diff --git a/tests/fixtures/passthrough/sample.expected.json b/tests/fixtures/passthrough/claude-code.expected.json
similarity index 53%
rename from tests/fixtures/passthrough/sample.expected.json
rename to tests/fixtures/passthrough/claude-code.expected.json
index 9573b8b..799633f 100644
--- a/tests/fixtures/passthrough/sample.expected.json
+++ b/tests/fixtures/passthrough/claude-code.expected.json
@@ -3,6 +3,7 @@
     "sourcetype": "cribl:demo",
     "index": "main",
     "datatype": "cribl-demo",
-    "_raw": "demo event"
+    "type": "assistant",
+    "sessionId": "fe82a754-0606-4bcf-b79a-f7b6f2a72bc8"
   }
 ]
diff --git a/tests/fixtures/passthrough/claude-code.json b/tests/fixtures/passthrough/claude-code.json
new file mode 100644
index 0000000..e6941b9
--- /dev/null
+++ b/tests/fixtures/passthrough/claude-code.json
@@ -0,0 +1,22 @@
+[
+  {
+    "datatype": "cribl-demo",
+    "_time": 1736836313.996,
+    "type": "assistant",
+    "sessionId": "fe82a754-0606-4bcf-b79a-f7b6f2a72bc8",
+    "message": {
+      "role": "assistant",
+      "model": "claude-opus-4-5-20251101",
+      "content": [
+        {
+          "type": "tool_use",
+          "id": "toolu_abc",
+          "name": "Read",
+          "input": { "file_path": "/src/app.ts" }
+        }
+      ],
+      "stop_reason": "tool_use",
+      "usage": { "input_tokens": 1234, "output_tokens": 567 }
+    }
+  }
+]
diff --git a/tests/fixtures/passthrough/codex.expected.json b/tests/fixtures/passthrough/codex.expected.json
new file mode 100644
index 0000000..140025a
--- /dev/null
+++ b/tests/fixtures/passthrough/codex.expected.json
@@ -0,0 +1,10 @@
+[
+  {
+    "sourcetype": "cribl:demo",
+    "index": "main",
+    "datatype": "cribl-demo",
+    "type": "item.tool.result",
+    "sessionId": "rollout-019ddfce-b73e-7230-ae24-a70b89c76982",
+    "tool": "exec_command"
+  }
+]
diff --git a/tests/fixtures/passthrough/codex.json b/tests/fixtures/passthrough/codex.json
new file mode 100644
index 0000000..f40cacc
--- /dev/null
+++ b/tests/fixtures/passthrough/codex.json
@@ -0,0 +1,12 @@
+[
+  {
+    "datatype": "cribl-demo",
+    "_time": 1736850010,
+    "type": "item.tool.result",
+    "sessionId": "rollout-019ddfce-b73e-7230-ae24-a70b89c76982",
+    "turnId": "turn_001",
+    "tool": "exec_command",
+    "input": { "command": "grep -n 'def' api.py" },
+    "output": "1: def get_user(id):\n5: def handle_error():"
+  }
+]
diff --git a/tests/fixtures/passthrough/gemini.expected.json b/tests/fixtures/passthrough/gemini.expected.json
new file mode 100644
index 0000000..3100cab
--- /dev/null
+++ b/tests/fixtures/passthrough/gemini.expected.json
@@ -0,0 +1,10 @@
+[
+  {
+    "sourcetype": "cribl:demo",
+    "index": "main",
+    "datatype": "cribl-demo",
+    "type": "user",
+    "sessionId": "sess-abc123",
+    "projectHash": "proj-hash-xyz"
+  }
+]
diff --git a/tests/fixtures/passthrough/gemini.json b/tests/fixtures/passthrough/gemini.json
new file mode 100644
index 0000000..a9bfa4d
--- /dev/null
+++ b/tests/fixtures/passthrough/gemini.json
@@ -0,0 +1,12 @@
+[
+  {
+    "datatype": "cribl-demo",
+    "_time": 1736850000,
+    "type": "user",
+    "id": "msg_1",
+    "sessionId": "sess-abc123",
+    "projectHash": "proj-hash-xyz",
+    "model": "gemini-2.0-flash",
+    "content": [{ "text": "Implement auth middleware" }]
+  }
+]
diff --git a/tests/fixtures/passthrough/sample.json b/tests/fixtures/passthrough/sample.json
deleted file mode 100644
index ec57193..0000000
--- a/tests/fixtures/passthrough/sample.json
+++ /dev/null
@@ -1,7 +0,0 @@
-[
-  {
-    "_raw": "demo event",
-    "_time": 1714137600,
-    "datatype": "cribl-demo"
-  }
-]