@sentropic/h2a-runtime 0.98.7-rc.7 → 0.98.7-rc.9

package/dist/index.js

@@ -31,7 +31,7 @@ import { projectStatusForH2a } from "./status-projection.js";
 import { buildAgentLaunchArgs, buildAgentLaunchStdin, isAgentLaunchEffort, isAgentLaunchProfile, } from "./agent-launch-args.js";
 import { resolveGatewayModelAlias } from "./gateway-model-catalog/model-catalog.js";
 import { deriveSessionClass } from "./session-class.js";
-import { isRelaunchKillable, planRelaunch, relaunchContinuationPrompt, tryAcquireResumeLaunchClaim, wakeRelaunchedSession, } from "./relaunch.js";
+import { isRelaunchKillable, planRelaunch, relaunchContinuationPrompt, scrubbedRetypeCommand, prepareGatewayRetypeCommand, tryAcquireResumeLaunchClaim, wakeRelaunchedSession, } from "./relaunch.js";
 import { isHumanFacingSession, legacySessionEvidence, readConversationCustomTitle, readLastLayout, reconcileRunConvIds, restore as restoreLayout, } from "./restore.js";
 import { getLayoutConfig } from "./config.js";
 import { resolvePinnedLaunchEntries } from "./resume-launch-options.js";
@@ -81,7 +81,7 @@ import { createInterface } from "node:readline";
 const H2A_RUN_API_VERSION = "h2a.run/v1";
 const STRUCTURED_LAUNCH_PHASE_PREFIX = "[h2a] h2a.run.phase/v1 ";
 const H2A_RUNTIME_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
-import { CLI_PROFILES, gatewayModeForProfile, profileUsesLlmMeshGateway, } from "./protocol-local.js";
+import { CLI_PROFILES, gatewayModeForProfile, profileUsesLlmMeshGateway, resolveResumedGatewayMode, } from "./protocol-local.js";
 import { readLlmMeshConfig, updateLlmMeshRoutingConfig, } from "./gateway-host/config-file.js";
 import { startGateway, stopGateway, readGatewayPid, llmMeshLogPath, replaceAnthropicGatewayEnvironment, acquireLlmMeshSessionEnv, } from "./gateway-host/daemon.js";
 import { describeLlmMeshRoutingConfig, parseLlmMeshRoutingConfig, preferredRoutingConfig, strategyRoutingConfig, } from "./routing-preferences.js";
@@ -141,6 +141,7 @@ async function startRemoteFanout(remote, profileName, members, spec) {
                 ? { startupArgs: spec.startupArgs }
                 : {}),
             ...(spec.credentials ? { credentials: spec.credentials } : {}),
+            ...(spec.llmGateway === true ? { llmGateway: true } : {}),
         });
         return { name: member.name, sessionId: session.id, workspaceId: ws.id };
     });
@@ -206,6 +207,20 @@ async function runProfile(profileName, opts, commandArgs = []) {
         if (opts.resume !== undefined && resumeArgs.length === 0) {
             throw new Error(`profile "${profileName}" has no verified resume argv; start it without -r/--resume`);
         }
+        // Remote sessions are direct unless the gateway is explicitly asked for.
+        // Only an explicit --gw/--llm-gateway transmits the opt-in; the server
+        // ignores a globally configured gateway URL without it.
+        let remoteGatewayMode;
+        try {
+            remoteGatewayMode = gatewayModeFromOptions(opts);
+        }
+        catch (error) {
+            throw new Error(`[h2a] ${error.message}.`);
+        }
+        if (remoteGatewayMode === "gateway" && !profileUsesLlmMeshGateway(profileName)) {
+            throw new Error(`[h2a] --llm-gateway/--gw is unsupported for ${profileName}; this gateway is Anthropic-compatible and only Claude profiles consume it.`);
+        }
+        const remoteGatewayChoice = remoteGatewayMode === "gateway" ? { llmGateway: true } : {};
         const startupArgs = [...resumeArgs, ...commandArgs];
         // WP6 — REMOTE fan-out: --count N spawns N concurrent remote sessions, each
         // on its OWN workspace subPath of the shared RWX volume. count<=1 falls
@@ -235,6 +250,7 @@ async function runProfile(profileName, opts, commandArgs = []) {
                 target: opts.target,
                 startupArgs,
                 ...(credentials ? { credentials } : {}),
+                ...remoteGatewayChoice,
             });
             return;
         }
@@ -253,6 +269,7 @@ async function runProfile(profileName, opts, commandArgs = []) {
             ...(opts.workspaceId ? { workspaceId: opts.workspaceId } : {}),
             ...(opts.browser ? { metadata: { browser: true } } : {}),
             ...(opts.agentImage ? { agentImage: opts.agentImage } : {}),
+            ...remoteGatewayChoice,
         });
         if (archive) {
             await uploadWorkspaceArchive(opts.remote, session.id, archive);
@@ -276,7 +293,21 @@ async function runProfile(profileName, opts, commandArgs = []) {
         ...(opts.port !== undefined ? { port: opts.port } : {}),
         ...(commandArgs.length > 0 ? { startupArgs: commandArgs } : {}),
     };
-    const result = await run(runOptions);
+    const gatewayMode = gatewayModeFromOptions(opts);
+    if (gatewayMode === "gateway" && !profileUsesLlmMeshGateway(profileName)) {
+        throw new Error(`--llm-gateway/--gw is unsupported for ${profileName}`);
+    }
+    // Resolve local PTY routing before spawning, just as for managed sessions.
+    // Restore the caller's native auth even if acquisition or spawning fails.
+    const restoreEnv = replaceAnthropicGatewayEnvironment(process.env, captureAnthropicGatewayEnvironment());
+    let result;
+    try {
+        await injectLlmMeshGatewayEnv(gatewayMode, false);
+        result = await run({ ...runOptions, gatewayMode: gatewayMode === "gateway" ? "gateway" : "direct" });
+    }
+    finally {
+        restoreEnv();
+    }
     process.stderr.write(`[h2a] session ${result.sessionId} attach at http://127.0.0.1:${result.port}\n`);
     const { exitCode } = await result.exit;
     process.exitCode = exitCode;
@@ -858,32 +889,12 @@ export async function startJob(job) {
     const prevJobId = process.env[JOB_ID_ENV];
     process.env[DEPTH_ENV] = childDepthEnvValue(job.depthBudget ?? clampDepth(undefined));
     process.env[JOB_ID_ENV] = job.id;
-    // Inject llm-mesh gateway env if running. Do not trust a parent env that may
-    // contain an old gateway token from a previous restart.
-    // tmux inherits process.env, so claude + its subagents all get the gateway automatically.
-    const jobSessionSlug = slugify(job.id);
-    const jobSessionResolution = resolveLocalSession(jobSessionSlug);
-    const gatewayClientSessionId = jobSessionResolution.kind === "found"
-        ? jobSessionResolution.session.name
-        : jobSessionResolution.kind === "missing"
-            ? localSessionName(jobSessionSlug)
-            : undefined;
-    let meshEnv;
-    try {
-        meshEnv =
-            profileUsesLlmMeshGateway(job.tool) &&
-                getLlmMeshRuntimeConfig().enabled &&
-                gatewayClientSessionId
-                ? await acquireLlmMeshSessionEnv(undefined, gatewayClientSessionId)
-                : null;
-    }
-    catch (error) {
-        return {
-            started: false,
-            error: error instanceof Error ? error.message : String(error),
-        };
-    }
-    const restoreGatewayEnvironment = replaceAnthropicGatewayEnvironment(process.env, meshEnv ?? undefined);
+    // Gateway off unless explicitly asked: jobs never acquire the gateway.
+    // A legacy llmMesh.enabled=true, a running service, enrolled accounts or a
+    // parent env never select gateway routing for immediate or deferred jobs.
+    // Strip any stale h2a routing vars so the child starts direct; a user-owned
+    // ANTHROPIC_API_KEY survives for native authentication.
+    const restoreGatewayEnvironment = replaceAnthropicGatewayEnvironment(process.env, undefined);
     let tmuxSession;
     let workerPid;
     let agentPane;
@@ -1405,13 +1416,12 @@ export function bareChoiceFromOptions(opts) {
         return false;
     return undefined;
 }
-async function injectLlmMeshGatewayEnv(mode = "auto", allowDirectFallback = true, clientSessionId) {
-    if (mode === "direct") {
-        delete process.env.ANTHROPIC_BASE_URL;
-        delete process.env.ANTHROPIC_AUTH_TOKEN;
-        return undefined;
-    }
-    if (mode !== "gateway" && !getLlmMeshRuntimeConfig().enabled) {
+export async function injectLlmMeshGatewayEnv(mode = "auto", allowDirectFallback = true, clientSessionId) {
+    if (mode !== "gateway") {
+        // Gateway off unless explicitly asked: auto resolves to direct BEFORE any
+        // acquire/start. A legacy llmMesh.enabled=true, a running service, enrolled
+        // accounts or a parent env never select gateway routing. A user-owned
+        // ANTHROPIC_API_KEY is preserved for native authentication.
         delete process.env.ANTHROPIC_BASE_URL;
         delete process.env.ANTHROPIC_AUTH_TOKEN;
         return undefined;
@@ -1535,7 +1545,9 @@ export async function prepareLlmMeshForRestore(opts = {}, context = {
     injectGateway: (mode) => injectLlmMeshGatewayEnv(mode, mode !== "gateway"),
 }) {
     const mode = opts.mode ?? "auto";
-    if (mode !== "gateway" && !context.runtimeEnabled)
+    // Global enablement is not restore consent. Pinned sessions request --gw
+    // individually through their launch command; only --gw prewarms globally.
+    if (mode !== "gateway")
         return;
     const config = context.config ?? {};
     const port = config.port ?? 3002;
@@ -2016,6 +2028,10 @@ export async function main(argv) {
             .option("--name <label>", "base label for the --count fan-out fleet names (default: cwd basename)")
             .option("--browser", "add the headful-browser noVNC sidecar (WP7) — enables 2FA / authenticated-site flows from inside the pod")
             .option("--image <ref>", "override the session-agent container image (fully-qualified registry ref, e.g. rg.fr-par.scw.cloud/sentropic-geo/geo-acquisition:0.1.0)")
+            .option("--llm-gateway", "route this remote session through the llm-mesh gateway (explicit opt-in; default is direct)")
+            .option("--gw", "alias for --llm-gateway")
+            .option("--no-llm-gateway", "run this remote session without llm-mesh gateway env")
+            .option("--no-gw", "alias for --no-llm-gateway")
             .action(async (commandArgs, opts) => {
             const { remote: remoteOverride, local, workspace, ...rest } = opts;
             if (local) {
@@ -3701,6 +3717,8 @@ export async function main(argv) {
             process.exitCode = 1;
             return;
         }
+        const sameResumeIdentity = resolvedConvId !== undefined && registryEntry?.convId === resolvedConvId &&
+            registryEntry?.cwd === process.cwd() && registryEntry?.tool === explicitProfile;
         const entry = explicitProfile
             ? {
                 id: displaySlug,
@@ -3715,8 +3733,9 @@ export async function main(argv) {
                 enrolledAt: new Date().toISOString(),
                 lastSeenAt: new Date().toISOString(),
                 source: "run",
-                bare: registryEntry?.convId === resolvedConvId ? registryEntry?.bare : undefined,
-                gatewayMode: registryEntry?.convId === resolvedConvId ? registryEntry?.gatewayMode : undefined,
+                bare: sameResumeIdentity ? registryEntry?.bare : undefined,
+                gatewayMode: sameResumeIdentity ? registryEntry?.gatewayMode : undefined,
+                gatewayProvenance: sameResumeIdentity ? registryEntry?.gatewayProvenance : undefined,
             }
             : registryEntry;
         // WHICH host serves this resume — resolved BEFORE ANY act (F1): every
@@ -3814,7 +3833,7 @@ export async function main(argv) {
             process.exitCode = 2;
             return;
         }
-        const effectiveGatewayMode = gatewayModeForProfile(profile, gatewayMode === "auto" ? entry.gatewayMode ?? "auto" : gatewayMode);
+        const effectiveGatewayMode = resolveResumedGatewayMode(profile, gatewayMode, entry.gatewayMode, entry.gatewayProvenance);
         let gateway;
         // Resolve against the selected mode, not the parent's environment:
         // required gateway injection below must succeed before either launch.
@@ -4027,7 +4046,11 @@ export async function main(argv) {
             cwd: entry.cwd,
             sessionClass,
             ...(entry.convId ? { convId: entry.convId } : {}),
-            gatewayMode: effectiveGatewayMode,
+            // Only an explicit CLI choice becomes a new proven pin; otherwise
+            // the previous pin (if any) is preserved untouched by the merge.
+            ...(gatewayMode !== "auto"
+                ? { gatewayMode, gatewayProvenance: "explicit" }
+                : {}),
             bare: useBare,
         });
         process.stderr.write(`[h2a] resumed local session ${resumeSlug} (${profile} resume${entry.convId ? ` ${entry.convId}` : ""} in ${entry.cwd})\n`);
@@ -4383,8 +4406,11 @@ export async function main(argv) {
             for (const prunedId of resumeResolution.prunedIds) {
                 process.stderr.write(`[h2a] pruned dead registry row ${prunedId} that pinned conflicting launch options for this resume\n`);
             }
-            const pinnedLaunch = resumeResolution.entries[0];
-            const launchGatewayMode = gatewayModeForProfile(profile, gatewayMode === "auto" ? pinnedLaunch?.gatewayMode ?? "auto" : gatewayMode);
+            // Conflicting pins have already failed closed above. For agreeing
+            // pins, prefer the proven choice over an equivalent legacy row.
+            const pinnedLaunch = resumeResolution.entries.find(entry => entry.gatewayProvenance === "explicit")
+                ?? resumeResolution.entries[0];
+            const launchGatewayMode = resolveResumedGatewayMode(profile, gatewayMode, pinnedLaunch?.gatewayMode, pinnedLaunch?.gatewayProvenance);
             const command = localCliCommand(profile);
             // A detached/background or run-once launch is a worker, even when its
             // agent later emits a Claude SessionStart hook. Stamp this through tmux
@@ -4428,6 +4454,11 @@ export async function main(argv) {
                     return;
                 }
                 const useBare = resolveClaudeBare(profile, bareChoiceFromOptions(opts) ?? pinnedLaunch?.bare);
+                // Preserve the conversation's bare pin, including absence on a
+                // legacy row: materializing it only on the new row creates a conflict.
+                const enrollmentBare = pinnedLaunch && bareChoiceFromOptions(opts) === undefined
+                    ? pinnedLaunch.bare
+                    : useBare;
                 // H0 (#662): normalize readable gateway aliases (argon-high, wonder,
                 // wonder-full, spark) to their exact canonical model id. Unknown
                 // names pass through unchanged for exact-model validation downstream.
@@ -4755,8 +4786,8 @@ export async function main(argv) {
                     return;
                 }
                 // Auto-enroll in the live-session registry (feeds `h2a ls`/`restore`).
-                // Pin the gateway posture ONLY when the user was explicit (--gw/--no-gw);
-                // an "auto" launch stays unpinned so restore follows the live default.
+                // A CLI choice or a proven pin for this exact convId/cwd/tool
+                // survives enrollment under a new name. Legacy/auto stays unpinned.
                 enrollFromRun({
                     profile,
                     slug,
@@ -4768,8 +4799,10 @@ export async function main(argv) {
                     cwd,
                     sessionClass,
                     ...(opts.resume !== undefined ? { convId: opts.resume } : {}),
-                    gatewayMode: launchGatewayMode,
-                    bare: useBare,
+                    ...(gatewayMode !== "auto" || pinnedLaunch?.gatewayProvenance === "explicit"
+                        ? { gatewayMode: launchGatewayMode, gatewayProvenance: "explicit" }
+                        : {}),
+                    ...(enrollmentBare !== undefined ? { bare: enrollmentBare } : {}),
                 });
                 const nativeOwnerSocket = launchOwnership?.host === "native"
                     ? launchOwnership.sessions.find(owned => owned.name === name)?.socketPath : undefined;
@@ -6295,6 +6328,9 @@ export async function main(argv) {
                 ...(entry.gatewayMode !== undefined
                     ? { gatewayMode: entry.gatewayMode }
                     : {}),
+                ...(entry.gatewayProvenance !== undefined
+                    ? { gatewayProvenance: entry.gatewayProvenance }
+                    : {}),
                 ...(entry.bare !== undefined ? { bare: entry.bare } : {}),
             }));
             const result = await executeNativeRestart({
@@ -6349,7 +6385,9 @@ export async function main(argv) {
                             ...(candidate.convId !== undefined
                                 ? { convId: candidate.convId }
                                 : {}),
-                            ...(mode !== "auto" ? { gatewayMode: mode } : {}),
+                            ...(mode !== "auto"
+                                ? { gatewayMode: mode, gatewayProvenance: "explicit" }
+                                : {}),
                             ...(candidate.bare !== undefined ? { bare: candidate.bare } : {}),
                         });
                     }
@@ -6462,7 +6500,7 @@ export async function main(argv) {
                     process.exitCode = 1;
                     return;
                 }
-                const relaunchMode = gatewayModeForProfile(nativeEntry.tool, nativeEntry.gatewayMode ?? "auto");
+                const relaunchMode = resolveResumedGatewayMode(nativeEntry.tool, "auto", nativeEntry.gatewayMode, nativeEntry.gatewayProvenance);
                 await injectLlmMeshGatewayEnv(relaunchMode, relaunchMode !== "gateway", actName);
                 if (!killNativeSessionTree(actName)) {
                     process.stderr.write(`[h2a] native session ${slug} could not be killed; nothing was relaunched.\n`);
@@ -6489,7 +6527,15 @@ export async function main(argv) {
                     ...(relaunched.pid !== undefined ? { pid: relaunched.pid } : {}),
                     cwd: nativeEntry.cwd,
                     sessionClass: nativeEntry.sessionClass ?? "human",
-                    gatewayMode: relaunchMode,
+                    // No new CLI choice here: preserve the recorded pin verbatim so a
+                    // proven choice survives the relaunch and a legacy row keeps its
+                    // (unproven) data without gaining authority.
+                    ...(nativeEntry.gatewayMode !== undefined
+                        ? { gatewayMode: nativeEntry.gatewayMode }
+                        : {}),
+                    ...(nativeEntry.gatewayProvenance !== undefined
+                        ? { gatewayProvenance: nativeEntry.gatewayProvenance }
+                        : {}),
                     bare: useBare,
                     ...(nativeEntry.convId ? { convId: nativeEntry.convId } : {}),
                 });
@@ -6619,14 +6665,55 @@ export async function main(argv) {
         if (!forced) {
             let ok = 0;
             for (const action of plan.actions) {
-                const sessionId = entryByTmuxSession.get(action.name)?.id;
-                const relaunched = sessionId !== undefined
-                    ? relaunchSessionWithLease({
-                        sessionId,
-                        tmuxSession: action.name,
-                        command: action.cmd,
-                    })
-                    : relaunchInSession(action.name, action.cmd);
+                // The pane is NOT recreated, so apply the routing policy to the
+                // retyped command itself: resolve the session's consent, scrub the
+                // routing vars for direct, or pass the freshly acquired gateway
+                // route: the idle shell may carry an expired bearer or no route.
+                const retypeEntry = entryByTmuxSession.get(action.name);
+                const retypeMode = resolveResumedGatewayMode(action.profile, "auto", retypeEntry?.gatewayMode, retypeEntry?.gatewayProvenance);
+                let retypeCmd = action.cmd;
+                let cleanupRetypeEnv = () => { };
+                if (retypeMode === "gateway") {
+                    // Validate the explicit choice before retyping: fail closed when
+                    // the gateway is unavailable instead of typing a doomed command.
+                    // Hand off privately before restoring this process's environment.
+                    const restoreRetypeEnv = replaceAnthropicGatewayEnvironment(process.env, captureAnthropicGatewayEnvironment());
+                    try {
+                        await injectLlmMeshGatewayEnv("gateway", false, localSessionName(action.slug));
+                        const prepared = prepareGatewayRetypeCommand(action.cmd, {
+                            ANTHROPIC_BASE_URL: process.env.ANTHROPIC_BASE_URL,
+                            ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN,
+                        });
+                        retypeCmd = prepared.command;
+                        cleanupRetypeEnv = prepared.cleanup;
+                    }
+                    catch (error) {
+                        process.stderr.write(`[h2a] FAILED to relaunch ${action.slug}: ${error.message}\n`);
+                        continue;
+                    }
+                    finally {
+                        restoreRetypeEnv();
+                    }
+                }
+                else {
+                    retypeCmd = scrubbedRetypeCommand(action.cmd);
+                }
+                const sessionId = retypeEntry?.id;
+                let relaunched = false;
+                try {
+                    relaunched = sessionId !== undefined
+                        ? relaunchSessionWithLease({
+                            sessionId,
+                            tmuxSession: action.name,
+                            command: retypeCmd,
+                        })
+                        : relaunchInSession(action.name, retypeCmd);
+                }
+                finally {
+                    // A successful retype transfers cleanup to the private reader.
+                    if (!relaunched)
+                        cleanupRetypeEnv();
+                }
                 if (relaunched) {
                     ok += 1;
                     process.stderr.write(`[h2a] relaunched ${action.slug}: ${action.cmd}\n`);
@@ -6702,6 +6789,11 @@ export async function main(argv) {
             }
             finalReady.push(item);
         }
+        // Isolate the routing env per session: a gateway relaunch deletes the
+        // native ANTHROPIC_API_KEY from the shared process env, so without a
+        // per-iteration restore the next (direct) session would lose native
+        // auth. Every iteration starts from the loop-entry environment.
+        const loopEntryGatewayEnv = captureAnthropicGatewayEnvironment();
         let ok = 0;
         for (const { action, entry, sessionClass } of finalReady) {
             const safety = sessionRelaunchSafety(action.name);
@@ -6728,8 +6820,9 @@ export async function main(argv) {
                 process.stderr.write(`[h2a] skipped ${action.slug}: tmux session ${action.name} changed or was no longer proven dead immediately before kill.\n`);
                 continue;
             }
+            const restoreLoopEnv = replaceAnthropicGatewayEnvironment(process.env, loopEntryGatewayEnv);
             try {
-                const gatewayMode = gatewayModeForProfile(action.profile, entry.gatewayMode ?? "auto");
+                const gatewayMode = resolveResumedGatewayMode(action.profile, "auto", entry.gatewayMode, entry.gatewayProvenance);
                 await injectLlmMeshGatewayEnv(gatewayMode, true, localSessionName(action.slug));
                 const { name, agentPane } = startLocalSession(action.profile, action.command, entry.cwd, localResumeArgs(action.profile, action.convId, {
                     bare: resolveClaudeBare(action.profile, entry.bare),
@@ -6751,6 +6844,9 @@ export async function main(argv) {
                     ...(entry.gatewayMode !== undefined
                         ? { gatewayMode: entry.gatewayMode }
                         : {}),
+                    ...(entry.gatewayProvenance !== undefined
+                        ? { gatewayProvenance: entry.gatewayProvenance }
+                        : {}),
                     ...(entry.bare !== undefined ? { bare: entry.bare } : {}),
                 });
                 const wake = wakeRelaunchedSession(relaunchContinuationPrompt(entry.task), {
@@ -6783,6 +6879,9 @@ export async function main(argv) {
             catch (error) {
                 process.stderr.write(`[h2a] FAILED to force-restart ${action.slug} after killing ${action.name}: ${error.message}\n`);
             }
+            finally {
+                restoreLoopEnv();
+            }
         }
         process.stderr.write(`[h2a] force-restarted ${ok}/${plan.actions.length}${plan.skipped.length ? `, ${plan.skipped.length} skipped` : ""}\n`);
         if (ok !== plan.actions.length)
@@ -7146,13 +7245,13 @@ export async function main(argv) {
         }
         if (opts.reattach)
             restoreOpts.reattach = true;
-        // Forced-direct restore must NOT spin up the gateway; otherwise prepare
-        // it as before (no-op when the gateway is disabled).
-        if (forceGateway !== "direct") {
+        // Only explicit --gw prewarms globally. In auto mode, any pinned
+        // gateway session acquires its gateway through its own launch.
+        if (forceGateway === "gateway") {
             try {
                 await prepareLlmMeshForRestore({
                     dryRun: Boolean(opts.dryRun),
-                    mode: forceGateway ?? "auto",
+                    mode: forceGateway,
                 });
             }
             catch (error) {
@@ -7851,17 +7950,15 @@ export async function main(argv) {
         const config = readLlmMeshConfig() ?? {};
         const existing = readGatewayPid();
         if (existing) {
-            setLlmMeshRuntimeConfig({ enabled: true });
+            // Starting the service is not routing consent: launches stay direct
+            // unless --gw is passed, so the durable flag is left untouched.
             process.stdout.write(`[h2a] llm-mesh: already running (pid ${existing})\n`);
-            process.stdout.write(`[h2a] llm-mesh: restore config enabled\n`);
             return;
         }
         process.stdout.write(`[h2a] llm-mesh: starting gateway…\n`);
         const result = await startGateway(config, { verbose: opts.verbose });
-        setLlmMeshRuntimeConfig({ enabled: true });
         const port = result.port;
         process.stdout.write(`[h2a] llm-mesh: gateway started (pid ${result.pid}, port ${port})\n`);
-        process.stdout.write(`[h2a] llm-mesh: restore config enabled\n`);
         process.stdout.write("[h2a] llm-mesh: use `h2a run claude --gw`; the opaque bearer is not printed\n");
     });
     llmMeshCommand
@@ -7889,6 +7986,9 @@ export async function main(argv) {
         else {
             process.stdout.write(`[h2a] llm-mesh: not running\n`);
         }
+        // A previous start must not keep authorizing reactivation: stopping the
+        // service clears the durable flag so a later restore stays direct.
+        setLlmMeshRuntimeConfig({ enabled: false });
     });
     llmMeshCommand
         .command("restart")
@@ -7905,9 +8005,9 @@ export async function main(argv) {
         }
         process.stdout.write(`[h2a] llm-mesh: starting gateway…\n`);
         const result = await startGateway(config, { verbose: opts.verbose });
-        setLlmMeshRuntimeConfig({ enabled: true });
+        // Restarting the service is not routing consent: the durable flag is
+        // left untouched so a later restore stays direct unless --gw is passed.
         process.stdout.write(`[h2a] llm-mesh: gateway restarted (pid ${result.pid}, port ${result.port})\n`);
-        process.stdout.write(`[h2a] llm-mesh: restore config enabled\n`);
         process.stdout.write(`[h2a] llm-mesh: no tmux/Claude session was restarted; active sessions may keep their old gateway token until explicitly relaunched.\n`);
         process.stdout.write("[h2a] llm-mesh: use `h2a run claude --gw`; the opaque bearer is not printed\n");
     });