@triflux/remote 10.44.0 → 10.46.0

package/hub/store.mjs

@@ -1,6 +1,7 @@
 // hub/store.mjs — SQLite 감사 로그/메타데이터/역할 레지스트리 저장소
 // 실시간 배달은 router/pipe가 담당하고, 역할 권한과 복구 상태는 SQLite가 보존한다.
 
+import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
@@ -12,10 +13,7 @@ import {
 } from "@triflux/core/hub/lib/timeout-defaults.mjs";
 import { uuidv7 } from "@triflux/core/hub/lib/uuidv7.mjs";
 import { recalcConfidence } from "@triflux/core/hub/reflexion.mjs";
-import {
-  decodeRoleKey,
-  ROLE_REACHABILITY_STATES,
-} from "@triflux/core/hub/role-contract.mjs";
+import { decodeRoleKey, ROLE_REACHABILITY_STATES } from "@triflux/core/hub/role-contract.mjs";
 
 export { uuidv7 };
 
@@ -122,6 +120,21 @@ function ensureV6Columns(db) {
   }
 }
 
+function ensureV7Columns(db) {
+  if (hasTable(db, "agents")) {
+    ensureColumn(
+      db,
+      "agents",
+      "presence_generation",
+      "INTEGER NOT NULL DEFAULT 0",
+    );
+  }
+}
+
+function storeFingerprint(dbPath) {
+  return `sqlite:${createHash("sha256").update(String(dbPath)).digest("hex")}`;
+}
+
 /**
  * 저장소 생성
  * @param {string} dbPath
@@ -152,7 +165,7 @@ export function createStore(dbPath, options = {}) {
   db.exec(
     "CREATE TABLE IF NOT EXISTS _meta (key TEXT PRIMARY KEY, value TEXT)",
   );
-  const SCHEMA_VERSION = "6";
+  const SCHEMA_VERSION = "7";
   const curVer = (() => {
     try {
       return db
@@ -169,6 +182,7 @@ export function createStore(dbPath, options = {}) {
   // v5 테이블에는 schema.sql의 v6 인덱스가 참조하는 컬럼이 없으므로
   // CREATE IF NOT EXISTS 재실행 전에 멱등 컬럼 seam을 먼저 적용한다.
   ensureV6Columns(db);
+  ensureV7Columns(db);
   if (curVer !== SCHEMA_VERSION) {
     if (curVer != null) {
       // 이미 버전이 기록된 DB에서 버전 불일치가 발생한 경우 경고한다.
@@ -183,6 +197,7 @@ export function createStore(dbPath, options = {}) {
   }
   // 매 부팅 실행해 부분 적용된 마이그레이션도 안전하게 복구한다.
   ensureV6Columns(db);
+  ensureV7Columns(db);
   ensureColumn(
     db,
     "reflexion_entries",
@@ -199,8 +214,8 @@ export function createStore(dbPath, options = {}) {
 
   const S = {
     upsertAgent: db.prepare(`
-      INSERT INTO agents (agent_id, cli, pid, capabilities_json, topics_json, last_seen_ms, lease_expires_ms, status, metadata_json)
-      VALUES (@agent_id, @cli, @pid, @capabilities_json, @topics_json, @last_seen_ms, @lease_expires_ms, @status, @metadata_json)
+      INSERT INTO agents (agent_id, cli, pid, capabilities_json, topics_json, last_seen_ms, lease_expires_ms, presence_generation, status, metadata_json)
+      VALUES (@agent_id, @cli, @pid, @capabilities_json, @topics_json, @last_seen_ms, @lease_expires_ms, 1, @status, @metadata_json)
       ON CONFLICT(agent_id) DO UPDATE SET
         cli=excluded.cli,
         pid=excluded.pid,
@@ -208,6 +223,7 @@ export function createStore(dbPath, options = {}) {
         topics_json=excluded.topics_json,
         last_seen_ms=excluded.last_seen_ms,
         lease_expires_ms=excluded.lease_expires_ms,
+        presence_generation=agents.presence_generation + 1,
         status=excluded.status,
         metadata_json=excluded.metadata_json`),
     getAgent: db.prepare("SELECT * FROM agents WHERE agent_id = ?"),
@@ -215,24 +231,30 @@ export function createStore(dbPath, options = {}) {
       "UPDATE agents SET topics_json=?, last_seen_ms=? WHERE agent_id=?",
     ),
     heartbeat: db.prepare(
+      "UPDATE agents SET last_seen_ms=?, lease_expires_ms=?, status='online' WHERE agent_id=? AND presence_generation=?",
+    ),
+    heartbeatWithoutGeneration: db.prepare(
       "UPDATE agents SET last_seen_ms=?, lease_expires_ms=?, status='online' WHERE agent_id=?",
     ),
-    setAgentStatus: db.prepare("UPDATE agents SET status=? WHERE agent_id=?"),
+    setAgentStatus: db.prepare(
+      "UPDATE agents SET status=? WHERE agent_id=? AND presence_generation=?",
+    ),
+    setAgentStatusWithoutGeneration: db.prepare(
+      "UPDATE agents SET status=? WHERE agent_id=?",
+    ),
     onlineAgents: db.prepare("SELECT * FROM agents WHERE status != 'offline'"),
     allAgents: db.prepare("SELECT * FROM agents"),
     agentsByTopic: db.prepare(
       "SELECT a.* FROM agents a, json_each(a.topics_json) t WHERE t.value=? AND a.status != 'offline'",
     ),
     markStale: db.prepare(
-      "UPDATE agents SET status='stale' WHERE status='online' AND lease_expires_ms < ?",
+      "UPDATE agents SET status='stale' WHERE agent_id=? AND presence_generation=? AND status='online' AND lease_expires_ms < ?",
     ),
     markOffline: db.prepare(
-      "UPDATE agents SET status='offline' WHERE status='stale' AND lease_expires_ms < ? - 300000",
+      "UPDATE agents SET status='offline' WHERE agent_id=? AND presence_generation=? AND status='stale' AND lease_expires_ms < ? - 300000",
     ),
 
-    getRole: db.prepare(
-      "SELECT * FROM role_registry WHERE role_key_wire = ?",
-    ),
+    getRole: db.prepare("SELECT * FROM role_registry WHERE role_key_wire = ?"),
     insertRoleReservation: db.prepare(`
       INSERT INTO role_registry (
         role_key_wire, project_id, role_kind, scope_id, state,
@@ -289,9 +311,7 @@ export function createStore(dbPath, options = {}) {
         AND activation_seq=@expected_activation_seq
         AND activation_id IS @expected_activation_id
         AND version=@expected_version`),
-    listRoles: db.prepare(
-      "SELECT * FROM role_registry ORDER BY role_key_wire",
-    ),
+    listRoles: db.prepare("SELECT * FROM role_registry ORDER BY role_key_wire"),
     expiredHolderRoles: db.prepare(`
       SELECT * FROM role_registry
       WHERE holder_agent_id IS NOT NULL
@@ -419,12 +439,9 @@ export function createStore(dbPath, options = {}) {
       "UPDATE human_requests SET state=?, response_json=? WHERE request_id=?",
     ),
     pendingHR: db.prepare("SELECT * FROM human_requests WHERE state='pending'"),
-    expireHR: db.prepare(
-      "UPDATE human_requests SET state='timed_out' WHERE state='pending' AND deadline_ms < ?",
-    ),
 
     insertDL: db.prepare(
-      "INSERT OR REPLACE INTO dead_letters (message_id, reason, failed_at_ms, last_error) VALUES (?,?,?,?)",
+      "INSERT INTO dead_letters (message_id, reason, failed_at_ms, last_error) VALUES (?,?,?,?) ON CONFLICT(message_id) DO NOTHING",
     ),
     getDL: db.prepare(
       "SELECT * FROM dead_letters ORDER BY failed_at_ms DESC LIMIT ?",
@@ -471,7 +488,13 @@ export function createStore(dbPath, options = {}) {
       WHERE job_id=@job_id`),
 
     findExpired: db.prepare(
-      "SELECT id FROM messages WHERE status='queued' AND expires_at_ms < ?",
+      "SELECT * FROM messages WHERE status IN ('queued', 'delivered') AND expires_at_ms <= ?",
+    ),
+    claimExpired: db.prepare(
+      "UPDATE messages SET status='dead_letter' WHERE id=? AND status IN ('queued', 'delivered') AND expires_at_ms <= ?",
+    ),
+    claimDeadLetter: db.prepare(
+      "UPDATE messages SET status='dead_letter' WHERE id=? AND status != 'dead_letter'",
     ),
     urgentDepth: db.prepare(
       "SELECT COUNT(*) as cnt FROM messages WHERE status='queued' AND priority >= 7",
@@ -629,27 +652,28 @@ export function createStore(dbPath, options = {}) {
       previous_holder_agent_id:
         input.previous_holder_agent_id ??
         (current?.holder_agent_id !== input.holder_agent_id
-          ? current?.holder_agent_id ?? null
-          : current?.previous_holder_agent_id ?? null),
+          ? (current?.holder_agent_id ?? null)
+          : (current?.previous_holder_agent_id ?? null)),
       epoch: nextEpoch,
       activation_seq: nextActivationSeq,
       activation_id:
         input.activation_id ??
-        (input.holder_agent_id ? uuidv7() : current?.activation_id ?? null),
+        (input.holder_agent_id ? uuidv7() : (current?.activation_id ?? null)),
       activation_deadline_ms:
         input.activation_deadline_ms ?? current?.activation_deadline_ms ?? null,
       holder_lease_expires_ms:
         input.holder_lease_expires_ms ??
         current?.holder_lease_expires_ms ??
         null,
-      charter_version: input.charter_version ?? current?.charter_version ?? null,
+      charter_version:
+        input.charter_version ?? current?.charter_version ?? null,
       charter_acked_epoch:
         input.charter_acked_epoch ?? current?.charter_acked_epoch ?? null,
       retry_count: input.retry_count ?? current?.retry_count ?? 0,
       next_probe_ms: input.next_probe_ms ?? current?.next_probe_ms ?? null,
       blocked_reason:
         input.blocked_reason === undefined
-          ? current?.blocked_reason ?? null
+          ? (current?.blocked_reason ?? null)
           : input.blocked_reason,
       last_transition_ms: input.last_transition_ms ?? Date.now(),
       last_reason: input.last_reason ?? "role_reserved",
@@ -701,20 +725,18 @@ export function createStore(dbPath, options = {}) {
     return {
       roles,
       candidates: roles.flatMap((role) =>
-        S.listRoleCandidates
-          .all(role.role_key_wire)
-          .map(parseRoleCandidateRow),
+        S.listRoleCandidates.all(role.role_key_wire).map(parseRoleCandidateRow),
       ),
       pending_messages: roles.flatMap((role) =>
-        S.pendingRoleMessages
-          .all(role.role_key_wire, now)
-          .map(parseMessageRow),
+        S.pendingRoleMessages.all(role.role_key_wire, now).map(parseMessageRow),
       ),
     };
   });
 
   const store = {
     db,
+    type: "sqlite",
+    fingerprint: storeFingerprint(dbPath),
     uuidv7,
 
     close() {
@@ -748,6 +770,7 @@ export function createStore(dbPath, options = {}) {
       return {
         agent_id,
         lease_id: leaseId,
+        presence_generation: persisted?.presence_generation ?? null,
         lease_expires_ms: leaseExpires,
         server_time_ms: now,
         effective: {
@@ -760,6 +783,7 @@ export function createStore(dbPath, options = {}) {
           lease_expires_ms: persisted?.lease_expires_ms ?? null,
           store_type: "sqlite",
           db_path: dbPath ?? null,
+          store_fingerprint: storeFingerprint(dbPath),
         },
       };
     },
@@ -768,9 +792,12 @@ export function createStore(dbPath, options = {}) {
       return parseAgentRow(S.getAgent.get(id));
     },
 
-    refreshLease(agentId, ttlMs = 30000) {
+    refreshLease(agentId, ttlMs = 30000, presenceGeneration) {
       const now = Date.now();
-      const write = S.heartbeat.run(now, now + ttlMs, agentId);
+      const write =
+        presenceGeneration == null
+          ? S.heartbeatWithoutGeneration.run(now, now + ttlMs, agentId)
+          : S.heartbeat.run(now, now + ttlMs, agentId, presenceGeneration);
       return {
         agent_id: agentId,
         lease_expires_ms: now + ttlMs,
@@ -779,6 +806,7 @@ export function createStore(dbPath, options = {}) {
           updated: write.changes > 0,
           store_type: "sqlite",
           db_path: dbPath ?? null,
+          store_fingerprint: storeFingerprint(dbPath),
         },
       };
     },
@@ -804,14 +832,40 @@ export function createStore(dbPath, options = {}) {
 
     sweepStaleAgents() {
       const now = Date.now();
+      const candidates = S.allAgents.all();
+      let stale = 0;
+      let offline = 0;
+      for (const candidate of candidates) {
+        if (candidate.status === "online" && candidate.lease_expires_ms < now) {
+          stale += S.markStale.run(
+            candidate.agent_id,
+            candidate.presence_generation,
+            now,
+          ).changes;
+        } else if (
+          candidate.status === "stale" &&
+          candidate.lease_expires_ms < now - 300000
+        ) {
+          offline += S.markOffline.run(
+            candidate.agent_id,
+            candidate.presence_generation,
+            now,
+          ).changes;
+        }
+      }
       return {
-        stale: S.markStale.run(now).changes,
-        offline: S.markOffline.run(now).changes,
+        stale,
+        offline,
       };
     },
 
-    updateAgentStatus(agentId, status) {
-      return S.setAgentStatus.run(status, agentId).changes > 0;
+    updateAgentStatus(agentId, status, presenceGeneration) {
+      return (
+        (presenceGeneration == null
+          ? S.setAgentStatusWithoutGeneration.run(status, agentId)
+          : S.setAgentStatus.run(status, agentId, presenceGeneration)
+        ).changes > 0
+      );
     },
 
     getRole(roleKeyWire) {
@@ -837,7 +891,8 @@ export function createStore(dbPath, options = {}) {
         Object.hasOwn(input, "expectedActivationId") ||
         Object.hasOwn(input, "activation_id");
       const expected = {
-        version: input.expected_version ?? input.expectedVersion ?? input.version,
+        version:
+          input.expected_version ?? input.expectedVersion ?? input.version,
         epoch: input.expected_epoch ?? input.expectedEpoch ?? input.epoch,
         activation_seq:
           input.expected_activation_seq ??
@@ -979,15 +1034,15 @@ export function createStore(dbPath, options = {}) {
           0,
         excluded_until_ms:
           input.excluded_until_ms === undefined
-            ? current?.excluded_until_ms ?? null
+            ? (current?.excluded_until_ms ?? null)
             : input.excluded_until_ms,
         last_probe_ms:
           input.last_probe_ms === undefined
-            ? current?.last_probe_ms ?? null
+            ? (current?.last_probe_ms ?? null)
             : input.last_probe_ms,
         last_probe_code:
           input.last_probe_code === undefined
-            ? current?.last_probe_code ?? null
+            ? (current?.last_probe_code ?? null)
             : input.last_probe_code,
         updated_at_ms: input.updated_at_ms ?? Date.now(),
       });
@@ -1002,9 +1057,11 @@ export function createStore(dbPath, options = {}) {
       if (!current) return { ok: false, reason: "not_found" };
 
       let failures =
-        input.consecutive_probe_failures ??
-        current.consecutive_probe_failures;
-      if (input.probe_failed === true || input.increment_probe_failures === true) {
+        input.consecutive_probe_failures ?? current.consecutive_probe_failures;
+      if (
+        input.probe_failed === true ||
+        input.increment_probe_failures === true
+      ) {
         failures = current.consecutive_probe_failures + 1;
       } else if (input.probe_succeeded === true) {
         failures = 0;
@@ -1186,16 +1243,14 @@ export function createStore(dbPath, options = {}) {
       return S.pendingHR.all().map(parseHumanRequestRow);
     },
 
-    expireHumanRequests() {
-      return S.expireHR.run(Date.now()).changes;
-    },
-
     moveToDeadLetter(messageId, reason, lastError = null) {
-      db.transaction(() => {
-        S.setMsgStatus.run("dead_letter", messageId);
-        S.insertDL.run(messageId, reason, Date.now(), lastError);
+      const failedAt = Date.now();
+      return db.transaction(() => {
+        const changed = S.claimDeadLetter.run(messageId).changes;
+        if (!changed) return false;
+        S.insertDL.run(messageId, reason, failedAt, lastError);
+        return true;
       })();
-      return true;
     },
 
     getDeadLetters(limit = 50) {
@@ -1465,16 +1520,27 @@ export function createStore(dbPath, options = {}) {
       });
     },
 
-    sweepExpired() {
-      const now = Date.now();
+    sweepExpired({ now_ms = Date.now() } = {}) {
       return db.transaction(() => {
-        const expired = S.findExpired.all(now);
-        for (const { id } of expired) {
-          S.setMsgStatus.run("dead_letter", id);
-          S.insertDL.run(id, "ttl_expired", now, null);
+        const transitions = [];
+        for (const row of S.findExpired.all(now_ms)) {
+          if (!S.claimExpired.run(row.id, now_ms).changes) continue;
+          options.beforeDeadLetterInsert?.({
+            message_id: row.id,
+            reason: "ttl_expired",
+            failed_at_ms: now_ms,
+          });
+          const dlqInserted =
+            S.insertDL.run(row.id, "ttl_expired", now_ms, null).changes === 1;
+          transitions.push({
+            message: parseMessageRow(row),
+            previous_status: row.status,
+            reason: "ttl_expired",
+            failed_at_ms: now_ms,
+            dlq_inserted: dlqInserted,
+          });
         }
-        const humanRequests = S.expireHR.run(now).changes;
-        return { messages: expired.length, human_requests: humanRequests };
+        return { now_ms, messages: transitions.length, transitions };
       })();
     },
 

package/hub/team/backend.mjs

@@ -21,10 +21,12 @@ export function buildAntigravityCommand(
   // and `"` reach the shell verbatim (P1: shell injection).
   const promptFile = `${resultFile}.prompt`;
   writeFileSync(promptFile, prompt);
+  // agy 1.1.27 부터 --print 는 값(프롬프트)이 필수이고 stdin 프롬프트는 거부된다.
+  // 파일 내용을 셸이 재해석하지 않는 형태(따옴표 안 명령 치환 / Get-Content 식)로 값에 넣는다.
   if (isWindows) {
-    return `Get-Content -Raw '${promptFile}' | agy --print --dangerously-skip-permissions > '${resultFile}' 2>'${resultFile}.err'`;
+    return `agy --dangerously-skip-permissions --print (Get-Content -Raw '${promptFile}') > '${resultFile}' 2>'${resultFile}.err'`;
   }
-  return `agy --print --dangerously-skip-permissions < '${promptFile}' > '${resultFile}' 2>'${resultFile}.err'`;
+  return `agy --dangerously-skip-permissions --print "$(cat '${promptFile}')" > '${resultFile}' 2>'${resultFile}.err'`;
 }
 
 const _require = createRequire(import.meta.url);

package/hub/team/claude-daemon-control.mjs

@@ -321,10 +321,12 @@ export async function probeClaudeDaemonCandidates({
   short,
   sessionId,
   timeoutMs = 6000,
+  tmpRoot = "/tmp",
 } = {}) {
   const candidates = await buildClaudeDaemonDiscoveryCandidates({
     configDir,
     env,
+    tmpRoot,
   });
   const callerProvenance = detectCallerProvenance(env);
   const targetRequested = Boolean(short || sessionId);

package/hub/team/cli/commands/start/start-headless.mjs

@@ -88,6 +88,8 @@ export async function startHeadlessTeam({
     timeoutSec: timeoutSec || 900,
     layout,
     autoAttach: !!autoAttach,
+    leadPane: process.env.TMUX_PANE,
+    leadTmux: process.env.TMUX,
     dashboard: !!dashboard,
     dashboardLayout,
     dashboardSize: dashboardSize ?? 0.5,

package/hub/team/cli/commands/start/start-mux.mjs

@@ -5,6 +5,7 @@ import {
   attachSession,
   configureTeammateKeybindings,
   createSession,
+  splitAttachToClient,
 } from "../../../session.mjs";
 import { BOLD, DIM, GREEN, RESET } from "../../../shared.mjs";
 import { ok, warn } from "../../render.mjs";
@@ -62,12 +63,23 @@ export async function startMuxTeam({
 
   ok("CLI 초기화 대기 (3초)...");
   await new Promise((resolve) => setTimeout(resolve, 3000));
-  await orchestrate(sessionId, assignments, {
+  const promptInjectionFailures = await orchestrate(sessionId, assignments, {
     hubUrl,
     teammateMode,
     lead: { target: leadTarget, cli: lead, task },
+    onInjectionFailure(failure) {
+      warn(
+        `${failure.cli} ${failure.role} prompt 제출 실패 (${failure.target}): ${failure.message}`,
+      );
+    },
   });
-  ok("리드/워커 프롬프트 주입 완료");
+  if (promptInjectionFailures.length === 0) {
+    ok("리드/워커 프롬프트 주입 완료");
+  } else {
+    warn(
+      `prompt 제출 실패 ${promptInjectionFailures.length}건 — 세션 상태에 기록함`,
+    );
+  }
 
   return {
     sessionName: sessionId,
@@ -78,6 +90,7 @@ export async function startMuxTeam({
     teammateMode,
     startedAt: Date.now(),
     hubUrl,
+    promptInjectionFailures,
     members,
     panes: Object.fromEntries(
       members.map((member) => [
@@ -113,7 +126,15 @@ export async function startMuxTeam({
       );
       console.log(`  ${DIM}Ctrl+B → D: 세션 분리 (백그라운드)${RESET}\n`);
       if (process.stdout.isTTY && process.stdin.isTTY) attachSession(sessionId);
-      else {
+      else if (
+        splitAttachToClient(sessionId, {
+          targetPane: process.env.TMUX_PANE,
+          tmuxEnv: process.env.TMUX,
+        })
+      ) {
+        ok("non-TTY 환경: 바깥 tmux 클라이언트 창을 분할해 attach함");
+        console.log(`  ${DIM}분할 pane에서 나가기: Ctrl+B → D${RESET}\n`);
+      } else {
         warn("TTY 미지원 환경이라 자동 attach를 생략함");
         console.log(`  ${DIM}수동 연결: tfx multi attach${RESET}\n`);
       }

package/hub/team/cli/services/runtime-mode.mjs

@@ -5,16 +5,28 @@ import {
   sessionExists,
 } from "../../session.mjs";
 
-export function normalizeTeammateMode(mode = "auto") {
+export function normalizeTeammateMode(mode = "auto", deps = {}) {
+  const platform = deps.platform || process.platform;
+  const env = deps.env || process.env;
+  const detectMux = deps.detectMultiplexer || detectMultiplexer;
   const raw = String(mode).toLowerCase();
   if (raw === "inline" || raw === "native") return "in-process";
   if (raw === "headless" || raw === "hl") return "headless";
-  if (raw === "in-process" || raw === "tmux" || raw === "psmux" || raw === "wt")
-    return raw;
-  if (raw === "windows-terminal" || raw === "windows_terminal") return "wt";
+  if (raw === "in-process" || raw === "tmux") return raw;
+  if (raw === "psmux") return platform === "win32" ? "psmux" : "in-process";
+  if (
+    raw === "wt" ||
+    raw === "windows-terminal" ||
+    raw === "windows_terminal"
+  ) {
+    return platform === "win32" ? "wt" : "in-process";
+  }
   if (raw === "auto") {
-    if (process.env.TMUX) return "tmux";
-    const mux = detectMultiplexer();
+    if (env.TMUX) return "tmux";
+    const mux = detectMux();
+    if (platform !== "win32") {
+      return mux === "tmux" ? "tmux" : "in-process";
+    }
     if (mux === "psmux") return "psmux";
     if (mux === "tmux") return "tmux";
     return "in-process";
@@ -57,9 +69,11 @@ export function isTeamAlive(state) {
   return sessionExists(state.sessionName);
 }
 
-export function ensureTmuxOrExit() {
-  const mux = detectMultiplexer();
-  if (mux) return mux;
+export function ensureTmuxOrExit(deps = {}) {
+  const platform = deps.platform || process.platform;
+  const detectMux = deps.detectMultiplexer || detectMultiplexer;
+  const mux = detectMux();
+  if (mux && (platform === "win32" || mux === "tmux")) return mux;
   const error = new Error("tmux 미발견");
   error.code = "TMUX_REQUIRED";
   throw error;

package/hub/team/conductor.mjs

@@ -21,6 +21,11 @@ import { dirname, join } from "node:path";
 import { createRegistry } from "@triflux/core/mesh/mesh-registry.mjs";
 import { resolveNestedCodexAgentProfile } from "../../scripts/lib/cli-codex.mjs";
 import { codexProfileConfigOverrides } from "../../scripts/lib/codex-profile-config.mjs";
+import {
+  buildDisabledCliError,
+  normalizeCliName,
+  resolveCliPolicy,
+} from "../../scripts/lib/machine-profile.mjs";
 import { broker } from "@triflux/core/hub/account-broker.mjs";
 import { runPreflight as runCodexPreflight } from "@triflux/core/hub/codex-preflight.mjs";
 import {
@@ -606,30 +611,53 @@ export function createConductor(opts = {}) {
       }
     }
 
-    const spawnSpec = buildSpawnSpecForMode(MODES.HEADLESS, {
-      cli: session.config.agent,
-      prompt: session.config.prompt,
-      profile: session.config.profile,
-      role: session.config.role,
-      model: session.config.model,
-      env: session.config.env,
-      mcpServers: session.config.mcpServers,
-      excludeMcpServers,
-      resolveCommand: opts.deps?.resolveCliExecutable,
-      onWarning: (message, details = {}) => {
-        eventLog.append("mcp_server_skipped", {
-          session: session.id,
-          message,
-          ...details,
-        });
-        emitter.emit("warning", {
-          type: "mcp_server_skipped",
-          session: session.id,
-          message,
-          ...details,
-        });
-      },
-    });
+    let spawnSpec;
+    try {
+      spawnSpec = buildSpawnSpecForMode(MODES.HEADLESS, {
+        cli: session.config.agent,
+        prompt: session.config.prompt,
+        profile: session.config.profile,
+        role: session.config.role,
+        model: session.config.model,
+        env: session.config.env,
+        mcpServers: session.config.mcpServers,
+        excludeMcpServers,
+        resolveCommand: opts.deps?.resolveCliExecutable,
+        onWarning: (message, details = {}) => {
+          eventLog.append("mcp_server_skipped", {
+            session: session.id,
+            message,
+            ...details,
+          });
+          emitter.emit("warning", {
+            type: "mcp_server_skipped",
+            session: session.id,
+            message,
+            ...details,
+          });
+        },
+      });
+    } catch (err) {
+      // respawnSession 은 `void` 로 호출되므로 여기서 던지면 처리되지 않은 거부가
+      // 된다. spec 생성 실패를 명시 실패로 접어 세션이 매달리지 않게 한다.
+      // 정책 차단과 그 밖의 spec 생성 실패는 원인이 다르므로 이벤트를 나눈다.
+      const message = err?.message || String(err);
+      const blockedByPolicy = err?.code === "TFX_CLI_DISABLED";
+      const eventName = blockedByPolicy
+        ? "session_spawn_blocked"
+        : "session_spawn_failed";
+      const reason = blockedByPolicy ? "spawn_blocked" : "spawn_failed";
+      const detail = {
+        session: session.id,
+        agent: session.config.agent,
+        code: err?.code || null,
+        error: message,
+      };
+      eventLog.append(eventName, detail);
+      emitter.emit("warning", { type: eventName, ...detail });
+      handleFailure(session, `${reason}:${message}`);
+      return;
+    }
 
     // #90 branch guard: shard spawn cwd가 main 브랜치면 즉시 abort.
     // swarm shard는 반드시 shard 전용 worktree 브랜치에서 실행되어야 한다.
@@ -1176,6 +1204,34 @@ export function createConductor(opts = {}) {
       }
     }
 
+    // TFX_DISABLE_* SSOT 집행. 계정 임대와 worker sandbox 생성보다 앞에 둔다.
+    // 뒤에 두면 정책으로 거부된 세션이 샌드박스 디렉터리와 auth.json 사본을
+    // 남기고, 임대 반납이 회로 차단기 실패로 집계돼 멀쩡한 계정이 cooldown 에
+    // 들어간다. 다른 CLI 로 자동 전환하지 않고 호출자에게 그대로 던진다.
+    // claude 처럼 정책 대상이 아닌 agent 는 프로파일 파일을 읽지 않는다 (F4 와 동일).
+    if (!config.remote && normalizeCliName(config.agent)) {
+      const blockedCli = buildDisabledCliError(
+        config.agent,
+        resolveCliPolicy(process.env),
+      );
+      if (blockedCli) {
+        eventLog.append("session_spawn_blocked", {
+          session: config.id,
+          agent: config.agent,
+          code: blockedCli.code || null,
+          error: blockedCli.message,
+        });
+        emitter.emit("warning", {
+          type: "session_spawn_blocked",
+          session: config.id,
+          agent: config.agent,
+          code: blockedCli.code || null,
+          error: blockedCli.message,
+        });
+        throw blockedCli;
+      }
+    }
+
     // broker lease (graceful — broker null if accounts.json absent)
     let lease = null;
     const activeBroker = getActiveBroker();