kenaz 0.3.22 → 0.3.24

package/core/plugins/kenaz/hooks/kenaz-hook.js

@@ -13,7 +13,8 @@ const fs = require('fs');
 const path = require('path');
 const net = require('net');
 const http = require('http');
-const { spawnSync } = require('child_process');
+const os = require('os');
+const { spawn, spawnSync } = require('child_process');
 const { resolveMode, allows, projectDir } = require('./mode');
 const { isSdkSession } = require('./sdk-gate');
 
@@ -34,6 +35,7 @@ const HOOKS = {
   'memory-guard':   { kind: 'script', file: 'memory-guard.js', call: 'main', minMode: 'full' },
   'vendor-agent-guard': { kind: 'script', file: 'vendor-agent-guard.js', call: 'main', minMode: 'assist' },
   'peer-session-fill': { kind: 'script', file: 'peer-session-fill.js', call: 'main', minMode: 'assist' },
+  'worktree-guard': { kind: 'inline', file: 'worktree-guard.js', minMode: 'assist' }, // TASK_2485: runs from the plugin itself, needs no core
   'task-bridge':    { kind: 'script', file: 'task-bridge.js', minMode: 'assist' },
 };
 
@@ -49,6 +51,42 @@ function backendUp(cb) {
   s.on('error', () => done(false));
 }
 
+// TASK_2468: after a reboot nothing has started kenaz-server yet (the plugin MCP is a static http URL).
+// Start the installed binary detached, the way the installer does; never by process name, and only
+// called after the port probe failed (a second server is never started over an answering one).
+function startServer(dir) {
+  try {
+    const home = os.homedir();
+    const meta = JSON.parse(fs.readFileSync(path.join(home, '.kenaz', 'install.json'), 'utf8'));
+    const bin = meta && meta.serverBin;
+    if (!bin || !fs.existsSync(bin)) return false;
+    const core = coreDir(dir);
+    const env = Object.assign({}, process.env, core ? { KENAZ_SOURCE_DIR: core } : {});
+    const opts = { env, detached: true, stdio: 'ignore', windowsHide: true };
+    const viaNode = /\.js$/.test(bin); // a script (tests) runs under node; the real server is a binary
+    let child;
+    if (process.platform === 'win32') {
+      const args = core ? ['--source-dir', core] : []; // TASK_2478: no console, core dir as an argument
+      child = viaNode ? spawn(process.execPath, [bin, ...args], opts) : spawn(bin, args, opts);
+    } else {
+      const log = path.join(home, '.kenaz', 'kenaz-server.log');
+      const sq = (v) => "'" + String(v).replace(/'/g, "'\\''") + "'";
+      const cmd = 'if command -v setsid >/dev/null 2>&1; then S=setsid; else S=; fi; $S nohup ' +
+        (viaNode ? sq(process.execPath) + ' ' : '') + sq(bin) + ' >> ' + sq(log) + ' 2>&1 < /dev/null &';
+      child = spawn('sh', ['-c', cmd], opts);
+    }
+    child.on('error', () => {});
+    child.unref();
+    return true;
+  } catch (_) { return false; }
+}
+
+function waitForBackend(ms, cb) {
+  const end = Date.now() + ms;
+  const tick = () => backendUp((ok) => { if (ok || Date.now() >= end) return cb(ok); setTimeout(tick, 150); });
+  tick();
+}
+
 function post(body, cb) {
   const r = http.request({ hostname: HOST, port: PORT, path: '/api/rust/agent-flow/hook', method: 'POST',
     headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 3000 },
@@ -75,7 +113,7 @@ function run(spec, stdin, dir) {
   const stdio = ['pipe', 'inherit', 'ignore'];
   if (spec.kind === 'core-script') {
     const target = path.join(core, spec.rel);
-    if (fs.existsSync(target)) spawnSync(process.execPath, [target, ...(spec.args || [])], { cwd: dir, env, input: stdin, stdio, timeout: 10000 });
+    if (fs.existsSync(target)) spawnSync(process.execPath, [target, ...(spec.args || [])], { cwd: dir, env, input: stdin, stdio, timeout: 10000, windowsHide: true });
     return;
   }
   const file = path.join(core, '.claude', 'hooks', spec.file);
@@ -83,7 +121,7 @@ function run(spec, stdin, dir) {
   // Same shape as the core's own `node -e "chdir; require(hook)"` wrappers (require.main stays undefined).
   const code = 'process.chdir(process.env.CLAUDE_PROJECT_DIR);const m=require(process.argv[1]);' +
     (spec.call ? 'm[process.argv[2]]();' : '');
-  spawnSync(process.execPath, ['-e', code, file, spec.call || ''], { cwd: dir, env, input: stdin, stdio, timeout: 10000 });
+  spawnSync(process.execPath, ['-e', code, file, spec.call || ''], { cwd: dir, env, input: stdin, stdio, timeout: 10000, windowsHide: true });
 }
 
 function main() {
@@ -103,9 +141,25 @@ function main() {
     if (spec.kind === 'session-start') {
       return post(JSON.stringify({ hook_event_name: 'SessionStart', session_id: process.env.SESSION_ID || 'unknown', project_path: dir }), () => {});
     }
+    if (spec.kind === 'inline') {
+      const out = require('./' + spec.file).decide(JSON.parse(stdin || '{}'));
+      if (out) process.stdout.write(JSON.stringify(out));
+      return;
+    }
     run(spec, stdin, dir);
   };
-  if (spec.backend) backendUp((ok) => { if (ok) go(); }); else go();
+  if (!spec.backend) return go();
+  backendUp((ok) => {
+    if (ok) return go();
+    if (spec.kind !== 'session-start') return;
+    const finish = (up) => {
+      if (up) go();
+      process.stdout.write(up
+        ? 'kenaz-server was not running; the Kenaz hook started it on ' + HOST + ':' + PORT + '. If the kenaz MCP tools (kenaz-dashboard) show as failed, ask the user to run /mcp to reconnect them (they connected before the server was up).\n'
+        : 'kenaz-server is not running on ' + HOST + ':' + PORT + ', so the kenaz MCP tools are unavailable. Ask the user to run `! npx kenaz install` (registers the boot service and starts it), then /mcp to reconnect kenaz-dashboard.\n');
+    };
+    if (startServer(dir)) waitForBackend(3000, finish); else finish(false);
+  });
 }
 
 process.on('uncaughtException', () => process.exit(0));

package/core/plugins/kenaz/hooks/worktree-guard.js

@@ -0,0 +1,121 @@
+'use strict';
+// PreToolUse(Bash): deny `git worktree remove`, `rm -r`, `rmdir /s` and `Remove-Item -Recurse` aimed at a
+// directory that contains a symlink/junction (any name, any depth). On Windows `git worktree remove --force`
+// walks THROUGH junctions and empties their targets: field report 2026-10-20 lost node_modules, backend/.env
+// and tracked files of the MAIN repo. Directories without links pass. Fails open on any error or timeout.
+// Safe path: node <core>/.formation/tools/worktree-reclaim.js remove <dir>   (unlinks every link first).
+const fs = require('fs');
+const path = require('path');
+
+const MAX_MS = 2500;
+
+// Quote-aware split into commands (on && || ; | newline), each a token list.
+function commands(line) {
+  const out = []; let tok = ''; let cur = []; let q = null;
+  const endTok = () => { if (tok) cur.push(tok); tok = ''; };
+  const endCmd = () => { endTok(); if (cur.length) out.push(cur); cur = []; };
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (q) { if (c === q) q = null; else tok += c; continue; }
+    if (c === '"' || c === "'") { q = c; continue; }
+    if (c === '\\' && /[ "']/.test(line[i + 1] || '') && process.platform !== 'win32') { tok += line[++i]; continue; }
+    if (/\s/.test(c) && c !== '\n') { endTok(); continue; }
+    if (c === '\n' || c === ';' || c === '|' || c === '&') { endCmd(); continue; }
+    tok += c;
+  }
+  endCmd();
+  return out;
+}
+
+// Directory arguments of a removal command, or [] when the command is not a recursive removal.
+function removalTargets(t) {
+  const base = (s) => s.replace(/^.*[\\/]/, '').replace(/\.exe$/i, '').toLowerCase();
+  const i = t.findIndex((x) => ['git', 'rm', 'rmdir', 'rd', 'remove-item', 'ri', 'del'].includes(base(x)));
+  if (i < 0) return [];
+  const name = base(t[i]); const a = t.slice(i + 1);
+  if (name === 'git') {
+    const k = a.indexOf('worktree');
+    return k >= 0 && a[k + 1] === 'remove' ? a.slice(k + 2).filter((x) => !x.startsWith('-')) : [];
+  }
+  if (name === 'rm') return a.some((x) => /^-[a-z]*[rR]/.test(x) || x === '--recursive') ? a.filter((x) => !x.startsWith('-')) : [];
+  if (name === 'rmdir' || name === 'rd') return a.some((x) => /^\/s$/i.test(x)) ? a.filter((x) => !x.startsWith('/')) : [];
+  // PowerShell: Remove-Item / ri / del with -Recurse
+  if (!a.some((x) => /^-r(ecurse)?$/i.test(x))) return [];
+  const out = []; const valued = /^-(path|literalpath|include|exclude|filter|credential)$/i;
+  for (let j = 0; j < a.length; j++) {
+    if (/^-(path|literalpath)$/i.test(a[j]) && a[j + 1]) { out.push(a[++j]); continue; }
+    if (valued.test(a[j])) { j++; continue; }
+    if (!a[j].startsWith('-')) out.push(a[j]);
+  }
+  return out;
+}
+
+function resolveDir(arg, cwd) {
+  let p = arg;
+  if (/[*?]/.test(p)) return null;
+  const m = /^\/([a-zA-Z])\/(.*)$/.exec(p); // Git Bash /c/Users/...
+  if (m && process.platform === 'win32') p = m[1].toUpperCase() + ':/' + m[2];
+  return path.resolve(cwd || process.cwd(), p);
+}
+
+// First symlink/junction found under dir (lstat walk, never follows), or null.
+function findLink(dir, deadline) {
+  const stack = [dir];
+  while (stack.length) {
+    if (Date.now() > deadline) return null; // too big to prove: fail open
+    const d = stack.pop();
+    let names; try { names = fs.readdirSync(d); } catch { continue; }
+    for (const n of names) {
+      const p = path.join(d, n);
+      let st; try { st = fs.lstatSync(p); } catch { continue; }
+      if (st.isSymbolicLink()) return p;
+      if (st.isDirectory()) stack.push(p);
+    }
+  }
+  return null;
+}
+
+function coreHint(cwd) {
+  try { return require('./core-resolve').resolveCoreDir(cwd) || '<kenaz core>'; } catch (_) { return '<kenaz core>'; }
+}
+
+function decide(input) {
+  if (!input || input.tool_name !== 'Bash') return null;
+  const command = String((input.tool_input && input.tool_input.command) || '');
+  if (!/worktree|rm\b|rmdir|\brd\b|remove-item|\bri\b|\bdel\b/i.test(command)) return null;
+  const deadline = Date.now() + MAX_MS;
+  const cmds = commands(command);
+  // `powershell -Command "Remove-Item ..."` / `bash -c 'rm -rf ..'`: re-parse quoted tokens that hold a whole command
+  for (const t of [...cmds]) for (const tok of t) if (/\s/.test(tok)) cmds.push(...commands(tok));
+  for (const t of cmds) {
+    for (const arg of removalTargets(t)) {
+      const dir = resolveDir(arg, input.cwd);
+      if (!dir) continue;
+      let st; try { st = fs.lstatSync(dir); } catch { continue; }
+      if (!st.isDirectory()) continue; // a link itself, a file, or missing: removing it is safe
+      const link = findLink(dir, deadline);
+      if (!link) continue;
+      return {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          permissionDecisionReason: `Blocked: ${dir} contains a symlink/junction (${path.relative(dir, link)}). ` +
+            '`git worktree remove --force` follows junctions on Windows and empties their targets in the MAIN repo (node_modules, backend/.env, tracked files). ' +
+            'Use the safe remover, which unlinks every link first and refuses if one survives: ' +
+            `node "${coreHint(input.cwd)}/.formation/tools/worktree-reclaim.js" remove "${dir}"`,
+        },
+      };
+    }
+  }
+  return null;
+}
+
+function main() {
+  try {
+    const out = decide(JSON.parse(fs.readFileSync(0, 'utf8') || '{}'));
+    if (out) process.stdout.write(JSON.stringify(out));
+  } catch (_) { /* fail open */ }
+}
+
+if (require.main === module) main();
+module.exports = { decide, main, commands, removalTargets };

package/core/plugins/kenaz/hooks/worktree-guard.test.js

@@ -0,0 +1,75 @@
+'use strict';
+// TASK_2485: the guard denies recursive removal of a dir that holds a junction/symlink, allows link-free dirs.
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { decide } = require('./worktree-guard');
+
+function fixture() {
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'wtguard-')));
+  const target = path.join(root, 'main'); fs.mkdirSync(target);
+  const withLink = path.join(root, 'wt-link'); fs.mkdirSync(path.join(withLink, 'a', 'b'), { recursive: true });
+  fs.symlinkSync(target, path.join(withLink, 'a', 'b', 'anything'), 'junction'); // not named node_modules, nested
+  const plain = path.join(root, 'wt-plain'); fs.mkdirSync(path.join(plain, 'a'), { recursive: true });
+  fs.writeFileSync(path.join(plain, 'a', 'f.txt'), 'x');
+  return { root, withLink, plain, target };
+}
+const bash = (command, cwd) => ({ tool_name: 'Bash', cwd, tool_input: { command } });
+const denied = (r) => r && r.hookSpecificOutput.permissionDecision === 'deny';
+
+test('denies git worktree remove / rm -rf / rmdir /s / Remove-Item -Recurse on a dir holding a junction', () => {
+  const f = fixture();
+  try {
+    const d = f.withLink; const fwd = d.replace(/\\/g, '/');
+    for (const cmd of [
+      `git worktree remove --force "${d}"`,
+      `git -C "${f.root}" worktree remove -f ${fwd}`,
+      `rm -rf "${fwd}"`,
+      `rm -fr ${fwd} && echo done`,
+      `cd ${f.root} && rm -r wt-link`,
+      `rmdir /s /q "${d}"`,
+      `cmd /c rmdir /s /q "${d}"`,
+      `Remove-Item -Recurse -Force "${d}"`,
+      `powershell -Command "Remove-Item -Path '${d}' -Recurse -Force"`,
+    ]) {
+      const r = decide(bash(cmd, f.root));
+      assert.ok(denied(r), `should deny: ${cmd}`);
+      assert.match(r.hookSpecificOutput.permissionDecisionReason, /worktree-reclaim\.js/);
+    }
+  } finally { fs.rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test('same commands on a link-free dir, a missing dir, a link itself and unrelated commands pass (control)', () => {
+  const f = fixture();
+  try {
+    const p = f.plain;
+    for (const cmd of [
+      `git worktree remove --force "${p}"`, `rm -rf "${p.replace(/\\/g, '/')}"`, `rmdir /s /q "${p}"`, `Remove-Item -Recurse -Force "${p}"`,
+      `rm -rf ${path.join(f.root, 'nope')}`, `rm -f ${path.join(f.withLink, 'a', 'b', 'anything')}`, // a plain link/file removal is safe
+      `rm -rf ${f.withLink}/a/b/*`, // glob: cannot resolve, passes
+      `ls ${f.withLink}`, `git status`, `git worktree list`,
+    ]) {
+      assert.strictEqual(decide(bash(cmd, f.root)), null, `should pass: ${cmd}`);
+    }
+    assert.strictEqual(decide({ tool_name: 'Read', tool_input: { command: `rm -rf ${f.withLink}` } }), null);
+  } finally { fs.rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test('through the plugin entry point: deny output for a junction dir, nothing for a plain dir; mode off disables', () => {
+  const f = fixture();
+  try {
+    const hook = path.join(__dirname, 'kenaz-hook.js');
+    const run = (cmd, env = {}) => spawnSync(process.execPath, [hook, 'worktree-guard'], {
+      cwd: f.root, encoding: 'utf8', input: JSON.stringify(bash(cmd, f.root)),
+      env: { ...process.env, CLAUDE_PROJECT_DIR: f.root, KENAZ_MODE: 'full', CLAUDE_CODE_ENTRYPOINT: 'cli', ...env },
+    });
+    const blocked = run(`rm -rf "${f.withLink}"`);
+    assert.strictEqual(blocked.status, 0);
+    assert.strictEqual(JSON.parse(blocked.stdout).hookSpecificOutput.permissionDecision, 'deny');
+    assert.strictEqual(run(`rm -rf "${f.plain}"`).stdout, '');
+    assert.strictEqual(run(`rm -rf "${f.withLink}"`, { KENAZ_MODE: 'off' }).stdout, '');
+  } finally { fs.rmSync(f.root, { recursive: true, force: true }); }
+});

package/core/plugins/kenaz/scripts/kenaz.test.js

@@ -58,11 +58,14 @@ test('kenaz.yaml switch is honoured; env wins', () => {
 });
 
 test('backend down: no output, no stderr, exit 0', () => {
-  for (const n of ['flow-post', 'session-start']) {
-    const r = hook(n, proj(), { KENAZ_BACKEND_PORT: '1' });
-    assert.strictEqual(r.status, 0);
-    assert.strictEqual(r.stdout + r.stderr, '');
-  }
+  const home = proj(); // temp HOME: session-start would otherwise start the real installed server (TASK_2468)
+  const env = { KENAZ_BACKEND_PORT: '1', HOME: home, USERPROFILE: home };
+  const r = hook('flow-post', proj(), env);
+  assert.strictEqual(r.status, 0);
+  assert.strictEqual(r.stdout + r.stderr, '');
+  const s = hook('session-start', proj(), env); // only session-start speaks: one line naming the fix
+  assert.strictEqual(s.stderr, '');
+  assert.match(s.stdout, /npx kenaz install/);
 });
 
 test('ygg status fixture: masked key, room, peers, mail (TASK_2366)', () => {
@@ -202,3 +205,67 @@ test('ygg create explains 429, 503, missing relay_url and unreachable relay (TAS
     await assert.rejects(createTeam(dir, '', 'project'), /cannot reach the relay at http:\/\/127\.0\.0\.1:1/);
   });
 });
+
+// TASK_2468: SessionStart starts the installed server when the port is closed (temp HOME, free port, fake server script).
+async function freePort() {
+  const srv = require('net').createServer();
+  await new Promise((r) => srv.listen(0, '127.0.0.1', r));
+  const p = srv.address().port;
+  await new Promise((r) => srv.close(r));
+  return p;
+}
+function fakeHome(withBin) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'kz-home-'));
+  fs.mkdirSync(path.join(home, '.kenaz'));
+  const bin = path.join(home, 'fake-server.js');
+  fs.writeFileSync(bin, "const http=require('http');require('fs').writeFileSync(process.env.PIDFILE,String(process.pid));" +
+    "http.createServer((q,r)=>{r.end('{}')}).listen(Number(process.env.KENAZ_BACKEND_PORT),'127.0.0.1');setTimeout(()=>process.exit(0),15000);");
+  if (withBin) fs.writeFileSync(path.join(home, '.kenaz', 'install.json'), JSON.stringify({ serverBin: bin }));
+  return { home, pidfile: path.join(home, 'pid') };
+}
+const isUp = (port) => new Promise((r) => { const s = require('net').connect({ host: '127.0.0.1', port }); s.on('connect', () => { s.destroy(); r(true); }); s.on('error', () => r(false)); });
+const killPid = (f) => { try { process.kill(Number(fs.readFileSync(f, 'utf8'))); } catch (_) { /* never started */ } };
+const hookAsync = (env) => new Promise((resolve) => {
+  const c = require('child_process').spawn(process.execPath, [HOOK, 'session-start'], { env: Object.assign({}, process.env, { CLAUDE_PROJECT_DIR: proj(), KENAZ_MODE: '', KENAZ_SOURCE_DIR: CORE }, env) });
+  let out = ''; c.stdout.on('data', (d) => { out += d; }); c.on('close', () => resolve(out)); c.stdin.end('{}');
+});
+
+test('TASK_2468: session-start with the port closed starts the installed server and says so', async () => {
+  const port = await freePort(); const f = fakeHome(true);
+  const env = { HOME: f.home, USERPROFILE: f.home, KENAZ_BACKEND_PORT: String(port), PIDFILE: f.pidfile };
+  try {
+    const out = await hookAsync(env);
+    assert.ok(await isUp(port), 'server came up');
+    assert.match(out, /started it/); assert.match(out, /\/mcp/);
+  } finally { killPid(f.pidfile); }
+});
+
+test('TASK_2468: no install.json -> one line naming `npx kenaz install` and /mcp; nothing spawned', async () => {
+  const port = await freePort(); const f = fakeHome(false);
+  const env = { HOME: f.home, USERPROFILE: f.home, KENAZ_BACKEND_PORT: String(port), PIDFILE: f.pidfile };
+  const out = await hookAsync(env);
+  assert.match(out, /npx kenaz install/); assert.match(out, /\/mcp/);
+  assert.strictEqual(out.trim().split('\n').length, 1);
+  assert.ok(!(await isUp(port)));
+});
+
+test('TASK_2468: KENAZ_MODE=off and sdk entrypoint -> no output, nothing spawned', async () => {
+  for (const extra of [{ KENAZ_MODE: 'off' }, { CLAUDE_CODE_ENTRYPOINT: 'sdk-ts' }]) {
+    const port = await freePort(); const f = fakeHome(true);
+    const env = Object.assign({ HOME: f.home, USERPROFILE: f.home, KENAZ_BACKEND_PORT: String(port), PIDFILE: f.pidfile }, extra);
+    try {
+      assert.strictEqual(await hookAsync(env), '');
+      assert.ok(!(await isUp(port)) && !fs.existsSync(f.pidfile));
+    } finally { killPid(f.pidfile); }
+  }
+});
+
+test('TASK_2468: port already answering -> nothing spawned, no extra line', async () => {
+  const port = await freePort(); const f = fakeHome(true);
+  const srv = require('http').createServer((q, r) => r.end('{}'));
+  await new Promise((r) => srv.listen(port, '127.0.0.1', r));
+  try {
+    const out = await hookAsync({ HOME: f.home, USERPROFILE: f.home, KENAZ_BACKEND_PORT: String(port), PIDFILE: f.pidfile });
+    assert.strictEqual(out, ''); assert.ok(!fs.existsSync(f.pidfile));
+  } finally { srv.close(); }
+});

package/core/plugins/kenaz-peer/hooks/register.test.ts

@@ -17,6 +17,7 @@ function setup(on: any, rows: () => unknown[], marker?: () => string | null) {
     const url = String(e.url)
     calls.push(`${e.init?.method ?? 'GET'} ${url}`)
     const reply = (o: unknown) => ({ value: { status: 200, ok: true, headers: {}, text: JSON.stringify(o) } })
+    if (url.includes('/api/health')) return healthOk ? reply({ status: 'ok' }) : { value: { status: 500, ok: false, headers: {}, text: '' } }
     if (url.includes('/pending')) return reply({ messages: delivered ? [] : [msg] })
     if (url.includes('/ack')) { delivered = true; return reply({ acked: ['m1'], already_delivered: [], unknown: [] }) }
     return reply({ ok: true })
@@ -54,7 +55,7 @@ test('heartbeat precedes submit, ack carries the submitted id, second cycle is e
   expect(calls.filter(c => c.includes('/ack')).length).toBe(1)
 })
 
-function uiSetup(on: any, rows: unknown[], statusOk = true) {
+function uiSetup(on: any, rows: unknown[], statusOk = true, healthOk = true) {
   const status: unknown[] = []
   const toasts: string[] = []
   on('session.start', async (_$: any, e: any) => ({ cwd: e.cwd }))
@@ -69,6 +70,7 @@ function uiSetup(on: any, rows: unknown[], statusOk = true) {
     if (url.includes('/pending')) return reply({ messages: delivered ? [] : [{ id: 'm1', framed: 'hi', from_node: 'node-b' }] })
     if (url.includes('/ack')) { delivered = true; return reply({ acked: ['m1'] }) }
     if (url.includes('/status')) return statusOk ? reply({ pending_count: 2, sessions: [{ delivery_mode: 'push' }, { delivery_mode: 'none' }] }) : { value: { status: 500, ok: false, headers: {}, text: '' } }
+    if (url.includes('/api/health')) return healthOk ? reply({ status: 'ok' }) : { value: { status: 503, ok: false, headers: {}, text: '' } }
     return reply({ ok: true })
   })
   on('prompt.submit', async (_$: any, e: any) => e)
@@ -90,13 +92,23 @@ test('Ansuz session: status line from /api/peer/status and a toast naming the se
 
 test('Ansuz session with the server down shows kenaz-server down', async ($, on) => {
   const clock = mock.clock(on)
-  const { status } = uiSetup(on, [{ role: 'user', content: '# Ansuz -- Specialist Prompt' }], false)
+  const { status } = uiSetup(on, [{ role: 'user', content: '# Ansuz -- Specialist Prompt' }], false, false)
   await $.session.start(START)
   await clock.advance(5_000)
   await clock.advance(5_000)
   expect(status.some(s => String(s).includes('kenaz-server down'))).toBe(true)
 })
 
+test('TASK_2480: /status failing while /api/health is up shows peer status slow, not down', async ($, on) => {
+  const clock = mock.clock(on)
+  const { status } = uiSetup(on, [{ role: 'user', content: '# Ansuz -- Specialist Prompt' }], false, true)
+  await $.session.start(START)
+  await clock.advance(5_000)
+  await clock.advance(5_000)
+  expect(status.some(s => String(s).includes('peer status slow'))).toBe(true)
+  expect(status.some(s => String(s).includes('kenaz-server down'))).toBe(false)
+})
+
 test('control: non-Ansuz session gets no status and no toast', async ($, on) => {
   const clock = mock.clock(on)
   const { status, toasts } = uiSetup(on, [{ role: 'user', content: 'hello' }])

package/core/plugins/kenaz-peer/hooks/register.ts

@@ -132,7 +132,12 @@ async function refreshStatus($: any): Promise<void> {
   try {
     const root = await project($)
     const st = await jget($, `${BACKEND}/api/peer/status?projectPath=${encodeURIComponent(root)}&limit=1`)
-    if (!st || typeof st !== 'object') { await $.ui.status('Kenaz: kenaz-server down'); return }
+    if (!st || typeof st !== 'object') {
+      // TASK_2480: a failed /status is not "down": only a failed health probe says the server is down.
+      const alive = await jget($, `${BACKEND}/api/health`)
+      await $.ui.status(alive ? 'Kenaz: peer status slow' : 'Kenaz: kenaz-server down')
+      return
+    }
     const name = root.replace(/[\\/]+$/, '').split(/[\\/]/).pop() || root
     const sessions = Array.isArray(st.sessions) ? st.sessions.filter((s: any) => s?.delivery_mode !== 'none') : []
     const pending = Number(st.pending_count) || 0

package/lib/cli.js

@@ -72,8 +72,8 @@ function platformServer() {
 
 function onPath(cmd) {
   const r = process.platform === 'win32' // one string with shell (.cmd shims); args + shell:true is deprecated (DEP0190)
-    ? spawnSync(cmd + ' --version', { encoding: 'utf8', shell: true, timeout: 15000 })
-    : spawnSync(cmd, ['--version'], { encoding: 'utf8', timeout: 15000 });
+    ? spawnSync(cmd + ' --version', { windowsHide: true, encoding: 'utf8', shell: true, timeout: 15000 })
+    : spawnSync(cmd, ['--version'], { windowsHide: true, encoding: 'utf8', timeout: 15000 });
   return r.status === 0;
 }
 
@@ -244,7 +244,7 @@ async function doctor(p, flags, out, deps = {}) {
 
   try { // TASK_2413: which mechanism restarts the server after a reboot (read-only; `deps.sh` / `deps.platform` for tests)
     const sm = installer().detectServiceMode(p.home, p.core, deps.sh, deps.platform);
-    add('service mode', sm.mode === 'manual' ? 'skip' : 'ok', sm.mode + ' (' + sm.detail + ')');
+    add('service mode', sm.mode === 'manual' ? 'skip' : sm.warn ? 'warn' : 'ok', sm.mode + ' (' + sm.detail + ')');
   } catch (e) { add('service mode', 'skip', 'unknown: ' + e.message); }
   const d = dash.detect(p.home, deps.dashboard);
   if (!d.installed) add('dashboard', 'skip', 'no Kenaz Dashboard on this machine');
@@ -262,7 +262,11 @@ async function doctor(p, flags, out, deps = {}) {
   else {
     const d = { disabled: `off: ${upd.reason}`, error: `last check failed: ${upd.last_error}`, staged: `${upd.staged_version} staged, applies when idle`,
       applied: `${upd.applied_version} swapped in (previous ${upd.previous_version}), restart pending`, 'rolled-back': 'rolled back to the previous version' }[upd.state] || `${upd.state}, latest ${upd.latest_version || 'unknown'}`;
-    add('self-update', upd.state === 'disabled' ? 'skip' : 'ok', `${d} [running ${upd.current_version}]`);
+    // A staged version not newer than the running one froze older servers' updater (checks stop while one is staged).
+    const num = (v) => String(v || '').split('.').map(Number);
+    const stale = upd.staged_version && num(upd.staged_version).reduce((c, x, i) => c || x - (num(upd.current_version)[i] || 0), 0) <= 0;
+    if (stale) add('self-update', 'warn', `${upd.staged_version} staged but running ${upd.current_version}: updater stuck; delete ${path.join(p.dir, 'update', 'status.json')} and restart kenaz-server`);
+    else add('self-update', upd.state === 'disabled' ? 'skip' : upd.state === 'error' ? 'warn' : 'ok', `${d} [running ${upd.current_version}]`);
   }
 
   const inst = installer();
@@ -313,7 +317,7 @@ function passthrough(argv, deps) {
   const script = argv[0] === 'ygg' ? 'ygg.js' : 'kenaz-mode.js';
   const args = argv[0] === 'ygg' ? argv.slice(1) : argv;
   const spawn = deps.spawnSync || require('child_process').spawnSync;
-  const r = spawn(process.execPath, [path.join(core, 'plugins', 'kenaz', 'scripts', script), ...args], { stdio: 'inherit', cwd: process.cwd() });
+  const r = spawn(process.execPath, [path.join(core, 'plugins', 'kenaz', 'scripts', script), ...args], { windowsHide: true, stdio: 'inherit', cwd: process.cwd() });
   return r.status === null ? 1 : r.status;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kenaz",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "description": "Install Kenaz (plugin, hooks, kenaz-server) for Claude Code and Codex: npx kenaz install",
   "bin": {
     "kenaz": "bin/kenaz.js"
@@ -20,11 +20,11 @@
     "test": "node --test lib/cli.test.js"
   },
   "optionalDependencies": {
-    "@kenazai/server-darwin-arm64": "0.3.22",
-    "@kenazai/server-darwin-x64": "0.3.22",
-    "@kenazai/server-linux-arm64": "0.3.22",
-    "@kenazai/server-linux-x64": "0.3.22",
-    "@kenazai/server-win32-x64": "0.3.22"
+    "@kenazai/server-darwin-arm64": "0.3.24",
+    "@kenazai/server-darwin-x64": "0.3.24",
+    "@kenazai/server-linux-arm64": "0.3.24",
+    "@kenazai/server-linux-x64": "0.3.24",
+    "@kenazai/server-win32-x64": "0.3.24"
   },
   "license": "UNLICENSED",
   "repository": {