hilos-agent 0.11.1 → 0.11.2

package/src/handler.mjs

@@ -37,6 +37,7 @@ import {
   scrubHilosEnv,
   envForCwd,
 } from "./cli.mjs";
+import { commandArgv } from "./argv.mjs";
 import { makeStreamParser, createUsageFold } from "./agent-events.mjs";
 import {
   createDirectionInbox,
@@ -62,6 +63,7 @@ import {
 } from "./progress-emitter.mjs";
 import { createTranscriptTap } from "./transcript.mjs";
 import { createLocalHarnessEmitter } from "./local-harness-transport.mjs";
+import { releaseDaemonIterateClaim } from "./iterate-claim-recovery.mjs";
 import { imagePromptNote, renderAttachmentLine } from "./attachments.mjs";
 import { resolveFollowupMode, classifyFollowupCue, normalizeSignal } from "./followup.mjs";
 import {
@@ -647,6 +649,7 @@ async function runClaudeGatedCli({
   permissionCallbacks,
   sessionId = "",
   resolveSessionId,
+  beforeSpawn,
   log = console,
 }) {
   const server = await deps.startClaudePermissionServer({
@@ -671,6 +674,7 @@ async function runClaudeGatedCli({
       signal,
       env: claudeGateEnv(cfg),
       onData,
+      beforeSpawn,
       // 0785 — a CLI that rejects the gate flags is retried without them. This
       // fires BEFORE that ungated retry is spawned, so the room hears about the
       // downgrade first rather than after the fact.
@@ -698,7 +702,7 @@ function codexRunIsGated(cfg, caps) {
   return shouldGateCodexPermissions({
     vendor: detectVendor(cfg?.codingCmd),
     runtimePermissions: caps?.runtimePermissions,
-    codeArgs: String(cfg?.codingCmd || "").split(" ").filter(Boolean).slice(1),
+    codeArgs: commandArgv(String(cfg?.codingCmd || "")).slice(1),
   });
 }
 
@@ -736,8 +740,19 @@ async function runCodexGatedSession({
   signal,
   onData,
   onEvent,
+  beforeSpawn,
   permissionCallbacks,
 }) {
+  if (typeof beforeSpawn === "function" && (await beforeSpawn()) === false) {
+    return {
+      status: null,
+      stdout: "",
+      stderr: "",
+      aborted: true,
+      authorityLost: true,
+      error: new Error("execution authority lost before spawn"),
+    };
+  }
   const run = await deps.runCodexMcpSession({
     cmd,
     cwd,
@@ -754,6 +769,7 @@ async function runCodexGatedSession({
     env: scrubHilosEnv(codingChildEnv(cfg) || process.env),
     onData,
     onEvent,
+    beforeSpawn,
     ...permissionCallbacks,
   });
   if (!codexMcpTransportUnavailable(run)) return run;
@@ -777,6 +793,7 @@ async function runCodexGatedSession({
     signal,
     env: codingChildEnv(cfg),
     onData,
+    beforeSpawn,
   });
   return { ...fallback, permissionGateDropped: true };
 }
@@ -1084,7 +1101,21 @@ async function postFinalReportWithReplay({
   }
 }
 
-export async function claimDaemonIterate({ tool, runId, expectedIterateTurn, claimId = randomUUID() }) {
+/**
+ * @param {{ tool: Function, runId: string, expectedIterateTurn: number,
+ *   claimId?: string, recoveryStore?: {
+ *     persist: (record: { runId: string, expectedIterateTurn: number, claimId: string }) => boolean,
+ *     remove: (claimId: string) => boolean
+ *   } }} options
+ */
+export async function claimDaemonIterate({
+  tool,
+  runId,
+  expectedIterateTurn,
+  claimId = randomUUID(),
+  recoveryStore,
+}) {
+  const record = { runId, expectedIterateTurn, claimId };
   const args = {
     runId,
     status: "running",
@@ -1092,14 +1123,91 @@ export async function claimDaemonIterate({ tool, runId, expectedIterateTurn, cla
     expectedIterateTurn,
     claimId,
   };
+  // Rolling upgrade compatibility: the preceding server supported the
+  // idempotent claim token but not exact confirm/release. Without a recovery
+  // store (created only when the full schema is advertised), preserve that
+  // bounded same-token replay byte-for-byte and do not enable later guards.
+  if (!recoveryStore) {
+    try {
+      return await tool("update_run", args);
+    } catch {
+      return await tool("update_run", args);
+    }
+  }
+  if (!recoveryStore.persist(record)) {
+    throw new Error("the Iterate claim recovery record could not be persisted");
+  }
+  let lastError;
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const result = await tool("update_run", args);
+      if (
+        Number.isSafeInteger(result?.iterateTurn) &&
+        Number(result.iterateTurn) === expectedIterateTurn + 1
+      ) {
+        const claimedTurn = Number(result.iterateTurn);
+        const confirmed = await confirmDaemonIterateClaim({
+          tool,
+          runId,
+          iterateTurn: claimedTurn,
+          claimId,
+        });
+        if (!confirmed) {
+          lastError = new Error("the Iterate claim could not be confirmed");
+          break;
+        }
+        // Keep the exact receipt durable for the whole queue-job lifecycle.
+        // The poller defers reconciliation while this job is active, then
+        // exact-releases (or observes final settlement) before accepting more
+        // work. A crash anywhere before/during the child leaves the receipt for
+        // the next daemon instead of stranding a running generation.
+        return { ...result, claimId };
+      }
+      lastError = new Error("the server did not return the claimed Iterate generation");
+    } catch (error) {
+      lastError = error;
+    }
+  }
+
+  // Neither bounded response proved execution authority. Hand only this exact
+  // token back; a lost release response leaves the durable record for startup.
   try {
-    return await tool("update_run", args);
+    await releaseDaemonIterateClaim({ tool, recoveryStore, record });
   } catch {
-    // The RPC claim is idempotent by claimId. A lost response is recovered by
-    // replaying the exact object once; a competing claimant or a room Stop is
-    // returned as a refusal and the daemon never starts the coding process.
-    return await tool("update_run", args);
+    /* the durable record is the retry */
+  }
+  throw lastError;
+}
+
+/**
+ * Prove that this worker still owns one exact Iterate generation. Stop,
+ * release, a final report, or a newer generation all make the replay-safe
+ * confirmation return `not-owned` without changing the run.
+ */
+export async function confirmDaemonIterateClaim({ tool, runId, iterateTurn, claimId }) {
+  const args = {
+    runId,
+    confirmIterateClaim: true,
+    expectedIterateTurn: iterateTurn,
+    claimId,
+  };
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const result = await tool("update_run", args);
+      if (
+        result?.iterateClaimKind === "confirmed" &&
+        Number.isSafeInteger(result?.iterateTurn) &&
+        Number(result.iterateTurn) === iterateTurn
+      ) {
+        return true;
+      }
+      return false;
+    } catch {
+      // Read-only and exact-token fenced: one replay is safe. Two missing
+      // responses mean execution authority is unproven, so fail closed.
+    }
   }
+  return false;
 }
 
 export async function applyDecision({ decision, repoPath, branch, task, requester, cfg, tool, channelId, deps, parentId, existingPrUrl, settleId, runId, iterateTurn = 0, provenance = {}, usageArgs = {}, shouldContinue }) {
@@ -1491,10 +1599,21 @@ export function dmJudgmentBlock(implicitDm) {
  * `error` is set when the model produced nothing (so the caller can be honest
  * about a timeout vs a missing binary instead of inventing a reply).
  */
-export async function routeIntent({ name, repoFullName, transcript, workspaceMemory, cfg, signal, hasActiveRun = false, runCliFn, implicitDm = false }) {
-  const doRun = runCliFn || runCli; // folder mode injects deps.runCli; repo flow uses the import
+export async function routeIntent({
+  name,
+  repoFullName,
+  transcript,
+  workspaceMemory,
+  cfg,
+  signal,
+  hasActiveRun = false,
+  runCliFn,
+  implicitDm = false,
+  cwd = /** @type {string | undefined} */ (undefined),
+}) {
+  const doRun = runCliFn || runCli;
   const cmd = chatCmdFor(cfg);
-  const parts = cmd.split(" ").filter(Boolean);
+  const parts = commandArgv(cmd);
   // When this thread already owns an OPEN pull request (a follow-up reply), the
   // router ALSO reads whether the latest message continues that PR, wants a
   // separate one, or is unclear — the primary signal for same-PR continuation
@@ -1534,6 +1653,7 @@ export async function routeIntent({ name, repoFullName, transcript, workspaceMem
     timeoutMs: cfg.chatTimeoutMs || cfg.runTimeoutMs,
     label: "thinking",
     signal,
+    cwd,
   });
   if (run.aborted || signal?.aborted) return { aborted: true };
   const raw = (run.stdout || "").trim();
@@ -1716,18 +1836,29 @@ export function planAckPrompt(o) {
  * CLI. Bounded (≤45s) + best-effort: returns trimmed text, or null on
  * empty/timeout/error so the run keeps the instant template and never stalls.
  */
-async function proposePlanAck({ task, transcript, repoFullName, cfg, signal }) {
+export async function proposePlanAck({
+  task,
+  transcript,
+  repoFullName,
+  cfg,
+  signal,
+  cwd = /** @type {string | undefined} */ (undefined),
+  beforeSpawn = /** @type {(() => boolean | Promise<boolean>) | undefined} */ (undefined),
+  runCliFn = runCli,
+}) {
   const cmd = chatCmdFor(cfg);
   if (!cmd) return null;
-  const parts = cmd.split(" ").filter(Boolean);
+  const parts = commandArgv(cmd);
   const prompt = planAckPrompt({ task, transcript, repoFullName });
-  const run = await runCli({
+  const run = await runCliFn({
     cmd: parts[0],
     args: [...parts.slice(1), prompt],
     timeoutMs: Math.min(cfg.chatTimeoutMs || 90000, 45000),
     label: "thinking",
     signal,
+    cwd,
     env: codingChildEnv(cfg),
+    beforeSpawn,
   });
   if (run.aborted || signal?.aborted) return null;
   const text = (run.stdout || "").trim();
@@ -1746,7 +1877,21 @@ async function reactQuietly({ tool, caps, message, emoji }) {
 }
 
 /** Run the FAST chat CLI to produce a reply, using recent channel context. */
-async function respondConversationally({ message, channelId, tool, me, cfg, repoLink, parentId, workspaceMemory, signal, context, caps = {} }) {
+async function respondConversationally({
+  message,
+  channelId,
+  tool,
+  me,
+  cfg,
+  repoLink,
+  parentId,
+  workspaceMemory,
+  signal,
+  context,
+  caps = {},
+  runCliFn = runCli,
+  pathExistsFn = existsSync,
+}) {
   const implicitDm = message?.implicit === "dm";
   const { transcript } = context || (await fetchContext({ channelId, tool, parentId }));
   const name = me?.agentName || "an assistant";
@@ -1755,10 +1900,20 @@ async function respondConversationally({ message, channelId, tool, me, cfg, repo
   // "repository" line never claims a folder path is a repo. When there's no repo
   // but this channel maps to a local folder on THIS machine, say that instead.
   const folderPath = !repoLink ? resolveFolderPath(cfg, channelId) : null;
+  const repoPath = repoLink ? resolveRepoPath(cfg, repoLink.repo_full_name) : null;
+  const mappedProjectPath = repoPath || folderPath || null;
+  const projectCwd =
+    mappedProjectPath && pathExistsFn(mappedProjectPath)
+      ? mappedProjectPath
+      : undefined;
   const repoLine = repoLink
-    ? `This channel is connected to the repository ${repoLink.repo_full_name}; assume that repo for any code work — don't ask which one.`
+    ? repoPath && !projectCwd
+      ? `This channel is connected to the repository ${repoLink.repo_full_name}, but its configured local checkout ${repoPath} is unavailable on this machine. Answer from the conversation and don't claim you inspected it.`
+      : `This channel is connected to the repository ${repoLink.repo_full_name}; assume that repo for any code work — don't ask which one.`
     : folderPath
-      ? `This channel is connected to the local folder ${folderPath} on this machine; assume that folder for any file work — don't ask which one.`
+      ? projectCwd
+        ? `This channel is connected to the local folder ${folderPath} on this machine; assume that folder for any file work — don't ask which one.`
+        : `This channel is mapped to the local folder ${folderPath}, but that folder is unavailable on this machine. Answer from the conversation and don't claim you inspected it.`
       : `If asked to change code, note that a repo isn't linked to this channel yet.`;
   const prompt =
     `You are ${name}, a teammate in a team chat (hilos). Reply to the latest message ` +
@@ -1772,7 +1927,7 @@ async function respondConversationally({ message, channelId, tool, me, cfg, repo
   // chatCmd is unset) bounded by chatTimeoutMs, so a casual reply lands in seconds
   // and a stalled model can't dead-air the channel for the full coding timeout.
   const cmd = chatCmdFor(cfg);
-  const parts = cmd.split(" ").filter(Boolean);
+  const parts = commandArgv(cmd);
   const chatVendor = detectVendor(cmd);
   const webArgs = chatWebArgs(chatVendor, parts.slice(1), {
     enabled: cfg.webSearch !== false,
@@ -1805,12 +1960,13 @@ async function respondConversationally({ message, channelId, tool, me, cfg, repo
 
   let run;
   try {
-    run = await runCli({
+    run = await runCliFn({
       cmd: parts[0],
       args: [...parts.slice(1), ...webArgs, prompt],
       timeoutMs: cfg.chatTimeoutMs || cfg.runTimeoutMs,
       label: "thinking",
       signal,
+      cwd: projectCwd,
       env: codingChildWebEnv(cfg, chatVendor),
     });
   } finally {
@@ -1999,7 +2155,7 @@ async function reviewTask({ message, channelId, tool, me, cfg, workspaceMemory,
   // stdout and never stages/commits anything. Review uses the fast chat command
   // when set (no acceptEdits → can't write), falling back to the coding command.
   const cmd = cfg.reviewCmd || chatCmdFor(cfg);
-  const parts = String(cmd).split(" ").filter(Boolean);
+  const parts = commandArgv(String(cmd));
   let sandboxDir = null;
   try {
     sandboxDir = mkdtempSync(join(tmpdir(), "hilos-review-"));
@@ -2396,7 +2552,7 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
   // Run the coding CLI in the folder, streaming progress + honoring timeouts and
   // the abort signal (reuses runCli via deps + the progress-emitter machinery).
   const runFolderCli = async (promptText) => {
-    const parts = cfg.codingCmd.split(" ").filter(Boolean);
+    const parts = commandArgv(cfg.codingCmd);
     const vendor = detectVendor(cfg.codingCmd);
     const streamOn = Boolean(caps.postProgress);
     const streamArgs = streamOn ? codeStreamArgs(vendor) : [];
@@ -2930,7 +3086,7 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
 
 /** Handle one task. cfg/deps injectable for tests. `opts.signal` (AbortSignal)
  *  cancels an in-flight run — the queue fires it when a human says "stop". */
-export async function handleTask({ message, channelId, tool, me, caps = {} }, cfg, depsOverride, opts = {}) {
+export async function handleTask({ message, channelId, tool, me, caps = {}, iterateClaimRecoveryStore = null }, cfg, depsOverride, opts = {}) {
   if (message.dispatch?.briefMarkdown) {
     message = { ...message, body: `${message.body}\n\n${message.dispatch.briefMarkdown}` };
   }
@@ -3062,6 +3218,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   if (!repoLink) {
     const folderPath = resolveFolderPath(cfg, channelId);
     if (folderPath) {
+      const folderCwd = deps.pathExists(folderPath) ? folderPath : undefined;
       // Durable report-card fallback: list_mentions projects a still-pending
       // in-place decision into the queue. Deploy only while that decision
       // remains pending; a settled report is a silent no-op, which prevents a
@@ -3158,15 +3315,16 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
       // CLI router. There is still no keyword/regex intent list.
       if (!routed) {
         routed = await routeIntent({
-                name: me?.agentName || "an assistant",
-                repoFullName: folderPath,
-                transcript: context.transcript,
-                workspaceMemory,
-                cfg,
-                signal,
-                runCliFn: deps.runCli,
-                implicitDm,
-              });
+          name: me?.agentName || "an assistant",
+          repoFullName: folderPath,
+          transcript: context.transcript,
+          workspaceMemory,
+          cfg,
+          signal,
+          runCliFn: deps.runCli,
+          implicitDm,
+          cwd: folderCwd,
+        });
       }
       if (routed.aborted || signal?.aborted) {
         await tool("post_message", { channelId, parentId, body: "Stopped." });
@@ -3197,13 +3355,46 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
       // Not a coding task → the classifier is finished. The separate responder
       // below owns the answer and keeps its normal tools.
     }
-    await respondConversationally({ message, channelId, tool, me, cfg, repoLink, parentId, workspaceMemory, signal, context, caps });
+    await respondConversationally({
+      message,
+      channelId,
+      tool,
+      me,
+      cfg,
+      repoLink,
+      parentId,
+      workspaceMemory,
+      signal,
+      context,
+      caps,
+      runCliFn: deps.runCli,
+      pathExistsFn: deps.pathExists,
+    });
     return { status: "chat" };
   }
   const repoFullName = repoLink.repo_full_name;
+  const mappedRepoPath = resolveRepoPath(cfg, repoFullName);
+  const mappedRepoCwd =
+    mappedRepoPath && deps.pathExists(mappedRepoPath)
+      ? mappedRepoPath
+      : undefined;
 
   if (mode === "ask" && !forcedConflictRecovery) {
-    await respondConversationally({ message, channelId, tool, me, cfg, repoLink, parentId, workspaceMemory, signal, context, caps });
+    await respondConversationally({
+      message,
+      channelId,
+      tool,
+      me,
+      cfg,
+      repoLink,
+      parentId,
+      workspaceMemory,
+      signal,
+      context,
+      caps,
+      runCliFn: deps.runCli,
+      pathExistsFn: deps.pathExists,
+    });
     return { status: "chat" };
   }
 
@@ -3250,7 +3441,9 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           cfg,
           signal,
           hasActiveRun: activeRunOpen,
+          runCliFn: deps.runCli,
           implicitDm,
+          cwd: mappedRepoCwd,
         });
   if (routed.aborted || signal?.aborted) {
     await tool("post_message", { channelId, parentId, body: "Stopped." });
@@ -3273,6 +3466,8 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
       signal,
       context,
       caps,
+      runCliFn: deps.runCli,
+      pathExistsFn: deps.pathExists,
     });
     return { status: "chat" };
   }
@@ -3292,7 +3487,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     signal: followupSignal,
   });
 
-  let repoPath = resolveRepoPath(cfg, repoFullName);
+  let repoPath = mappedRepoPath;
   if (!repoPath) {
     // Zero-config path: if the daemon is running INSIDE a checkout of this repo
     // (its origin matches), just use the current directory — no repos map needed.
@@ -3594,6 +3789,8 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     : Number.isSafeInteger(activeRun?.iterateTurn)
       ? Number(activeRun.iterateTurn)
       : 0;
+  let iterateClaimId = null;
+  let iterateAuthorityLost = false;
   if (message.dispatch?.runId && caps.runs) {
     // Adopt the dispatch's canonical run. If the server already SETTLED it (the
     // reaper/outbox closed a dispatch we were slow to pick up), leave it alone
@@ -3623,12 +3820,18 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   }
   if (caps.runs && effectiveMode === "iterate" && runId && !message.dispatch?.runId) {
     try {
-      const claimed = await claimDaemonIterate({ tool, runId, expectedIterateTurn: iterateTurn });
+      const claimed = await claimDaemonIterate({
+        tool,
+        runId,
+        expectedIterateTurn: iterateTurn,
+        recoveryStore: iterateClaimRecoveryStore,
+      });
       const claimedTurn = claimed?.iterateTurn;
       if (!Number.isSafeInteger(claimedTurn) || Number(claimedTurn) !== iterateTurn + 1) {
         throw new Error("the server did not return the claimed Iterate generation");
       }
       iterateTurn = Number(claimedTurn);
+      iterateClaimId = claimed.claimId;
     } catch {
       // Unlike optional bookkeeping, the generation claim is execution
       // authority. Continuing after losing it would let two daemons ship one
@@ -3683,6 +3886,21 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     caps.runInputs && runId
       ? createDirectionInbox({ tool, runId, log: (line) => console.log(line) })
       : null;
+  // All subprocesses launched after an Iterate claim — including the fast plan
+  // acknowledgement — share this exact authority fence. Non-Iterate runs take
+  // the true fast path and preserve their existing behavior.
+  const beforeCodingSpawn = async () => {
+    if (signal?.aborted) return false;
+    if (!iterateClaimId) return true;
+    const ownsClaim = await confirmDaemonIterateClaim({
+      tool,
+      runId,
+      iterateTurn,
+      claimId: iterateClaimId,
+    });
+    if (!ownsClaim) iterateAuthorityLost = true;
+    return ownsClaim && !signal?.aborted;
+  };
   const settleConflictFailure = async (reason) => {
     if (!activeConflictMerge || !runId || !caps.runs) return;
     await tool("update_run", {
@@ -3709,6 +3927,8 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
       repoFullName,
       cfg,
       signal,
+      cwd: repoPath,
+      beforeSpawn: beforeCodingSpawn,
     }).catch(() => null);
     if (plan && !signal?.aborted) await tool("edit_message", { messageId: ackId, body: plan }).catch(() => {});
   }
@@ -3840,6 +4060,18 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
    * heartbeat does (the room hears who stopped it; the job's signal aborts).
    */
   const stoppedBeforeShip = async (state = "done") => {
+    if (iterateClaimId) {
+      const ownsClaim = await confirmDaemonIterateClaim({
+        tool,
+        runId,
+        iterateTurn,
+        claimId: iterateClaimId,
+      });
+      if (!ownsClaim) {
+        iterateAuthorityLost = true;
+        return true;
+      }
+    }
     // Only the streaming card carries progress metadata. The legacy heartbeat's
     // message is plain text, and stamping a lifecycle onto it would turn a
     // status line into a run card — so that path simply has no pre-ship check.
@@ -3894,7 +4126,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     }
   };
 
-  const parts = cfg.codingCmd.split(" ").filter(Boolean);
+  const parts = commandArgv(cfg.codingCmd);
   // Run the CLI and stage everything it changed; return the diff stats (no post).
   // Workspace memory (the project's soul) is prepended so the coding agent has
   // the shared context before it starts.
@@ -4128,6 +4360,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
           onData: handleCliData,
           onEvent: handleCliEvent,
+          beforeSpawn: beforeCodingSpawn,
           ...openCodePermissionCallbacks({
             tool,
             channelId,
@@ -4150,6 +4383,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           // after this scrub and dies with the process group.
           env: scrubHilosEnv(codingChildWebEnv(cfg, vendor) || process.env),
           onData: handleCliData,
+          beforeSpawn: beforeCodingSpawn,
           ...openCodePermissionCallbacks({
             tool,
             channelId,
@@ -4174,6 +4408,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           signal,
           onData: handleCliData,
           onEvent: handleCliEvent,
+          beforeSpawn: beforeCodingSpawn,
           permissionCallbacks: openCodePermissionCallbacks({
             tool,
             channelId,
@@ -4196,6 +4431,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           cwd: repoPath,
           signal,
           onData: handleCliData,
+          beforeSpawn: beforeCodingSpawn,
           sessionId: resume ? resumeSessionId ?? "" : "",
           resolveSessionId: () => emitter?.snapshot()?.sessionId ?? null,
           permissionCallbacks: openCodePermissionCallbacks({
@@ -4221,6 +4457,7 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
           signal,
           env: codingChildWebEnv(cfg, vendor),
           onData: handleCliData,
+          beforeSpawn: beforeCodingSpawn,
         });
       }
       // 0785 — the gate was expected here and the CLI couldn't hold it. Say so
@@ -4516,9 +4753,12 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   // Post the right cancel message: honest about whether cleanup actually worked.
   const postStopped = async () => {
     const clean = discardBranch();
+    const lead = iterateAuthorityLost
+      ? "This Iterate turn no longer owns its run, so I did not start or ship it"
+      : "Stopped";
     const body = clean
-      ? `Stopped — discarded \`${branch}\`.`
-      : `Stopped, but couldn't fully clean \`${branch}\` — run \`git reset --hard && git switch ${startRef.ref || cfg.defaultBranch}\` in ${repoPath}.`;
+      ? `${lead} — discarded \`${branch}\`.`
+      : `${lead}, but couldn't fully clean \`${branch}\` — run \`git reset --hard && git switch ${startRef.ref || cfg.defaultBranch}\` in ${repoPath}.`;
     await tool("post_message", {
       channelId,
       parentId: threadRoot,