Codex auto-review (guardian) threads show as separate cards and ignore Plugin Sub-Sessions

[ChaoyuWang04]

Description

With Codex Auto-review turned on (approvals_reviewer = "auto_review", or Auto-review selected in the Codex Desktop permission menu), every approval spawns a reviewer ("guardian") thread. CodeIsland shows each of these threads as its own top-level Codex card. The card has no title, and its prompt reads The following is the Codex agent history added since your last approval assessment…. Its output is the reviewer's verdict JSON ({"risk_level":"medium","user_authorization":"high","outcome":"allow",…}).

Settings → Sessions → Plugin Sub-Sessions → Merge / Hide has no effect on these cards. Normal thread_spawn subagents are merged or hidden correctly.

Environment

• CodeIsland 1.0.34
• Codex Desktop (originator: "Codex Desktop" / "codex_work_desktop", cli_version 0.155.0-alpha.9.2)

Cause

The session_meta of a guardian rollout, with unrelated fields trimmed:

{"type":"session_meta","payload":{
  "id":"01a0cd17-…",
  "parent_thread_id":"01a0b825-…",
  "source":{"subagent":{"other":"guardian"}},
  "thread_source":"guardian_review",
  "originator":"Codex Desktop"}}

AppState.inspectCodexSubagentMetadata looks for parent_thread_id only inside source.subagent. That works for thread_spawn workers. Guardian threads store the parent on the payload itself, so the lookup returns .unavailable. The fallback doesn't help either: ~/.codex/state_5.sqlite has no thread_spawn_edges row for guardian threads, and threads.source holds only {"subagent":{"other":"guardian"}}. The card therefore never gets a parent and is never merged or hidden.

Expected

Guardian review threads should follow the Plugin Sub-Sessions setting, the same way thread_spawn subagents do: merged under the parent Codex thread, or hidden.

I have a minimal fix with a test and will open a PR.