Exclude Codex guardian subagent rollouts from traces and pinning

Codex >=0.142 spawns internal "guardian" safety-judge subagents whose
rollout files share the session's cwd. The trace parser attributed them
to the user's session, polluting or blanking out the Overview digest
(codex-1 showed nothing), and the ID capture could pin a guardian's
conversation id, which would also break resume.

Flag rollouts whose session_meta says thread_source=subagent (or has a
source.subagent) and skip them in trace attribution and in
tryCaptureCodexId. Sessions already pinned to a guardian or missing
rollout self-heal on next launch: the stale pin is cleared so the real
conversation is re-captured.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/runner.js

@@ -164,14 +164,35 @@ function tryCaptureCodexId(sessionId, workdir, sinceMs) {
     if (!m || claimed.has(m[1])) continue;
     let meta;
     try { meta = JSON.parse(firstLine(c.p)); } catch { continue; }
-    if ((meta && meta.payload && meta.payload.cwd) !== workdir) continue;
+    const mp = (meta && meta.payload) || {};
+    if (mp.cwd !== workdir) continue;
+    // Skip Codex's internal guardian/subagent rollouts — they share the cwd but
+    // aren't this agent's conversation, so pinning one would break resume and
+    // the Overview digest.
+    if (mp.thread_source === 'subagent' || (mp.source && mp.source.subagent)) continue;
     update(sessionId, { codexSessionId: m[1], codexRollout: c.p });
     return true;
   }
   return false;
 }
 
+// A pin captured before subagents were filtered out (or one whose rollout was
+// rotated away) may point at a guardian/missing rollout — clear it so we
+// re-capture the real conversation on this launch.
+function pinIsStale(session) {
+  if (!session.codexSessionId) return false;
+  const p = session.codexRollout;
+  if (!p || !fs.existsSync(p)) return true;
+  try {
+    const mp = (JSON.parse(firstLine(p)) || {}).payload || {};
+    return mp.thread_source === 'subagent' || !!(mp.source && mp.source.subagent);
+  } catch { return false; }
+}
+
 function scheduleCodexCapture(session, workdir) {
+  if (session.codexSessionId && pinIsStale(session)) {
+    session = update(session.id, { codexSessionId: undefined, codexRollout: undefined }) || session;
+  }
   if (session.codexSessionId || codexCapturing.has(session.id)) return;
   codexCapturing.add(session.id);
   const since = Date.now() - 2000;

server/src/traces.js

@@ -135,7 +135,14 @@ function parseCodex(txt) {
     let j; try { j = JSON.parse(line); } catch { continue; }
     if (j.timestamp) addTs(st, j.timestamp);
     const p = j.payload || {};
-    if (j.type === 'session_meta' && p.cwd) st.cwd = p.cwd; // for cwd-fallback attribution
+    if (j.type === 'session_meta') {
+      if (p.cwd) st.cwd = p.cwd; // for cwd-fallback attribution
+      // Codex >=0.142 spawns internal "guardian" safety-judge subagents whose
+      // rollouts share the session's cwd. They aren't the user's conversation —
+      // flag them so build() skips attribution (they'd otherwise pollute or
+      // blank out the Overview digest).
+      if (p.thread_source === 'subagent' || (p.source && p.source.subagent)) st.subagent = true;
+    }
     if (j.type === 'response_item') {
       switch (p.type) {
         case 'message':
@@ -537,6 +544,7 @@ async function build() {
     seenFiles.add(p);
     const parsed = await statsFor(p, parseCodex);
     if (!parsed) continue;
+    if (parsed.stats.subagent) continue; // Codex guardian subagent — not the user's thread
     const m = path.basename(p).match(UUID_RE);
     let session = m ? byCodexId.get(m[1]) : null;
     if (!session && parsed.stats.cwd) {