Add live transcript attach and managed agent runs

bt-daemon/README.md

@@ -6,7 +6,7 @@ event→trace state machine and sends spans to Braintrust out-of-band. See
 [`docs/protocol.md`](docs/protocol.md) for the wire contract.
 
 > **Placeholder name** — the real name is TBD. The subcommand framing
-> (`serve` / `hook` / `status` / `import`) should survive a rename.
+> (`serve` / `hook` / `status` / `import` / `run`) should survive a rename.
 
 ## Layout
 
@@ -16,7 +16,7 @@ One self-contained Cargo crate, liftable to its own repo by copying
 - `src/wire` — the wire protocol module: envelope types + JSON-RPC framing.
 - `src/translate` and `src/sink` — agent state machines and Braintrust output.
 - `src/lib.rs` — the embeddable library: clap `Args` + async entry points
-  (`run_serve`, `run_hook`, `run_status`, `run_import`). This is what `bt`
+  (`run_serve`, `run_hook`, `run_status`, `run_import`, `run_traced`). This is what `bt`
   depends on.
 - `src/main.rs` — the standalone **`bt-daemon` binary**, compiled only with
   the `cli` feature for isolated testing/development. Env/flag static-token
@@ -81,6 +81,16 @@ that transcript, and sends them through the normal translator and sink to
 create a trace for the past session. Hook-only facts absent from a native
 transcript are not invented.
 
+Add `--attach` to keep following an active Codex or Claude transcript until
+Ctrl-C. `run <codex|claude> [ARGS...]` launches the selected agent with
+inherited stdio and injects live Braintrust hooks for that invocation, so it
+does not depend on the tracing plugin being installed or enabled. Managed runs
+suppress inherited Braintrust plugin hooks to avoid logging the same session
+twice; the injected hooks still use the normal daemon translator and sink.
+Codex applies its normal hook-review flow, so the first run requires trusting
+the injected Braintrust hook through `/hooks`; later runs reuse that trust while
+the hook definition remains unchanged.
+
 ## Status
 
 Phases 0–5 are implemented: protocol, daemon lifecycle, Braintrust sink,

bt-daemon/docs/protocol.md

@@ -245,6 +245,17 @@ routing synthetic lifecycle events through the regular translator. `--parent
 <SpanComponents>` attaches it below an exported span and is mutually exclusive
 with an object destination.
 
+`--attach` keeps a single translator and sink alive, tails new native records,
+and finalizes the active turn on Ctrl-C. `run <codex|claude> [ARGS...]`
+launches the selected agent with inherited stdio and injects live hook
+configuration for that invocation, so it works without plugin setup. A private
+inherited environment marker makes installed Braintrust plugin hooks no-op for
+that managed child, while a private hook flag authorizes the injected hook process.
+Codex does not bypass hook trust: the user reviews the injected hook once through
+`/hooks`, and Codex reuses its hash-based trust while the definition is unchanged.
+The resulting native hook events follow the regular journal, translator, and
+sink path; transcript tailing remains specific to `import --attach`.
+
 - **Journal (WAL).** Every accepted event is appended (auth-redacted) to
   `<data_dir>/journal/<session_id>.ndjson` before/at enqueue. `data_dir`
   defaults to `$XDG_STATE_HOME/braintrust/bt-daemon` or