Claude Code transcripts may lack cwd on early records; hold until seen

Claude Code session transcripts can begin with queue-operation records that hold prompt text but no cwd field. Directory-based policy checks therefore cannot read the first line alone. Scan forward with a byte budget, skip overlong records without parsing them, and pre-filter lines by substring before decoding JSON. While directory exclusions exist, hold any session whose working directory has not appeared yet, and keep its cursor so capture resumes once the field shows up. Codex rollouts, by contrast, record cwd in the first session_meta record. Limits: a transcript that never records a directory stays held, and this describes formats observed locally, not a documented guarantee.

Applies when: filtering or attributing Claude Code or Codex sessions by working directory from their JSONL transcripts. Keywords: Claude Code transcript cwd queue-operation JSONL Codex session_meta working directory filter