home, { recursive: true });
   const profilePath = join(home, PROFILE_FILE);
-  writeFileSync(profilePath, toml, "utf8");
+  const trustedState = readCodexHookTrustState(profilePath);
+  writeFileSync(profilePath, appendCodexHookTrustState(toml, trustedState), "utf8");
 
   // The profile file is stable and reusable on purpose — leaving it in place is
   // what lets Codex remember the hooks are trusted. cleanup is a no-op kept for
@@ -47,3 +48,51 @@ function safeRealpath(target) {
     return target;
   }
 }
+
+function readCodexHookTrustState(profilePath) {
+  try {
+    return extractCodexHookTrustState(readFileSync(profilePath, "utf8"));
+  } catch {
+    return "";
+  }
+}
+
+function appendCodexHookTrustState(toml, trustedState) {
+  if (!trustedState) {
+    return toml;
+  }
+  return `${toml.trimEnd()}\n\n${trustedState.trim()}\n`;
+}
+
+function extractCodexHookTrustState(toml) {
+  const lines = String(toml).split(/\r?\n/);
+  const output = [];
+  let inHookState = false;
+
+  for (const line of lines) {
+    const tableName = readTomlTableName(line);
+    if (tableName) {
+      const isHookStateTable = tableName === "hooks.state" || tableName.startsWith("hooks.state.");
+      if (isHookStateTable) {
+        inHookState = true;
+      } else if (inHookState) {
+        break;
+      }
+    }
+
+    if (inHookState) {
+      output.push(line);
+    }
+  }
+
+  return output.join("\n").trim();
+}
+
+function readTomlTableName(line) {
+  const table = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+  if (table) {
+    return table[1];
+  }
+  const arrayTable = /^\s*\[\[([^\]]+)\]\]\s*$/.exec(line);
+  return arrayTable?.[1];
+}

package/packages/cli-core/src/run-state.js

@@ -6,6 +6,7 @@ import { createIpcClient as defaultCreateIpcClient } from "../../daemon-core/src
 import { getDefaultPaths } from "../../platform-core/src/paths.js";
 import { isAiClientState } from "../../protocol/src/messages.js";
 import { DEADLINE, raceDeadline } from "./deadline.js";
+import { writeSessionTranscriptLink } from "./session-transcript-link.js";
 
 // Hard ceiling on the whole connect→send→close interaction. The reporter is a
 // child process of the wrapped AI client, and the client may wait for its hook
@@ -69,6 +70,13 @@ export async function runStateCommand(parsed, dependencies = {}) {
     return { command: "state", ok: false, reason: "invalid-state" };
   }
 
+  // Record this session's real transcript path (ground truth from the Claude hook
+  // payload, captured at the process entry and passed in via dependencies) so the
+  // wrapper's watcher tails THIS session's file rather than the newest in the
+  // project dir — which can bind it to a concurrent session and leak that
+  // session's interrupt/denial. Best-effort and synchronous; never blocks the hook.
+  recordTranscriptLink(sessionId, env, dependencies);
+
   const createIpcClient = dependencies.createIpcClient ?? defaultCreateIpcClient;
   const deadlineMs = dependencies.reportDeadlineMs ?? REPORT_DEADLINE_MS;
 
@@ -105,3 +113,105 @@ export async function runStateCommand(parsed, dependencies = {}) {
     return { command: "state", ok: false, reason: "no-daemon" };
   }
 }
+
+// Persist the session -> transcript binding for the wrapper's watcher. The
+// transcript path is supplied by the caller (read from the hook payload at the
+// process entry); when it's absent we simply skip — there is nothing to bind and
+// guessing is exactly the bug this avoids.
+function recordTranscriptLink(sessionId, env, dependencies) {
+  const transcriptPath = dependencies.transcriptPath;
+  if (typeof transcriptPath !== "string" || transcriptPath === "") {
+    return;
+  }
+  try {
+    const sessionDir =
+      dependencies.sessionDir ??
+      getDefaultPaths({
+        platform: dependencies.platform,
+        env,
+        homeDir: dependencies.homeDir
+      }).sessionDir;
+    writeSessionTranscriptLink({ sessionDir, sessionId, transcriptPath }, dependencies);
+  } catch {
+    // never break a hook over a best-effort binding write
+  }
+}
+
+// Pull `transcript_path` out of a Claude hook payload (JSON on stdin). Pure and
+// defensive: any non-JSON, missing-field, or wrong-type input yields undefined.
+export function extractTranscriptPath(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") {
+    return undefined;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const value = parsed?.transcript_path;
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// Read the Claude hook payload from stdin and return its transcript_path. Used by
+// the real `haya-pet state` process (a Claude hook child) — NOT by internal
+// callers, so tests and other commands never touch stdin. Bounded and best-effort:
+// a TTY (manual invocation) or a slow/absent payload resolves to undefined rather
+// than ever hanging the host client's hook.
+export function readHookTranscriptPathFromStdin(options = {}) {
+  const stdin = options.stdin ?? process.stdin;
+  const timeoutMs = options.timeoutMs ?? 400;
+  const maxBytes = options.maxBytes ?? 1_000_000;
+
+  return new Promise((resolve) => {
+    if (!stdin || stdin.isTTY) {
+      resolve(undefined);
+      return;
+    }
+
+    let data = "";
+    let settled = false;
+    let timer;
+
+    const finish = (value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timer) {
+        clearTimeout(timer);
+      }
+      try {
+        stdin.removeListener("data", onData);
+        stdin.removeListener("end", onEnd);
+        stdin.removeListener("error", onError);
+        stdin.pause();
+      } catch {
+        // detaching is best-effort
+      }
+      resolve(value);
+    };
+
+    const onData = (chunk) => {
+      data += chunk;
+      if (data.length > maxBytes) {
+        finish(extractTranscriptPath(data));
+      }
+    };
+    const onEnd = () => finish(extractTranscriptPath(data));
+    const onError = () => finish(undefined);
+
+    try {
+      stdin.setEncoding("utf8");
+      stdin.on("data", onData);
+      stdin.on("end", onEnd);
+      stdin.on("error", onError);
+      stdin.resume();
+      timer = setTimeout(() => finish(extractTranscriptPath(data)), timeoutMs);
+      if (timer && typeof timer.unref === "function") {
+        timer.unref();
+      }
+    } catch {
+      finish(undefined);
+    }
+  });
+}

package/packages/cli-core/src/session-transcript-link.js

@@ -0,0 +1,72 @@
+// Records which transcript file belongs to which haya-pet session, so a wrapper's
+// transcript watcher can tail ITS OWN session's transcript instead of guessing
+// "the newest .jsonl in the project dir".
+//
+// Why this exists: two Claude Code sessions running in the same folder share one
+// project dir (~/.claude/projects/<sanitized-cwd>/), each with its own UUID file.
+// Picking newest-by-mtime can bind a watcher to a DIFFERENT concurrent session's
+// transcript — so an interrupt (or denial) in session A leaks onto idle session B.
+// The only ground-truth source of a session's transcript path is the Claude hook
+// payload (`transcript_path` on stdin), which the `haya-pet state` reporter sees.
+// The reporter writes the path here (keyed by HAYA_PET_SESSION_ID); the wrapper's
+// watcher reads it to pin to the exact file.
+//
+// Local-only and best-effort: every operation swallows errors so it can never
+// break a hook or the wrapped command, and nothing here is ever sent off-device.
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+// Session ids are our own (`sess_<uuid>`), but sanitize defensively so the value
+// can never escape the sessions dir or produce an invalid filename.
+function sanitizeSessionId(sessionId) {
+  return String(sessionId).replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+
+export function sessionLinkPath(sessionDir, sessionId) {
+  return join(sessionDir, `${sanitizeSessionId(sessionId)}.json`);
+}
+
+export function writeSessionTranscriptLink(options = {}, dependencies = {}) {
+  const { sessionDir, sessionId, transcriptPath } = options;
+  if (!sessionDir || !sessionId || typeof transcriptPath !== "string" || transcriptPath === "") {
+    return false;
+  }
+  const mkdir = dependencies.mkdirSync ?? mkdirSync;
+  const write = dependencies.writeFileSync ?? writeFileSync;
+  try {
+    mkdir(sessionDir, { recursive: true });
+    write(sessionLinkPath(sessionDir, sessionId), JSON.stringify({ transcriptPath }), "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function readSessionTranscriptLink(options = {}, dependencies = {}) {
+  const { sessionDir, sessionId } = options;
+  if (!sessionDir || !sessionId) {
+    return undefined;
+  }
+  const read = dependencies.readFileSync ?? readFileSync;
+  try {
+    const parsed = JSON.parse(read(sessionLinkPath(sessionDir, sessionId), "utf8"));
+    return typeof parsed?.transcriptPath === "string" && parsed.transcriptPath !== ""
+      ? parsed.transcriptPath
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function removeSessionTranscriptLink(options = {}, dependencies = {}) {
+  const { sessionDir, sessionId } = options;
+  if (!sessionDir || !sessionId) {
+    return;
+  }
+  const rm = dependencies.rmSync ?? rmSync;
+  try {
+    rm(sessionLinkPath(sessionDir, sessionId), { force: true });
+  } catch {
+    // best-effort cleanup; a stale link is harmless (session ids are unique per run)
+  }
+}

package/packages/cli-core/test/claude-transcript-watcher.test.mjs

@@ -8,6 +8,7 @@ import {
   discoverTranscript,
   watchClaudeTranscript
 } from "../src/claude-transcript-watcher.js";
+import { writeSessionTranscriptLink } from "../src/session-transcript-link.js";
 
 const noopTimers = { setInterval: () => ({}), clearInterval: () => {} };
 
@@ -128,6 +129,78 @@ test("watchClaudeTranscript handles a line split across two appends", () => {
   watcher.stop();
 });
 
+test("watchClaudeTranscript pins to the session's linked transcript, not newest-by-mtime", () => {
+  // Two concurrent sessions share one project dir. Each has its own link.
+  const projectDir = mkdtempSync(join(tmpdir(), "proj-"));
+  const sessionDir = mkdtempSync(join(tmpdir(), "sess-"));
+  const fileA = join(projectDir, "a.jsonl");
+  const fileB = join(projectDir, "b.jsonl");
+  writeFileSync(fileA, "");
+  writeFileSync(fileB, "");
+  writeSessionTranscriptLink({ sessionDir, sessionId: "sess_a", transcriptPath: fileA });
+  writeSessionTranscriptLink({ sessionDir, sessionId: "sess_b", transcriptPath: fileB });
+
+  const interruptsA = [];
+  const interruptsB = [];
+  const watcherA = watchClaudeTranscript({
+    sessionId: "sess_a",
+    sessionDir,
+    onInterrupt: (e) => interruptsA.push(e),
+    ...noopTimers
+  });
+  const watcherB = watchClaudeTranscript({
+    sessionId: "sess_b",
+    sessionDir,
+    onInterrupt: (e) => interruptsB.push(e),
+    ...noopTimers
+  });
+
+  // Both pin to their own file, then skip to EOF.
+  watcherA._tick();
+  watcherB._tick();
+
+  // Interrupt happens in session A only.
+  appendFileSync(fileA, interrupt());
+  watcherA._tick();
+  watcherB._tick();
+
+  assert.deepEqual(interruptsA, [{ type: "interrupted" }], "session A sees its own interrupt");
+  assert.deepEqual(interruptsB, [], "session B (idle) is NOT contaminated by session A's interrupt");
+
+  watcherA.stop();
+  watcherB.stop();
+});
+
+test("watchClaudeTranscript with a session link idles until the link appears", () => {
+  const sessionDir = mkdtempSync(join(tmpdir(), "sess-"));
+  const projectDir = mkdtempSync(join(tmpdir(), "proj-"));
+  const file = join(projectDir, "s.jsonl");
+  writeFileSync(file, "");
+
+  const interrupts = [];
+  const watcher = watchClaudeTranscript({
+    sessionId: "sess_late",
+    sessionDir,
+    onInterrupt: (e) => interrupts.push(e),
+    ...noopTimers
+  });
+
+  // No link yet → nothing tailed, even if a marker is already present.
+  appendFileSync(file, interrupt());
+  watcher._tick();
+  assert.deepEqual(interrupts, [], "no guessing before the hook reports the path");
+
+  // The hook fires and records the binding; the watcher now pins (skipping to EOF,
+  // so the pre-existing marker is not replayed) and only catches NEW events.
+  writeSessionTranscriptLink({ sessionDir, sessionId: "sess_late", transcriptPath: file });
+  watcher._tick();
+  appendFileSync(file, interrupt());
+  watcher._tick();
+  assert.deepEqual(interrupts, [{ type: "interrupted" }]);
+
+  watcher.stop();
+});
+
 test("watchClaudeTranscript reports an interrupt appended after it starts tailing", () => {
   const dir = mkdtempSync(join(tmpdir(), "transcript-"));
   const path = join(dir, "session.jsonl");

package/packages/cli-core/test/codex-hook-injection.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "../../../test/harness.mjs";
@@ -43,3 +43,32 @@ test("injectCodexHooks honors CODEX_HOME from env and is stable across calls", (
     rmSync(home, { recursive: true, force: true });
   }
 });
+
+test("injectCodexHooks preserves Codex hook trust state in the managed profile", () => {
+  const home = mkdtempSync(join(tmpdir(), "haya-codex-home-"));
+  try {
+    const first = injectCodexHooks({
+      nodePath: "n",
+      cliPath: "c",
+      codexHome: home
+    });
+    const trustedState = `[hooks.state]
+
+[hooks.state.'${first.profilePath}:user_prompt_submit:0:0']
+trusted_hash = "sha256:abc123"
+`;
+    writeFileSync(first.profilePath, `${readFileSync(first.profilePath, "utf8")}\n${trustedState}`, "utf8");
+
+    injectCodexHooks({
+      nodePath: "n",
+      cliPath: "c",
+      codexHome: home
+    });
+
+    const next = readFileSync(first.profilePath, "utf8");
+    assert.match(next, /\[hooks\.state\]/);
+    assert.match(next, /trusted_hash = "sha256:abc123"/);
+  } finally {
+    rmSync(home, { recursive: true, force: true });
+  }
+});