grepmax 0.26.54 → 0.26.56

package/dist/lib/utils/daemon-launcher.js

@@ -48,6 +48,7 @@ const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const config_1 = require("../../config");
+const autostart_1 = require("./autostart");
 const log_rotate_1 = require("./log-rotate");
 /**
  * Spawn the daemon in background mode.
@@ -56,6 +57,8 @@ const log_rotate_1 = require("./log-rotate");
 function spawnDaemon() {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
+        if ((0, autostart_1.daemonStartDeniedReason)() !== null)
+            return null;
         let out = null;
         try {
             const logFile = path.join(config_1.PATHS.logsDir, "daemon.log");
@@ -90,6 +93,9 @@ function spawnDaemon() {
  */
 function spawnDaemonProcess() {
     return __awaiter(this, void 0, void 0, function* () {
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null)
+            throw new Error(`gmax: ${denied}`);
         const logFile = path.join(config_1.PATHS.logsDir, "daemon.log");
         const out = (0, log_rotate_1.openRotatedLog)(logFile);
         try {

package/dist/lib/utils/kernel-zone.js

@@ -1,6 +1,20 @@
 "use strict";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ZONE_THRESHOLDS = void 0;
+exports.formatPressureProbe = formatPressureProbe;
+exports.probeKernelZoneUsage = probeKernelZoneUsage;
+exports.probeMemoryPressure = probeMemoryPressure;
 exports.classifyZonePressure = classifyZonePressure;
 exports.parseZprintOutput = parseZprintOutput;
 exports.readKernelZoneUsage = readKernelZoneUsage;
@@ -21,11 +35,15 @@ const node_child_process_1 = require("node:child_process");
  * docs/2026-08-04-macos-kernel-zone-panic-incident.md.
  *
  * gmax cannot fix the kernel defect, but it can decline to be the thing that
- * detonates it. Sampling the zone is cheap (~0.2 s), so the daemon watches its own
- * blast radius and stands down while there are still hours of headroom.
+ * detonates it. Sampling the zone has taken 1.584 s on the incident host, so the
+ * probe uses a bounded five-second budget. The daemon stands down while there
+ * are still hours of headroom.
  */
 /** The zone that leaks. Named explicitly so `zprint` returns a single line. */
 const ZONE_NAME = "data.kalloc.1024";
+// Two 500 ms probes timed out on the incident host; a subsequent probe completed
+// in 1,584 ms. Keep the previous five-second ceiling to allow scheduling margin.
+const PROBE_TIMEOUT_MS = 5000;
 /**
  * Warn threshold.
  *
@@ -45,6 +63,122 @@ const WARN_BYTES = 4 * Math.pow(1024, 3);
  * is an unplanned reboot.
  */
 const CRITICAL_BYTES = 8 * Math.pow(1024, 3);
+/** Compact diagnostic metadata; never serializes raw probe output or errors. */
+function formatPressureProbe(result) {
+    return JSON.stringify(Object.assign(Object.assign({ status: result.status, sampledAtMs: result.sampledAtMs, durationMs: result.durationMs, outputBytes: result.outputBytes }, (result.status !== "known" ? { reason: result.reason } : {})), (result.status === "unknown"
+        ? {
+            errorCode: result.errorCode,
+            exitCode: result.exitCode,
+            signal: result.signal,
+        }
+        : {})));
+}
+const PROBE_ERROR_CODES = new Set([
+    "ETIMEDOUT",
+    "ENOBUFS",
+    "ERR_CHILD_PROCESS_STDIO_MAXBUFFER",
+    "ENOENT",
+    "EACCES",
+    "EPERM",
+]);
+const PROBE_SIGNALS = new Set(["SIGTERM", "SIGKILL", "SIGABRT", "SIGSEGV"]);
+function stdoutBytes(output) {
+    return typeof output === "string"
+        ? Buffer.byteLength(output)
+        : Buffer.isBuffer(output)
+            ? output.length
+            : 0;
+}
+function boundedPressureProbe(command, args, timeout, parse, overrides) {
+    const deps = Object.assign({ platform: process.platform, wallNow: Date.now, monotonicNow: () => performance.now(), run: (cmd, argv, options) => (0, node_child_process_1.execFileSync)(cmd, argv, options) }, overrides);
+    const sampledAtMs = deps.wallNow();
+    const started = deps.monotonicNow();
+    let outputBytes = 0;
+    const observation = () => ({
+        sampledAtMs,
+        durationMs: Math.max(0, deps.monotonicNow() - started),
+        outputBytes,
+    });
+    if (deps.platform !== "darwin")
+        return Object.assign(Object.assign({}, observation()), { status: "unsupported", reason: "unsupported-platform" });
+    try {
+        const output = deps.run(command, args, {
+            encoding: "utf-8",
+            timeout,
+            maxBuffer: 64 * 1024,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        outputBytes = stdoutBytes(output);
+        const value = parse(output);
+        return value === null
+            ? Object.assign(Object.assign({}, observation()), { status: "unknown", reason: "parse", errorCode: null, exitCode: null, signal: null }) : Object.assign(Object.assign({}, observation()), { status: "known", value });
+    }
+    catch (error) {
+        const details = error && typeof error === "object"
+            ? error
+            : {};
+        outputBytes = stdoutBytes(details.stdout);
+        const errorCode = typeof details.code === "string" && PROBE_ERROR_CODES.has(details.code)
+            ? details.code
+            : details.code == null
+                ? null
+                : "UNKNOWN";
+        const exitCode = typeof details.status === "number" && Number.isInteger(details.status)
+            ? details.status
+            : null;
+        const signal = typeof details.signal === "string" && PROBE_SIGNALS.has(details.signal)
+            ? details.signal
+            : null;
+        const reason = errorCode === "ETIMEDOUT"
+            ? "timeout"
+            : errorCode === "ENOBUFS" ||
+                errorCode === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER"
+                ? "output-limit"
+                : exitCode !== null || signal !== null
+                    ? "exit"
+                    : "execution";
+        return Object.assign(Object.assign({}, observation()), { status: "unknown", reason,
+            errorCode,
+            exitCode,
+            signal });
+    }
+}
+function probeKernelZoneUsage(zoneName = ZONE_NAME, overrides = {}) {
+    const result = boundedPressureProbe("zprint", [zoneName], PROBE_TIMEOUT_MS, (output) => {
+        const parsed = parseZprintOutput(output, zoneName);
+        if (!parsed)
+            return null;
+        const bytes = parsed.elements * parsed.elementSize;
+        if (!Number.isSafeInteger(bytes))
+            return null;
+        return Object.assign(Object.assign({}, parsed), { bytes, pressure: classifyZonePressure(bytes) });
+    }, overrides);
+    if (result.status !== "known")
+        return result;
+    const { value } = result, observation = __rest(result, ["value"]);
+    return Object.assign(Object.assign({}, observation), { usage: value });
+}
+/** XNU publishes dispatch flags NORMAL=1, WARN=2, CRITICAL=4 through this sysctl.
+ * https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/kern_memorystatus_notify.c
+ * Other values are unknown, including the unrelated internal kernel enum. */
+function probeMemoryPressure(overrides = {}) {
+    const result = boundedPressureProbe("sysctl", ["-n", "kern.memorystatus_vm_pressure_level"], 1000, (output) => {
+        switch (output.trim()) {
+            case "1":
+                return "normal";
+            case "2":
+                return "warn";
+            case "4":
+                return "critical";
+            default:
+                return null;
+        }
+    }, overrides);
+    if (result.status !== "known")
+        return result;
+    const { value } = result, observation = __rest(result, ["value"]);
+    return Object.assign(Object.assign({}, observation), { pressure: value });
+}
 function classifyZonePressure(bytes) {
     if (bytes >= CRITICAL_BYTES)
         return "critical";
@@ -84,27 +218,12 @@ function parseZprintOutput(output, zoneName = ZONE_NAME) {
 }
 /**
  * Sample the zone. Returns null off macOS, or whenever the sample cannot be
- * trusted — an unparseable report must read as "unknown", never as "healthy" and
- * never as a reason to stop working.
+ * trusted. An unparseable or timed-out report reads as "unknown", never as
+ * "healthy". macOS startup and heavy-operation admission refuse unknown samples.
  */
 function readKernelZoneUsage(zoneName = ZONE_NAME) {
-    if (process.platform !== "darwin")
-        return null;
-    try {
-        const output = (0, node_child_process_1.execFileSync)("zprint", [zoneName], {
-            encoding: "utf-8",
-            timeout: 5000,
-            stdio: ["ignore", "pipe", "ignore"],
-        });
-        const parsed = parseZprintOutput(output, zoneName);
-        if (!parsed)
-            return null;
-        const bytes = parsed.elements * parsed.elementSize;
-        return Object.assign(Object.assign({}, parsed), { bytes, pressure: classifyZonePressure(bytes) });
-    }
-    catch (_a) {
-        return null;
-    }
+    const result = probeKernelZoneUsage(zoneName);
+    return result.status === "known" ? result.usage : null;
 }
 function formatZoneUsage(usage) {
     const gib = (usage.bytes / Math.pow(1024, 3)).toFixed(2);

package/dist/lib/utils/safety-latch.js

@@ -0,0 +1,121 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFETY_LATCH_NAME = void 0;
+exports.safetyStopReason = safetyStopReason;
+exports.latchSafetyStop = latchSafetyStop;
+exports.assertNoSafetyStop = assertNoSafetyStop;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const config_1 = require("../../config");
+/** Machine-wide stop: changing stores or installing a version cannot clear it. */
+exports.SAFETY_LATCH_NAME = "safety-stop.json";
+function safetyRoot() {
+    var _a;
+    return (_a = config_1.PATHS.sharedRoot) !== null && _a !== void 0 ? _a : path.dirname(config_1.PATHS.autostartDisabledFile);
+}
+/** Absence is distinct from an unreadable/corrupt stop, which stays stopped. */
+function safetyStopReason(root = safetyRoot()) {
+    const file = path.join(root, exports.SAFETY_LATCH_NAME);
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.size > 8192)
+            return "unverified safety stop";
+        const value = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (value.schemaVersion !== 1 ||
+            !Number.isFinite(value.at) ||
+            typeof value.reason !== "string" ||
+            !value.reason.trim())
+            return "unverified safety stop";
+        return value.reason.replace(/[\r\n\t]/g, " ").slice(0, 512);
+    }
+    catch (error) {
+        return error.code === "ENOENT"
+            ? null
+            : "unreadable safety stop";
+    }
+}
+/** Atomic durable latch; intentionally no automatic expiry or clear operation. */
+function latchSafetyStop(reason, root = safetyRoot()) {
+    if (safetyStopReason(root) !== null)
+        return;
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    fs.chmodSync(root, 0o700);
+    const file = path.join(root, exports.SAFETY_LATCH_NAME);
+    const temporary = path.join(root, `.safety-stop-${(0, node_crypto_1.randomUUID)()}.tmp`);
+    let fd;
+    try {
+        fd = fs.openSync(temporary, "wx", 0o600);
+        const record = {
+            schemaVersion: 1,
+            at: Date.now(),
+            reason: reason.replace(/[\r\n\t]/g, " ").slice(0, 512) || "host safety stop",
+        };
+        fs.writeFileSync(fd, `${JSON.stringify(record)}\n`);
+        fs.fsyncSync(fd);
+        fs.closeSync(fd);
+        fd = undefined;
+        // Publish without replacing another concurrent stop's original cause.
+        try {
+            fs.linkSync(temporary, file);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        // Persist the directory entry, not only the payload, before stopping.
+        const dir = fs.openSync(root, "r");
+        try {
+            fs.fsyncSync(dir);
+        }
+        finally {
+            fs.closeSync(dir);
+        }
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (_a) { }
+    }
+}
+function assertNoSafetyStop() {
+    const reason = safetyStopReason();
+    if (reason !== null)
+        throw new Error(`gmax safety stop: ${reason}; containment must be reviewed before resuming`);
+}

package/dist/lib/workers/pool.js

@@ -57,7 +57,10 @@ const path = __importStar(require("node:path"));
 const config_1 = require("../../config");
 const embedding_generation_1 = require("../index/embedding-generation");
 const index_config_1 = require("../index/index-config");
+const autostart_1 = require("../utils/autostart");
+const kernel_zone_1 = require("../utils/kernel-zone");
 const logger_1 = require("../utils/logger");
+const safety_latch_1 = require("../utils/safety-latch");
 const TASK_TIMEOUT_MS = (() => {
     var _a;
     const fromEnv = Number.parseInt((_a = process.env.GMAX_WORKER_TASK_TIMEOUT_MS) !== null && _a !== void 0 ? _a : "", 10);
@@ -221,6 +224,7 @@ class WorkerPool {
         this.destroyPromise = null;
         this.consecutiveRespawns = 0;
         this.respawnLimitReached = false;
+        this.spawnDeniedReason = null;
         this.idleReapInterval = null;
         // Re-runs dispatch once the oldest unassigned task reaches SCALE_UP_WAIT_MS.
         this.scaleUpTimer = null;
@@ -237,7 +241,8 @@ class WorkerPool {
         // process environment remains live and is copied at each fork.
         this.embeddingEnvironment = Object.freeze(generatedEmbeddingEnv);
         // Lazy spawn: start with 1 worker, scale up on demand
-        this.spawnWorker();
+        if (!this.spawnWorker())
+            throw this.spawnDeniedError();
         // Periodically reap idle workers back to MIN_KEEP, and force-kill any
         // worker wedged in busy=true (the leak backstop — see STUCK_BUSY_MS).
         this.idleReapInterval = setInterval(() => {
@@ -247,7 +252,7 @@ class WorkerPool {
         }, IDLE_WORKER_TIMEOUT_MS);
     }
     isHealthy() {
-        return !this.destroyed && this.workers.length > 0;
+        return (!this.destroyed && !this.spawnDeniedReason && this.workers.length > 0);
     }
     /** PIDs of workers the pool currently tracks. Used by the daemon's orphan
      * sweep to distinguish live, accounted-for workers from de-listed strays. */
@@ -287,16 +292,16 @@ class WorkerPool {
         });
         return hasUnassigned(this.priorityQueue) || hasUnassigned(this.taskQueue);
     }
-    rejectUnassignedTasks(message) {
+    rejectUnassignedTasks(message, code) {
         for (const task of Array.from(this.tasks.values())) {
             if (task.worker)
                 continue;
-            task.reject(new Error(message));
+            task.reject(Object.assign(new Error(message), code ? { code } : {}));
             this.completeTask(task, null);
         }
     }
     maybeRespawn(reason, hasPendingTasks) {
-        if (this.destroyed || this.respawnLimitReached)
+        if (this.destroyed || this.spawnDeniedReason || this.respawnLimitReached)
             return false;
         this.consecutiveRespawns++;
         (0, logger_1.log)("pool", `respawn #${this.consecutiveRespawns} after ${reason} (workers=${this.workers.length} pending=${hasPendingTasks})`);
@@ -308,8 +313,7 @@ class WorkerPool {
                 this.rejectUnassignedTasks(message);
             return false;
         }
-        this.spawnWorker();
-        return true;
+        return this.spawnWorker();
     }
     completeTask(task, worker) {
         this.clearTaskTimeout(task);
@@ -357,8 +361,69 @@ class WorkerPool {
             this.dispatch();
         }
     }
+    spawnDeniedError() {
+        var _a;
+        return Object.assign(new Error((_a = this.spawnDeniedReason) !== null && _a !== void 0 ? _a : "Worker spawn denied"), { code: "HOST_SAFETY" });
+    }
+    denySpawn(reason, persist = true) {
+        // A pool cannot automatically recover after a failed admission. In
+        // particular, timer/exit callbacks must not retry forks or strand queues.
+        this.spawnDeniedReason = `Worker spawn denied: ${reason}`;
+        this.clearScaleUpTimer();
+        if (persist) {
+            try {
+                (0, safety_latch_1.latchSafetyStop)(this.spawnDeniedReason);
+            }
+            catch (_a) {
+                try {
+                    (0, logger_1.log)("pool", "worker admission denied; safety latch persistence failed");
+                }
+                catch (_b) { }
+            }
+        }
+        this.rejectUnassignedTasks(this.spawnDeniedReason, "HOST_SAFETY");
+        try {
+            (0, logger_1.log)("pool", this.spawnDeniedReason);
+        }
+        catch (_c) { }
+        return false;
+    }
     spawnWorker() {
-        const worker = new ProcessWorker(this.modulePath, this.execArgv, this.embeddingEnvironment, config_1.MAX_WORKER_MEMORY_MB);
+        if (this.destroyed || this.spawnDeniedReason)
+            return false;
+        let worker;
+        try {
+            const quarantine = (0, autostart_1.daemonStartDeniedReason)();
+            if (quarantine)
+                return this.denySpawn(quarantine, false);
+            if (process.platform === "darwin") {
+                const memory = (0, kernel_zone_1.probeMemoryPressure)();
+                if (memory.status !== "known" || memory.pressure !== "normal") {
+                    return this.denySpawn(`OS memory pressure ${memory.status === "known" ? memory.pressure : memory.status}; ${(0, kernel_zone_1.formatPressureProbe)(memory)}`);
+                }
+                const kernel = (0, kernel_zone_1.probeKernelZoneUsage)();
+                if (kernel.status !== "known" || kernel.usage.pressure !== "ok") {
+                    return this.denySpawn(`kernel pressure ${kernel.status === "known" ? kernel.usage.pressure : kernel.status}; ${(0, kernel_zone_1.formatPressureProbe)(kernel)}`);
+                }
+            }
+            if (process.platform === "darwin") {
+                // Refresh the cheap OS sample after the potentially slow kernel probe.
+                const freshMemory = (0, kernel_zone_1.probeMemoryPressure)();
+                if (freshMemory.status !== "known" ||
+                    freshMemory.pressure !== "normal") {
+                    return this.denySpawn(`OS memory pressure ${freshMemory.status === "known" ? freshMemory.pressure : freshMemory.status}; ${(0, kernel_zone_1.formatPressureProbe)(freshMemory)}`);
+                }
+            }
+            // Probes are synchronous but another process can quarantine the host
+            // while they run. Recheck the shared markers immediately before fork.
+            const finalQuarantine = (0, autostart_1.daemonStartDeniedReason)();
+            if (finalQuarantine)
+                return this.denySpawn(finalQuarantine, false);
+            worker = new ProcessWorker(this.modulePath, this.execArgv, this.embeddingEnvironment, config_1.MAX_WORKER_MEMORY_MB);
+        }
+        catch (_a) {
+            return this.denySpawn("host admission or fork failed");
+        }
         (0, logger_1.log)("pool", `spawn PID:${worker.child.pid} (${this.workers.length + 1}/${Math.max(1, config_1.CONFIG.WORKER_THREADS)})`);
         const onMessage = (msg) => {
             var _a, _b, _c, _d;
@@ -409,11 +474,14 @@ class WorkerPool {
         worker.child.on("exit", onExit);
         worker.child.on("error", onError);
         this.workers.push(worker);
+        return true;
     }
     enqueue(method, payload, signal) {
         if (this.destroyed) {
             return Promise.reject(new Error("Worker pool destroyed"));
         }
+        if (this.spawnDeniedReason)
+            return Promise.reject(this.spawnDeniedError());
         if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
             const err = new Error("Aborted");
             err.name = "AbortError";
@@ -502,6 +570,23 @@ class WorkerPool {
         var _c, _d, _e;
         if (this.destroyed)
             return;
+        if (this.spawnDeniedReason) {
+            this.rejectUnassignedTasks(this.spawnDeniedReason, "HOST_SAFETY");
+            return;
+        }
+        // Work admitted before another process quarantines the host may still
+        // be queued. Do not send it to an existing worker after that stop.
+        try {
+            const quarantine = (0, autostart_1.daemonStartDeniedReason)();
+            if (quarantine) {
+                this.denySpawn(quarantine, false);
+                return;
+            }
+        }
+        catch (_f) {
+            this.denySpawn("quarantine check failed");
+            return;
+        }
         let idle = this.workers.find((w) => !w.busy);
         // Drain priority queue first so search tasks never wait behind an
         // indexing batch.
@@ -528,7 +613,8 @@ class WorkerPool {
                 this.armScaleUpTimer(waitMs);
                 return;
             }
-            this.spawnWorker();
+            if (!this.spawnWorker())
+                return;
             idle = this.workers[this.workers.length - 1];
         }
         if (!idle)
@@ -723,7 +809,8 @@ class WorkerPool {
         }
         // Replace anything we dropped below the floor with fresh, lean workers.
         while (!this.destroyed && this.workers.length < MIN_KEEP_WORKERS) {
-            this.spawnWorker();
+            if (!this.spawnWorker())
+                break;
         }
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.54",
+  "version": "0.26.56",
   "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",
   "homepage": "https://github.com/reowens/grepmax",
   "bugs": {

package/plugins/grepmax/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.54",
+  "version": "0.26.56",
   "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
   "author": {
     "name": "Robert Owens",

package/plugins/grepmax/hooks/watch-lease.js

@@ -15,15 +15,23 @@ const SOCKET = path.join(GMAX_DIR, "daemon.sock");
 // Activity refreshes this TTL; idle sessions do not watch forever.
 const SESSION_LEASE_TTL_MS = 4 * 60 * 60 * 1000;
 
-function isAutostartDisabled() {
-  if (process.env.GMAX_NO_AUTOSTART === "1") return true;
+function markerPresentOrUnknown(file) {
   try {
-    return fs.existsSync(path.join(GMAX_DIR, "autostart-disabled"));
-  } catch {
-    return false;
+    fs.lstatSync(file);
+    return true;
+  } catch (error) {
+    return error.code !== "ENOENT";
   }
 }
 
+function isAutostartDisabled() {
+  if (process.env.GMAX_NO_AUTOSTART === "1") return true;
+  return (
+    markerPresentOrUnknown(path.join(GMAX_DIR, "autostart-disabled")) ||
+    markerPresentOrUnknown(path.join(GMAX_DIR, "safety-stop.json"))
+  );
+}
+
 function readHookInput(timeoutMs = 1000) {
   return new Promise((resolve) => {
     let data = "";