wendkeep 0.46.0 → 0.46.2

package/CHANGELOG.md

@@ -4,6 +4,91 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.46.2] — 2026-07-19
+
+### Fixed
+
+- **Rollout de subagent do Codex virava sessão top-level no import.** Um subagent do Codex
+  não é um arquivo em `<transcript>/subagents/` — é um rollout **irmão** no
+  `~/.codex/sessions/`, cujo `session_meta` declara `source.subagent` e aponta pro pai via
+  `parent_thread_id`. O import ignorava o marcador e materializava o subagent como uma
+  "sessão" própria, com o contexto do pai inteiro replicado (subagent herda o histórico) —
+  no caso real, uma nota fantasma de 23 turnos duplicando a conversa da sessão-mãe. Agora a
+  descoberta expõe o marcador, o import conta subagents à parte no relatório (nunca em
+  `skipped`) e nenhuma nota é criada. A entrada de registry que o import antigo escreveu
+  para um subagent é removida — self-healing do nosso próprio dado errado, nunca limpeza
+  genérica: entrada com o mesmo id mas transcript diferente é preservada.
+- **Telemetria de subagent do Codex nunca chegava à sessão-mãe — nem ao vivo.** A descoberta
+  (`collectSubagentUsage`) era Claude-shaped: procurava um diretório `subagents/` ao lado do
+  transcript, que no Codex não existe. Resultado: toda sessão Codex fechava com
+  `subagents_count: 0`, tanto no import quanto no hook vivo `SubagentStop` wirado na 0.46.0
+  — o custo dos subagents simplesmente não existia no vault. A nova
+  `collectCodexSubagentUsage` acha os irmãos por `parent_thread_id` (no dia do rollout pai e
+  no dia seguinte, cobrindo spawn que cruza a meia-noite UTC — o caso real passou a seis
+  minutos disso) e devolve o mesmo agregado que o writer já consome: vivo e import passam a
+  atribuir pelo mesmo caminho.
+- **O bloco injetado ainda aparecia como fala do usuário no "Contexto conversado".** O fix
+  da 0.46.1 protegeu o título, mas a linha `**Usuário:**` da iteração vinha de um segundo
+  filtro (`shouldIgnoreUserText`) que duplicava por cópia a lista do `isBootstrapPrompt` — e
+  as cópias divergiram. O filtro agora delega: um lugar só para o próximo bloco que o
+  harness inventar.
+- Bytes NUL literais em `hooks/token-usage.mjs` e `hooks/subagent-usage.mjs` escapados —
+  mesma classe do fix de `taxonomy.mjs` (#7): o byte cru fazia o `file` classificar o fonte
+  como binário e o ripgrep pulá-lo em silêncio. Entrou `tests/source-hygiene.test.mjs`
+  barrando byte de controle em qualquer fonte publicado; ele pegou uma quarta ocorrência
+  introduzida durante esta própria mudança.
+
+## [0.46.1] — 2026-07-19
+
+### Fixed
+
+- **Turnos do Codex sumiam da nota sem nenhum aviso.** No Windows o Codex serializa o payload
+  do `Stop` com o campo `last_assistant_message` cortado no meio, sem fechar a string JSON —
+  bug upstream ainda aberto ([openai/codex#23784](https://github.com/openai/codex/issues/23784)).
+  Sessão em português enche esse campo de acento, então o corte é frequente. O
+  `readHookInput` fazia `JSON.parse` cru, lançava, e o `session-stop` saía com código 0
+  escrevendo só no stderr — que o Codex descarta. Resultado: a nota era criada, o summary
+  atualizava a cada prompt, e nenhuma iteração jamais entrava. Só o `Stop` quebrava porque
+  `last_assistant_message` é o único campo exclusivo dele; `SessionStart` e
+  `UserPromptSubmit` não o carregam.
+  Como esse campo é o **último** do `StopCommandInput`, tudo que o wendkeep consome
+  (`session_id`, `turn_id`, `transcript_path`, `cwd`) está no prefixo bem-formado. O
+  `readHookInput` passa a recuperar esse prefixo numa passada só, descartando o campo
+  truncado — nunca reconstruindo-o, porque metade de uma mensagem é dado inventado.
+- **O hook parou de falhar em silêncio.** Todo caminho de bail do `session-stop` agora emite
+  `systemMessage`, que a UI do Codex mostra, com o motivo e o comando de recuperação. O exit
+  code continua 0 de propósito: hook de `Stop` que sai diferente de zero trava o turno
+  (openai/codex#21921), e trocar turno perdido por sessão travada é pior negócio.
+- **`resolveSessionIdentity` passa a usar o `SESSION_REGISTRY` como fonte do
+  `transcript_path`** quando o payload não o traz. O registry já tinha o mapeamento; o lookup
+  é que ficava abaixo do gate, inalcançável justo no caso que resolveria. A entrada precisa
+  ser do mesmo provider, o que preserva o invariante do incidente de contaminação
+  cross-provider de 2026-07-11.
+- **`wendkeep import` deixou de ser cego para a sessão danificada.** O dedup perguntava
+  "existe registro?", não "existe conteúdo?" — e como o `session-start` registra antes do
+  `session-stop` escrever, **as sessões esvaziadas pelo bug acima eram exatamente as que o
+  comando de recuperação se recusava a consertar.** Agora a decisão compara os turnos do
+  transcript com os marcadores `wk-turn` já na nota: cobertura completa pula, parcial ou
+  vazia completa a nota existente sem criar uma segunda. Sem flag opt-in — quem roda `import`
+  depois de perder sessão não tem como saber que precisaria de uma. O relatório ganhou a
+  categoria `repaired`, separada de `imported` (nota nova) e de `skipped` (já completa).
+- **Sessões importadas ganhavam título de bloco injetado pelo harness.** Seis notas de um
+  mesmo projeto ficaram chamadas `<recommended_plugins> Here is a list of plugins that ar`,
+  no frontmatter e no nome do arquivo. Causa de uma linha: `buildIterationBlock` seleciona
+  `userPrompts.at(-1)` e o `deriveSummary` usava `.find(Boolean)` — o harness injeta o bloco
+  como **primeiro** prompt do turno e o pedido do usuário vem por **último**. Mesmo dado,
+  ponta oposta. As duas seleções agora são a mesma, com `isBootstrapPrompt` (que passou a
+  reconhecer `<recommended_plugins>`) como rede, aplicado ao prompt inteiro e não linha a
+  linha — filtrar por linha cairia na linha seguinte do próprio bloco injetado.
+
+### Recuperação
+
+- Quem perdeu turnos de sessões Codex antes desta versão recupera com
+  `wendkeep import --source codex`. O rollout do Codex fica íntegro em disco, e o import agora
+  completa a nota existente em vez de pulá-la. Rodar mais de uma vez é no-op.
+- Notas já criadas com título poluído **não** são renomeadas automaticamente: mexer em nome de
+  arquivo quebra wikilink e reorganiza o grafo, e isso é decisão do dono do vault.
+
 ## [0.46.0] — 2026-07-18
 
 ### Added

package/hooks/import-sessions.mjs

@@ -17,7 +17,7 @@ import {
 import { buildSessionContent, allocateSessionPath } from './session-start.mjs';
 import { createLinkedNotes } from './linked-notes.mjs';
 import { updateSessionObservability } from './session-observability.mjs';
-import { readSessionRegistry, upsertSessionRegistry, formatLocalIso, formatDate, providerMeta } from './obsidian-common.mjs';
+import { readSessionRegistry, upsertSessionRegistry, removeSessionRegistryEntry, formatLocalIso, formatDate, providerMeta, isBootstrapPrompt } from './obsidian-common.mjs';
 import { getLocale } from './locale.mjs';
 import { captureProseDecisions } from './decision-capture.mjs';
 
@@ -154,6 +154,36 @@ export function capturedSessionIds(vaultBase) {
   return ids;
 }
 
+// session_id -> absolute note path, for the sessions that already have a note on disk. The
+// registry alone is not enough: it records a session the moment session-start runs, which is
+// exactly the state a damaged session is stuck in (registered, note empty).
+export function capturedSessionNotes(vaultBase) {
+  const notes = new Map();
+  const registry = readSessionRegistry(vaultBase).sessions || {};
+  for (const [id, entry] of Object.entries(registry)) {
+    if (!entry?.session_file) continue;
+    const abs = join(vaultBase, ...String(entry.session_file).split('/'));
+    if (existsSync(abs)) notes.set(id, abs);
+  }
+  try {
+    const sessionsDir = join(vaultBase, getLocale(vaultBase).folders.sessions);
+    for (const path of walkFiles(sessionsDir, /\.md$/i)) {
+      const id = noteSessionId(path);
+      if (id && !notes.has(id)) notes.set(id, path);
+    }
+  } catch { /* registry alone is enough */ }
+  return notes;
+}
+
+// Turn ids already memorialized in a note, read from the `wk-turn` markers insertIteration
+// writes. Missing/unreadable note = nothing captured.
+export function noteTurnIds(notePath) {
+  try {
+    const md = readFileSync(notePath, 'utf-8');
+    return new Set([...md.matchAll(/<!-- (?:wk|codex)-turn: ([^\s]+) -->/g)].map((m) => m[1]));
+  } catch { return new Set(); }
+}
+
 export function discoverCodexTranscripts(projectPath, fromDir) {
   const dir = fromDir || defaultCodexSessionsDir();
   if (!dir || !existsSync(dir)) return { dir, transcripts: [] };
@@ -162,15 +192,25 @@ export function discoverCodexTranscripts(projectPath, fromDir) {
     const meta = readSessionMeta(path);
     if (!meta || !meta.id) continue;
     if (projectPath && !cwdMatchesProject(meta.cwd, projectPath)) continue;
-    transcripts.push({ path, sessionId: meta.id, cwd: meta.cwd || '' });
+    // A subagent thread's rollout is a SIBLING file of its parent's — same dir, own id. The
+    // meta says what the file IS; ignoring it turned hierarchy into a duplicate session note.
+    const subagent = meta.source?.subagent
+      ? { parentThreadId: meta.parent_thread_id || meta.source.subagent.thread_spawn?.parent_thread_id || '', nickname: meta.source.subagent.thread_spawn?.agent_nickname || '' }
+      : null;
+    transcripts.push({ path, sessionId: meta.id, cwd: meta.cwd || '', subagent });
   }
   return { dir, transcripts };
 }
 
 // Session objective for the note title/frontmatter: first real user prompt, one line.
-function deriveSummary(tx) {
-  for (const turn of tx.turns || []) {
-    const prompt = (turn.userPrompts || []).find(Boolean);
+// Mirrors buildIterationBlock's selection (`userPrompts.at(-1)`) on purpose: the harness
+// injects preamble as the FIRST prompt of a turn and the user's request lands LAST, so taking
+// the first titled six Vendiva sessions "<recommended_plugins> Here is a list of plugins".
+// isBootstrapPrompt is the belt: it runs per whole prompt, not per line — filtering by line
+// would fall through to the next line of the SAME injected block.
+export function deriveSummary(tx) {
+  for (const turn of tx?.turns || []) {
+    const prompt = (turn.userPrompts || []).filter((p) => p && !isBootstrapPrompt(p)).at(-1);
     if (prompt) {
       return prompt.replace(/[\r\n#]+/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 80) || 'session';
     }
@@ -313,15 +353,29 @@ export function runImport(vaultBase, opts = {}) {
     codexDir = d.dir;
     transcripts.push(...d.transcripts);
   }
-  const captured = capturedSessionIds(vaultBase);
+  const notes = capturedSessionNotes(vaultBase);
   const sinceMs = since ? Date.parse(since) : 0;
-  const report = { source: src, claudeDir, codexDir, scanned: transcripts.length, imported: 0, skipped: 0, errors: [], sessions: [] };
+  const report = { source: src, claudeDir, codexDir, scanned: transcripts.length, imported: 0, repaired: 0, skipped: 0, subagents: 0, errors: [], sessions: [] };
 
   let done = 0;
   for (const t of transcripts) {
-    if (captured.has(t.sessionId)) { report.skipped++; continue; }
+    // A subagent rollout is telemetry of its PARENT session, never a session of its own —
+    // importing it materialized the parent's replayed context as a ghost note. Counted apart
+    // from `skipped` (which means "session already covered"). If import <=0.46.1 registered
+    // it as a top-level session, that entry is our own bad write: heal it.
+    if (t.subagent) {
+      report.subagents++;
+      if (!dryRun) {
+        try { removeSessionRegistryEntry(vaultBase, t.sessionId, t.path); } catch { /* best-effort */ }
+      }
+      continue;
+    }
     if (limit && done >= limit) break;
 
+    // Every transcript is parsed now, including already-captured ones: partial coverage is
+    // undetectable without the turn list. The old presence-only check was cheaper but made
+    // the recovery command blind to exactly the sessions it exists to repair. Narrow a large
+    // vault with --since / --limit.
     let tx;
     try {
       tx = parseTranscript(t.path);
@@ -332,6 +386,31 @@ export function runImport(vaultBase, opts = {}) {
     const turns = tx.turns || [];
     if (!turns.length) { report.skipped++; continue; }
 
+    const existingNote = notes.get(t.sessionId);
+    if (existingNote) {
+      const have = noteTurnIds(existingNote);
+      const missing = turns.filter((turn) => !have.has(String(turn.turnId)));
+      if (!missing.length) { report.skipped++; continue; }
+      if (dryRun) {
+        report.sessions.push({ sessionId: t.sessionId, turns: missing.length, repaired: true, dryRun: true });
+        report.repaired++;
+        done++;
+        continue;
+      }
+      try {
+        for (const turn of missing) {
+          insertIteration(existingNote, buildIterationBlock(tx, { turn_id: turn.turnId, now: turn.timestamp }), turn.turnId, tx);
+        }
+        try { updateSessionObservability({ sessionPath: existingNote, transcriptPath: t.path }); } catch { /* best-effort */ }
+        report.sessions.push({ sessionId: t.sessionId, turns: missing.length, repaired: true });
+        report.repaired++;
+        done++;
+      } catch (error) {
+        report.errors.push({ sessionId: t.sessionId, error: error.message });
+      }
+      continue;
+    }
+
     const startTs = turns[0].timestamp || '';
     if (sinceMs && startTs && Number.isFinite(Date.parse(startTs)) && Date.parse(startTs) < sinceMs) {
       report.skipped++;

package/hooks/obsidian-common.mjs

@@ -23,10 +23,52 @@ export const VAULT_COMPLEMENT_RULES = [
   'Atualize `SHARED_MEMORY.md` somente quando a síntese mudar estado ativo que outro agente precise saber.',
 ];
 
+// Codex on Windows serializes the Stop payload with `last_assistant_message` cut mid-string
+// and never closed when the assistant text carries non-ASCII (openai/codex#23784). That field
+// is LAST in codex-rs's StopCommandInput, so everything wendkeep consumes — session_id,
+// turn_id, transcript_path, cwd — sits in the intact prefix.
+//
+// One pass, tracking quotes/escapes/depth, remembering the offset of the last top-level comma
+// that was NOT inside a string. Re-closing there yields the well-formed prefix. Deliberately
+// NOT a decreasing brute-force parse: this runs on every turn and the payload can be tens of
+// KB. The truncated field is dropped, never reconstructed — half an assistant message is
+// invented data, and it is the one field we do not need.
+export function salvageTruncatedJson(raw) {
+  const text = String(raw || '');
+  if (text[0] !== '{') return null;
+  let inString = false;
+  let escaped = false;
+  let depth = 0;
+  let lastBoundary = -1;
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    if (escaped) { escaped = false; continue; }
+    if (ch === '\\') { if (inString) escaped = true; continue; }
+    if (ch === '"') { inString = !inString; continue; }
+    if (inString) continue;
+    if (ch === '{' || ch === '[') depth += 1;
+    else if (ch === '}' || ch === ']') depth -= 1;
+    else if (ch === ',' && depth === 1) lastBoundary = i;
+  }
+  if (lastBoundary === -1) return null;
+  try {
+    const parsed = JSON.parse(`${text.slice(0, lastBoundary)}}`);
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch { return null; }
+}
+
 export function readHookInput() {
   const raw = readFileSync(0, 'utf-8').trim();
   if (!raw) return {};
-  return JSON.parse(raw);
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    const salvaged = salvageTruncatedJson(raw);
+    // `_wk` prefix: the object is the harness payload merged with our own metadata, and a
+    // silent key collision here would be worse than the ugly prefix.
+    if (salvaged) return { ...salvaged, _wkSalvaged: true };
+    throw error;
+  }
 }
 
 export function writeHookOutput(payload = {}) {
@@ -313,6 +355,25 @@ function meaningfulPatch(patch = {}) {
   }));
 }
 
+// Remove one registry entry, but ONLY when its transcript matches the given path — this is
+// self-healing for entries wendkeep itself mis-wrote (a subagent rollout registered as a
+// top-level session by import <=0.46.1), never generic registry cleanup. An entry with the
+// same id but a different transcript belongs to someone else's state and is preserved.
+export function removeSessionRegistryEntry(vaultBase, sessionId, transcriptPath) {
+  if (!sessionId) return false;
+  let removed = false;
+  mutateSessionRegistry(vaultBase, (registry) => {
+    const entry = registry.sessions[sessionId];
+    if (!entry) return null;
+    const paths = [...(Array.isArray(entry.transcript_paths) ? entry.transcript_paths : []), entry.transcript_path].filter(Boolean);
+    if (!paths.some((p) => transcriptsMatch(p, transcriptPath))) return null;
+    delete registry.sessions[sessionId];
+    removed = true;
+    return null;
+  });
+  return removed;
+}
+
 export function upsertSessionRegistry(vaultBase, sessionId, patch) {
   if (!sessionId) return null;
   const clean = meaningfulPatch(patch);
@@ -503,6 +564,10 @@ export function isBootstrapPrompt(text = '') {
   return clean.startsWith('# AGENTS.md instructions')
     || clean.startsWith('<environment_context>')
     || clean.startsWith('<permissions instructions>')
+    // Codex injects the available-plugins catalogue as the first userPrompt of turn 1.
+    // Anchored with startsWith on purpose: matching the bare substring would discard a
+    // legitimate prompt that merely asks about plugins.
+    || clean.startsWith('<recommended_plugins>')
     || clean.includes('You are Codex, a coding agent')
     || clean.startsWith('## Memory');
 }

package/hooks/session-identity.mjs

@@ -96,6 +96,30 @@ export function resolveSessionIdentity(vaultBase, input = {}, provider = detectP
     };
   }
 
+  // Codex on Windows can deliver a Stop payload whose transcript_path never arrives (or is
+  // lost to a truncated JSON, openai/codex#23784). The registry already knows the mapping —
+  // the lookup below just sat under this gate, unreachable in the one case it solves. The
+  // comment above says we require "rollout/registry"; the registry half was never wired.
+  // Requiring the entry's provider to match preserves the cross-provider invariant from the
+  // 2026-07-11 incident: we are not minting a canonical id, we are finding an ALREADY
+  // REGISTERED session whose key is the hook's own id. A resume with a fresh id simply
+  // misses and stays deferred.
+  if (!transcriptPath && hookId) {
+    const entry = readSessionRegistry(vaultBase).sessions?.[hookId];
+    if (entry?.transcript_path && entry.provider === provider) {
+      return {
+        state: 'resolved',
+        provider,
+        canonicalConversationId: hookId,
+        hookSessionId: hookId,
+        transcriptPath: entry.transcript_path,
+        transcriptId: entry.transcript_id || basename(entry.transcript_path, '.jsonl'),
+        parentConversationId: '',
+        diagnostics: ['transcript recuperado do SESSION_REGISTRY'],
+      };
+    }
+  }
+
   if (!transcriptPath || !inspected.canonicalConversationId) {
     return { state: 'deferred', provider, transcriptPath, diagnostics: ['transcript ausente ou sem identidade canônica'] };
   }

package/hooks/session-observability.mjs

@@ -1,7 +1,7 @@
 // Single atomic writer for session usage, models, reasoning/effort and subagents.
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { collectSessionUsage } from './token-usage.mjs';
-import { collectSubagentUsage, sessionDirFromTranscript } from './subagent-usage.mjs';
+import { collectSubagentUsage, collectCodexSubagentUsage, sessionDirFromTranscript } from './subagent-usage.mjs';
 import { inspectTranscriptIdentity } from './session-identity.mjs';
 
 const HEADING = '## Agentes, tokens e custos';
@@ -137,7 +137,11 @@ ${renderSubagents(subagents)}`;
 export function buildSessionObservability({ sessionContent, transcriptPath }) {
   const main = collectSessionUsage({ sessionContent, transcriptPath });
   if (!main) return null;
-  const subagents = collectSubagentUsage(sessionDirFromTranscript(transcriptPath));
+  // Claude layout first (<transcript>/subagents/); when absent, the Codex layout — sibling
+  // rollouts linked by parent_thread_id. The Codex collector self-gates: a Claude transcript
+  // has no session_meta line, so it returns null and this stays a strict fallback.
+  const subagents = collectSubagentUsage(sessionDirFromTranscript(transcriptPath))
+    || collectCodexSubagentUsage(transcriptPath);
   const ledger = [...mainLedger(main), ...subagentLedger(subagents)];
   const sub = subagents?.aggregate || { count: 0, tokens: 0, cost: 0, wasted: 0, tools: [] };
   let content = main.content;

package/hooks/session-stop.mjs

@@ -18,6 +18,7 @@ import {
   formatLocalIso,
   getNextAdrNumber,
   getVaultBase,
+  isBootstrapPrompt,
   warnIfDefaultVault,
   listMarkdownFiles,
   readControl,
@@ -53,11 +54,12 @@ const SYNTHETIC_EVENT_TAG = /^<\/?(?:task-notification|system-reminder|local-com
 
 function shouldIgnoreUserText(text) {
   const trimmed = String(text || '').trim();
+  // Bootstrap detection is DELEGATED, not copied: this used to duplicate isBootstrapPrompt's
+  // prefix list and the copies drifted — <recommended_plugins> made it into one and not the
+  // other, so the title came out clean while the same block still showed as "Usuário" in the
+  // conversation context. One filter, one place to add the next injected block.
   return SYNTHETIC_EVENT_TAG.test(trimmed)
-    || /^# AGENTS\.md instructions/.test(trimmed)
-    || trimmed.startsWith('<permissions instructions>')
-    || trimmed.includes('You are Codex, a coding agent')
-    || trimmed.startsWith('## Memory')
+    || isBootstrapPrompt(trimmed)
     // Harness utility meta-prompts (title generation, classifiers) — not real user turns; they
     // were leaking into note titles/summaries on import.
     || /^Generate a concise( UI)? title/i.test(trimmed)
@@ -584,6 +586,16 @@ function formatTokenLine(usage, model) {
   return cost ? `${line} — ≈ API equivalente (não é cobrança do plano)` : line;
 }
 
+// User-facing explanation for a turn that could not be memorialized. Names the upstream bug
+// when the payload arrived salvaged, because "wendkeep didn't record it" reads as a wendkeep
+// defect and the user would have nowhere to look.
+export function bailMessage(why, input = {}) {
+  const truncated = input._wkSalvaged
+    ? ' O payload do Stop chegou truncado (openai/codex#23784).'
+    : '';
+  return `[wendkeep] Turno não registrado: ${why}.${truncated} Recupere com \`wendkeep import --source codex\`.`;
+}
+
 export function buildIterationBlock(tx, input) {
   const turnId = input.turn_id || tx.latestTurnId || `${Date.now()}`;
   const turn = selectTurn(tx, turnId);
@@ -1033,8 +1045,11 @@ function main() {
   const transcriptPath = input.transcript_path || input.transcriptPath || '';
   const { identity, entry } = resolveSessionEntry(vaultBase, input);
   if (identity.state !== 'resolved' || !entry?.session_file) {
-    process.stderr.write(`[wendkeep] Stop sem identidade segura: ${identity.diagnostics?.join('; ') || 'sessão não registrada'}\n`);
-    writeHookOutput({});
+    const why = identity.diagnostics?.join('; ') || 'sessão não registrada';
+    process.stderr.write(`[wendkeep] Stop sem identidade segura: ${why}\n`);
+    // stderr alone is a black hole here: Codex discards it, which is how an entire session of
+    // lost turns produced no signal at all. systemMessage is what the UI actually shows.
+    writeHookOutput({ systemMessage: bailMessage(why, input) });
     return;
   }
 
@@ -1160,6 +1175,9 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
     main();
   } catch (error) {
     process.stderr.write(`[wendkeep] Stop falhou: ${error.message}\n`);
-    writeHookOutput({});
+    // Same reasoning as the identity bail: stderr is discarded by Codex. Exit stays 0 —
+    // a non-zero Stop hook blocks the turn (openai/codex#21921), and trading a lost turn
+    // for a stuck session is a worse deal.
+    writeHookOutput({ systemMessage: bailMessage(error.message) });
   }
 }

package/hooks/subagent-usage.mjs

@@ -76,6 +76,109 @@ const round4 = (n) => Math.round((Number(n) || 0) * 10000) / 10000;
 
 // Aggregate every subagent transcript under <sessionDir>/subagents. null when the dir is
 // absent (Codex / a session with no subagents) or nothing parseable.
+// --- Codex discovery ----------------------------------------------------------
+// A Codex subagent is not a file under `<transcript>/subagents/` — it is a SIBLING rollout
+// in ~/.codex/sessions/YYYY/MM/DD/, whose session_meta declares source.subagent and points
+// back via parent_thread_id. Without this, every Codex session closed with subagents_count 0,
+// live (SubagentStop) and on import alike.
+
+// First line of a rollout, bounded — Codex meta lines can be large (env, git, instructions).
+function readRolloutMeta(path, maxBytes = 4 * 1024 * 1024) {
+  try {
+    const text = readFileSync(path, 'utf-8');
+    if (text.length > maxBytes) return null;
+    const line = text.slice(0, text.indexOf('\n') === -1 ? text.length : text.indexOf('\n'));
+    const e = JSON.parse(line);
+    return e.type === 'session_meta' ? (e.payload || {}) : null;
+  } catch { return null; }
+}
+
+// Sibling day dirs to scan: the parent rollout's own dir plus the NEXT day — a session that
+// crosses midnight UTC spawns its subagent in the other day's folder, and the first real case
+// (Vendiva, 23:54 UTC) missed that by six minutes.
+function codexSiblingDirs(transcriptPath) {
+  const dir = join(transcriptPath, '..');
+  const m = String(dir).replace(/[\\/]+$/, '').match(/(\d{4})[\\/](\d{2})[\\/](\d{2})$/);
+  if (!m) return [dir];
+  const next = new Date(Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]) + 1));
+  const pad = (n) => String(n).padStart(2, '0');
+  const nextDir = join(dir, '..', '..', '..', String(next.getUTCFullYear()), pad(next.getUTCMonth() + 1), pad(next.getUTCDate()));
+  return [dir, nextDir];
+}
+
+export function collectCodexSubagentUsage(transcriptPath) {
+  const meta = readRolloutMeta(transcriptPath);
+  if (!meta?.id) return null; // not a Codex rollout — the Claude path stays untouched
+  const canonicalId = meta.id;
+
+  const subagents = [];
+  const allTools = new Set();
+  const usageAgg = { input: 0, cached: 0, cacheWrite: 0, output: 0, reasoning: 0, total: 0 };
+  const modelMap = new Map();
+  let count = 0;
+  let calls = 0;
+  let cost = 0;
+
+  for (const dayDir of codexSiblingDirs(transcriptPath)) {
+    let names;
+    try { names = readdirSync(dayDir); } catch { continue; }
+    for (const n of names) {
+      if (!/\.jsonl$/i.test(n)) continue;
+      const f = join(dayDir, n);
+      if (f === transcriptPath) continue;
+      const sib = readRolloutMeta(f);
+      if (!sib?.source?.subagent) continue;
+      const parent = sib.parent_thread_id || sib.source.subagent.thread_spawn?.parent_thread_id || '';
+      if (parent !== canonicalId) continue;
+
+      const summary = summarizeTokenUsage(parseTokenUsageFromTranscript(f));
+      if (!summary.calls) continue;
+      const tokens = tokensTotal(summary.totals);
+      for (const t of summary.tools) allTools.add(t);
+
+      subagents.push({
+        id: String(sib.id || basename(f, '.jsonl')).slice(0, 12),
+        agentType: sib.source.subagent.thread_spawn?.agent_nickname || 'codex-subagent',
+        workflow: null,
+        model: summary.models[0] || '?',
+        effort: summary.pensamento || '',
+        tools: summary.tools.length,
+        toolNames: summary.tools,
+        calls: summary.calls,
+        tokens,
+        cost: round4(summary.costs.model),
+        modelRows: summary.modelRows,
+      });
+
+      for (const row of summary.modelRows || []) {
+        const rowEffort = summary.pensamento || '';
+        const key = `${row.provider || '?'}\u0000${row.model || '?'}\u0000${rowEffort}`;
+        const current = modelMap.get(key) || { provider: row.provider || '?', model: row.model || '?', effort: rowEffort, calls: 0, tokens: 0, cost: 0,
+          usage: { input: 0, cached: 0, cacheWrite: 0, output: 0, reasoning: 0, total: 0 } };
+        current.calls += row.calls || 0;
+        current.tokens += tokensTotal(row.usage);
+        current.cost += row.costs?.model || 0;
+        for (const k of Object.keys(current.usage)) current.usage[k] += row.usage?.[k] || 0;
+        modelMap.set(key, current);
+      }
+
+      count += 1;
+      calls += summary.calls;
+      cost += summary.costs.model;
+      for (const k of Object.keys(usageAgg)) usageAgg[k] += summary.totals[k] || 0;
+    }
+  }
+
+  if (!count) return null;
+  return {
+    subagents,
+    workflows: [],
+    aggregate: { count, calls, tokens: tokensTotal(usageAgg), cost: round4(cost), wasted: 0, usage: usageAgg, tools: [...allTools],
+      modelRows: [...modelMap.values()].map((r) => ({ ...r, cost: round4(r.cost), source: 'subagent' })),
+    },
+  };
+}
+
 export function collectSubagentUsage(sessionDir) {
   const subDir = join(sessionDir, 'subagents');
   if (!existsSync(subDir)) return null;

package/hooks/token-usage.mjs

@@ -612,7 +612,7 @@ const USAGE_FIELDS = ['provider', 'pensamento', 'input', 'cache_write', 'cache_r
 
 export function sameUsageData(a, b) {
   if (!a || !b) return false;
-  const listEqual = (x, y) => (x || []).join('') === (y || []).join('');
+  const listEqual = (x, y) => (x || []).join('\u0000') === (y || []).join('\u0000');
   return USAGE_FIELDS.every((f) => (a[f] ?? null) === (b[f] ?? null))
     && listEqual(a.modelos, b.modelos) && listEqual(a.tools, b.tools);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.46.0",
+  "version": "0.46.2",
   "description": "A persistent-memory harness for AI coding agents on your Obsidian vault: turn-by-turn session capture plus a native, zero-dependency spec→change→verify→archive loop (sensor-gated, independent verdict, mutation discrimination). Local-first, agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "bin": {