@hayasaka7/haya-pet 0.3.9 → 0.3.11

package/docs/known-issues.md

@@ -150,19 +150,60 @@ Issues found in live use, with their current status.
   to *thinking* (the agent continues the turn) and the next real event refines it.
   Verified live on the manual path; auto uses the identical matcher mechanism.
 
-## ✅ Resolved: Claude Code subagent completion changed the main session status
-
-- **Symptom:** In Claude Code multi-agent runs, the main agent could already be
-  stopped while a subagent was still finishing. When that late subagent emitted
-  `SubagentStop`, the pet treated it as a main-session `idle` update and could
-  show a misleading working/done transition after the main agent had settled.
-- **Root cause:** The Claude hook table mapped `SubagentStop` to `idle`. That is
-  only safe if subagent completion is ordered before the main turn finishes, which
-  Claude Code does not guarantee.
-- **Fix:** Claude `SubagentStop` is now ignored. Main-session idle still comes
-  from Claude's real `Stop` hook, while late subagent completion cannot override
-  the current main-agent state. Codex keeps its separate behavior because Codex
-  uses `Stop` as the only idle signal and treats `SubagentStop` as mid-turn.
+## ✅ Resolved: subagent activity drove the main session status (Claude Code)
+
+- **Symptom:** With Claude Code hooks enabled and a multi-agent run, two things
+  went wrong once the **main agent had stopped but a subagent was still working**:
+  (1) the pet dropped to *idle* even though real work was ongoing in the
+  background; and (2) while the subagent ran, its own tool calls flipped the pet
+  between *running tools* / *editing files* / *thinking* — the subagent's activity
+  was driving the main session's status.
+- **Root cause:** Two gaps. (a) The hook table mapped `Stop` → *idle*
+  unconditionally, with no awareness that a backgrounded subagent can outlive the
+  main turn. (b) A backgrounded subagent's tool calls fire the **parent session's**
+  `PreToolUse` / `PostToolUse` hooks, which ran `haya-pet state running_tool`
+  (etc.) under the main session id and overwrote its status. (An earlier fix only
+  stopped `SubagentStop` from reporting *idle*; it addressed neither of these.)
+- **Fix — only ever decided at the main agent's `Stop`; no timers, no persisted
+  state:**
+  - **The "Subagent running" cue.** Claude's `Stop` payload carries an
+    (undocumented) **`background_tasks`** array: a live snapshot of work still
+    running at that instant. When `Stop` would report *idle* but `background_tasks`
+    still lists a running **subagent**, the reporter instead reports *running
+    tools* with the summary **"Subagent running"**
+    (`packages/cli-core/src/background-tasks.js`). When that subagent finishes,
+    Claude fires `Stop` **again** with an empty `background_tasks`, which clears the
+    cue back to *idle* — self-retracting, no timer. (Verified against live hook
+    traces: a backgrounded subagent appears in `Stop`'s `background_tasks` as
+    `type:"subagent", status:"running"`, and a second `Stop` arrives with `[]` once
+    it completes.)
+  - **Subagent events are dropped.** Every hook payload from a subagent context
+    carries an **`agent_id`** — the documented field that distinguishes subagent
+    hook calls from main-thread calls. The reporter now drops any event with an
+    `agent_id` (`extractAgentId` in `run-state.js`), so a subagent's tool use can
+    never overwrite the main session's status. Main-agent events have no `agent_id`
+    and report as before; the main `Stop` (also no `agent_id`) still carries the
+    `background_tasks` snapshot used for the cue above. `SubagentStop` is likewise
+    not wired.
+- **Known limitations (accepted):**
+  - **Only subagents, never background shells.** A `background_tasks` entry can
+    also be `type:"shell"` (e.g. a `sleep 120` the agent backgrounded). These are
+    deliberately **not** surfaced: their completion isn't reliably observable here,
+    and a "working" cue we can't retract is worse than showing *idle*. So a
+    backgrounded shell still running after the main agent stops shows *idle*.
+  - **The `agent_id` discriminator is documented but not yet captured live on
+    `PreToolUse` / `PostToolUse`.** The Claude hooks reference lists `agent_id` /
+    `agent_type` as optional fields delivered to all hooks to distinguish subagent
+    calls, and the observed flicker confirms subagent tool calls reach the parent
+    hooks — but a subagent `PreToolUse` payload hasn't been captured on disk to
+    100% confirm `agent_id` is present there. If a future Claude build omits it the
+    flicker could recur; the marker would then be widened to also match
+    `agent_type` / `agent_transcript_path`.
+- **How to diagnose if it recurs:** with `HAYA_PET_HOOK_DEBUG=<path>` set, the
+  reporter logs an `agentId` field on subagent-sourced events (which it then
+  drops). A subagent event logged with **no** `agentId` is the signal to widen the
+  marker. Codex keeps its separate behavior: it uses `Stop` as the only idle signal
+  and treats `SubagentStop` as mid-turn.
 
 ## ✅ Resolved: false "waiting for approval" while Codex auto-reviews an approval (Approve for me)
 
@@ -218,15 +259,13 @@ Issues found in live use, with their current status.
 
 - **Symptom:** Even after approving HAYA Pet's Codex hooks once, every new
   `haya-pet run --client codex` showed Codex's hook review prompt again.
-- **Root cause:** HAYA Pet correctly wrote a stable
-  `$CODEX_HOME/haya-pet.config.toml` profile, but Codex stores the user's hook
-  trust decisions back into that same profile under `[hooks.state]` as
-  `trusted_hash` entries. The injector rewrote the entire profile on every
-  launch, so it deleted Codex's trust cache before Codex could reuse it.
-- **Fix:** The Codex hook injector now regenerates the HAYA-managed hook tables
-  while preserving the Codex-managed `[hooks.state]` tables from the existing
-  profile. Users may need to approve once after updating; after that, unchanged
-  hook commands should stay trusted.
+- **Root cause:** Older builds wrote a stable `$CODEX_HOME/haya-pet.config.toml`
+  profile, but Codex stored hook trust decisions back into that same profile
+  under `[hooks.state]`. Rewriting the profile on launch deleted that trust cache.
+- **Fix:** The Codex hook injector now writes stable commands into
+  `$CODEX_HOME/hooks.json` and preserves existing user hooks while refreshing
+  HAYA-managed entries. Users may need to approve once after updating; after
+  that, unchanged hook commands should stay trusted.
 
 ## ✅ Resolved: Codex pet looked busy immediately after startup
 
@@ -426,8 +465,12 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
   `Notification`/`PreCompact`/`PostCompact`/`Stop` events to `haya-pet state <state>`,
   reported to the daemon over the IPC pipe. `PostCompact` is split by its
   `manual`/`auto` trigger matcher (manual `/compact` → *idle*, auto compaction →
-  *thinking*) so the pet never sticks on *compacting*. `SubagentStop` is intentionally ignored because
-  it is not a main-turn idle signal. `PreToolUse` distinguishes
+  *thinking*) so the pet never sticks on *compacting*. Subagent-originated events
+  are **dropped** by the reporter (they carry an `agent_id`), so a subagent's tool
+  use never drives the main status, and `SubagentStop` is not wired; when `Stop`
+  fires while a subagent is still running, its `background_tasks` snapshot surfaces
+  as a *running tools* / "Subagent running" cue that the next (empty) `Stop` clears
+  — see the resolved subagent entry above. `PreToolUse` distinguishes
   file-editing tools (`Edit`/`Write`/`MultiEdit`/`NotebookEdit` → *editing files*)
   from other tools (→ *running tools*) via the hook `matcher`. **Why opt-in:**
   injecting hooks makes Claude show a one-time *review hooks* trust prompt; the
@@ -436,9 +479,9 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
   launch — see the resolved note below). `--observe` is a separate PTY opt-in for
   non-interactive runs (terminal-fidelity tradeoff).
 - **Codex** — **implemented (partial).** Opt-in via the global `haya-pet hooks on`;
-  the wrapper injects `packages/adapters/src/codex-hooks.js` as a stable
-  `$CODEX_HOME/haya-pet.config.toml` profile and launches `codex -p haya-pet`
-  (`packages/cli-core/src/codex-hook-injection.js`). Falls back to `--observe` / L1
+  the wrapper injects `packages/adapters/src/codex-hooks.js` as stable user-level
+  hooks in `$CODEX_HOME/hooks.json` (`packages/cli-core/src/codex-hook-injection.js`).
+  Custom Codex `-p/--profile` args remain untouched. Falls back to `--observe` / L1
   when not enabled. Findings (verified against `codex-cli` 0.137.0 on Windows):
   - **Mechanism fits.** Codex has a lifecycle-hooks system (`[[hooks.<Event>]]` in
     `config.toml` or a `hooks.json`), with the `hooks` feature flag `stable` and ON
@@ -452,11 +495,10 @@ observation (`--observe`) or L1 lifecycle as the fallback. Current state:
     signal (`SubagentStop` is mid-turn → stays *thinking*). `PermissionRequest`
     exists, so the approval cue is reachable.
   - **Injection differs** — Codex has no `claude --settings <file>` equivalent.
-    Candidate non-mutating paths: `codex -p haya-pet` layering a generated
-    `$CODEX_HOME/haya-pet.config.toml` profile on top of the user's base config, or a
-    `hooks.json` next to the active config layer. Codex has its own *review hooks*
-    trust prompt (bypass: `--dangerously-bypass-hook-trust`), so the same one-time
-    trust UX as Claude applies.
+    HAYA Pet uses `$CODEX_HOME/hooks.json`, merging HAYA-managed entries with any
+    existing user hooks. Codex loads that hook source alongside selected profiles,
+    and has its own *review hooks* trust prompt (bypass:
+    `--dangerously-bypass-hook-trust`), so the same one-time trust UX as Claude applies.
   - **Windows command quoting (fixed in the adapter):** Codex runs a hook `command`
     via `cmd /c "<cmd>"`, which strips a **leading** quote — so Claude's
     `"<node>" "<cli>" …` form dies with *"hook exited with code 1"*. The Codex

package/docs/troubleshooting.md

@@ -18,10 +18,10 @@ deferred problems with known root causes.
 | Typing doesn't work / **Claude Code** TUI frozen under `haya-pet run` | You have hooks enabled and Claude is showing its *review hooks* trust prompt (approve it once), or your Claude is too old for `--settings`. Run `haya-pet hooks off` (or set `HAYA_PET_NO_HOOKS=1`) for native passthrough with lifecycle-only status — typing and Shift+Tab work normally. |
 | Pet changes status after a **Claude Code** subagent finishes, even though the main agent already stopped | Fixed — Claude `SubagentStop` is ignored because it is not a reliable main-turn state. Update to the latest version and restart the wrapped Claude session so the new hook settings are used. |
 | Pet shows only **idle/lifecycle** while **Codex** works | Live status is opt-in: run `haya-pet hooks on` once (persisted, global), then `haya-pet run --client codex -- codex`; approve Codex's one-time *review hooks* prompt. `thinking`/`idle` come from hooks, `running_tool`/`editing_files` from a transcript watcher, and approval states from the `PermissionRequest` hook plus a guardian-review watcher. |
-| **Codex** asks to review HAYA hooks on every launch | Fixed — update to the latest version, then approve once more. Codex writes trusted hook hashes into `$CODEX_HOME/haya-pet.config.toml` under `[hooks.state]`; HAYA Pet now preserves that Codex-managed block when refreshing the hook profile. |
+| **Codex** asks to review HAYA hooks on every launch | Fixed — update to the latest version, then approve once more. HAYA Pet now writes stable hook commands into `$CODEX_HOME/hooks.json` and preserves existing user hooks when refreshing that file. |
 | Pet showed **waiting for approval** while **Codex** auto-reviewed the request ("Approve for me") | Fixed — with `approvals_reviewer = auto_review` (legacy `guardian_subagent`) Codex's guardian decides without asking you; the pet now reports **reviewing** from the permission hook itself, then **working** on an allow verdict or **thinking** on a deny. *Waiting for approval* still shows when Codex actually asks you (`approvals_reviewer = "user"`). Restart the wrapped Codex session after updating so Codex reloads the changed hook command. |
 | Pet shows **shell_command** or **thinking** right after starting Codex, before you prompt it | Fixed — the Codex transcript and guardian watchers now ignore rollouts whose `session_meta.timestamp` predates the current wrapper launch, so another active Codex session cannot drive this pet's status. Restart the wrapped Codex session after updating. |
-| **Codex** live status didn't turn on / you pass your own `-p`/`--profile` | Codex allows only one profile, so haya-pet skips hook injection when you supply your own and prints a notice. Drop your `-p` for that run to get live status, or accept lifecycle-only. |
+| **Codex** live status didn't turn on with a custom `-p`/`--profile` | Fixed — HAYA Pet installs Codex hooks through `$CODEX_HOME/hooks.json`, so profile args are preserved. Run `haya-pet hooks on`, restart the wrapped Codex session, and approve the one-time hook review if Codex asks. |
 | Pet shows only **idle/lifecycle** while **Antigravity** (`agy`) works | Antigravity has no hook adapter yet. Add `--observe` for coarse PTY activity, or accept lifecycle-only status. |
 | Claude hooks fail with **"hook exited with code 1"** | The hook command must not bake an **fnm**/node-manager *per-shell* node path (`…\fnm_multishells\<pid>_…\node.exe`) that dies when the shell exits. haya-pet bakes the stable `realpath`-resolved node path into the temp settings instead. Update to the latest version. |
 | Pet shows only **idle** for a generic / unknown CLI | Expected without a hook adapter — add `--observe` for PTY observation, otherwise lifecycle only. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hayasaka7/haya-pet",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "type": "module",
   "description": "Generic AI CLI pet runtime foundation.",
   "keywords": [

package/packages/adapters/src/codex-hooks.js

@@ -49,14 +49,12 @@
 //  - UNTESTED: PreCompact / SubagentStart|Stop live firing (no compaction /
 //    subagent occurred in the probe).
 //
-// OPEN QUESTION (injection): unlike `claude --settings <file>`, Codex has no
-// per-invocation settings-file flag. Candidate non-mutating paths, best first:
-//   1. `codex -p haya-pet` + a generated `$CODEX_HOME/haya-pet.config.toml` profile
-//      that layers ON TOP of the user's base config (auth/config preserved).
-//   2. a `hooks.json` next to the active config layer ($CODEX_HOME/hooks.json) —
-//      simple but global to every codex session (harmless: the reporter no-ops
-//      without HAYA_PET_SESSION_ID).
-// Both still trip Codex's one-time hook-trust prompt, exactly like the Claude path.
+// Injection: unlike `claude --settings <file>`, Codex has no per-invocation
+// settings-file flag. The wrapper writes stable user-level hooks to
+// $CODEX_HOME/hooks.json, merging HAYA-managed entries with any existing user
+// hooks. This avoids consuming Codex's single -p/--profile slot; the reporter
+// still no-ops without HAYA_PET_SESSION_ID.
+// This still trips Codex's one-time hook-trust prompt, exactly like the Claude path.
 
 // Codex's file-editing tool(s) vs. its command tool.
 const EDIT_TOOLS = ["apply_patch"];

package/packages/cli-core/src/background-tasks.js

@@ -0,0 +1,63 @@
+// Pure helpers for the Claude "subagent still running at Stop" cue.
+//
+// When the main Claude agent ends its turn it fires `Stop`, whose payload carries
+// a `background_tasks` array — a live snapshot of work still running at that
+// instant (the hooks docs omit this field; it was verified against live traces).
+// If a backgrounded *subagent* is still running, the main agent is paused but real
+// work continues, so the pet keeps a "working" cue with a message rather than
+// dropping to idle. When that subagent finishes, Claude fires `Stop` AGAIN with an
+// empty `background_tasks`, which naturally clears the cue — so this needs no
+// timers, no persisted state, and no subagent-event wiring. The only check is at
+// the main agent's Stop, exactly as scoped.
+//
+// Scoped to `type: "subagent"` ONLY. Background *shells* are intentionally
+// excluded: their completion isn't reliably observable here, and a status we
+// cannot retract is worse than none.
+
+// A single, fixed cue message. The user only wants to know that a subagent is
+// still working after the main agent paused — NOT which one or how many.
+const SUBAGENT_RUNNING_SUMMARY = "Subagent running";
+
+// Parse a Claude hook payload (JSON on stdin) and return its background_tasks
+// array. Defensive: any non-JSON / missing / wrong-typed input yields [].
+export function extractBackgroundTasks(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed?.background_tasks) ? parsed.background_tasks : [];
+  } catch {
+    return [];
+  }
+}
+
+// The still-running *subagent* tasks. Shells and finished tasks are dropped.
+export function runningSubagentTasks(tasks) {
+  if (!Array.isArray(tasks)) {
+    return [];
+  }
+  return tasks.filter((task) => task && task.type === "subagent" && task.status === "running");
+}
+
+// A fixed cue message when any subagent is still running, or undefined when none
+// are (the caller then leaves the reported state untouched). Intentionally not
+// detailed — just "a subagent is still working".
+export function summarizeSubagentTasks(tasks) {
+  return runningSubagentTasks(tasks).length > 0 ? SUBAGENT_RUNNING_SUMMARY : undefined;
+}
+
+// Decide the effective state/summary for a reported state given the Stop payload's
+// background_tasks. Only an `idle` report with a running subagent is upgraded to a
+// working cue; everything else passes through unchanged — including the follow-up
+// Stop whose background_tasks is empty, which is what retracts the cue.
+export function applySubagentBackgroundTasks({ state, summary, backgroundTasks }) {
+  if (state !== "idle") {
+    return { state, summary };
+  }
+  const message = summarizeSubagentTasks(backgroundTasks);
+  if (!message) {
+    return { state, summary };
+  }
+  return { state: "running_tool", summary: message };
+}

package/packages/cli-core/src/codex-hook-injection.js

@@ -1,8 +1,7 @@
-// Resolves stable paths, builds the Codex hook settings, serializes them to TOML,
-// and writes them to a STABLE named-profile file inside CODEX_HOME. The wrapper
-// then launches `codex -p <profileName>`, which layers these hooks ON TOP of the
-// user's base config (auth/model/MCP untouched) and is inert for any codex run
-// that doesn't pass `-p <profileName>`.
+// Resolves stable paths, builds the Codex hook settings, and writes them to the
+// user-level hooks.json inside CODEX_HOME. Codex loads user-level hooks alongside
+// any selected profile, so HAYA Pet does not consume Codex's single -p/--profile
+// slot and custom profiles keep working.
 //
 // Like the Claude injector, the file path and command strings are kept identical
 // across sessions so Codex's hook-trust review only needs approving once. fnm hands
@@ -12,33 +11,31 @@ import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildCodexHookSettings, serializeCodexHooksToml } from "../../adapters/src/codex-hooks.js";
+import { buildCodexHookSettings } from "../../adapters/src/codex-hooks.js";
 
 const DEFAULT_CLI_PATH = fileURLToPath(new URL("../../../apps/cli/src/haya-pet.js", import.meta.url));
-const PROFILE_NAME = "haya-pet";
-const PROFILE_FILE = `${PROFILE_NAME}.config.toml`;
+const HOOKS_FILE = "hooks.json";
+const HAYA_HOOK_STATUS = "HAYA Pet live status";
 
 export function injectCodexHooks({ nodePath, cliPath, codexHome, env = process.env } = {}) {
   const resolvedNode = nodePath ?? safeRealpath(process.execPath);
   const resolvedCli = cliPath ?? safeRealpath(DEFAULT_CLI_PATH);
   const home = codexHome ?? env.CODEX_HOME ?? join(homedir(), ".codex");
 
-  const settings = buildCodexHookSettings({ nodePath: resolvedNode, cliPath: resolvedCli });
-  const toml = serializeCodexHooksToml(settings, {
-    header: "haya-pet live-status hooks profile. Managed by haya-pet; safe to delete."
-  });
+  const settings = markManagedHooks(buildCodexHookSettings({ nodePath: resolvedNode, cliPath: resolvedCli }));
 
-  // A fixed path with session-independent content: concurrent sessions just
-  // rewrite identical bytes, and the hooks stay "trusted" across launches.
+  // A fixed user-level hook source works with every Codex profile. We merge rather
+  // than overwrite because hooks.json may already contain user hooks.
   mkdirSync(home, { recursive: true });
-  const profilePath = join(home, PROFILE_FILE);
-  const trustedState = readCodexHookTrustState(profilePath);
-  writeFileSync(profilePath, appendCodexHookTrustState(toml, trustedState), "utf8");
-
-  // The profile file is stable and reusable on purpose — leaving it in place is
-  // what lets Codex remember the hooks are trusted. cleanup is a no-op kept for
-  // API symmetry with the caller's finally block.
-  return { profileName: PROFILE_NAME, profilePath, cleanup: () => {} };
+  const hooksPath = join(home, HOOKS_FILE);
+  const existing = readHooksJson(hooksPath);
+  const next = mergeHooksJson(existing, settings);
+  writeFileSync(hooksPath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+
+  // The hook file is stable and reusable on purpose — leaving it in place is what
+  // lets Codex remember the hooks are trusted. cleanup is a no-op kept for API
+  // symmetry with the caller's finally block.
+  return { hooksPath, cleanup: () => {} };
 }
 
 function safeRealpath(target) {
@@ -49,50 +46,98 @@ function safeRealpath(target) {
   }
 }
 
-function readCodexHookTrustState(profilePath) {
+function readHooksJson(hooksPath) {
   try {
-    return extractCodexHookTrustState(readFileSync(profilePath, "utf8"));
-  } catch {
-    return "";
+    const parsed = JSON.parse(readFileSync(hooksPath, "utf8"));
+    return isPlainObject(parsed) ? parsed : {};
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return {};
+    }
+    throw new Error(`haya-pet: could not update Codex ${HOOKS_FILE} (${error.message})`, { cause: error });
   }
 }
 
-function appendCodexHookTrustState(toml, trustedState) {
-  if (!trustedState) {
-    return toml;
+function markManagedHooks(settings) {
+  const hooks = {};
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    hooks[event] = entries.map((entry) => ({
+      ...entry,
+      hooks: (entry.hooks ?? []).map((hook) => ({
+        ...hook,
+        statusMessage: HAYA_HOOK_STATUS
+      }))
+    }));
   }
-  return `${toml.trimEnd()}\n\n${trustedState.trim()}\n`;
+  return { hooks };
 }
 
-function extractCodexHookTrustState(toml) {
-  const lines = String(toml).split(/\r?\n/);
-  const output = [];
-  let inHookState = false;
-
-  for (const line of lines) {
-    const tableName = readTomlTableName(line);
-    if (tableName) {
-      const isHookStateTable = tableName === "hooks.state" || tableName.startsWith("hooks.state.");
-      if (isHookStateTable) {
-        inHookState = true;
-      } else if (inHookState) {
-        break;
-      }
-    }
+function mergeHooksJson(existing, managed) {
+  const output = isPlainObject(existing) ? { ...existing } : {};
+  const existingHooks = isPlainObject(output.hooks) ? output.hooks : {};
+  const managedHooks = managed.hooks ?? {};
+  const hooks = {};
+  const events = new Set([...Object.keys(existingHooks), ...Object.keys(managedHooks)]);
+
+  for (const event of events) {
+    const preserved = removeManagedEntries(existingHooks[event]);
+    const nextEntries = managedHooks[event] ?? [];
 
-    if (inHookState) {
-      output.push(line);
+    if (Array.isArray(preserved)) {
+      hooks[event] = [...preserved, ...nextEntries];
+    } else if (nextEntries.length > 0) {
+      hooks[event] = nextEntries;
+    } else if (preserved !== undefined) {
+      hooks[event] = preserved;
     }
   }
 
-  return output.join("\n").trim();
+  output.hooks = hooks;
+  return output;
 }
 
-function readTomlTableName(line) {
-  const table = /^\s*\[([^\]]+)\]\s*$/.exec(line);
-  if (table) {
-    return table[1];
+function removeManagedEntries(entries) {
+  if (!Array.isArray(entries)) {
+    return entries;
+  }
+
+  return entries
+    .map((entry) => removeManagedHooksFromEntry(entry))
+    .filter((entry) => entry !== undefined);
+}
+
+function removeManagedHooksFromEntry(entry) {
+  if (!isPlainObject(entry) || !Array.isArray(entry.hooks)) {
+    return entry;
+  }
+
+  const hooks = entry.hooks.filter((hook) => !isManagedHook(hook));
+  if (hooks.length === 0) {
+    return undefined;
   }
-  const arrayTable = /^\s*\[\[([^\]]+)\]\]\s*$/.exec(line);
-  return arrayTable?.[1];
+  if (hooks.length === entry.hooks.length) {
+    return entry;
+  }
+  return { ...entry, hooks };
+}
+
+function isManagedHook(hook) {
+  if (!isPlainObject(hook)) {
+    return false;
+  }
+  if (hook.statusMessage === HAYA_HOOK_STATUS) {
+    return true;
+  }
+  return isLegacyHayaPetCommand(hook.command);
+}
+
+function isLegacyHayaPetCommand(command) {
+  if (typeof command !== "string") {
+    return false;
+  }
+  return /haya-pet\.js"?\s+(state|codex-permission-request)\b/.test(command);
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }

package/packages/cli-core/src/run-state.js

@@ -7,6 +7,7 @@ import { getDefaultPaths } from "../../platform-core/src/paths.js";
 import { isAiClientState } from "../../protocol/src/messages.js";
 import { DEADLINE, raceDeadline } from "./deadline.js";
 import { writeSessionTranscriptLink } from "./session-transcript-link.js";
+import { applySubagentBackgroundTasks, extractBackgroundTasks } from "./background-tasks.js";
 
 // Hard ceiling on the whole connect→send→close interaction. The reporter is a
 // child process of the wrapped AI client, and the client may wait for its hook
@@ -60,8 +61,28 @@ export async function runStateCommand(parsed, dependencies = {}) {
   const env = dependencies.env ?? process.env;
   const now = dependencies.now ?? Date.now;
   const sessionId = parsed.session ?? env.HAYA_PET_SESSION_ID;
+  const agentId = dependencies.agentId;
 
-  debugLog(env, now, { state: parsed.state, sessionId, summary: parsed.summary });
+  debugLog(
+    env,
+    now,
+    agentId
+      ? { state: parsed.state, sessionId, summary: parsed.summary, agentId }
+      : { state: parsed.state, sessionId, summary: parsed.summary }
+  );
+
+  // A subagent's own activity must NEVER drive the main session's status. A
+  // backgrounded subagent's tool calls fire the PARENT session's PreToolUse/
+  // PostToolUse hooks, which would otherwise overwrite the main agent's status
+  // (and the "Subagent running" cue) with running_tool/thinking/editing_files as
+  // the subagent works. The payload's `agent_id` is the documented field that
+  // distinguishes subagent hook calls from main-thread calls — when it's present
+  // the event came from a subagent, so we drop it entirely. The ONE place a
+  // subagent surfaces is the main agent's own Stop (no agent_id), via
+  // background_tasks; see applySubagentBackgroundTasks below.
+  if (agentId) {
+    return { command: "state", ok: false, reason: "subagent-event" };
+  }
 
   if (!sessionId) {
     return { command: "state", ok: false, reason: "no-session" };
@@ -77,6 +98,17 @@ export async function runStateCommand(parsed, dependencies = {}) {
   // session's interrupt/denial. Best-effort and synchronous; never blocks the hook.
   recordTranscriptLink(sessionId, env, dependencies);
 
+  // When the main agent's Stop reports idle but its background_tasks (from the hook
+  // payload, passed in via dependencies) still lists a running subagent, keep a
+  // working cue with a message instead — the main agent is paused but real work
+  // continues. The follow-up Stop carries an empty list and clears it. Scoped to
+  // subagents only; see background-tasks.js.
+  const effective = applySubagentBackgroundTasks({
+    state: parsed.state,
+    summary: parsed.summary,
+    backgroundTasks: dependencies.backgroundTasks
+  });
+
   const createIpcClient = dependencies.createIpcClient ?? defaultCreateIpcClient;
   const deadlineMs = dependencies.reportDeadlineMs ?? REPORT_DEADLINE_MS;
 
@@ -93,8 +125,8 @@ export async function runStateCommand(parsed, dependencies = {}) {
         await client.send({
           type: "state",
           sessionId,
-          state: parsed.state,
-          summary: parsed.summary,
+          state: effective.state,
+          summary: effective.summary,
           confidence: 0.9,
           source: "official_plugin",
           updatedAt: now()
@@ -152,19 +184,50 @@ export function extractTranscriptPath(raw) {
   }
 }
 
-// Read the Claude hook payload from stdin and return its transcript_path. Used by
-// the real `haya-pet state` process (a Claude hook child) — NOT by internal
-// callers, so tests and other commands never touch stdin. Bounded and best-effort:
-// a TTY (manual invocation) or a slow/absent payload resolves to undefined rather
-// than ever hanging the host client's hook.
-export function readHookTranscriptPathFromStdin(options = {}) {
+// Pull `agent_id` out of a Claude hook payload (JSON on stdin). Present only for
+// subagent-originated events (the documented field distinguishing subagent hook
+// calls from main-thread calls); absent for main-agent events. Pure and
+// defensive: any non-JSON, missing-field, or wrong-type input yields undefined.
+export function extractAgentId(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") {
+    return undefined;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const value = parsed?.agent_id;
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// Read the Claude hook payload from stdin and return everything the reporter
+// needs from it in one read (stdin can only be consumed once): the session's
+// transcript_path (for the watcher binding) and the live background_tasks snapshot
+// (for the subagent-at-Stop cue). Used by the real `haya-pet state` process (a
+// Claude hook child) — NOT by internal callers, so tests and other commands never
+// touch stdin. Bounded and best-effort: a TTY (manual invocation) or a
+// slow/absent payload resolves to empty results rather than ever hanging the host
+// client's hook.
+export async function readHookPayloadFromStdin(options = {}) {
+  const raw = await readHookPayloadRaw(options);
+  return {
+    transcriptPath: extractTranscriptPath(raw),
+    backgroundTasks: extractBackgroundTasks(raw),
+    agentId: extractAgentId(raw)
+  };
+}
+
+// Accumulate the raw payload string from stdin under a hard deadline and byte cap.
+// Always resolves (never rejects); an error or no payload yields "".
+function readHookPayloadRaw(options = {}) {
   const stdin = options.stdin ?? process.stdin;
   const timeoutMs = options.timeoutMs ?? 400;
   const maxBytes = options.maxBytes ?? 1_000_000;
 
   return new Promise((resolve) => {
     if (!stdin || stdin.isTTY) {
-      resolve(undefined);
+      resolve("");
       return;
     }
 
@@ -172,7 +235,7 @@ export function readHookTranscriptPathFromStdin(options = {}) {
     let settled = false;
     let timer;
 
-    const finish = (value) => {
+    const finish = () => {
       if (settled) {
         return;
       }
@@ -188,17 +251,20 @@ export function readHookTranscriptPathFromStdin(options = {}) {
       } catch {
         // detaching is best-effort
       }
-      resolve(value);
+      resolve(data);
     };
 
     const onData = (chunk) => {
       data += chunk;
       if (data.length > maxBytes) {
-        finish(extractTranscriptPath(data));
+        finish();
       }
     };
-    const onEnd = () => finish(extractTranscriptPath(data));
-    const onError = () => finish(undefined);
+    const onEnd = () => finish();
+    const onError = () => {
+      data = "";
+      finish();
+    };
 
     try {
       stdin.setEncoding("utf8");
@@ -206,12 +272,12 @@ export function readHookTranscriptPathFromStdin(options = {}) {
       stdin.on("end", onEnd);
       stdin.on("error", onError);
       stdin.resume();
-      timer = setTimeout(() => finish(extractTranscriptPath(data)), timeoutMs);
+      timer = setTimeout(finish, timeoutMs);
       if (timer && typeof timer.unref === "function") {
         timer.unref();
       }
     } catch {
-      finish(undefined);
+      finish();
     }
   });
 }