@lyupro/codex-bridge 0.6.5 → 0.6.7

package/src/home/lib/dispatcher-order.mjs

@@ -1,25 +1,47 @@
 /** Reads and compares the order identity carried between dispatcher hook boundaries. */
 import fs from 'node:fs';
+import path from 'node:path';
 import { parseJsonText } from './json-file.mjs';
 import { extractValue } from './required-inputs.mjs';
 
-/** The transcript is diagnostic evidence; malformed or unavailable evidence must fail open. */
-export function transcriptOrderId(transcriptPath) {
+/** Implements Plan_62 D7: keeps untrusted ids from redirecting the host-owned subagent transcript path. */
+export function ownTranscriptPath(payload) {
+  if (!payload || typeof payload !== 'object') return null;
+  const { transcript_path, session_id, agent_id } = payload;
+  const nonEmpty = (value) => typeof value === 'string' && value.trim().length > 0;
+  const unsafeSegment = (value) => value.includes('/') || value.includes('\\') || value.includes('..');
+  if (!nonEmpty(transcript_path) || !nonEmpty(session_id) || !nonEmpty(agent_id)) return null;
+  if (unsafeSegment(session_id) || unsafeSegment(agent_id)) return null;
+  return path.join(path.dirname(transcript_path), session_id, 'subagents', `agent-${agent_id}.jsonl`);
+}
+
+function firstEntry(transcriptPath) {
   try {
-    const firstEntry = fs.readFileSync(transcriptPath, 'utf8').split(/\r?\n/, 1)[0];
-    const transcriptEntry = parseJsonText(transcriptPath, firstEntry);
-    const content = transcriptEntry?.message?.content;
-    const promptText = typeof content === 'string'
+    const line = fs.readFileSync(transcriptPath, 'utf8').split(/\r?\n/, 1)[0];
+    const entry = parseJsonText(transcriptPath, line);
+    const content = entry?.message?.content;
+    const text = typeof content === 'string'
       ? content
       : Array.isArray(content)
         ? content.filter((part) => part?.type === 'text').map((part) => part.text).join('\n')
         : '';
-    return String(extractValue(promptText, 'order id') || '').trim();
+    return { type: entry?.type, text };
   } catch {
-    return '';
+    return null;
   }
 }
 
+/** Reads the first user message; missing or malformed host transcript evidence fails closed. */
+export function transcriptPrompt(transcriptPath) {
+  const entry = firstEntry(transcriptPath);
+  return entry?.type === 'user' ? entry.text : null;
+}
+
+/** The reply guard's transcript is diagnostic evidence, so it keeps the fail-open, type-agnostic read. */
+export function transcriptOrderId(transcriptPath) {
+  return String(extractValue(firstEntry(transcriptPath)?.text ?? '', 'order id') || '').trim();
+}
+
 /** On 2026-08-15 another order's saved reply was returned as the current run's verdict. */
 export function runOrderMismatch(orderedOrderId, runStatus, runDir) {
   const ordered = String(orderedOrderId ?? '').trim();

package/src/home/lib/dispatcher-state.mjs

@@ -0,0 +1,111 @@
+/** Keeps dispatcher handback evidence under the package state home without trusting hook ids as paths. */
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { writeJsonAtomic } from './atomic-json.mjs';
+import { parseJsonText } from './json-file.mjs';
+import { withFileLock } from './file-lock.mjs';
+
+function assertIdentity(sessionId, agentId) {
+  if (typeof sessionId !== 'string' || sessionId.length === 0
+    || typeof agentId !== 'string' || agentId.length === 0) {
+    throw new TypeError('sessionId and agentId must be non-empty strings');
+  }
+}
+
+export function dispatcherStatePath({ stateDir, sessionId, agentId }) {
+  assertIdentity(sessionId, agentId);
+  const digest = createHash('sha256').update(`${sessionId}\n${agentId}`).digest('hex').slice(0, 32);
+  return path.join(stateDir, 'dispatchers', `${digest}.json`);
+}
+
+export function readDispatcherState(ids) {
+  const file = dispatcherStatePath(ids);
+  let source;
+  try {
+    source = fs.readFileSync(file, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+
+  let record;
+  try {
+    record = parseJsonText(file, source);
+  } catch {
+    return { corrupt: true };
+  }
+  if (!record || typeof record !== 'object' || Array.isArray(record)
+    || record.sessionId !== ids.sessionId || record.agentId !== ids.agentId) {
+    return { corrupt: true };
+  }
+  return record;
+}
+
+function timestamp(value) {
+  return new Date(value).toISOString();
+}
+
+function clockValue(ids) {
+  return typeof ids.now === 'function' ? ids.now() : (ids.now ?? Date.now());
+}
+
+
+export async function updateDispatcherState(ids, mutate) {
+  if (typeof mutate !== 'function') throw new TypeError('mutate must be a function');
+  const file = dispatcherStatePath(ids);
+  const { sessionId, agentId } = ids;
+  return withFileLock(`${file}.lock`, async () => {
+    let current = readDispatcherState(ids);
+    if (current === null) {
+      current = { sessionId, agentId, createdAt: timestamp(clockValue(ids)) };
+    }
+    const result = await mutate(current);
+    const candidate = result === undefined ? current : result;
+    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+      throw new TypeError('mutate must produce a JSON record object');
+    }
+    const record = {
+      ...candidate,
+      sessionId,
+      agentId,
+      updatedAt: timestamp(clockValue(ids)),
+    };
+    writeJsonAtomic(file, record);
+    return record;
+  }, { description: 'dispatcher state' });
+}
+
+export function pruneDispatcherStates({ stateDir, olderThanMs = 7 * 24 * 3600 * 1000, now = Date.now() }) {
+  const directory = path.join(stateDir, 'dispatchers');
+  let entries;
+  try {
+    entries = fs.readdirSync(directory, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === 'ENOENT') return 0;
+    throw error;
+  }
+
+  const cutoff = now - olderThanMs;
+  let removed = 0;
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith('.json')) continue;
+    const file = path.join(directory, entry.name);
+    let old;
+    try {
+      old = fs.statSync(file).mtimeMs < cutoff;
+    } catch (error) {
+      if (error.code === 'ENOENT') continue;
+      throw error;
+    }
+    if (!old) continue;
+    try {
+      fs.unlinkSync(file);
+      removed += 1;
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+    fs.rmSync(`${file}.lock`, { force: true });
+  }
+  return removed;
+}

package/src/home/lib/dispatcher-stop.mjs

@@ -0,0 +1,52 @@
+/** Audits dispatcher tool calls because SubagentHandback delivers the answer before SubagentStop can block it. */
+import fs from 'node:fs';
+import { parseJsonText } from './json-file.mjs';
+import { HANDBACK_TOOL } from './hook-definitions.mjs';
+
+export function transcriptToolUses(transcriptPath) {
+  let source;
+  try {
+    source = fs.readFileSync(transcriptPath, 'utf8');
+  } catch {
+    return null;
+  }
+
+  const toolUses = [];
+  for (const line of source.split(/\r?\n/)) {
+    let record;
+    try {
+      record = parseJsonText(transcriptPath, line);
+    } catch {
+      continue;
+    }
+    if (record?.type !== 'assistant' && record?.message?.role !== 'assistant') continue;
+    const content = record.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      if (block?.type === 'tool_use') toolUses.push({ id: block.id, name: block.name });
+    }
+  }
+  return toolUses;
+}
+
+export function decideDispatcherStop({ state, toolUses }) {
+  const seenToolUseIds = !state?.corrupt && Array.isArray(state?.seenToolUseIds)
+    ? state.seenToolUseIds
+    : [];
+  const unseen = toolUses === null || (!state?.corrupt && state?.auditAlarmed)
+    ? []
+    : toolUses.filter((toolUse) => !seenToolUseIds.includes(toolUse.id));
+  const handbackAttempted = (state?.handbackAttempts ?? 0) >= 1
+    || toolUses?.some((toolUse) => toolUse.name === HANDBACK_TOOL) === true;
+
+  let route;
+  if (state?.handback === 'delivered') route = 'yield';
+  else if (handbackAttempted && state?.stopDemanded !== true) route = 'demand';
+  else if (handbackAttempted) route = 'yield';
+  else route = 'legacy';
+
+  const stateUpdate = {};
+  if (route === 'demand') stateUpdate.stopDemanded = true;
+  if (unseen.length) stateUpdate.auditAlarmed = true;
+  return { route, unseen, stateUpdate: Object.keys(stateUpdate).length ? stateUpdate : null };
+}

package/src/home/lib/handback-witness.mjs

@@ -0,0 +1,65 @@
+/** Records the 2026-09-17..24 silent SubagentHandback contract break before it can go unnoticed again. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { writeJsonAtomic } from './atomic-json.mjs';
+import { parseJsonText } from './json-file.mjs';
+import { withFileLock } from './file-lock.mjs';
+
+export const WITNESS_FILE = 'handback-witness.json';
+
+export function hostSdkVersion(env = process.env) {
+  const version = env.CLAUDE_AGENT_SDK_VERSION;
+  if (typeof version !== 'string') return null;
+  return version.trim() || null;
+}
+
+function isWitness(record) {
+  const witnessEntry = (entry, alarm = false) => entry && typeof entry === 'object'
+    && !Array.isArray(entry)
+    && (entry.sdkVersion === null || typeof entry.sdkVersion === 'string')
+    && typeof entry.at === 'string'
+    && (!alarm || typeof entry.detail === 'string');
+  return record && typeof record === 'object' && !Array.isArray(record)
+    && (record.lastSeen === null || witnessEntry(record.lastSeen))
+    && Array.isArray(record.alarms) && record.alarms.every((entry) => witnessEntry(entry, true));
+}
+
+export function readHandbackWitness({ stateDir }) {
+  const file = path.join(stateDir, WITNESS_FILE);
+  let source;
+  try {
+    source = fs.readFileSync(file, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return { lastSeen: null, alarms: [] };
+    return { corrupt: true };
+  }
+  try {
+    const record = parseJsonText(file, source);
+    return isWitness(record) ? record : { corrupt: true };
+  } catch {
+    return { corrupt: true };
+  }
+}
+
+function timestamp(now) {
+  return new Date(now).toISOString();
+}
+
+
+export async function recordHandbackWitness({ stateDir, kind, sdkVersion, detail = '', now = new Date() }) {
+  if (kind !== 'seen' && kind !== 'alarm') throw new TypeError("kind must be 'seen' or 'alarm'");
+  if (sdkVersion !== null && typeof sdkVersion !== 'string') {
+    throw new TypeError('sdkVersion must be a string or null');
+  }
+  const file = path.join(stateDir, WITNESS_FILE);
+  return withFileLock(`${file}.lock`, async () => {
+    const current = readHandbackWitness({ stateDir });
+    if (current.corrupt) throw new Error(`Cannot update corrupt handback witness: ${file}`);
+    const at = timestamp(now);
+    const record = kind === 'seen'
+      ? { ...current, lastSeen: { sdkVersion, at } }
+      : { ...current, alarms: [...current.alarms, { sdkVersion, at, detail }].slice(-20) };
+    writeJsonAtomic(file, record);
+    return record;
+  }, { description: 'handback witness' });
+}

package/src/home/lib/hook-definitions.mjs

@@ -39,6 +39,13 @@ export const SHELL_TOOLS = Object.freeze(['Bash', 'PowerShell']);
 /** A PreToolUse matcher is a regular expression over tool names, so alternation covers both. */
 export const SHELL_TOOL_MATCHER = SHELL_TOOLS.join('|');
 
+// Probed live on 2026-09-24; this is the one place the host handback tool name is spelled.
+export const HANDBACK_TOOL = 'SubagentHandback';
+
+// Plan_62 D15: a dispatcher has only its shell whitelist and handback tool; `*` would tax every session.
+export const DISPATCHER_TOOLS = Object.freeze([...SHELL_TOOLS, HANDBACK_TOOL]);
+export const DISPATCHER_TOOL_MATCHER = DISPATCHER_TOOLS.join('|');
+
 // Plan_31 routes host stop requests through the package guard; keep the matcher derived from
 // the tool list so registration and uninstall cannot drift from the host event spelling.
 export const STOP_TOOLS = Object.freeze(['TaskStop']);
@@ -66,4 +73,7 @@ export const HOOK_DEFINITIONS = Object.freeze([
   Object.freeze({ name: 'prune-guard', event: 'PreToolUse', matcher: SHELL_TOOL_MATCHER, file: 'prune-guard.mjs' }),
   Object.freeze({ name: 'worktree-witness', event: 'PostToolUse', matcher: SHELL_TOOL_MATCHER, file: 'worktree-witness.mjs' }),
   Object.freeze({ name: 'stop-guard', event: 'PreToolUse', matcher: STOP_TOOL_MATCHER, file: 'stop-guard.mjs' }),
+  Object.freeze({ name: 'dispatcher-gate', event: 'PreToolUse', matcher: DISPATCHER_TOOL_MATCHER, file: 'dispatcher-gate.mjs' }),
+  Object.freeze({ name: 'dispatcher-capture', event: 'PostToolUse', matcher: SHELL_TOOL_MATCHER, file: 'dispatcher-gate.mjs' }),
+  Object.freeze({ name: 'dispatcher-capture-failure', event: 'PostToolUseFailure', matcher: SHELL_TOOL_MATCHER, file: 'dispatcher-gate.mjs' }),
 ]);

package/src/home/lib/hook-entry.mjs

@@ -0,0 +1,20 @@
+/** Runs the installed home copy so the registering package cannot drift from its live guards. */
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { HOOK_DEFINITIONS } from './hook-definitions.mjs';
+
+export async function runHook(name, io = console) {
+  const definition = HOOK_DEFINITIONS.find(({ name: candidate }) => candidate === name);
+  try {
+    if (!definition) throw new Error(`unknown hook name "${name}"`);
+    // Plan_25 replaces absolute paths in foreign settings.json with this command. Importing the
+    // proven top-level script keeps its stdin reader and process.exit() contract intact; exporting
+    // guard functions would be a second implementation of the live hook boundary.
+    const hooksDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'hooks');
+    await import(pathToFileURL(path.join(hooksDir, definition.file)).href);
+    return typeof process.exitCode === 'number' ? process.exitCode : 0;
+  } catch (error) {
+    io.error(`codex-bridge hook: guard "${name}" did not run: ${error?.message ?? String(error)}. Run codex-bridge doctor.`);
+    return 1;
+  }
+}

package/src/home/lib/meta/advice-status.mjs

@@ -32,14 +32,10 @@ export function adviceGap(runDir, result, eventData) {
 
   let scopeResult;
   if (phase === 'advise') {
-    if (typeof status.continued_from !== 'string' || !status.continued_from) {
-      reasons.push('status.json#continued_from for the phase-1 result is missing');
+    if (!task?.scope || !Array.isArray(task.scope.predicted_risks)) {
+      reasons.push('advisor-task.json#scope is missing the phase-1 predicted_risks');
     } else {
-      const scopeFile = path.join(path.dirname(runDir), status.continued_from, 'result.json');
-      scopeResult = readJson(scopeFile);
-      if (!scopeResult || typeof scopeResult !== 'object' || !Array.isArray(scopeResult.predicted_risks)) {
-        reasons.push('phase-1 result.json or its predicted_risks is missing');
-      }
+      scopeResult = { predicted_risks: task.scope.predicted_risks, missing_paths: task.scope.missing_paths };
     }
   }
   if (reasons.length) return contractReason(reasons);

package/src/home/lib/meta/advice-verdict.mjs

@@ -76,10 +76,9 @@ function* addressesIn(value, root) {
   }
 }
 
-function citationProblem(raw, root, allowed) {
-  const match = raw.match(/^(.+):(\d+)(?:-(\d+))?$/);
-  if (!match) return 'use a repository-relative path:line or path:line-line address';
-  const entry = entryInRepo(root, match[1]);
+function citationProblem(file, start, end, root, allowed) {
+  if (typeof file !== 'string' || !file) return 'use a repository-relative path:line or path:line-line address';
+  const entry = entryInRepo(root, file);
   if (!entry?.isFile) return 'cite an existing file under repoRoot';
   let count;
   try {
@@ -87,8 +86,6 @@ function citationProblem(raw, root, allowed) {
   } catch {
     return 'cite a readable file under repoRoot';
   }
-  const start = Number(match[2]);
-  const end = match[3] === undefined ? start : Number(match[3]);
   if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 1 || end < start || end > count) {
     return `use an ascending line range within this file's ${count} lines`;
   }
@@ -103,40 +100,59 @@ function checkCitations({ phase, result, task, repoRoot, scopeResult }, reasons)
   const root = path.resolve(repoRoot);
   const allowed = [...task.paths, ...(phase === 'scope' ? result.missing_paths : scopeResult?.missing_paths ?? [])]
     .map((raw) => entryInRepo(root, raw)).filter(Boolean);
-  const check = (field, address) => {
-    const problem = citationProblem(address, root, allowed);
-    if (problem) reasons.push(`D3 ${field} ${JSON.stringify(address)}: ${problem}.`);
+  const locationLabel = ({ file, line_start, line_end }) =>
+    `${file}:${line_start}${line_end === line_start ? '' : `-${line_end}`}`;
+  const checkLocation = (field, location) => {
+    const { file, line_start: start, line_end: end } = location;
+    const label = locationLabel(location);
+    const problem = citationProblem(file, start, end, root, allowed);
+    if (problem) reasons.push(`D3 ${field} ${JSON.stringify(label)}: ${problem}.`);
   };
   const checkAddress = (field, raw) => {
-    const trimmed = raw.trim();
-    check(field, /^`.*`$/.test(trimmed) ? trimmed.slice(1, -1) : trimmed);
+    const match = raw.match(/^(.+):(\d+)(?:-(\d+))?$/);
+    if (!match) {
+      reasons.push(`D3 ${field} ${JSON.stringify(raw)}: use a repository-relative path:line or path:line-line address.`);
+      return;
+    }
+    const start = Number(match[2]);
+    checkLocation(field, {
+      file: match[1],
+      line_start: start,
+      line_end: match[3] === undefined ? start : Number(match[3]),
+    });
   };
   // D3 covers every address anywhere in the answer. A list of prose fields had to be edited by
   // hand when `falsifier` became `pre_mortem`, and each new field would have joined it unchecked.
-  // Fields that ARE an address are checked whole below, so they are skipped here.
+  // Structured evidence and the free-text early_check.target are handled separately below.
   for (const { field, value } of strings(result)) {
-    if (/\.address$|\.early_check\.target$/.test(field)) continue;
-    for (const address of addressesIn(value, root)) check(field, address);
+    if (/(?:^|\.)evidence(?:\[|\.|$)|\.early_check\.target$/.test(field)) continue;
+    for (const address of addressesIn(value, root)) checkAddress(field, address);
   }
+  const checkEvidence = (field, evidence) => {
+    for (const [index, location] of evidence.entries()) checkLocation(`${field}[${index}]`, location);
+  };
   if (result.independent_checks) {
     for (const [index, item] of result.independent_checks.entries()) {
-      checkAddress(`independent_checks[${index}].address`, item.address);
+      checkEvidence(`independent_checks[${index}].evidence`, item.evidence);
     }
   }
   if (phase === 'advise') {
     for (const [index, item] of result.assumptions.entries()) {
-      if (item.rating === 'VERIFIED' || item.address !== '') {
-        checkAddress(`assumptions[${index}].address`, item.address);
+      if (item.rating === 'VERIFIED' && item.evidence.length === 0) {
+        reasons.push(`D10 assumptions[${index}].evidence []: a VERIFIED assumption needs at least one location.`);
       }
+      checkEvidence(`assumptions[${index}].evidence`, item.evidence);
     }
     for (const [index, item] of result.pre_mortem.entries()) {
-      if (item.early_check.kind === 'inspect') {
-        checkAddress(`pre_mortem[${index}].early_check.target`, item.early_check.target);
+      const { early_check: earlyCheck } = item;
+      if (earlyCheck.kind === 'inspect' && earlyCheck.evidence.length === 0) {
+        reasons.push(`D10 pre_mortem[${index}].early_check.evidence []: an inspect check needs at least one location.`);
       }
+      checkEvidence(`pre_mortem[${index}].early_check.evidence`, earlyCheck.evidence);
     }
-    // An outcome's address is evidence whether or not the phase-1 answer is at hand.
+    // A risk outcome's locations are evidence whether or not the phase-1 answer is at hand.
     for (const [index, item] of result.risk_outcomes.entries()) {
-      checkAddress(`risk_outcomes[${index}].address`, item.address);
+      checkEvidence(`risk_outcomes[${index}].evidence`, item.evidence);
     }
   }
 }

package/src/home/lib/required-inputs.mjs

@@ -119,7 +119,7 @@ export function isPlaceholder(value) {
 }
 
 // Plan_59: scope is a real phase value, while it remains a placeholder for existing inputs.
-const isInputPlaceholder = (value, label) =>
+export const isInputPlaceholder = (value, label) =>
   !(label === 'phase' && cleanValue(value) === 'scope') && isPlaceholder(value);
 
 export function extractValue(promptText, label) {

package/src/home/lib/runner/advise-carry.mjs

@@ -0,0 +1,50 @@
+/** Owns the scope snapshot shared by advise readers because run 2026-09-23_141341_plan59-a1-stdin-hang left them with different inputs. */
+import path from 'node:path';
+import { readJsonFileSync } from '../json-file.mjs';
+import { parseAdvisorTask } from '../meta/advisor-task.mjs';
+import { die } from './args.mjs';
+
+export function advisorTaskArtifact({ taskText, phase, runsRoot, grantRun }) {
+  const task = parseAdvisorTask(taskText);
+  if (phase !== 'advise') return task;
+  if (typeof runsRoot !== 'string' || !runsRoot || typeof grantRun !== 'string' || !grantRun) {
+    throw new Error('Cannot carry advise scope result: runsRoot and grantRun are required.');
+  }
+  const scopeFile = path.join(runsRoot, grantRun, 'result.json');
+  let result;
+  try {
+    result = readJsonFileSync(scopeFile);
+  } catch (error) {
+    throw new Error(`Cannot read advise scope result at ${scopeFile}: ${error.message}`);
+  }
+  if (!result || typeof result !== 'object' || Array.isArray(result) ||
+      !Array.isArray(result.predicted_risks) || !Array.isArray(result.missing_paths) ||
+      result.predicted_risks.some((risk) => !risk || typeof risk.id !== 'string' || typeof risk.risk !== 'string') ||
+      result.missing_paths.some((entry) => typeof entry !== 'string')) {
+    throw new Error(`Malformed advise scope result at ${scopeFile}: expected predicted_risks and missing_paths arrays.`);
+  }
+  return { ...task, scope: { run: grantRun, predicted_risks: result.predicted_risks, missing_paths: result.missing_paths } };
+}
+
+// Called before makeRunDir: a scope result that cannot be carried is known before any quota is
+// spent, so it refuses like every other preflight gate instead of leaving a registered run behind.
+export function advisorTaskOrRefuse(input) {
+  try {
+    return advisorTaskArtifact(input);
+  } catch (error) {
+    return die(`${error.message} The run folder was not created; quota was not spent.`, 1);
+  }
+}
+
+export function adviseSection(artifact) {
+  if (!artifact?.scope) return '';
+  return [
+    '## Scope phase results',
+    '',
+    'Predicted risks:',
+    ...artifact.scope.predicted_risks.map(({ id, risk }) => `- ${id}: ${risk}`),
+    '',
+    'Paths you may additionally read and cite:',
+    ...artifact.scope.missing_paths.map((entry) => `- ${entry}`),
+  ].join('\n');
+}

package/src/home/lib/runner/attach.mjs

@@ -5,6 +5,7 @@ import { readJsonFileSync } from '../json-file.mjs';
 import { workerMayBeAlive } from '../meta/run-liveness.mjs';
 import { processAlive } from '../process-identity.mjs';
 import { exitCodeFor, writeFailure, chainRuns } from '../write-meta.mjs';
+import { sameRun } from './continuation.mjs';
 import { conflictingOrderOwner, runsForOrder } from './order-owner.mjs';
 
 // The attach call is the only process that waits for a worker it did not spawn. Keeping that
@@ -93,18 +94,21 @@ export async function waitForReply(runDir, workerPid, status) {
  * path only covers a live run that has not recorded a verdict yet.
  *
  * A repeat that arrives after the verdict is answered from disk rather than refused, for the same
- * reason. `--continue` is the one case that must not attach: it is the orchestrator saying it read
- * the previous reply and wants another pass.
+ * reason. `--continue` may attach to a run created from its grant: the 2026-09-23 dispatcher
+ * incident showed that repeating the identical continuation command must return to that run.
  */
-export async function attach({ runsRoot, repo, slug, taskHash, orderId, chain, isContinue, noWait } = {}) {
-  if (isContinue) return null;
+export async function attach({ runsRoot, repo, slug, taskHash, orderId, chain, grantRun, isContinue, noWait } = {}) {
   const runs = chain || chainRuns(runsRoot, repo, slug, taskHash, orderId);
   const runRecords = runs
     .map((run) => ({ run, status: readJsonFile(path.join(runsRoot, run, 'status.json')) }))
     .filter(({ status }) => status);
   const sameOrder = runsForOrder(runRecords, orderId);
+  const attachRuns = isContinue
+    ? sameOrder.filter(({ status }) => grantRun && status.continued_from && sameRun(runsRoot, status.continued_from, grantRun))
+    : sameOrder;
+  if (isContinue && !attachRuns.length) return null;
 
-  const owner = conflictingOrderOwner(runRecords, orderId, taskHash);
+  const owner = isContinue ? null : conflictingOrderOwner(runRecords, orderId, taskHash);
   if (owner) {
     const ownerDir = path.join(runsRoot, owner.run);
     console.log(
@@ -120,8 +124,8 @@ export async function attach({ runsRoot, repo, slug, taskHash, orderId, chain, i
   // order, and while it was in flight a repeat used to be answered by the first run's reply.txt —
   // a stale verdict presented as this pass's answer. Found by the Plan_11-2 checklist, 2026-08-04.
   let candidate = null;
-  for (let i = sameOrder.length - 1; i >= 0; i -= 1) {
-    const entry = sameOrder[i];
+  for (let i = attachRuns.length - 1; i >= 0; i -= 1) {
+    const entry = attachRuns[i];
     const dir = path.join(runsRoot, entry.run);
     if (fs.existsSync(path.join(dir, 'reply.txt'))) {
       announceSavedReply(dir, orderId, entry.status.started_at);

package/src/home/lib/runner/codex-cmd.mjs

@@ -77,7 +77,7 @@ export function spawnCaptured(command, args, options) {
     throw new TypeError('spawnCaptured requires a finite timeout greater than zero');
   }
   return new Promise((resolve) => {
-    const child = spawn(command, args, { ...rest, stdio: ['ignore', 'pipe', 'pipe'] });
+    const child = spawn(command, args, { ...rest, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
     let stdout = Buffer.alloc(0);
     let stderr = Buffer.alloc(0);
     let captureError = null;
@@ -232,6 +232,7 @@ export function runCodex(args, taskText, eventsPath, budgetMinutes, graceMs = ST
   const child = spawn(spec.command, spec.args, {
     ...spec.options,
     stdio: ['pipe', 'pipe', 'pipe'],
+    windowsHide: true,
   });
 
   return new Promise((resolve) => {
@@ -345,7 +346,7 @@ export function codexUnavailableReason() {
   const probe = spawnSync(
     process.platform === 'win32' ? process.env.ComSpec || 'cmd.exe' : 'codex',
     process.platform === 'win32' ? ['/d', '/s', '/c', 'codex --version'] : ['--version'],
-    { encoding: 'utf8' },
+    { encoding: 'utf8', windowsHide: true },
   );
   if (probe.error || probe.status !== 0) {
     return (probe.stderr || probe.error?.message || 'codex --version is not responding').trim();

package/src/home/lib/runner/continuation.mjs

@@ -9,7 +9,9 @@ import path from 'node:path';
 import { CONTINUATION_INPUT, parseContinuationGrant } from '../required-inputs.mjs';
 import { readJson } from '../write-meta.mjs';
 
-const sameRun = (runsRootPath, left, right) => {
+// One comparison of run names for the grant gate and for attach, so a repeat and a grant can never
+// disagree about whether two spellings name the same folder.
+export const sameRun = (runsRootPath, left, right) => {
   const a = path.resolve(runsRootPath, left);
   const b = path.resolve(runsRootPath, right);
   return process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;

package/src/home/lib/runner/git-state.mjs

@@ -15,7 +15,7 @@ import { runsRoot } from './runs-root.mjs';
 export const MAX_LOG = 256 * 1024 * 1024;
 
 export const git = (repo, args) =>
-  spawnSync('git', ['-C', repo, ...args], { encoding: 'utf8', maxBuffer: MAX_LOG });
+  spawnSync('git', ['-C', repo, ...args], { encoding: 'utf8', maxBuffer: MAX_LOG, windowsHide: true });
 
 /**
  * Prefix of the run folders as seen from inside the repository, or null when they live