@ask-llm/plugin 0.17.0 → 0.19.0

package/scripts/codex-pair-debounce-worker.mjs

@@ -1,103 +1,75 @@
 #!/usr/bin/env node
-// Detached edit-debounce worker (design 2026-06-03, closes #96 Bug 2 / Idea 1).
-//
-// Spawned by codex-pair-watch.mjs on each edit when debounceMs > 0. Sleeps the
-// settle window, then — only if no newer edit superseded it (trailing-edge) or
-// the burst exceeded the max cap — re-invokes the hook in FORCED-SYNC mode to
-// run the real review. The forced-sync hook acquires the existing per-file
-// inflight lock itself, so concurrent workers race there and exactly one
-// reviews (the inflight lock IS the claim — the worker holds no lock, which
-// would otherwise deadlock against the hook).
-//
-// The worker has no stdout channel to Claude, so it captures the hook's emitted
-// systemMessage and queues it in the per-file pending store; the next edit hook
-// (or the UserPromptSubmit drain) surfaces it. MUST exit 0 on every path (ADR-077).
-
+// Source of truth: codex-pair-debounce-worker.mts. The sibling .mjs is generated by `yarn workspace @ask-llm/plugin build:hooks`; never edit it.
+// Workers defer edits to the forced-sync hook, which owns the per-file lock; pending verdicts surface on a later hook.
 import { spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import {
-  clearReviewing,
-  decideReview,
-  markReviewed,
-  markReviewing,
-  readEditRecord,
-  writePending,
-} from "./lib/debounce-state.mjs";
-
+import { clearReviewing, decideReview, markReviewed, markReviewing, readEditRecord, writePending, } from "./lib/debounce-state.mjs";
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
 const HOOK_PATH = join(SCRIPT_DIR, "codex-pair-watch.mjs");
-
 function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
+    return new Promise((r) => setTimeout(r, ms));
 }
-
-// The forced-sync hook writes one `{ "continue": true, "systemMessage": "..." }`
-// JSON line to stdout. Pull systemMessage from the last parseable line.
+// Read the last parseable hook output line; earlier stdout may not be JSON.
 function extractSystemMessage(stdout) {
-  if (!stdout) return null;
-  const lines = stdout.split("\n").filter((l) => l.trim().length > 0);
-  for (let i = lines.length - 1; i >= 0; i--) {
-    try {
-      const obj = JSON.parse(lines[i]);
-      if (typeof obj.systemMessage === "string") return obj.systemMessage;
-    } catch {
-      // not JSON — skip
+    if (!stdout)
+        return null;
+    const lines = stdout.split("\n").filter((l) => l.trim().length > 0);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        try {
+            const obj = JSON.parse(lines[i]);
+            if (typeof obj.systemMessage === "string")
+                return obj.systemMessage;
+        }
+        catch {
+            // not JSON — skip
+        }
     }
-  }
-  return null;
+    return null;
 }
-
 async function main() {
-  const markerDir = process.env.CP_MARKER_DIR;
-  const file = process.env.CP_FILE;
-  const tool = process.env.CP_TOOL || "Edit";
-  const myGeneration = Number(process.env.CP_GENERATION);
-  const settleMs = Number(process.env.CP_SETTLE_MS);
-  const rawMaxMs = Number(process.env.CP_MAX_MS);
-  // Guard maxMs like settleMs: a missing/NaN CP_MAX_MS must not silently
-  // disable the anti-starvation cap (every `>= NaN` comparison is false).
-  const maxMs = Number.isFinite(rawMaxMs) && rawMaxMs > 0 ? rawMaxMs : 60_000;
-  if (!markerDir || !file || !Number.isFinite(myGeneration)) process.exit(0);
-
-  await sleep(Number.isFinite(settleMs) ? settleMs : 15_000);
-
-  const record = readEditRecord(markerDir, file);
-  const decision = decideReview({ record, myGeneration, now: Date.now(), maxMs });
-  if (!decision.review) process.exit(0);
-
-  // Hold a `reviewing` marker across the whole handoff: markReviewed consumes
-  // the debounce record BEFORE the forced-sync hook acquires the inflight
-  // lock, and the Stop-gate's in-flight check would otherwise see neither
-  // signal in that gap (dogfood review finding, 2026-07-02). Marker first,
-  // then record advance — no instant where both are absent.
-  markReviewing(markerDir, file);
-  // Advance the burst marker so the next edit starts a fresh burst. The actual
-  // concurrency claim is the inflight lock acquired by the forced-sync hook.
-  markReviewed(markerDir, file, myGeneration);
-
-  const payload = JSON.stringify({
-    hook_event_name: "PostToolUse",
-    tool_name: tool,
-    tool_input: { file_path: file },
-    session_id: process.env.CP_SESSION_ID || "",
-  });
-  const codexTimeout = Number(process.env.ASK_CODEX_TIMEOUT_MS ?? 800_000);
-  let res;
-  try {
-    res = spawnSync(process.execPath, [HOOK_PATH], {
-      input: payload,
-      cwd: markerDir,
-      encoding: "utf-8",
-      env: { ...process.env, CODEX_PAIR_FORCE_SYNC: "1" },
-      timeout: codexTimeout + 60_000,
+    const markerDir = process.env.CP_MARKER_DIR;
+    const file = process.env.CP_FILE;
+    const tool = process.env.CP_TOOL || "Edit";
+    const myGeneration = Number(process.env.CP_GENERATION);
+    const settleMs = Number(process.env.CP_SETTLE_MS);
+    const rawMaxMs = Number(process.env.CP_MAX_MS);
+    // NaN would disable the anti-starvation cap because comparisons always fail.
+    const maxMs = Number.isFinite(rawMaxMs) && rawMaxMs > 0 ? rawMaxMs : 60_000;
+    if (!markerDir || !file || !Number.isFinite(myGeneration))
+        process.exit(0);
+    await sleep(Number.isFinite(settleMs) ? settleMs : 15_000);
+    const record = readEditRecord(markerDir, file);
+    const decision = decideReview({ record, myGeneration, now: Date.now(), maxMs });
+    if (!decision.review)
+        process.exit(0);
+    // Mark reviewing before consuming the debounce record so the Stop-gate always sees in-flight work.
+    markReviewing(markerDir, file);
+    // The forced-sync hook owns the concurrency lock, not this worker.
+    markReviewed(markerDir, file, myGeneration);
+    const payload = JSON.stringify({
+        hook_event_name: "PostToolUse",
+        tool_name: tool,
+        tool_input: { file_path: file },
+        session_id: process.env.CP_SESSION_ID || "",
     });
-  } finally {
-    clearReviewing(markerDir, file);
-  }
-  const message = extractSystemMessage(res.stdout);
-  if (message) writePending(markerDir, file, message);
-  process.exit(0);
+    const codexTimeout = Number(process.env.ASK_CODEX_TIMEOUT_MS ?? 800_000);
+    let res;
+    try {
+        res = spawnSync(process.execPath, [HOOK_PATH], {
+            input: payload,
+            cwd: markerDir,
+            encoding: "utf-8",
+            env: { ...process.env, CODEX_PAIR_FORCE_SYNC: "1" },
+            timeout: codexTimeout + 60_000,
+        });
+    }
+    finally {
+        clearReviewing(markerDir, file);
+    }
+    const message = extractSystemMessage(res?.stdout);
+    if (message)
+        writePending(markerDir, file, message);
+    process.exit(0);
 }
-
 main().catch(() => process.exit(0));

package/scripts/codex-pair-prompt-drain.mjs

@@ -1,81 +1,67 @@
 #!/usr/bin/env node
-// UserPromptSubmit drain hook (design 2026-06-03 + plan red-team 2026-06-04).
-//
-// Surfaces any verdict a debounce worker queued, at the START of the next user
-// turn — closing the gap where a single edit (with no following edit) leaves
-// its review in the log but never in Claude's context. Cheap no-op when nothing
-// is pending. MUST exit 0 on every path (ADR-077).
-//
-// findMarkerUp is duplicated from codex-pair-watch/session.mjs by design:
-// zero-workspace-imports (marketplace git-subdir install has no node_modules)
-// and the helper is too small to extract (15 LOC).
-
+// Source of truth: codex-pair-prompt-drain.mts. The sibling .mjs is generated by `yarn workspace @ask-llm/plugin build:hooks`; never edit it.
+// Drain queued worker verdicts at the next user turn; failures must not block submission.
 import { access } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { drainPending, joinPendingForSurface } from "./lib/debounce-state.mjs";
 import { collectSessionMarkers } from "./lib/session-registry.mjs";
 import { CONTEXT_FILENAME, PAIR_ROOT_DIR } from "./lib/state.mjs";
-
 const MARKER_FILE = join(PAIR_ROOT_DIR, CONTEXT_FILENAME);
-
 async function findMarkerUp(startDir) {
-  const home = homedir();
-  let current = resolve(startDir);
-  for (let depth = 0; depth < 20; depth++) {
-    try {
-      await access(join(current, MARKER_FILE));
-      return current;
-    } catch {
-      // not here
+    const home = homedir();
+    let current = resolve(startDir);
+    for (let depth = 0; depth < 20; depth++) {
+        try {
+            await access(join(current, MARKER_FILE));
+            return current;
+        }
+        catch {
+            // not here
+        }
+        const parent = dirname(current);
+        if (parent === current || current === home)
+            return null;
+        current = parent;
     }
-    const parent = dirname(current);
-    if (parent === current || current === home) return null;
-    current = parent;
-  }
-  return null;
+    return null;
 }
-
 async function readStdin() {
-  return new Promise((r) => {
-    let data = "";
-    process.stdin.on("data", (c) => {
-      data += c.toString();
+    return new Promise((r) => {
+        let data = "";
+        process.stdin.on("data", (c) => {
+            data += c.toString();
+        });
+        process.stdin.on("end", () => r(data));
+        process.stdin.on("error", () => r(""));
     });
-    process.stdin.on("end", () => r(data));
-    process.stdin.on("error", () => r(""));
-  });
 }
-
 async function main() {
-  const raw = await readStdin();
-  let payload;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    process.exit(0);
-  }
-  if (payload?.hook_event_name !== "UserPromptSubmit") process.exit(0);
-
-  // ADR-131 (#209): drain EVERY repo active this session, not just cwd's. The
-  // watch hook registers each edited repo under session_id; union it with the
-  // cwd marker so single-repo behavior is unchanged when no session_id is present.
-  const cwdMarker = await findMarkerUp(process.cwd());
-  const markers = collectSessionMarkers(cwdMarker, payload?.session_id);
-  if (markers.length === 0) process.exit(0);
-
-  const messages = markers.flatMap((m) => drainPending(m));
-  if (messages.length === 0) process.exit(0);
-
-  // UserPromptSubmit context-injection contract: additionalContext is added to
-  // the model's context for the upcoming turn.
-  const out = JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: "UserPromptSubmit",
-      additionalContext: joinPendingForSurface(messages),
-    },
-  });
-  process.stdout.write(`${out}\n`, () => process.exit(0));
+    const raw = await readStdin();
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch {
+        process.exit(0);
+    }
+    if (payload?.hook_event_name !== "UserPromptSubmit")
+        process.exit(0);
+    // Include registered sibling repositories, not only cwd.
+    const cwdMarker = await findMarkerUp(process.cwd());
+    const markers = collectSessionMarkers(cwdMarker, payload?.session_id);
+    if (markers.length === 0)
+        process.exit(0);
+    const messages = markers.flatMap((m) => drainPending(m));
+    if (messages.length === 0)
+        process.exit(0);
+    // additionalContext reaches the model on the next user turn.
+    const out = JSON.stringify({
+        hookSpecificOutput: {
+            hookEventName: "UserPromptSubmit",
+            additionalContext: joinPendingForSurface(messages),
+        },
+    });
+    process.stdout.write(`${out}\n`, () => process.exit(0));
 }
-
 main().catch(() => process.exit(0));

package/scripts/codex-pair-session.mjs

@@ -1,194 +1,155 @@
 #!/usr/bin/env node
-// SessionStart / SessionEnd hook for the codex-pair app-server broker
-// (ADR-090, milestones implemented per ADR-093). SessionStart spawns
-// the broker + handshake + descriptor write (Milestone 2 PR 2);
-// SessionEnd teardown remains TODO (Milestone 2 PR 3).
-//
-// The hook MUST exit 0 on every path. A broker spawn failure is logged
-// silently to broker.log but doesn't break the session — the per-edit
-// path keeps working via per-edit codex spawns (ADR-077).
-
+// Source of truth: codex-pair-session.mts. The sibling .mjs is generated by `yarn workspace @ask-llm/plugin build:hooks`; never edit it.
+// Session lifecycle hook. Broker failures must not break per-edit reviews.
 import { access } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { bootstrapBroker, clearStaleBrokerState, teardownBroker } from "./lib/broker-lifecycle.mjs";
+import { resolveBrokerPreference } from "./lib/broker.mjs";
+import { bootstrapBroker, teardownBroker } from "./lib/broker-lifecycle.mjs";
 import { clearAllDebounceState } from "./lib/debounce-state.mjs";
 import { clearSession } from "./lib/session-registry.mjs";
-import {
-  appendLog,
-  CONTEXT_FILENAME,
-  clearAutoPause,
-  PAIR_ROOT_DIR,
-  readPauseInfo,
-  readPluginVersion,
-  resolveAutoResume,
-} from "./lib/state.mjs";
-
+import { appendLog, CONTEXT_FILENAME, clearAutoPause, PAIR_ROOT_DIR, readPauseInfo, readPluginVersion, resolveAutoResume, } from "./lib/state.mjs";
 const MARKER_FILE = join(PAIR_ROOT_DIR, CONTEXT_FILENAME);
-
-// Walk up from startDir looking for `.codex-pair/context.md`. Returns
-// the marker directory (the directory CONTAINING `.codex-pair/`) or
-// null. Mirrors codex-pair-watch.mjs and codex-pair-log.mjs — duplicated
-// because zero-workspace-imports + the helper is too small to extract
-// (15 LOC × 3 callers).
+// Keep marker discovery local so marketplace installs need no workspace dependencies.
 async function findMarkerUp(startDir) {
-  const home = homedir();
-  let current = resolve(startDir);
-  for (let depth = 0; depth < 20; depth++) {
-    const candidate = join(current, MARKER_FILE);
-    try {
-      await access(candidate);
-      return current;
-    } catch {
-      // not found here
+    const home = homedir();
+    let current = resolve(startDir);
+    for (let depth = 0; depth < 20; depth++) {
+        const candidate = join(current, MARKER_FILE);
+        try {
+            await access(candidate);
+            return current;
+        }
+        catch {
+            // not found here
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return null;
+        if (current === home)
+            return null;
+        current = parent;
     }
-    const parent = dirname(current);
-    if (parent === current) return null;
-    if (current === home) return null;
-    current = parent;
-  }
-  return null;
+    return null;
 }
-
 async function readStdin() {
-  return new Promise((resolve) => {
-    let data = "";
-    process.stdin.on("data", (c) => {
-      data += c.toString();
+    return new Promise((resolve) => {
+        let data = "";
+        process.stdin.on("data", (c) => {
+            data += c.toString();
+        });
+        process.stdin.on("end", () => resolve(data));
+        process.stdin.on("error", () => resolve(""));
     });
-    process.stdin.on("end", () => resolve(data));
-    process.stdin.on("error", () => resolve(""));
-  });
 }
-
-async function handleSessionStart() {
-  const cwd = process.cwd();
-  const markerDir = await findMarkerUp(cwd);
-  if (!markerDir) return; // no opt-in marker, nothing to do
-  // Recover from a prior-session crash before launching fresh.
-  // clearStaleBrokerState returns "live" if a still-usable broker
-  // exists — in that case we skip spawning a new one. "absent" or
-  // "stale" both result in a clean slate; bootstrapBroker handles
-  // the spawn + handshake from there.
-  const state = clearStaleBrokerState(markerDir);
-  if (state === "live") return;
-  await bootstrapBroker(markerDir);
+async function handleSessionStart(sessionId) {
+    const cwd = process.cwd();
+    const markerDir = await findMarkerUp(cwd);
+    if (!markerDir)
+        return; // no opt-in marker, nothing to do
+    if (typeof sessionId !== "string" || !sessionId)
+        return;
+    await bootstrapBroker(markerDir, { sessionId });
 }
-
-async function handleSessionEnd() {
-  const cwd = process.cwd();
-  const markerDir = await findMarkerUp(cwd);
-  if (!markerDir) return;
-  // teardownBroker reads the descriptor, SIGTERMs the pid with a grace
-  // window, escalates to SIGKILL via terminateProcessTree if needed,
-  // unlinks the descriptor + socket + lock. Returns the descriptor
-  // that was torn down (or null if none existed) — we ignore it; the
-  // hook just needs to exit 0 either way per ADR-077.
-  await teardownBroker(markerDir);
+async function handleSessionEnd(sessionId) {
+    const cwd = process.cwd();
+    const markerDir = await findMarkerUp(cwd);
+    if (!markerDir)
+        return;
+    // SessionEnd teardown is best-effort; broker failure must not block the session.
+    await teardownBroker(markerDir, { sessionId: typeof sessionId === "string" ? sessionId : undefined });
 }
-
 async function main() {
-  const raw = await readStdin();
-  let payload;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    process.exit(0);
-  }
-
-  const event = payload?.hook_event_name;
-  if (event !== "SessionStart" && event !== "SessionEnd") {
-    process.exit(0);
-  }
-
-  // SessionStart pause visibility (2026-07-02 seamless-pairing design; un-gated
-  // by the broker flag). An auto-pause used to be notify-ONCE and manual-resume-
-  // only — miss that single message and pairing is silently dead forever (the
-  // dogfood repo spent 18 days that way). Now: an expired auto-pause self-heals
-  // right here; a still-active pause gets a reminder the model actually sees
-  // (SessionStart supports additionalContext; it does NOT support systemMessage).
-  if (event === "SessionStart") {
+    const raw = await readStdin();
+    let payload;
     try {
-      const markerDir = await findMarkerUp(process.cwd());
-      const pauseInfo = markerDir ? readPauseInfo(markerDir) : null;
-      if (pauseInfo) {
-        const decision = resolveAutoResume(pauseInfo, {
-          now: Date.now(),
-          currentVersion: readPluginVersion(),
-        });
-        let context = null;
-        // clearAutoPause aborts (false) when the sentinel changed since we
-        // read it — either a concurrent SessionStart already resumed (sentinel
-        // gone → say nothing; reviews are live) or a new pause raced in
-        // (render the reminder from CURRENT state, not the stale pauseInfo).
-        if (decision.resume && clearAutoPause(markerDir, pauseInfo)) {
-          await appendLog(markerDir, {
-            timestamp: new Date().toISOString(),
-            verdict: "auto_resumed",
-            reason: `${decision.why} (paused ${pauseInfo.at ?? "unknown"}, kind: ${pauseInfo.kind})`,
-          });
-          context = `codex-pair auto-resumed (${decision.why}): was ${pauseInfo.kind}-paused since ${pauseInfo.at ?? "unknown"}. Reviews are live again.`;
-        } else {
-          const current = decision.resume ? readPauseInfo(markerDir) : pauseInfo;
-          if (current) {
-            const since = current.manual ? "" : ` since ${current.at}`;
-            const kind = current.manual ? "manually" : `auto (${current.kind})`;
-            const reason = current.manual ? "" : ` Reason: ${current.reason}.`;
-            context = `codex-pair is paused — ${kind}${since}.${reason} Edits are NOT being reviewed. Resume with /codex-pair-resume.`;
-          }
+        payload = JSON.parse(raw);
+    }
+    catch {
+        process.exit(0);
+    }
+    const event = payload?.hook_event_name;
+    if (event !== "SessionStart" && event !== "SessionEnd") {
+        process.exit(0);
+    }
+    // SessionStart reminds the model of active pauses via additionalContext and resumes expired ones.
+    if (event === "SessionStart") {
+        try {
+            const markerDir = await findMarkerUp(process.cwd());
+            const pauseInfo = markerDir ? readPauseInfo(markerDir) : null;
+            if (markerDir && pauseInfo) {
+                const decision = resolveAutoResume(pauseInfo, {
+                    now: Date.now(),
+                    currentVersion: readPluginVersion(),
+                });
+                let context = null;
+                // A changed pause sentinel requires rereading current state before notifying.
+                if (decision.resume && clearAutoPause(markerDir, pauseInfo)) {
+                    await appendLog(markerDir, {
+                        timestamp: new Date().toISOString(),
+                        verdict: "auto_resumed",
+                        reason: `${decision.why} (paused ${pauseInfo.at ?? "unknown"}, kind: ${pauseInfo.kind})`,
+                    });
+                    context = `codex-pair auto-resumed (${decision.why}): was ${pauseInfo.kind}-paused since ${pauseInfo.at ?? "unknown"}. Reviews are live again.`;
+                }
+                else {
+                    const current = decision.resume ? readPauseInfo(markerDir) : pauseInfo;
+                    if (current) {
+                        const since = current.manual ? "" : ` since ${current.at}`;
+                        const kind = current.manual ? "manually" : `auto (${current.kind})`;
+                        const reason = current.manual ? "" : ` Reason: ${current.reason}.`;
+                        context = `codex-pair is paused — ${kind}${since}.${reason} Edits are NOT being reviewed. Resume with /codex-pair-resume.`;
+                    }
+                }
+                if (context) {
+                    await new Promise((resolveWrite) => {
+                        const out = JSON.stringify({
+                            hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: context },
+                        });
+                        process.stdout.write(`${out}\n`, () => resolveWrite());
+                    });
+                }
+            }
         }
-        if (context) {
-          await new Promise((resolveWrite) => {
-            const out = JSON.stringify({
-              hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: context },
-            });
-            process.stdout.write(`${out}\n`, () => resolveWrite());
-          });
+        catch {
+            // best-effort (ADR-077) — pause visibility must never break the session
         }
-      }
-    } catch {
-      // best-effort (ADR-077) — pause visibility must never break the session
     }
-  }
-
-  // Edit-debounce cleanup runs on SessionEnd only (un-gated by the broker flag,
-  // since debounce is not broker-gated): a sleeping worker wakes to a missing
-  // record and self-cancels. NOT on SessionStart — that would wipe a verdict
-  // queued just before a new session begins; crash-orphaned state is reclaimed
-  // by the TTL sweep (sweepStaleDebounce) instead.
-  if (event === "SessionEnd") {
-    const dbMarkerDir = await findMarkerUp(process.cwd());
-    if (dbMarkerDir) {
-      try {
-        clearAllDebounceState(dbMarkerDir);
-      } catch {
-        // best-effort (ADR-077)
-      }
+    // Clear debounce state only on SessionEnd; SessionStart could erase a queued verdict.
+    if (event === "SessionEnd") {
+        const dbMarkerDir = await findMarkerUp(process.cwd());
+        if (dbMarkerDir) {
+            try {
+                clearAllDebounceState(dbMarkerDir);
+            }
+            catch {
+                // best-effort (ADR-077)
+            }
+        }
+        // Clear the registry by session ID so cwd does not affect cleanup.
+        try {
+            clearSession(payload?.session_id);
+        }
+        catch {
+            // best-effort (ADR-077)
+        }
     }
-    // ADR-131 (#209): drop this session's cross-repo marker registry. Keyed by
-    // session_id, not cwd — so it cleans up regardless of which repo cwd is.
+    const brokerMarkerDir = await findMarkerUp(process.cwd());
+    if (!brokerMarkerDir)
+        process.exit(0);
     try {
-      clearSession(payload?.session_id);
-    } catch {
-      // best-effort (ADR-077)
+        if (event === "SessionStart") {
+            if (resolveBrokerPreference(brokerMarkerDir))
+                await handleSessionStart(payload?.session_id);
+            else
+                await teardownBroker(brokerMarkerDir, { onlyIfCredentialMissing: true });
+        }
+        else if (event === "SessionEnd")
+            await handleSessionEnd(payload?.session_id);
+    }
+    catch {
+        // Bootstrap failure must not break the session.
     }
-  }
-
-  // Broker is disabled until ASK_CODEX_BROKER=1. Production behavior
-  // unchanged: SessionStart/SessionEnd are silent no-ops.
-  if (process.env.ASK_CODEX_BROKER !== "1") {
     process.exit(0);
-  }
-
-  try {
-    if (event === "SessionStart") await handleSessionStart();
-    else if (event === "SessionEnd") await handleSessionEnd();
-  } catch {
-    // ADR-077 silent-on-error: a failed bootstrap MUST NOT break the
-    // session. bootstrapBroker already catches internally, but defense
-    // in depth.
-  }
-  process.exit(0);
 }
-
 main().catch(() => process.exit(0));