context-mode 1.0.162 → 1.0.164

package/hooks/copilot-cli/sessionstart.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+import "../suppress-stderr.mjs";
+import "../ensure-deps.mjs";
+
+import { createSessionLoaders } from "../session-loaders.mjs";
+import { createRoutingBlock } from "../routing-block.mjs";
+import { createToolNamer } from "../core/tool-naming.mjs";
+import { writeSessionEventsFile, buildSessionDirective, getSessionEvents } from "../session-directive.mjs";
+import {
+  readStdin,
+  parseStdin,
+  getSessionId,
+  getSessionDBPath,
+  getSessionEventsPath,
+  getCleanupFlagPath,
+  getInputProjectDir,
+  COPILOT_OPTS,
+  resolveConfigDir,
+} from "../session-helpers.mjs";
+import { join } from "node:path";
+import { readFileSync, unlinkSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const toolNamer = createToolNamer("copilot-cli");
+const ROUTING_BLOCK = createRoutingBlock(toolNamer);
+const HOOK_DIR = fileURLToPath(new URL(".", import.meta.url));
+const { loadSessionDB } = createSessionLoaders(HOOK_DIR);
+const OPTS = COPILOT_OPTS;
+
+let additionalContext = ROUTING_BLOCK;
+
+try {
+  const raw = await readStdin();
+  const input = parseStdin(raw);
+  const source = input.source ?? "startup";
+  const projectDir = getInputProjectDir(input, OPTS);
+
+  if (source === "compact") {
+    const { SessionDB } = await loadSessionDB();
+    const dbPath = getSessionDBPath(OPTS, projectDir);
+    const db = new SessionDB({ dbPath });
+    const sessionId = getSessionId(input, OPTS);
+    const resume = db.getResume(sessionId);
+
+    if (resume && !resume.consumed) {
+      db.markResumeConsumed(sessionId);
+    }
+
+    const events = getSessionEvents(db, sessionId);
+    if (events.length > 0) {
+      const eventMeta = writeSessionEventsFile(events, getSessionEventsPath(OPTS, projectDir));
+      additionalContext += buildSessionDirective("compact", eventMeta, toolNamer);
+    }
+
+    db.close();
+  } else if (source === "resume") {
+    try { unlinkSync(getCleanupFlagPath(OPTS, projectDir)); } catch { /* no flag */ }
+
+    const { SessionDB } = await loadSessionDB();
+    const dbPath = getSessionDBPath(OPTS, projectDir);
+    const db = new SessionDB({ dbPath });
+
+    const sessionId = getSessionId(input, OPTS);
+    const events = sessionId ? getSessionEvents(db, sessionId) : [];
+    if (events.length > 0) {
+      const eventMeta = writeSessionEventsFile(events, getSessionEventsPath(OPTS, projectDir));
+      additionalContext += buildSessionDirective("resume", eventMeta, toolNamer);
+    }
+
+    db.close();
+  } else if (source === "startup" || source === "new") {
+    const { SessionDB } = await loadSessionDB();
+    const dbPath = getSessionDBPath(OPTS, projectDir);
+    const db = new SessionDB({ dbPath });
+    try { unlinkSync(getSessionEventsPath(OPTS, projectDir)); } catch { /* no stale file */ }
+
+    db.cleanupOldSessions(7);
+    db.db.exec(`DELETE FROM session_events WHERE session_id NOT IN (SELECT session_id FROM session_meta)`);
+
+    const sessionId = getSessionId(input, OPTS);
+    db.ensureSession(sessionId, projectDir);
+
+    const ruleFilePaths = [
+      join(projectDir, ".github", "copilot-instructions.md"),
+      join(projectDir, "AGENTS.md"),
+    ];
+    for (const p of ruleFilePaths) {
+      try {
+        const content = readFileSync(p, "utf-8");
+        if (content.trim()) {
+          db.insertEvent(sessionId, { type: "rule", category: "rule", data: p, priority: 1 });
+          db.insertEvent(sessionId, { type: "rule_content", category: "rule", data: content, priority: 1 });
+        }
+      } catch {
+        /* file does not exist - skip */
+      }
+    }
+
+    db.close();
+  }
+} catch (err) {
+  // Error telemetry is opt-in via CONTEXT_MODE_DEBUG (same pattern as the kimi
+  // hooks) so we don't write an append-only log to every user's config dir on a
+  // transient SessionStart error. See #787 review.
+  if (process.env.CONTEXT_MODE_DEBUG) {
+    try {
+      const { appendFileSync, mkdirSync } = await import("node:fs");
+      const { join: pjoin, dirname: pdirname } = await import("node:path");
+      const logPath = pjoin(resolveConfigDir(OPTS), "context-mode", "sessionstart-debug.log");
+      mkdirSync(pdirname(logPath), { recursive: true });
+      appendFileSync(
+        logPath,
+        `[${new Date().toISOString()}] ${err?.message || err}\n${err?.stack || ""}\n`,
+      );
+    } catch {
+      /* ignore logging failure */
+    }
+  }
+}
+
+console.log(JSON.stringify({ additionalContext }));

package/hooks/copilot-cli/stop.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import "../suppress-stderr.mjs";
+import "../ensure-deps.mjs";
+/**
+ * GitHub Copilot CLI Stop hook — record session-end state for continuity.
+ * Capture-only (emits no output). Parsed via the shared session helpers with
+ * COPILOT_OPTS.
+ */
+
+import {
+  readStdin,
+  parseStdin,
+  getSessionId,
+  getSessionDBPath,
+  getInputProjectDir,
+  COPILOT_OPTS,
+} from "../session-helpers.mjs";
+import { createSessionLoaders } from "../session-loaders.mjs";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HOOK_DIR = dirname(fileURLToPath(import.meta.url));
+const { loadSessionDB } = createSessionLoaders(HOOK_DIR);
+const OPTS = COPILOT_OPTS;
+
+try {
+  const raw = await readStdin();
+  const input = parseStdin(raw);
+  const projectDir = getInputProjectDir(input, OPTS);
+
+  const { SessionDB } = await loadSessionDB();
+  const dbPath = getSessionDBPath(OPTS, projectDir);
+  const db = new SessionDB({ dbPath });
+  const sessionId = getSessionId(input, OPTS);
+
+  db.ensureSession(sessionId, projectDir);
+  // insertEvent hashes event.data, so type/category/priority/data are all
+  // required — a session_end with only `type` throws on createHash(undefined)
+  // and is silently dropped (the latent codex/stop.mjs bug). Provide real
+  // fields so the session-end row actually persists.
+  const lastMessage =
+    typeof input.last_assistant_message === "string"
+      ? input.last_assistant_message.slice(0, 2000)
+      : "";
+  db.insertEvent(
+    sessionId,
+    {
+      type: "session_end",
+      category: "session",
+      priority: 1,
+      data: lastMessage || "session ended",
+    },
+    "Stop",
+  );
+
+  db.close();
+} catch {
+  /* a hook must never fail the host */
+}

package/hooks/copilot-cli/userpromptsubmit.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+import "../suppress-stderr.mjs";
+import "../ensure-deps.mjs";
+/**
+ * GitHub Copilot CLI UserPromptSubmit hook — capture genuine user prompts for
+ * session continuity. Capture-only (emits no output; Copilot CLI ignores hook
+ * stdout in auto-run mode). Copilot fires this with a snake_case payload, parsed
+ * via the shared session helpers with COPILOT_OPTS.
+ */
+
+import {
+  readStdin,
+  parseStdin,
+  getSessionId,
+  getSessionDBPath,
+  getInputProjectDir,
+  COPILOT_OPTS,
+} from "../session-helpers.mjs";
+import { createSessionLoaders, attributeAndInsertEvents } from "../session-loaders.mjs";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HOOK_DIR = dirname(fileURLToPath(import.meta.url));
+const { loadSessionDB, loadExtract, loadProjectAttribution } = createSessionLoaders(HOOK_DIR);
+const OPTS = COPILOT_OPTS;
+
+try {
+  const raw = await readStdin();
+  const input = parseStdin(raw);
+  const projectDir = getInputProjectDir(input, OPTS);
+
+  const prompt = input.prompt ?? input.user_prompt ?? input.message ?? "";
+  const trimmed = (typeof prompt === "string" ? prompt : "").trim();
+
+  // Skip host-injected system/tool envelopes — only capture genuine user input.
+  const isSystemMessage =
+    trimmed.startsWith("<task-notification>") ||
+    trimmed.startsWith("<system-reminder>") ||
+    trimmed.startsWith("<context_guidance>") ||
+    trimmed.startsWith("<tool-result>");
+
+  if (trimmed.length > 0 && !isSystemMessage) {
+    const { SessionDB } = await loadSessionDB();
+    const { extractUserEvents } = await loadExtract();
+    const { resolveProjectAttributions } = await loadProjectAttribution();
+    const dbPath = getSessionDBPath(OPTS, projectDir);
+    const db = new SessionDB({ dbPath });
+    const sessionId = getSessionId(input, OPTS);
+
+    db.ensureSession(sessionId, projectDir);
+
+    const promptEvent = { type: "user_prompt", category: "user-prompt", data: prompt, priority: 1 };
+    const promptAttributions = attributeAndInsertEvents(
+      db, sessionId, [promptEvent], input, projectDir, "UserPromptSubmit", resolveProjectAttributions,
+    );
+
+    const userEvents = extractUserEvents(trimmed);
+    const sessionStats = db.getSessionStats?.(sessionId);
+    const lastKnownProjectDir =
+      typeof db.getLatestAttributedProjectDir === "function"
+        ? db.getLatestAttributedProjectDir(sessionId)
+        : null;
+    const userAttributions = resolveProjectAttributions(userEvents, {
+      sessionOriginDir: sessionStats?.project_dir || projectDir,
+      inputProjectDir: projectDir,
+      workspaceRoots: Array.isArray(input.workspace_roots) ? input.workspace_roots : [],
+      lastKnownProjectDir: promptAttributions[0]?.projectDir || lastKnownProjectDir,
+    });
+    for (let i = 0; i < userEvents.length; i++) {
+      db.insertEvent(sessionId, userEvents[i], "UserPromptSubmit", userAttributions[i]);
+    }
+
+    db.close();
+  }
+} catch {
+  /* a hook must never fail the host */
+}

package/hooks/core/codex-caps.mjs

@@ -0,0 +1,112 @@
+/**
+ * Codex capability detection for the PreToolUse formatter (#845).
+ *
+ * Recent Codex builds honor PreToolUse `permissionDecision:"allow" + updatedInput`
+ * (command rewrite) and `additionalContext`. Older builds reject/ignore those
+ * fields. context-mode must emit the rewrite shape ONLY when the running Codex
+ * supports it and otherwise fail closed (deny) — it must never silently pass a
+ * redirect through.
+ *
+ * Detection parses `codex --version` and compares it against the first version
+ * verified to honor the contract. The result is cached to a temp file with a
+ * short TTL so the hot PreToolUse path does not spawn a process on every tool
+ * call. Any failure (no codex on PATH, parse error) → false → fail closed.
+ *
+ * There is intentionally NO opt-in env flag — those rot into dead code because
+ * nobody exercises the off-by-default path. The correct behavior is detected at
+ * runtime so it is always the default.
+ */
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * First Codex release verified to honor PreToolUse allow+updatedInput and
+ * additionalContext: codex-cli 0.141.0 (#845, validated against the shipped
+ * binary's output_parser). Below this we fail closed.
+ */
+export const MIN_REWRITE_VERSION = [0, 141, 0];
+
+const CACHE_TTL_MS = 60 * 60 * 1000; // re-probe at most hourly
+const CACHE_FILE = "context-mode-codex-caps.json";
+
+/** Parse a `codex --version` line ("codex-cli 0.141.0") → [major, minor, patch]. */
+export function parseCodexVersion(raw) {
+  const s = String(raw ?? "");
+  const isDigit = (c) => c >= "0" && c <= "9";
+  for (let i = 0; i < s.length; i++) {
+    let j = i;
+    const parts = [];
+    while (parts.length < 3) {
+      const start = j;
+      while (j < s.length && isDigit(s[j])) j++;
+      if (j === start) break; // no digits where a number was expected
+      parts.push(Number(s.slice(start, j)));
+      if (parts.length < 3) {
+        if (s[j] !== ".") break; // separator must be a dot
+        j++;
+      }
+    }
+    if (parts.length === 3) return parts;
+  }
+  return null;
+}
+
+/** Semantic ">=" over [major, minor, patch] tuples. */
+export function versionGte(a, b) {
+  for (let i = 0; i < 3; i++) {
+    const x = a[i] ?? 0;
+    const y = b[i] ?? 0;
+    if (x > y) return true;
+    if (x < y) return false;
+  }
+  return true;
+}
+
+function defaultRunVersion() {
+  const opts = { encoding: "utf8", timeout: 2000, stdio: ["ignore", "pipe", "ignore"] };
+  // Mirror the adapter's cross-platform probe (src/adapters/codex/index.ts):
+  // on Windows `codex` resolves to a .cmd shim that execFile cannot launch
+  // directly, so route through cmd.exe.
+  return process.platform === "win32"
+    ? execFileSync("cmd.exe", ["/d", "/s", "/c", "codex --version"], opts)
+    : execFileSync("codex", ["--version"], opts);
+}
+
+/**
+ * Whether the running Codex honors PreToolUse allow+updatedInput /
+ * additionalContext. Fails closed (false) on any error. Cached to a temp file
+ * with a TTL so the hot path avoids per-call process spawns.
+ *
+ * @param {object} [io] test seams
+ * @param {() => string} [io.runVersion] returns `codex --version` stdout
+ * @param {() => number}  [io.now]        clock in ms
+ * @param {string}        [io.cachePath]  cache file path
+ * @returns {boolean}
+ */
+export function codexSupportsUpdatedInput(io = {}) {
+  const now = io.now ?? Date.now;
+  const cachePath = io.cachePath ?? join(tmpdir(), CACHE_FILE);
+  const runVersion = io.runVersion ?? defaultRunVersion;
+
+  // Fast path: a non-expired cache entry.
+  try {
+    const cached = JSON.parse(readFileSync(cachePath, "utf8"));
+    if (cached && typeof cached.at === "number" && now() - cached.at < CACHE_TTL_MS) {
+      return cached.supported === true;
+    }
+  } catch { /* cache miss / corrupt — re-detect below */ }
+
+  let supported = false;
+  try {
+    const version = parseCodexVersion(runVersion());
+    supported = version ? versionGte(version, MIN_REWRITE_VERSION) : false;
+  } catch {
+    supported = false; // no codex on PATH / probe failed → fail closed
+  }
+
+  try { writeFileSync(cachePath, JSON.stringify({ at: now(), supported })); } catch { /* best effort */ }
+
+  return supported;
+}

package/hooks/core/formatters.mjs

@@ -105,6 +105,29 @@ export const formatters = {
     }),
   },
 
+  // GitHub Copilot CLI uses top-level decision fields (NOT the VS Code
+  // hookSpecificOutput wrapper) — matches CopilotCliAdapter.format*Response.
+  "copilot-cli": {
+    deny: (reason) => ({
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    }),
+    // Carry the reason on `ask` too, so the user sees WHY confirmation is
+    // requested (Copilot CLI honors permissionDecisionReason; matches the
+    // adapter's formatPreToolUseResponse ask branch). Fall back when the
+    // routing decision carries no reason, so the prompt is never bare.
+    ask: (reason) => ({
+      permissionDecision: "ask",
+      permissionDecisionReason: reason ?? "Action requires user confirmation",
+    }),
+    modify: (updatedInput) => ({
+      modifiedArgs: updatedInput,
+    }),
+    context: (additionalContext) => ({
+      additionalContext,
+    }),
+  },
+
   "jetbrains-copilot": {
     deny: (reason) => ({
       permissionDecision: "deny",
@@ -137,9 +160,44 @@ export const formatters = {
         permissionDecisionReason: reason,
       },
     }),
-    ask: () => null, // Codex rejects permissionDecision: "ask" in PreToolUse
-    modify: () => null, // Codex rejects updatedInput in PreToolUse
-    context: () => null, // Codex rejects additionalContext in PreToolUse (fails open)
+    // Codex still rejects permissionDecision:"ask" in PreToolUse (verified
+    // against codex-cli 0.141.0 output_parser.rs). Keep dropping it.
+    ask: () => null,
+    // #845: modern Codex (>= 0.141.0) honors permissionDecision:"allow" +
+    // updatedInput (command rewrite). Emit it when the running Codex supports
+    // it; otherwise FAIL CLOSED — turn the redirect into an enforceable deny
+    // carrying the same guidance, so the bytes-flood guard never silently
+    // passes through. `codexSupportsRewrite` is detected at runtime by the
+    // codex hook (hooks/core/codex-caps.mjs) and threaded in via formatDecision.
+    modify: (updatedInput, { codexSupportsRewrite } = {}) => {
+      if (codexSupportsRewrite) {
+        return {
+          hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "allow",
+            updatedInput,
+          },
+        };
+      }
+      const ui = updatedInput ?? {};
+      // Only command redirects must fail closed. Non-command rewrites (e.g.
+      // Agent prompt injection) are advisory — drop rather than block the tool.
+      if (!("command" in ui)) return null;
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: codexRedirectReason(ui.command),
+        },
+      };
+    },
+    // #845: surface additionalContext on Codex builds that support it; older
+    // builds ignore the field, so drop the advisory nudge rather than emit a
+    // shape they reject.
+    context: (additionalContext, { codexSupportsRewrite } = {}) =>
+      codexSupportsRewrite
+        ? { hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext } }
+        : null,
   },
 
   "kimi": {
@@ -168,6 +226,36 @@ export const formatters = {
     context: () => null, // Kimi HookResult has no additionalContext field
   },
 
+  "antigravity-cli": {
+    // agy PreToolUse accepts the Claude-compatible top-level decision shape.
+    // agy 1.0.6 does NOT honor PreToolUse additionalContext (verified by
+    // transcript probe), so context guidance must become an enforceable deny
+    // or it disappears and the native tool runs unchanged.
+    deny: (reason) => ({ decision: "deny", reason }),
+    // Carry a fallback reason on `ask` so a security-policy ask (routing emits
+    // {action:"ask"} with no reason) never shows a bare, unexplained prompt.
+    ask: (reason) => ({ decision: "ask", reason: reason ?? "Action requires user confirmation" }),
+    // agy cannot modify tool args, so a routing `modify` becomes a deny. Surface
+    // the per-tool redirect guidance routing carried in `updatedInput.command`
+    // (an `echo "<guidance>"` payload that already uses agy's context-mode/<tool>
+    // surface) instead of a generic line; fall back to the generic redirect.
+    modify: (updatedInput) => {
+      const cmd = updatedInput?.command ?? updatedInput?.CommandLine ?? "";
+      const m = String(cmd).match(/^echo\s+"([\s\S]*)"\s*$/);
+      const guidance = m ? m[1].replace(/\\(["\\])/g, "$1") : "";
+      return {
+        decision: "deny",
+        reason:
+          guidance ||
+          "context-mode: redirected. Use the context-mode MCP tools (ctx_execute / ctx_fetch_and_index / ctx_search) so raw bytes stay out of the conversation.",
+      };
+    },
+    context: (additionalContext) => ({
+      decision: "deny",
+      reason: agyContextReason(additionalContext),
+    }),
+  },
+
   "cursor": {
     deny: (reason) => ({
       permission: "deny",
@@ -185,11 +273,72 @@ export const formatters = {
   },
 };
 
+// Keep in sync with the identical agyContextReason in
+// src/adapters/antigravity-cli/index.ts: this bundled .mjs formatter (runtime
+// hook path) and the TS adapter are separate layers; the text must not drift.
+function agyContextReason(additionalContext) {
+  const text = String(additionalContext ?? "")
+    .replace(/<\/?context_guidance>/g, " ")
+    .replace(/<\/?tip>/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+  return text
+    ? `context-mode: use the context-mode MCP tools instead of this native tool. ${text}`
+    : "context-mode: use the context-mode MCP tools instead of this native tool so raw bytes stay out of the conversation.";
+}
+
+// #845: routing wraps redirect guidance as `echo "<guidance>"`. Unwrap a command
+// that is exactly `echo "<inner>"` (with optional surrounding whitespace) and
+// return the inner string, or null when the shape doesn't match. Greedy: inner
+// runs from the first `"` after `echo` to the last `"` before trailing space.
+function unwrapEcho(command) {
+  const s = String(command ?? "");
+  // Match the regex `\s` class exactly: space, tab, newline, carriage return,
+  // form feed, vertical tab (so behavior is identical to /^echo\s+"…"\s*$/).
+  const isWs = (c) =>
+    c === " " || c === "\t" || c === "\n" || c === "\r" || c === "\f" || c === "\v";
+  if (!s.startsWith("echo")) return null;
+  let i = 4;
+  if (i >= s.length || !isWs(s[i])) return null; // `echo` must be followed by whitespace
+  while (i < s.length && isWs(s[i])) i++;
+  if (s[i] !== "\"") return null; // payload must open with a quote
+  let end = s.length;
+  while (end > 0 && isWs(s[end - 1])) end--; // drop trailing whitespace
+  if (end <= i + 1 || s[end - 1] !== "\"") return null; // must close with a quote
+  return s.slice(i + 1, end - 1);
+}
+
+// Reverse the shell double-quote escaping routing applied: `\"` → `"`, `\\` → `\`.
+function unescapeDquote(s) {
+  let out = "";
+  for (let i = 0; i < s.length; i++) {
+    if (s[i] === "\\" && (s[i + 1] === "\"" || s[i + 1] === "\\")) {
+      out += s[i + 1];
+      i++;
+    } else {
+      out += s[i];
+    }
+  }
+  return out;
+}
+
+// When Codex cannot rewrite the command we surface that guidance as the deny
+// reason instead (mirrors the claude-code / antigravity-cli echo extraction).
+function codexRedirectReason(command) {
+  const inner = unwrapEcho(command);
+  if (inner !== null) return unescapeDquote(inner);
+  return "context-mode: command redirected. Use the context-mode MCP tools (ctx_execute / ctx_fetch_and_index / ctx_search) so raw output stays out of the conversation.";
+}
+
 /**
  * Apply a formatter to a normalized routing decision.
  * Returns the platform-specific JSON response, or null for passthrough.
+ *
+ * `opts` carries optional per-platform capability hints (e.g. codex
+ * `codexSupportsRewrite`). Formatters that ignore the extra argument are
+ * unaffected.
  */
-export function formatDecision(platform, decision) {
+export function formatDecision(platform, decision, opts = {}) {
   if (!decision) return null;
 
   const fmt = formatters[platform];
@@ -197,9 +346,11 @@ export function formatDecision(platform, decision) {
 
   switch (decision.action) {
     case "deny": return fmt.deny(decision.reason);
-    case "ask": return fmt.ask();
-    case "modify": return fmt.modify(decision.updatedInput);
-    case "context": return fmt.context(decision.additionalContext);
+    // Pass the reason to ask() too — platforms whose ask formatter ignores it
+    // (legacy `ask: () => …`) are unaffected; copilot-cli surfaces it.
+    case "ask": return fmt.ask(decision.reason);
+    case "modify": return fmt.modify(decision.updatedInput, opts);
+    case "context": return fmt.context(decision.additionalContext, opts);
     default: return null;
   }
 }

package/hooks/core/mcp-ready.mjs

@@ -11,12 +11,22 @@
  * Sentinel path: <tmpRoot>/context-mode-mcp-ready-<MCP_PID>
  * Scan: glob all context-mode-mcp-ready-* files, probe each PID.
  */
-import { readFileSync, readdirSync, unlinkSync } from "node:fs";
+import { readFileSync, readdirSync, statSync, unlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 const SENTINEL_PREFIX = "context-mode-mcp-ready-";
 
+/**
+ * Sentinel freshness window (#844). The MCP server refreshes its sentinel's
+ * mtime every 30s while alive (see `main()` in src/server.ts). A sentinel
+ * touched within this window is treated as a live server even when
+ * `process.kill(pid, 0)` cannot see the PID — e.g. a sandbox sharing /tmp
+ * across an isolated PID namespace, where the live host PID is invisible.
+ * 90s = 3x the server refresh interval, tolerant of scheduler jitter / load.
+ */
+const SENTINEL_FRESH_MS = 90_000;
+
 /**
  * Resolve the temp root — hardcoded /tmp on Unix to avoid TMPDIR mismatch.
  * Tests may override via CONTEXT_MODE_MCP_SENTINEL_DIR to isolate scan from
@@ -54,23 +64,42 @@ export function sentinelPath() {
  *
  * Handles:
  * - PPID mismatch (WSL2 shell wrappers) — no ppid dependency
- * - Stale sentinels (SIGKILL, OOM) — PID liveness check
+ * - Stale sentinels (SIGKILL, OOM) — PID liveness check + age threshold
  * - TMPDIR mismatch — hardcoded /tmp on Unix
+ * - Shared /tmp across isolated PID namespaces (#844) — a live host PID is
+ *   invisible to `kill(pid, 0)` from a sandbox, so a recently-refreshed
+ *   sentinel is trusted instead of being deleted.
  */
 export function isMCPReady() {
   try {
     const dir = sentinelDir();
     const files = readdirSync(dir).filter(f => f.startsWith(SENTINEL_PREFIX));
+    const now = Date.now();
     for (const f of files) {
       const fullPath = join(dir, f);
+      let pid;
       try {
-        const pid = parseInt(readFileSync(fullPath, "utf8"), 10);
-        if (isNaN(pid)) continue;
-        process.kill(pid, 0); // throws if process doesn't exist
-        return true;
+        pid = parseInt(readFileSync(fullPath, "utf8"), 10);
       } catch {
-        // Dead PID or unreadable — clean up stale sentinel
-        try { unlinkSync(fullPath); } catch {}
+        // Unreadable (torn mid-write) — leave it for the owner / a later scan.
+        continue;
+      }
+      if (isNaN(pid)) continue;
+      try {
+        process.kill(pid, 0); // throws if the PID is not signalable from here
+        return true;          // same-namespace liveness confirmed
+      } catch (err) {
+        // EPERM: the process exists but is owned by another user → alive.
+        if (err && err.code === "EPERM") return true;
+        // ESRCH (or anything else): the PID is invisible from THIS namespace.
+        // That is NOT proof the server is dead — a shared /tmp across isolated
+        // PID namespaces (#844) hides a live host PID. Trust a recently
+        // refreshed sentinel rather than delete a live server's marker.
+        let ageMs = Infinity;
+        try { ageMs = now - statSync(fullPath).mtimeMs; } catch { /* stat failed → treat as stale */ }
+        if (ageMs < SENTINEL_FRESH_MS) return true;
+        // Old AND unprobeable → genuinely stale (crash / OOM / SIGKILL) → clean up.
+        try { unlinkSync(fullPath); } catch { /* best effort */ }
       }
     }
     return false;